File: //proc/self/root/lib/python3/dist-packages/firewall/server/__pycache__/config.cpython-310.pyc
o
bhAb" � @ sL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZmZmZmZmZmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d dlm3Z3 d dl4m5Z5 G dd� de �Z6dS )� N)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�errors)�
FirewallErrorc s� e Zd ZdZdZ ejjZ e � fdd��Z
e dd� �Z e dd� �Z e d d
� �Z
e d d � �Ze d
d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)ejj�e%ej&dAdB�e!d�dCdD����Z*ej+j,ej&dEdF�dGdH� �Z-e)ejj.�e%ej/d=dI�e!d� fdJdK� ���Z0e%ejj1e2j3dI�e!d�dLdM���Z4e%ejj1e2j3dB�e!d�dNdO���Z5ej+�,ejj1�e!dPdQ� ��Z6e%ejj1d=dB�e!d�dRdS���Z7e%ejj1d=dB�e!d�dTdU���Z8e%ejj1d=dVd9�e!d�dWdX���Z9e%ejj1dYdI�e!d�dZd[���Z:e%ejj1d=dB�e!d�d\d]���Z;e%ejj1d=dB�e!d�d^d_���Z<e%ejj1d=dVd9�e!d�d`da���Z=e%ejj1dYdI�e!d�dbdc���Z>e%ejj1d=dB�e!d�ddde���Z?e%ejj1d=dB�e!d�dfdg���Z@e%ejj1d=dVd9�e!d�dhdi���ZAe%ejj1dYdI�e!d�djdk���ZBe%ejj1dldB�e!d�dmdn���ZCe%ejj1dldB�e!d�dodp���ZDe%ejj1dldVd9�e!d�dqdr���ZEe%ejj1dsdI�e!d�dtdu���ZFe%ejjGdvdI�e!d�dwdx���ZHe%ejjGdYdI�e!d�dydz���ZIe%ejjGd=d{d9�e!d�d|d}���ZJe%ejjGd=eKj3 d{d9�e!d�d~d���ZLej+j,ejjGd=dF�e!d�d�� ��ZMe%ejjGdvdI�e!d�d�d����ZNe%ejjGdYdI�e!d�d�d����ZOe%ejjGd=d{d9�e!d�d�d����ZPe%ejjGd=eQj3 d{d9�e!d�d�d����ZRej+j,ejjGd=dF�e!d�d�� ��ZSe%ejjGdvdI�e!d�d�d����ZTe%ejjGdYdI�e!d�d�d����ZUe%ejjGd=d{d9�e!d�d�d����ZVe%ejjGd�d{d9�e!d�d�d����ZWe%ejjGd�d{d9�e!d�d�d����ZXej+j,ejjGd=dF�e!d�d�� ��ZYe%ejjGdvdI�e!d�d�d����ZZe%ejjGdYdI�e!d�d�d����Z[e%ejjGd=d{d9�e!d�d�d����Z\e%ejjGd=d=d9�e!d�d�d����Z]e%ejjGd=d=d9�e!d�d�d����Z^e%ejjGd�d{d9�e!d�d�d����Z_e%ejjGd�d{d9�e!d�d�d����Z`ej+j,ejjGd=dF�e!d�d�� ��Zae%ejjGdvdI�e!d�d�d����Zbe%ejjGdYdI�e!d�d�d����Zce%ejjGd=d{d9�e!d�d�d����Zde%ejjGd�d{d9�e!d�d�d����Zeej+j,ejjGd=dF�e!d�d�� ��Zfe%ejjGdvdI�e!d�d�d����Zge%ejjGdYdI�e!d�d�d����Zhe%ejjGd=d{d9�e!d�d�d����Zie%ejjGd=ejj3 d{d9�e!d�d�d����Zkej+j,ejjGd=dF�e!d�d�� ��Zlemejjn�e%ejjneoj3dI�e!d�d�d�����Zpemejjn�e%ejjneoj3dB�e!d�d�d���Zqerejjn�ej+�,ejjn�e!d�dĄ ���Zsemejjn�e%ejjnd�dB�e!d�d�dDŽ���Ztemejjn�e%ejjnd�dB�e!d�d�dɄ���Zuemejjn�e%ejjnd�dVd9�e!d�d�d˄���Zvemejjn�e%ejjnd7dYd9�e!d�d�d̈́���Zwemejjn�e%ejjnd�d�d9�e!d�d�dф���Zxemejjn�e%ejjnd�dB�e!d�d�dԄ���Zyemejjn�e%ejjnd�dB�e!d�d�dք���Zzemejjn�e%ejjnd�dVd9�e!d�d�d���Z{emejjn�e%ejjnd�dB�e!d�d�dڄ���Z|emejjn�e%ejjnd�d�d9�e!d�d�d݄���Z}emejjn�e%ejjnd�d�d9�e!d�d�d����Z~emejjn�e%ejjnd�dB�e!d�d�d����Zemejjn�e%ejjnd�dB�e!d�d�d����Z�emejjn�e%ejjnd�dVd9�e!d�d�d����Z�emejjn�e%ejjnd=d�d9�e!d�d�d����Z�emejjn�e%ejjnd�dI�e!d�d�d����Z�� Z�S )��FirewallDConfigzFirewallD main classTc s� t t| �j|i |�� || _|d | _|d | _| �� t| jd�| _ | j �
tj � | j �
tj � | j �
tj
� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� tj�tj�r�tt�tj��D ]}dtj|f }tj�|�r�| j �
|� q�| j � tj � | j � tj � | j � tj � t | tj!j"ddddddddddddd� � d S )Nr � � z%s/%s� readwrite) �
CleanupOnExit�CleanupModulesOnExit�
IPv6_rpfilter�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting)#�superr" �__init__r �busname�path�
_init_varsr �
watch_updater�watcher�
add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdir�add_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�self�conf�args�kwargs�filenamer5 �� __class__� �8/usr/lib/python3/dist-packages/firewall/server/config.pyr3 D sV
���zFirewallDConfig.__init__c C s g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _
d| _ | j �
� D ] }| �| j �|�� q)| j �� D ] }| �| j �|�� q:| j �� D ] }| �| j �|�� qK| j �� D ] }| �| j �|�� q\| j �� D ] }| �| j �|�� qm| j � � D ] }| � | j � |�� q~d S �Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers�
helper_idx�policy_objects�policy_object_idxr �
get_ipsets� _addIPSet� get_ipset�
get_icmptypes� _addIcmpType� get_icmptype� get_services� _addService� get_service� get_zones�_addZone�get_zone� get_helpers�
_addHelper�
get_helper�get_policy_objects�
_addPolicy�get_policy_object)rQ �ipset�icmptype�service�zone�helper�policyrX rX rY r6 r s2 �zFirewallDConfig._init_varsc C s d S �NrX �rQ rX rX rY �__del__� s zFirewallDConfig.__del__c C s, t | j�dkr| j�� }|�� ~t | j�dkst | j�dkr0| j�� }|�� ~t | j�dks t | j�dkrH| j�� }|�� ~t | j�dks7t | j�dkr`| j�� }|�� ~t | j�dksOt | j�dkrx| j�� }|�� ~t | j�dksgt | j�dkr�| j�� }|�� ~t | j�dks| � � d S rZ )
�lenr[ �pop�
unregisterr] r_ ra rc re r6 )rQ �itemrX rX rY �reload� s>
�
�
�
�
�
� zFirewallDConfig.reloadc
C s� |t jkri| �t jj�}t�dt j� z| j �� W n ty6 } zt� d||f � W Y d }~d S d }~ww | �t jj��
� }t |� � �D ]}||v rW|| || krW||= qFt
|�dkrg| �t jj|g � d S |�t j�su|�t j�r�|�d�r�z
| j �|�\}}W n ty� } zt� d||f � W Y d }~d S d }~ww |dkr�| �|� d S |dkr�| �|� d S |dkr�| �|� d S d S |�t j�s�|�t j��r$|�d��r$z
| j �|�\}}W n ty� } zt� d ||f � W Y d }~d S d }~ww |dk�r
| �|� d S |dk�r| �|� d S |dk�r"| � |� d S d S |�t j ��s2|�t j ��r�|�d��r�z
| j � |�\}}W n t�y_ } zt� d
||f � W Y d }~d S d }~ww |dk�rl| � |� d S |dk�rx| �!|� d S |dk�r�| �"|� d S d S |�t j ��r�|�#t j d ��$d �}t
|�d
k �s�d |v �r�d S t%j&�'|��r�| j(�)|��s�| j(�*|� d S d S | j(�)|��r�| j(�+|� d S d S d S |�t j,��s�|�t j-��r2|�d��r2z
| j �.|�\}}W n t�y } zt� d||f � W Y d }~d S d }~ww |dk�r| �/|� d S |dk�r$| �0|� d S |dk�r0| �1|� d S d S |�t j2��s@|�t j3��r�|�d��r�z
| j �4|�\}}W n t�ym } zt� d||f � W Y d }~d S d }~ww |dk�rz| �5|� d S |dk�r�| �6|� d S |dk�r�| �7|� d S d S |t j8k�r�z| j �9� W n t�y� } zt� d||f � W Y d }~d S d }~ww | �:� d S |t j;k�r�z| j �<� W n t�y� } zt� d||f � W Y d }~d S d }~ww | �=� d S |�t j>��s|�t j?��rX|�d��rVz
| j �@|�\}}W n t�y1 } zt� d||f � W Y d }~d S d }~ww |dk�r>| �A|� d S |dk�rJ| �B|� d S |dk�rZ| �C|� d S d S d S d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r# z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rN �GetAllrO rP r �debug1�update_firewalld_conf� Exception�error�copy�list�keysr� �PropertiesChanged�
startswithr< r= �endswith�update_icmptype_from_pathrk �removeIcmpType�_updateIcmpTyper@ rA �update_service_from_pathrn �
removeService�_updateServicerB rC �update_zone_from_pathrq �
removeZone� _updateZone�replace�striprF r5 rJ r8 � has_watchr9 � remove_watchr: r; �update_ipset_from_pathrh � removeIPSet� _updateIPSetr> r? �update_helper_from_pathrt � removeHelper�
_updateHelperrL �update_lockdown_whitelist�LockdownWhitelistUpdatedrM �
update_direct�UpdatedrD rE � update_policy_object_from_pathrw � removePolicy�
_updatePolicy) rQ �name� old_props�msg�props�key�what�obj�_namerX rX rY r7 � s`
�����
�
�����
����
�
� ��
���
�����
�
�����
� ��� ���
����
� z FirewallDConfig.watch_updaterc C �P t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S �Nz%s/%dr# )
r
r r^ r4 rO �DBUS_PATH_CONFIG_ICMPTYPEr] �append�
IcmpTypeAddedr� )rQ r� �config_icmptyperX rX rY rk ? s �� z FirewallDConfig._addIcmpTypec C �L | j D ] }|jj|jkr#|jj|jkr#|jj|jkr#||_|�|j� qd S r )r] r� r� r5 rU r� )rQ r� rz rX rX rY r� K �
��z FirewallDConfig._updateIcmpTypec C �� d}| j D ]%}|�� }|j|| v r*|| �|j� | j�|j|�|_|�|jj� q| jD ])}|�� }d|v rW|j|d v rW|d �|j� | j� |j|�|_|�|jj� q.| j
D ]}|j|krs|� |j� |� � | j
�|� ~q[d S )N� � icmp_blocks)
ra � getSettingsr� r� r �set_zone_configr� r� re � set_policy_object_config_dictr] �Removedr� )rQ r� �indexr| �settingsr~ rz rX rX rY r� T �.
�
�
��z FirewallDConfig.removeIcmpTypec C r� r� )
r r r` r4 rO �DBUS_PATH_CONFIG_SERVICEr_ r� � ServiceAddedr� )rQ r� �config_servicerX rX rY rn n � � zFirewallDConfig._addServicec C r� r )r_ r� r� r5 rU r� )rQ r� r{ rX rX rY r� y r� z FirewallDConfig._updateServicec C r� )Nr$ r_ )
ra r� r� r� r r� r� r� re r� r_ r� r� )rQ r� r� r| r� r~ r{ rX rX rY r� � r� z FirewallDConfig.removeServicec C r� r� )
r r rb r4 rO �DBUS_PATH_CONFIG_ZONEra r� � ZoneAddedr� )rQ r� � config_zonerX rX rY rq � r� zFirewallDConfig._addZonec C r� r )ra r� r� r5 rU r� �rQ r� r| rX rX rY r� � �
��zFirewallDConfig._updateZonec C �< | j D ]}|j|kr|�|j� |�� | j �|� ~qd S r )ra r� r� r� r� r� r� rX rX rY r� � �
��zFirewallDConfig.removeZonec C r� r� )
r r rf r4 rO �DBUS_PATH_CONFIG_POLICYre r� � PolicyAddedr� )rQ r� �
config_policyrX rX rY rw � r� zFirewallDConfig._addPolicyc C r� r )re r� r� r5 rU r� �rQ r� r~ rX rX rY r� � r� z FirewallDConfig._updatePolicyc C r� r )re r� r� r� r� r� r� rX rX rY r� � r� z FirewallDConfig.removePolicyc C r� r� )
r r r\ r4 rO �DBUS_PATH_CONFIG_IPSETr[ r� �
IPSetAddedr� )rQ r� � config_ipsetrX rX rY rh � r� zFirewallDConfig._addIPSetc C r� r )r[ r� r� r5 rU r� �rQ r� ry rX rX rY r� � r� z FirewallDConfig._updateIPSetc C r� r )r[ r� r� r� r� r� r� rX rX rY r� � r� zFirewallDConfig.removeIPSetc C r� r� )
r r rd r4 rO �DBUS_PATH_CONFIG_HELPERrc r� � HelperAddedr� )rQ r� �
config_helperrX rX rY rt � r� zFirewallDConfig._addHelperc C r� r )rc r� r� r5 rU r� �rQ r� r} rX rX rY r� � r� z FirewallDConfig._updateHelperc C r� r )rc r� r� r� r� r� r� rX rX rY r� r� z FirewallDConfig.removeHelperc C s� | j �� rQ|d u rt�d� d S t�� }t||�}| j �d|�r"d S t||�}| j �d|�r0d S t |�}| j �d|�r=d S t
||�}| j �d|�rKd S t t j
d��d S )Nz&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r �lockdown_enabledr r� rO � SystemBusr � access_checkr r r r! r �
ACCESS_DENIED)rQ �sender�busr� r� r� r� rX rX rY � accessCheck s&
�zFirewallDConfig.accessCheckc C s |dvr t j�d| ��| j�� �|�}|dkr$|d u r tj}t �|�S |dkr9|d u r0tj}nt |�}t �
|�S |dkrM|d u rHtj rFdnd}t �|�S |dkra|d u r\tj rZdnd}t �|�S |d kru|d u rptj
rndnd}t �|�S |d
kr�|d u r�tjr�dnd}t �|�S |d kr�|d u r�tjr�dnd}t �|�S |d kr�|d u r�tj}t �|�S |d
kr�|d u r�tj}t �|�S |dkr�|d u r�tj}t �|�S |dkr�|d u r�tjr�dnd}t �|�S |dkr�|d u r�tjr�dnd}t �|�S |dk�r |d u �rtj�rdnd}t �|�S d S )N�
� DefaultZoner* r& r' r) r( r+ r, r- r. r/ r0 r1 �Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existr� r* r& �yes�nor' r) r( r+ r, r- r. r/ r0 r1 )rO �
exceptions�
DBusExceptionr �get_firewalld_conf�get�
FALLBACK_ZONE�String�FALLBACK_MINIMAL_MARK�int�Int32�FALLBACK_CLEANUP_ON_EXIT� FALLBACK_CLEANUP_MODULES_ON_EXIT�FALLBACK_LOCKDOWN�FALLBACK_IPV6_RPFILTER�FALLBACK_INDIVIDUAL_CALLS�FALLBACK_LOG_DENIED�FALLBACK_AUTOMATIC_HELPERS�FALLBACK_FIREWALL_BACKEND� FALLBACK_FLUSH_ALL_ON_RELOAD�FALLBACK_RFC3964_IPV4� FALLBACK_ALLOW_ZONE_DRIFTING)rQ �prop�valuerX rX rY �
_get_property) sz ��
�z FirewallDConfig._get_propertyc C sH |dkr t �| �|��S |dkrt �| �|��S |dkr$t �| �|��S |dkr0t �| �|��S |dkr<t �| �|��S |dkrHt �| �|��S |dkrTt �| �|��S |dkr`t �| �|��S |d krlt �| �|��S |d
krxt �| �|��S |d kr�t �| �|��S |d kr�t �| �|��S |d
kr�t �| �|��S t j�d| ��)Nr� r* r& r' r) r( r+ r, r- r. r/ r0 r1 r� )rO r� r r� r� r� )rQ r rX rX rY �_get_dbus_propertym s> ��z"FirewallDConfig._get_dbus_property�ss�v)� in_signature�
out_signatureNc C sl t |t�}t |t�}t�d||� |tjjkr | �|�S |tjjtjj fv r.tj
� d| ��tj
� d| ��)Nzconfig.Get('%s', '%s')r� �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr r� r rO rP r � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rQ �interface_name�
property_namer� rX rX rY �Get� s$
�����zFirewallDConfig.Get�sza{sv}c C st t |t�}t�d|� i }|tjjkr dD ] }| �|�||< qn|tjjtjj fv r+ntj
� d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r �sv�� signature)
r r r r� r rO rP r r r r� r� �
Dictionary)rQ r r� �ret�xrX rX rY r� � s"
����zFirewallDConfig.GetAll�ssv)r c C sZ t |t�}t |t�}t |�}t�d|||� | �|� |tjjkr�|dv r�|dv r:|�� dvr9t t
j d||f ��n0|dkrN|tj vrMt t
j d||f ��n |dkrb|tj
vrat t
j d||f ��ntj�d| ��| j�� �||� | j�� �� | �|||ig � d S |d v r�d S tj�d| ��|tjjtjjfv r�tj�d| ��tj�d
| ��) Nz config.Set('%s', '%s', '%s')) r& r' r) r( r+ r, r. r/ r0 )r& r' r) r( r+ r/ r0 )r� r� �true�falsez '%s' for %sr, r. r� )r* r- r1 r )r r r r� r� r rO rP �lowerr! r �
INVALID_VALUE�LOG_DENIED_VALUES�FIREWALL_BACKEND_VALUESr� r� r� �set�writer� r r )rQ r r � new_valuer� rX rX rY �Set� s~
�
���
���
�������������zFirewallDConfig.Setzsa{sv}asr c C s. t |t�}t |�}t |�}t�d|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s')�r r r r� )rQ r �changed_properties�invalidated_propertiesrX rX rY r� � s
�z!FirewallDConfig.PropertiesChanged)r
c s` t �d� tt| ��| j| j�� �}t| |t j
j �}t j
j fD ]}t
| ||t� jt� j�}q |S )Nzconfig.Introspect())r �debug2r2 r" �
Introspectr5 r4 �get_busr r rO rP r r r
�
deprecatedr )rQ r� �data� interfacerV rX rY r+ s
�
��zFirewallDConfig.Introspectc C s t �d� | j�� j�� S )Nz&config.policies.getLockdownWhitelist())r r� r � get_policies�lockdown_whitelist�
export_config�rQ r� rX rX rY �getLockdownWhitelist s
z$FirewallDConfig.getLockdownWhitelistc C sB t �d� t|�}| j�� j�|i � | j�� j�� | �� d S )Nz)config.policies.setLockdownWhitelist(...)) r r� r r r0 r1 �
import_configr$ r� �rQ r� r� rX rX rY �setLockdownWhitelist" s
z$FirewallDConfig.setLockdownWhitelistc C � t �d� d S )Nz*config.policies.LockdownWhitelistUpdated()�r r� r� rX rX rY r� , s z(FirewallDConfig.LockdownWhitelistUpdatedc C �^ t |�}t�d|� | �|� t| �� �}||d v r!ttj|��|d � |� | �
|� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r � r r r� r� r� r4 r! r �ALREADY_ENABLEDr� r7 �rQ r� r� r� rX rX rY �addLockdownWhitelistCommand3 �
z+FirewallDConfig.addLockdownWhitelistCommandc C �^ t |�}t�d|� | �|� t| �� �}||d vr!ttj|��|d � |� | �
|� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r � r r r� r� r� r4 r! r � NOT_ENABLEDr� r7 r= rX rX rY � removeLockdownWhitelistCommand@ � �
z.FirewallDConfig.removeLockdownWhitelistCommand�bc C �$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistCommand('%s')r �r r r� r4 )rQ r� r� rX rX rY � queryLockdownWhitelistCommandN �
�z-FirewallDConfig.queryLockdownWhitelistCommand�asc C � t �d� | �� d S )Nz.config.policies.getLockdownWhitelistCommands()r �r r� r4 r3 rX rX rY � getLockdownWhitelistCommandsW �
z,FirewallDConfig.getLockdownWhitelistCommandsc C r: )Nz1config.policies.addLockdownWhitelistContext('%s')r# r; �rQ r� r� r� rX rX rY �addLockdownWhitelistContext` r? z+FirewallDConfig.addLockdownWhitelistContextc C r@ )Nz4config.policies.removeLockdownWhitelistContext('%s')r# rA rO rX rX rY � removeLockdownWhitelistContextm rD z.FirewallDConfig.removeLockdownWhitelistContextc C rF )Nz3config.policies.queryLockdownWhitelistContext('%s')r# rG )rQ r� r� rX rX rY � queryLockdownWhitelistContext{ rI z-FirewallDConfig.queryLockdownWhitelistContextc C rK )Nz.config.policies.getLockdownWhitelistContexts()r# rL r3 rX rX rY � getLockdownWhitelistContexts� rN z,FirewallDConfig.getLockdownWhitelistContextsc C r: )Nz.config.policies.addLockdownWhitelistUser('%s')� r; �rQ r� r� r� rX rX rY �addLockdownWhitelistUser� r? z(FirewallDConfig.addLockdownWhitelistUserc C r@ )Nz1config.policies.removeLockdownWhitelistUser('%s')rT rA rU rX rX rY �removeLockdownWhitelistUser� r? z+FirewallDConfig.removeLockdownWhitelistUserc C rF )Nz0config.policies.queryLockdownWhitelistUser('%s')rT rG )rQ r� r� rX rX rY �queryLockdownWhitelistUser� � z*FirewallDConfig.queryLockdownWhitelistUserc C rK )Nz+config.policies.getLockdownWhitelistUsers()rT rL r3 rX rX rY �getLockdownWhitelistUsers� rN z)FirewallDConfig.getLockdownWhitelistUsers�ic C r: )Nz+config.policies.addLockdownWhitelistUid(%d)� r; �rQ r� r� r� rX rX rY �addLockdownWhitelistUid� r? z'FirewallDConfig.addLockdownWhitelistUidc C r@ )Nz.config.policies.removeLockdownWhitelistUid(%d)r\ rA r] rX rX rY �removeLockdownWhitelistUid� r? z*FirewallDConfig.removeLockdownWhitelistUidc C rF )Nz-config.policies.queryLockdownWhitelistUid(%d)r\ rG )rQ r� r� rX rX rY �queryLockdownWhitelistUid� rY z)FirewallDConfig.queryLockdownWhitelistUid�aic C rK )Nz*config.policies.getLockdownWhitelistUids()r\ rL r3 rX rX rY �getLockdownWhitelistUids� rN z(FirewallDConfig.getLockdownWhitelistUids�aoc C � t �d� | jS )z"list ipsets objects paths
zconfig.listIPSets())r r� r[ r3 rX rX rY �
listIPSets� �
zFirewallDConfig.listIPSetsc C �0 t �d� g }| jD ] }|�|jj� q
t|�S )zget ipset names
zconfig.getIPSetNames())r r� r[ r� r� r� rH )rQ r� r[ r� rX rX rY �
getIPSetNames� �
z FirewallDConfig.getIPSetNames�oc C �B t |t�}t�d|� | jD ] }|jj|kr| S qttj |��)z-object path of ipset with given name
zconfig.getIPSetByName('%s'))
r r r r� r[ r� r� r! r �
INVALID_IPSET)rQ ry r� r� rX rX rY �getIPSetByName� �
� z FirewallDConfig.getIPSetByNamec C �D t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z/add ipset with given name and settings
zconfig.addIPSet('%s'))r r r r� r� r � new_ipsetrh )rQ ry r� r� r� r� rX rX rY �addIPSet �
zFirewallDConfig.addIPSetc C � t |t�}t�d| � d S )Nzconfig.IPSetAdded('%s')r' )rQ ry rX rX rY r� �
zFirewallDConfig.IPSetAddedc C rd )z%list icmptypes objects paths
zconfig.listIcmpTypes())r r� r] r3 rX rX rY �
listIcmpTypes rf z FirewallDConfig.listIcmpTypesc C rg )zget icmptype names
zconfig.getIcmpTypeNames())r r� r] r� r� r� rH )rQ r� r] r� rX rX rY �getIcmpTypeNames$ ri z FirewallDConfig.getIcmpTypeNamesc C rk )z0object path of icmptype with given name
z config.getIcmpTypeByName('%s'))
r r r r� r] r� r� r! r �INVALID_ICMPTYPE)rQ rz r� r� rX rX rY �getIcmpTypeByName/ rn z!FirewallDConfig.getIcmpTypeByNamec C ro )z2add icmptype with given name and settings
zconfig.addIcmpType('%s'))r r r r� r� r � new_icmptyperk )rQ rz r� r� r� r� rX rX rY � addIcmpType< rr zFirewallDConfig.addIcmpTypec C � t �d| � d S )Nzconfig.IcmpTypeAdded('%s')r9 )rQ rz rX rX rY r� K � z FirewallDConfig.IcmpTypeAddedc C rd )z$list services objects paths
zconfig.listServices())r r� r_ r3 rX rX rY � listServicesR rf z FirewallDConfig.listServicesc C rg )zget service names
zconfig.getServiceNames())r r� r_ r� r� r� rH )rQ r� r_ r� rX rX rY �getServiceNamesZ ri z FirewallDConfig.getServiceNamesc C rk )z/object path of service with given name
z config.getServiceByName('%s'))
r r r r� r_ r� r� r! r �INVALID_SERVICE)rQ r{ r� r� rX rX rY �getServiceByNamee rn z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C ro )�1add service with given name and settings
zconfig.addService('%s'))r r r r� r� r � new_servicern �rQ r{ r� r� r� r� rX rX rY �
addServicer rr zFirewallDConfig.addServicezsa{sv}c C ro )r� zconfig.addService2('%s'))r r r r� r� r �new_service_dictrn r� rX rX rY � addService2� rr zFirewallDConfig.addService2c C r{ )Nzconfig.ServiceAdded('%s')r9 )rQ r{ rX rX rY r� � r| z FirewallDConfig.ServiceAddedc C rd )z!list zones objects paths
zconfig.listZones())r r� ra r3 rX rX rY � listZones� rf zFirewallDConfig.listZonesc C rg )zget zone names
zconfig.getZoneNames())r r� ra r� r� r� rH )rQ r� ra r� rX rX rY � getZoneNames� ri z FirewallDConfig.getZoneNamesc C rk )z,object path of zone with given name
zconfig.getZoneByName('%s'))
r r r r� ra r� r� r! r � INVALID_ZONE)rQ r| r� r� rX rX rY �
getZoneByName� rn z FirewallDConfig.getZoneByNamec C �v t |t�}t�d|� g }| jD ]}||jjv r |�|jj� qt |�dkr3d�
|�d|t |�f S |r9|d S dS )z4name of zone the given interface belongs to
z config.getZoneOfInterface('%s')r# � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r r� ) r r r r� ra r� �
interfacesr� r� r� �join)rQ �ifacer� r r� rX rX rY �getZoneOfInterface� �
�
��z"FirewallDConfig.getZoneOfInterfacec C r� )z1name of zone the given source belongs to
z config.getZoneOfSource('%s')r# r� zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r r� ) r r r r� ra r� �sourcesr� r� r� r� )rQ �sourcer� r r� rX rX rY �getZoneOfSource� r� z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}t�d|� | �|� |d dkr&t|�}t|d< t|�}| j� ||�}| �
|�}|S )�.add zone with given name and settings
�config.addZone('%s')� �default) r r r r� r� r� r �tupler �new_zonerq )rQ r| r� r� � _settingsr� r� rX rX rY �addZone� s
zFirewallDConfig.addZonec C s` t |t�}t |�}t�d|� | �|� d|v r"|d dkr"t|d< | j�||�}| �|�}|S )r� r� �targetr� ) r r r r� r� r r �
new_zone_dictrq )rQ r| r� r� r� r� rX rX rY �addZone2� s
zFirewallDConfig.addZone2c C r{ )Nzconfig.ZoneAdded('%s')r9 )rQ r| rX rX rY r� r| zFirewallDConfig.ZoneAddedc C rd )z$list policies objects paths
zconfig.listPolicies())r r� re r3 rX rX rY � listPolicies rf z FirewallDConfig.listPoliciesc C rg )zget policy names
zconfig.getPolicyNames())r r� re r� r� r� rH )rQ r� �policiesr� rX rX rY �getPolicyNames ri z FirewallDConfig.getPolicyNamesc C rk )z.object path of policy with given name
z config.getPolicyByName('%s'))
r r r r� re r� r� r! r �INVALID_POLICY)rQ r~ r� r� rX rX rY �getPolicyByName rn z FirewallDConfig.getPolicyByNamec C ro )z0add policy with given name and settings
zconfig.addPolicy('%s'))r r r r� r� r �new_policy_object_dictrw )rQ r~ r� r� r� r� rX rX rY � addPolicy+ rr zFirewallDConfig.addPolicyc C r{ )Nzconfig.PolicyAdded('%s')r9 )rQ r~ rX rX rY r� : r| zFirewallDConfig.PolicyAddedc C rd )z#list helpers objects paths
zconfig.listHelpers())r r� rc r3 rX rX rY � listHelpersC rf zFirewallDConfig.listHelpersc C rg )zget helper names
zconfig.getHelperNames())r r� rc r� r� r� rH )rQ r� rc r� rX rX rY �getHelperNamesK ri z FirewallDConfig.getHelperNamesc C rk )z.object path of helper with given name
z config.getHelperByName('%s'))
r r r r� rc r� r� r! r �INVALID_HELPER)rQ r} r� r� rX rX rY �getHelperByNameV rn z FirewallDConfig.getHelperByNamec C ro )z0add helper with given name and settings
zconfig.addHelper('%s'))r r r r� r� r �
new_helperrt )rQ r} r� r� r� r� rX rX rY � addHelperc rr zFirewallDConfig.addHelperc C rs )Nzconfig.HelperAdded('%s')r' )rQ r} rX rX rY r� r rt zFirewallDConfig.HelperAddedc C s t �d� | j�� �� S )Nzconfig.direct.getSettings())r r� r �
get_directr2 r3 rX rX rY r� { s
zFirewallDConfig.getSettingsc C s> t �d� t|�}| j�� �|i � | j�� �� | �� d S )Nzconfig.direct.update())r r� r r r� r5 r$ r� r6 rX rX rY r� � s
zFirewallDConfig.updatec C r8 )Nzconfig.direct.Updated()r9 r� rX rX rY r� � s zFirewallDConfig.Updated�sssc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d v r9ttj d|||f ��|d �
|� | � |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r r� r� r� r� r� r! r r< r� r� �rQ �ipv�table�chainr� �idxr� rX rX rY �addChain� s" �
��zFirewallDConfig.addChainc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d vr9ttj d|||f ��|d �
|� | � |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r r� r� r� r� r� r! r rB r� r� r� rX rX rY � removeChain� s" �
��zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}t�d|||f � t|||f�}|| �� d v S )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r r� r� r� )rQ r� r� r� r� r� rX rX rY �
queryChain� s �zFirewallDConfig.queryChainc C sb t |�}t |�}t�d||f � g }| �� d D ]}|d |kr.|d |kr.|�|d � q|S )Nz#config.direct.getChains('%s', '%s')r r# rT �r r r� r� r� )rQ r� r� r� r r� rX rX rY � getChains� s �zFirewallDConfig.getChainsr� za(sss)c C rK )Nz config.direct.getAllChains()r �r r� r� r3 rX rX rY � getAllChains� �
z FirewallDConfig.getAllChains�sssiasc
C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d v rGttj d||||f ��|d �
|� | � t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')�','r# z"rule '%s' already is in '%s:%s:%s')
r r r� r� r� r� r� r! r r< r� r� r� � rQ r� r� r� �priorityrS r� r� r� rX rX rY �addRule� �& �
��zFirewallDConfig.addRulec
C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d vrGttj d||||f ��|d �
|� | � t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')r� r# z rule '%s' is not in '%s:%s:%s')
r r r� r� r� r� r� r! r rB r� r� r� r� rX rX rY �
removeRule� r� zFirewallDConfig.removeRulec
C sd t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � |||||f}|| �� d v S )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')r� r# �r r r� r� r� )rQ r� r� r� r� rS r� r� rX rX rY � queryRule s �zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}t�d|||f � | �|� t| �� �}|d d d � D ]}|||f|d |d |d fkrB|d �|� q)| �t|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r# r rT ) r r r� r� r� r� r� r� r� )rQ r� r� r� r� r� �rulerX rX rY � removeRules s �
�zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}t�d|||f � g }| �� d D ] }|d |kr=|d |kr=|d |kr=|�|d |d f� q |S )Nz(config.direct.getRules('%s', '%s', '%s')r# r rT r\ r� r� )rQ r� r� r� r� r r� rX rX rY �getRules1 s �$�zFirewallDConfig.getRulesz a(sssias)c C rK )Nzconfig.direct.getAllRules()r# r� r3 rX rX rY � getAllRulesA r� zFirewallDConfig.getAllRules�sasc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d v r3ttj d||f ��|d �
|� | � |� d S )Nz(config.direct.addPassthrough('%s', '%s')r� rT �passthrough '%s', '%s') r r r� r� r� r� r� r! r r< r� r� �rQ r� rS r� r� r� rX rX rY �addPassthroughK � �
�z FirewallDConfig.addPassthroughc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d vr3ttj d||f ��|d �
|� | � |� d S )Nz+config.direct.removePassthrough('%s', '%s')r� rT r� ) r r r� r� r� r� r� r! r rB r� r� r� rX rX rY �removePassthrough^ r� z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}t�d|d�|�f � ||f}|| �� d v S )Nz*config.direct.queryPassthrough('%s', '%s')r� rT r� )rQ r� rS r� r� rX rX rY �queryPassthroughp s �z FirewallDConfig.queryPassthrough�aasc C sJ t |�}t�d| � g }| �� d D ]}|d |kr"|�|d � q|S )Nz#config.direct.getPassthroughs('%s')rT r r# r� )rQ r� r� r r� rX rX rY �getPassthroughs| s �z FirewallDConfig.getPassthroughsza(sas)c C rK )Nz"config.direct.getAllPassthroughs()rT r� r3 rX rX rY �getAllPassthroughs� r� z"FirewallDConfig.getAllPassthroughsr )��__name__�
__module__� __qualname__�__doc__�
persistentr rO �PK_ACTION_CONFIG� default_polkit_auth_requiredr r3 r6 r� r� r7 rk r� r� rn r� r� rq r� r� rw r� r� rh r� r� rt r� r� r r� r r r �PROPERTIES_IFACEr r� r r& r{ �signalr� �PK_ACTION_INFO�INTROSPECTABLE_IFACEr+ r r �DBUS_SIGNATUREr4 r7 r� r> rC rH rM rP rQ rR rS rV rW rX rZ r^ r_ r` rb rP re rh rm r rq r� ru rv rx r rz r� r} r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r
r r r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__rX rX rV rY r" < sT -
C
��
<
�� �
� ���
� ���
�
���
�
��
�
�
�
�
�
� �
�
�
���
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�r" )7rF rO � dbus.service�firewallr �firewall.core.baser �firewall.core.watcherr �firewall.core.loggerr �firewall.server.dbusr �firewall.server.decoratorsr r r r
r r � firewall.server.config_icmptyper
� firewall.server.config_servicer �firewall.server.config_zoner � firewall.server.config_policyr � firewall.server.config_ipsetr � firewall.server.config_helperr �firewall.core.io.icmptyper �firewall.core.io.ipsetr �firewall.core.io.helperr �#firewall.core.io.lockdown_whitelistr �firewall.core.io.directr �firewall.dbus_utilsr r r r r r r r r �firewall.errorsr! r" rX rX rX rY �<module> s0 (