�
�c�`c # @ sX d d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" g# Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d% l m
Z
d# d& l m Z m
Z
e j d' k Z d( � Z d) � Z d* d+ � Z d, � Z d- � Z d. � Z d/ � Z d0 � Z d1 � Z d2 � Z d3 � Z d4 � Z d5 � Z d6 � Z d7 � Z d8 � Z d9 � Z d: � Z! d; � Z" d< � Z# d= � Z$ d> � Z% d? � Z& d@ � Z' dA � Z( dB � Z) dC � Z* dD � Z+ dE � Z, dF � Z- dG � Z. dH � Z/ dI � Z0 dJ � Z1 dK � Z2 dL � Z3 dM � Z4 d$ S(N t PY2t getPortIDt getPortRanget portStrt getServiceNamet checkIPt checkIP6t checkIPnMaskt
checkIP6nMaskt
checkProtocolt checkInterfacet checkUINT32t firewalld_is_activet tempFilet readfilet writefilet enable_ip_forwardingt get_nf_conntrack_helper_settingt set_nf_conntrack_helper_settingt
check_portt
check_addresst check_single_addresst check_mact uniqifyt ppid_of_pidt max_zone_name_lent checkUsert checkUidt checkCommandt checkContextt joinArgst splitArgst b2ut u2bt
u2b_if_py2i����N( t log( t FIREWALLD_TEMPDIRt FIREWALLD_PIDFILEt 3c C s� t | t � r | } nd | r- | j � } n y t | � } Wn< t k
r{ y t j | � } Wq| t j k
rw d SXn X| d k r� d S| S( s� Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
i����i�� i����( t
isinstancet intt stript
ValueErrort sockett
getservbynamet error( t portt _id( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR . s
c C s> t | t � s | j � r> t | � } | d k r: | f S| S| j d � } t | � d k r� | d j � r� | d j � r� t | d � } t | d � } | d k r� | d k r� | | k r� | | f S| | k r� | | f S| f Sq� n g } xt t | � d d � D]� } t d j | | � � } d j | | � } t | � d k r�t | � } | d k r| d k r| | k r�| j | | f � q�| | k r�| j | | f � q�| j | f � qq| d k r| j | f � | t | � k rPqqqWt | � d k r d St | � d k r6d S| d S( sI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
i t -i i i����N(
R' R( t isdigitR t splitt lent ranget joint appendt None( t portst id1t splitst id2t matchedt it port2( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR E sH 2
t :c C sr | d k r d St | � } t | t � r; | d k r; d St | � d k rU d | Sd | d | | d f Sd S( s Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
t i i s %ss %s%s%sN( R R' R( R7 R3 ( R. t delimitert _range( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR { s c C s� t | � } t | � } t | � d k r> | t | d � k St | � d k r� | t | d � k r� | t | d � k r� t St S( Ni i i ( R R R3 t Truet False( R. R4 t _portRB ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt portInPortRange� s ,c C s8 y t j t | � | � } Wn t j k
r3 d SX| S( s� Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N( R+ t
getservbyportR( R- R7 ( R. t protot name( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s3 y t j t j | � Wn t j k
r. t SXt S( sl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
( R+ t inet_ptont AF_INETR- RD RC ( t ip( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s
| j d � S( s� Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
s []( R) ( RL ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt normalizeIP6� s c C s9 y t j t j t | � � Wn t j k
r4 t SXt S( sl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
( R+ RJ t AF_INET6RM R- RD RC ( RL ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s� d | k ra | | j d � } | | j d � d } t | � d k sZ t | � d k rm t Sn | } d } t | � s} t S| r� d | k r� t | � Sy t | � } Wn t k
r� t SX| d k s� | d k r� t Sn t S( Nt /i t .i i ( t indexR3 RD R7 R R( R* RC ( RL t addrt maskR= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s& $
c C s� d | k ra | | j d � } | | j d � d } t | � d k sZ t | � d k rm t Sn | } d } t | � s} t S| r� y t | � } Wn t k
r� t SX| d k s� | d k r� t Sn t S( NRO i i i� ( RQ R3 RD R7 R R( R* RC ( RL RR RS R= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s" $
c C sm y t | � } Wn: t k
rL y t j | � Wqi t j k
rH t SXn X| d k se | d k ri t St S( Ni i� ( R( R* R+ t getprotobynameR- RD RC ( t protocolR= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sN | s t | � d k r t Sx* d d d d g D] } | | k r0 t Sq0 Wt S( s� Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
i t RO t !t *( R3 RD RC ( t ifacet ch( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
s c C sH y t | d � } Wn t k
r' t SX| d k rD | d k rD t St S( Ni I���� ( R( R* RD RC ( t valt x( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s� t j j t � s t Sy( t t d � � } | j � } Wd QXWn t k
rR t SXt j j d | � sm t Sy, t d | d � � } | j � } Wd QXWn t k
r� t SXd | k r� t St S( sv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
t rNs /proc/%ss /proc/%s/cmdlinet firewalld( t ost patht existsR% RD t opent readlinet ExceptionRC ( t fdt pidt cmdline( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ! s"
c C sy yK t j j t � s( t j t d � n t j d d d d d t d t � SWn' t k
rt } t j
d | � � n Xd S( Ni� t modet wtt prefixs temp.t dirt deletes# Failed to create temporary file: %s( R_ R` Ra R$ t mkdirt tempfilet NamedTemporaryFileRD Rd R# R- R7 ( t msg( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
> s c C sW y& t | d � � } | j � SWd QXWn* t k
rR } t j d | | f � n Xd S( NR] s Failed to read file "%s": %s( Rb t readlinesRd R# R- R7 ( t filenamet ft e( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR J s c C s[ y) t | d � � } | j | � Wd QXWn+ t k
rV } t j d | | f � t SXt S( Nt ws Failed to write to file "%s": %s( Rb t writeRd R# R- RD RC ( Rr t lineRs Rt ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR R s c C s6 | d k r t d d � S| d k r2 t d d � St S( Nt ipv4s /proc/sys/net/ipv4/ip_forwards 1
t ipv6s& /proc/sys/net/ipv6/conf/all/forwarding( R RD ( t ipv( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR [ s
c C s | j d d � j d d � S( Nt _R0 s
nf-conntrack-R@ ( t replace( t module( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt get_nf_conntrack_short_nameb s c C s> y t t d � d � SWn t k
r9 t j d � d SXd S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helperi s3 Failed to get and parse nf_conntrack_helper setting( R( R Rd R# t warning( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR e s
c C s t d | r d n d � S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helpers 1
s 0
( R ( t flag( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR l s c C s� t | � } | d k sV | d k sV | d k sV t | � d k r� | d | d k r� | d k rv t j d | � nz | d k r� t j d | � nZ | d k r� t j d | � n: t | � d k r� | d | d k r� t j d | � n t St S(
Ni����i����i i i s '%s': port > 65535s '%s': port is invalids '%s': port is ambiguouss '%s': range start >= end( R R7 R3 R# t debug2RD RC ( R. RB ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR p s $& &c C s4 | d k r t | � S| d k r, t | � St Sd S( NRx Ry ( R R RD ( Rz t source( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s4 | d k r t | � S| d k r, t | � St Sd S( NRx Ry ( R R RD ( Rz R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sg t | � d k rc x" d D] } | | d k r t Sq Wx% d D] } | | t j k r> t Sq> Wt St S( Ni i i i i i R? i i i i i i i i
i
i i i ( i i i i i ( i i i i i i i i
i i
i i ( R3 RD t stringt hexdigitsRC ( t macR= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s7 g } x* | D]" } | | k r
| j | � q
q
W| S( N( R6 ( t _listt outputR\ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sV y= t j d | � } t | j � d j � � } | j � Wn t k
rQ d SX| S( s Get parent for pid s ps -o ppid -h -p %d 2>/dev/nulli N( R_ t popenR( Rq R) t closeRd R7 ( Rf Rs ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s= d d l m } t t t | j � � � } d | t d � S( s�
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
i����( t SHORTCUTSi t __allow( t firewall.core.baseR� t maxt mapR3 t values( R� t longest_shortcut( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s c C st t | � d k s- t | � t j d � k r1 t Sx< | D]4 } | t j k r8 | t j k r8 | d k r8 t Sq8 Wt S( Ni t SC_LOGIN_NAME_MAXRP R0 R{ t $( RP R0 R{ R� ( R3 R_ t sysconfRD R� t
ascii_letterst digitsRC ( t usert c( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s -
c C sW t | t � r7 y t | � } Wq7 t k
r3 t SXn | d k rS | d k rS t St S( Ni i i i I � i���( R' t strR( R* RD RC ( t uid( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sj t | � d k s$ t | � d k r( t Sx' d d d g D] } | | k r8 t Sq8 W| d d k rf t St S( Ni i t |s
t i RO ( R3 RD RC ( t commandRZ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s $ c C s� | j d � } t | � d
k r% t S| d d k rM | d d d k rM t S| d d d k re t S| d
d d k r} t St | d � d k r� t St S( NR? i i i t rooti����t _ui t _ri t _ti ( i i ( R2 R3 RD RC ( t contextR: ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s $c C sD d t t � k r) d j d � | D� � Sd j d � | D� � Sd S( Nt quoteRV c s s | ] } t j | � Vq d S( N( t shlexR� ( t .0t a( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr>� s c s s | ] } t j | � Vq d S( N( t pipesR� ( R� R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr>� s ( Rk R� R5 ( t args( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s c C sN t r= t | t � r= t | � } t j | � } t t | � St j | � Sd S( N( R R' t unicodeR! R� R2 R� R ( t _stringR: ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s# t | t � r | j d d � S| S( s bytes to unicode s UTF-8R| ( R' t bytest decode( R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s c C s# t | t � s | j d d � S| S( s unicode to bytes s UTF-8R| ( R' R� t encode( R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR! � s c C s) t r% t | t � r% | j d d � S| S( s" unicode to bytes only if Python 2s UTF-8R| ( R R' R� R� ( R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR" s (5 t __all__R+ R_ t os.pathR� R� R� t sysRn t firewall.core.loggerR# t firewall.configR$ R% t versionR R R R RF R R RM R R R R R
R R R
R R R R~ R R R R R R R R R R R R R R R R R! R" ( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt <module> sr 6