ó
c`c # @ sX d d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" g# Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d$ l Z d# d% l m
Z
d# d& l m Z m
Z
e j d' k Z d( Z d) Z d* d+ Z d, Z d- Z d. Z d/ Z d0 Z d1 Z d2 Z d3 Z d4 Z d5 Z d6 Z d7 Z d8 Z d9 Z d: Z! d; Z" d< Z# d= Z$ d> Z% d? Z& d@ Z' dA Z( dB Z) dC Z* dD Z+ dE Z, dF Z- dG Z. dH Z/ dI Z0 dJ Z1 dK Z2 dL Z3 dM Z4 d$ S(N t PY2t getPortIDt getPortRanget portStrt getServiceNamet checkIPt checkIP6t checkIPnMaskt
checkIP6nMaskt
checkProtocolt checkInterfacet checkUINT32t firewalld_is_activet tempFilet readfilet writefilet enable_ip_forwardingt get_nf_conntrack_helper_settingt set_nf_conntrack_helper_settingt
check_portt
check_addresst check_single_addresst check_mact uniqifyt ppid_of_pidt max_zone_name_lent checkUsert checkUidt checkCommandt checkContextt joinArgst splitArgst b2ut u2bt
u2b_if_py2i˙˙˙˙N( t log( t FIREWALLD_TEMPDIRt FIREWALLD_PIDFILEt 3c C s t | t r | } nd | r- | j } n y t | } Wn< t k
r{ y t j | } Wq| t j k
rw d SXn X| d k r d S| S( sÎ Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
i˙˙˙˙i˙˙ iţ˙˙˙( t
isinstancet intt stript
ValueErrort sockett
getservbynamet error( t portt _id( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR . s
c C s> t | t s | j r> t | } | d k r: | f S| S| j d } t | d k rđ | d j rđ | d j rđ t | d } t | d } | d k rđ | d k rđ | | k rÍ | | f S| | k ră | | f S| f Sqđ n g } xt t | d d D]÷ } t d j | | } d j | | } t | d k rŃt | } | d k r| d k r| | k r| j | | f qÎ| | k rť| j | | f qÎ| j | f qq| d k r| j | f | t | k rPqqqWt | d k r d St | d k r6d S| d S( sI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
i t -i i i˙˙˙˙N(
R' R( t isdigitR t splitt lent ranget joint appendt None( t portst id1t splitst id2t matchedt it port2( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR E sH 2
t :c C sr | d k r d St | } t | t r; | d k r; d St | d k rU d | Sd | d | | d f Sd S( s Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
t i i s %ss %s%s%sN( R R' R( R7 R3 ( R. t delimitert _range( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR { s c C s t | } t | } t | d k r> | t | d k St | d k r | t | d k r | t | d k r t St S( Ni i i ( R R R3 t Truet False( R. R4 t _portRB ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt portInPortRange s ,c C s8 y t j t | | } Wn t j k
r3 d SX| S( sŢ Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N( R+ t
getservbyportR( R- R7 ( R. t protot name( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s3 y t j t j | Wn t j k
r. t SXt S( sl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
( R+ t inet_ptont AF_INETR- RD RC ( t ip( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR § s
c C s
| j d S( s Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
s []( R) ( RL ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt normalizeIP6´ s c C s9 y t j t j t | Wn t j k
r4 t SXt S( sl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
( R+ RJ t AF_INET6RM R- RD RC ( RL ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ź s
c C sá d | k ra | | j d } | | j d d } t | d k sZ t | d k rm t Sn | } d } t | s} t S| rÝ d | k r t | Sy t | } Wn t k
r˝ t SX| d k sÖ | d k rÝ t Sn t S( Nt /i t .i i ( t indexR3 RD R7 R R( R* RC ( RL t addrt maskR= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR É s& $
c C sË d | k ra | | j d } | | j d d } t | d k sZ t | d k rm t Sn | } d } t | s} t S| rÇ y t | } Wn t k
r§ t SX| d k sŔ | d k rÇ t Sn t S( NRO i i i ( RQ R3 RD R7 R R( R* RC ( RL RR RS R= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ŕ s" $
c C sm y t | } Wn: t k
rL y t j | Wqi t j k
rH t SXn X| d k se | d k ri t St S( Ni i˙ ( R( R* R+ t getprotobynameR- RD RC ( t protocolR= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ő s
c C sN | s t | d k r t Sx* d d d d g D] } | | k r0 t Sq0 Wt S( sŹ Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
i t RO t !t *( R3 RD RC ( t ifacet ch( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
s c C sH y t | d } Wn t k
r' t SX| d k rD | d k rD t St S( Ni I˙˙˙˙ ( R( R* RD RC ( t valt x( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s t j j t s t Sy( t t d } | j } Wd QXWn t k
rR t SXt j j d | sm t Sy, t d | d } | j } Wd QXWn t k
r t SXd | k rž t St S( sv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
t rNs /proc/%ss /proc/%s/cmdlinet firewalld( t ost patht existsR% RD t opent readlinet ExceptionRC ( t fdt pidt cmdline( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ! s"
c C sy yK t j j t s( t j t d n t j d d d d d t d t SWn' t k
rt } t j
d | n Xd S( Nič t modet wtt prefixs temp.t dirt deletes# Failed to create temporary file: %s( R_ R` Ra R$ t mkdirt tempfilet NamedTemporaryFileRD Rd R# R- R7 ( t msg( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
> s c C sW y& t | d } | j SWd QXWn* t k
rR } t j d | | f n Xd S( NR] s Failed to read file "%s": %s( Rb t readlinesRd R# R- R7 ( t filenamet ft e( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR J s c C s[ y) t | d } | j | Wd QXWn+ t k
rV } t j d | | f t SXt S( Nt ws Failed to write to file "%s": %s( Rb t writeRd R# R- RD RC ( Rr t lineRs Rt ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR R s c C s6 | d k r t d d S| d k r2 t d d St S( Nt ipv4s /proc/sys/net/ipv4/ip_forwards 1
t ipv6s& /proc/sys/net/ipv6/conf/all/forwarding( R RD ( t ipv( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR [ s
c C s | j d d j d d S( Nt _R0 s
nf-conntrack-R@ ( t replace( t module( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt get_nf_conntrack_short_nameb s c C s> y t t d d SWn t k
r9 t j d d SXd S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helperi s3 Failed to get and parse nf_conntrack_helper setting( R( R Rd R# t warning( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR e s
c C s t d | r d n d S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helpers 1
s 0
( R ( t flag( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR l s c C sř t | } | d k sV | d k sV | d k sV t | d k rô | d | d k rô | d k rv t j d | nz | d k r t j d | nZ | d k rś t j d | n: t | d k rđ | d | d k rđ t j d | n t St S(
Niţ˙˙˙i˙˙˙˙i i i s '%s': port > 65535s '%s': port is invalids '%s': port is ambiguouss '%s': range start >= end( R R7 R3 R# t debug2RD RC ( R. RB ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR p s $& &c C s4 | d k r t | S| d k r, t | St Sd S( NRx Ry ( R R RD ( Rz t source( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s4 | d k r t | S| d k r, t | St Sd S( NRx Ry ( R R RD ( Rz R ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C sg t | d k rc x" d D] } | | d k r t Sq Wx% d D] } | | t j k r> t Sq> Wt St S( Ni i i i i i R? i i i i i i i i
i
i i i ( i i i i i ( i i i i i i i i
i i
i i ( R3 RD t stringt hexdigitsRC ( t macR= ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s7 g } x* | D]" } | | k r
| j | q
q
W| S( N( R6 ( t _listt outputR\ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C sV y= t j d | } t | j d j } | j Wn t k
rQ d SX| S( s Get parent for pid s ps -o ppid -h -p %d 2>/dev/nulli N( R_ t popenR( Rq R) t closeRd R7 ( Rf Rs ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Ł s
c C s= d d l m } t t t | j } d | t d S( sŠ
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
i˙˙˙˙( t SHORTCUTSi t __allow( t firewall.core.baseR t maxt mapR3 t values( R t longest_shortcut( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s c C st t | d k s- t | t j d k r1 t Sx< | D]4 } | t j k r8 | t j k r8 | d k r8 t Sq8 Wt S( Ni t SC_LOGIN_NAME_MAXRP R0 R{ t $( RP R0 R{ R ( R3 R_ t sysconfRD R t
ascii_letterst digitsRC ( t usert c( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ˇ s -
c C sW t | t r7 y t | } Wq7 t k
r3 t SXn | d k rS | d k rS t St S( Ni i i i I i˙˙˙( R' t strR( R* RD RC ( t uid( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Á s
c C sj t | d k s$ t | d k r( t Sx' d d d g D] } | | k r8 t Sq8 W| d d k rf t St S( Ni i t |s
t i RO ( R3 RD RC ( t commandRZ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Ë s $ c C s | j d } t | d
k r% t S| d d k rM | d d d k rM t S| d d d k re t S| d
d d k r} t St | d d k r t St S( NR? i i i t rootiţ˙˙˙t _ui t _ri t _ti ( i i ( R2 R3 RD RC ( t contextR: ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Ő s $c C sD d t t k r) d j d | D Sd j d | D Sd S( Nt quoteRV c s s | ] } t j | Vq d S( N( t shlexR˘ ( t .0t a( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr>é s c s s | ] } t j | Vq d S( N( t pipesR˘ ( R¤ RĽ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr>ë s ( Rk RŁ R5 ( t args( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ç s c C sN t r= t | t r= t | } t j | } t t | St j | Sd S( N( R R' t unicodeR! RŁ R2 R R ( t _stringR: ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR í s
c C s# t | t r | j d d S| S( s bytes to unicode s UTF-8R| ( R' t bytest decode( RŠ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ö s c C s# t | t s | j d d S| S( s unicode to bytes s UTF-8R| ( R' RŞ t encode( RŠ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR! ü s c C s) t r% t | t r% | j d d S| S( s" unicode to bytes only if Python 2s UTF-8R| ( R R' R¨ RŹ ( RŠ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR" s (5 t __all__R+ R_ t os.pathRŁ RŚ R t sysRn t firewall.core.loggerR# t firewall.configR$ R% t versionR R R R RF R R RM R R R R R
R R R
R R R R~ R R R R R R R R R R R R R R R R R! R" ( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt <module> sr 6