VULN_CHECK_I913V6 =jcddZddlZddlmZddlmZddlmZddlm Z m Z m Z m Z m Z GddZy) z Warning: %s Error: %s)r authorizeAll Exceptionrget_codestrlenr<r?append isinstancelisttupledeactivate_exception_handlerrfail_if_not_authorized get_dbus_nameget_dbus_messagerALREADY_ENABLED NOT_ENABLEDZONE_ALREADY_SET ALREADY_SETactivate_exception_handlerr-r0 UNKNOWN_ERROR)rcmd_typeoption action_method query_method parse_methodmessage start_argsend_argsno_exititems_errors _error_codesitemr2code call_items r__cmd_sequencezFirewallCommand.__cmd_sequenceSs 77  GG " D' '-D LL "DI%Z' dD)*T52I  &T! #X%  - - / y)2  + + -KN6{W$\(9\"a'a)\"Q& --. 'i! (11#c(;D6{Q**=3+>?++K#,=tD</$++D1qLG 4"9- c=1//0A0A0CD..0Cc(C$--c2**&&++&&  Dv;?&&}s':;QY&&}s':;'' c(94@|+ ''-1 / s7D4-F;4 F8=A0F33F8;K) CK$//K$$K)c 4|jd||||||y)Naddre_FirewallCommand__cmd_sequencerr^r_r`rarbres r add_sequencezFirewallCommand.add_sequences,         rc 8|jd||||||g|y)Nrnrcrerprxr^r_r`rarbres rx_add_sequencezFirewallCommand.x_add_sequences1       s  rc <|jd||||||g|g| y)Nrn)rcrdrerp) rzoner^r_r`rarbtimeoutres rzone_add_timeout_sequencez)FirewallCommand.zone_add_timeout_sequences6       vY  rc 4|jd||||||y)Nremoverorprrs rremove_sequencezFirewallCommand.remove_sequences,         rc 8|jd||||||g|y)Nr~rurprvs rx_remove_sequencez!FirewallCommand.x_remove_sequences1       s  rcg}|D]}| ||}|j| |D]}g} || |z } t|ts"t|ts| j|n| |z } |j || } |j!t|dkDr|j#||zdd |j% |st'j(dyy#t$rf} t|dkDr|jd| zYd} ~ tjt | } |j d| z| Yd} ~ ?d} ~ wwxYw#t$r} |j| jtj| j} t|dkDr(|jd| jzYd} ~ |j d| jz| Yd} ~ d} ~ wt$ra} tjt | } t|dkDr|jd| zn|j d| z| Yd} ~ d} ~ wwxYw)Nr>rHrIz: )noyesr)rKrNr<rrLrMr?rOrPrQrRrSrrTrUrVr[r3print_query_resultr-r0) rr^r`rarbrcrerfrir2rjrkress r__query_sequencez FirewallCommand.__query_sequences7D'E'-D LL DI%Z' dD)*T52I  &T!  - - / A"I.  + + -6{Q7T>=;MNO'',;< HHQKO!E6{Q**=3+>? ,55c#h?++K#,=tDD E(! T++C,=,=,?@$--c.B.B.DEv;?&&}s7K7K7M'MN'' c6J6J6L(LdSS A$--c#h7v;?&&}s':;'' c(94@  AsIC(<E( E1"E3EE I1#A2H#H I1AI,,I1c0|j|||||y)Nro _FirewallCommand__query_sequence)rr^r`rarbres rquery_sequencezFirewallCommand.query_sequenceJs"  L,  rc4|j|||||g|y)Nrur)rrwr^r`rarbres rx_query_sequencez FirewallCommand.x_query_sequenceVs'  L,QCQX  rct|sRt|sGt|s<|jdrt |dkDst t jd|z|S)Nzipset:z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)rrr startswithrNrr INVALID_ADDRrvalues r parse_sourcezFirewallCommand.parse_sourcecsWU#!%(e$%%h/CJN##JUR  rc |j|\}}t |sttj||dvrttj d|z||fS#t$rttjd|zwxYw)NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocoltcpudpsctpdccp''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})split ValueErrorrr INVALID_PORTr INVALID_PROTOCOL)rr separatorportprotos r parse_portzFirewallCommand.parse_portps !KK 2MT5$ 3 3T: : 6 6''9EA e} ##,.78  s A 'Bczd}d}d}d}d}d||dvr||djddd}|t|dzz }d||dvr||djddd} n||d} |t| dzz }|dk(r| }n=|dk(r| }n5|dk(r| }n-|dk(r| }n%|d k(r|rnttjd |zd||dvr|sttjd |sttjd |s|sttjd t |sttj ||dvrttjd|z|r%t |sttj ||r4td|s(|s td|sttj|||||fS)Nr=r>:rrtoporttoaddrifzinvalid forward port arg '%s'z missing portzmissing protocolzmissing destinationrripv4ipv6) rrNrrINVALID_FORWARDr rrr r) rrcompatrprotocolrrioptvals rparse_forward_portz"FirewallCommand.parse_forward_ports U12Y)//#q)!,C SA AeABiABiooc1-a0ABi SA Af}#**,Ks,S+U12Y0 6 6G G 6 68JK K& 6 68MN N$ 3 3T: : 9 9''9HD  *V, 3 3V< < .vv>1&&A#F$7$7@@h//rc|jd}t|dk(r|ddfSt|dk(r|Sttjd|z)Nrr>rrAzinvalid ipset option '%s')rrNrrINVALID_OPTION)rrargss rparse_ipset_optionz"FirewallCommand.parse_ipset_optionsW{{3 t9>GR= Y!^K%%'Be'L rc vddg}||vr0ttjd|ddj|d|S)Nrrinvalid argument:  (choose from '', '')rr INVALID_IPVjoinrripvss rcheck_destination_ipvz%FirewallCommand.check_destination_ipvsH     ""=BFKKPTDUV  rc |jdd\}}|j ||fS#t$rttjdwxYw)Nrr>z(destination syntax is ipv:address[/mask])rrrrINVALID_DESTINATIONr)rripv destinations rparse_service_destinationz)FirewallCommand.parse_service_destinations^ !&S!!4 S+ **3/==  **,V  s *$Ac vgd}||vr0ttjd|ddj|d|S)N)rrebrrrrrrs r check_ipvzFirewallCommand.check_ipvs>%  ""=BFKKPTDUV  rc vgd}||vr0ttjd|ddj|d|S)N)rrrrrrrrrs rcheck_helper_familyz#FirewallCommand.check_helper_familys>#  ""=BFKKPTDUV  rc|jdsttjd|zt |j dddkrttjd|z|S)N nf_conntrack_z('%s' does not start with 'nf_conntrack_'rr>zModule name '%s' too short)rrrINVALID_MODULErNreplacers r check_modulezFirewallCommand.check_modulesm0%%:UB  u}}_b1 2Q 6%%'Ce'K  rTcB |j}|j} |j} |j} |j } |j } |j }|j}|j}|j}|j}|r1|j}|j}|j}nu|j}tt!|j#|z}|j%}|j'}|j)}|j+}d}g}|||k(r|j-d|s||vr|j-d|r|||vr|j-d|r#|!|j/r|j-d|r|ddj1|zz}|j3||j4r(|j3d|z|j3d|z|rC|j3d |j/rd nd |j3d t7z|j3d |z|sR|j3dt7z|j3dt7z|j3drd nd z|rG|j3ddj1z|j3ddj1znF|j3ddj1z|j3ddj1z|j3ddj1t| z|j3ddj1| Dcgc]}|dd|dc}z|j3ddj1t| z|s|j3drd nd z|j3d| rd nd z|j3d| rdnd zdj1| D !cgc]\}}} }!d!|d"|d#| d$|!c}!} }}z|j3d%dj1|Dcgc]}|dd|dc}z|j3d&dj1|z|j3d'|rdnd zdj1t||(zycc}wcc}!} }}wcc}w))Ncd}d} |j|}|t|z }t|||||djdzjdd}|S#t$rY|SwxYw)Nrz priority= "r)indexrNintrr)rulepriority search_strrs rrich_rule_sorted_keyzDFirewallCommand.print_zone_policy_info..rich_rule_sorted_keysH$J UJJz*S_$tAT!"X^^C-@(ABJJ3PRSTO   O  sA A'&A'defaultactivedisabledz (%s)z, summary:  description: z disable: rrz priority: z target: z ingress-priority: z egress-priority: z icmp-block-inversion: %sz ingress-zones: rz egress-zones: z interfaces: z sources: z services: ports: r/r> protocols: z forward: %sz masquerade: %sz forward-ports: z rzport=z:proto=z:toport=z:toaddr= source-ports: z icmp-blocks: z rich rules: )key) getTarget getServicesgetPorts getProtocols getMasqueradegetForwardPortsgetSourcePorts getIcmpBlocks getRichRulesgetDescriptiongetShortgetIngressZonesgetEgressZones getPrioritygetIcmpBlockInversionsortedset getInterfaces getSources getForwardgetIngressPrioritygetEgressPriorityrO getDisablerr3rrM)"rrzsettings default_zoneextra_interfaces active_zonesactive_policiesisPolicytargetservicesports protocols masquerade forward_ports source_ports icmp_blocksrules descriptionshort_description ingress_zones egress_zonesricmp_block_inversion interfacessourcesforwardingress_priorityegress_priorityr attributesrrrrs" rprint_zone_policy_infoz&FirewallCommand.print_zone_policy_infos##%'')!!#))+ ++-  002 ..0 ,,. %%'--/ $--/ $446M#224L++-H#+#A#A#C H$:$:$CM9 : |f,- NN1C8H4II J NN033GG H NN,9MSWX   NN.-1HH I NN-0FF G NN+chhz.BB C NN=388G+<< = ~1A(BBC  #((U#SUTtAwQ$@U#ST T  &2C)DDE NN?weDI J )jUdKL  &vB 0kk:G:G5uffUFF49F    hhN47DG4NO P  (388K+@@A  vB (kk&,@AB C -$TOs,TTTc2|j|||||dy)NF)rrrrr)rrzrrrrs rprint_zone_infozFirewallCommand.print_zone_infoas) ##  %-% $ rc2|j|||||dy)NT)rrrrr)rpolicyrrrrs rprint_policy_infoz!FirewallCommand.print_policy_infoms) ##  %-+ $ rc |j}|j}|j}|j}|j }|j }|j } |j} |j} |j||jr(|jd| z|jd|z|jddj|D cgc]} | dd| dc} z|jddj|z|jd dj|D cgc]} | dd| dc} z|jd dj|z|jd dj|jD cgc] \} }| d |c}} z|jd djt| z|jddjt| zycc} wcc} wcc}} w)Nrrrrrrr>rrz modules:  destination: rz includes: z helpers: )rrr getModulesrgetDestinationsr getIncludes getHelpersr3rrrfr)rservicerrrr modulesr  destinationsr includeshelpersrkvs rprint_service_infoz"FirewallCommand.print_service_info~s!!#))+ ..0 %%'--/ //1 $--/'')%%' w << NN=+<< = NN,{: ;  #((U#SUTtAwQ$@U#ST T  ))<<=  hhN47DG4NO P  }sxx'889  hh\5G5G5IJ5ITQ1a(5IJK L  ~1A(BBC }sxxw'@@A$T O Ks1H6H;>IcX|j}|j}|j}t|dk(rddg}|j ||j r(|j d|z|j d|z|j ddj |zy)Nrrrrrrr)r!rrrNr3rr)ricmptyperr&r r s rprint_icmptype_infoz#FirewallCommand.print_icmptype_infos//1 --/ $--/ |  !"F+L x << NN=+<< = NN,{: ; (388L+AABrc B|j}|j}|j}|j}|j }|j ||j r(|j d|z|j d|z|j d|z|j ddj|jD cgc]\}} | r|d| n|c} }z|j ddj|zycc} }w)Nrrz type: z options: rrz entries: ) getType getOptions getEntriesrrr3rrrf) ripsetr ipset_typeoptionsentriesr r r)r*s rprint_ipset_infoz FirewallCommand.print_ipset_infos%%' %%'%%'--/ $--/ u << NN=+<< = NN,{: ; zJ./  hhQAA1a(14QR S  }sxx'889RsDc |j}|j}|j}|j}|j }|j ||j r(|j d|z|j d|z|j d|z|j d|z|j ddj|Dcgc]}|dd|d c}zycc}w) Nrrz family: z module: rrrrr>)r getModule getFamilyrrr3rr) rhelperrrmodulefamilyr r rs rprint_helper_infoz!FirewallCommand.print_helper_infos!!###%##%--/ $--/ v << NN=+<< = NN,{: ; |f,- |f,-  #((U#SUTtAwQ$@U#ST T #SsC;cP|r|jdy|jddy)Nrrr>rBrs rrz"FirewallCommand.print_query_results#     &   a (rcP|js|j|tjt |}|t j t jt jt jfvr|jd|zy|jd|z|y)NrHrI) rrTrrLrMrrWrXrYrZr<r?)rexception_messagerjs rexception_handlerz!FirewallCommand.exception_handlers++  ##$56%%c*;&<=   " "     # #        }/@@ A    .? ? FrcRd|vr#d}|j|tjyy)NNotAuthorizedExceptionz`Authorization failed. Make sure polkit agent is running or run the application as superuser.)r?rNOT_AUTHORIZED)rrAr2s rrTz&FirewallCommand.fail_if_not_authorizeds. #'8 8NC   V%:%: ; 9rcd|_yNFrr s rrSz,FirewallCommand.deactivate_exception_handlers ',$rcd|_yrrHr s rr[z*FirewallCommand.activate_exception_handlers '+$rcg}t}t|}|D]S}|snO|j}t|dks|ddvr-||vs2|j ||j |U|j |S)Nr>r)#;)ropenstriprNrOrnclose)rfilenamer6 entries_setflines rget_ipset_entries_from_filez+FirewallCommand.get_ipset_entries_from_files{e ND::rrBrTrSr[rTrrr r s]  5tt MTTM 7475$)V/~ 6 < < 6 66|  &   &20h  >  j Z,0"SU    "B< C:" ) G< -,rr )__doc__r-firewallrfirewall.errorsrdbus.exceptionsrfirewall.functionsrrrr r r rXrrr^s-C ))` ` r