VULN_CHECK_I913V6 =j٬ddlZddlZddlmZddlmZmZmZddlm Z ddl m Z ddl m Z ddlmZddlmZdd lmZdd lmZmZmZmZmZdd lmZdd lmZdd lmZmZm Z m!Z!GddeZ"y)N)config)dbus_to_python%dbus_introspection_prepare_properties!dbus_introspection_add_properties)Zone)ifcfg_set_zone_of_interface)DEFAULT_ZONE_TARGET) Rich_Rule)log)DbusServiceObject)handle_exceptionsdbus_handle_exceptionsdbus_service_methoddbus_service_signaldbus_polkit_require_auth)errors) FirewallError)portStrportInPortRangecoalescePortRangebreakPortRangec<eZdZdZdZ ej jZ e fdZ e dZ e dZ e dZeej dd e dfd Zeej d d e dfd Zeej jeej de dfdZeej ddZeej j.eej0d e dffd Zeej j4de dfdZeej j4d e dfdZdZeej j4de dfdZeej j4d e dfdZeej j4e dfdZ eej j4d e dZ!eej j4e dfdZ"eej j4d e dZ#eej j4d e dfd Z$eej j4d e d!Z%eej j4d e dfd"Z&eej j4d e dfd#Z'eej j4d e dfd$Z(eej j4d e dfd%Z)eej j4d e dfd&Z*eej j4d e dfd'Z+eej j4d e dfd(Z,eej j4d e dfd)Z-eej j4d*e dfd+Z.eej j4d*e dfd,Z/eej j4d e dfd-Z0eej j4d e dfd.Z1eej j4d d/ e dfd0Z2eej j4d1e dfd2Z3eej j4d1e dfd3Z4eej j4de dfd4Z5eej j4de dfd5Z6eej j4dd/ e dfd6Z7eej j4d*e dfd7Z8eej j4d*e dfd8Z9eej j4d e dfd9Z:eej j4d e dfd:Z;eej j4d d/ e dfd;Z<eej j4d1e dfd<Z=eej j4d1e dfd=Z>eej j4de dfd>Z?eej j4de dfd?Z@eej j4dd/ e dfd@ZAeej j4d*e dfdAZBeej j4d*e dfdBZCeej j4d e dfdCZDeej j4d e dfdDZEeej j4d d/ e dfdEZFeej j4d/e dfdFZGeej j4d/e dfdGZHeej j4e dfdHZIeej j4e dfdIZJeej j4d/e dfdJZKeej j4d/e dfdKZLeej j4d/e dfdLZMeej j4e dfdMZNeej j4e dfdNZOeej j4d/e dfdOZPeej j4dPe dfdQZQeej j4dPe dfdRZReej j4dSe dfdTZSeej j4dSe dfdUZTeej j4dSd/ e dfdVZUeej j4d*e dfdWZVeej j4d*e dfdXZWeej j4d e dfdYZXeej j4d e dfdZZYeej j4d d/ e dfd[ZZeej j4d*e dfd\Z[eej j4d*e dfd]Z\eej j4d e dfd^Z]eej j4d e dfd_Z^eej j4d d/ e dfd`Z_eej j4d*e dfdaZ`eej j4d*e dfdbZaeej j4d e dfdcZbeej j4d e dfddZceej j4d d/ e dfdeZdxZeS)gFirewallDConfigZonezFirewallD main classTctt| |i|||_||_||_||_|d|_|d|_d|j z|_ t|tjjy)Nrzconfig.zone.%d) superr__init__parentrobjitem_idbusnamepath _log_prefixrdbusDBUS_INTERFACE_CONFIG_ZONE)selfrconfzoner argskwargs __class__s @/usr/lib/python3.12/site-packages/firewall/server/config_zone.pyrzFirewallDConfigZone.__init__6sr !414B6B   Aw G +dll:- &++88 cyNr&s r,__del__zFirewallDConfigZone.__del__Ds r-c$|jyr/)remove_from_connectionr1s r, unregisterzFirewallDConfigZone.unregisterHs ##%r-c|dk(r)tj|jjS|dk(r)tj|jjS|dk(r)tj|jj S|dk(r)tj |jjS|dk(r)tj |jjStjjd|z)Nnamefilenamer"defaultbuiltinzDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist) r$Stringrr7r8r"Booleanr9r: exceptions DBusException)r& property_names r, _get_propertyz!FirewallDConfigZone._get_propertyPs F ";;txx}}- - j (;;txx001 1 f $;;txx}}- - i '<< 0 01 1 i '<< 0 01 1/////1>? r-ssv) in_signature out_signaturec&t|t}t|t}tjd|j|||t j jk7r"t jjd|z|j|S)Nz%s.Get('%s', '%s')Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) rstrr debug1r#rr$r%r=r>r@)r&interface_namer?senders r,GetzFirewallDConfigZone.Getbs(<&}c:  $"2"2NM  V[[CC C////02@A  !!-00r-sza{sv}cJt|t}tjd|j||t j jk7r"t jjd|zi}dD]}|j|||<t j|dS)Nz%s.GetAll('%s')rF)r7r8r"r9r:sv signature) rrGr rHr#rr$r%r=r>r@ Dictionary)r&rIrJretxs r,GetAllzFirewallDConfigZone.GetAllts(< $d&6&6G V[[CC C////02@A  CA''*CFDsd33r-ssv)rCct|t}t|t}t|}tjd|j||||j j ||tjjk7r"tjjd|ztjjd|z)Nz%s.Set('%s', '%s', '%s')rFzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-only) rrGr rHr#r accessCheckrr$r%r=r>)r&rIr? new_valuerJs r,SetzFirewallDConfigZone.Sets(<&}c: "9-  &         ' V[[CC C////02@A  oo++ )+8 9  r-zsa{sv}asrOct|t}t|}t|}tjd|j|||y)Nz&%s.PropertiesChanged('%s', '%s', '%s'))rrGr rHr#)r&rIchanged_propertiesinvalidated_propertiess r,PropertiesChangedz%FirewallDConfigZone.PropertiesChangedsI(<+,>?!/0F!G 4      "  r-)rDctjd|jtt||j |jj}t||tjjS)Nz%s.Introspect()) r debug2r#rr Introspectr"r!get_busrrr$r%)r&rJdatar+s r,r`zFirewallDConfigZone.Introspectsb $d&6&67($: IIt||++- 1 $ >>  r-z&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)ctjd|j|jj |j }|dt k(rt|}d|d<t|}|S)get settings for zonez%s.getSettings()r9) r rHr#rget_zone_configrr listtuple)r&rJsettings _settingss r, getSettingszFirewallDConfigZone.getSettingss_ %t'7'78;;..txx8 A;- -XI$IaLY'Hr-ctjd|j|jj |j }|dt k(rd|d<|S)rdz%s.getSettings2()targetr9)r rHr#rget_zone_config_dictrr r&rJris r, getSettings2z FirewallDConfigZone.getSettings2sN &(8(89;;33DHH= H !4 4!*HX r-c|jj|j}d|vrt|dn t}d|vrt|dn t}t |t rIt|t jd|z }t|t jd|z }nBd|vrt|dn t}d|vrt|dn t}||z }||z }|D]7} |jj| sttj| |D]7} |jj| sttj| y)aAssignment of interfaces/sources to zones is different from other zone settings in the sense that particular interface/zone can be part of only one zone. So make sure added interfaces/sources have not already been bound to another zone. interfacessourcesN)rrnrset isinstancerhrindex_ofrgetZoneOfInterfacerr ZONE_CONFLICTgetZoneOfSource) r&ri old_settings old_ifaces old_sources added_ifaces added_sources new_ifaces new_sourcesifacesources r, _checkDuplicateInterfacesSourcesz4FirewallDConfigZone._checkDuplicateInterfacesSourcess\ {{77A /;|/KC \* +QTQV -6,EC Y' (35  h &x l(CDE RLy)A BCkQM0.> L '((*+!  Hr-ctjd|j|j}|dtk7r|dSdS)Nz%s.getTarget()rer9)r rHr#rkr ros r, getTargetzFirewallDConfigZone.getTargetsB #T%5%56##%&qk-@@x{OiOr-ct|t}tjd|j||j j |t|j}|dk7r|nt|d<|j|y)Nz%s.setTarget('%s')r9re) rrGr rHr#rrWrgrkr r)r&rmrJris r, setTargetzFirewallDConfigZone.setTargetsk , ')9)96B '((*+ &) 3f9L  Hr-aschtjd|j|jdS)Nz%s.getServices()rrs r, getServiceszFirewallDConfigZone.getServicess- %t'7'78!!$$r-ct|t}tjd|jdj ||j j|t|j}||d<|j|y)Nz%s.setServices('[%s]'),r rrgr rHr#joinrrWrkr)r&servicesrJris r, setServiceszFirewallDConfigZone.setServicessj"(D1 +T-=-=sxx?QR '((*+  Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.addService('%s')rrrGr rHr#rrWrgrkrrALREADY_ENABLEDappendrr&servicerJris r, addServicezFirewallDConfigZone.addServices!#. ($*:*:GD '((*+ hqk ! 6 6@ @ 7# Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.removeService('%s')rrrGr rHr#rrWrgrkrr NOT_ENABLEDrrrs r, removeServicez!FirewallDConfigZone.removeServices!#. +T-=-=wG '((*+ (1+ % 2 2G< < 7# Hr-bct|t}tjd|j|||j dvS)Nz%s.queryService('%s')rrrGr rHr#rk)r&rrJs r, queryServicez FirewallDConfigZone.queryServices@ !#. *D,<,}t|tr|jt |.|j|@|}t j d|jdjd|D|jj|t|j}||d<|j|y)Nz%s.setPorts('[%s]')rc3:K|]}d|dd|ddyw('r, 'rrNr0.0ports r, z/FirewallDConfigZone.setPorts..JEDd1gtAw7Er rrgrurrhr rHr#rrrWrkrr&portsrJ_portsrris r,setPortszFirewallDConfigZone.setPortss"5$/D$% eDk* d# 0  !    HHJEJ J '((*+  Hr-c t|t}tttjd|j||j j |t|j}ttfd|d}|D]0}t||dsttj|dt||Dcgc]\}}| c}}\} } | D]"} |djt!| df$| D]"} |dj#t!| df$|j%|ycc}}w)Nz%s.addPort('%s', '%s')c|dk(SNrr0rSprotocols r,z-FirewallDConfigZone.addPort..!A$(2Br-rr:-rrGr rHr#rrWrgrkfilterrrrrrrrrr r&rrrJriexisting_port_idsport_id_port _protocol added_rangesremoved_rangesranges ` r,addPortzFirewallDConfigZone.addPorts3dC(!(C0 +T-=-=tXN '((*+ (BHQK!PQ(GtWQZ0#F$:$:tX ?$!E QK  s 3X> ?" H F E c t|t}tttjd|j||j j |t|j}ttfd|d}|D]}t||dsn ttj|dt||Dcgc]\}}| c}}\} } | D]"} |djt!| df$| D]"} |dj#t!| df$|j%|ycc}}w)Nz%s.removePort('%s', '%s')c|dk(Srr0rs r,rz0FirewallDConfigZone.removePort..rr-rrrrrrGr rHr#rrWrgrkrrrrrrrrrrrs ` r, removePortzFirewallDConfigZone.removePorts6dC(!(C0 .0@0@$Q '((*+ (BHQK!PQ(GtWQZ0)  2 2tX4NO O'5 3DE3D/eY53DE( $ n$E QK  s 3X> ?$!E QK  s 3X> ?" H F E ct|t}t|t}tjd|j|||j dD]\}}t ||s||k(syy)Nz%s.queryPort('%s', '%s')rTFrrGr rHr#rkrr&rrrJrrs r, queryPortzFirewallDConfigZone.queryPortsk dC(!(C0 -t/?/?xP $ 0 0 21 5 E9tU+I0E!6r-chtjd|j|jdS)Nz%s.getProtocols() rrs r, getProtocolsz FirewallDConfigZone.getProtocols"- &(8(89!"%%r-ct|t}tjd|jdj ||j j|t|j}||d<|j|y)Nz%s.setProtocols('[%s]')rrr)r& protocolsrJris r, setProtocolsz FirewallDConfigZone.setProtocols(sj#9d3  ,d.>.>@ST '((*+   Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.addProtocol('%s')rrr&rrJris r, addProtocolzFirewallDConfigZone.addProtocol2s"(C0 )4+;+;XF '((*+ x| # 6 6A A H% Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.removeProtocol('%s')rrr s r,removeProtocolz"FirewallDConfigZone.removeProtocol>s"(C0 ,d.>.>I '((*+ 8B< ' 2 2H= = H% Hr-ct|t}tjd|j|||j dvS)Nz%s.queryProtocol('%s')rr)r&rrJs r, queryProtocolz!FirewallDConfigZone.queryProtocolJs@ "(C0 +T-=-=xH4++-b111r-chtjd|j|jdS)Nz%s.getSourcePorts()rrs r,getSourcePortsz"FirewallDConfigZone.getSourcePortsUs- ($*:*:;!"%%r-cg}t|tD]>}t|tr|jt |.|j|@|}t j d|jdjd|D|jj|t|j}||d<|j|y)Nz%s.setSourcePorts('[%s]')rc3:K|]}d|dd|ddywrr0rs r,rz5FirewallDConfigZone.setSourcePorts..irrrrrs r,setSourcePortsz"FirewallDConfigZone.setSourcePorts[s"5$/D$% eDk* d# 0  '    HHJEJ J '((*+  Hr-c t|t}tttjd|j||j j |t|j}ttfd|d}|D]0}t||dsttj|dt||Dcgc]\}}| c}}\} } | D]"} |djt!| df$| D]"} |dj#t!| df$|j%|ycc}}w)Nz%s.addSourcePort('%s', '%s')c|dk(Srr0rs r,rz3FirewallDConfigZone.addSourcePort..xrr-rrrrrrs ` r, addSourcePortz!FirewallDConfigZone.addSourcePortps3dC(!(C0 143C3CT8T '((*+ (BHRL!QR(GtWQZ0#F$:$:tX.rr-rrrrrrs ` r,removeSourcePortz$FirewallDConfigZone.removeSourcePorts6dC(!(C0 4d6F6FhW '((*+ (BHRL!QR(GtWQZ0)  2 2tX4NO O'5 3DE3D/eY53DE( $ n$E RL  !4h ? @$!E RL  !4h ? @" H Frct|t}t|t}tjd|j|||j dD]\}}t ||s||k(syy)Nz%s.querySourcePort('%s', '%s')rTFrrs r,querySourcePortz#FirewallDConfigZone.querySourcePortsk dC(!(C0 3T5E5EtXV $ 0 0 22 6 E9tU+I0E!7r-chtjd|j|jdS)Nz%s.getIcmpBlocks()rrs r, getIcmpBlocksz!FirewallDConfigZone.getIcmpBlocks- ')9)9:!!$$r-ct|t}tjd|jdj ||j j|t|j}||d<|j|y)Nz%s.setIcmpBlocks('[%s]')rrr)r& icmptypesrJris r, setIcmpBlocksz!FirewallDConfigZone.setIcmpBlockssj#9d3  -t/?/?)ATU '((*+  Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.addIcmpBlock('%s')rrr&icmptyperJris r, addIcmpBlockz FirewallDConfigZone.addIcmpBlocks"(C0 *D,<,.>I4++-a000r-chtjd|j|jdS)Nz%s.getIcmpBlockInversion()rrs r,getIcmpBlockInversionz)FirewallDConfigZone.getIcmpBlockInversions- /1A1AB!"%%r-ct|t}tjd|j||j j |t|j}||d<|j|y)Nz%s.setIcmpBlockInversion('%s')r- rboolr rHr#rrWrgrkr)r&flagrJris r,setIcmpBlockInversionz)FirewallDConfigZone.setIcmpBlockInversionsadD) 3T5E5EtL '((*+  Hr-ctjd|j|jj |t |j }|drttjdd|d<|j|y)Nz%s.addIcmpBlockInversion()r-icmp-block-inversionT r rHr#rrWrgrkrrrrros r,addIcmpBlockInversionz)FirewallDConfigZone.addIcmpBlockInversionsn /1A1AB '((*+ B< 6 68NO O  Hr-ctjd|j|jj |t |j }|dsttjdd|d<|j|y)Nz%s.removeIcmpBlockInversion()r-r5F r rHr#rrWrgrkrrrrros r,removeIcmpBlockInversionz,FirewallDConfigZone.removeIcmpBlockInversionsn 2D4D4DE '((*+| 2 24JK K  Hr-chtjd|j|jdS)Nz%s.queryIcmpBlockInversion()r-rrs r,queryIcmpBlockInversionz+FirewallDConfigZone.queryIcmpBlockInversions- 143C3CD!"%%r-chtjd|j|jdS)Nz%s.getMasquerade()rrs r, getMasqueradez!FirewallDConfigZone.getMasquerade r r-ct|t}tjd|j||j j |t|j}||d<|j|y)Nz%s.setMasquerade('%s')r>r0)r& masqueraderJris r, setMasqueradez!FirewallDConfigZone.setMasqueradesa$J5  +T-=-=zJ '((*+   Hr-ctjd|j|jj |t |j }|drttjdd|d<|j|y)Nz%s.addMasquerade()r>rATr6ros r, addMasqueradez!FirewallDConfigZone.addMasqueradesm ')9)9: '((*+ A; 6 6 E E  Hr-ctjd|j|jj |t |j }|dsttjdd|d<|j|y)Nz%s.removeMasquerade()r>rAFr9ros r,removeMasqueradez$FirewallDConfigZone.removeMasquerade(sm *D,<,<= '((*+{ 2 2LA A  Hr-chtjd|j|jdS)Nz%s.queryMasquerade()r>rrs r,queryMasqueradez#FirewallDConfigZone.queryMasquerade3s- )4+;+;<!!$$r-za(ssss)chtjd|j|jdS)Nz%s.getForwardPorts() rrs r,getForwardPortsz#FirewallDConfigZone.getForwardPorts;s- )4+;+;<!!$$r-cg}t|tD]>}t|tr|jt |.|j|@|}t j d|jdjd|D|jj|t|j}||d<|j|y)Nz%s.setForwardPorts('[%s]')rc 3RK|]}d|dd|dd|dd|dd !yw) rrrrz', 'rrNr0rs r,rz6FirewallDConfigZone.setForwardPorts..Qs1!D.2!Wd1gtAwQP!s%'rJrrs r,setForwardPortsz#FirewallDConfigZone.setForwardPortsCs"5$/D$% eDk* d# 0  (    HH!   '((*+  Hr-ssssc t|t}t|t}t|t}t|t}tjd|j|||||j j |||t|t|f}t|j}||dvr%ttj|d|d|d||dj||j|y)Nz)%s.addForwardPort('%s', '%s', '%s', '%s')rJrrr&rrtoporttoaddrrJfwp_idris r,addForwardPortz"FirewallDConfigZone.addForwardPort[s dC(!(C0,, 7          '#f+s6{;((*+ Xa[ &&xQW(X   6" Hr-c t|t}t|t}t|t}t|t}tjd|j|||||j j |||t|t|f}t|j}||dvr%ttj|d|d|d||dj||j|y)Nz,%s.removeForwardPort('%s', '%s', '%s', '%s')rJrrrRs r,removeForwardPortz%FirewallDConfigZone.removeForwardPortvs dC(!(C0,, :          '#f+s6{;((*+ ! $""T8VV$T   6" Hr-c$t|t}t|t}t|t}t|t}tjd|j||||||t|t|f}||j dvS)Nz+%s.queryForwardPort('%s', '%s', '%s', '%s')rJr)r&rrrSrTrJrUs r,queryForwardPortz$FirewallDConfigZone.queryForwardPortsdC(!(C0,, 9         #f+s6{;))+A...r-chtjd|j|jdS)Nz%s.getInterfaces() rrs r, getInterfacesz!FirewallDConfigZone.getInterfacess- ')9)9:!"%%r-ct|t}tjd|jdj ||j j|t|j}||d<|j|y)Nz%s.setInterfaces('[%s]')rr\r)r&rrrJris r, setInterfacesz!FirewallDConfigZone.setInterfacessj$J5  -t/?/?*AUV '((*+!  Hr-ct|t}tjd|j||j j |t|j}||dvrttj||dj||j|t|jj |y)Nz%s.addInterface('%s')r\)rrGr rHr#rrWrgrkrrrrrrrr7r& interfacerJris r, addInterfacez FirewallDConfigZone.addInterfaces#9c2  *D,<, > I& H#B 2r-ct|t}tjd|j|||j dvS)Nz%s.queryInterface('%s')r\r)r&rbrJs r,queryInterfacez"FirewallDConfigZone.queryInterfaces@ #9c2  ,d.>.> JD,,.r222r-chtjd|j|jdS)Nz%s.getSources() rrs r, getSourceszFirewallDConfigZone.getSourcess- $d&6&67!"%%r-ct|t}tjd|jdj ||j j|t|j}||d<|j|y)Nz%s.setSources('[%s]')rrjr)r&rsrJris r, setSourceszFirewallDConfigZone.setSourcessj!$/ *D,<,OP '((*+  Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.addSource('%s')rjrr&rrJris r, addSourcezFirewallDConfigZone.addSources , ')9)96B '((*+ Xb\ ! 6 6? ? F# Hr-cZt|t}tjd|j||j j |t|j}||dvrttj||dj||j|y)Nz%s.removeSource('%s')rjrros r, removeSourcez FirewallDConfigZone.removeSources , *D,<,.>P '((*+5:;UY*+U;  H.>E '((*+y$/0 8B< ' 2 2D9 9 H% Hr-ct|t}tjd|j|tt |}||j dvS)Nz%s.queryRichRule('%s')ryrv)rrGr rHr#r rk)r&rrJrzs r, queryRichRulez!FirewallDConfigZone.queryRichRule>sO dC( +T-=-=tDy$/04++-b111r-r/)f__name__ __module__ __qualname____doc__ persistentrr$PK_ACTION_CONFIGdefault_polkit_auth_requiredr rrr2r5r@rPROPERTIES_IFACErKrTrrYrr]PK_ACTION_INFOINTROSPECTABLE_IFACEr`r%rkrprrrrrrrrrrrrrrrrrrrrrrrrrrrrrr r rrrrrrrr#r'r)r+r.r3r7r:r<r?rBrDrFrHrKrOrVrXrZr]r_rcrfrhrkrmrprrrtrwr}rrr __classcell__)r+s@r,rr.sJ&#);;#?#? +      &&"..TQTU1V1 ..SPWX 4Y 4fkk::;..UC D< 0..*E  F  fkk88922#F  G:   ..>   ??wWX D ..= $  $??gV $W $??@$A$??3OBPB ??@)A)??3OBPB ??cRS??3OBPB ??sS%T%??cRS??sS%T%??cRS??sS%T%??cRS??sSPTP ??cRS??tT%U%??dST??cRS??cRS ..SPS00??wW%X%??gVW&??dST&??dST* ..TQT??tT&U&??dST??cRS??cRS ..SPS22??wW&X&??gVW&??dST&??dST* ..TQT??tT%U%??dST??cRS??cRS ..SPS11??sS&T&??cRS??@A??@A??sS&T& ??sS%T%??cRS??@A??@A??sS%T%  ..i%%??iXY,??fU59V2??fU59V2 ..VSV59//(??tT&U&??dST??cR >S >??cR 3S 3 ..SPS33??tT&U&??dST??cRS??cRS ..SPS00??tT&U&??dST??cR S ??cR S  ..SPS22r-r)#r$ dbus.servicefirewallrfirewall.dbus_utilsrrrfirewall.core.io.zonerfirewall.core.fw_ifcfgrfirewall.core.baser firewall.core.richr firewall.core.loggerr firewall.server.dbusr firewall.server.decoratorsr rrrrrfirewall.errorsrfirewall.functionsrrrrrr0r-r,rsY  '>2($2)X2+X2r-