VULN_CHECK_I913V6 =jgFddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddlmZddlmZmZdd lmZmZmZmZmZmZmZdd lmZdd lmZm Z m!Z!m"Z"dd l#m$Z$dd l%m&Z&ddl'm(Z(ddl)m*Z*ddl+m,Z,m-Z-ddl.m/Z/ddlm0Z0ddl1m2Z2GddeZ3y))GLibN)config)Firewall) Rich_Rule)log)FirewallClientZoneSettings)FirewallDBusExceptionDbusServiceObject)dbus_handle_exceptionsdbus_service_methoddbus_service_signalhandle_exceptionsdbus_service_method_deprecateddbus_service_signal_deprecateddbus_polkit_require_auth)FirewallDConfig)dbus_to_python%dbus_introspection_prepare_properties!dbus_introspection_add_properties!dbus_introspection_add_deprecated)check_on_disk_config)IPSet)IcmpType)Helper)nm_get_connection_of_interfacenm_set_zone_of_connection)ifcfg_set_zone_of_interface)errors) FirewallErrorchZeZdZdZdZ ej jZ e fdZ dZ e dZ e dZ dZedZeej$d d edd Zeej$d d eddZeej jeej$deddZeej$ddZeej j2eej4d edfd Zeej jeej j8dd eddZeej jeej j8dd eddZeej j8edZeej jeej j8dd ddZ eej jeej j8dd eddZ!eej jeej j8dd eddZ"eej jFeej jHddddd Z%eej jFeej jHddddd!Z&eej jNeej jHdd"ddd#Z(eej jHdd$d%Z)eej jHdd$d&Z*eej jFeej jHd dddd'Z+eej jFeej jHd dddd(Z,eej jNeej jHd d"d dd)Z-eej jNeej jHdd*ddd+Z.eej jHd d$d,Z/eej jHd d$d-Z0eej jFeej jHd.dddd/Z1eej jFeej jHd.dddd0Z2eej jNeej jHd.d"ddd1Z3eej jNeej jHdd2ddd3Z4eej jHd.d$d4Z5eej jHd.d$d5Z6eej jFeej jHd dddd6Z7eej jFeej jHd dddd7Z8eej jNeej jHd d"ddd8Z9eej jNeej jHdd*ddd9Z:eej jHd d$d:Z;eej jHd d$d;Z<eej jFeej jHd dddd<Z=eej jFeej jHd dddd=Z>eej jNeej jHd d"d dd>Z?eej jNeej jHdd*ddd?Z@eej jHd d$d@ZAeej jHd d$dAZBeej jeej j8dd eddBZCeej jeej j8dd eddCZDeej j2eej j8dd" eddDZEeej j8dedEZFeej j8dedFZGeej jeej j8d dG eddHZIeej jeej jd d eddIZKeej jeej jdJeddKZLeej jdJedLZMdMZNeej jeej jd d eddNZPeej jeej jdJeddOZQeej jdJedPZRdQZSeej j2eej j8dd* eddRZTeej jeej j8d dS eddTZUeej jeej j8d d eddUZVeej j2eej j8dd* eddVZWeej jeej j8d eXj eddWZZeej jeej j8dd eddXZ[eej jeej j8d d eddYZ\eej j8d edZZ]eej jeej j8dd edd[Z^eej jeej j8d d edd\Z_eej j8d ed]Z`eej j2eej j8dd edd^Zaeej jeej j8d d edd_Zbeej j8d ed`Zceej j2eej jdd* eddaZdeej j2eej jddb eddcZeeej j2eej jdd* edddZfeej j2eej jddb eddeZgeej j2eej jd d eddfZheej j2eej jd d eddgZieej jeej jd d" eddhZjeej jeej jd d eddiZkeej jeej jd d eddjZleej jeej jd d eddkZmeej jeej jd d eddlZneej jeej jd d" eddmZoeej jeej jd d* eddnZpeej jd edoZqeej jd edpZreej jd edqZseej jd edrZteej jeej jd d eddsZueej jeej jd d eddtZveej jeej jd d edduZweej jeej jd d" eddvZxeej jeej jd d* eddwZyeej jd edxZzeej jd edyZ{eej jd edzZ|eej jeej jd{d edd|Z}eej jeej jd d edd}Z~eej jeej jd d" edd~Zeej jeej jd d* eddZeej jd{edZeej jd edZeej jeej jd{d eddZeej jeej jd d eddZeej jeej jd d" eddZeej jeej jd d* eddZeej jd{edZeej jd edZeej jeej jdd e ddZeej jeej jdd eddZeej jeej jdd" e ddZeej jeej jd d eddZeej jdeddZeej jdedZeej jeej jd{d eddZeej jeej jd d eddZeej jeej jd d" eddZeej jeej jd d* eddZeej jd{eddZeej jd edZeej jeej jdd e ddZeej jeej jdd e ddZeej jeej jdd" e ddZeej jeej jd d eddZeej jdeddZeej jdedZeej jeej jdd eddZeej jeej jd d eddZeej jeej jd d" eddZeej jdeddZeej jd edZeej jeej jdd e ddZeej jeej jdd e ddZeej jeej jdd" e ddZeej jeej jd d eddZeej jde ddZeej jdedZeej jeej jd{d eddZeej jeej jd d eddZeej jeej jd d" eddZeej jeej jd d* eddZeej jd{eddZeej jd edZeej jeej jd d eddZeej jeej jd d eddZeej jeej jd d" eddZeej jd edZeej jd edZeej jbeej jddddeddZeej jbeej jddddeddZeej jjeej jddd"deddZeej jjeej jdd d*deddZeej jjeej jddddeddZeej jddd$edZeej jddd$edZeej jbeej jdddde ddZeej jbeej jdddde ddZeej jbeej jddddeddZeej jjeej jddd"de dd„Zeej jjeej jddddeddĄZeej jjeej jddddeddƄZeej jddd$edDŽZeej jddd$edȄZeej jbeej jddd deddʄZeej jbeej jddddedd˄Zeej jbeej jddddedd̄Zeej jjeej jddd"dedd̈́Zeej jjeej jddddeddτZeej jbeej jddddeddЄZeej jjeej jdd ddeddфZeej jddd$ed҄Zeej jddd$edӄZeej jeej j8dd eddԄZeej j2eej jd d" eddՄZeej j2eej jdd* eddքZeej jeej jd ej eddׄZeej jeej jd d edd؄Zeej jeej jd d eddلZeej j2eej jd d" eddڄZeej j2eej jd d* eddۄZeej jeej jdɬedd܄Zeej jd ed݄Zeej jd edބZeej j2eej j8dd* edd߄Zeej jeej j8d ej eddZ܈xZS) FirewallDzFirewallD main classTcht|_|jtjj j dd}d}d} t|D]Q} tj}tjjtjj|}nt!j"d|d|r|rn~t$t&|S|tjj*||_tjj*|_t1|tjjt3|jj|j,tjj4|_ y#t$rtjdYSwxYw)NT)set_as_default<)busz Failed to connect to dbus after z retries.)rfwstartdbusmainloopglib DBusGMainLooprange SystemBusserviceBusNamerDBUS_INTERFACE Exceptiontimesleeprinfo1superr!__init__ DBUS_PATHbusnamepathrrDBUS_PATH_CONFIG)selfr%nameretries_before_logretries __class__s >/usr/lib/python3.12/site-packages/firewall/server/firewalld.pyr7zFirewallD.__init__AsD*  (((= !34"..*C<<// 0J0JPS/TD 5 67I6J)Tt i'fkk.C.CD KK)) -dFKK4N4NO% GGNNDLL&++*F*F  !!"JJqM"s!A FF10F1c$|jyN)stopr<s rA__del__zFirewallD.__del__es  cntjdi|_|jj S)Nzstart())rdebug1 _timeoutsr'r(rEs rAr(zFirewallD.starths' 9ww}}rGc`tjd|jjS)Nzstop())rrIr'rDrEs rArDzFirewallD.stopps  8ww||~rGcyrCr<senders rA accessCheckzFirewallD.accessCheckws rGcH|dk(r#tjtjS|dk(rJtjdtjjtjj fzS|dk(r-tj|j jS|dk(r.tj|j jdS|dk(r*tj|j jdS|d k(r.tj|j jd S|d k(r4tj|j jd k(rd SdS|dk(r*tj|j jdS|dk(r)tj|j jS|dk(r)tj|j jS|dk(r*tj|j j dS|dk(rtjd S|dk(rtj"idS|dk(rtj"idStj$j'd|z)Nversioninterface_versionz%d.%dstateIPv4ipv4 IPv4ICMPTypessIPv6ipv6 IPv6_rpfilternoFT IPv6ICMPTypesBRIDGEr IPSetTypesnf_conntrack_helper_settingnf_conntrack_helperssasnf_nat_helpersDorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not exist)r)StringrVERSIONDBUS_INTERFACE_VERSIONDBUS_INTERFACE_REVISIONr' get_stateBooleanis_ipv_enabledArrayipv4_supported_icmp_types_ipv6_rpfilteripv6_supported_icmp_typesebtables_enabled ipset_enabledipset_supported_types Dictionary exceptions DBusException)r<props rA _get_propertyzFirewallD._get_property|s 9 ;;v~~. . ( (;;KK66KK77 W_;;tww0023 3 V^<< 6 6v >? ? _ $::dgg??E E V^<< 6 6v >? ? _ $<<)?)?4)GR RTR R _ $::dgg??E E X << 8 89 9 W_<< 5 56 6 \ !::dgg;;SA A 2 2<<& & + +??2u- - % %??2u- -/////156 rGssv) in_signature out_signaturec$t|t}t|t}tjd|||tj j k(r|j|S|tj jtj jtj jtj jfvr"t jjd|zt jjd|z)NzGet('%s', '%s')rdJorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist)rstrrrIrr)r1rwDBUS_INTERFACE_ZONEDBUS_INTERFACE_DIRECTDBUS_INTERFACE_POLICIESDBUS_INTERFACE_IPSETrtru)r<interface_name property_namerOs rAGetz FirewallD.Gets(<&}c:  $nmD V[[77 7%%m4 4  KK + + KK - - KK / / KK , ,   /////1>?  ////02@A rGrXza{sv}ct|t}tjd|i}|tj j k(rdD]}|j|||<n|tj jtj jtj jtj jfvrn"t jjd|zt j|dS)Nz GetAll('%s')rRrSrTrUrYr[r^rr_r`rarcrWr]r}sv signature)rr~rrIrr)r1rwrrrrrtrurs)r<rrOretxs rAGetAllzFirewallD.GetAlls(< >>2 V[[77 7 ++A.A!" KK + + KK - - KK / / KK , ,   ////02@A  sd33rGssv)rzct|t}t|t}t|}tjd||||j ||t j jk(rH|dvr"t jjd|zt jjd|z|t j jt j jt j jt j jfvr"t jjd|zt jjd|z)NzSet('%s', '%s', '%s')rzGorg.freedesktop.DBus.Error.PropertyReadOnly: Property '%s' is read-onlyrdr})rr~rrIrPrr)r1rtrurrrr)r<rr new_valuerOs rASetz FirewallD.SetsD(<&}c: "9-  *NM9U  V[[77 7! oo3313@A oo3335BC KK + + KK - - KK / / KK , ,   /////1>?  ////02@A rGzsa{sv}asrct|t}t|}t|}tjd|||y)Nz#PropertiesChanged('%s', '%s', '%s'))rr~rrI)r<rchanged_propertiesinvalidated_propertiess rAPropertiesChangedzFirewallD.PropertiesChanged(s@(<+,>?!/0F!G 1   "  rG)r{ctjdtt||j |j j}t||tjj}tjjtjjfD]-}t|||tj t"j }/|S)Nz Introspect())rdebug2r6r! Introspectr:r9get_busrrr)r1rrrr deprecatedr)r<rOdata interfacer@s rArzFirewallD.Introspect6s >"Y0DLLjAD]}|jC|}tEtGjH|}d} |jKD]J} | |jjLvstjd|d| d|jO| d } L|jKD]/} tQ| } | rtS|| r|jO| d } 1| r|jU}|jKD]} tW||  ||vrE|jjY|}tjd|z|j[|n4tjd|z|jj]|||jj_}|jj`jcD]y}|je|} ||vr-|jjg|}|j|n4tjd|z|jji||{|jjk}|jjljoD]}|jq|} ||vrq|jjs|}|j|k7r*tjd|z|j|nMtjd|zn4tjd|z|jju|||jjvjy|jjvj{|jjvj}f} |jj|k7r1tjd |jj|ntjd!|rt t j~y #t $r(}tj"d|d |d }Yd }~Qd }~wwxYw#t $r(}tj"d|d |d }Yd }~d }~wwxYw#t $r(}tj"d|d |d }Yd }~d }~wwxYw#t $rY1wxYw#t $r(}tj"d|d |d }Yd }~d }~wwxYw#t $r(}tj"d|d |d }Yd }~qd }~wwxYw#t $r(}tj"d|d |d }Yd }~d }~wwxYw#t $r%}tj"d"|zd }Yd }~d }~wwxYw)#z$Make runtime configuration permanentzcopyRuntimeToPermanent()FAILEDzSaving runtime to permanent is not allowed while firewalld is in FAILED state. The permanent configuration must be fixed and then firewalld restarted. Try `firewall-offline-cmd --check-config`.FzCopying service '%s' settingsz$Service '%s' is identical, ignoring.zCreating service '%s'z(Runtime To Permanent failed on service 'z': TNzCopying icmptype '%s' settingsz%IcmpType '%s' is identical, ignoring.zCreating icmptype '%s'z)Runtime To Permanent failed on icmptype 'zCopying ipset '%s' settingsz"IPSet '%s' is identical, ignoring.zCreating ipset '%s'z&Runtime To Permanent failed on ipset 'zZone 'z': interface binding for 'z!' has been added by NM, ignoring.zCopying zone '%s' settingszCreating zone '%s'z%Runtime To Permanent failed on zone 'zCreating policy '%s'z'Runtime To Permanent failed on policy 'zCopying helper '%s' settingsz#Helper '%s' is identical, ignoring.zCreating helper '%s'z'Runtime To Permanent failed on helper 'zCopying direct configurationz,Direct configuration is identical, ignoring.z7Runtime To Permanent failed on direct configuration: %s)@rrIr'_staterrRUNNING_BUT_FAILEDrgetServiceNamesr/ get_servicesgetServiceSettingsgetServiceByName getSettingsupdate addServicer2warninggetIcmpTypeNamesicmptype get_icmptypesgetIcmpTypeSettingsgetIcmpTypeByName addIcmpType getIPSetNamesipset get_ipsetsgetIPSetSettingsgetIPSetByNameaddIPSet getZoneNameszone get_zonesgetZoneSettings2rcopydeepcopy getInterfaces_nm_assigned_interfacesremoveInterfacerrgetSettingsDictr getZoneByNameupdate2addZone2getPolicyNamespolicy"get_policies_not_derived_from_zonegetPolicySettingsgetPolicyByName addPolicygetHelperNameshelper get_helpersgetHelperSettingsgetHelperByName addHelperdirectget_all_chains get_all_rulesget_all_passthroughsRT_TO_PERM_FAILED) r<rOerror config_namesr=confconf_objesettingschangedr connections rAruntimeToPermanentzFirewallD.runtimeToPermanentse -. 77>>X %))H {{224 GGOO002D**40D <'#{{;;DAH++-5 #BT#IJ - #ID#PQJJ6=>KK**463*{{335 GG$$224D++D1D <'#{{<?KK++D$75*{{002 GGMM,,.D ,,T2<'#{{99$?H++-5 #@4#GH - #G$#NOJJ4t;<KK((t4/&{{//1 GGLL**,D((.D1$--2EFHG%335  ? ??JJ,,,Y7"G6&335 !? !JJ!&?j&Q 00;"& 6//1%335 +D)<6 <'#{{88>HJJ;dBC$$T*JJ3d:;KK((t4E-R{{113 GGNNEEGD))$/D <'#{{::4@HOOD)JJ5<=KK))$5H"{{113 GGNN..0D))$/D <'#{{::4@H++-5 #AD#HI - #H4#OPJJ5<=KK))$51. GGNN ) ) + GGNN ( ( * GGNN / / 1   {{&&(D0 9: ""4( IJ  8 89 9 i  IMqQ  ,  JNPQR  ,  tUVWX 4!   dTUVW    HLaP  ,  HLaP  (  KKQTUU VE sB)^.B)_" B:`),a  A=aA%bB)c/A#c6. _7__" `+`` aaa aa b #bb  b?b::b? c3 c..c36 d$?dd$)rzr{ is_deprecatedcyrCrMrNs rAenableLockdownzFirewallD.enableLockdownH rGcyrCrMrNs rAdisableLockdownzFirewallD.disableLockdownRrrGbcyNFrMrNs rA queryLockdownzFirewallD.queryLockdown\rG)rrcyrCrMrEs rALockdownEnabledzFirewallD.LockdownEnabledf rGcyrCrMrEs rALockdownDisabledzFirewallD.LockdownDisablednrrGcyrCrMr<commandrOs rAaddLockdownWhitelistCommandz%FirewallD.addLockdownWhitelistCommandzrrGcyrCrMrs rAremoveLockdownWhitelistCommandz(FirewallD.removeLockdownWhitelistCommandrrGcyrrMrs rAqueryLockdownWhitelistCommandz'FirewallD.queryLockdownWhitelistCommandrGascgSrCrMrNs rAgetLockdownWhitelistCommandsz&FirewallD.getLockdownWhitelistCommands  rGcyrCrMr<rs rALockdownWhitelistCommandAddedz'FirewallD.LockdownWhitelistCommandAddedrrGcyrCrMrs rALockdownWhitelistCommandRemovedz)FirewallD.LockdownWhitelistCommandRemovedrrGicyrCrMr<uidrOs rAaddLockdownWhitelistUidz!FirewallD.addLockdownWhitelistUidrrGcyrCrMrs rAremoveLockdownWhitelistUidz$FirewallD.removeLockdownWhitelistUidrrGcyrrMrs rAqueryLockdownWhitelistUidz#FirewallD.queryLockdownWhitelistUidrrGaicgSrCrMrNs rAgetLockdownWhitelistUidsz"FirewallD.getLockdownWhitelistUidsrrGcyrCrMr<rs rALockdownWhitelistUidAddedz#FirewallD.LockdownWhitelistUidAddedrrGcyrCrMrs rALockdownWhitelistUidRemovedz%FirewallD.LockdownWhitelistUidRemovedrrGcyrCrMr<userrOs rAaddLockdownWhitelistUserz"FirewallD.addLockdownWhitelistUserrrGcyrCrMrs rAremoveLockdownWhitelistUserz%FirewallD.removeLockdownWhitelistUserrrGcyrrMrs rAqueryLockdownWhitelistUserz$FirewallD.queryLockdownWhitelistUserrrGcgSrCrMrNs rAgetLockdownWhitelistUsersz#FirewallD.getLockdownWhitelistUsersrrGcyrCrMr<rs rALockdownWhitelistUserAddedz$FirewallD.LockdownWhitelistUserAddedrrGcyrCrMr(s rALockdownWhitelistUserRemovedz&FirewallD.LockdownWhitelistUserRemoved rrGcyrCrMr<contextrOs rAaddLockdownWhitelistContextz%FirewallD.addLockdownWhitelistContext*rrGcyrCrMr-s rAremoveLockdownWhitelistContextz(FirewallD.removeLockdownWhitelistContext4rrGcyrrMr-s rAqueryLockdownWhitelistContextz'FirewallD.queryLockdownWhitelistContext>rrGcgSrCrMrNs rAgetLockdownWhitelistContextsz&FirewallD.getLockdownWhitelistContextsJrrGcyrCrMr<r.s rALockdownWhitelistContextAddedz'FirewallD.LockdownWhitelistContextAddedTrrGcyrCrMr7s rALockdownWhitelistContextRemovedz)FirewallD.LockdownWhitelistContextRemoved\rrGctjd|j||jj |j y)zfEnable panic mode. All ingoing and outgoing connections and packets will be blocked. zenablePanicMode()N)rrIrPr'enable_panic_modePanicModeEnabledrNs rAenablePanicModezFirewallD.enablePanicModehs; &'   !!# rGctjd|j||jj |j y)zDisable panic mode. Enables normal mode: Allowed ingoing and outgoing connections will not be blocked anymore zdisablePanicMode()N)rrIrPr'disable_panic_modePanicModeDisabledrNs rAdisablePanicModezFirewallD.disablePanicModeus; '(   ""$  rGc`tjd|jjS)NzqueryPanicMode())rrIr'query_panic_moderNs rAqueryPanicModezFirewallD.queryPanicMode$ %&ww''))rGc.tjdy)NzPanicModeEnabled()rrEs rAr=zFirewallD.PanicModeEnableds '(rGc.tjdy)NzPanicModeDisabled()rrEs rArAzFirewallD.PanicModeDisableds ()rGz&(sssbsasa(ss)asba(ssss)asasasasa(ss)b)ct|t}tjd||jj j |S)NzgetZoneSettings(%s))rr~rrIr'rget_config_with_settingsr<rrOs rAgetZoneSettingszFirewallD.getZoneSettingss8dC( ($/ww||44T::rGct|t}tjd||jj j |S)NzgetZoneSettings2(%s))rr~rrIr'rget_config_with_settings_dictrKs rArzFirewallD.getZoneSettings2s8 dC( )40ww||99$??rGzsa{sv}cZt|t}tjd||j ||j j j|t|||j||d|vr.|ddkDr%tj|d|j|yyy)NzsetZoneSettings2(%s)timeoutr) rr~rrIrPr'rset_config_with_settings_dict ZoneUpdatedrtimeout_add_secondsZoneUpdatedCurrentSettings)r<rrrOs rAsetZoneSettings2zFirewallD.setZoneSettings2sdC( )40    22 .*F  x(  Xi%81%<  $ $#// &= rGc<tjd|d|dy)Nzzone.ZoneUpdated('', '')r)r<rrs rArRzFirewallD.ZoneUpdateds T8DErGcn|j||jjj|yrC)rRr'rrNr<rs rArTz$FirewallD.ZoneUpdatedCurrentSettingss% tww||II$OPrGct|t}tjd||jj j |S)Nzpolicy.getPolicySettings(%s))rr~rrIr'rrN)r<rrOs rArzFirewallD.getPolicySettingss8  , 16:ww~~;;FCCrGcZt|t}tjd||j ||j j j|t|||j||d|vr.|ddkDr%tj|d|j|yyy)Nzpolicy.setPolicySettings(%s)rPr) rr~rrIrPr'rrQ PolicyUpdatedrrSPolicyUpdatedCurrentSettings)r<rrrOs rAsetPolicySettingszFirewallD.setPolicySettingss , 16:   44 N8,f  68,  Xi%81%<  $ $#11 &= rGc<tjd|d|dy)Nzpolicy.PolicyUpdated('rWrXr)r<rrs rAr]zFirewallD.PolicyUpdateds JKrGcn|j||jjj|yrC)r]r'rrN)r<rs rAr^z&FirewallD.PolicyUpdatedCurrentSettingss& 6477>>#O#OPV#WXrGcttjd|jjj S)NzlistServices())rrIr'r/rrNs rA listServiceszFirewallD.listServicess( #$ww++--rGz(sssa(ss)asa{ss}asa(ss))ct|t}tjd||jj j |}|jdS)NzgetServiceSettings(%s))length)rr~rrIr'r/ get_serviceexport_config_tupler<r/rOobjs rArzFirewallD.getServiceSettingssK!#. +W5ggoo))'2&&a&00rGct|t}tjd||jj j |}|jS)NzgetServiceSettings2(%s))rr~rrIr'r/rgexport_config_dictris rAgetServiceSettings2zFirewallD.getServiceSettings2sF !#. ,g6ggoo))'2%%''rGcttjd|jjj S)NzlistIcmpTypes())rrIr'rrrNs rA listIcmpTypeszFirewallD.listIcmpTypess* $%ww--//rGct|t}tjd||jj j |jS)NzgetIcmpTypeSettings(%s))rr~rrIr'r get_icmptype export_config)r<rrOs rArzFirewallD.getIcmpTypeSettingssC"(C0 ,h7ww,,X6DDFFrGc`tjd|jjS)NzgetLogDenied())rrIr'get_log_deniedrNs rA getLogDeniedzFirewallD.getLogDenied0s$ #$ww%%''rGcVt|t}tjd|z|j ||j j ||j||j j|jj|jy)NzsetLogDenied('%s')) rr~rrIrPr'set_log_deniedLogDeniedChangedrrrr<valuerOs rA setLogDeniedzFirewallD.setLogDenied8sw uc* '%/0   u% e$   rGc4tjd|zy)NzLogDeniedChanged('%s')rr<rzs rArxzFirewallD.LogDeniedChangedGs +u56rGc.tjdy)NzgetAutomaticHelpers()r\rrNs rAgetAutomaticHelperszFirewallD.getAutomaticHelpersPs *+rGcvt|t}tjd|z|j |y)NzsetAutomaticHelpers('%s'))rr~rrIrPrys rAsetAutomaticHelperszFirewallD.setAutomaticHelpersZs0 uc* .67  rGc4tjd|zy)NzAutomaticHelpersChanged('%s')rr}s rAAutomaticHelpersChangedz!FirewallD.AutomaticHelpersChangedes 2e<=rGc`tjd|jjS)NzgetDefaultZone())rrIr'get_default_zonerNs rAgetDefaultZonezFirewallD.getDefaultZonenrFrGcVt|t}tjd|z|j ||j j ||j||j j|jj|jy)NzsetDefaultZone('%s')) rr~rrIrPr'set_default_zoneDefaultZoneChangedrrrrKs rAsetDefaultZonezFirewallD.setDefaultZonevsw dC( )D01     & %   rGc4tjd|zy)NzDefaultZoneChanged('%s')rrZs rArzFirewallD.DefaultZoneChangeds -67rGcttjd|jjj S)Nzpolicy.getPolicies())rrIr'rrrNs rA getPolicieszFirewallD.getPoliciess( )*ww~~@@BBrGz a{sa{sas}}c<tjdi}|jjj D]]}i||<|jjj |||d<|jjj |||d<_|S)Nzpolicy.getActivePolicies() ingress_zones egress_zones)rrIr'r)get_active_policies_not_derived_from_zonelist_ingress_zoneslist_egress_zones)r<rOpoliciesrs rAgetActivePolicieszFirewallD.getActivePoliciess /0ggnnNNPF!HV 040Q0Q1HV _ -04ww~~/O/OPV/WHV ^ , Q rGcttjd|jjj S)Nzzone.getZones())rrIr'rrrNs rAgetZoneszFirewallD.getZoness( $%ww||%%''rGc"tjdi}|jjj D]P}|jjj ||jjj |d||<R|S)Nzzone.getActiveZones()) interfacessources)rrIr'rget_active_zoneslist_interfaces list_sources)r<rOzonesrs rAgetActiveZoneszFirewallD.getActiveZonesso *+GGLL113D"ggll::4@77<<44T:E$K4  rGct|t}tjd|z|jj j |}|r|Sy)zReturn the zone an interface belongs to. :Parameters: `interface` : str Name of the interface :Returns: str. The name of the zone. zzone.getZoneOfInterface('%s')r)rr~rrIr'rget_zone_of_interface)r<rrOrs rAgetZoneOfInterfacezFirewallD.getZoneOfInterfacesE#9c2  2Y>?ww||11)< KrGct|t}tjd|z|jj j |}|r|Sy)Nzzone.getZoneOfSource('%s')r)rr~rrIr'rget_zone_of_source)r<sourcerOrs rAgetZoneOfSourcezFirewallD.getZoneOfSourcesE , /&89ww||..v6 KrGcyrrMrKs rA isImmutablezFirewallD.isImmutablesrGct|t}t|t}tjd|d|d|j ||j j j|||}|j|||S)zPAdd an interface to a zone. If zone is empty, use default zone. zzone.addInterface('rWrX) rr~rrIrPr'r add_interfaceInterfaceAddedr<rrrO_zones rA addInterfacezFirewallD.addInterfacesldC("9c2  dIFG   **4FC E9- rGcht|t}t|t}|j|||S)zChange a zone an interface is part of. If zone is empty, use default zone. This function is deprecated, use changeZoneOfInterface instead )rr~changeZoneOfInterfacer<rrrOs rA changeZonezFirewallD.changeZone s1dC("9c2 ))$ 6BBrGct|t}t|t}tjd|d|d|j ||j j j|||}|j|||S)z[Change a zone an interface is part of. If zone is empty, use default zone. zzone.changeZoneOfInterface('rWrX) rr~rrIrPr'rchange_zone_of_interfaceZoneOfInterfaceChangedrs rArzFirewallD.changeZoneOfInterfacesldC("9c2  tYOP   55dIvN ##E95 rGct|t}t|t}tjd|d|d|j ||j j j||}|j|||S)zkRemove interface from a zone. If zone is empty, remove from zone the interface belongs to. zzone.removeInterface('rWrX) rr~rrIrPr'rremove_interfaceInterfaceRemovedrs rArzFirewallD.removeInterface+sjdC("9c2  yIJ   --dI> eY/ rGct|t}t|t}tjd|d|d|jj j ||S)z^Return true if an interface is in a zone. If zone is empty, use default zone. zzone.queryInterface('rWrX)rr~rrIr'rquery_interfacers rAqueryInterfacezFirewallD.queryInterface=sHdC("9c2  iHIww||++D)<.>tX V udHg6 rGsssc :t|t}t|t}t|t}tjd|d|d|d|j ||j j j|||}|j||||S)Nzzone.removePort('rWrX) rr~rrIrPr'r remove_portrr<rrrrOrs rA removePortzFirewallD.removePorts|dC(dC(!(C0 $hOP   ((tX> h/ rGc t|t}t|t}t|t}tjd|d|d|d|jj j |||S)Nzzone.queryPort('rWrX)rr~rrIr'r query_portr<rrrrOs rA queryPortzFirewallD.queryPortsXdC(dC(!(C0 tXNOww||&&tT8<t|t}t|t}t|t}t|t}t|t}tjd|d|d|d|d|d |jj j |||||S)Nzzone.queryForwardPort('rWrX)rr~rrIr'rquery_forward_port)r<rrrrKrLrOs rAqueryForwardPortzFirewallD.queryForwardPortsdC(dC(!(C0,, T8VV 5 ww||..tT8VVTTrGct|t}tjd|z|jj j |S)Nzzone.getForwardPorts('%s'))rr~rrIr'rlist_forward_portsrKs rAgetForwardPortszFirewallD.getForwardPortss;dC( /489ww||..t44rGc @tjd||||||fzy)Nz7zone.ForwardPortAdded('%s', '%s', '%s', '%s', '%s', %d)r)r<rrrrKrLrPs rArJzFirewallD.ForwardPortAddeds( ET8VVW= > rGc Ntjd|d|d|d|d|d y)Nzzone.ForwardPortRemoved('rWrXr)r<rrrrKrLs rArIzFirewallD.ForwardPortRemoveds T8VV 5 rGct|t}t|t}t|t}tjd|d|d|j ||j jj||||}|dkDr"tj||j|||j||||S)Nzzone.enableIcmpBlock('rWrXr) rr~rrrIrPr'radd_icmp_blockrrSIcmpBlockRemovedIcmpBlockAdded)r<ricmprPrOrs rA addIcmpBlockzFirewallD.addIcmpBlocksdC(dC( #. tDE   ++D$H Q;  $ $Wd.C.CUD Q E41 rGct|t}t|t}tjd|d|d|j ||j j j||}|j|||S)Nzzone.removeIcmpBlock('rWrX) rr~rrIrPr'rremove_icmp_blockr\)r<rr^rOrs rAremoveIcmpBlockzFirewallD.removeIcmpBlock)sjdC(dC( tDE   ..tT: eT* rGct|t}t|t}tjd|d|d|jj j ||S)Nzzone.queryIcmpBlock('rWrX)rr~rrIr'rquery_icmp_block)r<rr^rOs rAqueryIcmpBlockzFirewallD.queryIcmpBlock9sHdC(dC( dCDww||,,T488rGct|t}tjd|z|jj j |S)Nzzone.getIcmpBlocks('%s'))rr~rrIr'rlist_icmp_blocksrKs rA getIcmpBlockszFirewallD.getIcmpBlocksEs;dC( -67ww||,,T22rGc:tjd|||fzy)Nz#zone.IcmpBlockAdded('%s', '%s', %d)r)r<rr^rPs rAr]zFirewallD.IcmpBlockAddedRs 8D$;PPQrGc<tjd|d|dy)Nzzone.IcmpBlockRemoved('rWrXr)r<rr^s rAr\zFirewallD.IcmpBlockRemovedWs $EFrGct|t}tjd|z|j ||j j j||}|j||S)Nz zone.addIcmpBlockInversion('%s')) rr~rrIrPr'radd_icmp_block_inversionIcmpBlockInversionAddedr?s rAaddIcmpBlockInversionzFirewallD.addIcmpBlockInversion`s]dC( 5>?   55dFC $$U+ rGct|t}tjd|z|j ||j j j|}|j||S)Nz#zone.removeIcmpBlockInversion('%s')) rr~rrIrPr'rremove_icmp_block_inversionIcmpBlockInversionRemovedr?s rAremoveIcmpBlockInversionz"FirewallD.removeIcmpBlockInversionos[dC( 8DAB   88> &&u- rGct|t}tjd|z|jj j |S)Nz"zone.queryIcmpBlockInversion('%s'))rr~rrIr'rquery_icmp_block_inversionrKs rAqueryIcmpBlockInversionz!FirewallD.queryIcmpBlockInversion~s;dC( 74@Aww||66t<z$FirewallD.addRule.. :T^As+Tz*direct.addRule('%s', '%s', '%s', %d, '%s')',') rr~rtuplerrIjoinrPr'rr RuleAddedr<r|r}r~priorityargsrOs rAaddRulezFirewallD.addRulesS#&uc*uc*!(C0:T:: 8E5(EJJt,<= >    UE8TB sE5(D9rGc t|t}t|t}t|t}t|t}td|D}t j d||||dj |fz|j||jjj||||||j|||||y)Nc3<K|]}t|tywrCrrs rArz'FirewallD.removeRule..( rrz-direct.removeRule('%s', '%s', '%s', %d, '%s')r) rr~rrrrIrrPr'rr RuleRemovedrs rA removeRulezFirewallD.removeRule sS#&uc*uc*!(C0:T:: ;E5(EJJt,<= >    ""3uhE eUHd;rGc t|t}t|t}t|t}tjd|d|d|d|j ||j j j|||D]C\}}|j j j||||||j|||||Ey)Nzdirect.removeRules('rWrX) rr~rrIrPr'r get_rulesrr)r<r|r}r~rOrrs rA removeRuleszFirewallD.removeRules1 sS#&uc*uc* S%OP  "ggnn66sE5INHd GGNN & &sE5(D I   S%$ ?JrGc Pt|t}t|t}t|t}t|t}td|D}t j d||||dj |fz|jjj|||||S)Nc3<K|]}t|tywrCrrs rArz&FirewallD.queryRule..T rrz,direct.queryRule('%s', '%s', '%s', %d, '%s')r) rr~rrrrIrr'rrrs rA queryRulezFirewallD.queryRuleD sS#&uc*uc*!(C0:T:: :E5(EJJt,<= > ww~~((eUHdKKrGza(ias)c t|t}t|t}t|t}tjd|d|d|d|jj j |||S)Nzdirect.getRules('rWrX)rr~rrIr'rrr{s rAgetRuleszFirewallD.getRules[ sXS#&uc*uc* #ueLMww~~''UE::rGz a(sssias)cttjd|jjj S)Nzdirect.getAllRules())rrIr'rrrNs rA getAllRuleszFirewallD.getAllRulesk s( )*ww~~++--rGc \tjd||||dj|fzy)Nz,direct.RuleAdded('%s', '%s', '%s', %d, '%s')rrrIrr<r|r}r~rrs rArzFirewallD.RuleAddedx s/ :E5(EJJt,<= > rGc \tjd||||dj|fzy)Nz.direct.RuleRemoved('%s', '%s', '%s', %d, '%s')rrrs rArzFirewallD.RuleRemoved s/ <E5(EJJt,<= > rGrbc2t|t}td|D}tjd|ddj |d|j | |jjj||S#t$r}|dvrtgd}n tdd g}t|}|jtjk(r:tt||zd krtj |t#|d}~wwxYw) Nc3<K|]}t|tywrCrrs rArz(FirewallD.passthrough.. rrzdirect.passthrough('rWrrX)rVrZ)z-Cz--check-L--listrrr)rr~rrrIrrPr'r passthroughrsetcoderCOMMAND_FAILEDlenrr )r<r|rrOr query_argsmsgs rArzFirewallD.passthrough sS#&:T:: sEJJt>--c48 8 && !BC  $!12 e*CzzV222s4y:-.!3KK$+C00  s %B DBDDc&t|}td|D}tjd|ddj |d|j ||j jj|||j||y)Nc32K|]}t|ywrCrrs rArz+FirewallD.addPassthrough.. 51^A&zdirect.addPassthrough('rWrrX) rrrrIrrPr'radd_passthroughPassthroughAddedr<r|rrOs rAaddPassthroughzFirewallD.addPassthrough snS!555 #uzz$?OPQ   &&sD1 c4(rGc&t|}td|D}tjd|ddj |d|j ||j jj|||j||y)Nc32K|]}t|ywrCrrs rArz.FirewallD.removePassthrough.. rrzdirect.removePassthrough('rWrrX) rrrrIrrPr'rremove_passthroughPassthroughRemovedrs rAremovePassthroughzFirewallD.removePassthrough snS!555 S%**TBRST   ))#t4 T*rGct|}td|D}tjd|ddj |d|j j j||S)Nc32K|]}t|ywrCrrs rArz-FirewallD.queryPassthrough.. rrzdirect.queryPassthrough('rWrrX)rrrrIrr'rquery_passthroughrs rAqueryPassthroughzFirewallD.queryPassthrough sSS!555 CDAQRSww~~//T::rGza(sas)cttjd|jjj S)Nzdirect.getAllPassthroughs())rrIr'rrrNs rAgetAllPassthroughszFirewallD.getAllPassthroughs s( 01ww~~2244rGctjdt|jD]}|j|y)Nzdirect.removeAllPassthroughs())rrIreversedrr)r<rOrs rAremoveAllPassthroughszFirewallD.removeAllPassthroughs s9 34#D$;$;$=>K "D " "K 0?rGct|}tjd||jjj |S)Nzdirect.getPassthroughs('%s'))rrrIr'rget_passthroughs)r<r|rOs rAgetPassthroughszFirewallD.getPassthroughs s6S! 137ww~~..s33rGcZtjd|ddj|dy)Nzdirect.PassthroughAdded('rWrrXrr<r|rs rArzFirewallD.PassthroughAdded s CDAQRSrGcZtjd|ddj|dy)Nzdirect.PassthroughRemoved('rWrrXrrs rArzFirewallD.PassthroughRemoved s c5::dCSTUrGcy)zPK_ACTION_ALL implies all other actions, i.e. once a subject is authorized for PK_ACTION_ALL it's also authorized for any other action. Use-case is GUI (RHBZ#994729). NrMrNs rA authorizeAllzFirewallD.authorizeAll! rrGct|}tjd|z|jjj |S)Nzipset.queryIPSet('%s'))rrrIr'r query_ipsetr<rrOs rA queryIPSetzFirewallD.queryIPSet/ s9u% +u56ww}}((//rGcttjd|jjj S)Nzipsets.getIPSets())rrIr'rrrNs rA getIPSetszFirewallD.getIPSets: s( '(ww}}''))rGct|t}tjd||jj j |jS)NzgetIPSetSettings(%s))rr~rrIr'r get_ipsetrrrs rArzFirewallD.getIPSetSettingsD sAuc* )51ww}}&&u-;;==rGct|}t|}tjd|d|d|j||jj j |||j||y)Nzipset.addEntry('rWrX)rrrIrPr'r add_entry EntryAddedr<rentryrOs rAaddEntryzFirewallD.addEntryS s]u%u% 5%@A    u- u%rGct|}t|}tjd|d|d|j||jj j |||j||y)Nzipset.removeEntry('rWrX)rrrIrPr'r remove_entry EntryRemovedrs rA removeEntryzFirewallD.removeEntrya s_u%u% eUCD    ""5%0 %'rGct|}t|}tjd|d|d|jjj ||S)Nzipset.queryEntry('rWrX)rrrIr'r query_entryrs rA queryEntryzFirewallD.queryEntryo sDu%u% UEBCww}}((66rGct|}tjd|z|jjj |S)Nzipset.getEntries('%s'))rrrIr'r get_entriesrs rA getEntrieszFirewallD.getEntries{ s9u% +e34ww}}((//rGct|}t|t}tjd|dj ||j j j|}|j j j||t|}t|}||z D]}|j||||z D]}|j||y)Nzipset.setEntries('%s', '[%s]'),) rlistrrIrr'rr set_entriesrrr)r<rentriesrO old_entriesold_entries_set entries_setrs rA setEntrieszFirewallD.setEntries s u% $/ 3UCHHW>@@rGrC)r)__name__ __module__ __qualname____doc__ persistentrr)PK_ACTION_CONFIGdefault_polkit_auth_requiredrr7rFr(rDrPr rwr PROPERTIES_IFACErrrrr rPK_ACTION_INFOINTROSPECTABLE_IFACErr1rrrrrrPK_ACTION_POLICIESrrrPK_ACTION_POLICIES_INFOrrrrrrrr r rrrrrrr r"r$r&r)r+r/r1r3r5r8r:r>rBrEr=rAPK_ACTION_CONFIG_INFOrLrrrUrRrTDBUS_INTERFACE_POLICYrr_r]r^rcrrmrorDBUS_SIGNATURErrur{rxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrrrrr!r$rrr+r.r1r4r*r)r<r@rCr;r:rMrQrTrWrJrIr_rbrerhr]r\rnrrrurmrqPK_ACTION_DIRECTrrrPK_ACTION_DIRECT_INFOrrrrzrrrrrrrrrrrrrrrrrr PK_ACTION_ALLrrrrrrrrrrrrrrrr __classcell__)r@s@rAr!r!9s/J&#);;#?#? 9! ! F  33j..TQTUV0..SPWX$4Y$4Lfkk::;..UC/D</b..*E  F  fkk88922#FG:.fkk::;33"TVWX<fkk::;33"TVW X< 334!5!fkk::;33"TVWX<fkk::;33"TVW&X<&fkk::;33"TVWx:X<x:@fkk<<= ++   > fkk<<= ++   > fkkAAB ++   C ++     ++    fkk<<= ++   > fkk<<= ++   > fkkAAB ++ # C fkkAAB ++   C ++     ++    fkk<<= ++   > fkk<<= ++   > fkkAAB ++   CfkkAAB ++   C ++     ++    fkk<<= ++   > fkk<<= ++   > fkkAAB ++   CfkkAAB ++   C ++     ++    fkk<<= ++   > fkk<<= ++   > fkkAAB ++ # C fkkAAB ++   C ++     ++    fkk::;33"TVW X< fkk::;33"TVW !X< !fkk88933"TWX*Y:* 33rB)C)33rB*C*fkk??@ ""> ; A; fkk??@ ''c@A @ fkk::;88xP Q< 88HMFNFQfkk??@ ))7DA D fkk::;::R S< ::hOLPLYfkk889 ""4.: .fkk??@ ""0 1 A1fkk??@ ""G(A ( fkk889 ""40: 0fkk??@ ""-- G AGfkk??@33"TWX(YA( fkk::;33#UWX Y< 33sC7D7fkk??@33"TWXYAfkk::;33#UWX!Y<!33sC>D>fkk88933"TWX*Y:* fkk::;33#UWX Y< 33sC8D8fkk889 ))$C: Cfkk889 )), : "fkk889 ''b(: ( fkk889 ''b  : fkk889 ''c : fkk889 ''c: fkk??@ ''cA fkk::; ''d# < fkk::; ''d#C< Cfkk::; ''d# < fkk::; ''d# < fkk??@ ''d#=A =fkk??@ ''c2A 288DIJJJ88DIGJG 88DI*J*88DILJLfkk::; ''d# < fkk::; ''d# < fkk::; ''d# < fkk??@ ''d#7A 7fkk??@ ''c/A /88DIDJD88DILJL88DIFJFfkk::; ''e3 < fkk::; ''d#< fkk??@ ''d#2A 2fkk??@ ''c-A -88EJQKQ88DIFJFfkk::; ''e3<  fkk::; ''d# < fkk??@ ''d#9A 9fkk??@ ''c0A 088EJSKS88DIHJHfkk::; ''fC48< $fkk::; ''e3 < fkk??@ ''e3+/=A =fkk??@ ''c-A -88FK L 88EJRKRfkk::; ''e3 < fkk::; ''d# < fkk??@ ''d#;A ;fkk??@ ''c1A 188EJUKU88DIJJJfkk::; ''fC48< (fkk::; ''e3+/ < fkk??@ ''e3+/DA Dfkk??@ ''c4A 488FK L 88EJXKXfkk::; ''d# < fkk::; ''c< fkk??@ ''c3A 3 88DIGJG88CH<I<fkk::; ''hcDH< 6fkk::; ''gS;?< &fkk??@ ''gS;? UA Ufkk??@ ''c5A 588HM<= N 88GL M fkk::; ''e3 < fkk::; ''d# < fkk??@ ''d#9A 9fkk??@ ''c3A 388EJRKR88DIGJGfkk::; ''c< fkk::; ''c< fkk??@ ''c=A = 88CHBIB88CHDIDfkk::; ))  + <+fkk::; ))  - <-fkk??@ ))  = A=fkk??@ ))  5 A5fkk??@ ))  / A/  )) P  P )) R  Rfkk::; ))  8<: <:"fkk::; ))  8<< <<"fkk::; ))   @ < @fkk??@ ))  8< L A Lfkk??@ ))  ; A;fkk??@ ))!  . A.  ))      ))     fkk::; ))   <,fkk::; ))  ) <)fkk::; ))  + <+fkk??@ ))  ; A;fkk??@ ))  5 A5 fkk::; ))  1 <1fkk??@ ))  4 A4  )) T  T )) V  V fkk77833"TVW X9 fkk889 ((s#0: 0 fkk889 ((r*: * fkk??@ ((** > A>fkk::; ((t2&< &fkk::; ((t2(< (fkk889 ((t37: 7fkk889 ((s$0: 0 fkk::;99N ,O< ,99TJDKD 99TJFKFfkk889 ""4,: , fkk??@ ""++ A AArGr!)4 gi.repositoryrr3rr) dbus.servicedbus.mainloop.glibfirewallrfirewall.core.fwrfirewall.core.richrfirewall.core.loggerrfirewall.clientrfirewall.server.dbusr r firewall.server.decoratorsr r r rrrrfirewall.server.configrfirewall.dbus_utilsrrrrfirewall.core.io.functionsrfirewall.core.io.ipsetrfirewall.core.io.icmptyperfirewall.core.io.helperrfirewall.core.fw_nmrrfirewall.core.fw_ifcfgrrfirewall.errorsrr!rMrGrAr+sx %($6I3 <(.*?)E*A!E*ArG