MINI MINI MANI MO
ó
dßØ[c % @ sk d d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ g% Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d' l m
Z
d% d( l m Z d% d) l
m Z m Z m Z e j d* k Z d+ „ Z d, „ Z d- d. „ Z d/ „ Z d0 „ Z d1 „ Z d2 „ Z d3 „ Z d4 „ Z d5 „ Z d6 „ Z d7 „ Z d8 „ Z d9 „ Z d: „ Z! d; „ Z" d< „ Z# d= „ Z$ d> „ Z% d? „ Z& d@ „ Z' dA „ Z( dB „ Z) dC „ Z* dD „ Z+ dE „ Z, dF „ Z- dG „ Z. dH „ Z/ dI „ Z0 dJ „ Z1 dK „ Z2 dL „ Z3 dM „ Z4 dN „ Z5 dO „ Z6 d& S(P t PY2t getPortIDt getPortRanget portStrt getServiceNamet checkIPt checkIP6t checkIPnMaskt
checkIP6nMaskt
checkProtocolt checkInterfacet checkUINT32t firewalld_is_activet tempFilet readfilet writefilet enable_ip_forwardingt get_nf_conntrack_helper_settingt set_nf_conntrack_helper_settingt get_nf_conntrack_helperst get_nf_nat_helperst
check_portt
check_addresst check_single_addresst check_mact uniqifyt ppid_of_pidt max_zone_name_lent checkUsert checkUidt checkCommandt checkContextt joinArgst splitArgst b2ut u2bt
u2b_if_py2iÿÿÿÿN( t log( t runProg( t FIREWALLD_TEMPDIRt FIREWALLD_PIDFILEt COMMANDSt 3c C s t | t ƒ r | } nd | r- | j ƒ } n y t | ƒ } Wn< t k
r{ y t j | ƒ } Wq| t j k
rw d SXn X| d k rŒ d S| S( sÎ Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
iÿÿÿÿiÿÿ iþÿÿÿ( t
isinstancet intt stript
ValueErrort sockett
getservbynamet error( t portt _id( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR . s
c C s> t | t ƒ s | j ƒ r> t | ƒ } | d k r: | f S| S| j d ƒ } t | ƒ d k rð | d j ƒ rð | d j ƒ rð t | d ƒ } t | d ƒ } | d k rð | d k rð | | k rÍ | | f S| | k rã | | f S| f Sqð n g } xt t | ƒ d d ƒ D]÷ } t d j | | ƒ ƒ } d j | | ƒ } t | ƒ d k rÑt | ƒ } | d k r| d k r| | k r™| j | | f ƒ qÎ| | k r»| j | | f ƒ qÎ| j | f ƒ qq| d k r| j | f ƒ | t | ƒ k rPqqqWt | ƒ d k r d St | ƒ d k r6d S| d S( sI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
i t -i i iÿÿÿÿN(
R+ R, t isdigitR t splitt lent ranget joint appendt None( t portst id1t splitst id2t matchedt it port2( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR E sH 2
t :c C sr | d k r d St | ƒ } t | t ƒ r; | d k r; d St | ƒ d k rU d | Sd | d | | d f Sd S( s Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
t i i s %ss %s%s%sN( R R+ R, R; R7 ( R2 t delimitert _range( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR { s c C s8 y t j t | ƒ | ƒ } Wn t j k
r3 d SX| S( sÞ Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N( R/ t
getservbyportR, R1 R; ( R2 t protot name( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s3 y t j t j | ƒ Wn t j k
r. t SXt S( sl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
( R/ t inet_ptont AF_INETR1 t Falset True( t ip( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR › s
c C s3 y t j t j | ƒ Wn t j k
r. t SXt S( sl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
( R/ RJ t AF_INET6R1 RL RM ( RN ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ¨ s
c C sá d | k ra | | j d ƒ } | | j d ƒ d } t | ƒ d k sZ t | ƒ d k rm t Sn | } d } t | ƒ s} t S| rÝ d | k r™ t | ƒ Sy t | ƒ } Wn t k
r½ t SX| d k sÖ | d k rÝ t Sn t S( Nt /i t .i i ( t indexR7 RL R; R R, R. RM ( RN t addrt maskRA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR µ s& $
c C sË d | k ra | | j d ƒ } | | j d ƒ d } t | ƒ d k sZ t | ƒ d k rm t Sn | } d } t | ƒ s} t S| rÇ y t | ƒ } Wn t k
r§ t SX| d k sÀ | d k rÇ t Sn t S( NRP i i i€ ( RR R7 RL R; R R, R. RM ( RN RS RT RA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Ì s" $
c C sm y t | ƒ } Wn: t k
rL y t j | ƒ Wqi t j k
rH t SXn X| d k se | d k ri t St S( Ni iÿ ( R, R. R/ t getprotobynameR1 RL RM ( t protocolRA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR á s
c C sN | s t | ƒ d k r t Sx* d d d d g D] } | | k r0 t Sq0 Wt S( s¬ Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
i t RP t !t *( R7 RL RM ( t ifacet ch( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
ð s c C sH y t | d ƒ } Wn t k
r' t SX| d k rD | d k rD t St S( Ni Iÿÿÿÿ ( R, R. RL RM ( t valt x( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s t j j t ƒ s t Sy( t t d ƒ } | j ƒ } Wd QXWn t k
rR t SXt j j d | ƒ sm t Sy, t d | d ƒ } | j ƒ } Wd QXWn t k
r t SXd | k r¾ t St S( sv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
t rNs /proc/%ss /proc/%s/cmdlinet firewalld( t ost patht existsR( RL t opent readlinet ExceptionRM ( t fdt pidt cmdline( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
s"
c C sy yK t j j t ƒ s( t j t d ƒ n t j d d d d d t d t ƒ SWn' t k
rt } t j
d | ƒ ‚ n Xd S( Niè t modet wtt prefixs temp.t dirt deletes# Failed to create temporary file: %s( R` Ra Rb R' t mkdirt tempfilet NamedTemporaryFileRL Re R% R1 R; ( t msg( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
* s c C sW y& t | d ƒ } | j ƒ SWd QXWn* t k
rR } t j d | | f ƒ n Xd S( NR^ s Failed to read file "%s": %s( Rc t readlinesRe R% R1 R; ( t filenamet ft e( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR 6 s c C s[ y) t | d ƒ } | j | ƒ Wd QXWn+ t k
rV } t j d | | f ƒ t SXt S( Nt ws Failed to write to file "%s": %s( Rc t writeRe R% R1 RL RM ( Rs t lineRt Ru ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR > s c C s6 | d k r t d d ƒ S| d k r2 t d d ƒ St S( Nt ipv4s /proc/sys/net/ipv4/ip_forwards 1
t ipv6s& /proc/sys/net/ipv6/conf/all/forwarding( R RL ( t ipv( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR G s
c C s¨ t j ƒ d } d | } i } t j j | ƒ r¤xot t j | ƒ ƒ D]U} | j d ƒ sc qH n | j d ƒ d } t t d | g ƒ \ } } | d k r¤ qH n | j d ƒ r| j d ƒ d j
ƒ } | j d d ƒ } | j d
d ƒ } | j | g ƒ j
| ƒ qH n x‹ | j d ƒ D]z } | j d
ƒ r d | k r | j d ƒ d j
ƒ } | j d d ƒ } | j d d ƒ } | j | g ƒ j
| ƒ q q WqH Wn | S( Ni s% /lib/modules/%s/kernel/net/netfilter/t
nf_conntrack_RQ i t modinfot nf_conntrack_proto_t _R4 s
nf-conntrack-RD s
s alias:s -helper-RC i s nfct-helper-( R` t unameRa t isdirt sortedt listdirt
startswithR6 R& R) R- t replacet
setdefaultR: ( t kverRa t helpersRs t modulet statust rett helperRx ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR N s0
'c
C s± t j ƒ d } i } x”d | d | d | g D]w} t j j | ƒ r2 x\t t j | ƒ ƒ D]B} | j d ƒ s{ q` n | j d ƒ d } t t d | g ƒ \ } } | d k r¼ q` n | j d ƒ r'| j d ƒ d j
ƒ } | j d
d ƒ } | j d d
ƒ } | j | g ƒ j
| ƒ q` n d } xr | j d ƒ D]a } | j d ƒ r=d | k r=| j d d
ƒ } | j d
d ƒ } | j | g ƒ j
| ƒ q=q=Wq` Wq2 q2 W| S( Ni s% /lib/modules/%s/kernel/net/netfilter/s* /lib/modules/%s/kernel/net/ipv4/netfilter/s* /lib/modules/%s/kernel/net/ipv6/netfilter/t nf_nat_RQ i R} t
nf_nat_proto_R R4 s nf-nat-RD s
s description:s
NAT helper( R` R€ Ra R R‚ Rƒ R„ R6 R& R) R- R… R† R: R; (
R‡ Rˆ Ra Rs R‰ RŠ R‹ RŒ t aliasRx ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR l s4
+c C s> y t t d ƒ d ƒ SWn t k
r9 t j d ƒ d SXd S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helperi s3 Failed to get and parse nf_conntrack_helper setting( R, R Re R% t warning( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Œ s
c C s t d | r d n d ƒ S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helpers 1
s 0
( R ( t flag( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR “ s c C sø t | ƒ } | d k sV | d k sV | d k sV t | ƒ d k rô | d | d k rô | d k rv t j d | ƒ nz | d k r– t j d | ƒ nZ | d k r¶ t j d | ƒ n: t | ƒ d k rð | d | d k rð t j d | ƒ n t St S(
Niþÿÿÿiÿÿÿÿi i i s '%s': port > 65535s '%s': port is invalids '%s': port is ambiguouss '%s': range start >= end( R R; R7 R% t debug2RL RM ( R2 RF ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR — s $& &c C s4 | d k r t | ƒ S| d k r, t | ƒ St Sd S( NRy Rz ( R R RL ( R{ t source( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ¦ s
c C s4 | d k r t | ƒ S| d k r, t | ƒ St Sd S( NRy Rz ( R R RL ( R{ R“ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ® s
c C sg t | ƒ d k rc x" d D] } | | d k r t Sq Wx% d D] } | | t j k r> t Sq> Wt St S( Ni i i i i i RC i i i i i i i i
i
i i i ( i i i i i ( i i i i i i i i
i i
i i ( R7 RL t stringt hexdigitsRM ( t macRA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ¶ s
c C s7 g } x* | D]" } | | k r
| j | ƒ q
q
W| S( N( R: ( t _listt outputR] ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Â s
c C sV y= t j d | ƒ } t | j ƒ d j ƒ ƒ } | j ƒ Wn t k
rQ d SX| S( s Get parent for pid s ps -o ppid -h -p %d 2>/dev/nulli N( R` t popenR, Rr R- t closeRe R; ( Rg Rt ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Ê s
c C s= d d l m } t t t | j ƒ ƒ ƒ } d | t d ƒ S( s©
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
iÿÿÿÿ( t SHORTCUTSi t __allow( t firewall.core.baseR› t maxt mapR7 t values( R› t longest_shortcut( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Ô s c C st t | ƒ d k s- t | ƒ t j d ƒ k r1 t Sx< | D]4 } | t j k r8 | t j k r8 | d k r8 t Sq8 Wt S( Ni t SC_LOGIN_NAME_MAXRQ R4 R t $( RQ R4 R R£ ( R7 R` t sysconfRL R” t
ascii_letterst digitsRM ( t usert c( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR Þ s -
c C sW t | t ƒ r7 y t | ƒ } Wq7 t k
r3 t SXn | d k rS | d k rS t St S( Ni i i i I € iÿÿÿ( R+ t strR, R. RL RM ( t uid( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR è s
c C sj t | ƒ d k s$ t | ƒ d k r( t Sx' d d d g D] } | | k r8 t Sq8 W| d d k rf t St S( Ni i t |s
t i RP ( R7 RL RM ( t commandR[ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ò s $ c C s› | j d ƒ } t | ƒ d
k r% t S| d d k rM | d d d k rM t S| d d d k re t S| d
d d k r} t St | d ƒ d k r— t St S( NRC i i i t rootiþÿÿÿt _ui t _ri t _ti ( i i ( R6 R7 RL RM ( t contextR> ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR ü s $c C sD d t t ƒ k r) d j d „ | Dƒ ƒ Sd j d „ | Dƒ ƒ Sd S( Nt quoteRW c s s | ] } t j | ƒ Vq d S( N( t shlexR³ ( t .0t a( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr> s c s s | ] } t j | ƒ Vq d S( N( t pipesR³ ( Rµ R¶ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr> s ( Rl R´ R9 ( t args( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s c C sN t r= t | t ƒ r= t | ƒ } t j | ƒ } t t | ƒ St j | ƒ Sd S( N( R R+ t unicodeR# R´ R6 RŸ R" ( t _stringR> ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR! s
c C s# t | t ƒ r | j d d ƒ S| S( s bytes to unicode s UTF-8R… ( R+ t bytest decode( Rº ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR" s c C s# t | t ƒ s | j d d ƒ S| S( s unicode to bytes s UTF-8R… ( R+ R» t encode( Rº ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR# # s c C s) t r% t | t ƒ r% | j d d ƒ S| S( s" unicode to bytes only if Python 2s UTF-8R… ( R R+ R¹ R½ ( Rº ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR$ ) s (7 t __all__R/ R` t os.pathR´ R· R” t sysRo t firewall.core.loggerR% t firewall.core.progR& t firewall.configR' R( R) t versionR R R R R R R R R R R
R R R
R R R R R R R R R R R R R R R R R R R R! R" R# R$ ( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt <module> sp 6
OHA YOOOO