관리-도구
편집 파일: functions.cpython-36.pyc
3 @)�f'K � # @ s d ddddddddd d d d d ddddddddddddddd d d d d d!d"g#Z d#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d$lZd#d%l m Z d#d&l m Z m Z ejd'k Zd(d)� ed#d*�D �Zd+d� Zd,d� ZdXd.d�Zd/d0� Zd1d2� Zd3d4� Zd5d� Zd6d� Zd7d8� Zd9d� Zd:d� Z d;d"� Z d<d� Z d=d � Z d>d � Z d?d � Z!d@d � Z"dAd � Z#dBd� Z$dCd� Z%dDd� Z&dEdF� Z'dGd� Z(dHd� Z)dId� Z*dJd� Z+dKd� Z,dLd� Z-dMd!� Z.dNd� Z/dOd� Z0dPd� Z1dQd� Z2dRd� Z3dSd � Z4dTd � Z5dUd � Z6dVd � Z7dWd � Z8d$S )Y�PY2� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask� checkIP6nMask� checkProtocol�checkInterface� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding� check_port� check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�b2u�u2b� u2b_if_py2�max_policy_name_len�stripNonPrintableCharacters� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILE�3c C s" i | ]}|d ko|dk sd|�qS )� � N� )�.0�ir+ r+ � /usr/lib/python3.6/functions.py� <dictcomp>. s r/ � c C st t | t�r| }nT| r | j� } y t| �}W n: tk rb ytj| �}W n tjk r\ dS X Y nX |dkrpdS |S )z� Check and Get port id from port string or port id using socket.getservbyname @param port port string or port id @return Port id if valid, -1 if port can not be found and -2 if port is too big � i�� � ������)� isinstance�int�strip� ValueError�socketZ getservbyname�error)�portZ_idr+ r+ r. r 7 s c C s� t | t�st | t�r| S t | t�s*| j� rDt| �}|dkr@|fS |S | jd�}t|�dkr�|d j� r�|d j� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }x�tt|�dd�D ]�}tdj |d|� ��}dj ||d� �}t|�dk�rnt|�}|dk�r�|dk�r�||k �rF|j ||f� n&||k�r`|j ||f� n |j |f� q�|dkr�|j |f� |t|�kr�P q�W t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id @param ports an integer or port string or port range string @return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous. r$ �-r2 r1 Nr3 r3 ) r5 �tuple�listr6 �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatchedr- Zport2r+ r+ r. r N sL $ �:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string @param port port or port range int or [int, int] @param delimiter of the output string for port ranges, default ':' @return Port or port range string, empty string if port isn't specified, None if port or port range is not valid � r$ Nr1 z%sz%s%s%s)r r5 r6 rA )r; Z delimiter�_ranger+ r+ r. r � s c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr1 r$ r2 TF)r rA r )r; rB Z_portrH r+ r+ r. �portInPortRange� s 0 00rI c C sT t | �}t|�dkr$|d |d f}tt |�}ttdd� |�dd� d�}g }x�|D ]�}|d |d kr�|d |d kr�|j|� qR|d |d kr�|d |d k r�|d |d kr�|j|� |d |d f}qR|d |d ko�|d |d ko�|d |d krR|j|� |d |d f}qRW ttdd� |��}|d |d k�rJ|d f}|g|fS )z� Coalesce a port range with existing list of port ranges @param new_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after coalescing, list of removed original ranges) r1 r$ c S s t | �dkr | d | d fS | S )Nr1 r$ )rA )�xr+ r+ r. �<lambda>� s z#coalescePortRange.<locals>.<lambda>c S s | d S )Nr$ r+ )rJ r+ r+ r. rK � s )�keyc S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s )r rA �map�sortedrD r> )Z new_range�rangesZcoalesced_range�_ranges�removed_rangesrB r+ r+ r. �coalescePortRange� s* rR c C s� t | �} t| �dkr$| d | d f} tt |�}ttdd� |�dd� d�}g }g }�xJ|D �]@}| d |d kr�| d |d kr�|j|� qX| d |d kr�| d |d k r�| d |d kr�|j|� |j| d d |d f� qX| d |d k�r<| d |d k�r<| d |d k�r<|j|� |j|d | d d f� qX| d |d krX| d |d k rX|j|� |j|d | d d f� |j| d d |d f� qXW ttdd� |��}ttdd� |��}||fS ) z� break a port range from existing list of port ranges @param remove_range tuple/list/string @param ranges list of tuple/list/string @return tuple of (list of ranges added after breaking up, list of removed original ranges) r1 r$ c S s t | �dkr | d | d fS | S )Nr1 r$ )rA )rJ r+ r+ r. rK � s z breakPortRange.<locals>.<lambda>c S s | d S )Nr$ r+ )rJ r+ r+ r. rK � s )rL c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s c S s | d | d kr| d fS | S )Nr$ r1 r+ )rJ r+ r+ r. rK � s )r rA rM rN rD r> )Z remove_rangerO rP rQ Z added_rangesrB r+ r+ r. �breakPortRange� s2 $ rS c C s0 yt jt| �|�}W n t jk r* dS X |S )z� Check and Get service name from port and proto string combination using socket.getservbyport @param port string or id @param protocol string @return Service name if port and protocol are valid, else None N)r9 Z getservbyportr6 r: )r; �proto�namer+ r+ r. r � s c C s. yt jt j| � W n t jk r( dS X dS )zl Check IPv4 address. @param ip address string @return True if address is valid, else False FT)r9 � inet_ptonZAF_INETr: )�ipr+ r+ r. r s c C s | j d�S )z� Normalize the IPv6 address This is mostly about converting URL-like IPv6 address to normal ones. e.g. [1234::4321] --> 1234:4321 z[])r7 )rW r+ r+ r. � normalizeIP6 s rX c C s2 yt jt jt| �� W n t jk r, dS X dS )zl Check IPv6 address. @param ip address string @return True if address is valid, else False FT)r9 rV ZAF_INET6rX r: )rW r+ r+ r. r s c C s� d| krN| d | j d�� }| | j d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�d|krvt|�S y t|�}W n tk r� dS X |dk s�|dkr�dS dS )N�/r1 F�.r$ � T)�indexrA r r6 r8 )rW �addr�maskr- r+ r+ r. r - s& c C s | j t�S )N)� translate�NOPRINT_TRANS_TABLE)Zrule_strr+ r+ r. r# D s c C s� d| krN| d | j d�� }| | j d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�y t|�}W n tk r� dS X |dk s�|dkr�dS dS )NrY r1 Fr$ � T)r\ rA r r6 r8 )rW r] r^ r- r+ r+ r. r G s" c C s` y t | �}W n: tk rF ytj| � W n tjk r@ dS X Y nX |dk sX|dkr\dS dS )NFr$ � T)r6 r8 r9 Zgetprotobynamer: )Zprotocolr- r+ r+ r. r \ s c C s4 | st | �dkrdS xdD ]}|| kr dS q W dS ) z� Check interface string @param interface string @return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False � F� rY �!�*T)rd rY re rf )rA )Ziface�chr+ r+ r. r k s c C s< yt | d�}W n tk r" dS X |dkr8|dkr8dS dS )Nr$ Fl �� T)r6 r8 )�valrJ r+ r+ r. r ~ s c C s� t jjt�sdS y"ttd��} | j� }W dQ R X W n tk rF dS X t jjd| �s\dS y&td| d��} | j� }W dQ R X W n tk r� dS X d|kr�dS dS )zv Check if firewalld is active @return True if there is a firewalld pid file and the pid is used by firewalld F�rNz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr' �open�readline� Exception)�fd�pidZcmdliner+ r+ r. r � s" c C sb y*t jjt�st jtd� tjddtdd�S tk r\ } ztj d| � � W Y d d } ~ X nX d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s) rj rk rl r& �mkdir�tempfileZNamedTemporaryFilero r% r: )�msgr+ r+ r. r � s c C sX y t | d�� }|j� S Q R X W n4 tk rR } ztjd| |f � W Y d d }~X nX d S )Nri z Failed to read file "%s": %s)rm � readlinesro r% r: )�filename�f�er+ r+ r. r � s $c C s\ y$t | d��}|j|� W d Q R X W n2 tk rV } ztjd| |f � dS d }~X nX dS )N�wz Failed to write to file "%s": %sFT)rm �writero r% r: )rz �liner{ r| r+ r+ r. r � s c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1 �ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr+ r+ r. r � s c C s | j dd�j dd�S )N�_r< z nf-conntrack-rG )�replace)�moduler+ r+ r. �get_nf_conntrack_short_name� s r� c C s� t | �}|d ks<|d ks<|d ks<t|�dkr�|d |d kr�|d krTtjd| � nZ|d krltjd| � nB|d kr�tjd| � n*t|�dkr�|d |d kr�tjd| � dS d S )Nr2 r1 r$ z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFTr4 r3 r4 r3 )r rA r% Zdebug2)r; rH r+ r+ r. r � s c C s( | dkrt |�S | dkr t|�S dS d S )Nr� r� F)r r )r� �sourcer+ r+ r. r � s c C s( | dkrt |�S | dkr t|�S dS d S )Nr� r� F)r r )r� r� r+ r+ r. r � s c C sR t | �dkrNx dD ]}| | dkrdS qW x dD ]}| | tjkr0dS q0W dS dS )N� � r2 � � � rF Fr$ r1 � � � � � � � � rc T� )r2 r� r� r� r� ) r$ r1 r� r� r� r� r� r� r� r� r� rc )rA �stringZ hexdigits)Zmacr- r+ r+ r. r � s c C s( g }x | D ]}||kr |j |� q W |S )N)rD )Z_list�outputrJ r+ r+ r. r � s c C sH y.t jd| �}t|j� d j� �} |j� W n tk rB dS X | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr$ N)rj �popenr6 ry r7 �closero )rq r{ r+ r+ r. r � s c C sB ddl m} ddlm} ttt|j� ��}d|t| � td� S )z� iptables limits length of chain to (currently) 28 chars. The longest chain we create is POST_<policy>_allow, which leaves 28 - 11 = 17 chars for <policy>. r$ )�POLICY_CHAIN_PREFIX)� SHORTCUTS� Z_allow)Zfirewall.core.ipXtablesr� �firewall.core.baser� �maxrM rA �values)r� r� �longest_shortcutr+ r+ r. r" s c C s. ddl m} ttt| j� ��}d|td� S )z� Netfilter limits length of chain to (currently) 28 chars. The longest chain we create is FWDI_<zone>_allow, which leaves 28 - 11 = 17 chars for <zone>. r$ )r� r� Z__allow)r� r� r� rM rA r� )r� r� r+ r+ r. r s c C sT t | �dk s t | �tjd�kr"dS x,| D ]$}|tjkr(|tjkr(|d kr(dS q(W dS ) Nr1 �SC_LOGIN_NAME_MAXFrZ r< r� �$T)rZ r< r� r� )rA rj �sysconfr� Z ascii_lettersZdigits)�user�cr+ r+ r. r s c C sD t | t�r,y t| �} W n tk r* dS X | dkr@| dkr@dS dS ) NFr$ r2 r) r1 Tl i���)r5 �strr6 r8 )Zuidr+ r+ r. r ( s c C sJ t | �dk st | �dkr dS xd D ]}|| kr"dS q"W | d dkrFdS d S ) Nr1 i F�|� � r$ rY T)r� r� r� )rA )Zcommandrg r+ r+ r. r 2 s c C s� | j d�}t|�dkrdS |d dkr>|d dd � dkr>dS |d dd � d krVdS |d dd � d krndS t|d �d k r�dS d S )NrF r� r� Fr$ �rootr2 Z_ur1 Z_rZ_tr� T)r� r� r4 r4 r4 )r@ rA )�contextrE r+ r+ r. r < s c C s8 dt t�kr djdd� | D ��S djdd� | D ��S d S )N�quoterd c s s | ]}t j|�V qd S )N)�shlexr� )r, �ar+ r+ r. � <genexpr>P s zjoinArgs.<locals>.<genexpr>c s s | ]}t j|�V qd S )N)�pipesr� )r, r� r+ r+ r. r� R s )rt r� rC )�argsr+ r+ r. r N s c C s8 t r*t| t�r*t| �} tj| �}tt|�S tj| �S d S )N)r r5 �unicoder r� r@ rM r )�_stringrE r+ r+ r. r T s c C s t | t�r| jdd�S | S )z bytes to unicode zUTF-8r� )r5 �bytes�decode)r� r+ r+ r. r ] s c C s t | t�s| jdd�S | S )z unicode to bytes zUTF-8r� )r5 r� �encode)r� r+ r+ r. r c s c C s t rt| t�r| jdd�S | S )z" unicode to bytes only if Python 2zUTF-8r� )r r5 r� r� )r� r+ r+ r. r! i s )rF )9�__all__r9 rj Zos.pathr� r� r� �sysrw Zfirewall.core.loggerr% Zfirewall.configr& r' �versionr rB r` r r r rI rR rS r r rX r r r# r r r r r r r r r r� r r r r r r r" r r r r r r r r r r! r+ r+ r+ r. �<module> sz : &+