관리-도구
편집 파일: fw_direct.cpython-36.pyc
3 @)�f�W � @ sn d gZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z G d d � d e�Zd S ) �FirewallDirect� )�LastUpdatedOrderedDict)� ipXtables)�ebtables)�FirewallTransaction)�log)�errors)� FirewallErrorc @ sL e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dNdd�Z dd� Z dd� Z dOdd�Zdd� Zd d � Zd d � Zd d!� ZdPd"d#�ZdQd$d%�Zd&d'� Zd(d)� Zd*d+� ZdRd,d-�ZdSd.d/�Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z dTd<d=�Z dUd>d?�Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&dJdK� Z'dLdM� Z(dS )Vr c C s || _ | j� d S )N)�_fw�_FirewallDirect__init_vars)�self�fw� r � /usr/lib/python3.6/fw_direct.py�__init__' s zFirewallDirect.__init__c C s d| j | j| j| jf S )Nz%s(%r, %r, %r))� __class__�_chains�_rules�_rule_priority_positions)r r r r �__repr__+ s zFirewallDirect.__repr__c C s" i | _ i | _i | _i | _d | _d S )N)r r r � _passthroughs�_obj)r r r r Z __init_vars/ s zFirewallDirect.__init_varsc C s | j � d S )N)r )r r r r �cleanup6 s zFirewallDirect.cleanupc C s t | j�S )N)r r )r r r r �new_transaction; s z FirewallDirect.new_transactionc C s || _ d S )N)r )r �objr r r �set_permanent_config@ s z#FirewallDirect.set_permanent_configc C s* t | j�t | j� t | j� dkr&dS dS )Nr TF)�lenr r r )r r r r �has_runtime_configurationC s "z(FirewallDirect.has_runtime_configurationc C sB | j � r dS t| jj� �t| jj� � t| jj� � dkr>dS dS )NTr F)r r r �get_all_chains� get_all_rules�get_all_passthroughs)r r r r �has_configurationH s z FirewallDirect.has_configurationNc C sP |d kr| j � }n|}| j| jj� | jj� | jj� f|� |d krL|jd� d S )NT)r � set_configr r r r �execute)r �use_transaction� transactionr r r � apply_directQ s zFirewallDirect.apply_directc C s i }i }i }xL| j D ]B}|\}}x4| j | D ]&}| jj|||�s,|j|g �j|� q,W qW xf| jD ]\}|\}}}xL| j| D ]>\} } | jj|||| | �s|||kr�t� ||< | || | | f< q|W qbW xP| jD ]F}x@| j| D ]2} | jj || �s�||k� r�g ||< || j| � q�W q�W |||fS )N) r r � query_chain� setdefault�appendr � query_ruler r �query_passthrough) r Zchains�rulesZ passthroughs�table_id�ipv�table�chain�chain_id�priority�argsr r r �get_runtime_configb s, z!FirewallDirect.get_runtime_configc C s | j | j| jfS )N)r r r )r r r r � get_config� s zFirewallDirect.get_configc C s� |d kr| j � }n|}|\}}}x||D ]t}|\}} xf|| D ]Z} | j|| | �s<y| j|| | |d� W q< tk r� } ztjt| �� W Y d d } ~ X q<X q<W q&W x�|D ]�} | \}} } xt|| D ]h\} }| j|| | | |�s�y| j|| | | ||d� W q� tk �r" } ztjt| �� W Y d d } ~ X q�X q�W q�W xx|D ]p}xh|| D ]\}| j ||��s@y| j |||d� W n2 tk �r� } ztjt| �� W Y d d } ~ X nX �q@W �q2W |d k�r�|j d� d S )N)r$ T) r r' � add_chainr r Zwarning�strr* �add_ruler+ �add_passthroughr# )r Zconfr$ r% r r r r- r. r/ r0 �errorr1 r2 r3 r r r r" � s@ ( ( , zFirewallDirect.set_configc C s* dddg}||kr&t tjd||f ��d S )N�ipv4�ipv6Zebz'%s' not in '%s')r r Z INVALID_IPV)r r. Zipvsr r r � _check_ipv� s zFirewallDirect._check_ipvc C sF | j |� |dkr tjj� ntjj� }||krBttjd||f ��d S )Nr; r< z'%s' not in '%s')r; r< )r= r �BUILT_IN_CHAINS�keysr r r Z INVALID_TABLE)r r. r/ Ztablesr r r �_check_ipv_table� s z FirewallDirect._check_ipv_tablec C s� |dkr4t j| }| jjr i }qH| jj|�j| }ntj| }tj| }||kr`tt j d| ��||krxtt j d| ��|dkr�| jj j |�d k r�tt j d| ��d S )Nr; r< z chain '%s' is built-in chainzchain '%s' is reservedzChain '%s' is reserved)r; r< )r; r< )r r> r �nftables_enabled�get_direct_backend_by_ipv� our_chainsr Z OUR_CHAINSr r Z BUILTIN_CHAIN�zoneZzone_from_chainZ INVALID_CHAIN)r r. r/ r0 Zbuilt_in_chainsrC r r r �_check_builtin_chain� s" z#FirewallDirect._check_builtin_chainc C sH |r| j j|g �j|� n*| j | j|� t| j | �dkrD| j |= d S )Nr )r r( r) �remover )r r- r0 �addr r r �_register_chain� s z FirewallDirect._register_chainc C sV |d kr| j � }n|}| jj� r.|j| jj� | jd||||� |d krR|jd� d S )NT)r r � may_skip_flush_direct_backends�add_pre�flush_direct_backends�_chainr# )r r. r/ r0 r$ r% r r r r6 � s zFirewallDirect.add_chainc C s> |d kr| j � }n|}| jd||||� |d kr:|jd� d S )NFT)r rL r# )r r. r/ r0 r$ r% r r r � remove_chain� s zFirewallDirect.remove_chainc C s: | j ||� | j|||� ||f}|| jko8|| j| kS )N)r@ rE r )r r. r/ r0 r- r r r r' � s zFirewallDirect.query_chainc C s, | j ||� ||f}|| jkr(| j| S g S )N)r@ r )r r. r/ r- r r r � get_chains� s zFirewallDirect.get_chainsc C sD g }x:| j D ]0}|\}}x"| j | D ]}|j|||f� q$W q W |S )N)r r) )r �r�keyr. r/ r0 r r r r s z FirewallDirect.get_all_chainsc C sZ |d kr| j � }n|}| jj� r.|j| jj� | jd||||||� |d krV|jd� d S )NT)r r rI rJ rK �_ruler# )r r. r/ r0 r2 r3 r$ r% r r r r8 s zFirewallDirect.add_rulec C sB |d kr| j � }n|}| jd||||||� |d kr>|jd� d S )NFT)r rQ r# )r r. r/ r0 r2 r3 r$ r% r r r � remove_rule s zFirewallDirect.remove_rulec C s2 | j ||� |||f}|| jko0||f| j| kS )N)r@ r )r r. r/ r0 r2 r3 r1 r r r r* # s zFirewallDirect.query_rulec C s6 | j ||� |||f}|| jkr2t| j| j� �S g S )N)r@ r �listr? )r r. r/ r0 r1 r r r � get_rules) s zFirewallDirect.get_rulesc C sR g }xH| j D ]>}|\}}}x.| j | D ] \}}|j||||t|�f� q&W q W |S )N)r r) rS )r rO rP r. r/ r0 r2 r3 r r r r 0 s z FirewallDirect.get_all_rulesc C s� |rr|| j krt� | j |< || j | |< || jkr<i | j|< || j| krb| j| | |7 < q�|| j| |< n<| j | |= t| j | �dkr�| j |= | j| | |8 < d S )Nr )r r r r )r �rule_idr1 r2 �enable�countr r r �_register_rule8 s z FirewallDirect._register_rulec C sV y| j j| j j|�j|�S tk rP } z tj|� ttj |��W Y d d }~X nX d S )N) r �rulerB �name� Exceptionr Zdebug2r r ZCOMMAND_FAILED)r r. r3 �msgr r r � passthroughL s zFirewallDirect.passthroughc C sX |r*|| j krg | j |< | j | j|� n*| j | j|� t| j | �dkrT| j |= d S )Nr )r r) rF r )r r. r3 rV r r r �_register_passthroughT s z$FirewallDirect._register_passthroughc C sX |d kr| j � }n|}| jj� r.|j| jj� | jd|t|�|� |d krT|jd� d S )NT)r r rI rJ rK � _passthroughrS r# )r r. r3 r$ r% r r r r9 ^ s z FirewallDirect.add_passthroughc C s@ |d kr| j � }n|}| jd|t|�|� |d kr<|jd� d S )NFT)r r_ rS r# )r r. r3 r$ r% r r r �remove_passthroughl s z!FirewallDirect.remove_passthroughc C s || j kot|�| j | kS )N)r �tuple)r r. r3 r r r r+ w s z FirewallDirect.query_passthroughc C s> g }x4| j D ]*}x$| j | D ]}|j|t|�f� q W q W |S )N)r r) rS )r rO r. r3 r r r r { s z#FirewallDirect.get_all_passthroughsc C s4 g }|| j kr0x | j | D ]}|jt|�� qW |S )N)r r) rS )r r. rO r3 r r r �get_passthroughs� s z FirewallDirect.get_passthroughsc C s� g }x�|D ]�}d}x�|D ]�}y|j |�}W n tk r> Y qX t|�|krd||d krd}||d jd�}x.|D ]&} |dd� } | | |d < |j| � qxW qW |s |j|� q W |S )z5Split values combined with commas for options in optsF�,� TN)�index� ValueErrorr �splitr) ) r r, ZoptsZ out_rulesrY Z processed�opt�i�items�itemrQ r r r � split_value� s$ zFirewallDirect.split_valuec C s* | j ||� | jj r2|dkr2| jjj||||� |}| jj|�} | jj rd| j|||�rdd| }n:| jjr�|dd � dkr�| j|||d d� �r�|d d� }|||f} ||f} |r�| | jkr�| | j| kr�tt j d||||f ��nB| | jk�s| | j| k�rtt j d||||f ��| j| | }d} d } | | j k�r�t | j | j� �}d }x@|t|�k �r�||| k�r�| | j | || 7 } |d7 }�qTW t|�g}| j|d d g�}| j|d d g�}x<|D ]4}|j| | j|||| t|��� | d7 } | d7 } �q�W | j| | ||| � |j| j| | || | � d S )Nr; r< z %s_direct� Z_directz"rule '%s' already is in '%s:%s:%s'z rule '%s' is not in '%s:%s:%s'rd r z-sz--sourcez-dz --destination)r; r< i����i����i����)r@ r rA rD �create_zone_base_by_chainrB Zis_chain_builtinr r r �ALREADY_ENABLED� NOT_ENABLEDr �sortedr? r rS rl r8 Z build_rulera rX �add_fail)r rV r. r/ r0 r2 r3 r% rL �backendr1 rU re rW Z positions�jZ args_list�_argsr r r rQ � sZ ( zFirewallDirect._rulec C s� | j ||� | j|||� ||f}|rV|| jkr�|| j| kr�ttjd|||f ��n.|| jksn|| j| kr�ttjd|||f ��| jj|�}|j ||j |||�� | j |||� |j | j ||| � d S )Nz chain '%s' already is in '%s:%s'z chain '%s' is not in '%s:%s') r@ rE r r r ro rp r rB Z add_rulesZbuild_chain_rulesrH rr )r rG r. r/ r0 r% r- rs r r r rL s$ zFirewallDirect._chainc C s� | j |� t|�}|rD|| jkrp|| j| krpttjd||f ��n,|| jks\|| j| krpttjd||f ��| jj|�}|r�|j |� |dkr�|j |�\}}|r�|r�| jj j |||� |} n |j |�} |j|| � | j|||� |j| j||| � d S )Nzpassthrough '%s', '%s'r; r< )r; r< )r= ra r r r ro rp r rB Zcheck_passthroughZ passthrough_parse_table_chainrD rn Zreverse_passthroughr8 r^ rr ) r rV r. r3 r% Z tuple_argsrs r/ r0 ru r r r r_ ' s0 zFirewallDirect._passthrough)N)N)N)N)N)N)N)N))�__name__� __module__� __qualname__r r r r r r r r! r& r4 r5 r" r= r@ rE rH r6 rM r' rN r r8 rR r* rT r rX r] r^ r9 r` r+ r rb rl rQ rL r_ r r r r r & sL ' jN)�__all__Zfirewall.fw_typesr Z firewall.corer r Z firewall.core.fw_transactionr Zfirewall.core.loggerr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s