관리-도구
편집 파일: fw.cpython-36.pyc
3 @)�f�� � @ s� d gZ ddlZddlZddlZddlZddlZddlmZ ddlm Z ddl m Z ddl m Z ddl m Z ddl mZ dd l mZ dd lmZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m!Z! ddl"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3 ddl4m5Z5 dd l6m7Z7 dd l8m9Z9 dd l:m;Z; dd lm<Z< dd l=m>Z> G d!d � d e?�Z@dS )"�Firewall� N)�config)� functions)� ipXtables)�ebtables)�nftables)�ipset)�modules)�FirewallIcmpType)�FirewallService)� FirewallZone)�FirewallDirect)�FirewallConfig)�FirewallPolicies)� FirewallIPSet)�FirewallTransaction)�FirewallHelper)�FirewallPolicy)�nm_get_bus_name�nm_get_interfaces_in_zone)�log)�firewalld_conf)�Direct)�service_reader)�icmptype_reader)� zone_reader�Zone)� ipset_reader)� IPSET_TYPES)� helper_reader)� policy_reader)�errors)� FirewallErrorc @ s� e Zd Zdedd�Zdd� Zdd� Zdd � Zd d � Zdfd d �Zdd� Z dgdd�Z dd� Z dd� Z dd� Z dd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zdhd)d*�Zdid+d,�Zd-d.� Zdjd/d0�Zdkd1d2�Zdld3d4�Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z!dAdB� Z"dCdD� Z#dEdF� Z$dGdH� Z%dIdJ� Z&dKdL� Z'dMdN� Z(dmdOdP�Z)dQdR� Z*dSdT� Z+dUdV� Z,dWdX� Z-dYdZ� Z.d[d\� Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3d(S )nr Fc C s t tj�| _|| _| jr>d| _d| _d| _d| _t | _ d| _ nrt j | �| _d| _g | _t j| �| _d| _g | _tj� | _d| _tj� | _d| _g | _ tj| �| _d| _ tj� | _t| �| _ t | �| _ t | �| _ t!| �| _"t#| �| _t$� | _%t&| �| _t'| �| _(t)| �| _*| j+� d S )NFT),r r �FIREWALLD_CONF�_firewalld_conf�_offline�ip4tables_enabled�ip6tables_enabled�ebtables_enabled� ipset_enabledr �ipset_supported_types�nftables_enabledr � ip4tables�ip4tables_backend�ipv4_supported_icmp_types� ip6tables�ip6tables_backend�ipv6_supported_icmp_typesr �ebtables_backendr � ipset_backendr �nftables_backendr �modules_backendr �icmptyper �servicer �zoner �directr r �policiesr r �helperr �policy�_Firewall__init_vars)�selfZoffline� r? �/usr/lib/python3.6/fw.py�__init__C sB zFirewall.__init__c C sD d| j | j| j| j| j| j| j| j| j| j | j | j | j | j | jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))� __class__r& r' r( �_state�_panic� _default_zone�_module_refcount�_marks�cleanup_on_exit�cleanup_modules_on_exit�ipv6_rpfilter_enabledr) �_individual_calls� _log_denied)r> r? r? r@ �__repr__k s zFirewall.__repr__c C sj d| _ d| _d| _i | _g | _tj| _tj| _ tj | _ tj | _ tj| _tj| _tj| _tj| _tj| _d S )NZINITF� )rC rD rE rF rG r ZFALLBACK_CLEANUP_ON_EXITrH Z FALLBACK_CLEANUP_MODULES_ON_EXITrI ZFALLBACK_IPV6_RPFILTERrJ ZFALLBACK_INDIVIDUAL_CALLSrK ZFALLBACK_LOG_DENIEDrL ZFALLBACK_FIREWALL_BACKEND�_firewall_backendZ FALLBACK_FLUSH_ALL_ON_RELOAD�_flush_all_on_reloadZFALLBACK_RFC3964_IPV4� _rfc3964_ipv4Z FALLBACK_ALLOW_ZONE_DRIFTING�_allow_zone_drifting)r> r? r? r@ Z __init_varst s zFirewall.__init_varsc C s� | j r$d| jj� kr$tjd� d| _ | jrHd| jj� krHtjd� d| _| jrld| jj� krltjd� d| _| j r�| j r�| j r�tj d� t j d� d S )N�filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.� ) r& r- �get_available_tablesr �info1r' r0 r( r2 r+ �fatal�sys�exit)r> r? r? r@ � _check_tables� s zFirewall._check_tablesc C sz y| j j� W n* tk r8 tjd� d| _g | _Y nX | j j� | _| jj � | jj s|| jj rltjd� ntjd� d| _ | j r�| jjd�| _n| j r�| jj� | _ng | _| jj � | jj s�| jj r�tjd� ntjd� d| _| j r�| jjd�| _n | j�r| jj� | _ng | _| jj � | jj �sN| jj �r>tjd � ntjd � d| _| j�rv| j �rv| jj �rvtjd � d S ) Nz4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zCiptables-restore and iptables are missing, disabling IPv4 firewall.�ipv4zGip6tables-restore is missing, using individual calls for IPv6 firewall.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.�ipv6zHebtables-restore is missing, using individual calls for bridge firewall.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be used)r3 Zset_list� ValueErrorr �warningr) r* Zset_supported_typesr- Z fill_exists�restore_command_existsZcommand_existsr& r+ r4 Zsupported_icmp_typesr. r0 r' r1 r2 r( rK �restore_noflush_option�debug1)r> r? r? r@ � _start_check� sL zFirewall._start_checkc > C s� t j}tjdt j� y| jj� W n8 tk rZ } ztj|� tjd� W Y d d }~X �n"X | jj d�rt| jj d�}| jj d�r�| jj d�}|d k r�|j � dBkr�d| _ tjd| j � | jj d ��r| jj d �}|d k r�|j � dCkr�d | _ |d k �r|j � dDk�rd| _ tjd | j � | jj d��rv| jj d�}|d k �rv|j � dEk�rvtjd� y| j j� W n tk �rt Y nX | jj d��r�| jj d�}|d k �r�|j � dFk�r�d| _|j � dGk�r�d | _| j�r�tjd� n tjd� | jj d��r"| jj d�}|d k �r"|j � dHk�r"tjd� d | _| jj d��rt| jj d�}|d k�sT|j � dk�r\d| _n|j � | _tjd| j� | jj d��r�| jj d�| _tjd| j� | jj d��r�| jj d�}|j � dIk�r�d| _nd | _tjd| j� | jj d ��r&| jj d �}|j � dJk�rd| _nd | _tjd | j� | jj d ��r|| jj d �}|j � dKk�rVd| _nd | _| j�sntjd � tjd | j� | j jtj| j�� | j| j� | j�s�| j � tjd!� y| j j j� W nZ tk �r } z<| j j � �r�tj d"| j j j |� ntjd"| j j j |� W Y d d }~X nX | j j!tj| j �� | j"t j#d#� | j"t j$d#� | j"t j%d$� | j"t j&d$� t'| j(j)� �d%k�r�tj d&� | j"t j*d'� | j"t j+d'� | j"t j,d(� | j"t j-d(� t'| j.j/� �d%k�r�tj d)� | j"t j0d*� | j"t j1d*� t'| j2j3� �d%k�r&tj4d+� t5j6d,� | j"t j7d-� | j"t j8d-� d}x.dLD ]&}|| j2j3� k�rLtj4d1|� d }�qLW |�r�t5j6d,� || j2j3� k�r�d2| j2j3� k�r�d2}nd3| j2j3� k�r�d3}nd.}tj d4||� |}n tjd5|� t9t j:�} t;j<j=t j:��rRtjd6t j: � y | j� W n4 tk �rP } ztj d7t j:|� W Y d d }~X nX | j>j?| � | j j@tj| �� | jA|�| _B| j�r�d S | jC� tjD� d%k�r�tEjE� } tF| �} |�s�| jG| d8� |�r�|�s�| jH�r�| jIjJ� �r�| jKd � | jL� |�r|�rtjd9� | jMjN� | jO| d8� | jKd � | jL� | jH�rX| jIjJ� �rXtjd:� | jIjP� tjd;� | jQ| d8� tjd<� | j2jR| d8� | j2jSd | jB| d8� tjd=� | jTjU| d8� | jKd � | jL� | j>jV� �rVtjd>� | j>jW| � y| jKd � | jL� W nX tk �r> } z$t| jXd?| jY�r&| jYnd@ ��W Y d d } ~ X n tk �rT � Y nX ~ tjD� d,k�r�tEjE� } tjZdA| | � d S )MNz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.� DefaultZoneZ CleanupOnExit�no�falseFz CleanupOnExit is set to '%s'ZCleanupModulesOnExit�yes�trueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZ IPv6_rpfilterzIPv6 rpfilter is enabledzIPV6 rpfilter is disabledZIndividualCallszIndividualCalls is enabled� LogDeniedZoffzLogDenied is set to '%s'ZFirewallBackendz FirewallBackend is set to '%s'ZFlushAllOnReloadz FlushAllOnReload is set to '%s'Z RFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZAllowZoneDriftingz�AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.z AllowZoneDrifting is set to '%s'zLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %sr r6 r zNo icmptypes found.r; r7 zNo services found.r8 zNo zones found.rT r< �block�drop�trustedzZone '%s' is not available.ZpublicZexternalz+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'z Loading direct rules file '%s'z)Failed to load direct rules file '%s': %s)�use_transactionzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policiesz2Applying direct chains rules and passthrough rulesz Direct: %srN z%Flushing and applying took %f seconds)rd re )rf rg )rd re )rf rg )rd re )rf rg )rf rg )rd re )rd re )rd re )ri rj rk )[r Z FALLBACK_ZONEr ra r# r$ �read� Exceptionr^ �get�lowerrH rI r: Zenable_lockdownr" rJ rK rL rO rP rQ rR r% Zset_firewalld_conf�copy�deepcopy�_select_firewall_backendrb Zlockdown_whitelistZquery_lockdown�error�filenameZ set_policies�_loaderZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPES�lenr6 � get_icmptypesZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr7 � get_servicesZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr8 � get_zonesrW rX rY ZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIESr ZFIREWALLD_DIRECT�os�path�existsr9 Zset_permanent_configZ set_direct� check_zonerE rZ ZgetDebugLogLevel�timer �flushr) r Z has_ipsets�execute�clearr5 �unload_firewall_modules�apply_default_tablesZ apply_ipsets�apply_default_rulesZ apply_zones�change_default_zoner< Zapply_policiesZhas_configurationZ apply_direct�code�msgZdebug2)r> �reload�complete_reloadZ default_zoner� �valuert �zr8 �objZtm1� transaction�eZtm2r? r? r@ �_start� st .zFirewall._startc C sH y | j � W n& tk r2 d| _| jd� � Y nX d| _| jd� d S )N�FAILED�ACCEPT�RUNNING)r� rn rC � set_policy)r> r? r? r@ �start� s zFirewall.startc C sh t jj|�sd S |rZ|jtj�rV|dkrVt� }t jj|�|_|j |j� ||_d|_ nd}�x|t t j |��D �]h}|j d�s�|jtj�rl|dkrlt jjd||f �rl| jd||f |dd� qld||f }tjd||� �y�|dk�r�t||�}|j| jj� k�r8| jj|j�}tjd ||j|j|j� | jj|j� n|jjtj��rNd|_ y| jj|� W n< tk �r� } z tjd |jt| �f � W Y d d } ~ X nX | jjtj |�� �n�|d k�rFt ||�}|j| j j � k�r| j j |j�}tjd ||j|j|j� | j j!|j� n|jjtj��r$d|_ | j j"|� | jj"tj |�� �n.|dk�rnt#|||d �}|�r�dt jj|�t jj|�d d� f |_|j |j� tj |�} |j| j$j%� k�r| j$j&|j�}| j$j'|j� |j(�r�tjd||j||� |j)|� ntjd ||j|j|j� n |jjtj��r,d|_ d| _ | jj*| � |�r^tjd||j||� |j)|� n | j$j*|� �n|dk�rDt+||�}|j| j,j-� k�r�| j,j.|j�}tjd ||j|j|j� | j,j/|j� n|jjtj��r�d|_ y| j,j0|� W n< tk �r, } z tj1d |jt| �f � W Y d d } ~ X nX | jj0tj |�� �n0|dk�r�t2||�}|j| j3j4� k�r�| j3j5|j�}tjd ||j|j|j� | j3j6|j� n|jjtj��r�d|_ | j3j7|� | jj7tj |�� n�|dk�rht8||�}|j| j9j:� k�r2| j9j;|j�}tjd ||j|j|j� | j9j<|j� n|jjtj��rHd|_ | j9j=|� | jj>tj |�� n tj?d|� W ql tk �r� } ztj@d||| � W Y d d } ~ X ql tAk �r� tj@d||� tjB� Y qlX qlW |�rd|j(�rd|j| j$j%� k�rX| j$j&|j�}tjd||j|j|j� y| j$j'|j� W n tAk �rH Y nX | jjC|j� | j$j*|� d S )Nr8 Fz.xmlz%s/%sT)�combinezLoading %s file '%s'r6 z Overloads %s '%s' ('%s/%s')z %s: %s, ignoring for run-time.r7 )Z no_check_namer � z Combining %s '%s' ('%s/%s')r r; r< zUnknown reader type %sz Failed to load %s file '%s': %sz Failed to load %s file '%s':z0 Overloading and deactivating %s '%s' ('%s/%s')���)Dr{ r| �isdir� startswithr Z ETC_FIREWALLDr �basename�nameZ check_name�default�sorted�listdir�endswithrv r ra r r6 rx Z get_icmptyperu Zremove_icmptypeZ add_icmptyper" rV �strrq rr r r7 ry Z get_serviceZremove_serviceZ add_servicer r8 rz Zget_zoneZ remove_zone�combinedr� Zadd_zoner r � get_ipsets� get_ipsetZ remove_ipset� add_ipsetr^ r r; Z get_helpersZ get_helperZ remove_helperZ add_helperr r< � get_policiesZ get_policyZ remove_policyZ add_policyZadd_policy_objectrW rt rn Z exceptionZ forget_zone) r> r| Z reader_typer� Z combined_zoneru r� r� Zorig_objrt Z config_objr� r? r? r@ rv s $ $ zFirewall._loaderc C sp | j j� | jj� | jj� | jj� | jj� | jj� | jj� | jj� | j j� | j j� | j � d S )N) r6 �cleanupr7 r8 r r; r r9 r: r< r$ r= )r> r? r? r@ r� � s zFirewall.cleanupc C sN | j sB| jr(| j� | jj� | jd� | jrBtjd� | jj � | j � d S )Nr� z!Unloading firewall kernel modules) r% rH r� r r� rI r ra r5 r� r� )r> r? r? r@ �stop� s z Firewall.stopc C s� d}d}x�t |�D ]�\}}|r0| jj|�\}}n$| j| dkrDd}n| jj|�\}}|dkrn|d7 }||7 }q|r�| jj|d� | j| d7 < q|| jkr| j| d8 < | j| dkr| j|= qW ||fS )Nr rN rT )� enumerater5 � load_modulerF Z unload_module� setdefault) r> Z_modules�enableZ num_failedZ error_msgs�i�moduleZstatusr� r? r? r@ �handle_modules� s( zFirewall.handle_modulesc C s |dkrd| _ d S )Nr F)r+ )r> �backendr? r? r@ rs � s z!Firewall._select_firewall_backendc C s4 x | j � D ]}|j|kr |S q W ttjd| ��d S )Nz'%s' backend does not exist)� all_backendsr� r" r! Z UNKNOWN_ERROR)r> r� r� r? r? r@ �get_backend_by_name� s z Firewall.get_backend_by_namec C s\ | j r | jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt j d| ��d S )Nr[ r\ �ebz-'%s' is not a valid backend or is unavailable) r+ r4 r& r- r' r0 r( r2 r" r! � INVALID_IPV)r> �ipvr? r? r@ �get_backend_by_ipv� s zFirewall.get_backend_by_ipvc C sP |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| ��d S )Nr[ r\ r� z-'%s' is not a valid backend or is unavailable) r& r- r' r0 r( r2 r" r! r� )r> r� r? r? r@ �get_direct_backend_by_ipv� s z"Firewall.get_direct_backend_by_ipvc C s< |dkr| j S |dkr | jS |dkr*| jS |dkr8| jS dS )Nr, r/ r r F)r& r' r( r+ )r> r� r? r? r@ �is_backend_enabled� s zFirewall.is_backend_enabledc C s8 | j r dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTr[ r\ r� F)r+ r& r' r( )r> r� r? r? r@ �is_ipv_enabled s zFirewall.is_ipv_enabledc C sR g }| j r|j| j� n6| jr*|j| j� | jr<|j| j� | jrN|j| j� |S )N) r+ �appendr4 r& r- r' r0 r( r2 )r> �backendsr? r? r@ �enabled_backends s zFirewall.enabled_backendsc C sP g }| j r|j| j� | jr(|j| j� | jr:|j| j� | jrL|j| j� |S )N) r& r� r- r' r0 r( r2 r+ r4 )r> r� r? r? r@ r� s zFirewall.all_backendsNc C sN |d krt | �}n|}x | j� D ]}|j||j� � q W |d krJ|jd� d S )NT)r r� � add_rulesZbuild_default_tablesr� )r> rl r� r� r? r? r@ r� $ s z Firewall.apply_default_tablesc C s� |d krt | �}n|}x(| j� D ] }|j| j�}|j||� q W | jd�r~| jd�}d|j� kr~| jr~|j | j�}|j||� | jd�r�| j r�|j � }|j||� |d kr�|j d� d S )Nr\ �rawT) r r� Zbuild_default_rulesrL r� r� r� rU rJ Zbuild_rpfilter_rulesrQ Zbuild_rfc3964_ipv4_rulesr� )r> rl r� r� �rulesZ ipv6_backendr? r? r@ r� 0 s" z Firewall.apply_default_rulesc C s | j r| jj� rdS dS )NTF)r+ r9 Zhas_runtime_configuration)r> r? r? r@ � may_skip_flush_direct_backendsH s z'Firewall.may_skip_flush_direct_backendsc C s` |d krt | �}n|}x2| j� D ]&}|| j� kr2q |j� }|j||� q W |d kr\|jd� d S )NT)r r� r� �build_flush_rulesr� r� )r> rl r� r� r� r? r? r@ �flush_direct_backendsN s z Firewall.flush_direct_backendsc C sp |d krt | �}n|}tjd� | j� s4| j|d� x$| j� D ]}|j� }|j||� q>W |d krl|jd� d S )NzFlushing rule set)rl T) r r ra r� r� r� r� r� r� )r> rl r� r� r� r? r? r@ r� ] s zFirewall.flushc C s` |d krt | �}n|}tjd|� x&| j� D ]}|j|�}|j||� q,W |d kr\|jd� d S )NzSetting policy to '%s'T)r r ra r� Zbuild_set_policy_rulesr� r� )r> r< rl r� r� r� r? r? r@ r� o s zFirewall.set_policyc C sB |sdS | j |�}|s&ttjd| ��| j|�s4dS |j|| j�S )NrN z'%s' is not a valid backend)r� r" r! r� r� �set_rulerL )r> � backend_name�ruler� r? r? r@ r� � s z Firewall.rulec C s" t td |��}| j|�}|s,ttjd| ��| j|�s:d S | js\|j s\|dkoX| j j �rx�t |�D ]�\}}y|j || j � W qf tk �r } zjtjtj� � tj|� xFt|d |� �D ]2}y|j |j|�| j � W q� tk r� Y q�X q�W |�W Y d d }~X qfX qfW n|j|| j � d S )Nz'%s' is not a valid backendr )�listrS r� r" r! r� r� rK r_ r2 r` r� r� rL rn r ra � traceback� format_excrt �reversedZ reverse_ruleZ set_rules)r> r� r� Z_rulesr� r� r� r� r? r? r@ r� � s. zFirewall.rulesc C s | j rttj��d S )N)rD r" r! Z PANIC_MODE)r> r? r? r@ � check_panic� s zFirewall.check_panicc C s" |}|| j j� kr ttj|��|S )N)r< r� r" r! ZINVALID_POLICY)r> r< Z_policyr? r? r@ � check_policy� s zFirewall.check_policyc C s8 |}| s|dkr| j � }|| jj� kr4ttj|��|S )NrN )�get_default_zoner8 rz r" r! Z INVALID_ZONE)r> r8 �_zoner? r? r@ r~ � s zFirewall.check_zonec C s t j|�sttj|��d S )N)r ZcheckInterfacer" r! ZINVALID_INTERFACE)r> � interfacer? r? r@ �check_interface� s zFirewall.check_interfacec C s | j j|� d S )N)r7 � check_service)r> r7 r? r? r@ r� � s zFirewall.check_servicec C s t j|�sttj|��d S )N)r � check_portr" r! Z INVALID_PORT)r> Zportr? r? r@ r� � s zFirewall.check_portc C s* |st tj��|dkr&t tjd| ��d S )N�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r� r� r� r� )r" r! ZMISSING_PROTOCOLZINVALID_PROTOCOL)r> Zprotocolr? r? r@ � check_tcpudp� s zFirewall.check_tcpudpc C s t j|�sttj|��d S )N)r ZcheckIPr" r! � INVALID_ADDR)r> Zipr? r? r@ �check_ip� s zFirewall.check_ipc C sP |dkr t j|�sLttj|��n,|dkr@t j|�sLttj|��n ttjd��d S )Nr[ r\ z'%s' not in {'ipv4'|'ipv6'})r Z checkIPnMaskr" r! r� Z checkIP6nMaskr� )r> r� �sourcer? r? r@ � check_address� s zFirewall.check_addressc C s | j j|� d S )N)r6 �check_icmptype)r> Zicmpr? r? r@ r� � s zFirewall.check_icmptypec C s> t |t�s td|t|�f ��t|�dk r:ttjd| ��d S )Nz%s is %s, expected intr z#timeout '%d' is not positive number)� isinstance�int� TypeError�typer" r! � INVALID_VALUE)r> Ztimeoutr? r? r@ � check_timeout� s zFirewall.check_timeoutc C s` | j }| j}|sNi }x&| jj� D ]}| jj|�d ||< q W | jj� }| j� }g }x$| jj � D ]} |j | jj | �� q^W |s�| j d� | j � | j� d } y| jd|d� W n& tk r� } z | } W Y d d } ~ X nX |�r(xL|D ]D} | jj| j�s�x0| jj� D ]"} | jdk�r� q�| j| j� � q�W q�W |�s�| j� }||k�r�||k�rRi ||< xFt|| j� �D ]2\}}|d �rd|| | || |< || |= �qdW xb| jj� D ]T}||k�r�x.|| D ]"}| jj|||| | d � �q�W ||= n tjd|� �q�W t|�d k�r6x(t|j� �D ]}tjd |� ||= �qW ~x�|D ]�} | jj| j��r�xx| j D ]R}y| jj | j|� W n6 t k �r� } z|j t j!k�r�|�W Y d d }~X nX �qZW n| jj"| � | jj#| j� �q>W | jj$|� t%� }|�r,x@| jj� d g D ],}x$t&|�D ]}| jj|||d � �q W �q�W || _ | j �sD| j d � | �rVd| _'| �nd| _'d S )N� interfacesZDROPT)r� r� r � __default__�senderzNew zone '%s'.r z(Lost zone '%s', zone interfaces dropped.rN )r� r� r� r� )(rD rP r8 rz � get_settingsr9 Zget_runtime_configr� r r� r� r� r� r� r� r� rn Z query_ipsetr� r� Z set_destroyr� �items�change_zone_of_interfacer rV rw �keysZentriesZ add_entryr" r� r! �ALREADY_ENABLEDr� Z apply_ipsetZ set_configr r rC )r> r� rD Z flush_allZ_zone_interfacesr8 Z_direct_config�_old_dzZ _ipset_objs�_nameZstart_exceptionr� r� r� Z_new_dz�iface�settingsZ interface_id�entryr� Z nm_bus_namer� r? r? r@ r� � s� zFirewall.reloadc C s | j S )N)rC )r> r? r? r@ � get_statea s zFirewall.get_statec C sZ | j rttjd��y| jd� W n. tk rN } zttj|��W Y d d }~X nX d| _ d S )Nzpanic mode already enabledZPANICT)rD r" r! r� r� rn �COMMAND_FAILED)r> r� r? r? r@ �enable_panic_modef s zFirewall.enable_panic_modec C sZ | j sttjd��y| jd� W n. tk rN } zttj|��W Y d d }~X nX d| _ d S )Nzpanic mode is not enabledr� F)rD r" r! Z NOT_ENABLEDr� rn r� )r> r� r? r? r@ �disable_panic_modeq s zFirewall.disable_panic_modec C s | j S )N)rD )r> r? r? r@ �query_panic_mode| s zFirewall.query_panic_modec C s | j S )N)rL )r> r? r? r@ �get_log_denied� s zFirewall.get_log_deniedc C sb |t jkr&ttjd|djt j�f ��|| j� krR|| _| jj d|� | jj � n ttj |��d S )Nz'%s', choose from '%s'z','rh ) r ZLOG_DENIED_VALUESr" r! r� �joinr� rL r$ �set�writeZ ALREADY_SET)r> r� r? r? r@ �set_log_denied� s zFirewall.set_log_deniedc C s | j S )N)rE )r> r? r? r@ r� � s zFirewall.get_default_zonec C s� | j |�}|| jkr�| j}|| _| jjd|� | jj� | jj||� | jj|�}x@t|d j � �D ] \}}|d rd| jj d|� qdW n t t j |��d S )Nrc r� r� rN )r~ rE r$ r� r� r8 r� r� r� r� r� r" r! ZZONE_ALREADY_SET)r> r8 r� r� Z_old_dz_settingsr� r� r? r? r@ �set_default_zone� s zFirewall.set_default_zonec C sH |j � }x:|j� D ].\}}|s(t|t�r2|||< q||kr||= qW |S )N)rq r� r� �bool)r> Z permanentZruntimer� �keyr� r? r? r@ �'combine_runtime_with_permanent_settings� s z0Firewall.combine_runtime_with_permanent_settingsc C s i }i }x�t |j� �t |j� �B D ]�}||kr"t|| t�r�t ||krN|| ng �}tt || �| �||< t|t || �A |@ �||< q"t|| t�s�t|| t�r�|| r�|| r�d||< q�|| r�|| r�d||< q"ttjdj t || �|���q"W ||fS )NTFz Unhandled setting type {} key {}) r� r� r� r� r� r� r" r! ZINVALID_SETTING�formatr� )r> Z old_settingsZ new_settingsZ add_settingsZremove_settingsr� �oldr? r? r@ � get_added_and_removed_settings� s z'Firewall.get_added_and_removed_settings)F)FF)F)N)N)N)N)N)F)4�__name__� __module__� __qualname__rA rM r= rZ rb r� r� rv r� r� r� rs r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r~ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r? r? r? r@ r B sh ( ; s )A�__all__Zos.pathr{ rX rq r r� Zfirewallr r Z firewall.corer r r r r Zfirewall.core.fw_icmptyper Zfirewall.core.fw_servicer Zfirewall.core.fw_zoner Zfirewall.core.fw_directr Zfirewall.core.fw_configr Zfirewall.core.fw_policiesr Zfirewall.core.fw_ipsetr Z firewall.core.fw_transactionr Zfirewall.core.fw_helperr Zfirewall.core.fw_policyr Zfirewall.core.fw_nmr r Zfirewall.core.loggerr Z firewall.core.io.firewalld_confr Zfirewall.core.io.directr Zfirewall.core.io.servicer Zfirewall.core.io.icmptyper Zfirewall.core.io.zoner r Zfirewall.core.io.ipsetr Zfirewall.core.ipsetr Zfirewall.core.io.helperr Zfirewall.core.io.policyr r! Zfirewall.errorsr" �objectr r? r? r? r@ �<module> sH