관리-도구
편집 파일: command.cpython-36.pyc
3 @)�f�^ � @ sf d Z dgZddlZddlmZ ddlmZ ddlmZ ddl m Z m Z m Z m Z mZ G dd� de�ZdS ) z<FirewallCommand class for command line client simplification�FirewallCommand� N)�errors)� FirewallError)� DBusException)� checkIPnMask� checkIP6nMask� check_mac� check_port�check_single_addressc @ s� e Zd Zd\dd�Zdd� Zdd� Zdd � Zd d � Zd d � Zd]dd�Z d^dd�Z d_dd�Z d`dd�Z dadd�Z dbdd�Zdcd d �Zddd d �Zded d!�Zdfd"d#�Zdgd$d%�Zdhd&d'�Zdid(d)�Zdjd*d+�Zdkd,d-�Zd.d/� Zdld1d2�Zdmd3d4�Zd5d6� Zd7d8� Z d9d:� Z d;d<� Z d=d>� Z d?d@� Z dg dAfdBdC�Z!dg fdDdE�Z"dg fdFdG�Z#dHdI� Z$dJdK� Z%dLdM� Z&dNdO� Z'dPdQ� Z(dRdS� Z)dTdU� Z*dVdW� Z+dXdY� Z,dZd[� Z-dS )nr Fc C s || _ || _d| _d | _d S )NT)�quiet�verbose�'_FirewallCommand__use_exception_handler�fw)�selfr r � r � /usr/lib/python3.6/command.py�__init__# s zFirewallCommand.__init__c C s || _ d S )N)r )r r r r r �set_fw) s zFirewallCommand.set_fwc C s || _ d S )N)r )r �flagr r r � set_quiet, s zFirewallCommand.set_quietc C s | j S )N)r )r r r r � get_quiet/ s zFirewallCommand.get_quietc C s || _ d S )N)r )r r r r r � set_verbose2 s zFirewallCommand.set_verbosec C s | j S )N)r )r r r r � get_verbose5 s zFirewallCommand.get_verboseNc C s$ |d k r | j r tjj|d � d S )N� )r �sys�stdout�write)r �msgr r r � print_msg8 s zFirewallCommand.print_msgc C s$ |d k r | j r tjj|d � d S )Nr )r r �stderrr )r r r r r �print_error_msg< s z FirewallCommand.print_error_msgc C s, d}d}t jj� r || | }| j|� d S )Nz[91mz[00m)r r �isattyr )r r ZFAILZENDr r r � print_warning@ s z FirewallCommand.print_warningr c C s, |dkr| j |� n | j|� tj|� d S )N� )r" r r �exit)r r Z exit_coder r r �print_and_exitG s z FirewallCommand.print_and_exitc C s | j |d� d S )N� )r% )r r r r r �failR s zFirewallCommand.failc C s" |d k r | j r tjj|d � d S )Nr )r r r r )r r r r r �print_if_verboseU s z FirewallCommand.print_if_verbosec C s� | j d k r| j j� g } d} g } x�|D ]�} |d k r�y || �} W nx tk r� } z\tjt|��}t|�dkrz| jd| � n| jd| |� || kr�| j |� | d7 } w&W Y d d }~X nX | j | � q&W �xb| D �]X} g }|d k r�||7 }t | t � o�t | t � �r|j | � n|| 7 }|d k �r(||7 }| j � y ||� W n� ttfk �r } z�t |t��rx| j|j� � |j� }nt|�}tj|�}|tjtjtjtjgk�r�d}t|�dk�r�| jd| � n,|dk�r�| jd| � d S | jd| |� || k�r| j |� | d7 } W Y d d }~X nX | j� q�W | �s�t|�| k�sJd| k�rNd S t| �dk�rltj| d � nt| �dk�r�tjtj� d S )Nr r# z Warning: %sz Error: %s)r Z authorizeAll� Exceptionr �get_code�str�lenr" r% �append� isinstance�list�tuple� deactivate_exception_handlerr �fail_if_not_authorized� get_dbus_name�get_dbus_messager �ALREADY_ENABLED� NOT_ENABLED�ZONE_ALREADY_SET� ALREADY_SET�activate_exception_handlerr r$ Z UNKNOWN_ERROR)r Zcmd_type�option� action_method� query_method� parse_method�message� start_args�end_args�no_exit�itemsZ_errorsZ _error_codes�itemr �code� call_itemr r r Z__cmd_sequenceY sr z FirewallCommand.__cmd_sequencec C s | j d||||||d� d S )N�add)rA )� _FirewallCommand__cmd_sequence)r r: r; r< r= r> rA r r r � add_sequence� s z FirewallCommand.add_sequencec C s | j d||||||g|d� d S )NrF )r? rA )rG )r �xr: r; r< r= r> rA r r r �x_add_sequence� s z FirewallCommand.x_add_sequencec C s$ | j d||||||g|g|d� d S )NrF )r? r@ rA )rG ) r �zoner: r; r< r= r> ZtimeoutrA r r r �zone_add_timeout_sequence� s z)FirewallCommand.zone_add_timeout_sequencec C s | j d||||||d� d S )N�remove)rA )rG )r r: r; r< r= r> rA r r r �remove_sequence� s z FirewallCommand.remove_sequencec C s | j d||||||g|d� d S )NrM )r? rA )rG )r rI r: r; r< r= r> rA r r r �x_remove_sequence� s z!FirewallCommand.x_remove_sequencec C s g }x�|D ]�}|d k r�y ||�}W n^ t k r� } zBt|�dkrR| jd| � w n tjt| ��} | jd| | � W Y d d } ~ X nX |j|� q W �xv|D �]l}g } |d k r�| |7 } t|t � r�t|t � r�| j|� n| |7 } | j � y || � } W n� t k �rj } zZ| j | j� � tj| j� �} t|�dk�rF| jd| j� � w�n| jd| j� | � W Y d d } ~ X n` t k �r� } zBtjt| ��} t|�dk�r�| jd| � n| jd| | � W Y d d } ~ X nX | j� t|�dk�r�| jd|| d| f � q�| j| � q�W |�stjd� d S ) Nr# z Warning: %sz Error: %sz%s: %s�no�yesr )rP rQ )r) r, r" r r* r+ r% r- r. r/ r0 r1 r r2 r3 r4 r9 r �print_query_resultr r$ ) r r: r< r= r> r? rA rB rC r rD rE �resr r r Z__query_sequence� sR " " z FirewallCommand.__query_sequencec C s | j |||||d� d S )N)rA )� _FirewallCommand__query_sequence)r r: r< r= r> rA r r r �query_sequence� s z FirewallCommand.query_sequencec C s | j |||||g|d� d S )N)r? rA )rT )r rI r: r< r= r> rA r r r �x_query_sequence� s z FirewallCommand.x_query_sequencec C sJ t |� rFt|� rFt|� rF|jd�o2t|�dk rFttjd| ��|S )Nzipset:� z8'%s' is no valid IPv4, IPv6 or MAC address, nor an ipset)r r r � startswithr, r r � INVALID_ADDR)r �valuer r r � parse_source� s z FirewallCommand.parse_source�/c C sl y|j |�\}}W n$ tk r6 ttjd| ��Y nX t|�sLttj|��|dkrdttjd| ��||fS )NzTbad port (most likely missing protocol), correct syntax is portid[-portid]%sprotocol�tcp�udp�sctp�dccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r] r^ r_ r` )�split� ValueErrorr r � INVALID_PORTr �INVALID_PROTOCOL)r rZ Z separator�port�protor r r � parse_port s zFirewallCommand.parse_portc C s� d }d }d }d }d}x�d||d � kr�||d � j dd�d }|t|�d 7 }d||d � krx||d � j dd�d } n ||d � } |t| �d 7 }|dkr�| }q|dkr�| }q|dkr�| }q|dkr�| }q|d kr�|r�qttjd | ��qW |�s ttjd ��|�sttjd ��|�p|�s*ttjd ��t|��s@ttj|��|dk�rZttjd| ��|�rxt|� �rxttj|��|�r�td|� �r�|�s�td|� �r�ttj |��||||fS )Nr �=r# �:re rf �toport�toaddr�ifz invalid forward port arg '%s'z missing portzmissing protocolzmissing destinationr] r^ r_ r` z''%s' not in {'tcp'|'udp'|'sctp'|'dccp'}�ipv4�ipv6)r] r^ r_ r` ) ra r, r r ZINVALID_FORWARDr rc rd r rY ) r rZ �compatre Zprotocolrj rk �i�opt�valr r r �parse_forward_port sT z"FirewallCommand.parse_forward_portc C sF |j d�}t|�dkr"|d dfS t|�dkr2|S ttjd| ��d S )Nrh r# r � r& zinvalid ipset option '%s')ra r, r r ZINVALID_OPTION)r rZ �argsr r r �parse_ipset_optionH s z"FirewallCommand.parse_ipset_optionc C s. ddg}||kr*t tjd|dj|�f ��|S )Nrm rn z'invalid argument: %s (choose from '%s')z', ')r r � INVALID_IPV�join)r rZ �ipvsr r r �check_destination_ipvR s z%FirewallCommand.check_destination_ipvc C sD y|j dd�\}}W n tk r4 ttjd��Y nX | j|�|fS )Nri r# z(destination syntax is ipv:address[/mask])ra rb r r ZINVALID_DESTINATIONrz )r rZ ZipvZ destinationr r r �parse_service_destinationZ s z)FirewallCommand.parse_service_destinationc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrm rn Zebz'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r � check_ipvb s zFirewallCommand.check_ipvc C s0 dddg}||kr,t tjd|dj|�f ��|S )Nrt rm rn z'invalid argument: %s (choose from '%s')z', ')r r rw rx )r rZ ry r r r �check_helper_familyj s z#FirewallCommand.check_helper_familyc C sB |j d�sttjd| ��t|jdd��dk r>ttjd| ��|S )NZ nf_conntrack_z('%s' does not start with 'nf_conntrack_'rt r# zModule name '%s' too short)rX r r ZINVALID_MODULEr, �replace)r rZ r r r � check_moduler s z FirewallCommand.check_moduleTc C s� |j � }|j� }|j� }|j� } |j� } |j� } |j� } |j� } |j� }|j � }|j � }|rv|j � }|j � }|j � }n,|j� }tt|j� | ��}|j� }|j� }dd� }g }|d k r�||kr�|jd� | r�|s�|s�|r�|r�|r�|jd� |�r|ddj|� }| j|� | j�r2| jd| � | jd| � |�rJ| jd t|� � | jd | � |�sv| jd |�rnd nd � |�r�| jddj|� � | jddj|� � n(| jddj|� � | jddj|� � | jddjt|�� � | jddjdd� |D �� � | jddjt| �� � |�s:| jd|�r2d nd � | jd| �rJd nd � | jd| �rbdnd djd d� | D �� � | jd djd d� | D �� � | jd dj| � � | jd!|�r�dnd djt||d"�� � d S )#Nc S sf d}d}y| j |�}W n tk r* Y n8X |t|�7 }t| ||| |d � j d� � jdd��}|S )Nr z priority=� �"rt )�indexrb r, �intr~ )Zrule�priorityZ search_strrp r r r �rich_rule_sorted_key� s *zDFirewallCommand.print_zone_policy_info.<locals>.rich_rule_sorted_key�defaultZactivez (%s)z, z summary: z description: z priority: z target: z icmp-block-inversion: %srQ rP z ingress-zones: r� z egress-zones: z interfaces: z sources: z services: z ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )�.0re r r r � <listcomp>� s z:FirewallCommand.print_zone_policy_info.<locals>.<listcomp>z protocols: z forward: %sz masquerade: %sz forward-ports: z rt c S s$ g | ] \}}}}d ||||f �qS )z$port=%s:proto=%s:toport=%s:toaddr=%sr )r� re rf rj rk r r r r� � s z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z icmp-blocks: z rich rules: )�key)Z getTargetZ getServices�getPorts� getProtocolsZ getMasqueradeZgetForwardPorts�getSourcePortsZ getIcmpBlocksZ getRichRules�getDescription�getShortZgetIngressZonesZgetEgressZonesZ getPriorityZgetIcmpBlockInversion�sorted�setZ getInterfacesZ getSourcesZ getForwardr- rx r r r+ )r rK �settings� default_zone�extra_interfaces�isPolicy�targetZservices�ports� protocolsZ masqueradeZ forward_ports� source_portsZ icmp_blocksZrules� description�short_descriptionZ ingress_zonesZ egress_zonesr� Zicmp_block_inversionZ interfacesZsourcesZforwardr� Z attributesr r r �print_zone_policy_info| sx z&FirewallCommand.print_zone_policy_infoc C s | j ||||dd� d S )NF)r� r� r� )r� )r rK r� r� r� r r r �print_zone_info� s z FirewallCommand.print_zone_infoc C s | j ||||dd� d S )NT)r� r� r� )r� )r Zpolicyr� r� r� r r r �print_policy_info� s z!FirewallCommand.print_policy_infoc C s. |j � }|j� }|j� }|j� }|j� }|j� }|j� } |j� } |j� } | j |� | j rt| j d| � | j d| � | j ddj dd� |D �� � | j ddj |� � | j ddj d d� |D �� � | j d dj |� � | j d dj d d� |j � D �� � | j d dj t | �� � | j ddj t | �� � d S )Nz summary: z description: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z6FirewallCommand.print_service_info.<locals>.<listcomp>z protocols: z source-ports: c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� � s z modules: z destination: c S s g | ]\}}d ||f �qS )z%s:%sr )r� �k�vr r r r� � s z includes: z helpers: )r� r� r� Z getModulesr� �getDestinationsr� Z getIncludesZ getHelpersr r rx rB r� ) r Zservicer� r� r� r� �modulesr� � destinationsr� ZincludesZhelpersr r r �print_service_info� s2 z"FirewallCommand.print_service_infoc C sp |j � }|j� }|j� }t|�dkr,ddg}| j|� | jrX| jd| � | jd| � | jddj|� � d S )Nr rm rn z summary: z description: z destination: r� )r� r� r� r, r r rx )r Zicmptyper� r� r� r� r r r �print_icmptype_info� s z#FirewallCommand.print_icmptype_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jddjdd� |j� D �� � | jddj|� � d S ) Nz summary: z description: z type: z options: r� c S s$ g | ] \}}|r d ||f n|�qS )z%s=%sr )r� r� r� r r r r� s z4FirewallCommand.print_ipset_info.<locals>.<listcomp>z entries: ) ZgetTypeZ getOptionsZ getEntriesr� r� r r rx rB )r Zipsetr� Z ipset_typeZoptions�entriesr� r� r r r �print_ipset_info� s z FirewallCommand.print_ipset_infoc C s� |j � }|j� }|j� }|j� }|j� }| j|� | jrT| jd| � | jd| � | jd| � | jd| � | jddjdd� |D �� � d S ) Nz summary: z description: z family: z module: z ports: r� c S s g | ]}d |d |d f �qS )z%s/%sr r# r )r� re r r r r� s z5FirewallCommand.print_helper_info.<locals>.<listcomp>)r� Z getModuleZ getFamilyr� r� r r rx )r �helperr� r� �moduleZfamilyr� r� r r r �print_helper_info s z!FirewallCommand.print_helper_infoc C s |r| j d� n | j dd� d S )NrQ rP r# )r% )r rZ r r r rR s z"FirewallCommand.print_query_resultc C s\ | j s� | j|� tjt|��}|tjtjtjtj gkrH| j d| � n| j d| |� d S )Nz Warning: %sz Error: %s) r r2 r r* r+ r r5 r6 r7 r8 r" r% )r �exception_messagerD r r r �exception_handler s z!FirewallCommand.exception_handlerc C s d|krd}| j |tj� d S )NZNotAuthorizedExceptionz`Authorization failed. Make sure polkit agent is running or run the application as superuser.)r% r ZNOT_AUTHORIZED)r r� r r r r r2 ' s z&FirewallCommand.fail_if_not_authorizedc C s d| _ d S )NF)r )r r r r r1 - s z,FirewallCommand.deactivate_exception_handlerc C s d| _ d S )NT)r )r r r r r9 0 s z*FirewallCommand.activate_exception_handlerc C sp g }t � }t|�}xP|D ]H}|s"P |j� }t|�dk s|d dkrDq||kr|j|� |j|� qW |j� |S )Nr# r �#�;)r� r� )r� �open�stripr, r- rF �close)r �filenamer� Z entries_set�f�liner r r �get_ipset_entries_from_file3 s z+FirewallCommand.get_ipset_entries_from_file)FF)N)N)N)Nr )N)N)NNF)F)F)F)F)F)NF)F)F)r\ )F).�__name__� __module__� __qualname__r r r r r r r r r" r% r' r( rG rH rJ rL rN rO rT rU rV r[ rg rs rv rz r{ r| r} r r� r� r� r� r� r� r� rR r� r2 r1 r9 r� r r r r r " sX J 2 2 O )�__doc__�__all__r Zfirewallr Zfirewall.errorsr Zdbus.exceptionsr Zfirewall.functionsr r r r r �objectr r r r r �<module> s