shell bypass 403
a
���gt � @ sL d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZmZmZmZmZmZ d dlmZ d d lmZ d d
lmZ d d lmZ d d l m Z d d
l m Z d dl m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z) d dl*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 d dlm3Z3 d dl4m5Z5 G dd� de �Z6dS )� N)�config)�DEFAULT_ZONE_TARGET)�Watcher)�log)�DbusServiceObject)�handle_exceptions�dbus_handle_exceptions�dbus_service_method� dbus_service_method_deprecated� dbus_service_signal_deprecated�dbus_polkit_require_auth)�FirewallDConfigIcmpType)�FirewallDConfigService)�FirewallDConfigZone)�FirewallDConfigPolicy)�FirewallDConfigIPSet)�FirewallDConfigHelper)�IcmpType)�IPSet)�Helper)�LockdownWhitelist)�Direct)�dbus_to_python�command_of_sender�context_of_sender�
uid_of_sender� user_of_uid�%dbus_introspection_prepare_properties�!dbus_introspection_add_properties�!dbus_introspection_add_deprecated)�errors)�
FirewallErrorc s e Zd ZdZdZejjZe � fdd��Z
e dd� �Z e dd� �Z e d d
� �Z
e d d � �Ze d
d� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd � �Ze d d � �Ze d d � �Ze d!d"� �Ze d#d$� �Ze d%d&� �Ze d'd(� �Z e d)d*� �Z e d+d,� �Z e d-d.� �Z e d/d0� �Z e!d1d2� �Z"e!d3d4� �Z#e!d5d6� �Z$e%ej&d7d8d9�e!d�d;d<���Z'e%ej&d=d>d9�e!d�d?d@���Z(e)ejj�e%ej&dAdB�e!d�dCdD����Z*ej+j,ej&dEdF�dGdH� �Z-e)ejj.�e%ej/d=dI�e!d� fdJdK� ���Z0e%ejj1e2j3dI�e!d�dLdM���Z4e%ejj1e2j3dB�e!d�dNdO���Z5ej+�,ejj1�e!dPdQ� ��Z6e%ejj1d=dB�e!d�dRdS���Z7e%ejj1d=dB�e!d�dTdU���Z8e%ejj1d=dVd9�e!d�dWdX���Z9e%ejj1dYdI�e!d�dZd[���Z:e%ejj1d=dB�e!d�d\d]���Z;e%ejj1d=dB�e!d�d^d_���Z<e%ejj1d=dVd9�e!d�d`da���Z=e%ejj1dYdI�e!d�dbdc���Z>e%ejj1d=dB�e!d�ddde���Z?e%ejj1d=dB�e!d�dfdg���Z@e%ejj1d=dVd9�e!d�dhdi���ZAe%ejj1dYdI�e!d�djdk���ZBe%ejj1dldB�e!�d dmdn���ZCe%ejj1dldB�e!�ddodp���ZDe%ejj1dldVd9�e!�ddqdr���ZEe%ejj1dsdI�e!�ddtdu���ZFe%ejjGdvdI�e!�ddwdx���ZHe%ejjGdYdI�e!�ddydz���ZIe%ejjGd=d{d9�e!�dd|d}���ZJe%ejjGd=eKj3 d{d9�e!�dd~d���ZLej+j,ejjGd=dF�e!d�d�� ��ZMe%ejjGdvdI�e!�dd�d����ZNe%ejjGdYdI�e!�d d�d����ZOe%ejjGd=d{d9�e!�d
d�d����ZPe%ejjGd=eQj3 d{d9�e!�d d�d����ZRej+j,ejjGd=dF�e!d�d�� ��ZSe%ejjGdvdI�e!�d d�d����ZTe%ejjGdYdI�e!�d
d�d����ZUe%ejjGd=d{d9�e!�dd�d����ZVe%ejjGd�d{d9�e!�dd�d����ZWe%ejjGd�d{d9�e!�dd�d����ZXej+j,ejjGd=dF�e!d�d�� ��ZYe%ejjGdvdI�e!�dd�d����ZZe%ejjGdYdI�e!�dd�d����Z[e%ejjGd=d{d9�e!�dd�d����Z\e%ejjGd=d=d9�e!�dd�d����Z]e%ejjGd=d=d9�e!�dd�d����Z^e%ejjGd�d{d9�e!�dd�d����Z_e%ejjGd�d{d9�e!�dd�d����Z`ej+j,ejjGd=dF�e!d�d�� ��Zae%ejjGdvdI�e!�dd�d����Zbe%ejjGdYdI�e!�dd�d����Zce%ejjGd=d{d9�e!�dd�d����Zde%ejjGd�d{d9�e!�dd�d����Zeej+j,ejjGd=dF�e!d�d�� ��Zfe%ejjGdvdI�e!�d d�d����Zge%ejjGdYdI�e!�d d�d����Zhe%ejjGd=d{d9�e!�d d�d����Zie%ejjGd=ejj3 d{d9�e!�d d�d����Zkej+j,ejjGd=dF�e!d�d�� ��Zlemejjn�e%ejjneoj3dI�e!�d d�d�����Zpemejjn�e%ejjneoj3dB�e!�d!d�d���Zqerejjn�ej+�,ejjn�e!d�dĄ ���Zsemejjn�e%ejjnd�dB�e!�d"d�dDŽ���Ztemejjn�e%ejjnd�dB�e!�d#d�dɄ���Zuemejjn�e%ejjnd�dVd9�e!�d$d�d˄���Zvemejjn�e%ejjnd7dYd9�e!�d%d�d̈́���Zwemejjn�e%ejjnd�d�d9�e!�d&d�dф���Zxemejjn�e%ejjnd�dB�e!�d'd�dԄ���Zyemejjn�e%ejjnd�dB�e!�d(d�dք���Zzemejjn�e%ejjnd�dVd9�e!�d)d�d���Z{emejjn�e%ejjnd�dB�e!�d*d�dڄ���Z|emejjn�e%ejjnd�d�d9�e!�d+d�d݄���Z}emejjn�e%ejjnd�d�d9�e!�d,d�d����Z~emejjn�e%ejjnd�dB�e!�d-d�d����Zemejjn�e%ejjnd�dB�e!�d.d�d����Z�emejjn�e%ejjnd�dVd9�e!�d/d�d����Z�emejjn�e%ejjnd=d�d9�e!�d0d�d����Z�emejjn�e%ejjnd�dI�e!�d1d�d����Z�� Z�S (2 �FirewallDConfigzFirewallD main classTc s� t t| �j|i |�� || _|d | _|d | _| �� t| jd�| _ | j �
tj � | j �
tj � | j �
tj
� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� | j �
tj� tj�tj��r>tt�tj��D ].}dtj|f }tj�|��r| j �
|� �q| j � tj � | j � tj � | j � tj � t | tj!j"ddddddddddddddd�� d S )Nr � � z%s/%sZ readwrite)�
CleanupOnExit�CleanupModulesOnExit�
IPv6_rpfilter�IPv6_rpfilter2�Lockdown� MinimalMark�IndividualCalls� LogDenied�AutomaticHelpers�FirewallBackend�FlushAllOnReload� RFC3964_IPv4�AllowZoneDrifting�NftablesTableOwner)#�superr" �__init__r �busname�path�
_init_varsr �
watch_updater�watcher�
add_watch_dir�FIREWALLD_IPSETS�ETC_FIREWALLD_IPSETS�FIREWALLD_ICMPTYPES�ETC_FIREWALLD_ICMPTYPES�FIREWALLD_HELPERS�ETC_FIREWALLD_HELPERS�FIREWALLD_SERVICES�ETC_FIREWALLD_SERVICES�FIREWALLD_ZONES�ETC_FIREWALLD_ZONES�FIREWALLD_POLICIES�ETC_FIREWALLD_POLICIES�os�exists�sorted�listdir�isdirZadd_watch_file�LOCKDOWN_WHITELIST�FIREWALLD_DIRECT�FIREWALLD_CONFr �dbus�DBUS_INTERFACE_CONFIG)�selfZconf�args�kwargs�filenamer6 �� __class__� �:/usr/lib/python3.9/site-packages/firewall/server/config.pyr4 D sV
��zFirewallDConfig.__init__c C s g | _ d| _g | _d| _g | _d| _g | _d| _g | _d| _ g | _
d| _ | j �
� D ]}| �| j �|�� qR| j �� D ]}| �| j �|�� qt| j �� D ]}| �| j �|�� q�| j �� D ]}| �| j �|�� q�| j �� D ]}| �| j �|�� q�| j � � D ]}| � | j � |�� q�d S �Nr ) �ipsets� ipset_idx� icmptypes� icmptype_idx�services� service_idx�zones�zone_idx�helpers�
helper_idx�policy_objects�policy_object_idxr Z
get_ipsets� _addIPSetZ get_ipsetZ
get_icmptypes� _addIcmpTypeZ get_icmptypeZ get_services� _addServiceZ get_serviceZ get_zones�_addZoneZget_zoneZ get_helpers�
_addHelperZ
get_helperZget_policy_objects�
_addPolicyZget_policy_object)rQ �ipset�icmptype�service�zone�helper�policyrW rW rX r7 u s0 zFirewallDConfig._init_varsc C s d S �NrW �rQ rW rW rX �__del__� s zFirewallDConfig.__del__c C s� t | j�dkr$| j�� }|�� ~q t | j�dkrH| j�� }|�� ~q$t | j�dkrl| j�� }|�� ~qHt | j�dkr�| j�� }|�� ~qlt | j�dkr�| j�� }|�� ~q�t | j�dkr�| j�� }|�� ~q�| � � d S rY )
�lenrZ �pop�
unregisterr\ r^ r` rb rd r7 )rQ �itemrW rW rX �reload� s2
zFirewallDConfig.reloadc
C s~ |t jkr�| �t jj�}t�dt j� z| j �� W n8 tyl } z t� d||f � W Y d }~d S d }~0 0 | �t jj��
� }t |� � �D ]"}||v r�|| || kr�||= q�t
|�dkr�| �t jj|g � d S |�t j�s�|�t j��r�|�d��r�z| j �|�\}}W n: t�yF } z t� d||f � W Y d }~d S d }~0 0 |dk�r^| �|� n*|dk�rt| �|� n|dk�rz| �|� �n�|�t j��s�|�t j��rH|�d��rHz| j �|�\}}W n: t�y } z t� d ||f � W Y d }~d S d }~0 0 |dk�r| �|� n*|dk�r0| �|� n|dk�rz| � |� �n2|�t j ��sd|�t j ��r�|�d��rz| j � |�\}}W n: t�y� } z t� d
||f � W Y d }~d S d }~0 0 |dk�r�| � |� n*|dk�r�| �!|� n|dk�r�| �"|� n�|�t j ��rz|�#t j d ��$d �}t
|�d
k �s<d |v �r@d S t%j&�'|��rj| j(�)|��s�| j(�*|� n| j(�)|��rz| j(�+|� �n�|�t j,��s�|�t j-��rD|�d��rDz| j �.|�\}}W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 |dk�r| �/|� n*|dk�r,| �0|� n|dk�rz| �1|� �n6|�t j2��s`|�t j3��r |�d��r z| j �4|�\}}W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 |dk�r�| �5|� n*|dk�r�| �6|� n|dk�rz| �7|� �nz|t j8k�rbz| j �9� W n: t�yT } z t� d||f � W Y d }~d S d }~0 0 | �:� �n|t j;k�r�z| j �<� W n: t�y� } z t� d||f � W Y d }~d S d }~0 0 | �=� n�|�t j>��s�|�t j?��rz|�d��rzz| j �@|�\}}W n: t�y8 } z t� d||f � W Y d }~d S d }~0 0 |dk�rP| �A|� n*|dk�rf| �B|� n|dk�rz| �C|� d S )Nz,config: Reloading firewalld config file '%s'z+Failed to load firewalld.conf file '%s': %sr z.xmlz%Failed to load icmptype file '%s': %s�new�remove�updatez$Failed to load service file '%s': %sz!Failed to load zone file '%s': %s� �/r# z"Failed to load ipset file '%s': %sz#Failed to load helper file '%s': %sz/Failed to load lockdown whitelist file '%s': %sz)Failed to load direct rules file '%s': %sz#Failed to load policy file '%s': %s)Dr rN �GetAllrO rP r �debug1Zupdate_firewalld_conf� Exception�error�copy�list�keysru �PropertiesChanged�
startswithr= r> �endswithZupdate_icmptype_from_pathrg �removeIcmpType�_updateIcmpTyperA rB Zupdate_service_from_pathrh �
removeService�_updateServicerC rD Zupdate_zone_from_pathri �
removeZone� _updateZone�replace�striprG r6 rK r9 Z has_watchr: Z remove_watchr; r< Zupdate_ipset_from_pathrf � removeIPSet� _updateIPSetr? r@ Zupdate_helper_from_pathrj � removeHelper�
_updateHelperrL Zupdate_lockdown_whitelist�LockdownWhitelistUpdatedrM Z
update_direct�UpdatedrE rF Z update_policy_object_from_pathrk � removePolicy�
_updatePolicy) rQ �nameZ old_props�msgZprops�keyZwhat�obj�_namerW rW rX r8 � s&
��
�
��
��
�
���
���
� �
��
z FirewallDConfig.watch_updaterc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S �Nz%s/%dr# )
r
r r] r5 rO ZDBUS_PATH_CONFIG_ICMPTYPEr\ �append�
IcmpTypeAddedr� )rQ r� �config_icmptyperW rW rX rg B s �� z FirewallDConfig._addIcmpTypec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r\ r� r� r6 rT r� )rQ r� rm rW rW rX r� N s
� �z FirewallDConfig._updateIcmpTypec C s� d}| j D ]J}|�� }|j|| v r
|| �|j� | j�|j|�|_|�|jj� q
| jD ]R}|�� }d|v r\|j|d v r\|d �|j� | j� |j|�|_|�|jj� q\| j
D ]0}|j|kr�|� |j� |� � | j
�|� ~q�d S )N� Z icmp_blocks)
r` � getSettingsr� r{ r �set_zone_configr� r� rd � set_policy_object_config_dictr\ �Removedrw )rQ r� �indexro �settingsrq rm rW rW rX r� W s&
z FirewallDConfig.removeIcmpTypec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� )
r r r_ r5 rO ZDBUS_PATH_CONFIG_SERVICEr^ r� � ServiceAddedr� )rQ r� �config_servicerW rW rX rh q s � zFirewallDConfig._addServicec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r^ r� r� r6 rT r� )rQ r� rn rW rW rX r� | s
� �z FirewallDConfig._updateServicec C s� d}| j D ]J}|�� }|j|| v r
|| �|j� | j�|j|�|_|�|jj� q
| jD ]R}|�� }d|v r\|j|d v r\|d �|j� | j� |j|�|_|�|jj� q\| j
D ]0}|j|kr�|� |j� |� � | j
�|� ~q�d S )Nr$ r^ )
r` r� r� r{ r r� r� r� rd r� r^ r� rw )rQ r� r� ro r� rq rn rW rW rX r� � s&
z FirewallDConfig.removeServicec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� )
r r ra r5 rO ZDBUS_PATH_CONFIG_ZONEr` r� � ZoneAddedr� )rQ r� � config_zonerW rW rX ri � s � zFirewallDConfig._addZonec C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )r` r� r� r6 rT r� �rQ r� ro rW rW rX r� � s
�zFirewallDConfig._updateZonec C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )r` r� r� r� rw r{ r� rW rW rX r� � s
zFirewallDConfig.removeZonec C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� )
r r re r5 rO ZDBUS_PATH_CONFIG_POLICYrd r� � PolicyAddedr� )rQ r� �
config_policyrW rW rX rk � s � zFirewallDConfig._addPolicyc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rd r� r� r6 rT r� �rQ r� rq rW rW rX r� � s
�z FirewallDConfig._updatePolicyc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rd r� r� r� rw r{ r� rW rW rX r� � s
z FirewallDConfig.removePolicyc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� )
r r r[ r5 rO ZDBUS_PATH_CONFIG_IPSETrZ r� �
IPSetAddedr� )rQ r� � config_ipsetrW rW rX rf � s � zFirewallDConfig._addIPSetc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rZ r� r� r6 rT r� �rQ r� rl rW rW rX r� � s
�z FirewallDConfig._updateIPSetc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rZ r� r� r� rw r{ r� rW rW rX r� � s
zFirewallDConfig.removeIPSetc C sP t | | j|| j| jdtjj| jf �}| j�|� | jd7 _| �|j � |S r� )
r r rc r5 rO ZDBUS_PATH_CONFIG_HELPERrb r� � HelperAddedr� )rQ r� �
config_helperrW rW rX rj � s � zFirewallDConfig._addHelperc C sL | j D ]@}|jj|jkr|jj|jkr|jj|jkr||_|�|j� qd S rr )rb r� r� r6 rT r� �rQ r� rp rW rW rX r� s
�z FirewallDConfig._updateHelperc C s< | j D ]0}|j|kr|�|j� |�� | j �|� ~qd S rr )rb r� r� r� rw r{ r� rW rW rX r� s
z FirewallDConfig.removeHelperc C s� | j jjdkrttjd��| j �� r�|d u r:t�d� d S t �
� }t ||�}| j � d|�r^d S t
||�}| j � d|�rzd S t|�}| j � d|�r�d S t||�}| j � d|�r�d S ttjd��d S ) NZFAILEDz�Changing permanent configuration is not allowed while firewalld is in FAILED state. The permanent configuration must be fixed and then firewalld restarted. Try `firewall-offline-cmd --check-config`.z&Lockdown not possible, sender not set.�context�uid�user�commandzlockdown is enabled)r Z_fw�_stater! r ZRUNNING_BUT_FAILEDZlockdown_enabledr r� rO Z SystemBusr Z access_checkr r r Z
ACCESS_DENIED)rQ �senderZbusr� r� r� r� rW rW rX � accessCheck s, �
zFirewallDConfig.accessCheckc C s� |dvrt j�d| ��| j�� �|�}|dkrH|d u r>tj}t �|�S |dkrr|d u r`tj}nt |�}t �
|�S |dkr�|d u r�tj r�dnd}t �|�S |dkr�|d u r�tj r�dnd}t �|�S |d kr�|d u r�tj
r�dnd}t �|�S |d
k�r |d u �s|dk�rt �d�S t �d�S �nv|d k�rD|d u �r:tj}t �|�S |d k�rr|d u �rhtj�rddnd}t �|�S |d
k�r�|d u �r�tj}t �|�S |dk�r�|d u �r�tj}t �|�S |dk�r�|d u �r�tj}t �|�S |dk�r |d u �rtj�r�dnd}t �|�S |dk�r:|d u �r0tj�r,dnd}t �|�S |dk�rh|d u �r^tj�rZdnd}t �|�S |dk�r�|d u �r�tj�r�dnd}t �|�S d S )N�� DefaultZoner* r% r& r) r' r+ r, r- r. r/ r0 r1 r( r2 �Dorg.freedesktop.DBus.Error.InvalidArgs: Property '%s' does not existr� r* r% �yes�nor& r) r' r( r+ r, r- r. r/ r0 r1 r2 )rO �
exceptions�
DBusExceptionr �get_firewalld_conf�getZ
FALLBACK_ZONE�StringZFALLBACK_MINIMAL_MARK�int�Int32ZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGZ FALLBACK_NFTABLES_TABLE_OWNER)rQ �prop�valuerW rW rX �
_get_property3 s� ��
z FirewallDConfig._get_propertyc C s� |dkrt �| �|��S |dkr0t �| �|��S |dkrHt �| �|��S |dkr`t �| �|��S |dkrxt �| �|��S |dkr�t �| �|��S |dkr�t �| �|��S |dkr�t �| �|��S |d kr�t �| �|��S |d
k� r�t �| �|��S |d k�r t �| �|��S |d k�r&t �| �|��S |d
k�r@t �| �|��S |dk�rZt �| �|��S |dk�rtt �| �|��S t j�d| ��d S )Nr� r* r% r& r) r' r( r+ r, r- r. r/ r0 r1 r2 r� )rO r� r� r� r� r� )rQ r� rW rW rX �_get_dbus_property� sF
��z"FirewallDConfig._get_dbus_property�ss�v)� in_signature�
out_signatureNc C sr t |t�}t |t�}t�d||� |tjjkr8| �|�S |tjjtjj fv r^tj
� d| ��ntj
� d| ��d S )Nzconfig.Get('%s', '%s')r� �Jorg.freedesktop.DBus.Error.UnknownInterface: Interface '%s' does not exist) r �strr r� r rO rP r� � DBUS_INTERFACE_CONFIG_DIRECT� DBUS_INTERFACE_CONFIG_POLICIESr� r� )rQ �interface_name�
property_namer� rW rW rX �Get� s$
�����zFirewallDConfig.Get�sza{sv}c C st t |t�}t�d|� i }|tjjkr@dD ]}| �|�||< q*n&|tjjtjj fv rVntj
� d| ��tj |dd�S )Nzconfig.GetAll('%s')r� r� �sv�Z signature)
r r� r r� r rO rP r� r� r� r� r� Z
Dictionary)rQ r� r� �ret�xrW rW rX r � s
���zFirewallDConfig.GetAllZssv)r� c C s� t |t�}t |t�}t |�}t�d|||� | �|� |tjjk�rR|dv �r4|dv rx|�� dvrvt t
j d||f ��n�|dkr�|tj vr�t t
j d||f ��n`|dkr�|tj
vr�t t
j d||f ��n8|dkr�|tjvr�t t
j d||f ��ntj�d | ��| j�� �||� | j�� �� | �|||ig � n |d
v �r@ntj�d | ��n8|tjjtjjfv �rztj�d | ��ntj�d | ��d S ) Nz config.Set('%s', '%s', '%s')) r% r& r) r' r+ r, r. r/ r0 r( r2 )r% r& r) r' r+ r/ r0 r2 )r� r� �trueZfalsez '%s' for %sr, r. r( r� )r* r- r1 r� )r r� r r� r� r rO rP �lowerr! r Z
INVALID_VALUEZLOG_DENIED_VALUESZFIREWALL_BACKEND_VALUESZIPV6_RPFILTER_VALUESr� r� r� �set�writer� r� r� )rQ r� r� Z new_valuer� rW rW rX �Set� s�
�
��
��
��
����
�������zFirewallDConfig.Setzsa{sv}asr� c C s. t |t�}t |�}t |�}t�d|||� d S )Nz*config.PropertiesChanged('%s', '%s', '%s')�r r� r r� )rQ r� Zchanged_propertiesZinvalidated_propertiesrW rW rX r� s
�z!FirewallDConfig.PropertiesChanged)r� c s` t �d� tt| ��| j| j�� �}t| |t j
j �}t j
j fD ] }t
| ||t� jt� j�}q>|S )Nzconfig.Introspect())r Zdebug2r3 r" �
Introspectr6 r5 Zget_busr r rO rP r� r r
Z
deprecatedr )rQ r� �dataZ interfacerU rW rX r� " s
�
��zFirewallDConfig.Introspectc C s t �d� | j�� j�� S )Nz&config.policies.getLockdownWhitelist())r r� r � get_policies�lockdown_whitelist�
export_config�rQ r� rW rW rX �getLockdownWhitelist9 s
z$FirewallDConfig.getLockdownWhitelistc C sB t �d� t|�}| j�� j�|i � | j�� j�� | �� d S )Nz)config.policies.setLockdownWhitelist(...)) r r� r r r� r� �
import_configr� r� �rQ r� r� rW rW rX �setLockdownWhitelist@ s
z$FirewallDConfig.setLockdownWhitelistc C s t �d� d S )Nz*config.policies.LockdownWhitelistUpdated()�r r� rs rW rW rX r� J s z(FirewallDConfig.LockdownWhitelistUpdatedc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | �
|� d S )Nz1config.policies.addLockdownWhitelistCommand('%s')r � r r r� r� r� r� r! r �ALREADY_ENABLEDr� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistCommandQ s
z+FirewallDConfig.addLockdownWhitelistCommandc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | �
|� d S )Nz4config.policies.removeLockdownWhitelistCommand('%s')r � r r r� r� r� r� r! r � NOT_ENABLEDr{ r� r� rW rW rX � removeLockdownWhitelistCommand^ s �
z.FirewallDConfig.removeLockdownWhitelistCommand�bc C s$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistCommand('%s')r �r r r� r� )rQ r� r� rW rW rX � queryLockdownWhitelistCommandl s
�z-FirewallDConfig.queryLockdownWhitelistCommand�asc C s t �d� | �� d S )Nz.config.policies.getLockdownWhitelistCommands()r �r r� r� r� rW rW rX � getLockdownWhitelistCommandsu s
z,FirewallDConfig.getLockdownWhitelistCommandsc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | �
|� d S )Nz1config.policies.addLockdownWhitelistContext('%s')r# r� �rQ r� r� r� rW rW rX �addLockdownWhitelistContext~ s
z+FirewallDConfig.addLockdownWhitelistContextc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | �
|� d S )Nz4config.policies.removeLockdownWhitelistContext('%s')r# r� r� rW rW rX � removeLockdownWhitelistContext� s �
z.FirewallDConfig.removeLockdownWhitelistContextc C s$ t |�}t�d|� || �� d v S )Nz3config.policies.queryLockdownWhitelistContext('%s')r# r� )rQ r� r� rW rW rX � queryLockdownWhitelistContext� s
�z-FirewallDConfig.queryLockdownWhitelistContextc C s t �d� | �� d S )Nz.config.policies.getLockdownWhitelistContexts()r# r� r� rW rW rX � getLockdownWhitelistContexts� s
z,FirewallDConfig.getLockdownWhitelistContextsc C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | �
|� d S )Nz.config.policies.addLockdownWhitelistUser('%s')� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistUser� s
z(FirewallDConfig.addLockdownWhitelistUserc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | �
|� d S )Nz1config.policies.removeLockdownWhitelistUser('%s')r r� r rW rW rX �removeLockdownWhitelistUser� s
z+FirewallDConfig.removeLockdownWhitelistUserc C s$ t |�}t�d|� || �� d v S )Nz0config.policies.queryLockdownWhitelistUser('%s')r r� )rQ r� r� rW rW rX �queryLockdownWhitelistUser� s z*FirewallDConfig.queryLockdownWhitelistUserc C s t �d� | �� d S )Nz+config.policies.getLockdownWhitelistUsers()r r� r� rW rW rX �getLockdownWhitelistUsers� s
z)FirewallDConfig.getLockdownWhitelistUsers�ic C s^ t |�}t�d|� | �|� t| �� �}||d v rBttj|��|d � |� | �
|� d S )Nz+config.policies.addLockdownWhitelistUid(%d)� r� �rQ r� r� r� rW rW rX �addLockdownWhitelistUid� s
z'FirewallDConfig.addLockdownWhitelistUidc C s^ t |�}t�d|� | �|� t| �� �}||d vrBttj|��|d � |� | �
|� d S )Nz.config.policies.removeLockdownWhitelistUid(%d)r r� r rW rW rX �removeLockdownWhitelistUid� s
z*FirewallDConfig.removeLockdownWhitelistUidc C s$ t |�}t�d|� || �� d v S )Nz-config.policies.queryLockdownWhitelistUid(%d)r r� )rQ r� r� rW rW rX �queryLockdownWhitelistUid� s z)FirewallDConfig.queryLockdownWhitelistUidZaic C s t �d� | �� d S )Nz*config.policies.getLockdownWhitelistUids()r r� r� rW rW rX �getLockdownWhitelistUids� s
z(FirewallDConfig.getLockdownWhitelistUidsZaoc C s t �d� | jS )z"list ipsets objects paths
zconfig.listIPSets())r r� rZ r� rW rW rX �
listIPSets s
zFirewallDConfig.listIPSetsc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget ipset names
zconfig.getIPSetNames())r r� rZ r� r� r� rI )rQ r� rZ r� rW rW rX �
getIPSetNames s
z FirewallDConfig.getIPSetNames�oc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z-object path of ipset with given name
zconfig.getIPSetByName('%s')N)
r r� r r� rZ r� r� r! r Z
INVALID_IPSET)rQ rl r� r� rW rW rX �getIPSetByName s
z FirewallDConfig.getIPSetByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z/add ipset with given name and settings
zconfig.addIPSet('%s'))r r� r r� r� r Z new_ipsetrf )rQ rl r� r� r� r� rW rW rX �addIPSet# s
zFirewallDConfig.addIPSetc C s t |t�}t�d| � d S )Nzconfig.IPSetAdded('%s')r� )rQ rl rW rW rX r� 2 s
zFirewallDConfig.IPSetAddedc C s t �d� | jS )z%list icmptypes objects paths
zconfig.listIcmpTypes())r r� r\ r� rW rW rX �
listIcmpTypes: s
z FirewallDConfig.listIcmpTypesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget icmptype names
zconfig.getIcmpTypeNames())r r� r\ r� r� r� rI )rQ r� r\ r� rW rW rX �getIcmpTypeNamesB s
z FirewallDConfig.getIcmpTypeNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z0object path of icmptype with given name
z config.getIcmpTypeByName('%s')N)
r r� r r� r\ r� r� r! r ZINVALID_ICMPTYPE)rQ rm r� r� rW rW rX �getIcmpTypeByNameM s
z!FirewallDConfig.getIcmpTypeByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z2add icmptype with given name and settings
zconfig.addIcmpType('%s'))r r� r r� r� r Z new_icmptyperg )rQ rm r� r� r� r� rW rW rX � addIcmpTypeZ s
zFirewallDConfig.addIcmpTypec C s t �d| � d S )Nzconfig.IcmpTypeAdded('%s')r� )rQ rm rW rW rX r� i s z FirewallDConfig.IcmpTypeAddedc C s t �d� | jS )z$list services objects paths
zconfig.listServices())r r� r^ r� rW rW rX � listServicesp s
z FirewallDConfig.listServicesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget service names
zconfig.getServiceNames())r r� r^ r� r� r� rI )rQ r� r^ r� rW rW rX �getServiceNamesx s
z FirewallDConfig.getServiceNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z/object path of service with given name
z config.getServiceByName('%s')N)
r r� r r� r^ r� r� r! r ZINVALID_SERVICE)rQ rn r� r� rW rW rX �getServiceByName� s
z FirewallDConfig.getServiceByNamezs(sssa(ss)asa{ss}asa(ss))c C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )�1add service with given name and settings
zconfig.addService('%s'))r r� r r� r� r Z new_servicerh �rQ rn r� r� r� r� rW rW rX �
addService� s
zFirewallDConfig.addServicezsa{sv}c C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )r zconfig.addService2('%s'))r r� r r� r� r Znew_service_dictrh r rW rW rX � addService2� s
zFirewallDConfig.addService2c C s t �d| � d S )Nzconfig.ServiceAdded('%s')r� )rQ rn rW rW rX r� � s z FirewallDConfig.ServiceAddedc C s t �d� | jS )z!list zones objects paths
zconfig.listZones())r r� r` r� rW rW rX � listZones� s
zFirewallDConfig.listZonesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget zone names
zconfig.getZoneNames())r r� r` r� r� r� rI )rQ r� r` r� rW rW rX � getZoneNames� s
z FirewallDConfig.getZoneNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z,object path of zone with given name
zconfig.getZoneByName('%s')N)
r r� r r� r` r� r� r! r Z INVALID_ZONE)rQ ro r� r� rW rW rX �
getZoneByName� s
z FirewallDConfig.getZoneByNamec C sv t |t�}t�d|� g }| jD ] }||jjv r |�|jj� q t |�dkrfd�
|�d|t |�f S |rr|d S dS )z4name of zone the given interface belongs to
z config.getZoneOfInterface('%s')r# � zE (ERROR: interface '%s' is in %s zone XML files, can be only in one)r r} ) r r� r r� r` r� Z
interfacesr� r� ru �join)rQ Zifacer� r� r� rW rW rX �getZoneOfInterface� s
��z"FirewallDConfig.getZoneOfInterfacec C sv t |t�}t�d|� g }| jD ] }||jjv r |�|jj� q t |�dkrfd�
|�d|t |�f S |rr|d S dS )z1name of zone the given source belongs to
z config.getZoneOfSource('%s')r# r! zB (ERROR: source '%s' is in %s zone XML files, can be only in one)r r} ) r r� r r� r` r� Zsourcesr� r� ru r" )rQ �sourcer� r� r� rW rW rX �getZoneOfSource� s
��z FirewallDConfig.getZoneOfSourcez's(sssbsasa(ss)asba(ssss)asasasasa(ss)b)c C sh t |t�}t |�}t�d|� | �|� |d dkrLt|�}t|d< t|�}| j� ||�}| �
|�}|S )�.add zone with given name and settings
�config.addZone('%s')� �default) r r� r r� r� r� r �tupler Znew_zoneri )rQ ro r� r� Z _settingsr� r� rW rW rX �addZone� s
zFirewallDConfig.addZonec C s` t |t�}t |�}t�d|� | �|� d|v rD|d dkrDt|d< | j�||�}| �|�}|S )r& r' �targetr) ) r r� r r� r� r r Z
new_zone_dictri )rQ ro r� r� r� r� rW rW rX �addZone2 s
zFirewallDConfig.addZone2c C s t �d| � d S )Nzconfig.ZoneAdded('%s')r� )rQ ro rW rW rX r� " s zFirewallDConfig.ZoneAddedc C s t �d� | jS )z$list policies objects paths
zconfig.listPolicies())r r� rd r� rW rW rX � listPolicies) s
z FirewallDConfig.listPoliciesc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget policy names
zconfig.getPolicyNames())r r� rd r� r� r� rI )rQ r� Zpoliciesr� rW rW rX �getPolicyNames1 s
z FirewallDConfig.getPolicyNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z.object path of policy with given name
z config.getPolicyByName('%s')N)
r r� r r� rd r� r� r! r ZINVALID_POLICY)rQ rq r� r� rW rW rX �getPolicyByName< s
z FirewallDConfig.getPolicyByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z0add policy with given name and settings
zconfig.addPolicy('%s'))r r� r r� r� r Znew_policy_object_dictrk )rQ rq r� r� r� r� rW rW rX � addPolicyI s
zFirewallDConfig.addPolicyc C s t �d| � d S )Nzconfig.PolicyAdded('%s')r� )rQ rq rW rW rX r� X s zFirewallDConfig.PolicyAddedc C s t �d� | jS )z#list helpers objects paths
zconfig.listHelpers())r r� rb r� rW rW rX � listHelpersa s
zFirewallDConfig.listHelpersc C s0 t �d� g }| jD ]}|�|jj� qt|�S )zget helper names
zconfig.getHelperNames())r r� rb r� r� r� rI )rQ r� rb r� rW rW rX �getHelperNamesi s
z FirewallDConfig.getHelperNamesc C sF t |t�}t�d|� | jD ]}|jj|kr | S q ttj |��dS )z.object path of helper with given name
z config.getHelperByName('%s')N)
r r� r r� rb r� r� r! r ZINVALID_HELPER)rQ rp r� r� rW rW rX �getHelperByNamet s
z FirewallDConfig.getHelperByNamec C sD t |t�}t |�}t�d|� | �|� | j�||�}| �|�}|S )z0add helper with given name and settings
zconfig.addHelper('%s'))r r� r r� r� r Z
new_helperrj )rQ rp r� r� r� r� rW rW rX � addHelper� s
zFirewallDConfig.addHelperc C s t |t�}t�d| � d S )Nzconfig.HelperAdded('%s')r� )rQ rp rW rW rX r� � s
zFirewallDConfig.HelperAddedc C s t �d� | j�� �� S )Nzconfig.direct.getSettings())r r� r �
get_directr� r� rW rW rX r� � s
zFirewallDConfig.getSettingsc C s> t �d� t|�}| j�� �|i � | j�� �� | �� d S )Nzconfig.direct.update())r r� r r r6 r� r� r� r� rW rW rX r| � s
zFirewallDConfig.updatec C s t �d� d S )Nzconfig.direct.Updated()r� rs rW rW rX r� � s zFirewallDConfig.UpdatedZsssc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d v rrttj d|||f ��|d �
|� | � |� d S )Nz(config.direct.addChain('%s', '%s', '%s')r z chain '%s' already is in '%s:%s') r r r� r� r* r� r� r! r r� r� r| �rQ �ipv�table�chainr� �idxr� rW rW rX �addChain� s" �
��zFirewallDConfig.addChainc C s� t |�}t |�}t |�}t�d|||f � | �|� t|||f�}t| �� �}||d vrrttj d|||f ��|d �
|� | � |� d S )Nz+config.direct.removeChain('%s', '%s', '%s')r z chain '%s' is not in '%s:%s') r r r� r� r* r� r� r! r r� r{ r| r7 rW rW rX � removeChain� s" �
��zFirewallDConfig.removeChainc C sJ t |�}t |�}t |�}t�d|||f � t|||f�}|| �� d v S )Nz*config.direct.queryChain('%s', '%s', '%s')r )r r r� r* r� )rQ r8 r9 r: r� r; rW rW rX �
queryChain� s �zFirewallDConfig.queryChainc C sb t |�}t |�}t�d||f � g }| �� d D ]*}|d |kr2|d |kr2|�|d � q2|S )Nz#config.direct.getChains('%s', '%s')r r# r �r r r� r� r� )rQ r8 r9 r� r� r; rW rW rX � getChains� s zFirewallDConfig.getChainsr} za(sss)c C s t �d� | �� d S )Nz config.direct.getAllChains()r �r r� r� r� rW rW rX � getAllChains� s
z FirewallDConfig.getAllChainsZsssiasc
C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d v r�ttj d||||f ��|d �
|� | � t |�� d S )Nz1config.direct.addRule('%s', '%s', '%s', %d, '%s')�','r# z"rule '%s' already is in '%s:%s:%s')
r r r� r" r� r� r� r! r r� r� r| r* � rQ r8 r9 r: �priorityrR r� r; r� rW rW rX �addRule s& �
��zFirewallDConfig.addRulec
C s� t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � | �|� |||||f}t| �� �}||d vr�ttj d||||f ��|d �
|� | � t |�� d S )Nz4config.direct.removeRule('%s', '%s', '%s', %d, '%s')rC r# z rule '%s' is not in '%s:%s:%s')
r r r� r" r� r� r� r! r r� r{ r| r* rD rW rW rX �
removeRule s& �
��zFirewallDConfig.removeRulec
C sd t |�}t |�}t |�}t |�}t |�}t�d||||d�|�f � |||||f}|| �� d v S )Nz3config.direct.queryRule('%s', '%s', '%s', %d, '%s')rC r# �r r r� r" r� )rQ r8 r9 r: rE rR r� r; rW rW rX � queryRule/ s �zFirewallDConfig.queryRulec C s� t |�}t |�}t |�}t�d|||f � | �|� t| �� �}|d d d � D ]2}|||f|d |d |d fkrR|d �|� qR| �t|�� d S )Nz+config.direct.removeRules('%s', '%s', '%s')r# r r ) r r r� r� r� r� r{ r| r* )rQ r8 r9 r: r� r� ZrulerW rW rX � removeRules> s �
zFirewallDConfig.removeRulesza(ias)c C s� t |�}t |�}t |�}t�d|||f � g }| �� d D ]>}|d |kr<|d |kr<|d |kr<|�|d |d f� q<|S )Nz(config.direct.getRules('%s', '%s', '%s')r# r r r r( r? )rQ r8 r9 r: r� r� r; rW rW rX �getRulesO s �$zFirewallDConfig.getRulesz a(sssias)c C s t �d� | �� d S )Nzconfig.direct.getAllRules()r# rA r� rW rW rX � getAllRules_ s
zFirewallDConfig.getAllRulesZsasc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d v rfttj d||f ��|d �
|� | � |� d S )Nz(config.direct.addPassthrough('%s', '%s')rC r �passthrough '%s', '%s') r r r� r" r� r� r� r! r r� r� r| �rQ r8 rR r� r; r� rW rW rX �addPassthroughi s �
�z FirewallDConfig.addPassthroughc C s� t |�}t |�}t�d|d�|�f � | �|� ||f}t| �� �}||d vrfttj d||f ��|d �
|� | � |� d S )Nz+config.direct.removePassthrough('%s', '%s')rC r rM ) r r r� r" r� r� r� r! r r� r{ r| rN rW rW rX �removePassthrough| s �
�z!FirewallDConfig.removePassthroughc C s@ t |�}t |�}t�d|d�|�f � ||f}|| �� d v S )Nz*config.direct.queryPassthrough('%s', '%s')rC r rH )rQ r8 rR r� r; rW rW rX �queryPassthrough� s �z FirewallDConfig.queryPassthroughZaasc C sJ t |�}t�d| � g }| �� d D ] }|d |kr&|�|d � q&|S )Nz#config.direct.getPassthroughs('%s')r r r# r? )rQ r8 r� r� r; rW rW rX �getPassthroughs� s z FirewallDConfig.getPassthroughsza(sas)c C s t �d� | �� d S )Nz"config.direct.getAllPassthroughs()r rA r� rW rW rX �getAllPassthroughs� s
z"FirewallDConfig.getAllPassthroughs)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)N)��__name__�
__module__� __qualname__�__doc__Z
persistentr rO ZPK_ACTION_CONFIGZ default_polkit_auth_requiredr r4 r7 rt ry r8 rg r� r� rh r� r� ri r� r� rk r� r� rf r� r� rj r� r� r r� r� r� r ZPROPERTIES_IFACEr� r r r� rn �signalr� ZPK_ACTION_INFOZINTROSPECTABLE_IFACEr� r� r ZDBUS_SIGNATUREr� r� r� r� r� r� r� r� r� r� r r r r r r
r r r
rP r r r r r r� r r r r r r� r r r r r r� r r r r# r% r+ r- r� r. r/ r0 r1 r� r2 r3 r4 r r5 r� r
r� r r� r| r r� r< r= r> r@ rB rF rG rI rJ rK rL rO rP rQ rR rS �
__classcell__rW rW rU rX r" < sN 0
L
$��
C
�� �
� ���
� ���
�
���
�
��
�
�
�
�
�
� �
�
�
���
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�r" )7rG rO Z dbus.serviceZfirewallr Zfirewall.core.baser Zfirewall.core.watcherr Zfirewall.core.loggerr Zfirewall.server.dbusr Zfirewall.server.decoratorsr r r r
r r Z firewall.server.config_icmptyper
Z firewall.server.config_servicer Zfirewall.server.config_zoner Z firewall.server.config_policyr Z firewall.server.config_ipsetr Z firewall.server.config_helperr Zfirewall.core.io.icmptyper Zfirewall.core.io.ipsetr Zfirewall.core.io.helperr Z#firewall.core.io.lockdown_whitelistr Zfirewall.core.io.directr Zfirewall.dbus_utilsr r r r r r r r r Zfirewall.errorsr! r" rW rW rW rX �<module> s. (