ÿØÿà JFIF      ÿÛ „ 	 ( %!1!%)+//.383,7(-.+



-%%-////---/-.+/--+------/------/--0+--/-/-----.-----ÿÀ  ¥2" ÿÄ               ÿÄ J  	     ! 1AQ"aq2‘#BR‚¡ÁÑ3br’¢±Âð$CSƒ²á4c“%DsÓñÿÄ              ÿÄ *        !1AQa‘"2q3±ð#b¡ÿÚ   ? ¼QxJQaÍuò¸Zö Úü8,ÐÚú
"SSn<rçù–´âE—^ªBÖ9À\†¸ÔÁT­ÃÛ5
ëd´³Í#Ý;Þ38œî ¶H£M:wÎ3…³…âpÔF&‚FK¸9„â4àGEõªfÿ ‘ñ(ßw­pŽF|È¥ù®häðÍÑ¶¹‘[ÒinÙW¶ùñY˜Q{›K"išÒ[Ú8žë\F¹@-?v"ÔU”,ìöžkÿ {I‡£šÍ?e
ríV
..............................................................................................................................................................................
.............................................................................                                                  
                                                                                                                                                                                     ÿØÿà JFIF      ÿÛ „ 	 ( %!1!%)+//.383,7(-.+



-%%-////---/-.+/--+------/------/--0+--/-/-----.-----ÿÀ  ¥2" ÿÄ               ÿÄ J  	     ! 1AQ"aq2‘#BR‚¡ÁÑ3br’¢±Âð$CSƒ²á4c“%DsÓñÿÄ              ÿÄ *        !1AQa‘"2q3±ð#b¡ÿÚ   ? ¼QxJQaÍuò¸Zö Úü8,ÐÚú
"SSn<rçù–´âE—^ªBÖ9À\†¸ÔÁT­ÃÛ5
ëd´³Í#Ý;Þ38œî ¶H£M:wÎ3…³…âpÔF&‚FK¸9„â4àGEõªfÿ ‘ñ(ßw­pŽF|È¥ù®häðÍÑ¶¹‘[ÒinÙW¶ùñY˜Q{›K"išÒ[Ú8žë\F¹@-?v"ÔU”,ìöžkÿ {I‡£šÍ?e
ríV
..............................................................................................................................................................................
.............................................................................                                                  
                                                                                                                                                                                     3
Yj                 @   s  d gZ ddlZddlZddlZddlZddlZddlmZ ddlm	Z	 ddl
mZ ddl
mZ ddl
mZ ddl
mZ dd	l
mZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl m!Z! ddl"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z* ddl+m,Z, ddl-m.Z. ddl/m0Z0 ddl1m2Z2m3Z3 ddl4m5Z5 ddl6m7Z7 ddl8m9Z9 ddl:m;Z; ddlm<Z< dd l=m>Z> G d!d  d e?Z@dS )"Firewall    N)config)	functions)	ipXtables)ebtables)nftables)ipset)modules)FirewallIcmpType)FirewallService)FirewallZone)FirewallDirect)FirewallConfig)FirewallPolicies)FirewallIPSet)FirewallTransaction)FirewallHelper)FirewallPolicy)nm_get_bus_namenm_get_interfaces_in_zone)log)firewalld_conf)Direct)service_reader)icmptype_reader)zone_readerZone)ipset_reader)IPSET_TYPES)helper_reader)policy_reader)errors)FirewallErrorc               @   s  e Zd ZdeddZdd Zdd Zdd	 Zd
d ZdfddZdd Z	dgddZ
dd Zdd Zdd Zdd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zdhd)d*Zdid+d,Zd-d. Zdjd/d0Zdkd1d2Zdld3d4Zd5d6 Zd7d8 Zd9d: Zd;d< Zd=d> Z d?d@ Z!dAdB Z"dCdD Z#dEdF Z$dGdH Z%dIdJ Z&dKdL Z'dMdN Z(dmdOdPZ)dQdR Z*dSdT Z+dUdV Z,dWdX Z-dYdZ Z.d[d\ Z/d]d^ Z0d_d` Z1dadb Z2dcdd Z3d(S )nr   Fc             C   s  t tj| _|| _| jr>d| _d| _d| _d| _t	| _
d| _nrtj| | _d| _g | _tj| | _d| _g | _tj | _d| _tj | _d| _g | _
tj| | _d| _tj | _t| | _t| | _t| | _ t!| | _"t#| | _t$ | _%t&| | _t'| | _(t)| | _*| j+  d S )NFT),r   r   FIREWALLD_CONF_firewalld_conf_offlineip4tables_enabledip6tables_enabledebtables_enabledipset_enabledr   ipset_supported_typesnftables_enabledr   	ip4tablesip4tables_backendipv4_supported_icmp_types	ip6tablesip6tables_backendipv6_supported_icmp_typesr   ebtables_backendr   ipset_backendr   nftables_backendr	   modules_backendr
   icmptyper   servicer   zoner   directr   r   policiesr   r   helperr   policy_Firewall__init_vars)selfZoffline r?   /usr/lib/python3.6/fw.py__init__C   sB    










zFirewall.__init__c             C   sD   d| j | j| j| j| j| j| j| j| j| j	| j
| j| j| j| jf S )Nz:%s(%r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r, %r))	__class__r&   r'   r(   _state_panic_default_zone_module_refcount_markscleanup_on_exitcleanup_modules_on_exitipv6_rpfilter_enabledr)   _individual_calls_log_denied)r>   r?   r?   r@   __repr__k   s    zFirewall.__repr__c             C   sj   d| _ d| _d| _i | _g | _tj| _tj| _	tj
| _tj| _tj| _tj| _tj| _tj| _tj| _d S )NZINITF )rC   rD   rE   rF   rG   r   ZFALLBACK_CLEANUP_ON_EXITrH   Z FALLBACK_CLEANUP_MODULES_ON_EXITrI   ZFALLBACK_IPV6_RPFILTERrJ   ZFALLBACK_INDIVIDUAL_CALLSrK   ZFALLBACK_LOG_DENIEDrL   ZFALLBACK_FIREWALL_BACKEND_firewall_backendZFALLBACK_FLUSH_ALL_ON_RELOAD_flush_all_on_reloadZFALLBACK_RFC3964_IPV4_rfc3964_ipv4ZFALLBACK_ALLOW_ZONE_DRIFTING_allow_zone_drifting)r>   r?   r?   r@   Z__init_varst   s    zFirewall.__init_varsc             C   s   | j r$d| jj kr$tjd d| _ | jrHd| jj krHtjd d| _| jrld| jj krltjd d| _| j  r| j r| j	 rtj
d tjd d S )Nfilterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.   )r&   r-   get_available_tablesr   info1r'   r0   r(   r2   r+   fatalsysexit)r>   r?   r?   r@   _check_tables   s     



zFirewall._check_tablesc             C   sz  y| j j  W n* tk
r8   tjd d| _g | _Y nX | j j | _| jj	  | jj
s|| jjrltjd ntjd d| _| jr| jjd| _n| jr| jj | _ng | _| jj	  | jj
s| jjrtjd ntjd d| _| jr| jjd| _n| jr| jj | _ng | _| jj	  | jj
sN| jjr>tjd	 ntjd
 d| _| jrv| j rv| jj rvtjd d S )Nz4ipset not usable, disabling ipset usage in firewall.FzFiptables-restore is missing, using individual calls for IPv4 firewall.zCiptables-restore and iptables are missing, disabling IPv4 firewall.ipv4zGip6tables-restore is missing, using individual calls for IPv6 firewall.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.ipv6zHebtables-restore is missing, using individual calls for bridge firewall.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be used)r3   Zset_list
ValueErrorr   warningr)   r*   Zset_supported_typesr-   Zfill_existsrestore_command_existsZcommand_existsr&   r+   r4   Zsupported_icmp_typesr.   r0   r'   r1   r2   r(   rK   restore_noflush_optiondebug1)r>   r?   r?   r@   _start_check   sL    








zFirewall._start_checkc          >   C   s  t j}tjdt j y| jj  W n8 tk
rZ } ztj| tjd W Y d d }~X n"X | jj	drt| jj	d}| jj	dr| jj	d}|d k	r|j
 dBkrd| _tjd| j | jj	d	r| jj	d	}|d k	r|j
 dCkrd| _|d k	r|j
 dDkrd| _tjd| j | jj	drv| jj	d}|d k	rv|j
 dEkrvtjd y| jj  W n tk
rt   Y nX | jj	dr| jj	d}|d k	r|j
 dFkrd| _|j
 dGkrd| _| jrtjd n
tjd | jj	dr"| jj	d}|d k	r"|j
 dHkr"tjd d| _| jj	drt| jj	d}|d ksT|j
 dkr\d| _n|j
 | _tjd| j | jj	dr| jj	d| _tjd| j | jj	dr| jj	d}|j
 dIkrd| _nd| _tjd| j | jj	dr&| jj	d}|j
 dJkrd| _nd| _tjd| j | jj	dr|| jj	d}|j
 dKkrVd| _nd| _| jsntjd tjd | j | j jtj| j | j| j | js| j  tjd! y| jjj  W nZ tk
r  } z<| jj rtjd"| jjj | ntjd"| jjj | W Y d d }~X nX | j j!tj| j | j"t j#d# | j"t j$d# | j"t j%d$ | j"t j&d$ t'| j(j) d%krtjd& | j"t j*d' | j"t j+d' | j"t j,d( | j"t j-d( t'| j.j/ d%krtjd) | j"t j0d* | j"t j1d* t'| j2j3 d%kr&tj4d+ t5j6d, | j"t j7d- | j"t j8d- d}x.dLD ]&}|| j2j3 krLtj4d1| d}qLW |rt5j6d, || j2j3 krd2| j2j3 krd2}nd3| j2j3 krd3}nd.}tjd4|| |}ntjd5| t9t j:}	t;j<j=t j:rRtjd6t j:  y|	j  W n4 tk
rP } ztjd7t j:| W Y d d }~X nX | j>j?|	 | j j@tj|	 | jA|| _B| jrd S | jC  tjD d%krtEjE }
tF| }|s| jG|d8 |r|s| jHr| jIjJ r|jKd |jL  |r|rtjd9 | jMjN  | jO|d8 |jKd |jL  | jHrX| jIjJ rXtjd: | jIjP  tjd; | jQ|d8 tjd< | j2jR|d8 | j2jSd | jB|d8 tjd= | jTjU|d8 |jKd |jL  | j>jV rVtjd> | j>jW| y|jKd |jL  W nX tk
r> } z$t|jXd?|jYr&|jYnd@ W Y d d }~X n tk
rT    Y nX ~tjD d,krtEjE }tjZdA||
   d S )MNz"Loading firewalld config file '%s'z0Using fallback firewalld configuration settings.DefaultZoneZCleanupOnExitnofalseFzCleanupOnExit is set to '%s'ZCleanupModulesOnExityestrueTz#CleanupModulesOnExit is set to '%s'ZLockdownzLockdown is enabledZIPv6_rpfilterzIPv6 rpfilter is enabledzIPV6 rpfilter is disabledZIndividualCallszIndividualCalls is enabled	LogDeniedZoffzLogDenied is set to '%s'ZFirewallBackendzFirewallBackend is set to '%s'ZFlushAllOnReloadzFlushAllOnReload is set to '%s'ZRFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZAllowZoneDriftingzAllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. Please consider disabling it now.z AllowZoneDrifting is set to '%s'zLoading lockdown whitelistz*Failed to load lockdown whitelist '%s': %sr   r6   r   zNo icmptypes found.r;   r7   zNo services found.r8   zNo zones found.rT   r<   blockdroptrustedzZone '%s' is not available.ZpublicZexternalz+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'zLoading direct rules file '%s'z)Failed to load direct rules file '%s': %s)use_transactionzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying used zoneszApplying used policiesz2Applying direct chains rules and passthrough rulesz
Direct: %srN   z%Flushing and applying took %f seconds)rd   re   )rf   rg   )rd   re   )rf   rg   )rd   re   )rf   rg   )rf   rg   )rd   re   )rd   re   )rd   re   )ri   rj   rk   )[r   ZFALLBACK_ZONEr   ra   r#   r$   read	Exceptionr^   getlowerrH   rI   r:   Zenable_lockdownr"   rJ   rK   rL   rO   rP   rQ   rR   r%   Zset_firewalld_confcopydeepcopy_select_firewall_backendrb   Zlockdown_whitelistZquery_lockdownerrorfilenameZset_policies_loaderZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESlenr6   get_icmptypesZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr7   get_servicesZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr8   	get_zonesrW   rX   rY   ZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIESr   ZFIREWALLD_DIRECTospathexistsr9   Zset_permanent_configZ
set_direct
check_zonerE   rZ   ZgetDebugLogLeveltimer   flushr)   r   Z
has_ipsetsexecuteclearr5   unload_firewall_modulesapply_default_tablesZapply_ipsetsapply_default_rulesZapply_zoneschange_default_zoner<   Zapply_policiesZhas_configurationZapply_directcodemsgZdebug2)r>   reloadcomplete_reloadZdefault_zoner   valuert   zr8   objZtm1transactioneZtm2r?   r?   r@   _start   st   







 




















.zFirewall._startc             C   sH   y| j   W n& tk
r2   d| _| jd  Y nX d| _| jd d S )NFAILEDACCEPTRUNNING)r   rn   rC   
set_policy)r>   r?   r?   r@   start  s    
zFirewall.startc             C   sh  t jj|sd S |rZ|jtjrV|dkrVt }t jj||_|j	|j ||_d|_
nd}x|tt j|D ]h}|jds|jtjrl|dkrlt jjd||f rl| jd||f |dd qld||f }tjd|| y|dkrt||}|j| jj kr8| jj|j}tjd	||j|j|j | jj|j n|jjtjrNd|_
y| jj| W n< tk
r }	 ztjd
|jt|	f  W Y d d }	~	X nX | jjtj| n|dkrFt||}|j| jj kr| jj |j}tjd	||j|j|j | jj!|j n|jjtjr$d|_
| jj"| | jj"tj| n.|dkrnt#|||d}|rdt jj|t jj|dd f |_|j	|j tj|}
|j| j$j% kr| j$j&|j}| j$j'|j |j(rtjd||j|| |j)| ntjd	||j|j|j n|jjtjr,d|_
d|
_
| jj*|
 |r^tjd||j|| |j)| n| j$j*| n|dkrDt+||}|j| j,j- kr| j,j.|j}tjd	||j|j|j | j,j/|j n|jjtjrd|_
y| j,j0| W n< tk
r, }	 ztj1d
|jt|	f  W Y d d }	~	X nX | jj0tj| n0|dkrt2||}|j| j3j4 kr| j3j5|j}tjd	||j|j|j | j3j6|j n|jjtjrd|_
| j3j7| | jj7tj| n|dkrht8||}|j| j9j: kr2| j9j;|j}tjd	||j|j|j | j9j<|j n|jjtjrHd|_
| j9j=| | jj>tj| ntj?d| W ql tk
r } ztj@d||| W Y d d }~X ql tAk
r   tj@d|| tjB  Y qlX qlW |rd|j(rd|j| j$j% krX| j$j&|j}tjd||j|j|j y| j$j'|j W n tAk
rH   Y nX | jjC|j | j$j*| d S )Nr8   Fz.xmlz%s/%sT)combinezLoading %s file '%s'r6   z  Overloads %s '%s' ('%s/%s')z%s: %s, ignoring for run-time.r7   )Zno_check_namer      z  Combining %s '%s' ('%s/%s')r   r;   r<   zUnknown reader type %szFailed to load %s file '%s': %szFailed to load %s file '%s':z0  Overloading and deactivating %s '%s' ('%s/%s'))Dr{   r|   isdir
startswithr   ZETC_FIREWALLDr   basenamenameZ
check_namedefaultsortedlistdirendswithrv   r   ra   r   r6   rx   Zget_icmptyperu   Zremove_icmptypeZadd_icmptyper"   rV   strrq   rr   r   r7   ry   Zget_serviceZremove_serviceZadd_servicer   r8   rz   Zget_zoneZremove_zonecombinedr   Zadd_zoner   r   
get_ipsets	get_ipsetZremove_ipset	add_ipsetr^   r   r;   Zget_helpersZ
get_helperZremove_helperZ
add_helperr    r<   get_policiesZ
get_policyZremove_policyZ
add_policyZadd_policy_objectrW   rt   rn   Z	exceptionZforget_zone)r>   r|   Zreader_typer   Zcombined_zoneru   r   r   Zorig_objrt   Z
config_objr   r?   r?   r@   rv      s   


$







$




zFirewall._loaderc             C   sp   | j j  | jj  | jj  | jj  | jj  | jj  | jj  | jj  | j	j  | j
j  | j  d S )N)r6   cleanupr7   r8   r   r;   r   r9   r:   r<   r$   r=   )r>   r?   r?   r@   r     s    









zFirewall.cleanupc             C   sN   | j sB| jr(| j  | jj  | jd | jrBtjd | jj	  | j
  d S )Nr   z!Unloading firewall kernel modules)r%   rH   r   r   r   rI   r   ra   r5   r   r   )r>   r?   r?   r@   stop  s    



zFirewall.stopc       	      C   s   d}d}xt |D ]\}}|r0| jj|\}}n$| j| dkrDd}n| jj|\}}|dkrn|d7 }||7 }q|r| jj|d | j|  d7  < q|| jkr| j|  d8  < | j| dkr| j|= qW ||fS )Nr   rN   rT   )	enumerater5   load_modulerF   Zunload_module
setdefault)	r>   Z_modulesenableZ
num_failedZ
error_msgsimoduleZstatusr   r?   r?   r@   handle_modules  s(    
zFirewall.handle_modulesc             C   s   |dkrd| _ d S )Nr   F)r+   )r>   backendr?   r?   r@   rs     s    z!Firewall._select_firewall_backendc             C   s4   x| j  D ]}|j|kr
|S q
W ttjd| d S )Nz'%s' backend does not exist)all_backendsr   r"   r!   ZUNKNOWN_ERROR)r>   r   r   r?   r?   r@   get_backend_by_name  s
    
zFirewall.get_backend_by_namec             C   s\   | j r| jS |dkr | jr | jS |dkr4| jr4| jS |dkrH| jrH| jS tt	j
d| d S )Nr[   r\   ebz-'%s' is not a valid backend or is unavailable)r+   r4   r&   r-   r'   r0   r(   r2   r"   r!   INVALID_IPV)r>   ipvr?   r?   r@   get_backend_by_ipv  s    zFirewall.get_backend_by_ipvc             C   sP   |dkr| j r| jS |dkr(| jr(| jS |dkr<| jr<| jS ttjd| d S )Nr[   r\   r   z-'%s' is not a valid backend or is unavailable)	r&   r-   r'   r0   r(   r2   r"   r!   r   )r>   r   r?   r?   r@   get_direct_backend_by_ipv  s    z"Firewall.get_direct_backend_by_ipvc             C   s<   |dkr| j S |dkr| jS |dkr*| jS |dkr8| jS dS )Nr,   r/   r   r   F)r&   r'   r(   r+   )r>   r   r?   r?   r@   is_backend_enabled  s    zFirewall.is_backend_enabledc             C   s8   | j r
dS |dkr| jS |dkr&| jS |dkr4| jS dS )NTr[   r\   r   F)r+   r&   r'   r(   )r>   r   r?   r?   r@   is_ipv_enabled   s    zFirewall.is_ipv_enabledc             C   sR   g }| j r|j| j n6| jr*|j| j | jr<|j| j | jrN|j| j |S )N)	r+   appendr4   r&   r-   r'   r0   r(   r2   )r>   backendsr?   r?   r@   enabled_backends  s    zFirewall.enabled_backendsc             C   sP   g }| j r|j| j | jr(|j| j | jr:|j| j | jrL|j| j |S )N)	r&   r   r-   r'   r0   r(   r2   r+   r4   )r>   r   r?   r?   r@   r     s    zFirewall.all_backendsNc             C   sN   |d krt | }n|}x | j D ]}|j||j  q W |d krJ|jd d S )NT)r   r   	add_rulesZbuild_default_tablesr   )r>   rl   r   r   r?   r?   r@   r   $  s    
zFirewall.apply_default_tablesc             C   s   |d krt | }n|}x(| j D ]}|j| j}|j|| q W | jdr~| jd}d|j kr~| jr~|j	| j}|j|| | jdr| j
r|j }|j|| |d kr|jd d S )Nr\   rawT)r   r   Zbuild_default_rulesrL   r   r   r   rU   rJ   Zbuild_rpfilter_rulesrQ   Zbuild_rfc3964_ipv4_rulesr   )r>   rl   r   r   rulesZipv6_backendr?   r?   r@   r   0  s"    


zFirewall.apply_default_rulesc             C   s   | j r| jj  rdS dS )NTF)r+   r9   Zhas_runtime_configuration)r>   r?   r?   r@   may_skip_flush_direct_backendsH  s    z'Firewall.may_skip_flush_direct_backendsc             C   s`   |d krt | }n|}x2| j D ]&}|| j kr2q |j }|j|| q W |d kr\|jd d S )NT)r   r   r   build_flush_rulesr   r   )r>   rl   r   r   r   r?   r?   r@   flush_direct_backendsN  s    
zFirewall.flush_direct_backendsc             C   sp   |d krt | }n|}tjd | j s4| j|d x$| j D ]}|j }|j|| q>W |d krl|jd d S )NzFlushing rule set)rl   T)	r   r   ra   r   r   r   r   r   r   )r>   rl   r   r   r   r?   r?   r@   r   ]  s    

zFirewall.flushc             C   s`   |d krt | }n|}tjd| x&| j D ]}|j|}|j|| q,W |d kr\|jd d S )NzSetting policy to '%s'T)r   r   ra   r   Zbuild_set_policy_rulesr   r   )r>   r<   rl   r   r   r   r?   r?   r@   r   o  s    

zFirewall.set_policyc             C   sB   |sdS | j |}|s&ttjd| | j|s4dS |j|| jS )NrN   z'%s' is not a valid backend)r   r"   r!   r   r   set_rulerL   )r>   backend_nameruler   r?   r?   r@   r     s    


zFirewall.rulec             C   s"  t td |}| j|}|s,ttjd| | j|s:d S | js\|j s\|dkoX| j	j
 rxt|D ]\}}y|j|| j W qf tk
r } zjtjtj  tj| xFt|d | D ]2}y|j|j|| j W q tk
r   Y qX qW |W Y d d }~X qfX qfW n|j|| j d S )Nz'%s' is not a valid backendr   )listrS   r   r"   r!   r   r   rK   r_   r2   r`   r   r   rL   rn   r   ra   	traceback
format_excrt   reversedZreverse_ruleZ	set_rules)r>   r   r   Z_rulesr   r   r   r   r?   r?   r@   r     s.    




zFirewall.rulesc             C   s   | j rttjd S )N)rD   r"   r!   Z
PANIC_MODE)r>   r?   r?   r@   check_panic  s    zFirewall.check_panicc             C   s"   |}|| j j krttj||S )N)r<   r   r"   r!   ZINVALID_POLICY)r>   r<   Z_policyr?   r?   r@   check_policy  s    zFirewall.check_policyc             C   s8   |}| s|dkr| j  }|| jj kr4ttj||S )NrN   )get_default_zoner8   rz   r"   r!   ZINVALID_ZONE)r>   r8   _zoner?   r?   r@   r~     s    zFirewall.check_zonec             C   s   t j|sttj|d S )N)r   ZcheckInterfacer"   r!   ZINVALID_INTERFACE)r>   	interfacer?   r?   r@   check_interface  s    
zFirewall.check_interfacec             C   s   | j j| d S )N)r7   check_service)r>   r7   r?   r?   r@   r     s    zFirewall.check_servicec             C   s   t j|sttj|d S )N)r   
check_portr"   r!   ZINVALID_PORT)r>   Zportr?   r?   r@   r     s    
zFirewall.check_portc             C   s*   |st tj|dkr&t tjd| d S )Ntcpudpsctpdccpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'})r   r   r   r   )r"   r!   ZMISSING_PROTOCOLZINVALID_PROTOCOL)r>   Zprotocolr?   r?   r@   check_tcpudp  s    
zFirewall.check_tcpudpc             C   s   t j|sttj|d S )N)r   ZcheckIPr"   r!   INVALID_ADDR)r>   Zipr?   r?   r@   check_ip  s    
zFirewall.check_ipc             C   sP   |dkr t j|sLttj|n,|dkr@t j|sLttj|nttjdd S )Nr[   r\   z'%s' not in {'ipv4'|'ipv6'})r   ZcheckIPnMaskr"   r!   r   ZcheckIP6nMaskr   )r>   r   sourcer?   r?   r@   check_address  s    

zFirewall.check_addressc             C   s   | j j| d S )N)r6   check_icmptype)r>   Zicmpr?   r?   r@   r     s    zFirewall.check_icmptypec             C   s>   t |tstd|t|f t|dk r:ttjd| d S )Nz%s is %s, expected intr   z#timeout '%d' is not positive number)
isinstanceint	TypeErrortyper"   r!   INVALID_VALUE)r>   Ztimeoutr?   r?   r@   check_timeout  s
    
zFirewall.check_timeoutc              C   s`  | j }| j}|sNi }x&| jj D ]}| jj|d ||< q W | jj }| j }g }x$| jj	 D ]}	|j
| jj|	 q^W |s| jd | j  | j  d }
y| jd|d W n& tk
r } z
|}
W Y d d }~X nX |r(xL|D ]D}| jj|jsx0| jj D ]"}|jdkr q|j|j  qW qW |s| j }||kr||krRi ||< xFt|| j D ]2\}}|d rd|| | || |< || |= qdW xb| jj D ]T}||krx.|| D ]"}| jj|||| | d  qW ||= ntjd| qW t|d	kr6x(t|j D ]}tjd
| ||= qW ~x|D ]}| jj|jrxx|jD ]R}y| jj|j| W n6 tk
r } z|jt j!kr|W Y d d }~X nX qZW n| jj"| | jj#|j q>W | jj$| t% }|r,x@| jj dg D ],}x$t&|D ]}| jj|||d q
W qW || _ | j sD| jd |
rVd| _'|
nd| _'d S )N
interfacesZDROPT)r   r   r   __default__senderzNew zone '%s'.r   z(Lost zone '%s', zone interfaces dropped.rN   )r   r   r   r   )(rD   rP   r8   rz   get_settingsr9   Zget_runtime_configr   r   r   r   r   r   r   r   r   rn   Zquery_ipsetr   r   Zset_destroyr   itemschange_zone_of_interfacer   rV   rw   keysZentriesZ	add_entryr"   r   r!   ALREADY_ENABLEDr   Zapply_ipsetZ
set_configr   r   rC   )r>   r   rD   Z	flush_allZ_zone_interfacesr8   Z_direct_config_old_dzZ_ipset_objs_nameZstart_exceptionr   r   r   Z_new_dzifacesettingsZinterface_identryr   Znm_bus_namer   r?   r?   r@   r     s    









zFirewall.reloadc             C   s   | j S )N)rC   )r>   r?   r?   r@   	get_statea  s    zFirewall.get_statec             C   sZ   | j rttjdy| jd W n. tk
rN } zttj|W Y d d }~X nX d| _ d S )Nzpanic mode already enabledZPANICT)rD   r"   r!   r   r   rn   COMMAND_FAILED)r>   r   r?   r?   r@   enable_panic_modef  s    zFirewall.enable_panic_modec             C   sZ   | j sttjdy| jd W n. tk
rN } zttj|W Y d d }~X nX d| _ d S )Nzpanic mode is not enabledr   F)rD   r"   r!   ZNOT_ENABLEDr   rn   r   )r>   r   r?   r?   r@   disable_panic_modeq  s    zFirewall.disable_panic_modec             C   s   | j S )N)rD   )r>   r?   r?   r@   query_panic_mode|  s    zFirewall.query_panic_modec             C   s   | j S )N)rL   )r>   r?   r?   r@   get_log_denied  s    zFirewall.get_log_deniedc             C   sb   |t jkr&ttjd|djt jf || j krR|| _| jj	d| | jj
  nttj|d S )Nz'%s', choose from '%s'z','rh   )r   ZLOG_DENIED_VALUESr"   r!   r   joinr   rL   r$   setwriteZALREADY_SET)r>   r   r?   r?   r@   set_log_denied  s    
zFirewall.set_log_deniedc             C   s   | j S )N)rE   )r>   r?   r?   r@   r     s    zFirewall.get_default_zonec             C   s   | j |}|| jkr| j}|| _| jjd| | jj  | jj|| | jj|}x@t|d j	 D ]\}}|d rd| jj
d| qdW nttj|d S )Nrc   r   r   rN   )r~   rE   r$   r   r   r8   r   r   r   r   r   r"   r!   ZZONE_ALREADY_SET)r>   r8   r   r   Z_old_dz_settingsr   r   r?   r?   r@   set_default_zone  s    


zFirewall.set_default_zonec             C   sH   |j  }x:|j D ].\}}|s(t|tr2|||< q||kr||= qW |S )N)rq   r   r   bool)r>   Z	permanentZruntimer   keyr   r?   r?   r@   'combine_runtime_with_permanent_settings  s    

z0Firewall.combine_runtime_with_permanent_settingsc             C   s  i }i }xt |j t |j B D ]}||kr"t|| trt ||krN|| ng }tt || | ||< t|t || A |@ ||< q"t|| tst|| tr||  r|| rd||< q|| r||  rd||< q"ttjdj	t
|| |q"W ||fS )NTFz Unhandled setting type {} key {})r   r   r   r   r   r   r"   r!   ZINVALID_SETTINGformatr   )r>   Zold_settingsZnew_settingsZadd_settingsZremove_settingsr   oldr?   r?   r@   get_added_and_removed_settings  s    

 z'Firewall.get_added_and_removed_settings)F)FF)F)N)N)N)N)N)F)4__name__
__module____qualname__rA   rM   r=   rZ   rb   r   r   rv   r   r   r   rs   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r?   r?   r?   r@   r   B   sh   
(	;
   
 





 	
s)A__all__Zos.pathr{   rX   rq   r   r   Zfirewallr   r   Zfirewall.corer   r   r   r   r	   Zfirewall.core.fw_icmptyper
   Zfirewall.core.fw_servicer   Zfirewall.core.fw_zoner   Zfirewall.core.fw_directr   Zfirewall.core.fw_configr   Zfirewall.core.fw_policiesr   Zfirewall.core.fw_ipsetr   Zfirewall.core.fw_transactionr   Zfirewall.core.fw_helperr   Zfirewall.core.fw_policyr   Zfirewall.core.fw_nmr   r   Zfirewall.core.loggerr   Zfirewall.core.io.firewalld_confr   Zfirewall.core.io.directr   Zfirewall.core.io.servicer   Zfirewall.core.io.icmptyper   Zfirewall.core.io.zoner   r   Zfirewall.core.io.ipsetr   Zfirewall.core.ipsetr   Zfirewall.core.io.helperr   Zfirewall.core.io.policyr    r!   Zfirewall.errorsr"   objectr   r?   r?   r?   r@   <module>   sH   