????
Your IP : 216.73.216.152
�
`q^c % @ st d d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ g% Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d& l Z d% d' l m
Z
d% d( l m Z d% d) l
m Z m Z m Z e j d* k Z d+ � Z d, � Z d- d. � Z d/ � Z d0 � Z d1 � Z d2 � Z d3 � Z d4 � Z d5 � Z d6 � Z d7 � Z d8 � Z d9 � Z d: � Z! d; � Z" d< � Z# d= � Z$ d> � Z% d? � Z& d@ � Z' dA � Z( dB � Z) dC � Z* dD � Z+ dE � Z, dF � Z- dG � Z. dH � Z/ dI � Z0 dJ � Z1 dK � Z2 dL � Z3 dM � Z4 dN � Z5 dO � Z6 dP � Z7 d& S(Q t PY2t getPortIDt getPortRanget portStrt getServiceNamet checkIPt checkIP6t checkIPnMaskt
checkIP6nMaskt
checkProtocolt checkInterfacet checkUINT32t firewalld_is_activet tempFilet readfilet writefilet enable_ip_forwardingt get_nf_conntrack_helper_settingt set_nf_conntrack_helper_settingt get_nf_conntrack_helperst get_nf_nat_helperst
check_portt
check_addresst check_single_addresst check_mact uniqifyt ppid_of_pidt max_zone_name_lent checkUsert checkUidt checkCommandt checkContextt joinArgst splitArgst b2ut u2bt
u2b_if_py2i����N( t log( t runProg( t FIREWALLD_TEMPDIRt FIREWALLD_PIDFILEt COMMANDSt 3c C s� t | t � r | } nd | r- | j � } n y t | � } Wn< t k
r{ y t j | � } Wq| t j k
rw d SXn X| d k r� d S| S( s� Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
i����i�� i����( t
isinstancet intt stript
ValueErrort sockett
getservbynamet error( t portt _id( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR 0 s
c C s> t | t � s | j � r> t | � } | d k r: | f S| S| j d � } t | � d k r� | d j � r� | d j � r� t | d � } t | d � } | d k r� | d k r� | | k r� | | f S| | k r� | | f S| f Sq� n g } xt t | � d d � D]� } t d j | | � � } d j | | � } t | � d k r�t | � } | d k r| d k r| | k r�| j | | f � q�| | k r�| j | | f � q�| j | f � qq| d k r| j | f � | t | � k rPqqqWt | � d k r d St | � d k r6d S| d S( sI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
i t -i i i����N(
R+ R, t isdigitR t splitt lent ranget joint appendt None( t portst id1t splitst id2t matchedt it port2( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR G sH 2
t :c C sr | d k r d St | � } t | t � r; | d k r; d St | � d k rU d | Sd | d | | d f Sd S( s Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
t i i s %ss %s%s%sN( R R+ R, R; R7 ( R2 t delimitert _range( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR } s c C s� t | � } t | � } t | � d k r> | t | d � k St | � d k r� | t | d � k r� | t | d � k r� t St S( Ni i i ( R R R7 t Truet False( R2 R8 t _portRF ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt portInPortRange� s ,c C s8 y t j t | � | � } Wn t j k
r3 d SX| S( s� Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N( R/ t
getservbyportR, R1 R; ( R2 t protot name( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s3 y t j t j | � Wn t j k
r. t SXt S( sl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
( R/ t inet_ptont AF_INETR1 RH RG ( t ip( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s3 y t j t j | � Wn t j k
r. t SXt S( sl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
( R/ RN t AF_INET6R1 RH RG ( RP ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s� d | k ra | | j d � } | | j d � d } t | � d k sZ t | � d k rm t Sn | } d } t | � s} t S| r� d | k r� t | � Sy t | � } Wn t k
r� t SX| d k s� | d k r� t Sn t S( Nt /i t .i i ( t indexR7 RH R; R R, R. RG ( RP t addrt maskRA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s& $
c C s� d | k ra | | j d � } | | j d � d } t | � d k sZ t | � d k rm t Sn | } d } t | � s} t S| r� y t | � } Wn t k
r� t SX| d k s� | d k r� t Sn t S( NRR i i i� ( RT R7 RH R; R R, R. RG ( RP RU RV RA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s" $
c C sm y t | � } Wn: t k
rL y t j | � Wqi t j k
rH t SXn X| d k se | d k ri t St S( Ni i� ( R, R. R/ t getprotobynameR1 RH RG ( t protocolRA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sN | s t | � d k r t Sx* d d d d g D] } | | k r0 t Sq0 Wt S( s� Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
i t RR t !t *( R7 RH RG ( t ifacet ch( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
� s c C sH y t | d � } Wn t k
r' t SX| d k rD | d k rD t St S( Ni l �� ( R, R. RH RG ( t valt x( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s
c C s� t j j t � s t Sy( t t d � � } | j � } Wd QXWn t k
rR t SXt j j d | � sm t Sy, t d | d � � } | j � } Wd QXWn t k
r� t SXd | k r� t St S( sv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
t rNs /proc/%ss /proc/%s/cmdlinet firewalld( t ost patht existsR( RH t opent readlinet ExceptionRG ( t fdt pidt cmdline( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s"
c C sy yK t j j t � s( t j t d � n t j d d d d d t d t � SWn' t k
rt } t j
d | � � n Xd S( Ni� t modet wtt prefixs temp.t dirt deletes# Failed to create temporary file: %s( Rb Rc Rd R' t mkdirt tempfilet NamedTemporaryFileRH Rg R% R1 R; ( t msg( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR
8 s c C sW y& t | d � � } | j � SWd QXWn* t k
rR } t j d | | f � n Xd S( NR` s Failed to read file "%s": %s( Re t readlinesRg R% R1 R; ( t filenamet ft e( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR D s c C s[ y) t | d � � } | j | � Wd QXWn+ t k
rV } t j d | | f � t SXt S( Nt ws Failed to write to file "%s": %s( Re t writeRg R% R1 RH RG ( Ru t lineRv Rw ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR L s c C s6 | d k r t d d � S| d k r2 t d d � St S( Nt ipv4s /proc/sys/net/ipv4/ip_forwards 1
t ipv6s& /proc/sys/net/ipv6/conf/all/forwarding( R RH ( t ipv( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR U s
c C s� t j � d } d | } i } t j j | � r�xot t j | � � D]U} | j d � sc qH n | j d � d } t t d | g � \ } } | d k r� qH n | j d � r| j d � d j
� } | j d d � } | j d
d � } | j | g � j
| � qH n x� | j d � D]z } | j d
� r d | k r | j d � d j
� } | j d d � } | j d d � } | j | g � j
| � q q WqH Wn | S( Ni s% /lib/modules/%s/kernel/net/netfilter/t
nf_conntrack_RS i t modinfot nf_conntrack_proto_t _R4 s
nf-conntrack-RD s
s alias:s -helper-RC i s nfct-helper-( Rb t unameRc t isdirt sortedt listdirt
startswithR6 R& R) R- t replacet
setdefaultR: ( t kverRc t helpersRu t modulet statust rett helperRz ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR \ s0
'c C s� t j � d } i } x�d | d | d | g D]q} t j j | � r2 xVt t j | � � D]<} | j d � s{ q` n | j d � d } t t d | g � \ } } | d k r� q` n | j d � r'| j d � d j
� } | j d
d � } | j d d
� } | j | g � j
| � q` n xr | j d � D]a } | j d � r7d | k r7| j d d
� } | j d
d � } | j | g � j
| � q7q7Wq` Wq2 q2 W| S( Ni s% /lib/modules/%s/kernel/net/netfilter/s* /lib/modules/%s/kernel/net/ipv4/netfilter/s* /lib/modules/%s/kernel/net/ipv6/netfilter/t nf_nat_RS i R t
nf_nat_proto_R� R4 s nf-nat-RD s
s description:s
NAT helper( Rb R� Rc R� R� R� R� R6 R& R) R- R� R� R: ( R� R� Rc Ru R� R� R� R� Rz ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR z s2
+c C s> y t t d � d � SWn t k
r9 t j d � d SXd S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helperi s3 Failed to get and parse nf_conntrack_helper setting( R, R Rg R% t warning( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s t d | r d n d � S( Ns+ /proc/sys/net/netfilter/nf_conntrack_helpers 1
s 0
( R ( t flag( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s c C s� t | � } | d k sV | d k sV | d k sV t | � d k r� | d | d k r� | d k rv t j d | � nz | d k r� t j d | � nZ | d k r� t j d | � n: t | � d k r� | d | d k r� t j d | � n t St S(
Ni����i����i i i s '%s': port > 65535s '%s': port is invalids '%s': port is ambiguouss '%s': range start >= end( R R; R7 R% t debug2RH RG ( R2 RF ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s $& &c C s4 | d k r t | � S| d k r, t | � St Sd S( NR{ R| ( R R RH ( R} t source( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s4 | d k r t | � S| d k r, t | � St Sd S( NR{ R| ( R R RH ( R} R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sg t | � d k rc x" d D] } | | d k r t Sq Wx% d D] } | | t j k r> t Sq> Wt St S( Ni i i i i i RC i i i i i i i i
i
i i i ( i i i i i ( i i i i i i i i
i i
i i ( R7 RH t stringt hexdigitsRG ( t macRA ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s7 g } x* | D]" } | | k r
| j | � q
q
W| S( N( R: ( t _listt outputR_ ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sV y= t j d | � } t | j � d j � � } | j � Wn t k
rQ d SX| S( s Get parent for pid s ps -o ppid -h -p %d 2>/dev/nulli N( Rb t popenR, Rt R- t closeRg R; ( Ri Rv ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C s= d d l m } t t t | j � � � } d | t d � S( s�
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
i����( t SHORTCUTSi t __allow( t firewall.core.baseR� t maxt mapR7 t values( R� t longest_shortcut( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s c C st t | � d k s- t | � t j d � k r1 t Sx< | D]4 } | t j k r8 | t j k r8 | d k r8 t Sq8 Wt S( Ni t SC_LOGIN_NAME_MAXRS R4 R� t $( RS R4 R� R� ( R7 Rb t sysconfRH R� t
ascii_letterst digitsRG ( t usert c( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s -
c C sW t | t � r7 y t | � } Wq7 t k
r3 t SXn | d k rS | d k rS t St S( Ni i i i l l �� ( R+ t strR, R. RH RG ( t uid( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s
c C sj t | � d k s$ t | � d k r( t Sx' d d d g D] } | | k r8 t Sq8 W| d d k rf t St S( Ni i t |s
t i RR ( R7 RH RG ( t commandR] ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR � s $ c C s� | j d � } t | � d
k r% t S| d d k rM | d d d k rM t S| d d d k re t S| d
d d k r} t St | d � d k r� t St S( NRC i i i t rooti����t _ui t _ri t _ti ( i i ( R6 R7 RH RG ( t contextR> ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s $c C sD d t t � k r) d j d � | D� � Sd j d � | D� � Sd S( Nt quoteRY c s s | ] } t j | � Vq d S( N( t shlexR� ( t .0t a( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr> s c s s | ] } t j | � Vq d S( N( t pipesR� ( R� R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pys <genexpr> s ( Rn R� R9 ( t args( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR s c C sN t r= t | t � r= t | � } t j | � } t t | � St j | � Sd S( N( R R+ t unicodeR# R� R6 R� R" ( t _stringR> ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR! ! s
c C s# t | t � r | j d d � S| S( s bytes to unicode s UTF-8R� ( R+ t bytest decode( R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR" * s c C s# t | t � s | j d d � S| S( s unicode to bytes s UTF-8R� ( R+ R� t encode( R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR# 0 s c C s) t r% t | t � r% | j d d � S| S( s" unicode to bytes only if Python 2s UTF-8R� ( R R+ R� R� ( R� ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyR$ 6 s (8 t __all__R/ Rb t os.pathR� R� R� t sysRq t firewall.core.loggerR% t firewall.core.progR& t firewall.configR' R( R) t versionR R R R RJ R R R R R R R
R R R
R R R R R R R R R R R R R R R R R R R R! R" R# R$ ( ( ( s6 /usr/lib/python2.7/site-packages/firewall/functions.pyt <module> sv 6