File: //usr/lib/python3/dist-packages/firewall/__pycache__/functions.cpython-38.pyc
U
/ �^�8 � ! @ s� d ddddddddd d
d d d
ddddddddddddddd d d d d g!Z d!d"lZd!d"lZd!d"lZd!d"lZd!d"lZd!d"lZd!d"lZd!d"lZd!d#l m
Z
d!d$l m Z m
Z
ejd%k Zd&d� Zd'd� ZdMd)d�Zd*d+� Zd,d� Zd-d� Zd.d/� Zd0d� Zd1d� Zd2d� Zd3d � Zd4d
� Zd5d � Z d6d � Z d7d
� Z d8d� Z d9d� Z d:d� Z!d;d<� Z"d=d� Z#d>d� Z$d?d� Z%d@d� Z&dAd� Z'dBd� Z(dCd� Z)dDd� Z*dEd� Z+dFd� Z,dGd� Z-dHd � Z.dId � Z/dJd � Z0dKd � Z1dLd � Z2d"S )N�PY2� getPortID� getPortRange�portStr�getServiceName�checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
checkProtocol�checkInterface� checkUINT32�firewalld_is_active�tempFile�readfile� writefile�enable_ip_forwarding�
check_port�
check_address�check_single_address� check_mac�uniqify� ppid_of_pid�max_zone_name_len� checkUser�checkUid� checkCommand� checkContext�joinArgs� splitArgs�b2u�u2b�
u2b_if_py2� N)�log)�FIREWALLD_TEMPDIR�FIREWALLD_PIDFILE�3c C sx t | t�r| }nX| r | �� } z t| �}W n> tk
rf zt�| �}W n tjk
r` Y Y dS X Y nX |dkrtdS |S )z� Check and Get port id from port string or port id using socket.getservbyname
@param port port string or port id
@return Port id if valid, -1 if port can not be found and -2 if port is too big
���i�� ���)�
isinstance�int�strip�
ValueError�socketZ
getservbyname�error)�portZ_id� r0 �4/usr/lib/python3/dist-packages/firewall/functions.pyr - s
c C s� t | t�s| �� r,t| �}|dkr(|fS |S | �d�}t|�dkr�|d �� r�|d �� r�t|d �}t|d �}|dkr�|dkr�||k r�||fS ||kr�||fS |fS g }tt|�dd�D ]�}td�|d|� ��}d�||d� �}t|�dk�rTt|�}|dk�rz|dk�rz||k �r,|�||f� n&||k�rF|�||f� n |�|f� q�|dkr�|�|f� |t|�kr� �q|q�t|�dk �r�dS t|�dk�r�dS |d S )aI Get port range for port range string or single port id
@param ports an integer or port string or port range string
@return Array containing start and end port id for a valid range or -1 if port can not be found and -2 if port is too big for integer input or -1 for invalid ranges or None if the range is ambiguous.
r" �-� � r' N) r) r* �isdigitr �split�len�range�join�append)ZportsZid1�splitsZid2Zmatched�iZport2r0 r0 r1 r D sH
$
�:c C sX | dkr dS t | �}t|t�r*|dk r*dS t|�dkr>d| S d|d ||d f S dS )a Create port and port range string
@param port port or port range int or [int, int]
@param delimiter of the output string for port ranges, default ':'
@return Port or port range string, empty string if port isn't specified, None if port or port range is not valid
� r" Nr4 z%sz%s%s%s)r r) r* r7 )r/ Z delimiter�_ranger0 r0 r1 r z s c C s t | �}t |�}t|�dkr�t|�dkr@t|d �t|d �kS t|�dkr�t|d �t|d �kr�t|d �t|d �kr�dS n|t|�dkr�t|�dkr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�t|d �t|d �kr�dS dS )Nr4 r" r3 TF)r r7 r )r/ r8 Z_portr? r0 r0 r1 �portInPortRange� s. �� ����r@ c C s2 zt �t| �|�}W n t jk
r, Y dS X |S )z� Check and Get service name from port and proto string combination using socket.getservbyport
@param port string or id
@param protocol string
@return Service name if port and protocol are valid, else None
N)r- Z
getservbyportr* r. )r/ �proto�namer0 r0 r1 r � s
c C s0 zt �t j| � W n t jk
r* Y dS X dS )zl Check IPv4 address.
@param ip address string
@return True if address is valid, else False
FT)r- � inet_ptonZAF_INETr. ��ipr0 r0 r1 r � s
c C s
| � d�S )z� Normalize the IPv6 address
This is mostly about converting URL-like IPv6 address to normal ones.
e.g. [1234::4321] --> 1234:4321
z[])r+ rD r0 r0 r1 � normalizeIP6� s rF c C s4 zt �t jt| �� W n t jk
r. Y dS X dS )zl Check IPv6 address.
@param ip address string
@return True if address is valid, else False
FT)r- rC ZAF_INET6rF r. rD r0 r0 r1 r � s
c C s� d| krN| d | � d�� }| | � d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�d|krvt|�S z t|�}W n tk
r� Y dS X |dk s�|dkr�dS dS )N�/r4 F�.r" � T)�indexr7 r r* r, �rE Zaddr�maskr< r0 r0 r1 r � s& c C s� d| krN| d | � d�� }| | � d�d d � }t|�dk sHt|�dk rVdS n| }d }t|�sbdS |r�z t|�}W n tk
r� Y dS X |dk s�|dkr�dS dS )NrG r4 Fr" � T)rJ r7 r r* r, rK r0 r0 r1 r � s" c C sd z t | �}W n> tk
rJ zt�| � W n tjk
rD Y Y dS X Y nX |dk s\|dkr`dS dS )NFr" � T)r* r, r- Zgetprotobynamer. )Zprotocolr< r0 r0 r1 r
� s c C s0 | rt | �dkrdS dD ]}|| kr dS qdS )z� Check interface string
@param interface string
@return True if interface is valid (maximum 16 chars and does not contain ' ', '/', '!', ':', '*'), else False
� F)� rG �!�*T�r7 )Ziface�chr0 r0 r1 r s c C s> zt | d�}W n tk
r$ Y dS X |dkr:|dkr:dS dS )Nr" Fl �� T)r* r, )�val�xr0 r0 r1 r s c C s� t j�t�sdS z"ttd��} | �� }W 5 Q R X W n tk
rH Y dS X t j�d| �s^dS z&td| d��} | �� }W 5 Q R X W n tk
r� Y dS X d|kr�dS dS )zv Check if firewalld is active
@return True if there is a firewalld pid file and the pid is used by firewalld
F�rz/proc/%sz/proc/%s/cmdlineZ firewalldT)�os�path�existsr% �open�readline� Exception)�fd�pidZcmdliner0 r0 r1 r
& s" c
C sd z,t j�t�st �td� tjddtdd�W S tk
r^ } zt� d| � � W 5 d } ~ X Y nX d S )Ni� Zwtztemp.F)�mode�prefix�dir�deletez#Failed to create temporary file: %s)
rX rY rZ r$ �mkdir�tempfileZNamedTemporaryFiler] r# r. )�msgr0 r0 r1 r C s �c
C sf z,t | d��}|�� W 5 Q R � W S Q R X W n4 tk
r` } zt�d| |f � W 5 d }~X Y nX d S )NrW z Failed to read file "%s": %s)r[ � readlinesr] r# r. )�filename�f�er0 r0 r1 r O s $c
C sd z$t | d��}|�|� W 5 Q R X W n: tk
r^ } z t�d| |f � W Y �dS d }~X Y nX dS )N�wz Failed to write to file "%s": %sFT)r[ �writer] r# r. )rh �lineri rj r0 r0 r1 r W s c C s( | dkrt dd�S | dkr$t dd�S dS )N�ipv4z /proc/sys/net/ipv4/ip_forwardz1
�ipv6z&/proc/sys/net/ipv6/conf/all/forwardingF)r )�ipvr0 r0 r1 r ` s
c C s | � dd�� dd�S )N�_r2 z
nf-conntrack-r> )�replace)�moduler0 r0 r1 �get_nf_conntrack_short_nameg s rt c C s� t | �}|dks<|dks<|d ks<t|�dkr�|d |d kr�|dkrTt�d| � nZ|dkrlt�d| � nB|d kr�t�d| � n*t|�dkr�|d |d kr�t�d | � d
S d S ) Nr( r' r3 r" r4 z'%s': port > 65535z'%s': port is invalidz'%s': port is ambiguousz'%s': range start >= endFT)r r7 r# Zdebug2)r/ r? r0 r0 r1 r j s
�� c C s( | dkrt |�S | dkr t|�S dS d S �Nrn ro F)r r �rp �sourcer0 r0 r1 r y s
c C s( | dkrt |�S | dkr t|�S dS d S ru )r r rv r0 r0 r1 r � s
c C sN t | �dkrJdD ]}| | dkr dS qdD ]}| | tjkr, dS q,dS dS )N� )r3 � � � � r= F) r" r4 � � � � � �
� �
� rO T)r7 �stringZ hexdigits)Zmacr< r0 r0 r1 r � s c C s$ g }| D ]}||kr|� |� q|S �N)r: )Z_list�outputrV r0 r0 r1 r � s
c C sJ z.t �d| �}t|�� d �� �} |�� W n tk
rD Y dS X | S )z Get parent for pid z ps -o ppid -h -p %d 2>/dev/nullr" N)rX �popenr* rg r+ �closer] )r_ ri r0 r0 r1 r � s c C s. ddl m} ttt| �� ��}d|td� S )z�
Netfilter limits length of chain to (currently) 28 chars.
The longest chain we create is FWDI_<zone>_allow,
which leaves 28 - 11 = 17 chars for <zone>.
r" )� SHORTCUTS� Z__allow)Zfirewall.core.baser� �max�mapr7 �values)r� Zlongest_shortcutr0 r0 r1 r � s c C sR t | �dk s t | �t�d�kr"dS | D ]&}|tjkr&|tjkr&|dkr& dS q&dS )Nr4 �SC_LOGIN_NAME_MAXF)rH r2 rq �$T)r7 rX �sysconfr� Z
ascii_lettersZdigits)�user�cr0 r0 r1 r � s
��c C sF t | t�r.z t| �} W n tk
r, Y dS X | dkrB| dkrBdS dS )NFr" i���T)r) �strr* r, )Zuidr0 r0 r1 r � s
c C sH t | �dk st | �dkr dS dD ]}|| kr dS q | d dkrDdS dS )Nr4 i F)�|�
� r" rG TrS )ZcommandrT r0 r0 r1 r � s c C s� | � d�}t|�dkrdS |d dkr>|d dd � dkr>dS |d dd � d krVdS |d
dd � d krndS t|d �dk r�dS d
S )Nr= )r~ ry Fr" �rootr( Z_ur4 Z_rr3 Z_tr} T)r6 r7 )�contextr; r0 r0 r1 r � s
c C s8 dt t�kr d�dd� | D ��S d�dd� | D ��S d S )N�quoterP c s s | ]}t �|�V qd S r� )�shlexr� ��.0�ar0 r0 r1 � <genexpr>� s zjoinArgs.<locals>.<genexpr>c s s | ]}t �|�V qd S r� )�pipesr� r� r0 r0 r1 r� � s )rb r� r9 )�argsr0 r0 r1 r � s c C s8 t r*t| t�r*t| �} t�| �}tt|�S t�| �S d S r� )r r) �unicoder r� r6 r� r )�_stringr; r0 r0 r1 r � s
c C s t | t�r| �dd�S | S )z bytes to unicode �UTF-8rr )r) �bytes�decode�r� r0 r0 r1 r � s
c C s t | t�s| �dd�S | S )z unicode to bytes r� rr )r) r� �encoder� r0 r0 r1 r � s
c C s t rt| t�r| �dd�S | S )z" unicode to bytes only if Python 2r� rr )r r) r� r� r� r0 r0 r1 r! � s )r= )3�__all__r- rX �os.pathr� r� r� �sysre Zfirewall.core.loggerr# Zfirewall.configr$ r% �versionr r r r r@ r r rF r r r r
r r r
r r r r rt r r r r r r r r r r r r r r r r! r0 r0 r0 r1 �<module> s�
�
6