Warning: file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found
in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 88
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 215
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 216
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 217
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 218
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 219
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 220
PK ! k7 simple.gonu [ GOOF----LE-8-2.0 ] 4 h/ ] g guile g define-module* g rnrs g io g simple
g filenameS f rnrs/io/simple.scm g pureS
g versionS g set-current-module g resolve-r6rs-interface g only g ports g call-with-port g
close-port g open-file-input-port g open-file-output-port g
eof-object g eof-object? g file-options g buffer-mode g native-transcoder !g get-char "g lookahead-char #g get-datum $g put-char %g put-datum &g input-port? 'g output-port? ( !"#$%&' )g call-with-deferred-observers *) +) ,g module-use-interfaces! -, ., /g current-module 0/ 1/ 2g @@ 3g current-input-port 4g current-output-port 5g current-error-port 6g define* 7g with-input-from-port 8g with-output-to-port 92345678 :g base ;: g module-export! ?> @> Ag module-re-export! BA CA Dg i/o-error-port Eg i/o-port-error? Fg make-i/o-port-error Gg &i/o-port Hg i/o-file-does-not-exist-error? Ig "make-i/o-file-does-not-exist-error Jg &i/o-file-does-not-exist Kg i/o-file-already-exists-error? Lg "make-i/o-file-already-exists-error Mg &i/o-file-already-exists Ng i/o-file-is-read-only-error? Og make-i/o-file-is-read-only-error Pg &i/o-file-is-read-only Qg i/o-file-protection-error? Rg make-i/o-file-protection-error Sg &i/o-file-protection Tg i/o-error-filename Ug i/o-filename-error? Vg make-i/o-filename-error Wg
&i/o-filename Xg i/o-error-position Yg i/o-invalid-position-error? Zg make-i/o-invalid-position-error [g &i/o-invalid-position \g i/o-write-error? ]g make-i/o-write-error ^g
&i/o-write _g i/o-read-error? `g make-i/o-read-error ag &i/o-read bg
i/o-error? cg make-i/o-error dg &i/o eDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcd543'& ( fg module-replace! gf hf ig write jg display kg newline lg
write-char mg read ng peek-char og read-char pg close-output-port qg close-input-port rg open-output-file sg open-input-file tg with-output-to-file ug with-input-from-file vg call-with-output-file wg call-with-input-file xijklmnopqrstuvw yj zj {g enums |{ }g enum-set-constructor ~|} |} g make-enumeration | | g no-create g no-fail g no-truncate g blockC 5 h 7 ]4
5 4 > " G 4(5 4+.1 h D ] 45 L 6< g filenamef rnrs/io/simple.scm
C O > " G 495 4+.1 h D ] 45 L 6< g filenamef rnrs/io/simple.scm
C O > " G 4;5 4+.1 h D ] 45 L 6< g filenamef rnrs/io/simple.scm
C O > " G 4=5 4+.1 h D ] 45 L 6< g filenamef rnrs/io/simple.scm
C O > " G 4+@1 h D ] 45 6 < g filenamef rnrs/io/simple.scm
C> " G 4+C1e h D ] 45 6 < g filenamef rnrs/io/simple.scm
C> " G 4+h1x h D ] 45 6 < g filenamef rnrs/io/simple.scm
C> " G zjR h ]4 56 g filename
g proc g filenamef rnrs/io/simple.scm
w g nameg call-with-input-file CwR h ]4 56 g filename
g proc g filenamef rnrs/io/simple.scm
z g nameg call-with-output-file CvRw7 h , ] L 6 $ g port
C h ] O 6 g filename
g thunk g filenamef rnrs/io/simple.scm
} g nameg with-input-from-file CuRv8 h , ] L 6 $ g port
C h ] O 6 g filename
g thunk g filenamef rnrs/io/simple.scm
g nameg with-output-to-file CtR h y ] 44455545 6 q g filename
g filenamef rnrs/io/simple.scm
g nameg open-input-file CsR h z ] 44455545 6 r g filename
g filenamef rnrs/io/simple.scm
g nameg open-output-file CrRiqRipR3! h p - . , 3 # 45 6 h g port
g filenamef rnrs/io/simple.scm
g nameg read-char CoR3" h p - . , 3 # 45 6 h g port
g filenamef rnrs/io/simple.scm
g nameg peek-char CnR3# h k - . , 3 # 45 6 c g port
g filenamef rnrs/io/simple.scm
g nameg read CmR4$ h( - . , 3 # 45 6 z g char
! g port ! g filenamef rnrs/io/simple.scm
! g nameg
write-char ClR4$ h( n - . , 3 # 45
6 f g port
! g filenamef rnrs/io/simple.scm
!
g nameg newline CkR4% h( - . , 3 # 45 6 w g object
! g port ! g filenamef rnrs/io/simple.scm
! g nameg write CiRC / g m
+ g iface
2 g iface
9 g iface
@ g iface
I g filenamef rnrs/io/simple.scm
u j w # z # } # K
U
C6 PK ! ; ports.gonu [ GOOF----LE-8-2.0 ] 4 h4 ] g guile g define-module* g rnrs g io g ports
g filenameS f rnrs/io/ports.scm g pureS
g versionS g set-current-module g resolve-r6rs-interface g ice-9 g binary-ports g call-with-deferred-observers g module-use-interfaces! g current-module !g only "g base #" $g assertion-violation %!#$ &g enums '& (g records )g syntactic *() +g
exceptions ,+ -g
conditions .- /g files 0/ 1g srfi 2g srfi-8 312 4g rdelim 54 6g except 7g raise 8g display 9678 :g prefix ;!8 g module-export! ?> @> Ag i/o-encoding-error-char Bg make-i/o-encoding-error Cg i/o-encoding-error? Dg &i/o-encoding-error Eg make-i/o-decoding-error Fg i/o-decoding-error? Gg &i/o-decoding-error Hg standard-error-port Ig standard-output-port Jg standard-input-port Kg
put-string Lg put-datum Mg put-char Ng lookahead-char Og get-string-n Pg get-string-all Qg get-line Rg get-datum Sg get-char Tg open-file-input/output-port Ug flush-output-port Vg make-custom-textual-output-port Wg call-with-string-output-port Xg call-with-bytevector-output-port Yg open-file-output-port Zg open-string-output-port [g open-file-input-port \g open-string-input-port ]g call-with-port ^g port-has-set-port-position!? _g port-has-port-position? `g set-port-position! ag
port-position bg transcoded-port cg
textual-port? dg binary-port? eg port-transcoder fg port-eof? gg utf-16-codec hg utf-8-codec ig
latin-1-codec jg native-transcoder kg transcoder-error-handling-mode lg transcoder-eol-style mg transcoder-codec ng make-transcoder og error-handling-mode pg native-eol-style qg eol-style rg buffer-mode? sg buffer-mode tg file-options uABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst 4 vg module-re-export! wv xv yg i/o-error-port zg make-i/o-port-error {g i/o-port-error? |g &i/o-port }g "make-i/o-file-does-not-exist-error ~g i/o-file-does-not-exist-error? g &i/o-file-does-not-exist g "make-i/o-file-already-exists-error g i/o-file-already-exists-error? g &i/o-file-already-exists g make-i/o-file-is-read-only-error g i/o-file-is-read-only-error? g &i/o-file-is-read-only g make-i/o-file-protection-error g i/o-file-protection-error? g &i/o-file-protection g i/o-error-filename g make-i/o-filename-error g i/o-filename-error? g
&i/o-filename g make-i/o-invalid-position-error g i/o-invalid-position-error? g &i/o-invalid-position g make-i/o-write-error g i/o-write-error? g
&i/o-write g make-i/o-read-error g i/o-read-error? g &i/o-read g make-i/o-error g
i/o-error? g &i/o g current-error-port g current-output-port g current-input-port g
get-string-n! g put-bytevector g put-u8 g make-custom-binary-output-port g open-bytevector-output-port g get-bytevector-all g get-bytevector-some g get-bytevector-n! g get-bytevector-n g lookahead-u8 g get-u8 g make-custom-binary-input-port g open-bytevector-input-port g
close-port g output-port? g input-port? g port? g eof-object? g
eof-object yz{|}~ 6 g module-replace! g make-syntax-transformer g file-option g macro g $sc-dispatch g any g
syntax->datum ' ' g no-create g no-fail g no-truncate g
syntax-object g quote g m-d35b14d-24 g top g ribcage g sym f l-d35b14d-29 f l-d35b14d-2a g s f l-d35b14d-26 g shift g dummy g type-name g symbol g constructor-syntax g m-bfa5881-18 f l-bfa5881-1d f l-bfa5881-1e f l-bfa5881-1f f l-bfa5881-20 g x f l-bfa5881-1a g private & g syntax-violation ' ' g symbol->string ' ' f not a member of the set f -source expression failed to match any pattern g _ g each-any g
datum->syntax ' ' g every ' ' g memq f not a subset of the universe g enum-set-constructor g t-d35b14d-43 g t-d35b14d-44
g m-d35b14d-45
f l-d35b14d-49 f l-d35b14d-4a
g quoted-syms f l-d35b14d-3b g quoted-universe f l-d35b14d-39 g syms f l-d35b14d-36 !g universe "! #f l-d35b14d-34 $# %"$ & 'f l-d35b14d-31 (' )&( *f l-d35b14d-2e +* ,+ - %), .- /g make-enumeration 0/- 1g none 2g line 3g block 4g m-d35b14d-4d 54 6s 75 8f l-d35b14d-52 9f l-d35b14d-53 :89 ;67: <5 =f l-d35b14d-4f >= ?<> @5;? A@ Bg buffer-modes C123 Dg t-d35b14d-6c Eg t-d35b14d-6d FDE Gg m-d35b14d-6e HG IHH Jf l-d35b14d-72 Kf l-d35b14d-73 LJK MFIL Nf l-d35b14d-64 ON P<O Qf l-d35b14d-62 RQ S<R Tf l-d35b14d-5f UT V <U Wf l-d35b14d-5d XW Y"<X Zf l-d35b14d-5a [Z \&<[ ]f l-d35b14d-57 ^] _<^ `5MPSVY\_ a` b/` cg enum-set-member? dg enum-set-universe e' f' g'/ h'/ ig lf jg cr kg crlf lg nel mg crnel ng ls og m-d35b14d-76 po qq rp sf l-d35b14d-7b tf l-d35b14d-7c ust vqru wp xf l-d35b14d-78 yx zwy {pvz |{ }g
eol-styles ~ijklmn1 g t-d35b14d-95 g t-d35b14d-96 g m-d35b14d-97 f l-d35b14d-9b f l-d35b14d-9c f l-d35b14d-8d w f l-d35b14d-8b w f l-d35b14d-88 w f l-d35b14d-86 "w f l-d35b14d-83 &w f l-d35b14d-80 w p / g ignore g replace g m-d35b14d-9f o f l-d35b14d-a4 f l-d35b14d-a5 f l-d35b14d-a1 g error-handling-modes 7 g t-d35b14d-be g t-d35b14d-bf g m-d35b14d-c0 f l-d35b14d-c4 f l-d35b14d-c5 f l-d35b14d-b6 f l-d35b14d-b4 f l-d35b14d-b1 f l-d35b14d-af " f l-d35b14d-ac & f l-d35b14d-a9 / g make-record-type-descriptor * * g
transcoder g immutable g codec q o g record-constructor * * g "make-record-constructor-descriptor * * g %make-transcoder g register-record-type * * g record-predicate * * g transcoder? g record-accessor * * g %default-port-encoding f
ISO-8859-1 f UTF-8 f UTF-16 g with-throw-handler g system-error g system-error-errno g EACCES g EEXIST g ENOENT g EROFS g with-i/o-filename-conditions g memv g EIO g EFBIG g ENOSPC g EPIPE g condition g throw g with-i/o-port-error g with-textual-output-conditions g port g body0 g body g m-d35b14d-cb f l-d35b14d-d0
f l-d35b14d-d1 f l-d35b14d-d2 f l-d35b14d-d3
f l-d35b14d-cd g lambda g with-i/o-encoding-error g with-textual-input-conditions g m-d35b14d-d9 f l-d35b14d-de f l-d35b14d-df !f l-d35b14d-e0 "f l-d35b14d-e1 # !" $ # % &f l-d35b14d-db '& (%' )$( *) +) ,) -g with-i/o-decoding-error .-) /g
port-encoding 0g port-conversion-strategy 1g error 2g
substitute 3f unsupported error handling mode 4g %make-transcoded-port 54 64 7g set-port-encoding! 8g set-port-conversion-strategy! 9g seek :g SEEK_CUR ;g SEEK_SET < ?g open-input-string @g open Ag r6rs-open Bg O_CREAT Cg O_TRUNC Dg O_EXCL Eg file-options->mode Fg O_RDONLY Gg O_RDWR Hg open-output-string Ig get-output-string Jg O_WRONLY Kg make-soft-port Lg string Mg
string-length Nf w Og force-output P. Q. Rg
&i/o-encoding Sg list->vector T.S U.S Vg char WVA X. Y. Z. [. \g condition-predicate ].\ ^.\ _g condition-accessor `._ a._ b. c. d eg
m-d35b14d-114 fe gf hf
l-d35b14d-119 if
l-d35b14d-11a jhi kdgj lf mf
l-d35b14d-116 nm oln pko qp rp sg encoding-error tsp urt vp wg begin xwp yg key zyp {g subr |{p }g message ~}p g errno p p g chr p z|~ 7p Bp v g
write-char g write g string? g substring/shared f expected string g
guile:display g
&i/o-decoding g
m-d35b14d-148 f
l-d35b14d-14d f
l-d35b14d-14e d f
l-d35b14d-14a g decoding-error w y { } 7 E g read-char g read g read-line g trim g read-string g make-string g peek-char g dup->inport g dup->outportC 5 h@Z ]4
5 4 > " G 45 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4%5 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4'5 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4*5 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4,5 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4.5 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 405 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 435 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 455 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 495 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4=5 4 h C ] 45 L 6; g filenamef rnrs/io/ports.scm
C O > " G 4@ u h C ] 45 6 ; g filenamef rnrs/io/ports.scm
C> " G 4x h C ] 45 6 ; g filenamef rnrs/io/ports.scm
C> " G 4 h C ] 45 6 ; g filenamef rnrs/io/ports.scm
C> " G 4
hH ~ ]
45 & " & " $ C45 6 v g file-option
G g sym G g t - g filenamef rnrs/io/ports.scm }
G C h( c ] 4 5 $ @ 6 [ g s
" g tmp " g filenamef rnrs/io/ports.scm
}
" C5R4t h S ] 6 K g x
g filenamef rnrs/io/ports.scm
}
Ct.0 h N ] C F g t-d35b14d-43
g t-d35b14d-44 C h ])4 5 4L 5 4L 5 45 $ " 44 5
> " G 4 5 $
@6 g sym
g syms g quoted-universe g quoted-syms ) g t 4 ] g tmp d g tmp o g filenamef rnrs/io/ports.scm }
C h( c ] 4 5 $ O @ 6 [ g s
' g tmp ' g filenamef rnrs/io/ports.scm
}
' C5tR4s123As
hH ]
45 & " & " $ C45 6 w g buffer-mode
G g sym G g t - g filenamef rnrs/io/ports.scm
G C h( d ] 4 5 $ @ 6 \ g s
" g tmp " g filenamef rnrs/io/ports.scm
" C5sR4B CC h T ] 6 L g x
g filenamef rnrs/io/ports.scm
CBab h N ] C F g t-d35b14d-6c
g t-d35b14d-6d C h ])4 5 4L 5 4L 5 45 $ " 44 5
> " G 4 5 $
@6 g sym
g syms g quoted-universe g quoted-syms ) g t 4 ] g tmp d g tmp o g filenamef rnrs/io/ports.scm
C h( d ] 4 5 $ O @ 6 \ g s
' g tmp ' g filenamef rnrs/io/ports.scm
' C5BRcdfhC h r ] 444455556 j g symbol
g filenamef rnrs/io/ports.scm
g nameg buffer-mode? CrR4qijklmn1|q h } ]
45 & " F& " 9& " ,& " & " & " $ C
4 5
6 u g eol-style
{ g sym { g t a g filenamef rnrs/io/ports.scm
{ C h( d ] 4 5 $ @ 6 \ g s
" g tmp " g filenamef rnrs/io/ports.scm
" C5qR4} ~~ h T ] 6 L g x
g filenamef rnrs/io/ports.scm
C} h N ] C F g t-d35b14d-95
g t-d35b14d-96 C h ])4 5 4L 5 4L 5 45 $ " 44 5
> " G 4 5 $
@6 g sym
g syms g quoted-universe g quoted-syms ) g t 4 ] g tmp d g tmp o g filenamef rnrs/io/ports.scm
C h( d ] 4 5 $ O @ 6 \ g s
' g tmp ' g filenamef rnrs/io/ports.scm
' C5}R1 h a ] C Y g filenamef rnrs/io/ports.scm
g nameg native-eol-style CpR4o7o
hH ]
45 & " & " $ C45 6 g error-handling-mode
G g sym G g t - g filenamef rnrs/io/ports.scm
G C h( d ] 4 5 $ @ 6 \ g s
" g tmp " g filenamef rnrs/io/ports.scm
" C5oR4 h T ] 6 L g x
g filenamef rnrs/io/ports.scm
C h N ] C F g t-d35b14d-be
g t-d35b14d-bf C h ])4 5 4L 5 4L 5 45 $ " 44 5
> " G 4 5 $
@6 g sym
g syms g quoted-universe g quoted-syms ) g t 4 ] g tmp d g tmp o g filenamef rnrs/io/ports.scm
C h( d ] 4 5 $ O @ 6 \ g s
' g tmp ' g filenamef rnrs/io/ports.scm
' C5R4 5R4 4 i55R4 i4 i5> " G R4 i5R4 i 5kR4 i 5lR4 i
5mRp h0 - . , 3 # 45 # 6 g codec
- g eol-style - g
handling-mode - g filenamef rnrs/io/ports.scm
- g nameg make-transcoder CnRni h r ][ $ " 45 6 j g t
g filenamef rnrs/io/ports.scm
g nameg native-transcoder CjR h g ] C _ g filenamef rnrs/io/ports.scm
g nameg
latin-1-codec CiR h e ] C ] g filenamef rnrs/io/ports.scm
g nameg utf-8-codec ChR h f ] C ^ g filenamef rnrs/io/ports.scm
g nameg utf-16-codec CgR}7 h` a - 1 3 4 5 $ " /$ " $ " $ "
4L 56 Y g args
] g errno ] g construct-condition P ] ]
C h ] O 6 g filename
g thunk g filenamef rnrs/io/ports.scm
g nameg with-i/o-filename-conditions CR7z hH @ - 1 3 4 5 4 5$ 44L 5 4 L556
@ 8 g args
C g errno C C
C h ] O 6 g port
g make-primary-condition g thunk g filenamef rnrs/io/ports.scm
g nameg with-i/o-port-error CR4 h d ] C \ g dummy
g port g body0 g body C h( ] 4 5 $ @ 6 g x
" g tmp " " g
macro-typeg syntax-rulesg patternsg portg body0g bodyg ... C5R4*+,. h d ] C \ g dummy
g port g body0 g body C h( ] 4 5 $ @ 6 g x
" g tmp " " g
macro-typeg syntax-rulesg patternsg portg body0g bodyg ... C5R/np0172$e3 hX ]4 5 $ >45 4 5 $ " $ " 4
5 6C
g port
Q g t Q g key ! M g filenamef rnrs/io/ports.scm
H ' Q g nameg port-transcoderg
documentationf dReturn the transcoder object associated with @var{port}, or @code{#f}
if the port has no transcoder. CeR/ h ]4 5C g port
g filenamef rnrs/io/ports.scm
g nameg binary-port?g
documentationf ZReturns @code{#t} if @var{port} does not have an associated encoding,
@code{#f} otherwise. CdR h ]C g port
g filenamef rnrs/io/ports.scm
g nameg
textual-port?g
documentationf LAlways returns @code{#t}, as all ports can be used for textual I/O in
Guile. CcRdN h( m ]4 5$ 4 5" 4 56 e g port
# g filenamef rnrs/io/ports.scm
# g nameg port-eof? CfR67mk781213 h r ]4 5 445> " G 45 $ 4> " G " :$ 4 > " G " 4
45> " G C j g port
g
transcoder g result g key + g filenamef rnrs/io/ports.scm
t g nameg transcoded-portg
documentationf Return a new textual port based on @var{port}, using
@var{transcoder} to encode and decode data written to or
read from its underlying binary port @var{port}. CbR9: h ]
6 g port
g filenamef rnrs/io/ports.scm
g nameg
port-positiong
documentationf jReturn the offset (an integer) indicating where the next octet will be
read from/written to in @var{port}. CaR9; h ] 6 g port
g offset g filenamef rnrs/io/ports.scm
g nameg set-port-position!g
documentationf NSet the position where the next octet will be read from/written to
@var{port}. C`R>a h ] L 6
C h . - 1 3 C & g args
C h ]4 O 5$ CC g port
g filenamef rnrs/io/ports.scm
g nameg port-has-port-position?g
documentationf =Return @code{#t} is @var{port} supports @code{port-position}. C_R>`a h ] L 4L 56
C h . - 1 3 C & g args
C h ]4 O 5$ CC g port
g filenamef rnrs/io/ports.scm
g nameg port-has-set-port-position!?g
documentationf BReturn @code{#t} is @var{port} supports @code{set-port-position!}. C^R h( + ]
4 > G 4 > " G E# g port
( g proc ( g vals
( g filenamef rnrs/io/ports.scm
#
( g nameg call-with-portg
documentationf Call @var{proc}, passing it @var{port} and closing @var{port} upon exit of
@var{proc}. Return the return values of @var{proc}. C]R] h@ - . , 3 # 4> G 4 > " G 6 g proc
? g
transcoder ? g port ? g extract ? g filenamef rnrs/io/ports.scm
,
? g nameg call-with-bytevector-output-port CXR? h ]Y4 > ZCZF g str
g filenamef rnrs/io/ports.scm
1
3 ( g nameg open-string-input-portg
documentationf 1Open an input port that will read from @var{str}. C\R@ h ] Y4LL > ZCZF
C7m h@ ] 4 O 5 $ 445> " G " C g filename
: g mode : g buffer-mode : g
transcoder : g port : g filenamef rnrs/io/ports.scm
6
: g nameg r6rs-open CARcBCD hH ]4 5$
" 4 5$
" 4 5$
" C g file-options
D g base-mode D g filenamef rnrs/io/ports.scm
?
D g nameg file-options->mode CERfh3AF hH - . , 3 # 444555 # # 6 g filename
C g file-options C g buffer-mode C g
transcoder C g filenamef rnrs/io/ports.scm
K
C g nameg open-file-input-portg
documentationf 5Return an input port for reading from @var{filename}. C[Rfh3AEG hP " - . , 3 # 444555 # # 456 g filename
J g file-options J g buffer-mode J g
transcoder J g filenamef rnrs/io/ports.scm
S
J g nameg open-file-input/output-portg
documentationf =Return a port for reading from and writing to @var{filename}. CTRHI h ] L 6
C h 5 ]Y45 Z O D - g port
g filenamef rnrs/io/ports.scm
^
a 4
g nameg open-string-output-portg
documentationf Return two values: an output port that will collect characters written to it
as a string, and a thunk to retrieve the characters associated with that port. CZRfh3AEJ hP - . , 3 # 444555 # # 456 g filename
J g file-options J g buffer-mode J g maybe-transcoder J g filenamef rnrs/io/ports.scm
f
J g nameg open-file-output-portg
documentationf 4Return an output port for writing to @var{filename}. CYRHI h( ! ] 45 4 > " G 6 g proc
! g port ! g filenamef rnrs/io/ports.scm
q
! g nameg call-with-string-output-portg
documentationf zCall @var{proc}, passing it a string output port. When @var{proc} returns,
return the characters accumulated in that port. CWRKL h ) ]L 4 5
6 ! g c
CM h ) ]L
4 56! g s
CN h ]O O 6 g id
g write! g get-position g
set-position! g close g filenamef rnrs/io/ports.scm
x
g nameg make-custom-textual-output-port CVRO h u ] 6m g port
g filenamef rnrs/io/ports.scm
g nameg flush-output-port CUR4 QR|i4 UW 55RR4 Y4 [Ri55BR4 ^Ri5CR4 aRi4 cRi
55AR4quvx h ? ] C 7 g dummy
g body C h( ] 4 5 $ @ 6 g x
" g tmp " " g
documentationf BConvert Guile throws to `encoding-error' to `&i/o-encoding-error'.g
macro-typeg syntax-rulesg patternsg bodyg ... C5Rs h ] LL 6
C7B h ]456 g key
g subr g message g errno g port g chr C h ] L LO 6
C h ~ ] O 6 v g port
g char g filenamef rnrs/io/ports.scm
g nameg put-char CMRs h ] LL 6
C7B h ]456 g key
g subr g message g errno g port g chr C h ] L LO 6
C h ] O 6 x g port
g datum g filenamef rnrs/io/ports.scm
g nameg put-datum CLRs8M$K hX F ] 4L5$ >L $ 0L$ 4LL L L5L64LL 4L55L6LL6L6 > g filenamef rnrs/io/ports.scm Q + U
C7B h ]456 g key
g subr g message g errno g port g chr C h ] L LLLO 6
C h8 - . , 3 # # O 6 g port
3 g s 3 g start 3 g count 3 g filenamef rnrs/io/ports.scm
3 g nameg
put-string CKRs h ] LL 6
C7B h ]456 g key
g subr g message g errno g port g chr C h ] L LO 6
C h0 - . , 3 # 45 O 6 w g object
* g port * g filenamef rnrs/io/ports.scm
* g nameg display C8R4 Q|i4 U55R4 Y4 [i55ER4 ^i5FR4- h ? ] C 7 g dummy
g body C h( ] 4 5 $ @ 6 g x
" g tmp " " g
documentationf BConvert Guile throws to `decoding-error' to `&i/o-decoding-error'.g
macro-typeg syntax-rulesg patternsg bodyg ... C5-R h ] L 6
C7E h w ]456 o g key
g subr
g message
g errno
g port
C h ] L O 6
C h l ] O 6 d g port
g filenamef rnrs/io/ports.scm
g nameg get-char CSR h ] L 6
C7E h w ]456 o g key
g subr
g message
g errno
g port
C h ] L O 6
C h m ] O 6 e g port
g filenamef rnrs/io/ports.scm
g nameg get-datum CRR h ] L 6
C7E h w ]456 o g key
g subr
g message
g errno
g port
C h ] L O 6
C h l ] O 6 d g port
g filenamef rnrs/io/ports.scm
g nameg get-line CQR h ] L 6
C7E h w ]456 o g key
g subr
g message
g errno
g port
C h ] L O 6
C h r ] O 6 j g port
g filenamef rnrs/io/ports.scm
g nameg get-string-all CPR h@ ]45 4
5 45$ C$ C
6 g port
< g count < g s < g rv < g filenamef rnrs/io/ports.scm
< g nameg get-string-ng
documentationf Read up to @var{count} characters from @var{port}.
If no characters could be read before encountering the end of file,
return the end-of-file object, otherwise return a string containing
the characters read. COR h ] L 6
C7E h w ]456 o g key
g subr
g message
g errno
g port
C h ] L O 6
C h r ] O 6 j g port
g filenamef rnrs/io/ports.scm
g nameg lookahead-char CNR h d ] Y4
> ZCZF \ g filenamef rnrs/io/ports.scm
g nameg standard-input-port CJR h e ] Y4 > ZCZF ] g filenamef rnrs/io/ports.scm
g nameg standard-output-port CIR h d ] Y4 > ZCZF \ g filenamef rnrs/io/ports.scm
g nameg standard-error-port CHRC g m
+ g iface
2 g iface
8 g iface
? g iface
H g iface
O g iface
X g iface
_ g iface
h g iface
o g iface
x g iface
g filenamef rnrs/io/ports.scm
<
E
P
!
#
'
(
)
*P
,
-
.
09
1
3> #
4V ,
5T 1
6 6
7 ?
9F K
: S
< ^
> f
?t q
A) x
A
A
E
Gs
J
L
L
O
QX
S
T
V
Xu
Y
Y
Z7
0 Z9
C6 PK ! L console/size.rbnu [ # frozen_string_literal: false
# fallback to console window size
def IO.default_console_size
[
ENV["LINES"].to_i.nonzero? || 25,
ENV["COLUMNS"].to_i.nonzero? || 80,
]
end
begin
require 'io/console'
rescue LoadError
class << IO
alias console_size default_console_size
end
else
# returns console window size
def IO.console_size
console.winsize
rescue NoMethodError
default_console_size
end
end
PK ! \0p 0p
console.sonu ȯ ELF > " @ 0i @ 8 @ xV xV Z Z Z H ([ ([ ([ 8 8 8 $ $ XV XV XV Std XV XV XV Ptd J J J Qtd Rtd Z Z Z H P GNU ~B0z
M~Y+ T H! @ T V X BE|qX /Do > ' ` u P . 9 p S 6 : o f U $ U H " " h h y U , B q 9 , { F " r [ # ` X` ` B p @G __gmon_start__ _ITM_deregisterTMCloneTable _ITM_registerTMCloneTable __cxa_finalize rb_check_typeddata cfmakeraw rb_data_typed_object_zalloc rb_funcallv rb_default_rs rb_io_write __errno_location tcsetattr rb_num2uint rb_sprintf rb_io_taint_check rb_io_check_closed rb_sys_fail_str __stack_chk_fail tcgetattr tcflush rb_string_value_cstr rb_io_get_write_io rb_ensure rb_stdin rb_stderr rb_error_arity rb_str_new_static rb_str_catf rb_io_flush rb_convert_type rb_eArgError rb_raise rb_cIO rb_cFile rb_const_defined rb_cloexec_open rb_update_max_fd rb_class_new_instance rb_obj_freeze rb_const_set rb_unexpected_type rb_const_get rb_const_remove rb_id2sym rb_io_close rb_check_id rb_keyword_given_p rb_funcallv_kw strlen rb_io_getbyte rb_ary_new rb_ary_push rb_str_new rb_str_new_cstr ioctl rb_assoc_new rb_fix2int rb_num2int rb_Array rb_ary_detransient rb_protect rb_syserr_fail rb_jump_tag rb_io_gets rb_yield rb_hash_dup rb_hash_aref rb_funcallv_public rb_ary_resize rb_ary_ptr_use_start rb_ary_ptr_use_end rb_debug_rstring_null_ptr rb_obj_class InitVM_console rb_f_notimplement rb_define_module_under rb_cObject rb_define_class_under rb_define_alloc_func rb_undef_method Init_console rb_intern rb_define_method rb_define_singleton_method libruby.so.3.1 libm.so.6 libc.so.6 _edata __bss_start GLIBC_2.4 GLIBC_2.2.5 /opt/alt/ruby31/lib64 ii
ui Z P# Z # Z Z Z 2J _ _ _
_ _ " _ * _ + _ 5 _ > _ L _ M _ N _ O _ S P] X] `] h] p] x] ] ]
] ] ] ] ] ] ] ] ] ] ] ] ] ] ^ ^ ^ ^ ^ (^ 0^ ! 8^ # @^ $ H^ % P^ & X^ ' `^ ( h^ ) p^ , x^ - ^ . ^ / ^ 0 ^ 1 ^ 2 ^ 3 ^ 4 ^ 6 ^ 7 ^ 8 ^ 9 ^ : ^ ; ^ < ^ = ^ ? _ @ _ A _ B _ C _ D (_ W 0_ E 8_ F @_ G H_ H P_ I X_ J `_ K h_ O p_ P x_ Q _ R HH9F HtH 5C %C h h h h h h h h q h a h Q h
A h 1 h ! h
h h h h h h h h h h q h a h Q h A h 1 h ! h h h h h! h" h# h$ h% h& h' q h( a h) Q h* A h+ 1 h, ! h- h. h/ h0 h1 h2 h3 h4 h5 h6 h7 q h8 a h9 Q h: A h; 1 h< ! h= h> h? h@ hA hB hC hD hE hF %5? D %-? D %%? D % ? D %? D %
? D %? D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %> D %}> D %u> D %m> D %e> D %]> D %U> D %M> D %E> D %=> D %5> D %-> D %%> D % > D %> D %
> D %> D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %= D %}= D %u= D %m= D %e= D %]= D %U= D %M= D %E= D %== D %5= D %-= D %%= D % = D %= D %
= D %= D H=& % f. H=Y= HR= H9tH< Ht H=)= H5"= H)HHH?HHtH< Htf D =< u+UH=< Ht H=7 d< ] w H" O { H g HHwH ff. @ UHH5!7 SHH4HtH xHH[] D ` HH[]f. ATIH56 UHSLH56 Ho oHKoP S HP0HS0@8C8H[]A\ D UHSHHC ωC Ht.U xSUxSUtC H H H[] H6 < {ff. SH5 H< [foHP foKJfoS R HK0HJ0K8J8[ff. HH5; Hf D H5: 11ff. H-: H0ff. fUSHH
8u&1HډuH []f. H1[] SHH0H=" p1HH4H[ff. @ ATIUHHSLHSH=! p1HHH[]A\ UHH5a4 SHHHXdH%( HD$H1aHo )$oH)L$oP )T$ HP0HT$0@8D$8HXH{HtHL$HdH3 %( HuHX[]H{ Of. USHXdH%( HD$H1H.HXH2{H'u&H=8 HtHT$HdH3%( uHX[]H{ ff. @ SHPdH%( HD$H1HXH{Hu)D$ HHHЃHT$HdH3%( uHP[H{ U AVIAUATUHSHPdH%( HD$H1I2HXH6DcLD'uLD$ Iu6D$ LDt)HT$HdH3%( Hu HP[]A\A]A^ÃxD$ H{ yf AUATUHSHXdH%( HD$H1IHXHDcLD|uCLDH" L$ { H $gt HT$HdH3%( HuHX[]A\A]H{ UHSHHXH{1u
HH[]H{ SHdH%( HD$1HHtHHH$cH4$HgHD$dH3%( uH[ D H 0 у1 AVAUATUSHHdH%( HD$1H HDn@ HtyH H umHuL`LyMt$XHMH A|$HHHu`AD$u$HH HlHu9f D HL$dH3 %( H[]A\A]A^f. E1HH7uHH= u*1I D HHt+HJ;tEPЃ w-T HߍlP]HuHL\ Et#A9u E1롐HcLHt-1~ @ HcLD$Ht-dH|$ {LHLff. ATUHSHXHH{XHu{ u"H[]A\fL`LA|$H{ off. @ ATUHS`HXHdH{XHu+{ H5 Hx*H[]A\f. L`L A|$H{ ff. @ USHdH%( HD$1HXHH{XHuL{1HT
uQD$Ht $H| HL$dH3 %( u$H[] kHhHo}H{ D7I{zO}R5נN7t"wxGWjZcYڙ>e,֛^jvrSb W ?¼eܞ{o05bPҎyN=A->nuf
(rC-QͭTErNHCV߀ o l4w=@!N)5*@=* ś PI4g 3/oCoCT(9zNIn AUq^30+/ifr-0g;L7 O .rp*
- GSg YZ .shstrtab .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt.sec .text .fini .rodata .eh_frame_hdr .eh_frame .note.gnu.property .init_array .fini_array .data.rel.ro .dynamic .got .bss .gnu.build.attributes .gnu_debuglink .gnu_debugdata 8 8 $ o ` ` 8 ( X 0
; 8 o , , E o 0 T ^ B h h h c n p w " " |% } G G
H H J J L L XV XV Z Z Z Z Z Z h ([ ([ 8] 8] ` _ X X`` _ H @b ( hb h " PK ! n^ buffer.hnu [ #ifndef RUBY_IO_BUFFER_H
#define RUBY_IO_BUFFER_H
/**
* @file
* @author Samuel Williams
* @date Fri 2 Jul 2021 16:29:01 NZST
* @copyright Copyright (C) 2021 Samuel Williams
* @copyright This file is a part of the programming language Ruby.
* Permission is hereby granted, to either redistribute and/or
* modify this file, provided that the conditions mentioned in the
* file COPYING are met. Consult the file for details.
*/
#pragma once
#include "ruby/ruby.h"
#include "ruby/internal/config.h"
RBIMPL_SYMBOL_EXPORT_BEGIN()
// WARNING: This entire interface is experimental and may change in the future!
#define RB_IO_BUFFER_EXPERIMENTAL 1
#define RUBY_IO_BUFFER_VERSION 2
// The `IO::Buffer` class.
RUBY_EXTERN VALUE rb_cIOBuffer;
// The operating system page size.
RUBY_EXTERN size_t RUBY_IO_BUFFER_PAGE_SIZE;
// The default buffer size, usually a (small) multiple of the page size.
// Can be overridden by the RUBY_IO_BUFFER_DEFAULT_SIZE environment variable.
RUBY_EXTERN size_t RUBY_IO_BUFFER_DEFAULT_SIZE;
// Represents the internal state of the buffer.
// More than one flag can be set at a time.
enum rb_io_buffer_flags {
// The memory in the buffer is owned by someone else.
// More specifically, it means that someone else owns the buffer and we shouldn't try to resize it.
RB_IO_BUFFER_EXTERNAL = 1,
// The memory in the buffer is allocated internally.
RB_IO_BUFFER_INTERNAL = 2,
// The memory in the buffer is mapped.
// A non-private mapping is marked as external.
RB_IO_BUFFER_MAPPED = 4,
// A mapped buffer that is also shared.
RB_IO_BUFFER_SHARED = 8,
// The buffer is locked and cannot be resized.
// More specifically, it means we can't change the base address or size.
// A buffer is typically locked before a system call that uses the data.
RB_IO_BUFFER_LOCKED = 32,
// The buffer mapping is private and will not impact other processes or the underlying file.
RB_IO_BUFFER_PRIVATE = 64,
// The buffer is read-only and cannot be modified.
RB_IO_BUFFER_READONLY = 128,
// The buffer is backed by a file.
RB_IO_BUFFER_FILE = 256,
};
// Represents the endian of the data types.
enum rb_io_buffer_endian {
// The least significant units are put first.
RB_IO_BUFFER_LITTLE_ENDIAN = 4,
RB_IO_BUFFER_BIG_ENDIAN = 8,
#if defined(WORDS_BIGENDIAN)
RB_IO_BUFFER_HOST_ENDIAN = RB_IO_BUFFER_BIG_ENDIAN,
#else
RB_IO_BUFFER_HOST_ENDIAN = RB_IO_BUFFER_LITTLE_ENDIAN,
#endif
RB_IO_BUFFER_NETWORK_ENDIAN = RB_IO_BUFFER_BIG_ENDIAN
};
VALUE rb_io_buffer_new(void *base, size_t size, enum rb_io_buffer_flags flags);
VALUE rb_io_buffer_map(VALUE io, size_t size, rb_off_t offset, enum rb_io_buffer_flags flags);
VALUE rb_io_buffer_lock(VALUE self);
VALUE rb_io_buffer_unlock(VALUE self);
int rb_io_buffer_try_unlock(VALUE self);
VALUE rb_io_buffer_free(VALUE self);
VALUE rb_io_buffer_free_locked(VALUE self);
// Access the internal buffer and flags. Validates the pointers.
// The points may not remain valid if the source buffer is manipulated.
// Consider using rb_io_buffer_lock if needed.
enum rb_io_buffer_flags rb_io_buffer_get_bytes(VALUE self, void **base, size_t *size);
void rb_io_buffer_get_bytes_for_reading(VALUE self, const void **base, size_t *size);
void rb_io_buffer_get_bytes_for_writing(VALUE self, void **base, size_t *size);
VALUE rb_io_buffer_transfer(VALUE self);
void rb_io_buffer_resize(VALUE self, size_t size);
void rb_io_buffer_clear(VALUE self, uint8_t value, size_t offset, size_t length);
// The length is the minimum required length.
VALUE rb_io_buffer_read(VALUE self, VALUE io, size_t length, size_t offset);
VALUE rb_io_buffer_pread(VALUE self, VALUE io, rb_off_t from, size_t length, size_t offset);
VALUE rb_io_buffer_write(VALUE self, VALUE io, size_t length, size_t offset);
VALUE rb_io_buffer_pwrite(VALUE self, VALUE io, rb_off_t from, size_t length, size_t offset);
RBIMPL_SYMBOL_EXPORT_END()
#endif /* RUBY_IO_BUFFER_H */
PK ! ף dumb.rbnu [ require 'io/wait'
class Reline::Dumb < Reline::IO
RESET_COLOR = '' # Do not send color reset sequence
def initialize(encoding: nil)
@input = STDIN
@buf = []
@pasting = false
@encoding = encoding
@screen_size = [24, 80]
end
def dumb?
true
end
def encoding
if @encoding
@encoding
elsif RUBY_PLATFORM =~ /mswin|mingw/
Encoding::UTF_8
else
Encoding::default_external
end
end
def set_default_key_bindings(_)
end
def input=(val)
@input = val
end
def with_raw_input
yield
end
def getc(_timeout_second)
unless @buf.empty?
return @buf.shift
end
c = nil
loop do
Reline.core.line_editor.handle_signal
result = @input.wait_readable(0.1)
next if result.nil?
c = @input.read(1)
break
end
c&.ord
end
def ungetc(c)
@buf.unshift(c)
end
def get_screen_size
@screen_size
end
def cursor_pos
Reline::CursorPos.new(1, 1)
end
def hide_cursor
end
def show_cursor
end
def move_cursor_column(val)
end
def move_cursor_up(val)
end
def move_cursor_down(val)
end
def erase_after_cursor
end
def scroll_down(val)
end
def clear_screen
end
def set_screen_size(rows, columns)
@screen_size = [rows, columns]
end
def set_winch_handler(&handler)
end
def in_pasting?
@pasting
end
def prep
end
def deprep(otio)
end
end
PK ! %DC DC
windows.rbnu [ require 'fiddle/import'
class Reline::Windows < Reline::IO
def initialize
@input_buf = []
@output_buf = []
@output = STDOUT
@hsg = nil
@getwch = Win32API.new('msvcrt', '_getwch', [], 'I')
@kbhit = Win32API.new('msvcrt', '_kbhit', [], 'I')
@GetKeyState = Win32API.new('user32', 'GetKeyState', ['L'], 'L')
@GetConsoleScreenBufferInfo = Win32API.new('kernel32', 'GetConsoleScreenBufferInfo', ['L', 'P'], 'L')
@SetConsoleCursorPosition = Win32API.new('kernel32', 'SetConsoleCursorPosition', ['L', 'L'], 'L')
@GetStdHandle = Win32API.new('kernel32', 'GetStdHandle', ['L'], 'L')
@FillConsoleOutputCharacter = Win32API.new('kernel32', 'FillConsoleOutputCharacter', ['L', 'L', 'L', 'L', 'P'], 'L')
@ScrollConsoleScreenBuffer = Win32API.new('kernel32', 'ScrollConsoleScreenBuffer', ['L', 'P', 'P', 'L', 'P'], 'L')
@hConsoleHandle = @GetStdHandle.call(STD_OUTPUT_HANDLE)
@hConsoleInputHandle = @GetStdHandle.call(STD_INPUT_HANDLE)
@GetNumberOfConsoleInputEvents = Win32API.new('kernel32', 'GetNumberOfConsoleInputEvents', ['L', 'P'], 'L')
@ReadConsoleInputW = Win32API.new('kernel32', 'ReadConsoleInputW', ['L', 'P', 'L', 'P'], 'L')
@GetFileType = Win32API.new('kernel32', 'GetFileType', ['L'], 'L')
@GetFileInformationByHandleEx = Win32API.new('kernel32', 'GetFileInformationByHandleEx', ['L', 'I', 'P', 'L'], 'I')
@FillConsoleOutputAttribute = Win32API.new('kernel32', 'FillConsoleOutputAttribute', ['L', 'L', 'L', 'L', 'P'], 'L')
@SetConsoleCursorInfo = Win32API.new('kernel32', 'SetConsoleCursorInfo', ['L', 'P'], 'L')
@GetConsoleMode = Win32API.new('kernel32', 'GetConsoleMode', ['L', 'P'], 'L')
@SetConsoleMode = Win32API.new('kernel32', 'SetConsoleMode', ['L', 'L'], 'L')
@WaitForSingleObject = Win32API.new('kernel32', 'WaitForSingleObject', ['L', 'L'], 'L')
@legacy_console = getconsolemode & ENABLE_VIRTUAL_TERMINAL_PROCESSING == 0
end
def encoding
Encoding::UTF_8
end
def win?
true
end
def win_legacy_console?
@legacy_console
end
def set_default_key_bindings(config)
{
[224, 72] => :ed_prev_history, # ↑
[224, 80] => :ed_next_history, # ↓
[224, 77] => :ed_next_char, # →
[224, 75] => :ed_prev_char, # ←
[224, 83] => :key_delete, # Del
[224, 71] => :ed_move_to_beg, # Home
[224, 79] => :ed_move_to_end, # End
[ 0, 41] => :ed_unassigned, # input method on/off
[ 0, 72] => :ed_prev_history, # ↑
[ 0, 80] => :ed_next_history, # ↓
[ 0, 77] => :ed_next_char, # →
[ 0, 75] => :ed_prev_char, # ←
[ 0, 83] => :key_delete, # Del
[ 0, 71] => :ed_move_to_beg, # Home
[ 0, 79] => :ed_move_to_end # End
}.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
config.add_default_key_binding_by_keymap(:vi_insert, key, func)
config.add_default_key_binding_by_keymap(:vi_command, key, func)
end
{
[27, 32] => :em_set_mark, # M-
[24, 24] => :em_exchange_mark, # C-x C-x
}.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
end
# Emulate ANSI key sequence.
{
[27, 91, 90] => :completion_journey_up, # S-Tab
}.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
config.add_default_key_binding_by_keymap(:vi_insert, key, func)
end
end
if defined? JRUBY_VERSION
require 'win32api'
else
class Win32API
DLL = {}
TYPEMAP = {"0" => Fiddle::TYPE_VOID, "S" => Fiddle::TYPE_VOIDP, "I" => Fiddle::TYPE_LONG}
POINTER_TYPE = Fiddle::SIZEOF_VOIDP == Fiddle::SIZEOF_LONG_LONG ? 'q*' : 'l!*'
WIN32_TYPES = "VPpNnLlIi"
DL_TYPES = "0SSI"
def initialize(dllname, func, import, export = "0", calltype = :stdcall)
@proto = [import].join.tr(WIN32_TYPES, DL_TYPES).sub(/^(.)0*$/, '\1')
import = @proto.chars.map {|win_type| TYPEMAP[win_type.tr(WIN32_TYPES, DL_TYPES)]}
export = TYPEMAP[export.tr(WIN32_TYPES, DL_TYPES)]
calltype = Fiddle::Importer.const_get(:CALL_TYPE_TO_ABI)[calltype]
handle = DLL[dllname] ||=
begin
Fiddle.dlopen(dllname)
rescue Fiddle::DLError
raise unless File.extname(dllname).empty?
Fiddle.dlopen(dllname + ".dll")
end
@func = Fiddle::Function.new(handle[func], import, export, calltype)
rescue Fiddle::DLError => e
raise LoadError, e.message, e.backtrace
end
def call(*args)
import = @proto.split("")
args.each_with_index do |x, i|
args[i], = [x == 0 ? nil : +x].pack("p").unpack(POINTER_TYPE) if import[i] == "S"
args[i], = [x].pack("I").unpack("i") if import[i] == "I"
end
ret, = @func.call(*args)
return ret || 0
end
end
end
VK_RETURN = 0x0D
VK_MENU = 0x12 # ALT key
VK_LMENU = 0xA4
VK_CONTROL = 0x11
VK_SHIFT = 0x10
VK_DIVIDE = 0x6F
KEY_EVENT = 0x01
WINDOW_BUFFER_SIZE_EVENT = 0x04
CAPSLOCK_ON = 0x0080
ENHANCED_KEY = 0x0100
LEFT_ALT_PRESSED = 0x0002
LEFT_CTRL_PRESSED = 0x0008
NUMLOCK_ON = 0x0020
RIGHT_ALT_PRESSED = 0x0001
RIGHT_CTRL_PRESSED = 0x0004
SCROLLLOCK_ON = 0x0040
SHIFT_PRESSED = 0x0010
VK_TAB = 0x09
VK_END = 0x23
VK_HOME = 0x24
VK_LEFT = 0x25
VK_UP = 0x26
VK_RIGHT = 0x27
VK_DOWN = 0x28
VK_DELETE = 0x2E
STD_INPUT_HANDLE = -10
STD_OUTPUT_HANDLE = -11
FILE_TYPE_PIPE = 0x0003
FILE_NAME_INFO = 2
ENABLE_VIRTUAL_TERMINAL_PROCESSING = 4
# Calling Win32API with console handle is reported to fail after executing some external command.
# We need to refresh console handle and retry the call again.
private def call_with_console_handle(win32func, *args)
val = win32func.call(@hConsoleHandle, *args)
return val if val != 0
@hConsoleHandle = @GetStdHandle.call(STD_OUTPUT_HANDLE)
win32func.call(@hConsoleHandle, *args)
end
private def getconsolemode
mode = "\000\000\000\000"
call_with_console_handle(@GetConsoleMode, mode)
mode.unpack1('L')
end
private def setconsolemode(mode)
call_with_console_handle(@SetConsoleMode, mode)
end
#if @legacy_console
# setconsolemode(getconsolemode() | ENABLE_VIRTUAL_TERMINAL_PROCESSING)
# @legacy_console = (getconsolemode() & ENABLE_VIRTUAL_TERMINAL_PROCESSING == 0)
#end
def msys_tty?(io = @hConsoleInputHandle)
# check if fd is a pipe
if @GetFileType.call(io) != FILE_TYPE_PIPE
return false
end
bufsize = 1024
p_buffer = "\0" * bufsize
res = @GetFileInformationByHandleEx.call(io, FILE_NAME_INFO, p_buffer, bufsize - 2)
return false if res == 0
# get pipe name: p_buffer layout is:
# struct _FILE_NAME_INFO {
# DWORD FileNameLength;
# WCHAR FileName[1];
# } FILE_NAME_INFO
len = p_buffer[0, 4].unpack1("L")
name = p_buffer[4, len].encode(Encoding::UTF_8, Encoding::UTF_16LE, invalid: :replace)
# Check if this could be a MSYS2 pty pipe ('\msys-XXXX-ptyN-XX')
# or a cygwin pty pipe ('\cygwin-XXXX-ptyN-XX')
name =~ /(msys-|cygwin-).*-pty/ ? true : false
end
KEY_MAP = [
# It's treated as Meta+Enter on Windows.
[ { control_keys: :CTRL, virtual_key_code: 0x0D }, "\e\r".bytes ],
[ { control_keys: :SHIFT, virtual_key_code: 0x0D }, "\e\r".bytes ],
# It's treated as Meta+Space on Windows.
[ { control_keys: :CTRL, char_code: 0x20 }, "\e ".bytes ],
# Emulate getwch() key sequences.
[ { control_keys: [], virtual_key_code: VK_UP }, [0, 72] ],
[ { control_keys: [], virtual_key_code: VK_DOWN }, [0, 80] ],
[ { control_keys: [], virtual_key_code: VK_RIGHT }, [0, 77] ],
[ { control_keys: [], virtual_key_code: VK_LEFT }, [0, 75] ],
[ { control_keys: [], virtual_key_code: VK_DELETE }, [0, 83] ],
[ { control_keys: [], virtual_key_code: VK_HOME }, [0, 71] ],
[ { control_keys: [], virtual_key_code: VK_END }, [0, 79] ],
# Emulate ANSI key sequence.
[ { control_keys: :SHIFT, virtual_key_code: VK_TAB }, [27, 91, 90] ],
]
def process_key_event(repeat_count, virtual_key_code, virtual_scan_code, char_code, control_key_state)
# high-surrogate
if 0xD800 <= char_code and char_code <= 0xDBFF
@hsg = char_code
return
end
# low-surrogate
if 0xDC00 <= char_code and char_code <= 0xDFFF
if @hsg
char_code = 0x10000 + (@hsg - 0xD800) * 0x400 + char_code - 0xDC00
@hsg = nil
else
# no high-surrogate. ignored.
return
end
else
# ignore high-surrogate without low-surrogate if there
@hsg = nil
end
key = KeyEventRecord.new(virtual_key_code, char_code, control_key_state)
match = KEY_MAP.find { |args,| key.matches?(**args) }
unless match.nil?
@output_buf.concat(match.last)
return
end
# no char, only control keys
return if key.char_code == 0 and key.control_keys.any?
@output_buf.push("\e".ord) if key.control_keys.include?(:ALT) and !key.control_keys.include?(:CTRL)
@output_buf.concat(key.char.bytes)
end
def check_input_event
num_of_events = 0.chr * 8
while @output_buf.empty?
Reline.core.line_editor.handle_signal
if @WaitForSingleObject.(@hConsoleInputHandle, 100) != 0 # max 0.1 sec
# prevent for background consolemode change
@legacy_console = getconsolemode & ENABLE_VIRTUAL_TERMINAL_PROCESSING == 0
next
end
next if @GetNumberOfConsoleInputEvents.(@hConsoleInputHandle, num_of_events) == 0 or num_of_events.unpack1('L') == 0
input_records = 0.chr * 20 * 80
read_event = 0.chr * 4
if @ReadConsoleInputW.(@hConsoleInputHandle, input_records, 80, read_event) != 0
read_events = read_event.unpack1('L')
0.upto(read_events) do |idx|
input_record = input_records[idx * 20, 20]
event = input_record[0, 2].unpack1('s*')
case event
when WINDOW_BUFFER_SIZE_EVENT
@winch_handler.()
when KEY_EVENT
key_down = input_record[4, 4].unpack1('l*')
repeat_count = input_record[8, 2].unpack1('s*')
virtual_key_code = input_record[10, 2].unpack1('s*')
virtual_scan_code = input_record[12, 2].unpack1('s*')
char_code = input_record[14, 2].unpack1('S*')
control_key_state = input_record[16, 2].unpack1('S*')
is_key_down = key_down.zero? ? false : true
if is_key_down
process_key_event(repeat_count, virtual_key_code, virtual_scan_code, char_code, control_key_state)
end
end
end
end
end
end
def with_raw_input
yield
end
def getc(_timeout_second)
check_input_event
@output_buf.shift
end
def ungetc(c)
@output_buf.unshift(c)
end
def in_pasting?
not empty_buffer?
end
def empty_buffer?
if not @output_buf.empty?
false
elsif @kbhit.call == 0
true
else
false
end
end
def get_console_screen_buffer_info
# CONSOLE_SCREEN_BUFFER_INFO
# [ 0,2] dwSize.X
# [ 2,2] dwSize.Y
# [ 4,2] dwCursorPositions.X
# [ 6,2] dwCursorPositions.Y
# [ 8,2] wAttributes
# [10,2] srWindow.Left
# [12,2] srWindow.Top
# [14,2] srWindow.Right
# [16,2] srWindow.Bottom
# [18,2] dwMaximumWindowSize.X
# [20,2] dwMaximumWindowSize.Y
csbi = 0.chr * 22
return if call_with_console_handle(@GetConsoleScreenBufferInfo, csbi) == 0
csbi
end
def get_screen_size
unless csbi = get_console_screen_buffer_info
return [1, 1]
end
csbi[0, 4].unpack('SS').reverse
end
def cursor_pos
unless csbi = get_console_screen_buffer_info
return Reline::CursorPos.new(0, 0)
end
x = csbi[4, 2].unpack1('s')
y = csbi[6, 2].unpack1('s')
Reline::CursorPos.new(x, y)
end
def move_cursor_column(val)
call_with_console_handle(@SetConsoleCursorPosition, cursor_pos.y * 65536 + val)
end
def move_cursor_up(val)
if val > 0
y = cursor_pos.y - val
y = 0 if y < 0
call_with_console_handle(@SetConsoleCursorPosition, y * 65536 + cursor_pos.x)
elsif val < 0
move_cursor_down(-val)
end
end
def move_cursor_down(val)
if val > 0
return unless csbi = get_console_screen_buffer_info
screen_height = get_screen_size.first
y = cursor_pos.y + val
y = screen_height - 1 if y > (screen_height - 1)
call_with_console_handle(@SetConsoleCursorPosition, (cursor_pos.y + val) * 65536 + cursor_pos.x)
elsif val < 0
move_cursor_up(-val)
end
end
def erase_after_cursor
return unless csbi = get_console_screen_buffer_info
attributes = csbi[8, 2].unpack1('S')
cursor = csbi[4, 4].unpack1('L')
written = 0.chr * 4
call_with_console_handle(@FillConsoleOutputCharacter, 0x20, get_screen_size.last - cursor_pos.x, cursor, written)
call_with_console_handle(@FillConsoleOutputAttribute, attributes, get_screen_size.last - cursor_pos.x, cursor, written)
end
def scroll_down(val)
return if val < 0
return unless csbi = get_console_screen_buffer_info
buffer_width, buffer_lines, x, y, attributes, window_left, window_top, window_bottom = csbi.unpack('ssssSssx2s')
screen_height = window_bottom - window_top + 1
val = screen_height if val > screen_height
if @legacy_console || window_left != 0
# unless ENABLE_VIRTUAL_TERMINAL,
# if srWindow.Left != 0 then it's conhost.exe hosted console
# and puts "\n" causes horizontal scroll. its glitch.
# FYI irb write from culumn 1, so this gives no gain.
scroll_rectangle = [0, val, buffer_width, buffer_lines - val].pack('s4')
destination_origin = 0 # y * 65536 + x
fill = [' '.ord, attributes].pack('SS')
call_with_console_handle(@ScrollConsoleScreenBuffer, scroll_rectangle, nil, destination_origin, fill)
else
origin_x = x + 1
origin_y = y - window_top + 1
@output.write [
(origin_y != screen_height) ? "\e[#{screen_height};H" : nil,
"\n" * val,
(origin_y != screen_height or !x.zero?) ? "\e[#{origin_y};#{origin_x}H" : nil
].join
end
end
def clear_screen
if @legacy_console
return unless csbi = get_console_screen_buffer_info
buffer_width, _buffer_lines, attributes, window_top, window_bottom = csbi.unpack('ss@8S@12sx2s')
fill_length = buffer_width * (window_bottom - window_top + 1)
screen_topleft = window_top * 65536
written = 0.chr * 4
call_with_console_handle(@FillConsoleOutputCharacter, 0x20, fill_length, screen_topleft, written)
call_with_console_handle(@FillConsoleOutputAttribute, attributes, fill_length, screen_topleft, written)
call_with_console_handle(@SetConsoleCursorPosition, screen_topleft)
else
@output.write "\e[2J" "\e[H"
end
end
def set_screen_size(rows, columns)
raise NotImplementedError
end
def hide_cursor
size = 100
visible = 0 # 0 means false
cursor_info = [size, visible].pack('Li')
call_with_console_handle(@SetConsoleCursorInfo, cursor_info)
end
def show_cursor
size = 100
visible = 1 # 1 means true
cursor_info = [size, visible].pack('Li')
call_with_console_handle(@SetConsoleCursorInfo, cursor_info)
end
def set_winch_handler(&handler)
@winch_handler = handler
end
def prep
# do nothing
nil
end
def deprep(otio)
# do nothing
end
class KeyEventRecord
attr_reader :virtual_key_code, :char_code, :control_key_state, :control_keys
def initialize(virtual_key_code, char_code, control_key_state)
@virtual_key_code = virtual_key_code
@char_code = char_code
@control_key_state = control_key_state
@enhanced = control_key_state & ENHANCED_KEY != 0
(@control_keys = []).tap do |control_keys|
# symbols must be sorted to make comparison is easier later on
control_keys << :ALT if control_key_state & (LEFT_ALT_PRESSED | RIGHT_ALT_PRESSED) != 0
control_keys << :CTRL if control_key_state & (LEFT_CTRL_PRESSED | RIGHT_CTRL_PRESSED) != 0
control_keys << :SHIFT if control_key_state & SHIFT_PRESSED != 0
end.freeze
end
def char
@char_code.chr(Encoding::UTF_8)
end
def enhanced?
@enhanced
end
# Verifies if the arguments match with this key event.
# Nil arguments are ignored, but at least one must be passed as non-nil.
# To verify that no control keys were pressed, pass an empty array: `control_keys: []`.
def matches?(control_keys: nil, virtual_key_code: nil, char_code: nil)
raise ArgumentError, 'No argument was passed to match key event' if control_keys.nil? && virtual_key_code.nil? && char_code.nil?
(control_keys.nil? || [*control_keys].sort == @control_keys) &&
(virtual_key_code.nil? || @virtual_key_code == virtual_key_code) &&
(char_code.nil? || char_code == @char_code)
end
end
end
PK ! F' ' ansi.rbnu [ require 'io/console'
require 'io/wait'
class Reline::ANSI < Reline::IO
CAPNAME_KEY_BINDINGS = {
'khome' => :ed_move_to_beg,
'kend' => :ed_move_to_end,
'kdch1' => :key_delete,
'kpp' => :ed_search_prev_history,
'knp' => :ed_search_next_history,
'kcuu1' => :ed_prev_history,
'kcud1' => :ed_next_history,
'kcuf1' => :ed_next_char,
'kcub1' => :ed_prev_char,
}
ANSI_CURSOR_KEY_BINDINGS = {
# Up
'A' => [:ed_prev_history, {}],
# Down
'B' => [:ed_next_history, {}],
# Right
'C' => [:ed_next_char, { ctrl: :em_next_word, meta: :em_next_word }],
# Left
'D' => [:ed_prev_char, { ctrl: :ed_prev_word, meta: :ed_prev_word }],
# End
'F' => [:ed_move_to_end, {}],
# Home
'H' => [:ed_move_to_beg, {}],
}
if Reline::Terminfo.enabled?
Reline::Terminfo.setupterm(0, 2)
end
def initialize
@input = STDIN
@output = STDOUT
@buf = []
@old_winch_handler = nil
end
def encoding
Encoding.default_external
end
def set_default_key_bindings(config, allow_terminfo: true)
set_bracketed_paste_key_bindings(config)
set_default_key_bindings_ansi_cursor(config)
if allow_terminfo && Reline::Terminfo.enabled?
set_default_key_bindings_terminfo(config)
else
set_default_key_bindings_comprehensive_list(config)
end
{
[27, 91, 90] => :completion_journey_up, # S-Tab
}.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
config.add_default_key_binding_by_keymap(:vi_insert, key, func)
end
{
# default bindings
[27, 32] => :em_set_mark, # M-
[24, 24] => :em_exchange_mark, # C-x C-x
}.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
end
end
def set_bracketed_paste_key_bindings(config)
[:emacs, :vi_insert, :vi_command].each do |keymap|
config.add_default_key_binding_by_keymap(keymap, START_BRACKETED_PASTE.bytes, :bracketed_paste_start)
end
end
def set_default_key_bindings_ansi_cursor(config)
ANSI_CURSOR_KEY_BINDINGS.each do |char, (default_func, modifiers)|
bindings = [["\e[#{char}", default_func]] # CSI + char
if modifiers[:ctrl]
# CSI + ctrl_key_modifier + char
bindings << ["\e[1;5#{char}", modifiers[:ctrl]]
end
if modifiers[:meta]
# CSI + meta_key_modifier + char
bindings << ["\e[1;3#{char}", modifiers[:meta]]
# Meta(ESC) + CSI + char
bindings << ["\e\e[#{char}", modifiers[:meta]]
end
bindings.each do |sequence, func|
key = sequence.bytes
config.add_default_key_binding_by_keymap(:emacs, key, func)
config.add_default_key_binding_by_keymap(:vi_insert, key, func)
config.add_default_key_binding_by_keymap(:vi_command, key, func)
end
end
end
def set_default_key_bindings_terminfo(config)
key_bindings = CAPNAME_KEY_BINDINGS.map do |capname, key_binding|
begin
key_code = Reline::Terminfo.tigetstr(capname)
[ key_code.bytes, key_binding ]
rescue Reline::Terminfo::TerminfoError
# capname is undefined
end
end.compact.to_h
key_bindings.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
config.add_default_key_binding_by_keymap(:vi_insert, key, func)
config.add_default_key_binding_by_keymap(:vi_command, key, func)
end
end
def set_default_key_bindings_comprehensive_list(config)
{
# xterm
[27, 91, 51, 126] => :key_delete, # kdch1
[27, 91, 53, 126] => :ed_search_prev_history, # kpp
[27, 91, 54, 126] => :ed_search_next_history, # knp
# Console (80x25)
[27, 91, 49, 126] => :ed_move_to_beg, # Home
[27, 91, 52, 126] => :ed_move_to_end, # End
# KDE
# Del is 0x08
[27, 71, 65] => :ed_prev_history, # ↑
[27, 71, 66] => :ed_next_history, # ↓
[27, 71, 67] => :ed_next_char, # →
[27, 71, 68] => :ed_prev_char, # ←
# urxvt / exoterm
[27, 91, 55, 126] => :ed_move_to_beg, # Home
[27, 91, 56, 126] => :ed_move_to_end, # End
# GNOME
[27, 79, 72] => :ed_move_to_beg, # Home
[27, 79, 70] => :ed_move_to_end, # End
# Del is 0x08
# Arrow keys are the same of KDE
[27, 79, 65] => :ed_prev_history, # ↑
[27, 79, 66] => :ed_next_history, # ↓
[27, 79, 67] => :ed_next_char, # →
[27, 79, 68] => :ed_prev_char, # ←
}.each_pair do |key, func|
config.add_default_key_binding_by_keymap(:emacs, key, func)
config.add_default_key_binding_by_keymap(:vi_insert, key, func)
config.add_default_key_binding_by_keymap(:vi_command, key, func)
end
end
def input=(val)
@input = val
end
def output=(val)
@output = val
end
def with_raw_input
if @input.tty?
@input.raw(intr: true) { yield }
else
yield
end
end
def inner_getc(timeout_second)
unless @buf.empty?
return @buf.shift
end
until @input.wait_readable(0.01)
timeout_second -= 0.01
return nil if timeout_second <= 0
Reline.core.line_editor.handle_signal
end
c = @input.getbyte
(c == 0x16 && @input.tty? && @input.raw(min: 0, time: 0, &:getbyte)) || c
rescue Errno::EIO
# Maybe the I/O has been closed.
nil
end
START_BRACKETED_PASTE = String.new("\e[200~", encoding: Encoding::ASCII_8BIT)
END_BRACKETED_PASTE = String.new("\e[201~", encoding: Encoding::ASCII_8BIT)
def read_bracketed_paste
buffer = String.new(encoding: Encoding::ASCII_8BIT)
until buffer.end_with?(END_BRACKETED_PASTE)
c = inner_getc(Float::INFINITY)
break unless c
buffer << c
end
string = buffer.delete_suffix(END_BRACKETED_PASTE).force_encoding(encoding)
string.valid_encoding? ? string : ''
end
# if the usage expects to wait indefinitely, use Float::INFINITY for timeout_second
def getc(timeout_second)
inner_getc(timeout_second)
end
def in_pasting?
not empty_buffer?
end
def empty_buffer?
unless @buf.empty?
return false
end
!@input.wait_readable(0)
end
def ungetc(c)
@buf.unshift(c)
end
def retrieve_keybuffer
begin
return unless @input.wait_readable(0.001)
str = @input.read_nonblock(1024)
str.bytes.each do |c|
@buf.push(c)
end
rescue EOFError
end
end
def get_screen_size
s = @input.winsize
return s if s[0] > 0 && s[1] > 0
s = [ENV["LINES"].to_i, ENV["COLUMNS"].to_i]
return s if s[0] > 0 && s[1] > 0
[24, 80]
rescue Errno::ENOTTY, Errno::ENODEV
[24, 80]
end
def set_screen_size(rows, columns)
@input.winsize = [rows, columns]
self
rescue Errno::ENOTTY, Errno::ENODEV
self
end
def cursor_pos
if both_tty?
res = +''
m = nil
@input.raw do |stdin|
@output << "\e[6n"
@output.flush
loop do
c = stdin.getc
next if c.nil?
res << c
m = res.match(/\e\[(?\d+);(?\d+)R/)
break if m
end
(m.pre_match + m.post_match).chars.reverse_each do |ch|
stdin.ungetc ch
end
end
column = m[:column].to_i - 1
row = m[:row].to_i - 1
else
begin
buf = @output.pread(@output.pos, 0)
row = buf.count("\n")
column = buf.rindex("\n") ? (buf.size - buf.rindex("\n")) - 1 : 0
rescue Errno::ESPIPE, IOError
# Just returns column 1 for ambiguous width because this I/O is not
# tty and can't seek.
row = 0
column = 1
end
end
Reline::CursorPos.new(column, row)
end
def both_tty?
@input.tty? && @output.tty?
end
def move_cursor_column(x)
@output.write "\e[#{x + 1}G"
end
def move_cursor_up(x)
if x > 0
@output.write "\e[#{x}A"
elsif x < 0
move_cursor_down(-x)
end
end
def move_cursor_down(x)
if x > 0
@output.write "\e[#{x}B"
elsif x < 0
move_cursor_up(-x)
end
end
def hide_cursor
seq = "\e[?25l"
if Reline::Terminfo.enabled? && Reline::Terminfo.term_supported?
begin
seq = Reline::Terminfo.tigetstr('civis')
rescue Reline::Terminfo::TerminfoError
# civis is undefined
end
end
@output.write seq
end
def show_cursor
seq = "\e[?25h"
if Reline::Terminfo.enabled? && Reline::Terminfo.term_supported?
begin
seq = Reline::Terminfo.tigetstr('cnorm')
rescue Reline::Terminfo::TerminfoError
# cnorm is undefined
end
end
@output.write seq
end
def erase_after_cursor
@output.write "\e[K"
end
# This only works when the cursor is at the bottom of the scroll range
# For more details, see https://github.com/ruby/reline/pull/577#issuecomment-1646679623
def scroll_down(x)
return if x.zero?
# We use `\n` instead of CSI + S because CSI + S would cause https://github.com/ruby/reline/issues/576
@output.write "\n" * x
end
def clear_screen
@output.write "\e[2J"
@output.write "\e[1;1H"
end
def set_winch_handler(&handler)
@old_winch_handler = Signal.trap('WINCH', &handler)
@old_cont_handler = Signal.trap('CONT') do
@input.raw!(intr: true) if @input.tty?
# Rerender the screen. Note that screen size might be changed while suspended.
handler.call
end
rescue ArgumentError
# Signal.trap may raise an ArgumentError if the platform doesn't support the signal.
end
def prep
# Enable bracketed paste
@output.write "\e[?2004h" if Reline.core.config.enable_bracketed_paste && both_tty?
retrieve_keybuffer
nil
end
def deprep(otio)
# Disable bracketed paste
@output.write "\e[?2004l" if Reline.core.config.enable_bracketed_paste && both_tty?
Signal.trap('WINCH', @old_winch_handler) if @old_winch_handler
Signal.trap('CONT', @old_cont_handler) if @old_cont_handler
end
end
PK ! h?n$ n$ LC_MESSAGES/iso_3166-1.monu [ \
* 2 8 B
J U
] h q y
& . 7 @ G V o t z
'
0 > ] b j q
! ) / 9 > F R Y _ g m t
{
) 4 > F M U \
e
p {
! * 0 7 H Q l q } *
0 ; Q ^ f
m x
) 2 7 ? E Y a h u
& - 6 E
? J R Z f m t |
+
4 B & K r
% + 3 < Q Y a j | % / 8 ? L S Y b l u }
" *
0 > G
S ^ e n v {
!
! ! !! .! 8! >! F! K!
Z! h! q! v! ! ! ! ! ! ! ! ! ! ! ! ! "
" " " 0" <" S" m"
s" ~" " " " " " " " " " " " #
# # # ##
+# 6# =# D#
X# c# l# u# z# # # # # # # # # # # # $
$
$ $ ($ 2$ :$ Q$ W$ ^$ g$ Q A l % { 5 V G h ( z 8 + 9 f ^ U q i g \ O _ C ` ) ] P E J k 0 , 2 1 D * y c ' j F / o e > ~ 4 v ; W X
3 t : } & r b 7 N = ! p x S K . | T [ # Z 6 m R
< s u Y ? L @ " I w $ n a B - M H d Afghanistan Albania Algeria American Samoa Andorra Angola Anguilla Antigua and Barbuda Argentina Armenia Aruba Australia Austria Azerbaijan Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory British Virgin Islands Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cayman Islands Central African Republic Chad Chile Colombia Comoros Cook Islands Costa Rica Croatia Cuba Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic Ecuador Egypt El Salvador Equatorial Guinea Eritrea Ethiopia Faroe Islands Federated States of Micronesia Fiji Finland France French Polynesia Gabon Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guam Guatemala Guernsey Guinea Guinea-Bissau Guyana Haiti Honduras Hong Kong Hungary Iceland India Indonesia Iraq Ireland Isle of Man Israel Italy Jamaica Japan Jersey Jordan Kazakhstan Kenya Kiribati Kuwait Kyrgyzstan Latvia Lebanon Lesotho Liberia Libya Liechtenstein Lithuania Luxembourg Madagascar Malawi Malaysia Maldives Mali Malta Martinique Mauritania Mauritius Mayotte Mexico Moldova Monaco Mongolia Montenegro Montserrat Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island Northern Mariana Islands Norway Oman Pakistan Palau Panama Papua New Guinea Paraguay People's Republic of China Peru Philippines Poland Portugal Puerto Rico Qatar Republic of the Congo Romania Rwanda Réunion Saint Kitts and Nevis Saint Lucia Saint Pierre and Miquelon Saint Vincent and the Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia Seychelles Sierra Leone Singapore Slovakia Slovenia Solomon Islands Somalia South Africa South Sudan Spain Sri Lanka Sudan Suriname Swaziland Sweden Switzerland Taiwan Tajikistan Tanzania Thailand Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu Uganda Ukraine United Arab Emirates United Kingdom United States of America Uruguay Uzbekistan Vanuatu Venezuela Vietnam Wallis and Futuna Yemen Zambia Zimbabwe Åland Islands Project-Id-Version: iso_3166-1
Report-Msgid-Bugs-To: https://salsa.debian.org/iso-codes-team/iso-codes/issues
POT-Creation-Date: 2018-01-17 22:10+0100
PO-Revision-Date: 2017-12-29 07:00+0000
Last-Translator: Chris Leonard
Language-Team: Ido
Language: io
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=2; plural=n != 1;
X-Generator: Weblate 2.19-dev
Afganistan Albania Aljeria Usana Samoa Andora Angola Anguila Antigua e Barbuda Arjentinia Armenia Aruba Australia Austria Azerbaijan Bahrain Bangladesh Barbados Bielorusia Belgia Belize Benin Bermuda Bhutan Bolivia Bosnia e Herzegovina Botswana Bouvet Insulo Brazilia Britaniana teritorio en Indiana Oceano Virgin-Insuli Britana Bulgaria Burkina Faso Burundi Kambodja Kamerun Kanada Kaiman-Insuli Centrafrika Chad Chili Kolumbia Komori Cook-Insuli Kosta Rika Kroatia Kuba Chipro Chekia Dania Djibuti Dominika Dominikana Republiko Equador Egiptia Salvador Equatorala Guinea Eritrea Etiopia Faero Federata Stati di Mikronezia Fidji Finlando Francia Franca Polinezia Gabon Gruzia Germania Ghana Gibraltar Grekia Grenlando Grenada Guadelupa Guam Guatemala Guernsey Guinea Guinea Bisau Guyana Haiti Honduras Hong Kong Hungaria Islando India Indonezia Irak Republiko di Irlando Man-Insulo Israel Italia Jamaika Japonia Jersey Jordania Kazakstan Kenia Kiribati Kuwait Kirgizistan Latvia Libano Lesotho Liberia Libia Liechtenstein Lituania Luxemburgia Madagaskar Malawi Malaizia Maldivi Mali Malta Martinik Mauritania Maurico Mayotte Mexikia Moldova Monako Mongolia Montenegro Montserrat Maroko Mozambik Myanmar Namibia Nauru Nepal Nederlando Nova-Kaledonia Nova-Zelando Nikaragua Nijer Nigeria Niue Norfolk-insulo Norda Mariani Norvegia Oman Pakistan Palau Panama Papua-Nova-Guinea Paraguay Populala Republiko di Chinia Peru Filipini Polonia Portugal Portuo Riko Katar Republiko Kongo Rumania Ruanda Reunion Santa Kitts e Nevis Santa Lucia Santa Pierre e Mikelon Santa Vincent e Grenadini Samoa San-Marino San-Tome e Principe Saudi-Arabia Senegal Serbia Seycheli Sierra Leone Singapur Slovakia Slovenia Insuli Salomon Somalia Sudafrika Sud-Sudan Hispania Sri-Lanka Sudan Surinam Swazilando Suedia Suisia Republiko di Chinia Tajikistan Tanzania Tailando Togo Tokelau Tonga Trinidad e Tobago Tunizia Turkia Turkmenistan Turks e Kaikos-Insuli Tuvalu Uganda Ukrainia Unionita Araba Emirati Unionita Rejio Usa Uruguay Uzbekistan Vanuatu Venezuela Vietnam Wallis e Futuna Insuli Yemen Zambia Zimbabwe Alando PK ! I.X .X LC_MESSAGES/gtk20.monu [ ] 8 F 9 " " ,
$
+ 6 @ 7 a ) 4 = 6 ; ' D $ l ( )
" # ! D 0 f
9 6 ! $! 3 -! a! z! ! ! ! ! ! ! ! " ! " "" ;" C"
J" U" [" k" w" " " " " " " " " * " ) # + I# u# # # $ # # 1 # - .$ \$ " r$ $ $ $ $ $ % % % *% 2% ?% K% S%
\% & j% % % % % % $ % & ;& [& {& & & N & & & ' 1' E' # c' ' ' ' " ' ' ( 3( M( m( ( ( 8 ( 8 ( 1) I) N) Z) n) t) ~) ) ) ) ) ) ) ) ) ) )
) * * 5* K* `* u* *
* * * * * +
+ + + 3+ :+ B+ _+ h+ l+ t+ + + > + + + , , ,
,
$, /, >,
C,
Q, \, f, p, z, , = , ,
, , ! , - /-
7- B- R- d- u-
{-
- -
- - - - - - - -
. . !.
.. 9. ?.
N. \. i. . . . . . . . . / ./ :/ O/ Y/ `/ t/ |/ / / / /
/ / L / "0 40 G0 N0 / S0 0 0 0 0 0 > 0 " 1 51 T1 i1 ~1 1 1 1 1 ' 1 2 &2 =2 S2 h2 6 }2 2 2 ! h3 3 3
v4
4 4 4 4 4 4 ! 4 " 4 5 15 85 U5 \5 h5 % r5 5
5 5 5 5 5 5 6 6 -6 26 D6 L6 S6 \6 h6 q6 z6
6 6 6 6 6 6 6
6 6 6 6 6 6
6 7 7 !7 .7
67 A7 K7 Q7 Y7 k7 s7 7 7 7 7 7 7 7 7 7 7 7 7 7 8 8 8 (8 >8
J8 U8 Z8 ]8 b8 l8 { {8 F 9 ! >: ! `: * : : : : : : : $ ; 0 '; X; 6 t; @ ; ; ; . ; . '< 3 V< 3 <
< < ! < " < ! = - ?= m= v= ; = 6 = = = 4 = 3> J> P> W> c> j> ' s> $ > % > > ? &? .? 8? D? K? ^? j? z? ? ? ?
? ? ? ? 5 ? 6 -@ / d@ @ @ @ # @ A 0 $A ) UA A " A A A ! A B 3B JB RB iB }B B B B B B & B B $ B # #C GC cC . wC & C ) C * C
"D -D GD N MD + D D D D " E 8E ! RE tE " E E E E ) F $ -F RF nF ; F ; F F G G 0G IG SG [G hG tG {G
G G G G G G G G H H 8H PH iH H H H H H H I I #I 2I 8I UI [I bI |I I I I I I @ I #J
(J 3J O 1 GO yO O O
O O 7 O & O !P ?P VP mP P P P P ) P Q #Q * ) U J I E 6 [ 0 . 7 / & ] Q + N ' # A i 9 : y
c 5 ; N ? G
. u b D 3 n ) R
_ S O ! % z = s I \ 7 4 " S V - 3 X ~ o Y W P & E q K ( ; r ( 0 Q $ K 4 ' 9 P f w = 1 [ > t X B L T x B H J W V ] D 8 * # g Z @ e C M L 1 / " { , "%s" could not be converted to a value of type "%s" for attribute "%s" "%s" is not a valid attribute name "%s" is not a valid attribute type "%s" is not a valid value for attribute "%s" "Deepness" of the color. %1$s on %2$s %s job #%d (None) (disabled) (unknown) <%s> element has invalid id "%s" <%s> element has neither a "name" nor an "id" attribute A <%s> element has already been specified A element can't occur before a element A file named "%s" already exists. Do you want to replace it? A_t: About %s Add the current folder to the bookmarks Add the folder '%s' to the bookmarks Add the selected folder to the Bookmarks Add the selected folders to the bookmarks All sheets Amharic (EZ+) Amount of blue light in the color. Amount of green light in the color. Amount of red light in the color. Anonymous tag found and tags can not be created. Application Artwork by Attribute "%s" is invalid on <%s> element in this context Attribute "%s" repeated twice on the same <%s> element Axes Be_fore: Both "id" and "name" were found on the <%s> element Brightness of the color. CLASS COLORS C_ollate C_reate C_redits Cache file created successfully.
Cannot allocate colormap entries Cannot allocate colormap structure Cannot allocate new pixbuf Cannot read XPM colormap Cedilla Cl_ear Classified Color Color Selection Color Wheel Color _name: Command Line Confidential Copie_s: Copies Copy URL Copy _Location Could not add a bookmark Could not clear list Could not get image height (bad TIFF file) Could not get image width (bad TIFF file) Could not get information for file '%s': %s Could not mount %s Could not remove bookmark Could not remove item Could not rename %s back to %s: %s.
Could not rename %s to %s: %s
Could not rename %s to %s: %s, removing %s then.
Could not retrieve information about the file Could not select file Could not start the search process Couldn't convert filename Couldn't create new pixbuf Couldn't write to BMP file Create Fo_lder Create in _folder: Credits Custom Size %d Custom size DISPLAY De_lete File Delete File Desktop Disabled Documented by Element <%s> is not allowed below <%s> Empty Error creating folder '%s': %s Error deleting file '%s': %s Error loading icon: %s Error printing Error renaming file "%s" to "%s": %s Error renaming file "%s": %s Error renaming file to "%s": %s Error writing to image file: %s Even sheets Excess data in file FLAGS Failed to close '%s' while writing image, all data may not have been saved: %s Failed to load RGB data from TIFF file Failed to load TIFF image Failed to load icon Failed to load image '%s': %s Failed to open '%s' for writing: %s Failed to open TIFF image Failed to open file '%s': %s Failed to open temporary file Failed to read from temporary file Failed to rewrite header
Failed to save TIFF image Failed to write TIFF data Failed to write cache file: %s
Failed to write folder index
Failed to write hash table
Failed to write header
Failed to write to temporary file when loading XBM image Failed to write to temporary file when loading XPM image Failure reading GIF: %s File File System File not found: %s
Files Finishing Fol_ders Folders Font Font Selection Full Volume GTK+ Options Gamma General High Icon has zero height Icon has zero width Image Quality Image format unknown Image has unsupported bpp Image has zero height Image has zero width Image header corrupt Image type '%s' is not supported Invalid URI Invalid UTF-8 Invalid XBM file Invalid file name Invalid header in animation Invalid header in icon Job Job Details Keys LRM _Left-to-right mark Layout License Load additional GTK+ modules Location Low MODULES Manage Custom Sizes Manage Custom Sizes... Margins from Printer... Margins:
Left: %s %s
Right: %s %s
Top: %s %s
Bottom: %s %s Medium Modified Muted NAME Name Name too long New Folder No items found None Not available Odd sheets One Sided Op_acity: Open '%s' Other... Out of paper Outermost element in text must be not <%s> Output Tray Output t_ray: PDF PNM file has an image height of 0 PNM file has an image width of 0 Page %u Page Setup Pages Per Sheet Pages per _sheet: Pages per _side: Paper Paper Margins Paper Size Paper Source Paper Type Paper _source: Paper _type: Paused Pick a Color Pick a Font Places Position on the color wheel. Postscript Preparing Preparing %d Pri_ority: Print Print Document Print to File Print to LPR Print to Test Printer Printer Printer offline Printing %d RLM _Right-to-left mark Really delete file "%s"? Received invalid color data
Remove Remove the bookmark '%s' Remove the selected bookmark Rename File Rename file "%s" to: Rename... SCREEN Same as --no-wintab Sans 12 Save in _folder: Sc_ale: Screen Search Secret Select A File Serialized data is malformed Serialized data is malformed. First section isn't GTKTEXTBUFFERCONTENTS-0001 Show GTK+ Options Show _Hidden Files Si_ze: Size Specify one or more page ranges,
e.g. 1-3,7,11 Standard Status TIFFClose operation failed T_wo-sided: Tag "%s" already defined Tag "%s" does not exist in buffer and tags can not be created. Tag "%s" has invalid priority "%s" Tag "%s" has not been defined. The ANI image format The BMP image format The GIF image format The ICO image format The JPEG image format The PCX image format The PNG image format The PNM/PBM/PGM/PPM image format family The TIFF image format The Targa image format The WBMP image format The XBM image format The XPM image format The attribute "%s" was found twice on the <%s> element The folder could not be created The folder could not be created, as a file with the same name already exists. Try using a different name for the folder, or rename the file first. The generated cache was invalid.
The license of the program The previously-selected color, for comparison to the color you're selecting now. You can drag this color to a palette entry, or select this color as current by dragging it to the other color swatch alongside. Top Secret Translated by Transparency of the color. Two Sided Unclassified Unknown Unknown item Unsupported JPEG color space (%s) Unsupported depth for ICO file: %d Unsupported icon type Urgent Validate existing icon cache Volume Volume Down Volume Up Width or height of TIFF image is zero Window Written by X _tilt: X display to use X screen to use XPM file has image height <= 0 XPM file has image width <= 0 Y t_ilt: Yesterday at %H:%M _Add _Add to Bookmarks _After: _Blue: _Bottom: _Clear List _Device: _Family: _Files _Folder name: _Gamma value _Green: _Height: _Hue: _Left: _License _Location: _Mode: _Name: _New Folder _Now _Only print: _Orientation: _Output format _Palette: _Paper size: _Places _Pressure: _Preview: _Red: _Remove _Remove From List _Rename _Rename File _Replace _Reverse _Right: _Saturation: _Save color here _Save in folder: _Selection: _Style: _Top: _Value: _Wheel: _Width: _X: _Y: abcdefghijk ABCDEFGHIJK calendar:MY calendar:week_start:0 default:LTR default:mm inch mm none output.%s test-output.%s Project-Id-Version: gtk+ 2.12.1
Report-Msgid-Bugs-To:
POT-Creation-Date: 2010-06-10 11:56-0400
PO-Revision-Date: 2007-09-22 14:13-0500
Last-Translator: Michael Terry
Language-Team: Ido
Language: io
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=2; plural=n != 1;
"%s" ne povis esar konvertita ad valoro de tipo "%s" por atributo "%s" "%s" ne es valida atributala nomo "%s" ne es valida atributala tipo "%s" ne es valida valoro por atributo "%s" "Profundeso" di la koloro. %1$s an %2$s %s tasko #%d (Nula) (nekapabla) (nekonocata) <%s>-elemento havas invalida id "%s" <%s>-elemento havas nek "name" nek "id" atributo <%s>-elemento ja specigabas -elemento ne povas eventar avane -elemento Dokumento nomizita "%s" ja existas. Ka vu deziras remplasar ol? A_d: Pri %s Adjuntez la nuna dokumentuyo a la markorubandi Adjuntez la dokumentuyo '%s' a la markorubandi Adjuntez la selektata dokumentuyo a la Markorubandi Adjuntez la selektata dokumentuyi a la markorubandi Omna folii Amharala (EZ+) Quanto de blua lumo en la koloro. Quanto de verda lumo en la koloro. Quanto de reda lumo en la koloro. Anomima tago trovis ed tagi ne povas kreesar. Programo Artaji da Atributo "%s" es nevalida sur <%s>-elemento en ica kuntexto Atributo "%s" repetis duople sur la sama <%s>-elemento Axi _Avan: Due "id" ed "name" esis trovita sur la <%s>-elemento Lumozeso di la koloro. KLASO KOLORI K_olacionez K_reez K_rediti Trovajarala dokumento kreis sucesante.
Ne povas asignar koloromapa elementi Ne povas asignar koloromapa strukturo Ne povas asignar nova imajobufro Ne povas lektar XPM-koloromapo Cedilio _Vakuigez Klasifikita Koloro Kolorala Selektajo Kolora Roto Kolorala _nomo: Imperala Lineo Konfidencala _Kopiuri: Kopiuri Kopiez URL Kopiez _Loko Ne povis adjuntar markorubando Ne povis vakuigez listo Ne povis aquirar imajala alteso (mala TIFF dokumento) Ne povis aquirar imajala larjeso (mala TIFF dokumento) Ne povis aquirar informo pri dokumento '%s': %s Ne povis acensar %s Ne povis forigar markorubando Ne povis forigar elemento Ne povis retronomizar %s a %s: %s.
Ne povis rinomizar %s a %s: %s
No povis rinomizar %s ad %s: %s, do forigas %s.
Ne povis aquirar informo pri la dokumento Ne povis selektar dokumento Ne povis startar la sercha procedo Ne povis konvertar dokumentonomo Ne povis krear nova imajobufro Ne povis skribar ad BMP-dokumento Kreez _Dokumentuyo Kreez en _dokumentuyo: Krediti Desnormala Grandeso %d Desnormala grandeso VIDIGILO _Efacez Dokumento Efacez Dokumento Pupitrosupro Nekapabla Dokumentizita da Elemento <%s> ne es permisata sub <%s> Vakua Eroro dum kreas dokumentuyo '%s': %s Eroro dum efacas dokumento '%s': %s Eroro dum charjas ikono: %s Eroro dum imprimado Eroro dum rinomizas dokumento "%s" ad "%s": %s Eroro dum rinomizas dokumento "%s": %s Eroro dum rinomizas dokumento ad "%s": %s Eroro dum skribas ad imajala dokumento: %s Para folii Ecesa donaji en dokumento FLAGI Faliis klozar '%s' dum skribas imajo, omna donaji forsan ne esabas salvita: %s Faliis charjar RVB-donaji de TIFF-dokumento Faliis charjar TIFF-imajo Faliis charjar ikono Faliis apertar imajo '%s': %s Faliis apertar '%s' por skribo: %s Faliis apertar TIFF-imajo Faliis apertar dokumento '%s': %s Faliis apertar tempala dokumento Faliis lektar de tempala dokumento Faliis riskribar kapo
Faliis salvar TIFF-imajo Faliis skribar TIFF-donaji Faliis skribar trovajarala dokumento: %s
Faliis skribar dokumentuyala indexo
Faliis skribar hachotabelo
Faliis skribar kapo
Faliis skribar a tempala dokumento dum ke charjis XBM-imajo Faliis skribar a tempala dokumento dum ke charjis XPM-imajo Eroro dum lektas GIF: %s Dokumento Dokumenta Sistemo Dokumento netrovita: %s
Dokumenti Finanta _Dokumentuyi Dokumentuyi Tiparo Tiparala Selektajo Plena Lauteso GTK+ Selekti Lumozeso Generala Alta Ikono havas zera alteso Ikono havas zera larjeso Imajala Qualeso Imajala formato nekonocata Imajo havas nesuportata bpp Imajo havas zera alteso Imajo havas zera larjeso Imajala kapo es koruptita Imajala tipo '%s' es nesuportata Nevalida URI Nevalida UTF-8 Nevalida XBM-dokumento Nevalida dokumenta nomo Nevalida kapo en animo Nevalida kapo en ikono Tasko Taskala Detali Klavi LRM _Sinistra-a-dextra marko Traso Yurizo Charjez plusa GTK+-moduli Loko Basa MODULI Direktez Desnormala Grandesi Direktez Desnormala Grandesi... Marjini de Imprimilo... Marjini:
Sinistra: %s %s
Dextra: %s %s
Supra: %s %s
Infra: %s %s Meza Modifikita Tacigata NOMO Nomo Nomo tro longa Nova Dokumentuyo Nula elemteni trovita Nula Nedisponebla Nepara folii Unlatera Op_akeso: Apertez '%s' Altra... Ne plusa papero Maxim extera elemento en texto mustas esar ne <%s> Produkturala Pleto Produkturala _pleto: PDF PNM dokumento havas imajala alteso de 0 PNM dokumento havas imajala larjeso de 0 Pagino %u Pagina Establiso Pagini Po Folio Pagini po _folio: Pagini po _latero: Papero Paperala Marjini Paperala Grandeso Paperala Fonto Paperala Tipo Paperala _fonto: Paperala _tipo: Pauzita Selektez Koloro Selektez Tiparo Loki Loko en la kolora roto. Posskribajo Preparas Preparas %d Pri_oreso: Imprimez Imprimez Dokumento Imprimez a Dokumento Imprimez a LPR Imprimez a Testa Imprimilo Imprimilo Imprimilo es deskonectata Imprimas %d RLM _Dextra-a-sinistra marko Reale efacar dokumento "%s"? Recevis nevalida kolorala donaji
Forigez Forigez la markorubando '%s' Forigez la selektata markorubando Rinomizez Dokumento Rinomizez dokumento "%s" ad: Rinomizez... SKRENO Sama kam --no-wintab Sen 12 Salvez en _dokumentuyo: Sk_alo: Skreno Serchez Sekreta Selektez Dokumento Seriigata donaji es misforma Seriigata donaji es misforma. Unesma seciono ne es GTKTEXTBUFFERCONTENTS-0001 Montrez GTK+ Selecti Montrez _Celita Dokumenti _Grandeso: Grandeso Specigez un o plu pagina rangi,
exemple 1-3,7,11 Normala Stando TIFFClose-operaco faliis _Dulatera: Tago "%s" ja definita Tago "%s" ne existas en bufro ed tagi ne povas kreesar. Tago "%s" havas nevalida prioreso "%s" Tago "%s" ne esabas definita. La ANI imajala formato La BMP imajala formato La GIF imajala formato La ICO imajala formato La JPEG imajala formato La PCX imajala formato La PNG imajala formato La PNM/PBM/PGM/PPM-imajoformatala familio La TIFF imajala formato La Targa imajala formato La WBMP imajala formato La XBM imajala formato La XPM imajala formato La atributo "%s" esis trovita duople sur la <%s>-elemento La dokumentuyo ne povis kreesar La dokumentuyo ne povis kreesar, pro ke dokumento kun la sama nomo ja existas. Esforcez uzar diferanta nomo por la dokumentuyo, od rinomizez la dokumento unesme. La genitita trovajaro esis nevalida.
La yurizo di la programo La exselektita koloro, por komparado a la koloro ke vu selectas nun. Vu povas tranar ica koloro a piktoplanketa elemento, o selectez ica koloro kom nuna per tranas ol a la altra koloromakulo flanke. Maxim Sekreta Tradukita da Diafaneso di la koloro. Dulatera Neklasifikita Nekonocata Nekonocata elemento Nesuportat JPEG-kolorospaco (%s) Nesuportata profundeso por ICO-dokumento: %d Nesuportata ikonala tipo Urjanta Validigez existanta ikonala trovajaro Lauteso Lauteso Infre Lauteso Supre Larjeso od alteso di TIFF imajo es zero Fenestro Skribita da _X-inklino: X-vidigilo uzota X-skreno uzota XPM dokumento havas imajala alteso <= 0 XPM dokumento havas imajala larjeso <= 0 _Y-inklino: Hiere ad %H:%M _Adjuntez _Adjuntez a markorubandi _Dop: _Bluo: _Bazo: _Vakuigez Listo _Aparato: _Familio: _Dokumenti _Dokumentuya nomo: _Lumozesa valoro _Verdo: _Alteso: _Kolornuanco: _Sinistra: _Yurizo _Loko: _Modo: _Nomo: _Nova Dokumentuyo _Nun _Nur imprimez: _Orientizeso: _Produkturala formato _Piktoplanketo: _Paperala grandeso: _Loki _Presado: _Prevido: _Redo: _Forigez _Forigez de Listo _Rinomizez _Rinomizez Dokumento _Remplasez _Inversigez _Dextra: _Saturajo: _Salvez koloro hike _Salvez en dokumentuyo: _Selektajo: _Stilo: _Suprajo: _Valoro: _Roto: _Largeso: _X: _Y: abcdefghijk ABCDEFGHIJK calendar:YM calendar:week_start:1 default:LTR default:mm inch mm nula produkturo.%s testa-produkturo.%s PK ! o o LC_MESSAGES/gdk-pixbuf.monu [ : O " = X * q ) N 0 & # 9 " W z 8 8 8 M a v ! 5 W x
' '
O
e
|
!
"
% = \ z $ 0
% U
{
5
6
( ! G * i N + ) C " a ! " ; 8 ; t 1 I b | ' (
3 L c z ) 0 I a x , ' ' ( F , 0 . 1 + ! ( ) 5 6 4 &
8 3 " ' : - / % 7 9 $ # 2 * Cannot allocate colormap entries Cannot allocate colormap structure Cannot allocate new pixbuf Cannot read XPM colormap Could not get image height (bad TIFF file) Could not get image width (bad TIFF file) Couldn't create new pixbuf Couldn't write to BMP file Error writing to image file: %s Excess data in file Failed to close '%s' while writing image, all data may not have been saved: %s Failed to load RGB data from TIFF file Failed to load TIFF image Failed to load image '%s': %s Failed to open '%s' for writing: %s Failed to open TIFF image Failed to open file '%s': %s Failed to open temporary file Failed to read from temporary file Failed to save TIFF image Failed to write TIFF data Failed to write to temporary file when loading XBM image Failed to write to temporary file when loading XPM image Failure reading GIF: %s Icon has zero height Icon has zero width Image format unknown Image has unsupported bpp Image has zero height Image has zero width Image header corrupt Image type '%s' is not supported Invalid XBM file Invalid header in animation Invalid header in icon PNM file has an image height of 0 PNM file has an image width of 0 TIFFClose operation failed The ANI image format The BMP image format The GIF image format The ICO image format The JPEG image format The PCX image format The PNG image format The PNM/PBM/PGM/PPM image format family The TIFF image format The Targa image format The WBMP image format The XBM image format The XPM image format Unsupported JPEG color space (%s) Unsupported depth for ICO file: %d Unsupported icon type Width or height of TIFF image is zero XPM file has image height <= 0 XPM file has image width <= 0 Project-Id-Version: gtk+ 2.12.1
Report-Msgid-Bugs-To: http://bugzilla.gnome.org/enter_bug.cgi?product=gdk-pixbuf
POT-Creation-Date: 2012-02-04 18:44-0500
PO-Revision-Date: 2007-09-22 14:13-0500
Last-Translator: Michael Terry
Language-Team: Ido
Language: io
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Plural-Forms: nplurals=2; plural=n != 1;
Ne povas asignar koloromapa elementi Ne povas asignar koloromapa strukturo Ne povas asignar nova imajobufro Ne povas lektar XPM-koloromapo Ne povis aquirar imajala alteso (mala TIFF dokumento) Ne povis aquirar imajala larjeso (mala TIFF dokumento) Ne povis krear nova imajobufro Ne povis skribar ad BMP-dokumento Eroro dum skribas ad imajala dokumento: %s Ecesa donaji en dokumento Faliis klozar '%s' dum skribas imajo, omna donaji forsan ne esabas salvita: %s Faliis charjar RVB-donaji de TIFF-dokumento Faliis charjar TIFF-imajo Faliis apertar imajo '%s': %s Faliis apertar '%s' por skribo: %s Faliis apertar TIFF-imajo Faliis apertar dokumento '%s': %s Faliis apertar tempala dokumento Faliis lektar de tempala dokumento Faliis salvar TIFF-imajo Faliis skribar TIFF-donaji Faliis skribar a tempala dokumento dum ke charjis XBM-imajo Faliis skribar a tempala dokumento dum ke charjis XPM-imajo Eroro dum lektas GIF: %s Ikono havas zera alteso Ikono havas zera larjeso Imajala formato nekonocata Imajo havas nesuportata bpp Imajo havas zera alteso Imajo havas zera larjeso Imajala kapo es koruptita Imajala tipo '%s' es nesuportata Nevalida XBM-dokumento Nevalida kapo en animo Nevalida kapo en ikono PNM dokumento havas imajala alteso de 0 PNM dokumento havas imajala larjeso de 0 TIFFClose-operaco faliis La ANI imajala formato La BMP imajala formato La GIF imajala formato La ICO imajala formato La JPEG imajala formato La PCX imajala formato La PNG imajala formato La PNM/PBM/PGM/PPM-imajoformatala familio La TIFF imajala formato La Targa imajala formato La WBMP imajala formato La XBM imajala formato La XPM imajala formato Nesuportat JPEG-kolorospaco (%s) Nesuportata profundeso por ICO-dokumento: %d Nesuportata ikonala tipo Larjeso od alteso di TIFF imajo es zero XPM dokumento havas imajala alteso <= 0 XPM dokumento havas imajala larjeso <= 0 PK ! ,:< < __init__.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
# fix xmlplus to be compatible with the python xml sax parser and python 3
# by adding __contains__ to xml.sax.xmlreader.AttributesImpl
import xml
if "_xmlplus" in xml.__file__:
from xml.sax.xmlreader import AttributesImpl
if not hasattr(AttributesImpl, "__contains__"):
# this is missing:
def __AttributesImpl__contains__(self, name):
return name in getattr(self, "_attrs")
# add it using the name __contains__
setattr(AttributesImpl, "__contains__", __AttributesImpl__contains__)
from xml.sax.saxutils import XMLGenerator
if not hasattr(XMLGenerator, "_write"):
# this is missing:
def __XMLGenerator_write(self, text):
getattr(self, "_out").write(text)
# add it using the name _write
setattr(XMLGenerator, "_write", __XMLGenerator_write)
PK ! / helper.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
__all__ = [ "Helper", "helper_reader", "helper_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import u2b_if_py2
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \
check_tcpudp
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class Helper(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "family", "", ), # s
( "module", "", ), # s
( "ports", [ ( "", "" ), ], ), # a(ss)
)
DBUS_SIGNATURE = '(sssssa(ss))'
ADDITIONAL_ALNUM_CHARS = [ "-", "." ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"helper": [ "module" ],
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"helper": [ "name", "version", "family" ],
"port": [ "port", "protocol" ],
}
def __init__(self):
super(Helper, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.module = ""
self.family = ""
self.ports = [ ]
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.module = ""
self.family = ""
del self.ports[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.module = u2b_if_py2(self.module)
self.family = u2b_if_py2(self.family)
self.ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr) in self.ports]
def check_ipv(self, ipv):
ipvs = [ 'ipv4', 'ipv6' ]
if ipv not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"'%s' not in '%s'" % (ipv, ipvs))
def _check_config(self, config, item, all_config):
if item == "ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item == "module":
if not config.startswith("nf_conntrack_"):
raise FirewallError(
errors.INVALID_MODULE,
"'%s' does not start with 'nf_conntrack_'" % config)
if len(config.replace("nf_conntrack_", "")) < 1:
raise FirewallError(errors.INVALID_MODULE,
"Module name '%s' too short" % config)
# PARSER
class helper_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "helper":
if "version" in attrs:
self.item.version = attrs["version"]
if "family" in attrs:
self.item.check_ipv(attrs["family"])
self.item.family = attrs["family"]
if "module" in attrs:
if not attrs["module"].startswith("nf_conntrack_"):
raise FirewallError(
errors.INVALID_MODULE,
"'%s' does not start with 'nf_conntrack_'" % \
attrs["module"])
if len(attrs["module"].replace("nf_conntrack_", "")) < 1:
raise FirewallError(
errors.INVALID_MODULE,
"Module name '%s' too short" % attrs["module"])
self.item.module = attrs["module"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "port":
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (attrs["port"], attrs["protocol"])
if entry not in self.item.ports:
self.item.ports.append(entry)
else:
log.warning("Port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
def helper_reader(filename, path):
helper = Helper()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
helper.name = filename[:-4]
helper.check_name(helper.name)
helper.filename = filename
helper.path = path
helper.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
helper.default = helper.builtin
handler = helper_ContentHandler(helper)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_HELPER,
"not a valid helper file: %s" % \
msg.getException())
del handler
del parser
if PY2:
helper.encode_strings()
return helper
def helper_writer(helper, path=None):
_path = path if path else helper.path
if helper.filename:
name = "%s/%s" % (_path, helper.filename)
else:
name = "%s/%s.xml" % (_path, helper.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start helper element
attrs = {}
attrs["module"] = helper.module
if helper.version and helper.version != "":
attrs["version"] = helper.version
if helper.family and helper.family != "":
attrs["family"] = helper.family
handler.startElement("helper", attrs)
handler.ignorableWhitespace("\n")
# short
if helper.short and helper.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(helper.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if helper.description and helper.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(helper.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# ports
for port in helper.ports:
handler.ignorableWhitespace(" ")
handler.simpleElement("port", { "port": port[0], "protocol": port[1] })
handler.ignorableWhitespace("\n")
# end helper element
handler.endElement('helper')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! Cc== = direct.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.fw_types import LastUpdatedOrderedDict
from firewall.functions import splitArgs, joinArgs, u2b_if_py2
from firewall.core.io.io_object import IO_Object, IO_Object_ContentHandler, \
IO_Object_XMLGenerator
from firewall.core.logger import log
from firewall.core import ipXtables
from firewall.core import ebtables
from firewall import errors
from firewall.errors import FirewallError
class direct_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self.direct = False
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "direct":
if self.direct:
raise FirewallError(errors.PARSE_ERROR,
"More than one direct tag.")
self.direct = True
elif name == "chain":
if not self.direct:
log.error("Parse Error: chain outside of direct")
return
ipv = attrs["ipv"]
table = attrs["table"]
chain = attrs["chain"]
self.item.add_chain(u2b_if_py2(ipv), u2b_if_py2(table),
u2b_if_py2(chain))
elif name == "rule":
if not self.direct:
log.error("Parse Error: rule outside of direct")
return
ipv = attrs["ipv"]
if ipv not in [ "ipv4", "ipv6", "eb" ]:
raise FirewallError(errors.INVALID_IPV,
"'%s' not from {'ipv4'|'ipv6'|'eb'}" % ipv)
table = attrs["table"]
chain = attrs["chain"]
try:
priority = int(attrs["priority"])
except ValueError:
log.error("Parse Error: %s is not a valid priority" %
attrs["priority"])
return
self._rule = [ u2b_if_py2(ipv), u2b_if_py2(table),
u2b_if_py2(chain), priority ]
elif name == "passthrough":
if not self.direct:
log.error("Parse Error: command outside of direct")
return
ipv = attrs["ipv"]
self._passthrough = [ u2b_if_py2(ipv) ]
else:
log.error('Unknown XML element %s' % name)
return
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
if name == "rule":
if self._element:
# add arguments
self._rule.append([ u2b_if_py2(x)
for x in splitArgs(self._element) ])
self.item.add_rule(*self._rule)
else:
log.error("Error: rule does not have any arguments, ignoring.")
self._rule = None
elif name == "passthrough":
if self._element:
# add arguments
self._passthrough.append([ u2b_if_py2(x)
for x in splitArgs(self._element) ])
self.item.add_passthrough(*self._passthrough)
else:
log.error("Error: passthrough does not have any arguments, " +
"ignoring.")
self._passthrough = None
class Direct(IO_Object):
""" Direct class """
IMPORT_EXPORT_STRUCTURE = (
# chain: [ ipv, table, [ chain ] ]
( "chains", [ ( "", "", "" ), ], ), # a(sss)
# rule: [ ipv, table, chain, [ priority, [ arg ] ] ]
( "rules", [ ( "", "", "", 0, [ "" ] ), ], ), # a(sssias)
# passthrough: [ ipv, [ [ arg ] ] ]
( "passthroughs", [ ( "", [ "" ]), ], ), # a(sas)
)
DBUS_SIGNATURE = '(a(sss)a(sssias)a(sas))'
PARSER_REQUIRED_ELEMENT_ATTRS = {
"direct": None,
"chain": [ "ipv", "table", "chain" ],
"rule": [ "ipv", "table", "chain", "priority" ],
"passthrough": [ "ipv" ]
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
}
def __init__(self, filename):
super(Direct, self).__init__()
self.filename = filename
self.chains = LastUpdatedOrderedDict()
self.rules = LastUpdatedOrderedDict()
self.passthroughs = LastUpdatedOrderedDict()
def _check_config(self, conf, item, all_conf):
pass
# check arg lists
def export_config(self):
ret = [ ]
x = [ ]
for key in self.chains:
for chain in self.chains[key]:
x.append(tuple(list(key) + list([chain])))
ret.append(x)
x = [ ]
for key in self.rules:
for rule in self.rules[key]:
x.append(tuple((key[0], key[1], key[2], rule[0],
list(rule[1]))))
ret.append(x)
x = [ ]
for key in self.passthroughs:
for rule in self.passthroughs[key]:
x.append(tuple((key, list(rule))))
ret.append(x)
return tuple(ret)
def import_config(self, conf):
self.cleanup()
self.check_config(conf)
for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE):
if element == "chains":
for x in conf[i]:
self.add_chain(*x)
if element == "rules":
for x in conf[i]:
self.add_rule(*x)
if element == "passthroughs":
for x in conf[i]:
self.add_passthrough(*x)
def cleanup(self):
self.chains.clear()
self.rules.clear()
self.passthroughs.clear()
def output(self):
print("chains")
for key in self.chains:
print(" (%s, %s): %s" % (key[0], key[1],
",".join(self.chains[key])))
print("rules")
for key in self.rules:
print(" (%s, %s, %s):" % (key[0], key[1], key[2]))
for (priority,args) in self.rules[key]:
print(" (%d, ('%s'))" % (priority, "','".join(args)))
print("passthroughs")
for key in self.passthroughs:
print(" %s:" % (key))
for args in self.passthroughs[key]:
print(" ('%s')" % ("','".join(args)))
def _check_ipv(self, ipv):
ipvs = ['ipv4', 'ipv6', 'eb']
if ipv not in ipvs:
raise FirewallError(errors.INVALID_IPV,
"'%s' not in '%s'" % (ipv, ipvs))
def _check_ipv_table(self, ipv, table):
self._check_ipv(ipv)
tables = ipXtables.BUILT_IN_CHAINS.keys() if ipv in ['ipv4', 'ipv6'] \
else ebtables.BUILT_IN_CHAINS.keys()
if table not in tables:
raise FirewallError(errors.INVALID_TABLE,
"'%s' not in '%s'" % (table, tables))
# chains
def add_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table)
if key not in self.chains:
self.chains[key] = [ ]
if chain not in self.chains[key]:
self.chains[key].append(chain)
else:
log.warning("Chain '%s' for table '%s' with ipv '%s' " % \
(chain, table, ipv) + "already in list, ignoring")
def remove_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table)
if key in self.chains and chain in self.chains[key]:
self.chains[key].remove(chain)
if len(self.chains[key]) == 0:
del self.chains[key]
else:
raise ValueError( \
"Chain '%s' with table '%s' with ipv '%s' not in list" % \
(chain, table, ipv))
def query_chain(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table)
return (key in self.chains and chain in self.chains[key])
def get_chains(self, ipv, table):
self._check_ipv_table(ipv, table)
key = (ipv, table)
if key in self.chains:
return self.chains[key]
else:
raise ValueError("No chains for table '%s' with ipv '%s'" % \
(table, ipv))
def get_all_chains(self):
return self.chains
# rules
def add_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
if key not in self.rules:
self.rules[key] = LastUpdatedOrderedDict()
value = (priority, tuple(args))
if value not in self.rules[key]:
self.rules[key][value] = priority
else:
log.warning("Rule '%s' for table '%s' and chain '%s' " % \
("',".join(args), table, chain) +
"with ipv '%s' and priority %d " % (ipv, priority) +
"already in list, ignoring")
def remove_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
value = (priority, tuple(args))
if key in self.rules and value in self.rules[key]:
del self.rules[key][value]
if len(self.rules[key]) == 0:
del self.rules[key]
else:
raise ValueError("Rule '%s' for table '%s' and chain '%s' " % \
("',".join(args), table, chain) + \
"with ipv '%s' and priority %d not in list" % (ipv, priority))
def remove_rules(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
if key in self.rules:
for value in self.rules[key].keys():
del self.rules[key][value]
if len(self.rules[key]) == 0:
del self.rules[key]
def query_rule(self, ipv, table, chain, priority, args):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
value = (priority, tuple(args))
return (key in self.rules and value in self.rules[key])
def get_rules(self, ipv, table, chain):
self._check_ipv_table(ipv, table)
key = (ipv, table, chain)
if key in self.rules:
return self.rules[key]
else:
raise ValueError("No rules for table '%s' and chain '%s' " %\
(table, chain) + "with ipv '%s'" % (ipv))
def get_all_rules(self):
return self.rules
# # passthrough
#
def add_passthrough(self, ipv, args):
self._check_ipv(ipv)
if ipv not in self.passthroughs:
self.passthroughs[ipv] = [ ]
if args not in self.passthroughs[ipv]:
self.passthroughs[ipv].append(args)
else:
log.warning("Passthrough '%s' for ipv '%s'" % \
("',".join(args), ipv) + "already in list, ignoring")
def remove_passthrough(self, ipv, args):
self._check_ipv(ipv)
if ipv in self.passthroughs and args in self.passthroughs[ipv]:
self.passthroughs[ipv].remove(args)
if len(self.passthroughs[ipv]) == 0:
del self.passthroughs[ipv]
else:
raise ValueError("Passthrough '%s' for ipv '%s'" % \
("',".join(args), ipv) + "not in list")
def query_passthrough(self, ipv, args):
self._check_ipv(ipv)
return ipv in self.passthroughs and args in self.passthroughs[ipv]
def get_passthroughs(self, ipv):
self._check_ipv(ipv)
if ipv in self.passthroughs:
return self.passthroughs[ipv]
else:
raise ValueError("No passthroughs for ipv '%s'" % (ipv))
def get_all_passthroughs(self):
return self.passthroughs
# read
def read(self):
self.cleanup()
if not self.filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % self.filename)
handler = direct_ContentHandler(self)
parser = sax.make_parser()
parser.setContentHandler(handler)
with open(self.filename, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_TYPE,
"Not a valid file: %s" % \
msg.getException())
def write(self):
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.old" % self.filename)
except Exception as msg:
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
f = io.open(self.filename, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start whitelist element
handler.startElement("direct", { })
handler.ignorableWhitespace("\n")
# chains
for key in self.chains:
(ipv, table) = key
for chain in self.chains[key]:
handler.ignorableWhitespace(" ")
handler.simpleElement("chain", { "ipv": ipv, "table": table,
"chain": chain })
handler.ignorableWhitespace("\n")
# rules
for key in self.rules:
(ipv, table, chain) = key
for (priority, args) in self.rules[key]:
if len(args) < 1:
continue
handler.ignorableWhitespace(" ")
handler.startElement("rule", { "ipv": ipv, "table": table,
"chain": chain,
"priority": "%d" % priority })
handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args)))
handler.endElement("rule")
handler.ignorableWhitespace("\n")
# passthroughs
for ipv in self.passthroughs:
for args in self.passthroughs[ipv]:
if len(args) < 1:
continue
handler.ignorableWhitespace(" ")
handler.startElement("passthrough", { "ipv": ipv })
handler.ignorableWhitespace(sax.saxutils.escape(joinArgs(args)))
handler.endElement("passthrough")
handler.ignorableWhitespace("\n")
# end zone element
handler.endElement("direct")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! m ifcfg.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
"""ifcfg file parser"""
__all__ = [ "ifcfg" ]
import os.path
import io
import tempfile
import shutil
from firewall.core.logger import log
from firewall.functions import b2u, u2b, PY2
class ifcfg(object):
def __init__(self, filename):
self._config = { }
self._deleted = [ ]
self.filename = filename
self.clear()
def clear(self):
self._config = { }
self._deleted = [ ]
def cleanup(self):
self._config.clear()
def get(self, key):
return self._config.get(key.strip())
def set(self, key, value):
_key = b2u(key.strip())
self._config[_key] = b2u(value.strip())
if _key in self._deleted:
self._deleted.remove(_key)
def __str__(self):
s = ""
for (key, value) in self._config.items():
if s:
s += '\n'
s += '%s=%s' % (key, value)
return u2b(s) if PY2 else s
# load self.filename
def read(self):
self.clear()
try:
f = open(self.filename, "r")
except Exception as msg:
log.error("Failed to load '%s': %s", self.filename, msg)
raise
for line in f:
if not line:
break
line = line.strip()
if len(line) < 1 or line[0] in ['#', ';']:
continue
# get key/value pair
pair = [ x.strip() for x in line.split("=", 1) ]
if len(pair) != 2:
continue
if len(pair[1]) >= 2 and \
pair[1].startswith('"') and pair[1].endswith('"'):
pair[1] = pair[1][1:-1]
if pair[1] == '':
continue
elif self._config.get(pair[0]) is not None:
log.warning("%s: Duplicate option definition: '%s'", self.filename, line.strip())
continue
self._config[pair[0]] = pair[1]
f.close()
def write(self):
if len(self._config) < 1:
# no changes: nothing to do
return
# handled keys
done = [ ]
try:
temp_file = tempfile.NamedTemporaryFile(
mode='wt',
prefix="%s." % os.path.basename(self.filename),
dir=os.path.dirname(self.filename), delete=False)
except Exception as msg:
log.error("Failed to open temporary file: %s" % msg)
raise
modified = False
empty = False
try:
f = io.open(self.filename, mode='rt', encoding='UTF-8')
except Exception as msg:
if os.path.exists(self.filename):
log.error("Failed to open '%s': %s" % (self.filename, msg))
raise
else:
f = None
else:
for line in f:
if not line:
break
# remove newline
line = line.strip("\n")
if len(line) < 1:
if not empty:
temp_file.write(u"\n")
empty = True
elif line[0] == '#':
empty = False
temp_file.write(line)
temp_file.write(u"\n")
else:
p = line.split("=", 1)
if len(p) != 2:
empty = False
temp_file.write(line+u"\n")
continue
key = p[0].strip()
value = p[1].strip()
if len(value) >= 2 and \
value.startswith('"') and value.endswith('"'):
value = value[1:-1]
# check for modified key/value pairs
if key not in done:
if key in self._config and self._config[key] != value:
empty = False
temp_file.write(u'%s=%s\n' % (key,
self._config[key]))
modified = True
elif key in self._deleted:
modified = True
else:
empty = False
temp_file.write(line+u"\n")
done.append(key)
else:
modified = True
# write remaining key/value pairs
if len(self._config) > 0:
for (key, value) in self._config.items():
if key in done:
continue
if not empty:
empty = True
temp_file.write(u'%s=%s\n' % (key, value))
modified = True
if f:
f.close()
temp_file.close()
if not modified: # not modified: remove tempfile
os.remove(temp_file.name)
return
# make backup
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.bak" % self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
# copy tempfile
try:
shutil.move(temp_file.name, self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Failed to create '%s': %s" % (self.filename, msg))
else:
os.chmod(self.filename, 0o600)
PK ! 5 icmptype.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
__all__ = [ "IcmpType", "icmptype_reader", "icmptype_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import u2b_if_py2
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class IcmpType(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "destination", [ "", ], ), # as
)
DBUS_SIGNATURE = '(sssas)'
ADDITIONAL_ALNUM_CHARS = [ "_", "-" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"icmptype": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"icmptype": [ "name", "version" ],
"destination": [ "ipv4", "ipv6" ],
}
def __init__(self):
super(IcmpType, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.destination = [ ]
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
del self.destination[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.destination = [u2b_if_py2(m) for m in self.destination]
def _check_config(self, config, item, all_config):
if item == "destination":
for destination in config:
if destination not in [ "ipv4", "ipv6" ]:
raise FirewallError(errors.INVALID_DESTINATION,
"'%s' not from {'ipv4'|'ipv6'}" % \
destination)
# PARSER
class icmptype_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "icmptype":
if "name" in attrs:
log.warning("Ignoring deprecated attribute name='%s'" %
attrs["name"])
if "version" in attrs:
self.item.version = attrs["version"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "destination":
for x in [ "ipv4", "ipv6" ]:
if x in attrs and \
attrs[x].lower() in [ "yes", "true" ]:
self.item.destination.append(str(x))
def icmptype_reader(filename, path):
icmptype = IcmpType()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"%s is missing .xml suffix" % filename)
icmptype.name = filename[:-4]
icmptype.check_name(icmptype.name)
icmptype.filename = filename
icmptype.path = path
icmptype.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
icmptype.default = icmptype.builtin
handler = icmptype_ContentHandler(icmptype)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_ICMPTYPE,
"not a valid icmptype file: %s" % \
msg.getException())
del handler
del parser
if PY2:
icmptype.encode_strings()
return icmptype
def icmptype_writer(icmptype, path=None):
_path = path if path else icmptype.path
if icmptype.filename:
name = "%s/%s" % (_path, icmptype.filename)
else:
name = "%s/%s.xml" % (_path, icmptype.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start icmptype element
attrs = {}
if icmptype.version and icmptype.version != "":
attrs["version"] = icmptype.version
handler.startElement("icmptype", attrs)
handler.ignorableWhitespace("\n")
# short
if icmptype.short and icmptype.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(icmptype.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if icmptype.description and icmptype.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(icmptype.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# destination
if icmptype.destination:
handler.ignorableWhitespace(" ")
attrs = { }
for x in icmptype.destination:
attrs[x] = "yes"
handler.simpleElement("destination", attrs)
handler.ignorableWhitespace("\n")
# end icmptype element
handler.endElement('icmptype')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! z!
* __pycache__/functions.cpython-36.opt-1.pycnu [ 3
Yjy @ s d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ dd ZdS ) N)config)
FirewallError)FirewallConfig) zone_reader)service_reader) ipset_reader)icmptype_reader)
helper_reader)
policy_reader)Direct)LockdownWhitelist)firewalld_confc - C s| t | }t|jtjtjgdt|jtjtj gdt
|j tj tj
gdt|jtjtjgdt|jtjtjgdt|jtjtjgdd}x
|j D ]}x|| d D ]}tj j |sqxt tj |D ]}|j dryD|| d ||}|d
k r||_!|j"|j# || d | W q t$k
rT } z t$|j%d ||j&f W Y d d }~X q t'k
r } zt'd ||f W Y d d }~X qX qW qW qW tj j(tj)r:y$t*tj)}|j+ |j,|j- W np t$k
r } z t$|j%d tj)|j&f W Y d d }~X n6 t'k
r8 } zt'd tj)|f W Y d d }~X nX tj j(tj.ry$t/tj.}|j+ |j,|j- W np t$k
r } z t$|j%d tj.|j&f W Y d d }~X n6 t'k
r } zt'd tj.|f W Y d d }~X nX tj j(tj0rxyt1tj0}|j+ W np t$k
rB } z t$|j%d tj0|j&f W Y d d }~X n6 t'k
rv } zt'd tj0|f W Y d d }~X nX d S ) N)readeradddirs)ZipsethelperZicmptypeZservicezonepolicyr z.xmlr r r r z'%s': %s)r r )2r r Z add_ipsetr ZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSr Z
add_helperZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSr Z add_icmptypeZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESr Z add_serviceZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr Zadd_zoneZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr
Zadd_policy_objectZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIESkeysospathisdirsortedlistdirendswith fw_configZcheck_config_dictZexport_config_dictr codemsg ExceptionisfileZFIREWALLD_DIRECTr read check_configZ
export_configZLOCKDOWN_WHITELISTr ZFIREWALLD_CONFr
) fwr Zreadersr Z_dirfileobjerrorr r& /usr/lib/python3.6/functions.pyr! & sz
&.
($
($
(r! )r Zfirewallr Zfirewall.errorsr Zfirewall.core.fw_configr Zfirewall.core.io.zoner Zfirewall.core.io.servicer Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.io.policyr
Zfirewall.core.io.directr Z#firewall.core.io.lockdown_whitelistr Z firewall.core.io.firewalld_confr
r! r& r& r& r' s PK ! ?xR`/ `/ $ __pycache__/io_object.cpython-36.pycnu [ 3
Yj5 @ s d Z ddddddddgZd d
ljZd d
ljjZd d
lZd d
lZd d lm Z d d l
m Z d d
l m
Z
d dl
mZ d dlmZ ejdk ZG dd deZG dd deZG dd deZG dd deZG dd dejjZG dd dej Z dd Z dd Z d d Z d d Z!d
S ) z5Generic io_object handler, io specific check methods.PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol
check_address N) OrderedDict) functions)b2u)errors)
FirewallError3c @ s| e Zd ZdZf ZdZg Zi Zi Zdd Z dd Z
dd Z d d
Z d d Z
d
d Zdd Zdd Zdd Zdd Zdd ZdS )r z; Abstract IO_Object as base for icmptype, service and zone z()c C s" d| _ d| _d| _d| _d| _d S )N F)filenamepathnamedefaultZbuiltin)self r /usr/lib/python3.6/io_object.py__init__2 s
zIO_Object.__init__c C s6 g }x(| j D ] }|jtjt| |d q W t|S )Nr )IMPORT_EXPORT_STRUCTUREappendcopydeepcopygetattrtuple)r retxr r r
export_config9 s zIO_Object.export_configc C sX i }t dd | jD }x:|D ]2}t| |sA s z0IO_Object.export_config_dict..)dictr r
isinstanceboolr r )r conf type_formatskeyr r r export_config_dict? s
z IO_Object.export_config_dictc C s | j | xt| jD ]~\}\}}t|| tr~g }t }x,|| D ] }||krD|j| |j| qDW ~t| |t j
| qt| |t j
|| qW d S )N) check_config enumerater r& listsetr addsetattrr r )r r( ielementZdummyZ_confZ_setr r r r
import_configG s
zIO_Object.import_configc C s~ | j | xn|D ]f}t| |s0ttjdj|t|| tr`t| |tt j
t j || qt| |t j || qW d S )Nz-Internal error. '{}' is not a valid attribute)
check_config_dicthasattrr r
Z
UNKNOWN_ERRORformatr& r. r1 r
fromkeysr r )r r( r* r r r import_config_dictW s
"z IO_Object.import_config_dictc C sz t |ts(ttjd|tdt|f t|dk r@ttjdx4|D ],}|j rF|| j krFttjd||f qFW d S )Nz'%s' not of type %s, but %sr r" zname can't be emptyz'%s' is not allowed in '%s')
r& strr r
INVALID_TYPEtypelenZ INVALID_NAMEisalnumADDITIONAL_ALNUM_CHARS)r r charr r r
check_namec s
zIO_Object.check_namec C sj t |t | jkr0ttjdt |t | jf i }x&t| jD ]\}\}}|| ||< q@W | j| d S )Nz structure size mismatch %d != %d)r= r r r
r; r- r5 )r r( Z conf_dictr2 r yr r r r, p s zIO_Object.check_configc C sr t dd | jD }xX|D ]P}|dd | jD krDttjdj|| j|| || | j|| || qW d S )Nc S s g | ]}|d |d fqS )r r" r )r# r r r r r$ | s z/IO_Object.check_config_dict..c S s g | ] \}}|qS r r )r# r rB r r r r$ ~ s zoption '{}' is not valid)r% r r r
ZINVALID_OPTIONr7 _check_config_structure
_check_config)r r( r) r* r r r r5 { s
zIO_Object.check_config_dictc C s d S )Nr )r Zdummy1Zdummy2Zdummy3r r r rD s zIO_Object._check_configc C s` t |t|s,ttjd|t|t|f t |trrt|dkrRttjd| x |D ]}| j||d qXW nt |trt|t|krttjd|t|f xt |D ]\}}| j|| | qW nt |t
r\t|j d \}}xn|j D ]b\}}t |t|s,ttjd|t|t|f t |t|sttjd|t|t|f qW d S )Nz'%s' not of type %s, but %sr" zlen('%s') != 1r zlen('%s') != %d) r& r< r r
r; r. r= rC r r- r% items) r r( Z structurer r2 valueZskeyZsvaluer* r r r rC s8
z!IO_Object._check_config_structurec C s |j }d}|| jkrdd}| j| d k rdx:| j| D ],}||krL|j| q4ttjd||f q4W || jkrd}x$| j| D ]}||kr~|j| q~W |sttjd| x |D ]}ttjd||f qW d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)ZgetNames PARSER_REQUIRED_ELEMENT_ATTRSremover r
Z PARSE_ERROR PARSER_OPTIONAL_ELEMENT_ATTRS)r r attrsZ_attrsfoundr r r r parser_check_element_attrs s,
z$IO_Object.parser_check_element_attrsN)__name__
__module__ __qualname____doc__r ZDBUS_SIGNATUREr? rG rI r r! r+ r4 r9 rA r, r5 rD rC rL r r r r r ) s"
!c s$ e Zd Z fddZdd Z ZS )UnexpectedElementErrorc s t t| j || _d S )N)superrQ r r )r r ) __class__r r r s z UnexpectedElementError.__init__c C s
d| j S )NzUnexpected element '%s')r )r r r r __str__ s z UnexpectedElementError.__str__)rM rN rO r rT
__classcell__r r )rS r rQ s rQ c s$ e Zd Z fddZdd Z ZS )MissingAttributeErrorc s t t| j || _|| _d S )N)rR rV r r attribute)r r rW )rS r r r s z MissingAttributeError.__init__c C s d| j | jf S )Nz$Element '%s': missing '%s' attribute)r rW )r r r r rT s z MissingAttributeError.__str__)rM rN rO r rT rU r r )rS r rV s rV c s$ e Zd Z fddZdd Z ZS )UnexpectedAttributeErrorc s t t| j || _|| _d S )N)rR rX r r rW )r r rW )rS r r r s z!UnexpectedAttributeError.__init__c C s d| j | jf S )Nz'Element '%s': unexpected attribute '%s')r rW )r r r r rT s z UnexpectedAttributeError.__str__)rM rN rO r rT rU r r )rS r rX s rX c @ s4 e Zd Zdd Zdd Zdd Zdd Zd d
Zd S ) r c C s || _ d| _d S )Nr )item_element)r rY r r r r s z!IO_Object_ContentHandler.__init__c C s
d| _ d S )Nr )rZ )r r r r
startDocument s z&IO_Object_ContentHandler.startDocumentc C s
d| _ d S )Nr )rZ )r r rJ r r r startElement s z%IO_Object_ContentHandler.startElementc C s* |dkr| j | j_n|dkr&| j | j_d S )Nshort description)rZ rY r] r^ )r r r r r
endElement s z#IO_Object_ContentHandler.endElementc C s | j |jdd7 _ d S )N
)rZ replace)r contentr r r
characters s z#IO_Object_ContentHandler.charactersN)rM rN rO r r[ r\ r_ rd r r r r r s
c @ s< e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
S )r c C sN t jjj| |j| _|j| _i g| _| jd | _ g | _
d| _ d| _ d| _
d S )Nr" zutf-8F)saxhandlerContentHandlerr write_writeflushZ_flushZ _ns_contextsZ_current_contextZ_undeclared_ns_mapsZ _encodingZ_pending_start_elementZ_short_empty_elements)r outr r r r s z IO_Object_XMLGenerator.__init__c C s* t rdd |j D }tjj| || dS )a saxutils.XMLGenerator.startElement() expects name and attrs to be
unicode and bad things happen if any of them is (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
c S s i | ]\}}t |t |qS r )r )r# r rF r r r
s z7IO_Object_XMLGenerator.startElement..N)r rE saxutils XMLGeneratorr\ )r r rJ r r r r\ s z#IO_Object_XMLGenerator.startElementc C s t rX| jdt| x4|j D ](\}}| jdt|tjt|f q W | jd nF| jd| x,|j D ] \}}| jd|tj|f qpW | jd dS )z* slightly modified startElement()
N)r rj r rE rn Z quoteattr)r r rJ rF r r r
simpleElement s z$IO_Object_XMLGenerator.simpleElementc C s t jj| t| dS )z saxutils.XMLGenerator.endElement() expects name to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro r_ r )r r r r r r_ s z!IO_Object_XMLGenerator.endElementc C s t jj| t| dS )z saxutils.XMLGenerator.characters() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro rd r )r rc r r r rd % s z!IO_Object_XMLGenerator.charactersc C s t jj| t| dS )a saxutils.XMLGenerator.ignorableWhitespace() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro ignorableWhitespacer )r rc r r r rr - s z*IO_Object_XMLGenerator.ignorableWhitespaceN) rM rN rO r r\ rq r_ rd rr r r r r r s
c C s t j| }|dkr$ttjd| n`|dkr>ttjd| nF|d krXttjd| n,t|dkr|d |d krttjd| d S ) N z port number in '%s' is too bigr" z'%s' is invalid port rangez port range '%s' is ambiguousr re )r Z getPortRanger r
Z INVALID_PORTr= )ZportZ
port_ranger r r r 5 s
c C s | dkrt tjd| d S )Ntcpudpsctpdccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})ru rv rw rx )r r
INVALID_PROTOCOL)protocolr r r r D s c C s t j| sttj| d S )N)r Z
checkProtocolr r
ry )rz r r r r J s
c C s$ t j| |s ttjd|| f d S )Nz '%s' is not valid %s address)r r r r
Z INVALID_ADDR)ZipvZaddrr r r r N s )"rP __all__Zxml.saxrf Zxml.sax.saxutilsrn r sys collectionsr
Zfirewallr Zfirewall.functionsr r
Zfirewall.errorsr versionr objectr ExceptionrQ rV rX rg rh r ro r r r r r r r r r s0
CPK ! g2 2 % __pycache__/zone.cpython-36.opt-1.pycnu [ 3
YjM @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZmZ ddlmZmZ ddlmZmZmZmZ dd lmZmZmZm Z dd
l m Z dd l m Z dd lm!Z! dd
l"m#Z# G dd d eZ$G dd deZ%dddZ&dddZ'dS )Zone zone_reader zone_writer N)config) checkIPnMask
checkIP6nMaskcheckInterfaceuniqifymax_zone_name_len
u2b_if_py2 check_mac)DEFAULT_ZONE_TARGET ZONE_TARGETS)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)common_startElementcommon_endElementcommon_check_config
common_writer)rich)log)errors)
FirewallErrorc sf e Zd ZdZd@dAdBdCdDd dgfd
dEgfd dgfdFd
dGgfddgfddgfddgfddgfddHgfdIdJfZdddgZddddgddgdgdgdddgdgdddd gddgdddddd gd gdd Zdd ddgd gd!d"gd#d$gd%d&d'd#d(gd%d'd(gd)d*gd+gd,gd- Zed.d/ Z fd0d1Z
d2d3 Z d4d5 Z fd6d7Z
fd8d9Zd:d; Z fdd? Z ZS )Kr z Zone class version short descriptionUNUSEDFtargetservicesports icmp_blocks
masquerade
forward_ports
interfacessources rules_str protocols source_portsicmp_block_inversionforward_-/Nnameportprotocolvalueset)r r zoneservicer1 z
icmp-blockz icmp-typer, z forward-port interfacerulesource destinationr2 z source-portr ZauditZacceptrejectZdropZmarklimitzicmp-block-inversion immutableZenabledzto-portzto-addrfamilyZpriorityaddressmacinvertipsetprefixleveltypeZburst) r5 r$ z forward-portr8 r9 r: r r; r< c C s8 x&t tjD ]\}\}}|| kr |S q W ttjdd S )Nz
index_of()) enumerater IMPORT_EXPORT_STRUCTUREr r Z
UNKNOWN_ERROR)elementiZelZdummy rJ /usr/lib/python3.6/zone.pyindex_ofd s z
Zone.index_ofc s t t| j d| _d| _d| _d| _t| _g | _ g | _
g | _ g | _ d| _
d| _g | _g | _g | _g | _d | _g | _g | _d| _d| _d| _d S )Nr F)superr __init__r r r r r
r r! r" r) r# r, r$ r% r* r& r' fw_configrulesr( r+ combinedapplied)self) __class__rJ rK rN k s, z
Zone.__init__c C s d| _ d| _d| _d| _t| _| jd d = | jd d = | jd d = | j d d = d| _
d| _ | j d d = | j
d d = | jd d = | jd d = d | _| jd d = | jd d = d| _d| _d| _d S )Nr F)r r r r r
r r! r" r) r# r, r$ r% r* r& r' rO rP r( r+ rQ rR )rS rJ rJ rK cleanup s* z Zone.cleanupc C s t | j| _t | j| _t | j| _t | j| _dd | jD | _dd | jD | _dd | jD | _dd | jD | _dd | j D | _ dd | j
D | _
dd | j D | _ d d | j D | _ d
d | j
D | _
d d | jD | _d S )
z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |qS rJ )r ).0srJ rJ rK
s z'Zone.encode_strings..c S s g | ]\}}t |t |fqS rJ )r )rV poprrJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rZ rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rI rJ rJ rK rX s c S s0 g | ](\}}}}t |t |t |t |fqS rJ )r )rV Zp1Zp2Zp3Zp4rJ rJ rK rX s c S s g | ]\}}t |t |fqS rJ )r )rV rY rZ rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rI rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rW rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rW rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rW rJ rJ rK rX s N)r r r r r r! r" r) r# r% r* r& r' rP r( )rS rJ rJ rK encode_strings s zZone.encode_stringsc sN |dkr8dd |D | _ tt| j|dd | j D ntt| j|| d S )Nr( c S s g | ]}t j|d qS ))Zrule_str)r Z Rich_Rule)rV rW rJ rJ rK rX s z$Zone.__setattr__..c S s g | ] }t |qS rJ )str)rV rW rJ rJ rK rX s )rP rM r __setattr__)rS r0 r3 )rT rJ rK r] s zZone.__setattr__c s t t| j }|d= |S )Nr )rM r export_config_dict)rS Zconf)rT rJ rK r^ s zZone.export_config_dictc C sL t | ||| |dkr.|tkr*ttj|n|dkrxl|D ]d}t|sTttj|| jr}|| j krq|| jj
|jkrttjdj ||qW qW d S )Nr r& z)interface '{}' already bound to zone '{}'r' zipset:z&source '{}' already bound to zone '{}')r r r r INVALID_TARGETr ZINVALID_INTERFACErO Z get_zonesr0 Zget_zoner& formatr r r
startswith INVALID_ADDRr' )rS r itemZ
all_configr7 r5 r9 rJ rJ rK
_check_config s6
zZone._check_configc s t t| j| |jdr,ttjd| n|jdrHttjd| n|jddkrhttjd| nnd|kr|d |j d }n|}t
|t krttjd|t
|t | j f | j
r|| j
j krttjdd S )Nr/ z'%s' can't start with '/'z'%s' can't end with '/' zmore than one '/' in '%s'z'Zone of '%s' has %d chars, max is %d %sz+Zones can't have the same name as a policy.)rM r
check_namera r r INVALID_NAMEendswithcountfindlenr
rQ rO Zget_policy_objectsZ
NAME_CONFLICT)rS r0 Z checked_name)rT rJ rK rf s,
zZone.check_namec
C s d| _ d | _d| _d| _d| _x$|jD ]}|| jkr&| jj| q&W x$|jD ]}|| jkrL| jj| qLW x$|jD ]}|| jkrr| jj| qrW x$|j D ]}|| j kr| j j| qW x$|j
D ]}|| j
kr| j
j| qW x$|j D ]}|| j kr| j j| qW |j rd| _ |j
r d| _
x(|jD ] }|| jkr&| jj| q&W x(|jD ] }|| jkrP| jj| qPW x,|jD ]"} | jj| | jjt| qzW |jrd| _d S )NTr )rQ filenamer r r r& appendr' r! r" r) r# r, r$ r% r* rP r( r\ r+ )
rS r5 r7 r9 r6 r1 protoZicmpr, r8 rJ rJ rK combine sL
z Zone.combine)r r )r r )r r )r F)r r )r r )r$ F)r r r r )r r )r+ F)r, F)__name__
__module__ __qualname____doc__rG ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS staticmethodrL rN rU r[ r] r^ rd rf ro
__classcell__rJ rJ )rT rK r ( sx
c @ s$ e Zd Zdd Zdd Zdd ZdS )zone_ContentHandlerc C s" t j| | d | _d| _d | _d S )NF)r rN _rule _rule_errorZ _limit_ok)rS rc rJ rJ rK rN s z zone_ContentHandler.__init__c C s t j| || | jrd S | jj|| t| ||r6d S |dkrd|krVtjd|d d|krj|d | j_d|krtjd|d d|kr|d }|t krt
t j ||dkr|t
kr|| j_n|d kr| jjrtjd
nd | j_n|d krh| jrtjd
d | _d S d|kr.tjd d | _d S |d | jjkrT| jjj|d ntjd|d n8|dkrf| jr | jjrtjdt| j d | _d S d}d|kr|d j d$krd }d } }}d|kr|d }d|kr|d }d|kr|d }tj||||d| j_d S d|krBd|krBtjd d S d|krdd|krdtjd d S d |kr~tjd |d d|krtjd d S d|krt|d rt|d rt|d rt
t j|d d|kr$d |d }|| jj kr| jj j| ntjd |d d|kr|d }|| jj krT| jj j| ntjd |d n:|d!kr| jj rtjd" nd | j_ ntjd#| d S d S )%Nr5 r0 z'Ignoring deprecated attribute name='%s'r r= z,Ignoring deprecated attribute immutable='%s'r r r, z Forward already set, ignoring.Tr7 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r9 z:Invalid rule: More than one source in rule '%s', ignoring.FrA yestruer? r@ rB )rA z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r> z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.zicmp-block-inversionz+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s')ry rz ) r startElementrx rc Zparser_check_element_attrsr r Zwarningr r r r r_ r
r r, rw r& rm r9 r\ lowerr Z Rich_Sourcer r r rb r' r+ ) rS r0 attrsr rA Zaddrr@ rB entryrJ rJ rK r{ & s
z zone_ContentHandler.startElementc C s t j| | t| | d S )N)r
endElementr )rS r0 rJ rJ rK r s z zone_ContentHandler.endElementN)rp rq rr rN r{ r rJ rJ rJ rK rv s prv Fc
C s t }| jds ttjd| | d d |_|s>|j|j | |_||_|j t
j rZdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd| j W Y d d } ~ X nX W d Q R X ~~tr|j |S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid zone file: %s)r rh r r rg r0 rf rl pathra r
ETC_FIREWALLDZbuiltindefaultrv saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZ INVALID_ZONEZ getExceptionr r[ )
rl r Z
no_check_namer5 handlerparserr0 fr9 msgrJ rJ rK r s:
(c C s\ |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< | jtkr*| j|d < |jd | |jd
t| | x8t| jD ]*} |jd |jdd| i |jd
qVW x\t| j D ]N}
|jd d|
kr|jdd|
dd i n|jdd|
i |jd
qW | j r
|jd |jdi |jd
| j r2|jd |jdi |jd
|j d |jd
|j |j! ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r5
z r7 r0 zipset:r9 rB r? zicmp-block-inversionr, )"r rl r0 osexistsshutilZcopy2 Exceptionr errordirnamera r r mkdirior r Z
startDocumentr r r
r{ ZignorableWhitespacer r r& Z
simpleElementr' r+ r, r Z endDocumentclose) r5 r _pathr0 r dirpathr r r} r7 r9 rJ rJ rK r s`
)F)N)(__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
r r Zfirewall.core.baser
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.io.policyr r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r rv r r rJ rJ rJ rK s$
$ x|
PK ! qޝ # __pycache__/icmptype.cpython-36.pycnu [ 3
Yj @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZ ddlmZ dd lmZ dd
lmZ G d d d e ZG d d
d
e
Zdd ZdddZdS )IcmpTypeicmptype_readericmptype_writer N)config)
u2b_if_py2)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)log)errors)
FirewallErrorc sp e Zd ZdddddgffZdZddgZd d d d
Zd dgd d
gdZ fddZdd Z dd Z
dd Z Z S )r version short description destinationz(sssas)_-N)r r icmptypenameipv4ipv6)r r c s* t t| j d| _d| _d| _g | _d S )Nr )superr __init__r r r r )self) __class__ /usr/lib/python3.6/icmptype.pyr 8 s
zIcmpType.__init__c C s" d| _ d| _d| _| jd d = d S )Nr )r r r r )r r r r cleanup? s zIcmpType.cleanupc C s: t | j| _t | j| _t | j| _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |qS r )r ).0mr r r
L s z+IcmpType.encode_strings..N)r r r r r )r r r r encode_stringsE s zIcmpType.encode_stringsc C s2 |dkr.x$|D ] }|dkrt tjd| qW d S )Nr r r z '%s' not from {'ipv4'|'ipv6'})r r )r
r ZINVALID_DESTINATION)r r itemZ
all_configr r r r
_check_configN s
zIcmpType._check_config)r r )r r )r r )
__name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r# r%
__classcell__r r )r r r % s c @ s e Zd Zdd ZdS )icmptype_ContentHandlerc C s t j| || | jj|| |dkrTd|kr>tjd|d d|kr|d | j_nT|dkr^nJ|dkrhn@|dkrx6d D ].}||krv|| j d
krv| jjj t
| qvW d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r yestrue)r r )r+ r, ) r startElementr$ Zparser_check_element_attrsr Zwarningr lowerr appendstr)r r attrsxr r r r- Y s"
z$icmptype_ContentHandler.startElementN)r& r' r( r- r r r r r* X s r* c C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~tr|j |S )
Nz.xmlz%s is missing .xml suffix FTz%s/%srbz not a valid icmptype file: %s)r endswithr
r Z INVALID_NAMEr Z
check_namefilenamepath
startswithr
ETC_FIREWALLDZbuiltindefaultr* saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_ICMPTYPEZ getExceptionr r# ) r7 r8 r handlerparserr fsourcemsgr r r r m s8
(c
C s. |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< |jd | |jd | jrt| jd krt|jd
|jdi |j| j |jd |jd | jr| jd kr|jd
|jdi |j| j |jd |jd | jr|jd
i }x| jD ]} d|| < qW |jd| |jd |jd |jd |j |j ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r
z r r r+ r ) r8 r7 r osexistsshutilZcopy2 Exceptionr errordirnamer9 r r: mkdirior= r
Z
startDocumentr r- ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocumentclose)
r r8 _pathr rC dirpathrA r? r1 r2 r r r r s\
)N)__all__Zxml.saxr< rG rN rI Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
Zfirewall.core.loggerr r Zfirewall.errorsr
r r* r r r r r r s
3 PK ! @* / __pycache__/firewalld_conf.cpython-36.opt-1.pycnu [ 3
Yj5
@ s~ d dl Zd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z ddddd d
d d d
ddddg
Z
G dd deZdS ) N)config)log)b2uu2bPY2 DefaultZone MinimalMark
CleanupOnExitCleanupModulesOnExitLockdown
IPv6_rpfilterIndividualCalls LogDeniedAutomaticHelpersFirewallBackendFlushAllOnReload RFC3964_IPv4AllowZoneDriftingc @ sL e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dS )firewalld_confc C s i | _ g | _|| _| j d S )N)_config_deletedfilenameclear)selfr r $/usr/lib/python3.6/firewalld_conf.py__init__& s zfirewalld_conf.__init__c C s i | _ g | _d S )N)r r )r r r r r , s zfirewalld_conf.clearc C s | j j g | _d S )N)r r r )r r r r cleanup0 s
zfirewalld_conf.cleanupc C s | j j|j S )N)r getstrip)r keyr r r r 4 s zfirewalld_conf.getc C s8 t |j }t |j | j|< || jkr4| jj| d S )N)r r r r remove)r r valueZ_keyr r r set7 s
zfirewalld_conf.setc C sH d}x2| j j D ]$\}}|r$|d7 }|d||f 7 }qW trDt|S |S )N
z%s=%s)r itemsr r )r sr r" r r r __str__= s zfirewalld_conf.__str__c C s | j yt| jd}W n8 tk
rR } ztjd| j| | jdtj | jdt tj
| jdtj rpdnd | jdtj rdnd | jd tj
rdnd | jd
tjrdnd | jd tjrdnd | jd tj | jd
tj | jdtj | jdtjr
dnd | jdtjr"dnd | jdtjr:dnd W Y d d }~X nX x|D ]}|shP |j }t|dk s\|d d.krq\dd |jdD }t|dkrtjd|j q\nr|d tkrtjd|j q\nN|d d krtjd |j q\n*| jj|d d k r:tjd |j q\|d | j|d < q\W |j | jdstjd tj | jdt tj | jd}y t | W nP t t fk
r |d k rtj d |r|nd tj
| jdt tj
Y nX | jd}| s|j! d/krJ|d k r2tj d#|r(|nd tj | jdtj rDdnd | jd}| sj|j! d0kr|d k rtj d$|r|nd tj | jdtj rdnd | jd }| s|j! d1kr|d k rtj d%|r|nd tj
| jd tj
rdnd | jd
}| s"|j! d2kr^|d k rFtj d&|r<|nd tj | jd
tjrXdnd | jd }| s~|j! d3kr|d k rtj d'|r|nd tj | jd tjrdnd | jd }| s|tj"kr|d k rtj d(|tj | jd t tj | jd
}| s&|j! tj#kr\|d k rJtj d)|r@|nd tj | jd
t tj | jd}| s~|j! tj$kr|d k rtj d*|r|nd tj | jdt tj | jd}| s|j! d4kr
|d k rtj d+|r|nd tj | jdt tj | jd}| s*|j! d5kr`|d k rNtj d,|rD|nd tj | jdt tj | jd}| s|j! d6kr|d k rtj d-|r|nd tj | jdt tj d S )7NrzFailed to load '%s': %sr r r yesnor
r r r
r r r r r r r #;c S s g | ] }|j qS r )r ).0xr r r
b s z'firewalld_conf.read..= z Invalid option definition: '%s'zInvalid option: '%s'r$ zMissing value: '%s'z!Duplicate option definition: '%s'z0DefaultZone is not set, using default value '%s'z7MinimalMark '%s' is not valid, using default value '%d'falsetruez7CleanupOnExit '%s' is not valid, using default value %sz>CleanupModulesOnExit '%s' is not valid, using default value %sz2Lockdown '%s' is not valid, using default value %sz7IPv6_rpfilter '%s' is not valid, using default value %sz9IndividualCalls '%s' is not valid, using default value %sz3LogDenied '%s' is invalid, using default value '%s'z:AutomaticHelpers '%s' is not valid, using default value %sz9FirewallBackend '%s' is not valid, using default value %sz:FlushAllOnReload '%s' is not valid, using default value %sz6RFC3964_IPv4 '%s' is not valid, using default value %sz;AllowZoneDrifting '%s' is not valid, using default value %s)r- r. )r+ r4 r* r5 )r+ r4 r* r5 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )%r openr Exceptionr errorr# r Z
FALLBACK_ZONEstrZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGr lensplit
valid_keysr r closeint
ValueError TypeErrorZwarninglowerZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUES)r fmsglineZpairr" r r r readF s
zfirewalld_conf.readc : C s t | jdk rd S g }tjjtjs2tjtjd y.tj ddtjj
| j tjj | j dd}W n2 t
k
r } ztjd| W Y d d }~X nX d}d}ytj| j dd d
}W nP t
k
r } z0tjj| j rtjd | j |f nd }W Y d d }~X n6X x0|D ]&}|sP |jd }t |dk rH|s2|jd d
}n|d dkrpd}|j| |jd n|jd}t |dkrd}|j|d q |d j } |d j }
| |kr.| | jkr| j| |
krd}|jd| | j| f d
}n$| | jkrd
}nd}|j|d |j| nd
}q W t | jdkrx^| jj D ]P\} }
| |krjqT| dkrxqT|s|jd d
}|jd| |
f d
}qTW |r|j |j |stj|j d S tjj| j r@ytj | j d| j W nB t
k
r> } z$tj|j t d| j |f W Y d d }~X nX ytj |j| j W nB t
k
r } z$tj|j t d| j |f W Y d d }~X nX tj | j d d S )Nr, i Zwtz%s.F)modeprefixdirdeletez!Failed to open temporary file: %sZrtzUTF-8)rF encodingzFailed to open '%s': %sr% Tr r- r2 r3 z%s=%s
r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si )r r ) r: r ospathexistsr Z
ETC_FIREWALLDmkdirtempfileZNamedTemporaryFilebasenamer dirnamer7 r r8 ior6 r writer; r appendr& r= r! nameshutilZcopy2IOErrorZmovechmod) r doneZ temp_filerC ZmodifiedemptyrB rD pr r" r r r rS s
$ $zfirewalld_conf.writeN) __name__
__module__ __qualname__r r r r r# r( rE rS r r r r r % s r )Zos.pathrK rR rO rV Zfirewallr Zfirewall.core.loggerr Zfirewall.functionsr r r r< objectr r r r r s PK ! qޝ ) __pycache__/icmptype.cpython-36.opt-1.pycnu [ 3
Yj @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZ ddlmZ dd lmZ dd
lmZ G d d d e ZG d d
d
e
Zdd ZdddZdS )IcmpTypeicmptype_readericmptype_writer N)config)
u2b_if_py2)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)log)errors)
FirewallErrorc sp e Zd ZdddddgffZdZddgZd d d d
Zd dgd d
gdZ fddZdd Z dd Z
dd Z Z S )r version short description destinationz(sssas)_-N)r r icmptypenameipv4ipv6)r r c s* t t| j d| _d| _d| _g | _d S )Nr )superr __init__r r r r )self) __class__ /usr/lib/python3.6/icmptype.pyr 8 s
zIcmpType.__init__c C s" d| _ d| _d| _| jd d = d S )Nr )r r r r )r r r r cleanup? s zIcmpType.cleanupc C s: t | j| _t | j| _t | j| _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |qS r )r ).0mr r r
L s z+IcmpType.encode_strings..N)r r r r r )r r r r encode_stringsE s zIcmpType.encode_stringsc C s2 |dkr.x$|D ] }|dkrt tjd| qW d S )Nr r r z '%s' not from {'ipv4'|'ipv6'})r r )r
r ZINVALID_DESTINATION)r r itemZ
all_configr r r r
_check_configN s
zIcmpType._check_config)r r )r r )r r )
__name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r# r%
__classcell__r r )r r r % s c @ s e Zd Zdd ZdS )icmptype_ContentHandlerc C s t j| || | jj|| |dkrTd|kr>tjd|d d|kr|d | j_nT|dkr^nJ|dkrhn@|dkrx6d D ].}||krv|| j d
krv| jjj t
| qvW d S )Nr r z'Ignoring deprecated attribute name='%s'r r r r r r yestrue)r r )r+ r, ) r startElementr$ Zparser_check_element_attrsr Zwarningr lowerr appendstr)r r attrsxr r r r- Y s"
z$icmptype_ContentHandler.startElementN)r& r' r( r- r r r r r* X s r* c C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~tr|j |S )
Nz.xmlz%s is missing .xml suffix FTz%s/%srbz not a valid icmptype file: %s)r endswithr
r Z INVALID_NAMEr Z
check_namefilenamepath
startswithr
ETC_FIREWALLDZbuiltindefaultr* saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_ICMPTYPEZ getExceptionr r# ) r7 r8 r handlerparserr fsourcemsgr r r r m s8
(c
C s. |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< |jd | |jd | jrt| jd krt|jd
|jdi |j| j |jd |jd | jr| jd kr|jd
|jdi |j| j |jd |jd | jr|jd
i }x| jD ]} d|| < qW |jd| |jd |jd |jd |j |j ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r
z r r r+ r ) r8 r7 r osexistsshutilZcopy2 Exceptionr errordirnamer9 r r: mkdirior= r
Z
startDocumentr r- ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocumentclose)
r r8 _pathr rC dirpathrA r? r1 r2 r r r r s\
)N)__all__Zxml.saxr< rG rN rI Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
Zfirewall.core.loggerr r Zfirewall.errorsr
r r* r r r r r r s
3 PK ! (# ( __pycache__/service.cpython-36.opt-1.pycnu [ 3
Yj2 @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZmZmZ ddlmZ dd lmZ dd
lmZ G d d d e ZG d d
d
e
Zdd ZdddZdS )Serviceservice_readerservice_writer N)config)
u2b_if_py2)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol
check_address)log)errors)
FirewallErrorc s e Zd Zd d!d"dd#gfddgfdddifddgfd d$gfd
dgfd dgff
Zd d
gZddddZddgddgdgdgddgddgdgdgdZ fddZdd Zd d Z d d Z
Z S )%r version short descriptionportsmodules destination protocols source_portsincludeshelpers_-N)r r servicenameportprotocolvalueipv4ipv6r )r r! r" moduler z source-portincludehelperc sN t t| j d| _d| _d| _g | _g | _g | _i | _ g | _
g | _ g | _ d S )Nr )
superr __init__r r r r r r r r r r )self) __class__ /usr/lib/python3.6/service.pyr* D s zService.__init__c C sh d| _ d| _d| _| jd d = | jd d = | jd d = | jj | jd d = | j d d = | j
d d = d S )Nr ) r r r r r r r clearr r r )r+ r- r- r. cleanupQ s
zService.cleanupc C s t | j| _t | j| _t | j| _dd | jD | _dd | jD | _dd | jj D | _dd | jD | _dd | j D | _ dd | j
D | _
d d | j D | _ d
S ) z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |t |fqS r- )r ).0poprr- r- r.
d s z*Service.encode_strings..c S s g | ] }t |qS r- )r )r1 mr- r- r. r4 e s c S s i | ]\}}t |t |qS r- )r )r1 kvr- r- r.
f s z*Service.encode_strings..c S s g | ] }t |qS r- )r )r1 r3 r- r- r. r4 g s c S s g | ]\}}t |t |fqS r- )r )r1 r2 r3 r- r- r. r4 h s c S s g | ] }t |qS r- )r )r1 sr- r- r. r4 j s c S s g | ] }t |qS r- )r )r1 r9 r- r- r. r4 k s N) r r r r r r r itemsr r r r )r+ r- r- r. encode_strings] s zService.encode_stringsc C s: |dkrJx>|D ]6}|d dkr8t |d t|d qt|d qW n|dkrjx|D ] }t| qXW n|dkrx|D ] }t |d t|d qxW n|dkrx|D ]*}|dkrttjd
| t||| qW n^|d kr6xR|D ]J}|jd r|jd d}d
|kr|jd
d}t |dk rttj
|qW d S )Nr r r r r r r$ r% z'%s' not in {'ipv4'|'ipv6'}r
nf_conntrack_r r )r$ r% ) r r r
r r ZINVALID_DESTINATIONr
startswithreplacelenZINVALID_MODULE)r+ r itemZ
all_configr! protor r& r- r- r.
_check_configm s8
zService._check_config)r r )r r )r r )r r )r r ) __name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr* r0 r; rD
__classcell__r- r- )r, r. r & s4
c @ s e Zd Zdd ZdS )service_ContentHandlerc C s0 t j| || | jj|| |dkrTd|krxRd D ]J}||krt||| || jjkr&tjd| n|| | jj|< qW n|dkr|d }|jdr~|jdd}d|kr~|jdd}|| jjkr| jjj
| n tjd| n|dkr|d | jjkr| jjj
|d ntjd|d n@|dkr,|d | jjkr | jjj
|d ntjd|d d S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r! r r" z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r# z source-portz)SourcePort '%s/%s' already set, ignoring.r r$ r% z2Destination address for '%s' already set, ignoringr& r= r r z"Module '%s' already set, ignoring.r' z#Include '%s' already set, ignoring.r( z"Helper '%s' already set, ignoring.)r$ r% )r startElementrB Zparser_check_element_attrsr Zwarningr r r r appendr
r r r r r? r@ r r r )r+ r attrsentryxr& r- r- r. rJ s
z#service_ContentHandler.startElementN)rE rF rG rJ r- r- r- r. rI s rI c C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~tr|j |S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbz not a valid service file: %s)r endswithr r Z INVALID_NAMEr Z
check_namefilenamepathr? r
ETC_FIREWALLDZbuiltindefaultrI saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_SERVICEZ getExceptionr r; ) rS rT r handlerparserr fsourcemsgr- r- r. r s8
(c C sr |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< |jd | |jd | jrt| jd krt|jd
|jdi |j| j |jd |jd | jr| jd kr|jd
|jdi |j| j |jd |jd x>| jD ]4} |jd
|jd| d | d d |jd qW x4| j D ]*}
|jd
|jdd|
i |jd qW x>| j D ]4} |jd
|jd| d | d d |jd q s
( mQ PK ! ) ) ' __pycache__/helper.cpython-36.opt-1.pycnu [ 3
Yj @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZ ddlmZ dd lmZ dd
lmZ G d d d e ZG d d
d
e
Zdd ZdddZdS )Helper
helper_reader
helper_writer N)config)
u2b_if_py2)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudp)log)errors)
FirewallErrorc s e Zd Zdd d d d dd gffZdZd d
gZd d dgd Zd
ddgddgdZ fddZdd Z dd Z
dd Z dd Z Z
S )!r version short descriptionfamilymoduleportsz (sssssa(ss))-.N)r r helpernameportprotocol)r r c s6 t t| j d| _d| _d| _d| _d| _g | _d S )Nr ) superr __init__r r r r r r )self) __class__ /usr/lib/python3.6/helper.pyr ; s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d = d S )Nr )r r r r r r )r r! r! r" cleanupD s zHelper.cleanupc C sR t | j| _t | j| _t | j| _t | j| _t | j| _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |t |fqS r! )r ).0ZpoZprr! r! r"
U s z)Helper.encode_strings..N)r r r r r r r )r r! r! r" encode_stringsL s zHelper.encode_stringsc C s( ddg}||kr$t tjd||f d S )NZipv4Zipv6z'%s' not in '%s')r r Z INVALID_IPV)r ZipvZipvsr! r! r" check_ipvW s zHelper.check_ipvc C sz |dkr0xl|D ] }t |d t|d qW nF|dkrv|jdsRttjd| t|jdddk rvttjd| d S ) Nr r r
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r zModule name '%s' too short)r r
startswithr r INVALID_MODULElenreplace)r r itemZ
all_configr r! r! r"
_check_config] s
zHelper._check_config)r r )r r )r r )r r )r r )r r )__name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r# r& r' r/
__classcell__r! r! )r r" r & s$
c @ s e Zd Zdd ZdS )helper_ContentHandlerc C s> t j| || | jj|| |dkrd|kr8|d | j_d|kr\| jj|d |d | j_d|kr|d jdstt j
d|d t |d j dddk rtt j
d |d |d | j_
nz|d
krnp|d krnf|d kr:t|d t|d
|d |d
f}|| jjkr$| jjj| ntjd|d |d
d S )Nr r r r r) z('%s' does not start with 'nf_conntrack_'r r( zModule name '%s' too shortr r r r z#Port '%s/%s' already set, ignoring.)r startElementr. Zparser_check_element_attrsr r' r r* r r r+ r, r- r r r r appendr
Zwarning)r r attrsentryr! r! r" r5 n s>
z"helper_ContentHandler.startElementN)r0 r1 r2 r5 r! r! r! r" r4 m s r4 c C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~tr|j |S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid helper file: %s)r endswithr r Z INVALID_NAMEr Z
check_namefilenamepathr* r
ETC_FIREWALLDZbuiltindefaultr4 saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_HELPERZ getExceptionr r& ) r= r> r handlerparserr fsourcemsgr! r! r" r s8
(c
C sP |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| j|d < | jr | jd
kr | j|d < | jr<| jd
kr<| j|d < |jd
| |jd | jr| jd
kr|jd |jdi |j| j |jd |jd | jr| jd
kr|jd |jdi |j| j |jd |jd x>| j D ]4} |jd |j d| d | d d |jd qW |jd
|jd |j |j ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r r
z r r r r r( )r r ) r> r= r osexistsshutilZcopy2 Exceptionr
errordirnamer* r r? mkdiriorB r
Z
startDocumentr r r r5 ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocumentclose)
r r> _pathr rH dirpathrF rD r7 r r! r! r" r s\
)N)__all__Zxml.saxrA rL rS rN Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
r r Zfirewall.core.loggerr
r Zfirewall.errorsr r r4 r r r! r! r! r" s
G# PK ! h% h% 3 __pycache__/lockdown_whitelist.cpython-36.opt-1.pycnu [ 3
Yj1 @ s d dl jZd dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z d dl m
Z
d dlmZmZmZmZmZmZ d dlmZ d dlmZ G dd d e
ZG d
d d e ZdS ) N)config)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)log)uniqify checkUsercheckUid checkCommand checkContext
u2b_if_py2)errors)
FirewallErrorc @ s e Zd Zdd Zdd ZdS )!lockdown_whitelist_ContentHandlerc C s t j| | d| _d S )NF)r __init__ whitelist)selfitem r (/usr/lib/python3.6/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sV t j| || | jj|| |dkr@| jr6ttjdd| _n|dkrr| js\tj d d S |d }| jj
| n|dkr| jstj d d S d |kryt |d }W n& t k
r tj d
|d d S X | jj
| nd|kr| jj|d n\|d kr@| jstj d d S d
|kr.tj d d S | jj|d
ntj d| d S d S )Nr zMore than one whitelist.Tcommandz)Parse Error: command outside of whitelistnameuserz&Parse Error: user outside of whitelistidz"Parse Error: %s is not a valid uidselinuxz)Parse Error: selinux outside of whitelistcontextzParse Error: no contextzUnknown XML element %s)r startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr error add_commandint
ValueErroradd_uidadd_user add_context)r r Zattrsr uidr r r r ) sJ
z.lockdown_whitelist_ContentHandler.startElementN)__name__
__module__ __qualname__r r r r r r r $ s r c s4 e Zd ZdZddgfddgfddgfddgffZdZd gZd
d gd
d gd
Zddd giZ fddZ dd Z
dd Z dd Z dd Z
dd Zd d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Z d8d9 Z d:d; Z dd? Z d@dA Z!dBdC Z" Z#S )DLockdownWhitelistz LockdownWhitelist class commands contextsusersuidsr z
(asasasai)_Nr r )r r r r r r c s6 t t| j || _d | _g | _g | _g | _g | _d S )N) superr) r filenameparserr* r, r- r. )r r1 ) __class__r r r n s zLockdownWhitelist.__init__c C s |d
kr.x|D ]}| j ||d d | qW nv|dkrLt|sttj|nX|dkrjt|sttj|n:|dkrt|sttj|n |d krt |sttj
|d S ) Nr* r, r- r. r r r r% )r* r, r- r. )
_check_configr r r INVALID_COMMANDr INVALID_CONTEXTr INVALID_USERr
INVALID_UID)r r r Z
all_configxr r r r6 y s
z LockdownWhitelist._check_configc C s4 | j d d = | jd d = | jd d = | jd d = d S )N)r* r, r- r. )r r r r cleanup s zLockdownWhitelist.cleanupc C s: dd | j D | _ dd | jD | _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |qS r )r
).0r; r r r
s z4LockdownWhitelist.encode_strings..c S s g | ] }t |qS r )r
)r= r; r r r r> s c S s g | ] }t |qS r )r
)r= r; r r r r> s N)r* r, r- )r r r r encode_strings s z LockdownWhitelist.encode_stringsc C s@ t |sttj||| jkr,| jj| nttjd| d S )Nz!Command "%s" already in whitelist)r r r r7 r* appendALREADY_ENABLED)r r r r r r s
z LockdownWhitelist.add_commandc C s, || j kr| j j| nttjd| d S )Nz Command "%s" not in whitelist.)r* remover r NOT_ENABLED)r r r r r remove_command s
z LockdownWhitelist.remove_commandc C s
|| j kS )N)r* )r r r r r has_command s z LockdownWhitelist.has_commandc C sB x<| j D ]2}|jdr.|j|d d r:dS q||krdS qW dS )N*r4 TFr5 )r* endswith
startswith)r r Z_commandr r r
match_command s
z LockdownWhitelist.match_commandc C s | j S )N)r* )r r r r get_commands s z LockdownWhitelist.get_commandsc C sD t |sttjt||| jkr0| jj| nttjd| d S )Nz Uid "%s" already in whitelist)r
r r r: strr. r@ rA )r r% r r r r" s
zLockdownWhitelist.add_uidc C s, || j kr| j j| nttjd| d S )NzUid "%s" not in whitelist.)r. rB r r rC )r r% r r r
remove_uid s
z LockdownWhitelist.remove_uidc C s
|| j kS )N)r. )r r% r r r has_uid s zLockdownWhitelist.has_uidc C s
|| j kS )N)r. )r r% r r r match_uid s zLockdownWhitelist.match_uidc C s | j S )N)r. )r r r r get_uids s zLockdownWhitelist.get_uidsc C s@ t |sttj||| jkr,| jj| nttjd| d S )Nz User "%s" already in whitelist)r r r r9 r- r@ rA )r r r r r r# s
zLockdownWhitelist.add_userc C s, || j kr| j j| nttjd| d S )NzUser "%s" not in whitelist.)r- rB r r rC )r r r r r remove_user s
z LockdownWhitelist.remove_userc C s
|| j kS )N)r- )r r r r r has_user s zLockdownWhitelist.has_userc C s
|| j kS )N)r- )r r r r r
match_user s z LockdownWhitelist.match_userc C s | j S )N)r- )r r r r get_users s zLockdownWhitelist.get_usersc C s@ t |sttj||| jkr,| jj| nttjd| d S )Nz!Context "%s" already in whitelist)r r r r8 r, r@ rA )r r r r r r$ " s
z LockdownWhitelist.add_contextc C s, || j kr| j j| nttjd| d S )Nz Context "%s" not in whitelist.)r, rB r r rC )r r r r r remove_context, s
z LockdownWhitelist.remove_contextc C s
|| j kS )N)r, )r r r r r has_context3 s z LockdownWhitelist.has_contextc C s
|| j kS )N)r, )r r r r r
match_context6 s z LockdownWhitelist.match_contextc C s | j S )N)r, )r r r r get_contexts9 s z LockdownWhitelist.get_contextsc C s | j | jjds&ttjd| j t| }tj }|j | y|j
| j W n8 tj k
r } zttj d|j
W Y d d }~X nX ~~tr| j d S )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)r< r1 rG r r Z INVALID_NAMEr saxZ make_parserZsetContentHandlerparseZSAXParseExceptionZ INVALID_TYPEZ getExceptionr r? )r handlerr2 msgr r r read> s"
zLockdownWhitelist.readc C s t jj| jr\ytj| jd| j W n4 tk
rZ } ztd| j|f W Y d d }~X nX t jjtj sxt j
tj d t j | jddd}t
|}|j |jdi |jd x6t| jD ](}|jd |jd
d |i |jd qW x:t| jD ],}|jd |jd d
t|i |jd qW x8t| jD ]*}|jd |jd d |i |jd q0W x8t| jD ]*}|jd |jdd|i |jd qjW |jd |jd |j |j ~d S )Nz%s.oldzBackup of '%s' failed: %si ZwtzUTF-8)modeencodingr
z r r r r r r )ospathexistsr1 shutilZcopy2 ExceptionIOErrorr Z
ETC_FIREWALLDmkdirioopenr Z
startDocumentr ZignorableWhitespacer r* Z
simpleElementr. rK r- r, Z
endElementZ endDocumentclose)r r[ frZ r r% r r r r r writeQ sB $
zLockdownWhitelist.write)$r& r' r( __doc__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r6 r< r? r rD rE rI rJ r" rL rM rN rO r# rP rQ rR rS r$ rT rU rV rW r\ rk
__classcell__r r )r3 r r) W sL
1
r) )Zxml.saxrX r` rg rc Zfirewallr Zfirewall.core.io.io_objectr r r r Zfirewall.core.loggerr Zfirewall.functionsr r r
r r r
r Zfirewall.errorsr r r) r r r r s
3PK ! FmR R ! __pycache__/policy.cpython-36.pycnu [ 3
YjϢ @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
ddlm Z m Z m
Z
ddlmZmZmZ dd lmZmZmZmZmZmZ dd
lmZ dd lm Z dd lm Z dd
l m Z dd Z dd Z!dd Z"dd Z#dd Z$G dd d eZ%G dd deZ&d d dZ'd d dZ(dS ) Policy
policy_reader
policy_writer N)config)checkIPcheckIP6)uniqifymax_policy_name_lenportStr)DEFAULT_POLICY_TARGETPOLICY_TARGETSDEFAULT_POLICY_PRIORITY) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol)rich)log)errors)
FirewallErrorc C s |dkr n|dkrn|dkr| j r`| j jrJtjdt| j d| _dS tj|d | j _dS |d | jj kr| jj j
|d ntjd|d n|dkrN| j r| j jrtjdt| j d| _dS tj |d |d | j _dS t |d t
|d t|d d
|d f}|| jjkr4| jjj
| ntjd |d |d nN|d kr| j r| j jrtjdt| j d| _dS tj|d | j _nBt|d |d | jjkr| jjj
|d ntjd
|d n|dkrh| j r.| j jrtjdt| j d| _dS tj|d | j _dS |d | jjkrT| jjj
|d ntjd|d n4|dkr| j r| j jrtjdt| j d| _dS tj|d | j _dS tjd|d n|dkr2| j r| j jrtjdt| j d| _dS tj | j _n | jjr&tjd nd| j_nj|dkrd}d|krR|d }d}d|krh|d }| j r| j jrtjdt| j d| _dS tj|d |d ||| j _dS t |d t
|d |rt | |r
t| r
t| r
tt j d| t|d d
|d t|d
t|f}|| jj krL| jj j
| n6tjd|d |d |rld| nd|r|d| nd n|d kr@| j r| j jrtjdt| j d| _dS tj |d |d | j _dS t |d t
|d t|d d
|d f}|| jj kr&| jj j
| ntjd |d |d n\|d kr| j sftjd d| _dS | j j!rtjd t| j dS d!}d }d"|kr|d" }d }d#|kr|d# }d$|kr|d$ j" dLkrd}tj#|||| j _!n|dMkr| j stjd+ d| _dS | j j$r0tjd, d| _dS |d'krHtj% | j _$nh|d(krxd } d-|krh|d- } tj&| | j _$n8|d)krtj' | j _$n |d*kr|d. }
tj(|
| j _$| j j$| _)n|d/kr^| j stjd0 dS | j jrtjd1 dS d } d2|kr*|d2 } | dNkr*tjd; d| _dS d<|kr<|d< nd } tj*| | | j _| j j| _)n>|d=kr| j s~tjd> dS | j j+rtjd?t| j d| _dS tj, | j _+| j j+| _)n|d@kr,d }
dA}dB|kr|dB }
|
dOkrtjdE|dB d| _dS dF|krt-|dF }tj.|
|dG| _ np|dHkr| j)sRtjdI d| _dS | j)j/rxtjdJt| j d| _dS |d }tj0||j1dK| j)_/nd!S dS )PNshort descriptionservicez;Invalid rule: More than one element in rule '%s', ignoring.Tnamez#Service '%s' already set, ignoring.portprotocol-z#Port '%s/%s' already set, ignoring.valuez$Protocol '%s' already set, ignoring.z
icmp-blockz&icmp-block '%s' already set, ignoring.z icmp-typez-Invalid rule: icmp-block '%s' outside of rule
masqueradez!Masquerade already set, ignoring.z forward-port zto-portzto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%sz source-portz*Source port '%s/%s' already set, ignoring. destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.Faddressipsetinvertyestrueacceptrejectdropmarkz$Invalid rule: Action outside of rulez"Invalid rule: More than one actiontypesetr z!Invalid rule: Log outside of rulez Invalid rule: More than one loglevelemergalertcriterrorwarningnoticeinfodebugz Invalid rule: Invalid log levelprefixauditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.ruler familyipv4ipv6z&Invalid rule: Rule family "%s" invalidpriority)r: r= limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.burst)r& r' )r( r) r* r+ )r/ r0 r1 r2 r3 r4 r5 r6 )r; r< )2_ruleelementr r3 str _rule_errorr Rich_Serviceitemservicesappend Rich_Portr r r
ports
Rich_Protocolr protocolsRich_IcmpBlock icmp_blocks
Rich_IcmpTypeRich_Masquerader Rich_ForwardPortr r r r INVALID_ADDR
forward_portsRich_SourcePort source_portsr" lowerZRich_Destinationaction Rich_Accept Rich_Reject Rich_Drop Rich_Mark _limit_okZRich_Logr8 Z
Rich_Auditint Rich_Ruler> Z
Rich_Limitget)objr attrsentryto_portZto_addrr% r# r$ Z_typeZ_setr. r7 r: r= r rc /usr/lib/python3.6/policy.pycommon_startElement s
re c C s |dkr| j sy| jj W n6 tk
rR } ztjd|t| j W Y d d }~X nLX t| j| jjkr| jj j
| j | jjj
t| j ntjdt| j d | _d| _ n|d krd | _ d S ) Nr9 z%s: %sz Rule '%s' already set, ignoring.Fr( r) r* r+ r r8 )r( r) r* r+ r r8 ) rC r@ Zcheck Exceptionr r3 rB rE rules_strrulesrG r[ )r_ r erc rc rd common_endElement s & rj c C s t | trdnd}|dkrT| jrT| jj }x$|D ] }||kr0ttjd| q0W n|dkrx$|D ] }t|d t|d qbW nb|dkrx|D ] }t | qW n@|d kr| jr| jj
} x$|D ] }
|
| krttj d
|
qW n|d krx|D ]} t| d t| d | d r>| d
r>ttj d| | d rTt| d | d
rt
| d
rt| d
rttjd| d
qW nT|dkrx&|D ] }t|d t|d qW n |dkrx|D ]} tj| d}
| jr|
jrt |
jtjs t |
jtjr| jj
} |
jj| krLttj d
|
jj nH|
jr| jj|
jj}|jr|
j|jkrttj d|
j|
jjf nL| jrt |
jtjr| jj }|
jj|krttjdj|| j|
jjqW d S )Nr ZZonerF z '%s' not among existing servicesrI r rK rM z"'%s' not among existing icmp typesrR z$'%s' is missing to-port AND to-addr z#to-addr '%s' is not a valid addressrT rg
rich_rules)rule_strz3rich rule family '%s' conflicts with icmp type '%s'z){} '{}': '{}' not among existing services)rg rn )
isinstancer fw_configZ get_servicesr r ZINVALID_SERVICEr r r Z
get_icmptypesZINVALID_ICMPTYPEINVALID_FORWARDr r rQ r r] rA rL rN r r: Z get_icmptyper" rD format)r_ r rE
all_configZobj_typeZexisting_servicesr r protoZexisting_icmptypesZicmptypefwd_portr9 Zobj_richZictrc rc rd common_check_config2 s
rw c C s0 d|j i}|j}|d k r ||d< | jd| d S )Nr r? r> )r r?
simpleElement)handlerr> dr? rc rc rd _handler_add_rich_limitx s
r{ c C s | j rF| j dkrF|jd |jdi |j| j |jd |jd | jr| jdkr|jd |jdi |j| j |jd |jd x6t| jD ](}|jd |jdd|i |jd qW x@t| j D ]2}|jd |jd|d |d
d |jd qW x8t| j
D ]*}|jd |jd d
|i |jd qW x8t| j D ]*}|jd |jdd|i |jd qLW | j r|jd |jdi |jd xt| j
D ]}|jd |d |d
d }|d r|d dkr|d |d< |d r|d dkr|d |d< |jd| |jd qW xBt| jD ]4}|jd |jd|d |d
d |jd q>W xT| jD ]H}i }|jr|j|d< |jd krt|j|d< |jd |jd| |jd |jrVi }|jjr|jj|d< |jjr|jj|d< |jjr$|jj|d< |jjr6d |d < |jd |jd | |jd |jri }|jjrx|jj|d< |jjr|jj|d< |jjrd |d < |jd |jd | |jd |jrxd} i }t|jtj krd} |jj |d< nbt|jtj kr(d} |jj |d< |jj |d < n0t|jtj!krNd } |jj"|d
< n
t|jtj#krfd} nt|jtj$krd} |jj |d< nt|jtj%krd!} |jj |d< nt|jtj&krd} |jj |d< |jj |d < |jj'dkr|jj'|d< |jj(dkrX|jj(|d< nFt|jtj)krBd} |jj |d< |jj |d < nt*t+j,d"t|j |jd |j| | |jd |j-r i }|j-j.r|j-j.|d#< |j-j/r|j-j/|d$< |j-j0r|jd |jd%| |jd& t1||j-j0 |jd' |jd% n|jd |jd%| |jd |j2ri }|j2j0rx|jd |jd(i |jd& t1||j2j0 |jd' |jd( n|jd |jd(| |jd |j3rd}
i }t|j3tj4krd)}
n|t|j3tj5krd*}
|j3jr<|j3j|d+< nNt|j3tj6krd,}
n6t|j3tj7kr*d-}
|j3j8|d.< nt-j9d/t|j3 |j3j0r|jd |j|
| |jd& t1||j3j0 |jd' |j|
n|jd |j|
| |jd |jd |jd |jd qW d S )0Nr! z r
r r r r r rk )r r r r z
icmp-blockr rl zto-portrm zto-addrz forward-portz source-portr: r= r9 r# macr$ Truer% z sourcer" z icmp-typez"Unknown element '%s' in obj_writerr7 r. r z
z
r8 r( r) r, r* r+ r- zUnknown action '%s'):r ignorableWhitespace startElementZ
characters
endElementr r rF rx rI rK rM r rR rT rh r: r= rB r addrr} r$ r% r" rA r, r rD r rH r r rJ r rO rL rN rP rb
to_addressrS r r ZINVALID_OBJECTr r7 r. r> r{ r8 rV rW rX rY rZ r- r3 ) r_ ry r r r ZicmpZforwardr` r9 rA rV rc rc rd
common_writer s\
r c sP e Zd Zd7ZdZeZdgZd8d9d:d;d dgfd
dgfddgfddgfdd?gfd@ddgfddgffZdddgZ dddgdgddgdgdgdddgdddd gddgdddddd gd gdgdgd Z
ddgd d gd!dgd"d#d$d!d%gd"d$d%gd&d'gd(gd)gd*Z fd+d,Z d-d. Z
fd/d0Z fd1d2Zd3d4 Z fd5d6Z ZS )Ar i i r versionr! r r targetrF rI rM r FrR rn rK rT r=
ingress_zones egress_zones_r /Nr r r r r- )r r policyr r z
icmp-blockz icmp-typer z forward-portr9 r r" r z source-portr r8 r( r) r* r+ r> z ingress-zonez egress-zonezto-portzto-addrr: r# r} r% r$ r7 r. r, r? )r z forward-portr9 r r" r r) r> c s t t| j d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ g | _
g | _d | _g | _g | _d| _| j| _d | _g | _g | _d S )Nr! F)superr __init__r r r r r rF rI rK rM r rR rT rq rh rg appliedpriority_defaultr= Zderived_from_zoner r )self) __class__rc rd r s( zPolicy.__init__c C s d| _ d| _d| _t| _| jd d = | jd d = | jd d = | jd d = d| _ | j
d d = | j d d = d | _ | j
d d = | jd d = d| _| j| _| jd d = | jd d = d S )Nr! F)r r r r r rF rI rK rM r rR rT rq rh rg r r r= r r )r rc rc rd cleanup s$ zPolicy.cleanupc s" |dkr| j S ttt| |S d S )Nrn )rg getattrr r )r r )r rc rd __getattr__ s zPolicy.__getattr__c sB |dkr,dd |D | _ dd | j D | _ntt| j|| d S )Nrn c S s g | ]}t j|d qS ))ro )r r] ).0src rc rd
s z&Policy.__setattr__..c S s g | ] }t |qS rc )rB )r r rc rc rd r s )rh rg r r __setattr__)r r r )r rc rd r s zPolicy.__setattr__c
C s t | ||| |dkr2|tkr.ttjd| n|dkrz|| jksX|| jksX|| jk rvttjd|| j| j| jf n|dkrhddg}| j r|| j j
7 }x|D ]}||krttj d | |dkrt ddgt |@ s|d krt |t |g rttj d
| |dkr|dkr8d|kr8d|d ksT|dkrd|krd|d krttj d qW n|d kr|rd|krd|d krttj d
nxd|krd|d krttj dxR|d D ]F}|dkrސq| j j
|}| j rd| j j|krttj dqW n|dkr4x|D ] }tj|d}|jrt|jtjrd|kr|d|d kr|ttj d
nxd|kr,d|d krttj dxR|d D ]F}|dkrq| j j
|}| j rd| j j|krttj dqW q,|jrt|jtjrd|kr,d|d kr@|jjrttjdnt|d r,|jjs`ttjdd|d kr,x|d D ]8}| j j
|}| j rxd| j j|krxttj dqxW nv|jr,t|jtjr,d|kr,xR|d D ]F}|d krq| j j
|}| j rd| j j|krttj dqW q,W n|dkrx|D ]} d|krnd|d krnttj dnd|krDd|d kr| d rttjdnt|d rD| d sttjdd|d krDxD|d D ]8}| j j
|}| j rd| j j|krttj dqW qDW d S ) Nr z'%s' is invalid targetr= zQ%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %sr r ANYHOSTz '%s' not among existing zonesz>'%s' may only contain one of: many regular zones, ANY, or HOSTzF'HOST' can only appear in either ingress or egress zones, but not bothr z.'masquerade' is invalid for egress zone 'HOST'z/'masquerade' is invalid for ingress zone 'HOST'Z
interfaceszR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesrn )ro zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesrR z1'forward-port' is invalid for ingress zone 'HOST'rm )r r )r r )r r )r r )rw r r r INVALID_TARGETpriority_reserved priority_max priority_minZINVALID_PRIORITYrq get_zonesZ INVALID_ZONEr- Zget_zoneZget_zone_config_dictr r] rA rp rO rP r rr rV rZ )
r r rE rt Zexisting_zoneszoneZz_objr9 r_ rv rc rc rd
_check_config s
"
zPolicy._check_configc s t t| j| |jdr,ttjd| n|jdrHttjd| n|jddkrhttjd| njd|kr|d |j d }n|}t
|t krttjd|t
|t f | j r|| j j
krttjdd S )Nr z'%s' can't start with '/'z'%s' can't end with '/'rk zmore than one '/' in '%s'z&Policy of '%s' has %d chars, max is %dz,Policies can't have the same name as a zone.)r r
check_name
startswithr r INVALID_NAMEendswithcountfindlenr rq r Z
NAME_CONFLICT)r r Z checked_name)r rc rd r , s*
zPolicy.check_namei )r r! )r r! )r r! )r r! )r! r! )r F)r! r! r! r! )r! r! )r= r )__name__
__module__ __qualname__r r r
r r ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r r r r
__classcell__rc rc )r rd r Z sr
^c @ s$ e Zd Zdd Zdd Zdd ZdS )policy_ContentHandlerc C s" t j| | d | _d| _d | _d S )NF)r r r@ rC r[ )r rE rc rc rd r H s z policy_ContentHandler.__init__c C s t j| || | jrd S | jj|| t| ||r6d S |dkrd|krR|d | j_d|krjt|d | j_d|kr|d }|t krt
t j ||r|| j_
n^|dkr|d | jjkr| jjj|d ntjd|d n |dkr |d | jjkr| jjj|d ntjd |d n|d
kr| jsFtjd d | _d S | jjrltjd
t| j d | _d S d}d|kr|d j dkrd }d } }}d|kr|d }d|kr|d }d|kr|d }tj||||d| j_d S tjd| d S d S )Nr r r= r z ingress-zoner z(Ingress zone '%s' already set, ignoring.z egress-zonez'Egress zone '%s' already set, ignoring.r z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr% r& r' r# r} r$ )r% zUnknown XML element '%s')r& r' )r r rC rE Zparser_check_element_attrsre r r\ r= r r r r r r rG r r3 r r@ r rB rU r Z Rich_Source)r r r` r r% r r} r$ rc rc rd r N sf
z"policy_ContentHandler.startElementc C s t j| | t| | d S )N)r r rj )r r rc rc rd r s z policy_ContentHandler.endElementN)r r r r r r rc rc rc rd r G s @r Fc
C s t }| jds ttjd| | d d |_|s>|j|j | |_||_|j t
j rZdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd| j W Y d d } ~ X nX W d Q R X ~~|S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid policy file: %s)r r r r r r r filenamepathr r
ETC_FIREWALLDZbuiltindefaultr saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_POLICYZ getException)
r r Z
no_check_namer ry parserr fr msgrc rc rd r s6
(c
C s |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< | j| jkr0t| j|d < | j|d < |jd
| |jd t| | x8t| j D ]*} |jd |j dd| i |jd qfW x8t| j D ]*} |jd |j dd| i |jd qW |j d
|jd |j |j! ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr! r r= r r r| z z ingress-zoner z egress-zone)"r r r osexistsshutilZcopy2rf r r2 dirnamer r r mkdirior r Z
startDocumentr r= r rB r r r r r r rx r r Z endDocumentclose)
r r _pathr r dirpathr ry r` r rc rc rd r sN
)F)N))__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
Zfirewall.core.baser r r
Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr re rj rw r{ r r r r r rc rc rc rd s4
F [ nL
PK ! @* ) __pycache__/firewalld_conf.cpython-36.pycnu [ 3
Yj5
@ s~ d dl Zd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z ddddd d
d d d
ddddg
Z
G dd deZdS ) N)config)log)b2uu2bPY2 DefaultZone MinimalMark
CleanupOnExitCleanupModulesOnExitLockdown
IPv6_rpfilterIndividualCalls LogDeniedAutomaticHelpersFirewallBackendFlushAllOnReload RFC3964_IPv4AllowZoneDriftingc @ sL e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dS )firewalld_confc C s i | _ g | _|| _| j d S )N)_config_deletedfilenameclear)selfr r $/usr/lib/python3.6/firewalld_conf.py__init__& s zfirewalld_conf.__init__c C s i | _ g | _d S )N)r r )r r r r r , s zfirewalld_conf.clearc C s | j j g | _d S )N)r r r )r r r r cleanup0 s
zfirewalld_conf.cleanupc C s | j j|j S )N)r getstrip)r keyr r r r 4 s zfirewalld_conf.getc C s8 t |j }t |j | j|< || jkr4| jj| d S )N)r r r r remove)r r valueZ_keyr r r set7 s
zfirewalld_conf.setc C sH d}x2| j j D ]$\}}|r$|d7 }|d||f 7 }qW trDt|S |S )N
z%s=%s)r itemsr r )r sr r" r r r __str__= s zfirewalld_conf.__str__c C s | j yt| jd}W n8 tk
rR } ztjd| j| | jdtj | jdt tj
| jdtj rpdnd | jdtj rdnd | jd tj
rdnd | jd
tjrdnd | jd tjrdnd | jd tj | jd
tj | jdtj | jdtjr
dnd | jdtjr"dnd | jdtjr:dnd W Y d d }~X nX x|D ]}|shP |j }t|dk s\|d d.krq\dd |jdD }t|dkrtjd|j q\nr|d tkrtjd|j q\nN|d d krtjd |j q\n*| jj|d d k r:tjd |j q\|d | j|d < q\W |j | jdstjd tj | jdt tj | jd}y t | W nP t t fk
r |d k rtj d |r|nd tj
| jdt tj
Y nX | jd}| s|j! d/krJ|d k r2tj d#|r(|nd tj | jdtj rDdnd | jd}| sj|j! d0kr|d k rtj d$|r|nd tj | jdtj rdnd | jd }| s|j! d1kr|d k rtj d%|r|nd tj
| jd tj
rdnd | jd
}| s"|j! d2kr^|d k rFtj d&|r<|nd tj | jd
tjrXdnd | jd }| s~|j! d3kr|d k rtj d'|r|nd tj | jd tjrdnd | jd }| s|tj"kr|d k rtj d(|tj | jd t tj | jd
}| s&|j! tj#kr\|d k rJtj d)|r@|nd tj | jd
t tj | jd}| s~|j! tj$kr|d k rtj d*|r|nd tj | jdt tj | jd}| s|j! d4kr
|d k rtj d+|r|nd tj | jdt tj | jd}| s*|j! d5kr`|d k rNtj d,|rD|nd tj | jdt tj | jd}| s|j! d6kr|d k rtj d-|r|nd tj | jdt tj d S )7NrzFailed to load '%s': %sr r r yesnor
r r r
r r r r r r r #;c S s g | ] }|j qS r )r ).0xr r r
b s z'firewalld_conf.read..= z Invalid option definition: '%s'zInvalid option: '%s'r$ zMissing value: '%s'z!Duplicate option definition: '%s'z0DefaultZone is not set, using default value '%s'z7MinimalMark '%s' is not valid, using default value '%d'falsetruez7CleanupOnExit '%s' is not valid, using default value %sz>CleanupModulesOnExit '%s' is not valid, using default value %sz2Lockdown '%s' is not valid, using default value %sz7IPv6_rpfilter '%s' is not valid, using default value %sz9IndividualCalls '%s' is not valid, using default value %sz3LogDenied '%s' is invalid, using default value '%s'z:AutomaticHelpers '%s' is not valid, using default value %sz9FirewallBackend '%s' is not valid, using default value %sz:FlushAllOnReload '%s' is not valid, using default value %sz6RFC3964_IPv4 '%s' is not valid, using default value %sz;AllowZoneDrifting '%s' is not valid, using default value %s)r- r. )r+ r4 r* r5 )r+ r4 r* r5 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )r* r5 r+ r4 )%r openr Exceptionr errorr# r Z
FALLBACK_ZONEstrZFALLBACK_MINIMAL_MARKZFALLBACK_CLEANUP_ON_EXITZ FALLBACK_CLEANUP_MODULES_ON_EXITZFALLBACK_LOCKDOWNZFALLBACK_IPV6_RPFILTERZFALLBACK_INDIVIDUAL_CALLSZFALLBACK_LOG_DENIEDZFALLBACK_AUTOMATIC_HELPERSZFALLBACK_FIREWALL_BACKENDZ FALLBACK_FLUSH_ALL_ON_RELOADZFALLBACK_RFC3964_IPV4Z FALLBACK_ALLOW_ZONE_DRIFTINGr lensplit
valid_keysr r closeint
ValueError TypeErrorZwarninglowerZLOG_DENIED_VALUESZAUTOMATIC_HELPERS_VALUESZFIREWALL_BACKEND_VALUES)r fmsglineZpairr" r r r readF s
zfirewalld_conf.readc : C s t | jdk rd S g }tjjtjs2tjtjd y.tj ddtjj
| j tjj | j dd}W n2 t
k
r } ztjd| W Y d d }~X nX d}d}ytj| j dd d
}W nP t
k
r } z0tjj| j rtjd | j |f nd }W Y d d }~X n6X x0|D ]&}|sP |jd }t |dk rH|s2|jd d
}n|d dkrpd}|j| |jd n|jd}t |dkrd}|j|d q |d j } |d j }
| |kr.| | jkr| j| |
krd}|jd| | j| f d
}n$| | jkrd
}nd}|j|d |j| nd
}q W t | jdkrx^| jj D ]P\} }
| |krjqT| dkrxqT|s|jd d
}|jd| |
f d
}qTW |r|j |j |stj|j d S tjj| j r@ytj | j d| j W nB t
k
r> } z$tj|j t d| j |f W Y d d }~X nX ytj |j| j W nB t
k
r } z$tj|j t d| j |f W Y d d }~X nX tj | j d d S )Nr, i Zwtz%s.F)modeprefixdirdeletez!Failed to open temporary file: %sZrtzUTF-8)rF encodingzFailed to open '%s': %sr% Tr r- r2 r3 z%s=%s
r r z%s.oldzBackup of '%s' failed: %szFailed to create '%s': %si )r r ) r: r ospathexistsr Z
ETC_FIREWALLDmkdirtempfileZNamedTemporaryFilebasenamer dirnamer7 r r8 ior6 r writer; r appendr& r= r! nameshutilZcopy2IOErrorZmovechmod) r doneZ temp_filerC ZmodifiedemptyrB rD pr r" r r r rS s
$ $zfirewalld_conf.writeN) __name__
__module__ __qualname__r r r r r# r( rE rS r r r r r % s r )Zos.pathrK rR rO rV Zfirewallr Zfirewall.core.loggerr Zfirewall.functionsr r r r< objectr r r r r s PK ! ) ) ! __pycache__/helper.cpython-36.pycnu [ 3
Yj @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZ ddlmZ dd lmZ dd
lmZ G d d d e ZG d d
d
e
Zdd ZdddZdS )Helper
helper_reader
helper_writer N)config)
u2b_if_py2)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudp)log)errors)
FirewallErrorc s e Zd Zdd d d d dd gffZdZd d
gZd d dgd Zd
ddgddgdZ fddZdd Z dd Z
dd Z dd Z Z
S )!r version short descriptionfamilymoduleportsz (sssssa(ss))-.N)r r helpernameportprotocol)r r c s6 t t| j d| _d| _d| _d| _d| _g | _d S )Nr ) superr __init__r r r r r r )self) __class__ /usr/lib/python3.6/helper.pyr ; s zHelper.__init__c C s. d| _ d| _d| _d| _d| _| jd d = d S )Nr )r r r r r r )r r! r! r" cleanupD s zHelper.cleanupc C sR t | j| _t | j| _t | j| _t | j| _t | j| _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |t |fqS r! )r ).0ZpoZprr! r! r"
U s z)Helper.encode_strings..N)r r r r r r r )r r! r! r" encode_stringsL s zHelper.encode_stringsc C s( ddg}||kr$t tjd||f d S )NZipv4Zipv6z'%s' not in '%s')r r Z INVALID_IPV)r ZipvZipvsr! r! r" check_ipvW s zHelper.check_ipvc C sz |dkr0xl|D ] }t |d t|d qW nF|dkrv|jdsRttjd| t|jdddk rvttjd| d S ) Nr r r
nf_conntrack_z('%s' does not start with 'nf_conntrack_'r zModule name '%s' too short)r r
startswithr r INVALID_MODULElenreplace)r r itemZ
all_configr r! r! r"
_check_config] s
zHelper._check_config)r r )r r )r r )r r )r r )r r )__name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r# r& r' r/
__classcell__r! r! )r r" r & s$
c @ s e Zd Zdd ZdS )helper_ContentHandlerc C s> t j| || | jj|| |dkrd|kr8|d | j_d|kr\| jj|d |d | j_d|kr|d jdstt j
d|d t |d j dddk rtt j
d |d |d | j_
nz|d
krnp|d krnf|d kr:t|d t|d
|d |d
f}|| jjkr$| jjj| ntjd|d |d
d S )Nr r r r r) z('%s' does not start with 'nf_conntrack_'r r( zModule name '%s' too shortr r r r z#Port '%s/%s' already set, ignoring.)r startElementr. Zparser_check_element_attrsr r' r r* r r r+ r, r- r r r r appendr
Zwarning)r r attrsentryr! r! r" r5 n s>
z"helper_ContentHandler.startElementN)r0 r1 r2 r5 r! r! r! r" r4 m s r4 c C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~tr|j |S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid helper file: %s)r endswithr r Z INVALID_NAMEr Z
check_namefilenamepathr* r
ETC_FIREWALLDZbuiltindefaultr4 saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_HELPERZ getExceptionr r& ) r= r> r handlerparserr fsourcemsgr! r! r" r s8
(c
C sP |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| j|d < | jr | jd
kr | j|d < | jr<| jd
kr<| j|d < |jd
| |jd | jr| jd
kr|jd |jdi |j| j |jd |jd | jr| jd
kr|jd |jdi |j| j |jd |jd x>| j D ]4} |jd |j d| d | d d |jd qW |jd
|jd |j |j ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r r
z r r r r r( )r r ) r> r= r osexistsshutilZcopy2 Exceptionr
errordirnamer* r r? mkdiriorB r
Z
startDocumentr r r r5 ZignorableWhitespacer Z
charactersZ
endElementr r Z
simpleElementZ endDocumentclose)
r r> _pathr rH dirpathrF rD r7 r r! r! r" r s\
)N)__all__Zxml.saxrA rL rS rN Zfirewallr Zfirewall.functionsr Zfirewall.core.io.io_objectr r r r
r r Zfirewall.core.loggerr
r Zfirewall.errorsr r r4 r r r! r! r! r" s
G# PK ! Vq/ & __pycache__/ifcfg.cpython-36.opt-1.pycnu [ 3
Yj @ s^ d Z dgZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z G dd de
ZdS )zifcfg file parserifcfg N)log)b2uu2bPY2c @ sL e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dS )r c C s i | _ g | _|| _| j d S )N)_config_deletedfilenameclear)selfr r /usr/lib/python3.6/ifcfg.py__init__# s zifcfg.__init__c C s i | _ g | _d S )N)r r )r r r r
r
) s z ifcfg.clearc C s | j j d S )N)r r
)r r r r
cleanup- s z
ifcfg.cleanupc C s | j j|j S )N)r getstrip)r keyr r r
r 0 s z ifcfg.getc C s8 t |j }t |j | j|< || jkr4| jj| d S )N)r r r r remove)r r valueZ_keyr r r
set3 s
z ifcfg.setc C sH d}x2| j j D ]$\}}|r$|d7 }|d||f 7 }qW trDt|S |S )N
z%s=%s)r itemsr r )r sr r r r r
__str__9 s z
ifcfg.__str__c C sB | j yt| jd}W n4 tk
rL } ztjd| j| W Y d d }~X nX x|D ]}|s^P |j }t|dk sT|d dkrqTdd |jd dD }t|d
krqTt|d d
kr|d j d r|d j
d r|d dd |d< |d d krqTn,| j j |d d k r tj
d
| j|j qT|d | j |d < qTW |j d S )NrzFailed to load '%s': %s r #;c S s g | ] }|j qS r )r ).0xr r r
Q s z ifcfg.read..= "r z%%s: Duplicate option definition: '%s')r r )r
openr Exceptionr errorr lensplit
startswithendswithr r Zwarningclose)r fmsglineZpairr r r
readB s2
z
ifcfg.readc : C s t | jdk rd S g }y.tjddtjj| j tjj| jdd}W n2 t k
rv } zt
j d| W Y d d }~X nX d}d}yt j
| jddd }W nN t k
r } z0tjj| jrt
j d
| j|f nd }W Y d d }~X ndX x^|D ]T}|sP |jd }t |dk r(|sD|jd d }q|d
dkrPd}|j| |jd q|jdd}t |dkr~d}|j|d q|d
j } |d j }
t |
dkr|
jdr|
jdr|
dd }
| |kr@| | jkr| j| |
krd}|jd| | j| f d }n$| | jkr"d }nd}|j|d |j| qd }qW t | jd
krxF| jj D ]8\} }
| |krzqd|sd }|jd| |
f d }qdW |r|j |j |stj|j d S tjj| jr8ytj| jd| j W nB t k
r6 } z$tj|j t d| j|f W Y d d }~X nX ytj |j| j W nB t k
r } z$tj|j t d| j|f W Y d d }~X nX tj | jd d S )Nr Zwtz%s.F)modeprefixdirdeletez!Failed to open temporary file: %sZrtzUTF-8)r2 encodingzFailed to open '%s': %sr Tr r r" r# r$ z%s=%s
z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si r% ) r) r tempfileZNamedTemporaryFileospathbasenamer dirnamer' r r( ior& existsr writer* r+ r, r appendr r- r nameshutilZcopy2IOErrorZmovechmod) r doneZ temp_filer/ Zmodifiedemptyr. r0 pr r r r r
r> _ s
$ $z ifcfg.writeN) __name__
__module__ __qualname__r r
r r r r r1 r> r r r r
r " s )__doc____all__Zos.pathr8 r< r7 rA Zfirewall.core.loggerr Zfirewall.functionsr r r objectr r r r r
s PK ! 9), ), __pycache__/ipset.cpython-36.pycnu [ 3
YjU @ s d Z dddgZddljZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZmZmZmZ ddlmZmZmZmZ dd lmZmZ dd
lm Z m Z m Z m Z dd l m!Z! dd lm"Z" dd
l#m$Z$ G dd deZ%G dd deZ&dd Z'dddZ(dS )z$ipset io XML handler, reader, writerIPSet ipset_reader ipset_writer N)config) checkIPcheckIP6 checkIPnMask
checkIP6nMask
u2b_if_py2 check_mac
check_portcheckInterface
checkProtocol)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator) IPSET_TYPESIPSET_CREATE_OPTIONS)check_icmp_namecheck_icmp_type_codecheck_icmpv6_namecheck_icmpv6_type_code)log)errors)
FirewallErrorc s e Zd Zd d d d!dddifddgffZdZd d
d d gZd
d
dgdgd
dZdgdgdZ fddZdd Z dd Z
e dd Z dd Z
fd d Z ZS )"r version short descriptiontypeoptionsentriesz
(ssssa{ss}as)_-:.Nname)r r ipsetoptionentryvalue)r( r) c s< t t| j d| _d| _d| _d| _g | _i | _d| _ d S )Nr F)
superr __init__r r r r r" r! applied)self) __class__ /usr/lib/python3.6/ipset.pyr- C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d = | jj d| _d S )Nr F)r r r r r" r! clearr. )r/ r1 r1 r2 cleanupM s
z
IPSet.cleanupc C s\ t | j| _t | j| _t | j| _t | j| _dd | jj D | _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s i | ]\}}t |t |qS r1 )r
).0kvr1 r1 r2
^ s z(IPSet.encode_strings..c S s g | ] }t |qS r1 )r
)r5 er1 r1 r2
` s z(IPSet.encode_strings..N)r
r r r r r! itemsr" )r/ r1 r1 r2 encode_stringsV s zIPSet.encode_stringsc C sr d}d|kr |d dkr d}|j ds6ttjd| |dd jd}| jd}t|t|ksnt|d k rttjd
| |f xtt|D ]}|| }|| }|d krd |ko|dkrh|d krttjd
|| |f |jd } t| dkrttjd|| ||f x| D ]J}
|dkr2t|
sH|dkrt |
rttjd|
| ||f qW nh|dkr|dkrttjd|| ||f |dkrt
} nt} nt } | |sjttjd|| ||f q|dkr@d |kr|jd } t| dkrttjd|| ||f |dkr0t| d sJ|dkrft | d rfttjd| d | ||f |dkrt
| d s|dkr>t | d r>ttjd| d | ||f n|j dr|dko|dko|dksttjd|| ||f |dkrt
| s&|dkrjt | rjttjd|| ||f q|dkrvt
| s`|dkrjttjd|| f q|dkrld|krL|jd} t| dkrttjd| | d d krP|dkrttjd || f t| d rd | d krttjd | d | f n6| d jd \} }
t| |
sJttjd | d | f qj| d d2kr|dkr|ttjd || f t| d rd | d krttjd"| d | f n6| d jd \} }
t| |
sJttjd"| d | f n^| d d3kr$t| d r$ttjd'| d | f n&t| d sjttjd(| d | f n t|sjttjd)|| f q|d*kr |j d+ryt|d,}W n* tk
r ttjd-|| f Y nX n8y t|}W n* tk
r ttjd-|| f Y nX |dk s
|d.krjttjd-|| f q|d/krZt| sDt|d0krjttjd1|| f qttjd| qW d S )4NZipv4familyinet6Zipv6zhash:zipset type '%s' not usable , z)entry '%s' does not match ipset type '%s'Zipr$ z invalid address '%s' in '%s'[%d] z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r Znetz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'Zportr% zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'/z invalid icmp type '%s' in '%s'icmpv6 ipv6-icmpz invalid icmpv6 type '%s' in '%s'tcpsctpudpudplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'ZmarkZ0x zinvalid mark '%s' in '%s'l Ziface z invalid interface '%s' in '%s')rD rE )rF rG rH rI )
startswithr r
INVALID_IPSETsplitlenZ
INVALID_ENTRYranger r r r endswithr r r r r r r int
ValueErrorr
)r* r! Z
ipset_typer= flagsr; iflagitemZsplitsZ_splitZip_checkZ_type_codeZint_valr1 r1 r2 check_entryb sT
zIPSet.check_entryc C s |dkr |t kr ttjd| |dkrx|j D ]}|tkrNttjd| |dkryt|| }W n, tk
r ttj d||| f Y nX |d k rttj d
||| f q2|d kr2|| dkr2ttj
|| q2W d S )Nr z '%s' is not valid ipset typer! zipset invalid option '%s'timeouthashsizemaxelemz)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer= inetr> )rZ r[ r\ )r] r> ) r r r INVALID_TYPEkeysr rM rR rS
INVALID_VALUEINVALID_FAMILY)r/ r rW Z
all_configkey int_valuer1 r1 r2
_check_config& s2
zIPSet._check_configc sr d|d kr6|d d dkr6t |d dkr6ttjx&|d D ]}tj||d |d q@W tt| j| d S )NrZ 0r? r )rO r r ZIPSET_WITH_TIMEOUTr rY r,
import_config)r/ r r* )r0 r1 r2 rh A s
zIPSet.import_config)r r )r r )r r )r r )__name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr- r4 r< staticmethodrY rd rh
__classcell__r1 r1 )r0 r2 r , s,
Ec @ s e Zd Zdd Zdd ZdS )ipset_ContentHandlerc
C s t j| || | jj|| |dkrpd|krX|d tkrLttjd|d |d | j_d|krl|d | j_ nz|dkr|nn|dkrnb|dkrd}d |kr|d }|d
dkrttj
d|d
| jjdko|d
dk rttj
d|d
| jjf |d
dkr&| r&ttj
d|d
|d
d kry t |}W n. t k
rn ttj
d|d
|f Y nX |dk rttj
d|d
|f |d
d kr|d krttj||d
| jjkr|| jj|d
< ntjd|d
d S ) Nr( r z%sr r r r) r r+ r' r= rZ r[ r\ zUnknown option '%s'zhash:macz%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'z)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer] r> z Option %s already set, ignoring.)r= rZ r[ r\ )r= )r= rZ r[ r\ )rZ r[ r\ )r] r> )r startElementrW Zparser_check_element_attrsr r r r^ r r ZINVALID_OPTIONrR rS r` ra r! r warning)r/ r' attrsr+ rc r1 r1 r2 ro L sd
z!ipset_ContentHandler.startElementc C s( t j| | |dkr$| jjj| j d S )Nr* )r
endElementrW r" appendZ_element)r/ r' r1 r1 r2 rr s z ipset_ContentHandler.endElementN)ri rj rk ro rr r1 r1 r1 r2 rn K s 7rn c % C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~d |jkrF|jd d
krFt|jd krFt j d |j |jd d = d } t }
x| t|jk r|j| |
krt j d
|j| |jj | nry |j |j| |j|j! W n< tk
r } z t j d| |jj | W Y d d } ~ X nX |
j"|j| | d7 } qRW ~
t#r|j$ |S )Nz.xmlz'%s' is missing .xml suffixre FTz%s/%srbznot a valid ipset file: %srZ rf r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z
%s, ignoring.rA )%r rQ r r Z INVALID_NAMEr' Z
check_namefilenamepathrL r
ETC_FIREWALLDZbuiltindefaultrn saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionrM Z getExceptionr! rO r" r rp setpoprY r addr r< ) rv rw r( handlerparserr' fsourcemsgrU Z entries_setr9 r1 r1 r2 r s^
( c C s |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j d | ji}| jr| jd
kr| j|d < |jd | |jd
| jrz| jd
krz|jd |jdi |j| j |jd |jd
| jr| jd
kr|jd |jdi |j| j |jd |jd
xZ| jj D ]L\} }
|jd |
d
kr |j d| |
d n|j dd| i |jd
qW xD| j D ]:} |jd |jdi |j| |jd |jd
q(W |jd |jd
|j |j ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r(
z r r r) )r' r+ r' r* )!rw rv r' osexistsshutilZcopy2 Exceptionr errordirnamerL r rx mkdirior{ r Z
startDocumentr r ro ZignorableWhitespacer Z
charactersrr r r! r; Z
simpleElementr" Z endDocumentclose) r( rw _pathr' r dirpathr r rq rb r+ r* r1 r1 r2 r sf
)N))__doc____all__Zxml.saxrz r r r Zfirewallr Zfirewall.functionsr r r r r
r r r
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rn r r r1 r1 r1 r2 s&
, !=5PK ! z!
$ __pycache__/functions.cpython-36.pycnu [ 3
Yjy @ s d dl Z d dlmZ d dlmZ d dlmZ d dlmZ d dl m
Z
d dl m Z d dl
mZ d d lmZ d d
lmZ d d lmZ d d lmZ d d
lmZ dd ZdS ) N)config)
FirewallError)FirewallConfig) zone_reader)service_reader) ipset_reader)icmptype_reader)
helper_reader)
policy_reader)Direct)LockdownWhitelist)firewalld_confc - C s| t | }t|jtjtjgdt|jtjtj gdt
|j tj tj
gdt|jtjtjgdt|jtjtjgdt|jtjtjgdd}x
|j D ]}x|| d D ]}tj j |sqxt tj |D ]}|j dryD|| d ||}|d
k r||_!|j"|j# || d | W q t$k
rT } z t$|j%d ||j&f W Y d d }~X q t'k
r } zt'd ||f W Y d d }~X qX qW qW qW tj j(tj)r:y$t*tj)}|j+ |j,|j- W np t$k
r } z t$|j%d tj)|j&f W Y d d }~X n6 t'k
r8 } zt'd tj)|f W Y d d }~X nX tj j(tj.ry$t/tj.}|j+ |j,|j- W np t$k
r } z t$|j%d tj.|j&f W Y d d }~X n6 t'k
r } zt'd tj.|f W Y d d }~X nX tj j(tj0rxyt1tj0}|j+ W np t$k
rB } z t$|j%d tj0|j&f W Y d d }~X n6 t'k
rv } zt'd tj0|f W Y d d }~X nX d S ) N)readeradddirs)ZipsethelperZicmptypeZservicezonepolicyr z.xmlr r r r z'%s': %s)r r )2r r Z add_ipsetr ZFIREWALLD_IPSETSZETC_FIREWALLD_IPSETSr Z
add_helperZFIREWALLD_HELPERSZETC_FIREWALLD_HELPERSr Z add_icmptypeZFIREWALLD_ICMPTYPESZETC_FIREWALLD_ICMPTYPESr Z add_serviceZFIREWALLD_SERVICESZETC_FIREWALLD_SERVICESr Zadd_zoneZFIREWALLD_ZONESZETC_FIREWALLD_ZONESr
Zadd_policy_objectZFIREWALLD_POLICIESZETC_FIREWALLD_POLICIESkeysospathisdirsortedlistdirendswith fw_configZcheck_config_dictZexport_config_dictr codemsg ExceptionisfileZFIREWALLD_DIRECTr read check_configZ
export_configZLOCKDOWN_WHITELISTr ZFIREWALLD_CONFr
) fwr Zreadersr Z_dirfileobjerrorr r& /usr/lib/python3.6/functions.pyr! & sz
&.
($
($
(r! )r Zfirewallr Zfirewall.errorsr Zfirewall.core.fw_configr Zfirewall.core.io.zoner Zfirewall.core.io.servicer Zfirewall.core.io.ipsetr Zfirewall.core.io.icmptyper Zfirewall.core.io.helperr Zfirewall.core.io.policyr
Zfirewall.core.io.directr Z#firewall.core.io.lockdown_whitelistr Z firewall.core.io.firewalld_confr
r! r& r& r& r' s PK ! ?xR`/ `/ * __pycache__/io_object.cpython-36.opt-1.pycnu [ 3
Yj5 @ s d Z ddddddddgZd d
ljZd d
ljjZd d
lZd d
lZd d lm Z d d l
m Z d d
l m
Z
d dl
mZ d dlmZ ejdk ZG dd deZG dd deZG dd deZG dd deZG dd dejjZG dd dej Z dd Z dd Z d d Z d d Z!d
S ) z5Generic io_object handler, io specific check methods.PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol
check_address N) OrderedDict) functions)b2u)errors)
FirewallError3c @ s| e Zd ZdZf ZdZg Zi Zi Zdd Z dd Z
dd Z d d
Z d d Z
d
d Zdd Zdd Zdd Zdd Zdd ZdS )r z; Abstract IO_Object as base for icmptype, service and zone z()c C s" d| _ d| _d| _d| _d| _d S )N F)filenamepathnamedefaultZbuiltin)self r /usr/lib/python3.6/io_object.py__init__2 s
zIO_Object.__init__c C s6 g }x(| j D ] }|jtjt| |d q W t|S )Nr )IMPORT_EXPORT_STRUCTUREappendcopydeepcopygetattrtuple)r retxr r r
export_config9 s zIO_Object.export_configc C sX i }t dd | jD }x:|D ]2}t| |sA s z0IO_Object.export_config_dict..)dictr r
isinstanceboolr r )r conf type_formatskeyr r r export_config_dict? s
z IO_Object.export_config_dictc C s | j | xt| jD ]~\}\}}t|| tr~g }t }x,|| D ] }||krD|j| |j| qDW ~t| |t j
| qt| |t j
|| qW d S )N) check_config enumerater r& listsetr addsetattrr r )r r( ielementZdummyZ_confZ_setr r r r
import_configG s
zIO_Object.import_configc C s~ | j | xn|D ]f}t| |s0ttjdj|t|| tr`t| |tt j
t j || qt| |t j || qW d S )Nz-Internal error. '{}' is not a valid attribute)
check_config_dicthasattrr r
Z
UNKNOWN_ERRORformatr& r. r1 r
fromkeysr r )r r( r* r r r import_config_dictW s
"z IO_Object.import_config_dictc C sz t |ts(ttjd|tdt|f t|dk r@ttjdx4|D ],}|j rF|| j krFttjd||f qFW d S )Nz'%s' not of type %s, but %sr r" zname can't be emptyz'%s' is not allowed in '%s')
r& strr r
INVALID_TYPEtypelenZ INVALID_NAMEisalnumADDITIONAL_ALNUM_CHARS)r r charr r r
check_namec s
zIO_Object.check_namec C sj t |t | jkr0ttjdt |t | jf i }x&t| jD ]\}\}}|| ||< q@W | j| d S )Nz structure size mismatch %d != %d)r= r r r
r; r- r5 )r r( Z conf_dictr2 r yr r r r, p s zIO_Object.check_configc C sr t dd | jD }xX|D ]P}|dd | jD krDttjdj|| j|| || | j|| || qW d S )Nc S s g | ]}|d |d fqS )r r" r )r# r r r r r$ | s z/IO_Object.check_config_dict..c S s g | ] \}}|qS r r )r# r rB r r r r$ ~ s zoption '{}' is not valid)r% r r r
ZINVALID_OPTIONr7 _check_config_structure
_check_config)r r( r) r* r r r r5 { s
zIO_Object.check_config_dictc C s d S )Nr )r Zdummy1Zdummy2Zdummy3r r r rD s zIO_Object._check_configc C s` t |t|s,ttjd|t|t|f t |trrt|dkrRttjd| x |D ]}| j||d qXW nt |trt|t|krttjd|t|f xt |D ]\}}| j|| | qW nt |t
r\t|j d \}}xn|j D ]b\}}t |t|s,ttjd|t|t|f t |t|sttjd|t|t|f qW d S )Nz'%s' not of type %s, but %sr" zlen('%s') != 1r zlen('%s') != %d) r& r< r r
r; r. r= rC r r- r% items) r r( Z structurer r2 valueZskeyZsvaluer* r r r rC s8
z!IO_Object._check_config_structurec C s |j }d}|| jkrdd}| j| d k rdx:| j| D ],}||krL|j| q4ttjd||f q4W || jkrd}x$| j| D ]}||kr~|j| q~W |sttjd| x |D ]}ttjd||f qW d S )NFTzMissing attribute %s for %szUnexpected element %sz%s: Unexpected attribute %s)ZgetNames PARSER_REQUIRED_ELEMENT_ATTRSremover r
Z PARSE_ERROR PARSER_OPTIONAL_ELEMENT_ATTRS)r r attrsZ_attrsfoundr r r r parser_check_element_attrs s,
z$IO_Object.parser_check_element_attrsN)__name__
__module__ __qualname____doc__r ZDBUS_SIGNATUREr? rG rI r r! r+ r4 r9 rA r, r5 rD rC rL r r r r r ) s"
!c s$ e Zd Z fddZdd Z ZS )UnexpectedElementErrorc s t t| j || _d S )N)superrQ r r )r r ) __class__r r r s z UnexpectedElementError.__init__c C s
d| j S )NzUnexpected element '%s')r )r r r r __str__ s z UnexpectedElementError.__str__)rM rN rO r rT
__classcell__r r )rS r rQ s rQ c s$ e Zd Z fddZdd Z ZS )MissingAttributeErrorc s t t| j || _|| _d S )N)rR rV r r attribute)r r rW )rS r r r s z MissingAttributeError.__init__c C s d| j | jf S )Nz$Element '%s': missing '%s' attribute)r rW )r r r r rT s z MissingAttributeError.__str__)rM rN rO r rT rU r r )rS r rV s rV c s$ e Zd Z fddZdd Z ZS )UnexpectedAttributeErrorc s t t| j || _|| _d S )N)rR rX r r rW )r r rW )rS r r r s z!UnexpectedAttributeError.__init__c C s d| j | jf S )Nz'Element '%s': unexpected attribute '%s')r rW )r r r r rT s z UnexpectedAttributeError.__str__)rM rN rO r rT rU r r )rS r rX s rX c @ s4 e Zd Zdd Zdd Zdd Zdd Zd d
Zd S ) r c C s || _ d| _d S )Nr )item_element)r rY r r r r s z!IO_Object_ContentHandler.__init__c C s
d| _ d S )Nr )rZ )r r r r
startDocument s z&IO_Object_ContentHandler.startDocumentc C s
d| _ d S )Nr )rZ )r r rJ r r r startElement s z%IO_Object_ContentHandler.startElementc C s* |dkr| j | j_n|dkr&| j | j_d S )Nshort description)rZ rY r] r^ )r r r r r
endElement s z#IO_Object_ContentHandler.endElementc C s | j |jdd7 _ d S )N
)rZ replace)r contentr r r
characters s z#IO_Object_ContentHandler.charactersN)rM rN rO r r[ r\ r_ rd r r r r r s
c @ s< e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
S )r c C sN t jjj| |j| _|j| _i g| _| jd | _ g | _
d| _ d| _ d| _
d S )Nr" zutf-8F)saxhandlerContentHandlerr write_writeflushZ_flushZ _ns_contextsZ_current_contextZ_undeclared_ns_mapsZ _encodingZ_pending_start_elementZ_short_empty_elements)r outr r r r s z IO_Object_XMLGenerator.__init__c C s* t rdd |j D }tjj| || dS )a saxutils.XMLGenerator.startElement() expects name and attrs to be
unicode and bad things happen if any of them is (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
c S s i | ]\}}t |t |qS r )r )r# r rF r r r
s z7IO_Object_XMLGenerator.startElement..N)r rE saxutils XMLGeneratorr\ )r r rJ r r r r\ s z#IO_Object_XMLGenerator.startElementc C s t rX| jdt| x4|j D ](\}}| jdt|tjt|f q W | jd nF| jd| x,|j D ] \}}| jd|tj|f qpW | jd dS )z* slightly modified startElement()
N)r rj r rE rn Z quoteattr)r r rJ rF r r r
simpleElement s z$IO_Object_XMLGenerator.simpleElementc C s t jj| t| dS )z saxutils.XMLGenerator.endElement() expects name to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro r_ r )r r r r r r_ s z!IO_Object_XMLGenerator.endElementc C s t jj| t| dS )z saxutils.XMLGenerator.characters() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro rd r )r rc r r r rd % s z!IO_Object_XMLGenerator.charactersc C s t jj| t| dS )a saxutils.XMLGenerator.ignorableWhitespace() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
N)rn ro ignorableWhitespacer )r rc r r r rr - s z*IO_Object_XMLGenerator.ignorableWhitespaceN) rM rN rO r r\ rq r_ rd rr r r r r r s
c C s t j| }|dkr$ttjd| n`|dkr>ttjd| nF|d krXttjd| n,t|dkr|d |d krttjd| d S ) N z port number in '%s' is too bigr" z'%s' is invalid port rangez port range '%s' is ambiguousr re )r Z getPortRanger r
Z INVALID_PORTr= )ZportZ
port_ranger r r r 5 s
c C s | dkrt tjd| d S )Ntcpudpsctpdccpz)'%s' not from {'tcp'|'udp'|'sctp'|'dccp'})ru rv rw rx )r r
INVALID_PROTOCOL)protocolr r r r D s c C s t j| sttj| d S )N)r Z
checkProtocolr r
ry )rz r r r r J s
c C s$ t j| |s ttjd|| f d S )Nz '%s' is not valid %s address)r r r r
Z INVALID_ADDR)ZipvZaddrr r r r N s )"rP __all__Zxml.saxrf Zxml.sax.saxutilsrn r sys collectionsr
Zfirewallr Zfirewall.functionsr r
Zfirewall.errorsr versionr objectr ExceptionrQ rV rX rg rh r ro r r r r r r r r r s0
CPK ! h% h% - __pycache__/lockdown_whitelist.cpython-36.pycnu [ 3
Yj1 @ s d dl jZd dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z d dl m
Z
d dlmZmZmZmZmZmZ d dlmZ d dlmZ G dd d e
ZG d
d d e ZdS ) N)config)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)log)uniqify checkUsercheckUid checkCommand checkContext
u2b_if_py2)errors)
FirewallErrorc @ s e Zd Zdd Zdd ZdS )!lockdown_whitelist_ContentHandlerc C s t j| | d| _d S )NF)r __init__ whitelist)selfitem r (/usr/lib/python3.6/lockdown_whitelist.pyr % s z*lockdown_whitelist_ContentHandler.__init__c C sV t j| || | jj|| |dkr@| jr6ttjdd| _n|dkrr| js\tj d d S |d }| jj
| n|dkr| jstj d d S d |kryt |d }W n& t k
r tj d
|d d S X | jj
| nd|kr| jj|d n\|d kr@| jstj d d S d
|kr.tj d d S | jj|d
ntj d| d S d S )Nr zMore than one whitelist.Tcommandz)Parse Error: command outside of whitelistnameuserz&Parse Error: user outside of whitelistidz"Parse Error: %s is not a valid uidselinuxz)Parse Error: selinux outside of whitelistcontextzParse Error: no contextzUnknown XML element %s)r startElementr Zparser_check_element_attrsr r r Z PARSE_ERRORr error add_commandint
ValueErroradd_uidadd_user add_context)r r Zattrsr uidr r r r ) sJ
z.lockdown_whitelist_ContentHandler.startElementN)__name__
__module__ __qualname__r r r r r r r $ s r c s4 e Zd ZdZddgfddgfddgfddgffZdZd gZd
d gd
d gd
Zddd giZ fddZ dd Z
dd Z dd Z dd Z
dd Zd d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Z d8d9 Z d:d; Z dd? Z d@dA Z!dBdC Z" Z#S )DLockdownWhitelistz LockdownWhitelist class commands contextsusersuidsr z
(asasasai)_Nr r )r r r r r r c s6 t t| j || _d | _g | _g | _g | _g | _d S )N) superr) r filenameparserr* r, r- r. )r r1 ) __class__r r r n s zLockdownWhitelist.__init__c C s |d
kr.x|D ]}| j ||d d | qW nv|dkrLt|sttj|nX|dkrjt|sttj|n:|dkrt|sttj|n |d krt |sttj
|d S ) Nr* r, r- r. r r r r% )r* r, r- r. )
_check_configr r r INVALID_COMMANDr INVALID_CONTEXTr INVALID_USERr
INVALID_UID)r r r Z
all_configxr r r r6 y s
z LockdownWhitelist._check_configc C s4 | j d d = | jd d = | jd d = | jd d = d S )N)r* r, r- r. )r r r r cleanup s zLockdownWhitelist.cleanupc C s: dd | j D | _ dd | jD | _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |qS r )r
).0r; r r r
s z4LockdownWhitelist.encode_strings..c S s g | ] }t |qS r )r
)r= r; r r r r> s c S s g | ] }t |qS r )r
)r= r; r r r r> s N)r* r, r- )r r r r encode_strings s z LockdownWhitelist.encode_stringsc C s@ t |sttj||| jkr,| jj| nttjd| d S )Nz!Command "%s" already in whitelist)r r r r7 r* appendALREADY_ENABLED)r r r r r r s
z LockdownWhitelist.add_commandc C s, || j kr| j j| nttjd| d S )Nz Command "%s" not in whitelist.)r* remover r NOT_ENABLED)r r r r r remove_command s
z LockdownWhitelist.remove_commandc C s
|| j kS )N)r* )r r r r r has_command s z LockdownWhitelist.has_commandc C sB x<| j D ]2}|jdr.|j|d d r:dS q||krdS qW dS )N*r4 TFr5 )r* endswith
startswith)r r Z_commandr r r
match_command s
z LockdownWhitelist.match_commandc C s | j S )N)r* )r r r r get_commands s z LockdownWhitelist.get_commandsc C sD t |sttjt||| jkr0| jj| nttjd| d S )Nz Uid "%s" already in whitelist)r
r r r: strr. r@ rA )r r% r r r r" s
zLockdownWhitelist.add_uidc C s, || j kr| j j| nttjd| d S )NzUid "%s" not in whitelist.)r. rB r r rC )r r% r r r
remove_uid s
z LockdownWhitelist.remove_uidc C s
|| j kS )N)r. )r r% r r r has_uid s zLockdownWhitelist.has_uidc C s
|| j kS )N)r. )r r% r r r match_uid s zLockdownWhitelist.match_uidc C s | j S )N)r. )r r r r get_uids s zLockdownWhitelist.get_uidsc C s@ t |sttj||| jkr,| jj| nttjd| d S )Nz User "%s" already in whitelist)r r r r9 r- r@ rA )r r r r r r# s
zLockdownWhitelist.add_userc C s, || j kr| j j| nttjd| d S )NzUser "%s" not in whitelist.)r- rB r r rC )r r r r r remove_user s
z LockdownWhitelist.remove_userc C s
|| j kS )N)r- )r r r r r has_user s zLockdownWhitelist.has_userc C s
|| j kS )N)r- )r r r r r
match_user s z LockdownWhitelist.match_userc C s | j S )N)r- )r r r r get_users s zLockdownWhitelist.get_usersc C s@ t |sttj||| jkr,| jj| nttjd| d S )Nz!Context "%s" already in whitelist)r r r r8 r, r@ rA )r r r r r r$ " s
z LockdownWhitelist.add_contextc C s, || j kr| j j| nttjd| d S )Nz Context "%s" not in whitelist.)r, rB r r rC )r r r r r remove_context, s
z LockdownWhitelist.remove_contextc C s
|| j kS )N)r, )r r r r r has_context3 s z LockdownWhitelist.has_contextc C s
|| j kS )N)r, )r r r r r
match_context6 s z LockdownWhitelist.match_contextc C s | j S )N)r, )r r r r get_contexts9 s z LockdownWhitelist.get_contextsc C s | j | jjds&ttjd| j t| }tj }|j | y|j
| j W n8 tj k
r } zttj d|j
W Y d d }~X nX ~~tr| j d S )Nz.xmlz'%s' is missing .xml suffixzNot a valid file: %s)r< r1 rG r r Z INVALID_NAMEr saxZ make_parserZsetContentHandlerparseZSAXParseExceptionZ INVALID_TYPEZ getExceptionr r? )r handlerr2 msgr r r read> s"
zLockdownWhitelist.readc C s t jj| jr\ytj| jd| j W n4 tk
rZ } ztd| j|f W Y d d }~X nX t jjtj sxt j
tj d t j | jddd}t
|}|j |jdi |jd x6t| jD ](}|jd |jd
d |i |jd qW x:t| jD ],}|jd |jd d
t|i |jd qW x8t| jD ]*}|jd |jd d |i |jd q0W x8t| jD ]*}|jd |jdd|i |jd qjW |jd |jd |j |j ~d S )Nz%s.oldzBackup of '%s' failed: %si ZwtzUTF-8)modeencodingr
z r r r r r r )ospathexistsr1 shutilZcopy2 ExceptionIOErrorr Z
ETC_FIREWALLDmkdirioopenr Z
startDocumentr ZignorableWhitespacer r* Z
simpleElementr. rK r- r, Z
endElementZ endDocumentclose)r r[ frZ r r% r r r r r writeQ sB $
zLockdownWhitelist.write)$r& r' r( __doc__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r6 r< r? r rD rE rI rJ r" rL rM rN rO r# rP rQ rR rS r$ rT rU rV rW r\ rk
__classcell__r r )r3 r r) W sL
1
r) )Zxml.saxrX r` rg rc Zfirewallr Zfirewall.core.io.io_objectr r r r Zfirewall.core.loggerr Zfirewall.functionsr r r
r r r
r Zfirewall.errorsr r r) r r r r s
3PK ! (# " __pycache__/service.cpython-36.pycnu [ 3
Yj2 @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z ddl
m Z m Z m
Z
mZmZmZmZmZ ddlmZ dd lmZ dd
lmZ G d d d e ZG d d
d
e
Zdd ZdddZdS )Serviceservice_readerservice_writer N)config)
u2b_if_py2)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol
check_address)log)errors)
FirewallErrorc s e Zd Zd d!d"dd#gfddgfdddifddgfd d$gfd
dgfd dgff
Zd d
gZddddZddgddgdgdgddgddgdgdgdZ fddZdd Zd d Z d d Z
Z S )%r version short descriptionportsmodules destination protocols source_portsincludeshelpers_-N)r r servicenameportprotocolvalueipv4ipv6r )r r! r" moduler z source-portincludehelperc sN t t| j d| _d| _d| _g | _g | _g | _i | _ g | _
g | _ g | _ d S )Nr )
superr __init__r r r r r r r r r r )self) __class__ /usr/lib/python3.6/service.pyr* D s zService.__init__c C sh d| _ d| _d| _| jd d = | jd d = | jd d = | jj | jd d = | j d d = | j
d d = d S )Nr ) r r r r r r r clearr r r )r+ r- r- r. cleanupQ s
zService.cleanupc C s t | j| _t | j| _t | j| _dd | jD | _dd | jD | _dd | jj D | _dd | jD | _dd | j D | _ dd | j
D | _
d d | j D | _ d
S ) z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ]\}}t |t |fqS r- )r ).0poprr- r- r.
d s z*Service.encode_strings..c S s g | ] }t |qS r- )r )r1 mr- r- r. r4 e s c S s i | ]\}}t |t |qS r- )r )r1 kvr- r- r.
f s z*Service.encode_strings..c S s g | ] }t |qS r- )r )r1 r3 r- r- r. r4 g s c S s g | ]\}}t |t |fqS r- )r )r1 r2 r3 r- r- r. r4 h s c S s g | ] }t |qS r- )r )r1 sr- r- r. r4 j s c S s g | ] }t |qS r- )r )r1 r9 r- r- r. r4 k s N) r r r r r r r itemsr r r r )r+ r- r- r. encode_strings] s zService.encode_stringsc C s: |dkrJx>|D ]6}|d dkr8t |d t|d qt|d qW n|dkrjx|D ] }t| qXW n|dkrx|D ] }t |d t|d qxW n|dkrx|D ]*}|dkrttjd
| t||| qW n^|d kr6xR|D ]J}|jd r|jd d}d
|kr|jd
d}t |dk rttj
|qW d S )Nr r r r r r r$ r% z'%s' not in {'ipv4'|'ipv6'}r
nf_conntrack_r r )r$ r% ) r r r
r r ZINVALID_DESTINATIONr
startswithreplacelenZINVALID_MODULE)r+ r itemZ
all_configr! protor r& r- r- r.
_check_configm s8
zService._check_config)r r )r r )r r )r r )r r ) __name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr* r0 r; rD
__classcell__r- r- )r, r. r & s4
c @ s e Zd Zdd ZdS )service_ContentHandlerc C s0 t j| || | jj|| |dkrTd|krxRd D ]J}||krt||| || jjkr&tjd| n|| | jj|< qW n|dkr|d }|jdr~|jdd}d|kr~|jdd}|| jjkr| jjj
| n tjd| n|dkr|d | jjkr| jjj
|d ntjd|d n@|dkr,|d | jjkr | jjj
|d ntjd|d d S ) Nr r z'Ignoring deprecated attribute name='%s'r r r r! r r" z#Port '%s/%s' already set, ignoring.z$Protocol '%s' already set, ignoring.r# z source-portz)SourcePort '%s/%s' already set, ignoring.r r$ r% z2Destination address for '%s' already set, ignoringr& r= r r z"Module '%s' already set, ignoring.r' z#Include '%s' already set, ignoring.r( z"Helper '%s' already set, ignoring.)r$ r% )r startElementrB Zparser_check_element_attrsr Zwarningr r r r appendr
r r r r r? r@ r r r )r+ r attrsentryxr& r- r- r. rJ s
z#service_ContentHandler.startElementN)rE rF rG rJ r- r- r- r. rI s rI c C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~tr|j |S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbz not a valid service file: %s)r endswithr r Z INVALID_NAMEr Z
check_namefilenamepathr? r
ETC_FIREWALLDZbuiltindefaultrI saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_SERVICEZ getExceptionr r; ) rS rT r handlerparserr fsourcemsgr- r- r. r s8
(c C sr |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< |jd | |jd | jrt| jd krt|jd
|jdi |j| j |jd |jd | jr| jd kr|jd
|jdi |j| j |jd |jd x>| jD ]4} |jd
|jd| d | d d |jd qW x4| j D ]*}
|jd
|jdd|
i |jd qW x>| j D ]4} |jd
|jd| d | d d |jd q s
( mQ PK ! g2 2 __pycache__/zone.cpython-36.pycnu [ 3
YjM @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZmZ ddlmZmZ ddlmZmZmZmZ dd lmZmZmZm Z dd
l m Z dd l m Z dd lm!Z! dd
l"m#Z# G dd d eZ$G dd deZ%dddZ&dddZ'dS )Zone zone_reader zone_writer N)config) checkIPnMask
checkIP6nMaskcheckInterfaceuniqifymax_zone_name_len
u2b_if_py2 check_mac)DEFAULT_ZONE_TARGET ZONE_TARGETS)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)common_startElementcommon_endElementcommon_check_config
common_writer)rich)log)errors)
FirewallErrorc sf e Zd ZdZd@dAdBdCdDd dgfd
dEgfd dgfdFd
dGgfddgfddgfddgfddgfddHgfdIdJfZdddgZddddgddgdgdgdddgdgdddd gddgdddddd gd gdd Zdd ddgd gd!d"gd#d$gd%d&d'd#d(gd%d'd(gd)d*gd+gd,gd- Zed.d/ Z fd0d1Z
d2d3 Z d4d5 Z fd6d7Z
fd8d9Zd:d; Z fdd? Z ZS )Kr z Zone class version short descriptionUNUSEDFtargetservicesports icmp_blocks
masquerade
forward_ports
interfacessources rules_str protocols source_portsicmp_block_inversionforward_-/Nnameportprotocolvalueset)r r zoneservicer1 z
icmp-blockz icmp-typer, z forward-port interfacerulesource destinationr2 z source-portr ZauditZacceptrejectZdropZmarklimitzicmp-block-inversion immutableZenabledzto-portzto-addrfamilyZpriorityaddressmacinvertipsetprefixleveltypeZburst) r5 r$ z forward-portr8 r9 r: r r; r< c C s8 x&t tjD ]\}\}}|| kr |S q W ttjdd S )Nz
index_of()) enumerater IMPORT_EXPORT_STRUCTUREr r Z
UNKNOWN_ERROR)elementiZelZdummy rJ /usr/lib/python3.6/zone.pyindex_ofd s z
Zone.index_ofc s t t| j d| _d| _d| _d| _t| _g | _ g | _
g | _ g | _ d| _
d| _g | _g | _g | _g | _d | _g | _g | _d| _d| _d| _d S )Nr F)superr __init__r r r r r
r r! r" r) r# r, r$ r% r* r& r' fw_configrulesr( r+ combinedapplied)self) __class__rJ rK rN k s, z
Zone.__init__c C s d| _ d| _d| _d| _t| _| jd d = | jd d = | jd d = | j d d = d| _
d| _ | j d d = | j
d d = | jd d = | jd d = d | _| jd d = | jd d = d| _d| _d| _d S )Nr F)r r r r r
r r! r" r) r# r, r$ r% r* r& r' rO rP r( r+ rQ rR )rS rJ rJ rK cleanup s* z Zone.cleanupc C s t | j| _t | j| _t | j| _t | j| _dd | jD | _dd | jD | _dd | jD | _dd | jD | _dd | j D | _ dd | j
D | _
dd | j D | _ d d | j D | _ d
d | j
D | _
d d | jD | _d S )
z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s g | ] }t |qS rJ )r ).0srJ rJ rK
s z'Zone.encode_strings..c S s g | ]\}}t |t |fqS rJ )r )rV poprrJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rZ rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rI rJ rJ rK rX s c S s0 g | ](\}}}}t |t |t |t |fqS rJ )r )rV Zp1Zp2Zp3Zp4rJ rJ rK rX s c S s g | ]\}}t |t |fqS rJ )r )rV rY rZ rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rI rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rW rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rW rJ rJ rK rX s c S s g | ] }t |qS rJ )r )rV rW rJ rJ rK rX s N)r r r r r r! r" r) r# r% r* r& r' rP r( )rS rJ rJ rK encode_strings s zZone.encode_stringsc sN |dkr8dd |D | _ tt| j|dd | j D ntt| j|| d S )Nr( c S s g | ]}t j|d qS ))Zrule_str)r Z Rich_Rule)rV rW rJ rJ rK rX s z$Zone.__setattr__..c S s g | ] }t |qS rJ )str)rV rW rJ rJ rK rX s )rP rM r __setattr__)rS r0 r3 )rT rJ rK r] s zZone.__setattr__c s t t| j }|d= |S )Nr )rM r export_config_dict)rS Zconf)rT rJ rK r^ s zZone.export_config_dictc C sL t | ||| |dkr.|tkr*ttj|n|dkrxl|D ]d}t|sTttj|| jr}|| j krq|| jj
|jkrttjdj ||qW qW d S )Nr r& z)interface '{}' already bound to zone '{}'r' zipset:z&source '{}' already bound to zone '{}')r r r r INVALID_TARGETr ZINVALID_INTERFACErO Z get_zonesr0 Zget_zoner& formatr r r
startswith INVALID_ADDRr' )rS r itemZ
all_configr7 r5 r9 rJ rJ rK
_check_config s6
zZone._check_configc s t t| j| |jdr,ttjd| n|jdrHttjd| n|jddkrhttjd| nnd|kr|d |j d }n|}t
|t krttjd|t
|t | j f | j
r|| j
j krttjdd S )Nr/ z'%s' can't start with '/'z'%s' can't end with '/' zmore than one '/' in '%s'z'Zone of '%s' has %d chars, max is %d %sz+Zones can't have the same name as a policy.)rM r
check_namera r r INVALID_NAMEendswithcountfindlenr
rQ rO Zget_policy_objectsZ
NAME_CONFLICT)rS r0 Z checked_name)rT rJ rK rf s,
zZone.check_namec
C s d| _ d | _d| _d| _d| _x$|jD ]}|| jkr&| jj| q&W x$|jD ]}|| jkrL| jj| qLW x$|jD ]}|| jkrr| jj| qrW x$|j D ]}|| j kr| j j| qW x$|j
D ]}|| j
kr| j
j| qW x$|j D ]}|| j kr| j j| qW |j rd| _ |j
r d| _
x(|jD ] }|| jkr&| jj| q&W x(|jD ] }|| jkrP| jj| qPW x,|jD ]"} | jj| | jjt| qzW |jrd| _d S )NTr )rQ filenamer r r r& appendr' r! r" r) r# r, r$ r% r* rP r( r\ r+ )
rS r5 r7 r9 r6 r1 protoZicmpr, r8 rJ rJ rK combine sL
z Zone.combine)r r )r r )r r )r F)r r )r r )r$ F)r r r r )r r )r+ F)r, F)__name__
__module__ __qualname____doc__rG ZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRS staticmethodrL rN rU r[ r] r^ rd rf ro
__classcell__rJ rJ )rT rK r ( sx
c @ s$ e Zd Zdd Zdd Zdd ZdS )zone_ContentHandlerc C s" t j| | d | _d| _d | _d S )NF)r rN _rule _rule_errorZ _limit_ok)rS rc rJ rJ rK rN s z zone_ContentHandler.__init__c C s t j| || | jrd S | jj|| t| ||r6d S |dkrd|krVtjd|d d|krj|d | j_d|krtjd|d d|kr|d }|t krt
t j ||dkr|t
kr|| j_n|d kr| jjrtjd
nd | j_n|d krh| jrtjd
d | _d S d|kr.tjd d | _d S |d | jjkrT| jjj|d ntjd|d n8|dkrf| jr | jjrtjdt| j d | _d S d}d|kr|d j d$krd }d } }}d|kr|d }d|kr|d }d|kr|d }tj||||d| j_d S d|krBd|krBtjd d S d|krdd|krdtjd d S d |kr~tjd |d d|krtjd d S d|krt|d rt|d rt|d rt
t j|d d|kr$d |d }|| jj kr| jj j| ntjd |d d|kr|d }|| jj krT| jj j| ntjd |d n:|d!kr| jj rtjd" nd | j_ ntjd#| d S d S )%Nr5 r0 z'Ignoring deprecated attribute name='%s'r r= z,Ignoring deprecated attribute immutable='%s'r r r, z Forward already set, ignoring.Tr7 z$Invalid rule: interface use in rule.z Invalid interface: Name missing.z%Interface '%s' already set, ignoring.r9 z:Invalid rule: More than one source in rule '%s', ignoring.FrA yestruer? r@ rB )rA z$Invalid source: No address no ipset.z"Invalid source: Address and ipset.r> z)Ignoring deprecated attribute family='%s'z+Invalid source: Invertion not allowed here.zipset:%sz"Source '%s' already set, ignoring.zicmp-block-inversionz+Icmp-Block-Inversion already set, ignoring.zUnknown XML element '%s')ry rz ) r startElementrx rc Zparser_check_element_attrsr r Zwarningr r r r r_ r
r r, rw r& rm r9 r\ lowerr Z Rich_Sourcer r r rb r' r+ ) rS r0 attrsr rA Zaddrr@ rB entryrJ rJ rK r{ & s
z zone_ContentHandler.startElementc C s t j| | t| | d S )N)r
endElementr )rS r0 rJ rJ rK r s z zone_ContentHandler.endElementN)rp rq rr rN r{ r rJ rJ rJ rK rv s prv Fc
C s t }| jds ttjd| | d d |_|s>|j|j | |_||_|j t
j rZdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd| j W Y d d } ~ X nX W d Q R X ~~tr|j |S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid zone file: %s)r rh r r rg r0 rf rl pathra r
ETC_FIREWALLDZbuiltindefaultrv saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZ INVALID_ZONEZ getExceptionr r[ )
rl r Z
no_check_namer5 handlerparserr0 fr9 msgrJ rJ rK r s:
(c C s\ |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< | jtkr*| j|d < |jd | |jd
t| | x8t| jD ]*} |jd |jdd| i |jd
qVW x\t| j D ]N}
|jd d|
kr|jdd|
dd i n|jdd|
i |jd
qW | j r
|jd |jdi |jd
| j r2|jd |jdi |jd
|j d |jd
|j |j! ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r5
z r7 r0 zipset:r9 rB r? zicmp-block-inversionr, )"r rl r0 osexistsshutilZcopy2 Exceptionr errordirnamera r r mkdirior r Z
startDocumentr r r
r{ ZignorableWhitespacer r r& Z
simpleElementr' r+ r, r Z endDocumentclose) r5 r _pathr0 r dirpathr r r} r7 r9 rJ rJ rK r s`
)F)N)(__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
r r Zfirewall.core.baser
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.io.policyr r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr r rv r r rJ rJ rJ rK s$
$ x|
PK ! Vq/ __pycache__/ifcfg.cpython-36.pycnu [ 3
Yj @ s^ d Z dgZddlZddlZddlZddlZddlmZ ddl m
Z
m Z m Z G dd de
ZdS )zifcfg file parserifcfg N)log)b2uu2bPY2c @ sL e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dS )r c C s i | _ g | _|| _| j d S )N)_config_deletedfilenameclear)selfr r /usr/lib/python3.6/ifcfg.py__init__# s zifcfg.__init__c C s i | _ g | _d S )N)r r )r r r r
r
) s z ifcfg.clearc C s | j j d S )N)r r
)r r r r
cleanup- s z
ifcfg.cleanupc C s | j j|j S )N)r getstrip)r keyr r r
r 0 s z ifcfg.getc C s8 t |j }t |j | j|< || jkr4| jj| d S )N)r r r r remove)r r valueZ_keyr r r
set3 s
z ifcfg.setc C sH d}x2| j j D ]$\}}|r$|d7 }|d||f 7 }qW trDt|S |S )N
z%s=%s)r itemsr r )r sr r r r r
__str__9 s z
ifcfg.__str__c C sB | j yt| jd}W n4 tk
rL } ztjd| j| W Y d d }~X nX x|D ]}|s^P |j }t|dk sT|d dkrqTdd |jd dD }t|d
krqTt|d d
kr|d j d r|d j
d r|d dd |d< |d d krqTn,| j j |d d k r tj
d
| j|j qT|d | j |d < qTW |j d S )NrzFailed to load '%s': %s r #;c S s g | ] }|j qS r )r ).0xr r r
Q s z ifcfg.read..= "r z%%s: Duplicate option definition: '%s')r r )r
openr Exceptionr errorr lensplit
startswithendswithr r Zwarningclose)r fmsglineZpairr r r
readB s2
z
ifcfg.readc : C s t | jdk rd S g }y.tjddtjj| j tjj| jdd}W n2 t k
rv } zt
j d| W Y d d }~X nX d}d}yt j
| jddd }W nN t k
r } z0tjj| jrt
j d
| j|f nd }W Y d d }~X ndX x^|D ]T}|sP |jd }t |dk r(|sD|jd d }q|d
dkrPd}|j| |jd q|jdd}t |dkr~d}|j|d q|d
j } |d j }
t |
dkr|
jdr|
jdr|
dd }
| |kr@| | jkr| j| |
krd}|jd| | j| f d }n$| | jkr"d }nd}|j|d |j| qd }qW t | jd
krxF| jj D ]8\} }
| |krzqd|sd }|jd| |
f d }qdW |r|j |j |stj|j d S tjj| jr8ytj| jd| j W nB t k
r6 } z$tj|j t d| j|f W Y d d }~X nX ytj |j| j W nB t k
r } z$tj|j t d| j|f W Y d d }~X nX tj | jd d S )Nr Zwtz%s.F)modeprefixdirdeletez!Failed to open temporary file: %sZrtzUTF-8)r2 encodingzFailed to open '%s': %sr Tr r r" r# r$ z%s=%s
z%s.bakzBackup of '%s' failed: %szFailed to create '%s': %si r% ) r) r tempfileZNamedTemporaryFileospathbasenamer dirnamer' r r( ior& existsr writer* r+ r, r appendr r- r nameshutilZcopy2IOErrorZmovechmod) r doneZ temp_filer/ Zmodifiedemptyr. r0 pr r r r r
r> _ s
$ $z ifcfg.writeN) __name__
__module__ __qualname__r r
r r r r r1 r> r r r r
r " s )__doc____all__Zos.pathr8 r< r7 rA Zfirewall.core.loggerr Zfirewall.functionsr r r objectr r r r r
s PK ! I>. . ' __pycache__/direct.cpython-36.opt-1.pycnu [ 3
Yj= @ s d dl jZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z d dl
mZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ G d d d eZG d
d deZdS ) N)config)LastUpdatedOrderedDict) splitArgsjoinArgs
u2b_if_py2) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)log) ipXtables)ebtables)errors)
FirewallErrorc @ s$ e Zd Zdd Zdd Zdd ZdS )direct_ContentHandlerc C s t j| | d| _d S )NF)r __init__direct)selfitem r /usr/lib/python3.6/direct.pyr ( s z direct_ContentHandler.__init__c C s t j| || | jj|| |dkr@| jr6ttjdd| _n>|dkr| js\tj d d S |d }|d }|d }| jj
t |t |t | n|dkr6| jstj d d S |d }|dkrttj d
| |d }|d }yt
|d }W n( tk
r tj d|d d S X t |t |t ||g| _nH|dkrl| jsVtj d d S |d }t |g| _ntj d| d S d S )Nr zMore than one direct tag.Tchainz$Parse Error: chain outside of directipvtablerulez#Parse Error: rule outside of directipv4ipv6ebz"'%s' not from {'ipv4'|'ipv6'|'eb'}priorityz'Parse Error: %s is not a valid priority passthroughz&Parse Error: command outside of directzUnknown XML element %s)r r r )r startElementr Zparser_check_element_attrsr r r
Z PARSE_ERRORr
error add_chainr INVALID_IPVint
ValueError_rule _passthrough)r nameZattrsr r r r r r r r , sT
z"direct_ContentHandler.startElementc C s t j| | |dkrX| jrF| jjdd t| jD | jj| j n
tj d d | _nJ|dkr| jr| j
jdd t| jD | jj | j
n
tj d d | _
d S )
Nr c S s g | ] }t |qS r )r ).0xr r r
d s z4direct_ContentHandler.endElement..z2Error: rule does not have any arguments, ignoring.r c S s g | ] }t |qS r )r )r( r) r r r r* m s z0Error: passthrough does not have any arguments, z ignoring.z9Error: passthrough does not have any arguments, ignoring.) r
endElementZ_elementr% appendr r add_ruler
r r& add_passthrough)r r' r r r r+ ^ s
z direct_ContentHandler.endElementN)__name__
__module__ __qualname__r r r+ r r r r r ' s 2r c s< e Zd ZdZddBgfddddddgfgfdddgfgffZdZdd d
d gd d
d d gd gd
Zi Z fddZdd Z dd Z
dd Z dd Z dd Z
dd Zd d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Z d8d9 Z d:d; Z dd? Z d@dA Z! Z"S )CDirectz Direct class chains rulesr passthroughsz(a(sss)a(sssias)a(sas))Nr r r r )r r r r c s0 t t| j || _t | _t | _t | _d S )N)superr2 r filenamer r3 r5 r6 )r r8 ) __class__r r r s
zDirect.__init__c C s d S )Nr )r confr Zall_confr r r
_check_config s zDirect._check_configc C s g }g }x>| j D ]4}x.| j | D ] }|jtt|t|g q W qW |j| g }xR| jD ]H}xB| j| D ]4}|jt|d |d |d |d t|d f qnW q^W |j| g }x8| jD ].}x(| j| D ]}|jt|t|f qW qW |j| t|S )Nr )r3 r, tuplelistr5 r6 )r retr) keyr r r r r
export_config s$ $
zDirect.export_configc C s | j | j| xt| jD ]x\}\}}|dkrNx|| D ]}| j| q r
rR rL )r r r r r rM rA valuer r r r- s
zDirect.add_rulec C s | j || |||f}|t|f}|| jkrb|| j| krb| j| |= t| j| dkr| j|= n$tddj|||f d||f d S )Nr z(Rule '%s' for table '%s' and chain '%s' z',z)with ipv '%s' and priority %d not in list)rQ r> r5 rT r$ rL )r r r r r rM rA rY r r r remove_rule s
zDirect.remove_rulec C sb | j || |||f}|| jkr^x"| j| j D ]}| j| |= q0W t| j| dkr^| j|= d S )Nr )rQ r5 rP rT )r r r r rA rY r r r remove_rules" s
zDirect.remove_rulesc C s: | j || |||f}|t|f}|| jko8|| j| kS )N)rQ r> r5 )r r r r r rM rA rY r r r
query_rule+ s
zDirect.query_rulec C sF | j || |||f}|| jkr*| j| S td||f d| d S )Nz'No rules for table '%s' and chain '%s' z
with ipv '%s')rQ r5 r$ )r r r r rA r r r get_rules1 s
zDirect.get_rulesc C s | j S )N)r5 )r r r r
get_all_rules: s zDirect.get_all_rulesc C s^ | j | || jkr g | j|< || j| kr>| j| j| n tjddj||f d d S )Nz Passthrough '%s' for ipv '%s'z',zalready in list, ignoring)rO r6 r, r
rR rL )r r rM r r r r. ? s
zDirect.add_passthroughc C sl | j | || jkrN|| j| krN| j| j| t| j| dkrh| j|= ntddj||f d d S )Nr z Passthrough '%s' for ipv '%s'z',z not in list)rO r6 rS rT r$ rL )r r rM r r r remove_passthroughI s
zDirect.remove_passthroughc C s" | j | || jko || j| kS )N)rO r6 )r r rM r r r query_passthroughS s
zDirect.query_passthroughc C s. | j | || jkr | j| S td| d S )Nz No passthroughs for ipv '%s')rO r6 r$ )r r r r r get_passthroughsW s
zDirect.get_passthroughsc C s | j S )N)r6 )r r r r get_all_passthroughs^ s zDirect.get_all_passthroughsc C s | j | jjds&ttjd| j t| }tj }|j | t
| jdb}tj d }|j | y|j
| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X d S )Nz.xmlz'%s' is missing .xml suffixrbzNot a valid file: %s)rC r8 endswithr r
Z INVALID_NAMEr saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZ INVALID_TYPEZ getException)r handlerparserfsourcemsgr r r readc s
z Direct.readc
C sB t jj| jr\ytj| jd| j W n4 tk
rZ } ztd| j|f W Y d d }~X nX t jjtj sxt j
tj d t j | jddd}t
|}|j |jdi |jd xR| jD ]H}|\}}x:| j| D ],}|jd |jd
|||d |jd qW qW x| jD ]}|\}}}xx| j| D ]j\}} t| d k r@q&|jd |jd
|||d| d |jtjjt| |jd
|jd q&W q W x|| jD ]r}xj| j| D ]\} t| d k rȐq|jd |jdd|i |jtjjt| |jd |jd qW qW |jd |jd |j |j ~d S )Nz%s.oldzBackup of '%s' failed: %si ZwtzUTF-8)modeencodingr
z r )r r r r< r z%d)r r r r r r ) ospathexistsr8 shutilZcopy2 ExceptionIOErrorr Z
ETC_FIREWALLDmkdiriorf r Z
startDocumentr ZignorableWhitespacer3 Z
simpleElementr5 rT re Zsaxutilsescaper r+ r6 Z endDocumentclose)
r rl rj rh rA r r r r rM r r r writeu sZ $
z Direct.write)r4 r4 r4 )#r/ r0 r1 __doc__rE ZDBUS_SIGNATUREZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r; rB rH rC rN rO rQ r! rU rV rW rX r- rZ r[ r\ r] r^ r. r_ r` ra rb rm r{
__classcell__r r )r9 r r2 u sH
r2 )Zxml.saxre rq rx rt Zfirewallr Zfirewall.fw_typesr Zfirewall.functionsr r r Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr
Z
firewall.corer r r
Zfirewall.errorsr r r2 r r r r s
NPK ! r # __pycache__/__init__.cpython-36.pycnu [ 3
Yj< @ sj d dl Z de jkrfd dlmZ eeds s
PK ! r ) __pycache__/__init__.cpython-36.opt-1.pycnu [ 3
Yj< @ sj d dl Z de jkrfd dlmZ eeds s
PK ! 9), ), & __pycache__/ipset.cpython-36.opt-1.pycnu [ 3
YjU @ s d Z dddgZddljZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZmZmZmZ ddlmZmZmZmZ dd lmZmZ dd
lm Z m Z m Z m Z dd l m!Z! dd lm"Z" dd
l#m$Z$ G dd deZ%G dd deZ&dd Z'dddZ(dS )z$ipset io XML handler, reader, writerIPSet ipset_reader ipset_writer N)config) checkIPcheckIP6 checkIPnMask
checkIP6nMask
u2b_if_py2 check_mac
check_portcheckInterface
checkProtocol)PY2 IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator) IPSET_TYPESIPSET_CREATE_OPTIONS)check_icmp_namecheck_icmp_type_codecheck_icmpv6_namecheck_icmpv6_type_code)log)errors)
FirewallErrorc s e Zd Zd d d d!dddifddgffZdZd d
d d gZd
d
dgdgd
dZdgdgdZ fddZdd Z dd Z
e dd Z dd Z
fd d Z ZS )"r version short descriptiontypeoptionsentriesz
(ssssa{ss}as)_-:.Nname)r r ipsetoptionentryvalue)r( r) c s< t t| j d| _d| _d| _d| _g | _i | _d| _ d S )Nr F)
superr __init__r r r r r" r! applied)self) __class__ /usr/lib/python3.6/ipset.pyr- C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d = | jj d| _d S )Nr F)r r r r r" r! clearr. )r/ r1 r1 r2 cleanupM s
z
IPSet.cleanupc C s\ t | j| _t | j| _t | j| _t | j| _dd | jj D | _dd | jD | _dS )z HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s i | ]\}}t |t |qS r1 )r
).0kvr1 r1 r2
^ s z(IPSet.encode_strings..c S s g | ] }t |qS r1 )r
)r5 er1 r1 r2
` s z(IPSet.encode_strings..N)r
r r r r r! itemsr" )r/ r1 r1 r2 encode_stringsV s zIPSet.encode_stringsc C sr d}d|kr |d dkr d}|j ds6ttjd| |dd jd}| jd}t|t|ksnt|d k rttjd
| |f xtt|D ]}|| }|| }|d krd |ko|dkrh|d krttjd
|| |f |jd } t| dkrttjd|| ||f x| D ]J}
|dkr2t|
sH|dkrt |
rttjd|
| ||f qW nh|dkr|dkrttjd|| ||f |dkrt
} nt} nt } | |sjttjd|| ||f q|dkr@d |kr|jd } t| dkrttjd|| ||f |dkr0t| d sJ|dkrft | d rfttjd| d | ||f |dkrt
| d s|dkr>t | d r>ttjd| d | ||f n|j dr|dko|dko|dksttjd|| ||f |dkrt
| s&|dkrjt | rjttjd|| ||f q|dkrvt
| s`|dkrjttjd|| f q|dkrld|krL|jd} t| dkrttjd| | d d krP|dkrttjd || f t| d rd | d krttjd | d | f n6| d jd \} }
t| |
sJttjd | d | f qj| d d2kr|dkr|ttjd || f t| d rd | d krttjd"| d | f n6| d jd \} }
t| |
sJttjd"| d | f n^| d d3kr$t| d r$ttjd'| d | f n&t| d sjttjd(| d | f n t|sjttjd)|| f q|d*kr |j d+ryt|d,}W n* tk
r ttjd-|| f Y nX n8y t|}W n* tk
r ttjd-|| f Y nX |dk s
|d.krjttjd-|| f q|d/krZt| sDt|d0krjttjd1|| f qttjd| qW d S )4NZipv4familyinet6Zipv6zhash:zipset type '%s' not usable , z)entry '%s' does not match ipset type '%s'Zipr$ z invalid address '%s' in '%s'[%d] z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r Znetz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'Zportr% zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'/z invalid icmp type '%s' in '%s'icmpv6 ipv6-icmpz invalid icmpv6 type '%s' in '%s'tcpsctpudpudplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'ZmarkZ0x zinvalid mark '%s' in '%s'l Ziface z invalid interface '%s' in '%s')rD rE )rF rG rH rI )
startswithr r
INVALID_IPSETsplitlenZ
INVALID_ENTRYranger r r r endswithr r r r r r r int
ValueErrorr
)r* r! Z
ipset_typer= flagsr; iflagitemZsplitsZ_splitZip_checkZ_type_codeZint_valr1 r1 r2 check_entryb sT
zIPSet.check_entryc C s |dkr |t kr ttjd| |dkrx|j D ]}|tkrNttjd| |dkryt|| }W n, tk
r ttj d||| f Y nX |d k rttj d
||| f q2|d kr2|| dkr2ttj
|| q2W d S )Nr z '%s' is not valid ipset typer! zipset invalid option '%s'timeouthashsizemaxelemz)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer= inetr> )rZ r[ r\ )r] r> ) r r r INVALID_TYPEkeysr rM rR rS
INVALID_VALUEINVALID_FAMILY)r/ r rW Z
all_configkey int_valuer1 r1 r2
_check_config& s2
zIPSet._check_configc sr d|d kr6|d d dkr6t |d dkr6ttjx&|d D ]}tj||d |d q@W tt| j| d S )NrZ 0r? r )rO r r ZIPSET_WITH_TIMEOUTr rY r,
import_config)r/ r r* )r0 r1 r2 rh A s
zIPSet.import_config)r r )r r )r r )r r )__name__
__module__ __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr- r4 r< staticmethodrY rd rh
__classcell__r1 r1 )r0 r2 r , s,
Ec @ s e Zd Zdd Zdd ZdS )ipset_ContentHandlerc
C s t j| || | jj|| |dkrpd|krX|d tkrLttjd|d |d | j_d|krl|d | j_ nz|dkr|nn|dkrnb|dkrd}d |kr|d }|d
dkrttj
d|d
| jjdko|d
dk rttj
d|d
| jjf |d
dkr&| r&ttj
d|d
|d
d kry t |}W n. t k
rn ttj
d|d
|f Y nX |dk rttj
d|d
|f |d
d kr|d krttj||d
| jjkr|| jj|d
< ntjd|d
d S ) Nr( r z%sr r r r) r r+ r' r= rZ r[ r\ zUnknown option '%s'zhash:macz%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'z)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer] r> z Option %s already set, ignoring.)r= rZ r[ r\ )r= )r= rZ r[ r\ )rZ r[ r\ )r] r> )r startElementrW Zparser_check_element_attrsr r r r^ r r ZINVALID_OPTIONrR rS r` ra r! r warning)r/ r' attrsr+ rc r1 r1 r2 ro L sd
z!ipset_ContentHandler.startElementc C s( t j| | |dkr$| jjj| j d S )Nr* )r
endElementrW r" appendZ_element)r/ r' r1 r1 r2 rr s z ipset_ContentHandler.endElementN)ri rj rk ro rr r1 r1 r1 r2 rn K s 7rn c % C s t }| jds ttjd| | d d |_|j|j | |_||_|j t
j rVdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X ~~d |jkrF|jd d
krFt|jd krFt j d |j |jd d = d } t }
x| t|jk r|j| |
krt j d
|j| |jj | nry |j |j| |j|j! W n< tk
r } z t j d| |jj | W Y d d } ~ X nX |
j"|j| | d7 } qRW ~
t#r|j$ |S )Nz.xmlz'%s' is missing .xml suffixre FTz%s/%srbznot a valid ipset file: %srZ rf r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z
%s, ignoring.rA )%r rQ r r Z INVALID_NAMEr' Z
check_namefilenamepathrL r
ETC_FIREWALLDZbuiltindefaultrn saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionrM Z getExceptionr! rO r" r rp setpoprY r addr r< ) rv rw r( handlerparserr' fsourcemsgrU Z entries_setr9 r1 r1 r2 r s^
( c C s |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j d | ji}| jr| jd
kr| j|d < |jd | |jd
| jrz| jd
krz|jd |jdi |j| j |jd |jd
| jr| jd
kr|jd |jdi |j| j |jd |jd
xZ| jj D ]L\} }
|jd |
d
kr |j d| |
d n|j dd| i |jd
qW xD| j D ]:} |jd |jdi |j| |jd |jd
q(W |jd |jd
|j |j ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr r r r(
z r r r) )r' r+ r' r* )!rw rv r' osexistsshutilZcopy2 Exceptionr errordirnamerL r rx mkdirior{ r Z
startDocumentr r ro ZignorableWhitespacer Z
charactersrr r r! r; Z
simpleElementr" Z endDocumentclose) r( rw _pathr' r dirpathr r rq rb r+ r* r1 r1 r2 r sf
)N))__doc____all__Zxml.saxrz r r r Zfirewallr Zfirewall.functionsr r r r r
r r r
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rn r r r1 r1 r1 r2 s&
, !=5PK ! I>. . ! __pycache__/direct.cpython-36.pycnu [ 3
Yj= @ s d dl jZd dlZd dlZd dlZd dlmZ d dlmZ d dl m
Z
m Z m Z d dl
mZmZmZ d dlmZ d dlmZ d dlmZ d d lmZ d d
lmZ G d d d eZG d
d deZdS ) N)config)LastUpdatedOrderedDict) splitArgsjoinArgs
u2b_if_py2) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator)log) ipXtables)ebtables)errors)
FirewallErrorc @ s$ e Zd Zdd Zdd Zdd ZdS )direct_ContentHandlerc C s t j| | d| _d S )NF)r __init__direct)selfitem r /usr/lib/python3.6/direct.pyr ( s z direct_ContentHandler.__init__c C s t j| || | jj|| |dkr@| jr6ttjdd| _n>|dkr| js\tj d d S |d }|d }|d }| jj
t |t |t | n|dkr6| jstj d d S |d }|dkrttj d
| |d }|d }yt
|d }W n( tk
r tj d|d d S X t |t |t ||g| _nH|dkrl| jsVtj d d S |d }t |g| _ntj d| d S d S )Nr zMore than one direct tag.Tchainz$Parse Error: chain outside of directipvtablerulez#Parse Error: rule outside of directipv4ipv6ebz"'%s' not from {'ipv4'|'ipv6'|'eb'}priorityz'Parse Error: %s is not a valid priority passthroughz&Parse Error: command outside of directzUnknown XML element %s)r r r )r startElementr Zparser_check_element_attrsr r r
Z PARSE_ERRORr
error add_chainr INVALID_IPVint
ValueError_rule _passthrough)r nameZattrsr r r r r r r r , sT
z"direct_ContentHandler.startElementc C s t j| | |dkrX| jrF| jjdd t| jD | jj| j n
tj d d | _nJ|dkr| jr| j
jdd t| jD | jj | j
n
tj d d | _
d S )
Nr c S s g | ] }t |qS r )r ).0xr r r
d s z4direct_ContentHandler.endElement..z2Error: rule does not have any arguments, ignoring.r c S s g | ] }t |qS r )r )r( r) r r r r* m s z0Error: passthrough does not have any arguments, z ignoring.z9Error: passthrough does not have any arguments, ignoring.) r
endElementZ_elementr% appendr r add_ruler
r r& add_passthrough)r r' r r r r+ ^ s
z direct_ContentHandler.endElementN)__name__
__module__ __qualname__r r r+ r r r r r ' s 2r c s< e Zd ZdZddBgfddddddgfgfdddgfgffZdZdd d
d gd d
d d gd gd
Zi Z fddZdd Z dd Z
dd Z dd Z dd Z
dd Zd d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Z d8d9 Z d:d; Z dd? Z d@dA Z! Z"S )CDirectz Direct class chains rulesr passthroughsz(a(sss)a(sssias)a(sas))Nr r r r )r r r r c s0 t t| j || _t | _t | _t | _d S )N)superr2 r filenamer r3 r5 r6 )r r8 ) __class__r r r s
zDirect.__init__c C s d S )Nr )r confr Zall_confr r r
_check_config s zDirect._check_configc C s g }g }x>| j D ]4}x.| j | D ] }|jtt|t|g q W qW |j| g }xR| jD ]H}xB| j| D ]4}|jt|d |d |d |d t|d f qnW q^W |j| g }x8| jD ].}x(| j| D ]}|jt|t|f qW qW |j| t|S )Nr )r3 r, tuplelistr5 r6 )r retr) keyr r r r r
export_config s$ $
zDirect.export_configc C s | j | j| xt| jD ]x\}\}}|dkrNx|| D ]}| j| q r
rR rL )r r r r r rM rA valuer r r r- s
zDirect.add_rulec C s | j || |||f}|t|f}|| jkrb|| j| krb| j| |= t| j| dkr| j|= n$tddj|||f d||f d S )Nr z(Rule '%s' for table '%s' and chain '%s' z',z)with ipv '%s' and priority %d not in list)rQ r> r5 rT r$ rL )r r r r r rM rA rY r r r remove_rule s
zDirect.remove_rulec C sb | j || |||f}|| jkr^x"| j| j D ]}| j| |= q0W t| j| dkr^| j|= d S )Nr )rQ r5 rP rT )r r r r rA rY r r r remove_rules" s
zDirect.remove_rulesc C s: | j || |||f}|t|f}|| jko8|| j| kS )N)rQ r> r5 )r r r r r rM rA rY r r r
query_rule+ s
zDirect.query_rulec C sF | j || |||f}|| jkr*| j| S td||f d| d S )Nz'No rules for table '%s' and chain '%s' z
with ipv '%s')rQ r5 r$ )r r r r rA r r r get_rules1 s
zDirect.get_rulesc C s | j S )N)r5 )r r r r
get_all_rules: s zDirect.get_all_rulesc C s^ | j | || jkr g | j|< || j| kr>| j| j| n tjddj||f d d S )Nz Passthrough '%s' for ipv '%s'z',zalready in list, ignoring)rO r6 r, r
rR rL )r r rM r r r r. ? s
zDirect.add_passthroughc C sl | j | || jkrN|| j| krN| j| j| t| j| dkrh| j|= ntddj||f d d S )Nr z Passthrough '%s' for ipv '%s'z',z not in list)rO r6 rS rT r$ rL )r r rM r r r remove_passthroughI s
zDirect.remove_passthroughc C s" | j | || jko || j| kS )N)rO r6 )r r rM r r r query_passthroughS s
zDirect.query_passthroughc C s. | j | || jkr | j| S td| d S )Nz No passthroughs for ipv '%s')rO r6 r$ )r r r r r get_passthroughsW s
zDirect.get_passthroughsc C s | j S )N)r6 )r r r r get_all_passthroughs^ s zDirect.get_all_passthroughsc C s | j | jjds&ttjd| j t| }tj }|j | t
| jdb}tj d }|j | y|j
| W n8 tjk
r } zttjd|j W Y d d }~X nX W d Q R X d S )Nz.xmlz'%s' is missing .xml suffixrbzNot a valid file: %s)rC r8 endswithr r
Z INVALID_NAMEr saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZ INVALID_TYPEZ getException)r handlerparserfsourcemsgr r r readc s
z Direct.readc
C sB t jj| jr\ytj| jd| j W n4 tk
rZ } ztd| j|f W Y d d }~X nX t jjtj sxt j
tj d t j | jddd}t
|}|j |jdi |jd xR| jD ]H}|\}}x:| j| D ],}|jd |jd
|||d |jd qW qW x| jD ]}|\}}}xx| j| D ]j\}} t| d k r@q&|jd |jd
|||d| d |jtjjt| |jd
|jd q&W q W x|| jD ]r}xj| j| D ]\} t| d k rȐq|jd |jdd|i |jtjjt| |jd |jd qW qW |jd |jd |j |j ~d S )Nz%s.oldzBackup of '%s' failed: %si ZwtzUTF-8)modeencodingr
z r )r r r r< r z%d)r r r r r r ) ospathexistsr8 shutilZcopy2 ExceptionIOErrorr Z
ETC_FIREWALLDmkdiriorf r Z
startDocumentr ZignorableWhitespacer3 Z
simpleElementr5 rT re Zsaxutilsescaper r+ r6 Z endDocumentclose)
r rl rj rh rA r r r r rM r r r writeu sZ $
z Direct.write)r4 r4 r4 )#r/ r0 r1 __doc__rE ZDBUS_SIGNATUREZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r; rB rH rC rN rO rQ r! rU rV rW rX r- rZ r[ r\ r] r^ r. r_ r` ra rb rm r{
__classcell__r r )r9 r r2 u sH
r2 )Zxml.saxre rq rx rt Zfirewallr Zfirewall.fw_typesr Zfirewall.functionsr r r Zfirewall.core.io.io_objectr r r Zfirewall.core.loggerr
Z
firewall.corer r r
Zfirewall.errorsr r r2 r r r r s
NPK ! FmR R ' __pycache__/policy.cpython-36.opt-1.pycnu [ 3
YjϢ @ s d ddgZ ddljZddlZddlZddlZddlmZ ddlm Z m
Z
ddlm Z m Z m
Z
ddlmZmZmZ dd lmZmZmZmZmZmZ dd
lmZ dd lm Z dd lm Z dd
l m Z dd Z dd Z!dd Z"dd Z#dd Z$G dd d eZ%G dd deZ&d d dZ'd d dZ(dS ) Policy
policy_reader
policy_writer N)config)checkIPcheckIP6)uniqifymax_policy_name_lenportStr)DEFAULT_POLICY_TARGETPOLICY_TARGETSDEFAULT_POLICY_PRIORITY) IO_ObjectIO_Object_ContentHandlerIO_Object_XMLGenerator
check_port check_tcpudpcheck_protocol)rich)log)errors)
FirewallErrorc C s |dkr n|dkrn|dkr| j r`| j jrJtjdt| j d| _dS tj|d | j _dS |d | jj kr| jj j
|d ntjd|d n|dkrN| j r| j jrtjdt| j d| _dS tj |d |d | j _dS t |d t
|d t|d d
|d f}|| jjkr4| jjj
| ntjd |d |d nN|d kr| j r| j jrtjdt| j d| _dS tj|d | j _nBt|d |d | jjkr| jjj
|d ntjd
|d n|dkrh| j r.| j jrtjdt| j d| _dS tj|d | j _dS |d | jjkrT| jjj
|d ntjd|d n4|dkr| j r| j jrtjdt| j d| _dS tj|d | j _dS tjd|d n|dkr2| j r| j jrtjdt| j d| _dS tj | j _n | jjr&tjd nd| j_nj|dkrd}d|krR|d }d}d|krh|d }| j r| j jrtjdt| j d| _dS tj|d |d ||| j _dS t |d t
|d |rt | |r
t| r
t| r
tt j d| t|d d
|d t|d
t|f}|| jj krL| jj j
| n6tjd|d |d |rld| nd|r|d| nd n|d kr@| j r| j jrtjdt| j d| _dS tj |d |d | j _dS t |d t
|d t|d d
|d f}|| jj kr&| jj j
| ntjd |d |d n\|d kr| j sftjd d| _dS | j j!rtjd t| j dS d!}d }d"|kr|d" }d }d#|kr|d# }d$|kr|d$ j" dLkrd}tj#|||| j _!n|dMkr| j stjd+ d| _dS | j j$r0tjd, d| _dS |d'krHtj% | j _$nh|d(krxd } d-|krh|d- } tj&| | j _$n8|d)krtj' | j _$n |d*kr|d. }
tj(|
| j _$| j j$| _)n|d/kr^| j stjd0 dS | j jrtjd1 dS d } d2|kr*|d2 } | dNkr*tjd; d| _dS d<|kr<|d< nd } tj*| | | j _| j j| _)n>|d=kr| j s~tjd> dS | j j+rtjd?t| j d| _dS tj, | j _+| j j+| _)n|d@kr,d }
dA}dB|kr|dB }
|
dOkrtjdE|dB d| _dS dF|krt-|dF }tj.|
|dG| _ np|dHkr| j)sRtjdI d| _dS | j)j/rxtjdJt| j d| _dS |d }tj0||j1dK| j)_/nd!S dS )PNshort descriptionservicez;Invalid rule: More than one element in rule '%s', ignoring.Tnamez#Service '%s' already set, ignoring.portprotocol-z#Port '%s/%s' already set, ignoring.valuez$Protocol '%s' already set, ignoring.z
icmp-blockz&icmp-block '%s' already set, ignoring.z icmp-typez-Invalid rule: icmp-block '%s' outside of rule
masqueradez!Masquerade already set, ignoring.z forward-port zto-portzto-addrz#to-addr '%s' is not a valid addressz-Forward port %s/%s%s%s already set, ignoring.z >%sz @%sz source-portz*Source port '%s/%s' already set, ignoring. destinationz)Invalid rule: Destination outside of rulez?Invalid rule: More than one destination in rule '%s', ignoring.Faddressipsetinvertyestrueacceptrejectdropmarkz$Invalid rule: Action outside of rulez"Invalid rule: More than one actiontypesetr z!Invalid rule: Log outside of rulez Invalid rule: More than one loglevelemergalertcriterrorwarningnoticeinfodebugz Invalid rule: Invalid log levelprefixauditz#Invalid rule: Audit outside of rulez9Invalid rule: More than one audit in rule '%s', ignoring.ruler familyipv4ipv6z&Invalid rule: Rule family "%s" invalidpriority)r: r= limitz4Invalid rule: Limit outside of action, log and auditz9Invalid rule: More than one limit in rule '%s', ignoring.burst)r& r' )r( r) r* r+ )r/ r0 r1 r2 r3 r4 r5 r6 )r; r< )2_ruleelementr r3 str _rule_errorr Rich_Serviceitemservicesappend Rich_Portr r r
ports
Rich_Protocolr protocolsRich_IcmpBlock icmp_blocks
Rich_IcmpTypeRich_Masquerader Rich_ForwardPortr r r r INVALID_ADDR
forward_portsRich_SourcePort source_portsr" lowerZRich_Destinationaction Rich_Accept Rich_Reject Rich_Drop Rich_Mark _limit_okZRich_Logr8 Z
Rich_Auditint Rich_Ruler> Z
Rich_Limitget)objr attrsentryto_portZto_addrr% r# r$ Z_typeZ_setr. r7 r: r= r rc /usr/lib/python3.6/policy.pycommon_startElement s
re c C s |dkr| j sy| jj W n6 tk
rR } ztjd|t| j W Y d d }~X nLX t| j| jjkr| jj j
| j | jjj
t| j ntjdt| j d | _d| _ n|d krd | _ d S ) Nr9 z%s: %sz Rule '%s' already set, ignoring.Fr( r) r* r+ r r8 )r( r) r* r+ r r8 ) rC r@ Zcheck Exceptionr r3 rB rE rules_strrulesrG r[ )r_ r erc rc rd common_endElement s & rj c C s t | trdnd}|dkrT| jrT| jj }x$|D ] }||kr0ttjd| q0W n|dkrx$|D ] }t|d t|d qbW nb|dkrx|D ] }t | qW n@|d kr| jr| jj
} x$|D ] }
|
| krttj d
|
qW n|d krx|D ]} t| d t| d | d r>| d
r>ttj d| | d rTt| d | d
rt
| d
rt| d
rttjd| d
qW nT|dkrx&|D ] }t|d t|d qW n |dkrx|D ]} tj| d}
| jr|
jrt |
jtjs t |
jtjr| jj
} |
jj| krLttj d
|
jj nH|
jr| jj|
jj}|jr|
j|jkrttj d|
j|
jjf nL| jrt |
jtjr| jj }|
jj|krttjdj|| j|
jjqW d S )Nr ZZonerF z '%s' not among existing servicesrI r rK rM z"'%s' not among existing icmp typesrR z$'%s' is missing to-port AND to-addr z#to-addr '%s' is not a valid addressrT rg
rich_rules)rule_strz3rich rule family '%s' conflicts with icmp type '%s'z){} '{}': '{}' not among existing services)rg rn )
isinstancer fw_configZ get_servicesr r ZINVALID_SERVICEr r r Z
get_icmptypesZINVALID_ICMPTYPEINVALID_FORWARDr r rQ r r] rA rL rN r r: Z get_icmptyper" rD format)r_ r rE
all_configZobj_typeZexisting_servicesr r protoZexisting_icmptypesZicmptypefwd_portr9 Zobj_richZictrc rc rd common_check_config2 s
rw c C s0 d|j i}|j}|d k r ||d< | jd| d S )Nr r? r> )r r?
simpleElement)handlerr> dr? rc rc rd _handler_add_rich_limitx s
r{ c C s | j rF| j dkrF|jd |jdi |j| j |jd |jd | jr| jdkr|jd |jdi |j| j |jd |jd x6t| jD ](}|jd |jdd|i |jd qW x@t| j D ]2}|jd |jd|d |d
d |jd qW x8t| j
D ]*}|jd |jd d
|i |jd qW x8t| j D ]*}|jd |jdd|i |jd qLW | j r|jd |jdi |jd xt| j
D ]}|jd |d |d
d }|d r|d dkr|d |d< |d r|d dkr|d |d< |jd| |jd qW xBt| jD ]4}|jd |jd|d |d
d |jd q>W xT| jD ]H}i }|jr|j|d< |jd krt|j|d< |jd |jd| |jd |jrVi }|jjr|jj|d< |jjr|jj|d< |jjr$|jj|d< |jjr6d |d < |jd |jd | |jd |jri }|jjrx|jj|d< |jjr|jj|d< |jjrd |d < |jd |jd | |jd |jrxd} i }t|jtj krd} |jj |d< nbt|jtj kr(d} |jj |d< |jj |d < n0t|jtj!krNd } |jj"|d
< n
t|jtj#krfd} nt|jtj$krd} |jj |d< nt|jtj%krd!} |jj |d< nt|jtj&krd} |jj |d< |jj |d < |jj'dkr|jj'|d< |jj(dkrX|jj(|d< nFt|jtj)krBd} |jj |d< |jj |d < nt*t+j,d"t|j |jd |j| | |jd |j-r i }|j-j.r|j-j.|d#< |j-j/r|j-j/|d$< |j-j0r|jd |jd%| |jd& t1||j-j0 |jd' |jd% n|jd |jd%| |jd |j2ri }|j2j0rx|jd |jd(i |jd& t1||j2j0 |jd' |jd( n|jd |jd(| |jd |j3rd}
i }t|j3tj4krd)}
n|t|j3tj5krd*}
|j3jr<|j3j|d+< nNt|j3tj6krd,}
n6t|j3tj7kr*d-}
|j3j8|d.< nt-j9d/t|j3 |j3j0r|jd |j|
| |jd& t1||j3j0 |jd' |j|
n|jd |j|
| |jd |jd |jd |jd qW d S )0Nr! z r
r r r r r rk )r r r r z
icmp-blockr rl zto-portrm zto-addrz forward-portz source-portr: r= r9 r# macr$ Truer% z sourcer" z icmp-typez"Unknown element '%s' in obj_writerr7 r. r z
z
r8 r( r) r, r* r+ r- zUnknown action '%s'):r ignorableWhitespace startElementZ
characters
endElementr r rF rx rI rK rM r rR rT rh r: r= rB r addrr} r$ r% r" rA r, r rD r rH r r rJ r rO rL rN rP rb
to_addressrS r r ZINVALID_OBJECTr r7 r. r> r{ r8 rV rW rX rY rZ r- r3 ) r_ ry r r r ZicmpZforwardr` r9 rA rV rc rc rd
common_writer s\
r c sP e Zd Zd7ZdZeZdgZd8d9d:d;d dgfd
dgfddgfddgfdd?gfd@ddgfddgffZdddgZ dddgdgddgdgdgdddgdddd gddgdddddd gd gdgdgd Z
ddgd d gd!dgd"d#d$d!d%gd"d$d%gd&d'gd(gd)gd*Z fd+d,Z d-d. Z
fd/d0Z fd1d2Zd3d4 Z fd5d6Z ZS )Ar i i r versionr! r r targetrF rI rM r FrR rn rK rT r=
ingress_zones egress_zones_r /Nr r r r r- )r r policyr r z
icmp-blockz icmp-typer z forward-portr9 r r" r z source-portr r8 r( r) r* r+ r> z ingress-zonez egress-zonezto-portzto-addrr: r# r} r% r$ r7 r. r, r? )r z forward-portr9 r r" r r) r> c s t t| j d| _d| _d| _t| _g | _g | _ g | _
g | _ d| _ g | _
g | _d | _g | _g | _d| _| j| _d | _g | _g | _d S )Nr! F)superr __init__r r r r r rF rI rK rM r rR rT rq rh rg appliedpriority_defaultr= Zderived_from_zoner r )self) __class__rc rd r s( zPolicy.__init__c C s d| _ d| _d| _t| _| jd d = | jd d = | jd d = | jd d = d| _ | j
d d = | j d d = d | _ | j
d d = | jd d = d| _| j| _| jd d = | jd d = d S )Nr! F)r r r r r rF rI rK rM r rR rT rq rh rg r r r= r r )r rc rc rd cleanup s$ zPolicy.cleanupc s" |dkr| j S ttt| |S d S )Nrn )rg getattrr r )r r )r rc rd __getattr__ s zPolicy.__getattr__c sB |dkr,dd |D | _ dd | j D | _ntt| j|| d S )Nrn c S s g | ]}t j|d qS ))ro )r r] ).0src rc rd
s z&Policy.__setattr__..c S s g | ] }t |qS rc )rB )r r rc rc rd r s )rh rg r r __setattr__)r r r )r rc rd r s zPolicy.__setattr__c
C s t | ||| |dkr2|tkr.ttjd| n|dkrz|| jksX|| jksX|| jk rvttjd|| j| j| jf n|dkrhddg}| j r|| j j
7 }x|D ]}||krttj d | |dkrt ddgt |@ s|d krt |t |g rttj d
| |dkr|dkr8d|kr8d|d ksT|dkrd|krd|d krttj d qW n|d kr|rd|krd|d krttj d
nxd|krd|d krttj dxR|d D ]F}|dkrސq| j j
|}| j rd| j j|krttj dqW n|dkr4x|D ] }tj|d}|jrt|jtjrd|kr|d|d kr|ttj d
nxd|kr,d|d krttj dxR|d D ]F}|dkrq| j j
|}| j rd| j j|krttj dqW q,|jrt|jtjrd|kr,d|d kr@|jjrttjdnt|d r,|jjs`ttjdd|d kr,x|d D ]8}| j j
|}| j rxd| j j|krxttj dqxW nv|jr,t|jtjr,d|kr,xR|d D ]F}|d krq| j j
|}| j rd| j j|krttj dqW q,W n|dkrx|D ]} d|krnd|d krnttj dnd|krDd|d kr| d rttjdnt|d rD| d sttjdd|d krDxD|d D ]8}| j j
|}| j rd| j j|krttj dqW qDW d S ) Nr z'%s' is invalid targetr= zQ%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %sr r ANYHOSTz '%s' not among existing zonesz>'%s' may only contain one of: many regular zones, ANY, or HOSTzF'HOST' can only appear in either ingress or egress zones, but not bothr z.'masquerade' is invalid for egress zone 'HOST'z/'masquerade' is invalid for ingress zone 'HOST'Z
interfaceszR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesrn )ro zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesrR z1'forward-port' is invalid for ingress zone 'HOST'rm )r r )r r )r r )r r )rw r r r INVALID_TARGETpriority_reserved priority_max priority_minZINVALID_PRIORITYrq get_zonesZ INVALID_ZONEr- Zget_zoneZget_zone_config_dictr r] rA rp rO rP r rr rV rZ )
r r rE rt Zexisting_zoneszoneZz_objr9 r_ rv rc rc rd
_check_config s
"
zPolicy._check_configc s t t| j| |jdr,ttjd| n|jdrHttjd| n|jddkrhttjd| njd|kr|d |j d }n|}t
|t krttjd|t
|t f | j r|| j j
krttjdd S )Nr z'%s' can't start with '/'z'%s' can't end with '/'rk zmore than one '/' in '%s'z&Policy of '%s' has %d chars, max is %dz,Policies can't have the same name as a zone.)r r
check_name
startswithr r INVALID_NAMEendswithcountfindlenr rq r Z
NAME_CONFLICT)r r Z checked_name)r rc rd r , s*
zPolicy.check_namei )r r! )r r! )r r! )r r! )r! r! )r F)r! r! r! r! )r! r! )r= r )__name__
__module__ __qualname__r r r
r r ZIMPORT_EXPORT_STRUCTUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr r r r r r
__classcell__rc rc )r rd r Z sr
^c @ s$ e Zd Zdd Zdd Zdd ZdS )policy_ContentHandlerc C s" t j| | d | _d| _d | _d S )NF)r r r@ rC r[ )r rE rc rc rd r H s z policy_ContentHandler.__init__c C s t j| || | jrd S | jj|| t| ||r6d S |dkrd|krR|d | j_d|krjt|d | j_d|kr|d }|t krt
t j ||r|| j_
n^|dkr|d | jjkr| jjj|d ntjd|d n |dkr |d | jjkr| jjj|d ntjd |d n|d
kr| jsFtjd d | _d S | jjrltjd
t| j d | _d S d}d|kr|d j dkrd }d } }}d|kr|d }d|kr|d }d|kr|d }tj||||d| j_d S tjd| d S d S )Nr r r= r z ingress-zoner z(Ingress zone '%s' already set, ignoring.z egress-zonez'Egress zone '%s' already set, ignoring.r z$Invalid rule: Source outside of ruleTz:Invalid rule: More than one source in rule '%s', ignoring.Fr% r& r' r# r} r$ )r% zUnknown XML element '%s')r& r' )r r rC rE Zparser_check_element_attrsre r r\ r= r r r r r r rG r r3 r r@ r rB rU r Z Rich_Source)r r r` r r% r r} r$ rc rc rd r N sf
z"policy_ContentHandler.startElementc C s t j| | t| | d S )N)r r rj )r r rc rc rd r s z policy_ContentHandler.endElementN)r r r r r r rc rc rc rd r G s @r Fc
C s t }| jds ttjd| | d d |_|s>|j|j | |_||_|j t
j rZdnd|_ |j |_
t|}tj }|j| d|| f }t|db}tjd }|j| y|j| W n8 tjk
r } zttjd| j W Y d d } ~ X nX W d Q R X ~~|S )
Nz.xmlz'%s' is missing .xml suffix FTz%s/%srbznot a valid policy file: %s)r r r r r r r filenamepathr r
ETC_FIREWALLDZbuiltindefaultr saxZ make_parserZsetContentHandleropenZ InputSourceZ
setByteStreamparseZSAXParseExceptionZINVALID_POLICYZ getException)
r r Z
no_check_namer ry parserr fr msgrc rc rd r s6
(c
C s |r|n| j }| jr$d|| jf }nd|| jf }tj j|rytj|d| W n0 tk
r } ztj d|| W Y d d }~X nX tj j
|}|j t j
rtj j| rtj jt j
stjt j
d tj|d tj|ddd}t|}|j i }| jr| jd kr| j|d
< | j| jkr0t| j|d < | j|d < |jd
| |jd t| | x8t| j D ]*} |jd |j dd| i |jd qfW x8t| j D ]*} |jd |j dd| i |jd qW |j d
|jd |j |j! ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si ZwtzUTF-8)modeencodingr! r r= r r r| z z ingress-zoner z egress-zone)"r r r osexistsshutilZcopy2rf r r2 dirnamer r r mkdirior r Z
startDocumentr r= r rB r r r r r r rx r r Z endDocumentclose)
r r _pathr r dirpathr ry r` r rc rc rd r sN
)F)N))__all__Zxml.saxr r r r Zfirewallr Zfirewall.functionsr r r r r
Zfirewall.core.baser r r
Zfirewall.core.io.io_objectr r r r r r Z
firewall.corer Zfirewall.core.loggerr r Zfirewall.errorsr re rj rw r{ r r r r r rc rc rc rd s4
F [ nL
PK ! oU U ipset.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2015-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
"""ipset io XML handler, reader, writer"""
__all__ = [ "IPSet", "ipset_reader", "ipset_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import checkIP, checkIP6, checkIPnMask, \
checkIP6nMask, u2b_if_py2, check_mac, check_port, checkInterface, \
checkProtocol
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.ipset import IPSET_TYPES, IPSET_CREATE_OPTIONS
from firewall.core.icmp import check_icmp_name, check_icmp_type_code, \
check_icmpv6_name, check_icmpv6_type_code
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class IPSet(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "type", "" ), # s
( "options", { "": "", }, ), # a{ss}
( "entries", [ "" ], ), # as
)
DBUS_SIGNATURE = '(ssssa{ss}as)'
ADDITIONAL_ALNUM_CHARS = [ "_", "-", ":", "." ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"ipset": [ "type" ],
"option": [ "name" ],
"entry": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"ipset": [ "version" ],
"option": [ "value" ],
}
def __init__(self):
super(IPSet, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.type = ""
self.entries = [ ]
self.options = { }
self.applied = False
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.type = ""
del self.entries[:]
self.options.clear()
self.applied = False
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.type = u2b_if_py2(self.type)
self.options = { u2b_if_py2(k):u2b_if_py2(v)
for k, v in self.options.items() }
self.entries = [ u2b_if_py2(e) for e in self.entries ]
@staticmethod
def check_entry(entry, options, ipset_type):
family = "ipv4"
if "family" in options:
if options["family"] == "inet6":
family = "ipv6"
if not ipset_type.startswith("hash:"):
raise FirewallError(errors.INVALID_IPSET,
"ipset type '%s' not usable" % ipset_type)
flags = ipset_type[5:].split(",")
items = entry.split(",")
if len(flags) != len(items) or len(flags) < 1:
raise FirewallError(
errors.INVALID_ENTRY,
"entry '%s' does not match ipset type '%s'" % \
(entry, ipset_type))
for i in range(len(flags)):
flag = flags[i]
item = items[i]
if flag == "ip":
if "-" in item and family == "ipv4":
# IP ranges only with plain IPs, no masks
if i > 1:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s'[%d]" % \
(item, entry, i))
splits = item.split("-")
if len(splits) != 2:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address range '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
for _split in splits:
if (family == "ipv4" and not checkIP(_split)) or \
(family == "ipv6" and not checkIP6(_split)):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(_split, entry, ipset_type, family))
else:
# IPs with mask only allowed in the first
# position of the type
if family == "ipv4":
if item == "0.0.0.0":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
if i == 0:
ip_check = checkIPnMask
else:
ip_check = checkIP
else:
ip_check = checkIP6
if not ip_check(item):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
elif flag == "net":
if "-" in item:
# IP ranges only with plain IPs, no masks
splits = item.split("-")
if len(splits) != 2:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address range '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
# First part can only be a plain IP
if (family == "ipv4" and not checkIP(splits[0])) or \
(family == "ipv6" and not checkIP6(splits[0])):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(splits[0], entry, ipset_type, family))
# Second part can also have a mask
if (family == "ipv4" and not checkIPnMask(splits[1])) or \
(family == "ipv6" and not checkIP6nMask(splits[1])):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(splits[1], entry, ipset_type, family))
else:
# IPs with mask allowed in all positions, but no /0
if item.endswith("/0"):
if not (family == "ipv6" and i == 0 and
ipset_type == "hash:net,iface"):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
if (family == "ipv4" and not checkIPnMask(item)) or \
(family == "ipv6" and not checkIP6nMask(item)):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid address '%s' in '%s' for %s (%s)" % \
(item, entry, ipset_type, family))
elif flag == "mac":
# ipset does not allow to add 00:00:00:00:00:00
if not check_mac(item) or item == "00:00:00:00:00:00":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mac address '%s' in '%s'" % (item, entry))
elif flag == "port":
if ":" in item:
splits = item.split(":")
if len(splits) != 2:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid port '%s'" % (item))
if splits[0] == "icmp":
if family != "ipv4":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid protocol for family '%s' in '%s'" % \
(family, entry))
if not check_icmp_name(splits[1]) and "/" not in splits[1]:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid icmp type '%s' in '%s'" % \
(splits[1], entry))
else:
(_type, _code) = splits[1].split("/")
if not check_icmp_type_code(_type, _code):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid icmp type '%s' in '%s'"
% (splits[1], entry),
)
elif splits[0] in [ "icmpv6", "ipv6-icmp" ]:
if family != "ipv6":
raise FirewallError(
errors.INVALID_ENTRY,
"invalid protocol for family '%s' in '%s'" % \
(family, entry))
if not check_icmpv6_name(splits[1]) and "/" not in splits[1]:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid icmpv6 type '%s' in '%s'" % \
(splits[1], entry))
else:
(_type, _code) = splits[1].split("/")
if not check_icmpv6_type_code(_type, _code):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid icmpv6 type '%s' in '%s'"
% (splits[1], entry),
)
elif splits[0] not in [ "tcp", "sctp", "udp", "udplite" ] \
and not checkProtocol(splits[0]):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid protocol '%s' in '%s'" % (splits[0],
entry))
elif not check_port(splits[1]):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid port '%s'in '%s'" % (splits[1], entry))
else:
if not check_port(item):
raise FirewallError(
errors.INVALID_ENTRY,
"invalid port '%s' in '%s'" % (item, entry))
elif flag == "mark":
if item.startswith("0x"):
try:
int_val = int(item, 16)
except ValueError:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mark '%s' in '%s'" % (item, entry))
else:
try:
int_val = int(item)
except ValueError:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mark '%s' in '%s'" % (item, entry))
if int_val < 0 or int_val > 4294967295:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid mark '%s' in '%s'" % (item, entry))
elif flag == "iface":
if not checkInterface(item) or len(item) > 15:
raise FirewallError(
errors.INVALID_ENTRY,
"invalid interface '%s' in '%s'" % (item, entry))
else:
raise FirewallError(errors.INVALID_IPSET,
"ipset type '%s' not usable" % ipset_type)
def _check_config(self, config, item, all_config):
if item == "type":
if config not in IPSET_TYPES:
raise FirewallError(errors.INVALID_TYPE,
"'%s' is not valid ipset type" % config)
if item == "options":
for key in config.keys():
if key not in IPSET_CREATE_OPTIONS:
raise FirewallError(errors.INVALID_IPSET,
"ipset invalid option '%s'" % key)
if key in [ "timeout", "hashsize", "maxelem" ]:
try:
int_value = int(config[key])
except ValueError:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is not an integer" % \
(key, config[key]))
if int_value < 0:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is negative" % \
(key, config[key]))
elif key == "family" and \
config[key] not in [ "inet", "inet6" ]:
raise FirewallError(errors.INVALID_FAMILY, config[key])
def import_config(self, config):
if "timeout" in config[4] and config[4]["timeout"] != "0":
if len(config[5]) != 0:
raise FirewallError(errors.IPSET_WITH_TIMEOUT)
for entry in config[5]:
IPSet.check_entry(entry, config[4], config[3])
super(IPSet, self).import_config(config)
# PARSER
class ipset_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "ipset":
if "type" in attrs:
if attrs["type"] not in IPSET_TYPES:
raise FirewallError(errors.INVALID_TYPE, "%s" % attrs["type"])
self.item.type = attrs["type"]
if "version" in attrs:
self.item.version = attrs["version"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "option":
value = ""
if "value" in attrs:
value = attrs["value"]
if attrs["name"] not in \
[ "family", "timeout", "hashsize", "maxelem" ]:
raise FirewallError(
errors.INVALID_OPTION,
"Unknown option '%s'" % attrs["name"])
if self.item.type == "hash:mac" and attrs["name"] in [ "family" ]:
raise FirewallError(
errors.INVALID_OPTION,
"Unsupported option '%s' for type '%s'" % \
(attrs["name"], self.item.type))
if attrs["name"] in [ "family", "timeout", "hashsize", "maxelem" ] \
and not value:
raise FirewallError(
errors.INVALID_OPTION,
"Missing mandatory value of option '%s'" % attrs["name"])
if attrs["name"] in [ "timeout", "hashsize", "maxelem" ]:
try:
int_value = int(value)
except ValueError:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is not an integer" % \
(attrs["name"], value))
if int_value < 0:
raise FirewallError(
errors.INVALID_VALUE,
"Option '%s': Value '%s' is negative" % \
(attrs["name"], value))
if attrs["name"] == "family" and value not in [ "inet", "inet6" ]:
raise FirewallError(errors.INVALID_FAMILY, value)
if attrs["name"] not in self.item.options:
self.item.options[attrs["name"]] = value
else:
log.warning("Option %s already set, ignoring.", attrs["name"])
# nothing to do for entry and entries here
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
if name == "entry":
self.item.entries.append(self._element)
def ipset_reader(filename, path):
ipset = IPSet()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
ipset.name = filename[:-4]
ipset.check_name(ipset.name)
ipset.filename = filename
ipset.path = path
ipset.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
ipset.default = ipset.builtin
handler = ipset_ContentHandler(ipset)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_IPSET,
"not a valid ipset file: %s" % \
msg.getException())
del handler
del parser
if "timeout" in ipset.options and ipset.options["timeout"] != "0" and \
len(ipset.entries) > 0:
# no entries visible for ipsets with timeout
log.warning("ipset '%s': timeout option is set, entries are ignored",
ipset.name)
del ipset.entries[:]
i = 0
entries_set = set()
while i < len(ipset.entries):
if ipset.entries[i] in entries_set:
log.warning("Entry %s already set, ignoring.", ipset.entries[i])
ipset.entries.pop(i)
else:
try:
ipset.check_entry(ipset.entries[i], ipset.options, ipset.type)
except FirewallError as e:
log.warning("%s, ignoring.", e)
ipset.entries.pop(i)
else:
entries_set.add(ipset.entries[i])
i += 1
del entries_set
if PY2:
ipset.encode_strings()
return ipset
def ipset_writer(ipset, path=None):
_path = path if path else ipset.path
if ipset.filename:
name = "%s/%s" % (_path, ipset.filename)
else:
name = "%s/%s.xml" % (_path, ipset.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start ipset element
attrs = { "type": ipset.type }
if ipset.version and ipset.version != "":
attrs["version"] = ipset.version
handler.startElement("ipset", attrs)
handler.ignorableWhitespace("\n")
# short
if ipset.short and ipset.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(ipset.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if ipset.description and ipset.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(ipset.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# options
for key,value in ipset.options.items():
handler.ignorableWhitespace(" ")
if value != "":
handler.simpleElement("option", { "name": key, "value": value })
else:
handler.simpleElement("option", { "name": key })
handler.ignorableWhitespace("\n")
# entries
for entry in ipset.entries:
handler.ignorableWhitespace(" ")
handler.startElement("entry", { })
handler.characters(entry)
handler.endElement("entry")
handler.ignorableWhitespace("\n")
# end ipset element
handler.endElement('ipset')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK !
Ϣ Ϣ policy.pynu [ # -*- coding: utf-8 -*-
#
# SPDX-License-Identifier: GPL-2.0-or-later
__all__ = [ "Policy", "policy_reader", "policy_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import checkIP, checkIP6
from firewall.functions import uniqify, max_policy_name_len, portStr
from firewall.core.base import DEFAULT_POLICY_TARGET, POLICY_TARGETS, DEFAULT_POLICY_PRIORITY
from firewall.core.io.io_object import IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \
check_tcpudp, check_protocol
from firewall.core import rich
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
def common_startElement(obj, name, attrs):
if name == "short":
pass
elif name == "description":
pass
elif name == "service":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Service(attrs["name"])
return True
if attrs["name"] not in obj.item.services:
obj.item.services.append(attrs["name"])
else:
log.warning("Service '%s' already set, ignoring.",
attrs["name"])
elif name == "port":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Port(attrs["port"],
attrs["protocol"])
return True
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (portStr(attrs["port"], "-"), attrs["protocol"])
if entry not in obj.item.ports:
obj.item.ports.append(entry)
else:
log.warning("Port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
elif name == "protocol":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Protocol(attrs["value"])
else:
check_protocol(attrs["value"])
if attrs["value"] not in obj.item.protocols:
obj.item.protocols.append(attrs["value"])
else:
log.warning("Protocol '%s' already set, ignoring.",
attrs["value"])
elif name == "icmp-block":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_IcmpBlock(attrs["name"])
return True
if attrs["name"] not in obj.item.icmp_blocks:
obj.item.icmp_blocks.append(attrs["name"])
else:
log.warning("icmp-block '%s' already set, ignoring.",
attrs["name"])
elif name == "icmp-type":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_IcmpType(attrs["name"])
return True
else:
log.warning("Invalid rule: icmp-block '%s' outside of rule",
attrs["name"])
elif name == "masquerade":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_Masquerade()
else:
if obj.item.masquerade:
log.warning("Masquerade already set, ignoring.")
else:
obj.item.masquerade = True
elif name == "forward-port":
to_port = ""
if "to-port" in attrs:
to_port = attrs["to-port"]
to_addr = ""
if "to-addr" in attrs:
to_addr = attrs["to-addr"]
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_ForwardPort(attrs["port"],
attrs["protocol"],
to_port, to_addr)
return True
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
if to_port:
check_port(to_port)
if to_addr:
if not checkIP(to_addr) and not checkIP6(to_addr):
raise FirewallError(errors.INVALID_ADDR,
"to-addr '%s' is not a valid address" \
% to_addr)
entry = (portStr(attrs["port"], "-"), attrs["protocol"],
portStr(to_port, "-"), str(to_addr))
if entry not in obj.item.forward_ports:
obj.item.forward_ports.append(entry)
else:
log.warning("Forward port %s/%s%s%s already set, ignoring.",
attrs["port"], attrs["protocol"],
" >%s" % to_port if to_port else "",
" @%s" % to_addr if to_addr else "")
elif name == "source-port":
if obj._rule:
if obj._rule.element:
log.warning("Invalid rule: More than one element in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.element = rich.Rich_SourcePort(attrs["port"],
attrs["protocol"])
return True
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (portStr(attrs["port"], "-"), attrs["protocol"])
if entry not in obj.item.source_ports:
obj.item.source_ports.append(entry)
else:
log.warning("Source port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
elif name == "destination":
if not obj._rule:
log.warning('Invalid rule: Destination outside of rule')
obj._rule_error = True
return True
if obj._rule.destination:
log.warning("Invalid rule: More than one destination in rule '%s', ignoring.",
str(obj._rule))
return True
invert = False
address = None
if "address" in attrs:
address = attrs["address"]
ipset = None
if "ipset" in attrs:
ipset = attrs["ipset"]
if "invert" in attrs and \
attrs["invert"].lower() in [ "yes", "true" ]:
invert = True
obj._rule.destination = rich.Rich_Destination(address,
ipset,
invert)
elif name in [ "accept", "reject", "drop", "mark" ]:
if not obj._rule:
log.warning('Invalid rule: Action outside of rule')
obj._rule_error = True
return True
if obj._rule.action:
log.warning('Invalid rule: More than one action')
obj._rule_error = True
return True
if name == "accept":
obj._rule.action = rich.Rich_Accept()
elif name == "reject":
_type = None
if "type" in attrs:
_type = attrs["type"]
obj._rule.action = rich.Rich_Reject(_type)
elif name == "drop":
obj._rule.action = rich.Rich_Drop()
elif name == "mark":
_set = attrs["set"]
obj._rule.action = rich.Rich_Mark(_set)
obj._limit_ok = obj._rule.action
elif name == "log":
if not obj._rule:
log.warning('Invalid rule: Log outside of rule')
return True
if obj._rule.log:
log.warning('Invalid rule: More than one log')
return True
level = None
if "level" in attrs:
level = attrs["level"]
if level not in [ "emerg", "alert", "crit", "error",
"warning", "notice", "info", "debug" ]:
log.warning('Invalid rule: Invalid log level')
obj._rule_error = True
return True
prefix = attrs["prefix"] if "prefix" in attrs else None
obj._rule.log = rich.Rich_Log(prefix, level)
obj._limit_ok = obj._rule.log
elif name == "audit":
if not obj._rule:
log.warning('Invalid rule: Audit outside of rule')
return True
if obj._rule.audit:
log.warning("Invalid rule: More than one audit in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
obj._rule.audit = rich.Rich_Audit()
obj._limit_ok = obj._rule.audit
elif name == "rule":
family = None
priority = 0
if "family" in attrs:
family = attrs["family"]
if family not in [ "ipv4", "ipv6" ]:
log.warning('Invalid rule: Rule family "%s" invalid',
attrs["family"])
obj._rule_error = True
return True
if "priority" in attrs:
priority = int(attrs["priority"])
obj._rule = rich.Rich_Rule(family=family, priority=priority)
elif name == "limit":
if not obj._limit_ok:
log.warning('Invalid rule: Limit outside of action, log and audit')
obj._rule_error = True
return True
if obj._limit_ok.limit:
log.warning("Invalid rule: More than one limit in rule '%s', ignoring.",
str(obj._rule))
obj._rule_error = True
return True
value = attrs["value"]
obj._limit_ok.limit = rich.Rich_Limit(value, attrs.get("burst"))
else:
return False
return True
def common_endElement(obj, name):
if name == "rule":
if not obj._rule_error:
try:
obj._rule.check()
except Exception as e:
log.warning("%s: %s", e, str(obj._rule))
else:
if str(obj._rule) not in obj.item.rules_str:
obj.item.rules.append(obj._rule)
obj.item.rules_str.append(str(obj._rule))
else:
log.warning("Rule '%s' already set, ignoring.",
str(obj._rule))
obj._rule = None
obj._rule_error = False
elif name in [ "accept", "reject", "drop", "mark", "log", "audit" ]:
obj._limit_ok = None
def common_check_config(obj, config, item, all_config):
obj_type = "Policy" if isinstance(obj, Policy) else "Zone"
if item == "services" and obj.fw_config:
existing_services = obj.fw_config.get_services()
for service in config:
if service not in existing_services:
raise FirewallError(errors.INVALID_SERVICE,
"'%s' not among existing services" % \
service)
elif item == "ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item == "protocols":
for proto in config:
check_protocol(proto)
elif item == "icmp_blocks" and obj.fw_config:
existing_icmptypes = obj.fw_config.get_icmptypes()
for icmptype in config:
if icmptype not in existing_icmptypes:
raise FirewallError(errors.INVALID_ICMPTYPE,
"'%s' not among existing icmp types" % \
icmptype)
elif item == "forward_ports":
for fwd_port in config:
check_port(fwd_port[0])
check_tcpudp(fwd_port[1])
if not fwd_port[2] and not fwd_port[3]:
raise FirewallError(
errors.INVALID_FORWARD,
"'%s' is missing to-port AND to-addr " % fwd_port)
if fwd_port[2]:
check_port(fwd_port[2])
if fwd_port[3]:
if not checkIP(fwd_port[3]) and not checkIP6(fwd_port[3]):
raise FirewallError(
errors.INVALID_ADDR,
"to-addr '%s' is not a valid address" % fwd_port[3])
elif item == "source_ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item in ["rules_str", "rich_rules"]:
for rule in config:
obj_rich = rich.Rich_Rule(rule_str=rule)
if obj.fw_config and obj_rich.element and (isinstance(obj_rich.element, rich.Rich_IcmpBlock) or
isinstance(obj_rich.element, rich.Rich_IcmpType)):
existing_icmptypes = obj.fw_config.get_icmptypes()
if obj_rich.element.name not in existing_icmptypes:
raise FirewallError(errors.INVALID_ICMPTYPE,
"'%s' not among existing icmp types" % \
obj_rich.element.name)
elif obj_rich.family:
ict = obj.fw_config.get_icmptype(obj_rich.element.name)
if ict.destination and obj_rich.family not in ict.destination:
raise FirewallError(errors.INVALID_ICMPTYPE,
"rich rule family '%s' conflicts with icmp type '%s'" % \
(obj_rich.family, obj_rich.element.name))
elif obj.fw_config and isinstance(obj_rich.element, rich.Rich_Service):
existing_services = obj.fw_config.get_services()
if obj_rich.element.name not in existing_services:
raise FirewallError(
errors.INVALID_SERVICE,
"{} '{}': '{}' not among existing services".format(
obj_type, obj.name, obj_rich.element.name
),
)
def _handler_add_rich_limit(handler, limit):
d = {"value": limit.value}
burst = limit.burst
if burst is not None:
d["burst"] = burst
handler.simpleElement("limit", d)
def common_writer(obj, handler):
# short
if obj.short and obj.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(obj.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if obj.description and obj.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(obj.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# services
for service in uniqify(obj.services):
handler.ignorableWhitespace(" ")
handler.simpleElement("service", { "name": service })
handler.ignorableWhitespace("\n")
# ports
for port in uniqify(obj.ports):
handler.ignorableWhitespace(" ")
handler.simpleElement("port", { "port": port[0], "protocol": port[1] })
handler.ignorableWhitespace("\n")
# protocols
for protocol in uniqify(obj.protocols):
handler.ignorableWhitespace(" ")
handler.simpleElement("protocol", { "value": protocol })
handler.ignorableWhitespace("\n")
# icmp-blocks
for icmp in uniqify(obj.icmp_blocks):
handler.ignorableWhitespace(" ")
handler.simpleElement("icmp-block", { "name": icmp })
handler.ignorableWhitespace("\n")
# masquerade
if obj.masquerade:
handler.ignorableWhitespace(" ")
handler.simpleElement("masquerade", { })
handler.ignorableWhitespace("\n")
# forward-ports
for forward in uniqify(obj.forward_ports):
handler.ignorableWhitespace(" ")
attrs = { "port": forward[0], "protocol": forward[1] }
if forward[2] and forward[2] != "" :
attrs["to-port"] = forward[2]
if forward[3] and forward[3] != "" :
attrs["to-addr"] = forward[3]
handler.simpleElement("forward-port", attrs)
handler.ignorableWhitespace("\n")
# source-ports
for port in uniqify(obj.source_ports):
handler.ignorableWhitespace(" ")
handler.simpleElement("source-port", { "port": port[0],
"protocol": port[1] })
handler.ignorableWhitespace("\n")
# rules
for rule in obj.rules:
attrs = { }
if rule.family:
attrs["family"] = rule.family
if rule.priority != 0:
attrs["priority"] = str(rule.priority)
handler.ignorableWhitespace(" ")
handler.startElement("rule", attrs)
handler.ignorableWhitespace("\n")
# source
if rule.source:
attrs = { }
if rule.source.addr:
attrs["address"] = rule.source.addr
if rule.source.mac:
attrs["mac"] = rule.source.mac
if rule.source.ipset:
attrs["ipset"] = rule.source.ipset
if rule.source.invert:
attrs["invert"] = "True"
handler.ignorableWhitespace(" ")
handler.simpleElement("source", attrs)
handler.ignorableWhitespace("\n")
# destination
if rule.destination:
attrs = { }
if rule.destination.addr:
attrs["address"] = rule.destination.addr
if rule.destination.ipset:
attrs["ipset"] = rule.destination.ipset
if rule.destination.invert:
attrs["invert"] = "True"
handler.ignorableWhitespace(" ")
handler.simpleElement("destination", attrs)
handler.ignorableWhitespace("\n")
# element
if rule.element:
element = ""
attrs = { }
if type(rule.element) == rich.Rich_Service:
element = "service"
attrs["name"] = rule.element.name
elif type(rule.element) == rich.Rich_Port:
element = "port"
attrs["port"] = rule.element.port
attrs["protocol"] = rule.element.protocol
elif type(rule.element) == rich.Rich_Protocol:
element = "protocol"
attrs["value"] = rule.element.value
elif type(rule.element) == rich.Rich_Masquerade:
element = "masquerade"
elif type(rule.element) == rich.Rich_IcmpBlock:
element = "icmp-block"
attrs["name"] = rule.element.name
elif type(rule.element) == rich.Rich_IcmpType:
element = "icmp-type"
attrs["name"] = rule.element.name
elif type(rule.element) == rich.Rich_ForwardPort:
element = "forward-port"
attrs["port"] = rule.element.port
attrs["protocol"] = rule.element.protocol
if rule.element.to_port != "":
attrs["to-port"] = rule.element.to_port
if rule.element.to_address != "":
attrs["to-addr"] = rule.element.to_address
elif type(rule.element) == rich.Rich_SourcePort:
element = "source-port"
attrs["port"] = rule.element.port
attrs["protocol"] = rule.element.protocol
else:
raise FirewallError(
errors.INVALID_OBJECT,
"Unknown element '%s' in obj_writer" % type(rule.element))
handler.ignorableWhitespace(" ")
handler.simpleElement(element, attrs)
handler.ignorableWhitespace("\n")
# rule.element
# log
if rule.log:
attrs = { }
if rule.log.prefix:
attrs["prefix"] = rule.log.prefix
if rule.log.level:
attrs["level"] = rule.log.level
if rule.log.limit:
handler.ignorableWhitespace(" ")
handler.startElement("log", attrs)
handler.ignorableWhitespace("\n ")
_handler_add_rich_limit(handler, rule.log.limit)
handler.ignorableWhitespace("\n ")
handler.endElement("log")
else:
handler.ignorableWhitespace(" ")
handler.simpleElement("log", attrs)
handler.ignorableWhitespace("\n")
# audit
if rule.audit:
attrs = {}
if rule.audit.limit:
handler.ignorableWhitespace(" ")
handler.startElement("audit", { })
handler.ignorableWhitespace("\n ")
_handler_add_rich_limit(handler, rule.audit.limit)
handler.ignorableWhitespace("\n ")
handler.endElement("audit")
else:
handler.ignorableWhitespace(" ")
handler.simpleElement("audit", attrs)
handler.ignorableWhitespace("\n")
# action
if rule.action:
action = ""
attrs = { }
if type(rule.action) == rich.Rich_Accept:
action = "accept"
elif type(rule.action) == rich.Rich_Reject:
action = "reject"
if rule.action.type:
attrs["type"] = rule.action.type
elif type(rule.action) == rich.Rich_Drop:
action = "drop"
elif type(rule.action) == rich.Rich_Mark:
action = "mark"
attrs["set"] = rule.action.set
else:
log.warning("Unknown action '%s'", type(rule.action))
if rule.action.limit:
handler.ignorableWhitespace(" ")
handler.startElement(action, attrs)
handler.ignorableWhitespace("\n ")
_handler_add_rich_limit(handler, rule.action.limit)
handler.ignorableWhitespace("\n ")
handler.endElement(action)
else:
handler.ignorableWhitespace(" ")
handler.simpleElement(action, attrs)
handler.ignorableWhitespace("\n")
handler.ignorableWhitespace(" ")
handler.endElement("rule")
handler.ignorableWhitespace("\n")
class Policy(IO_Object):
priority_min = -32768
priority_max = 32767
priority_default = DEFAULT_POLICY_PRIORITY
priority_reserved = [0]
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "target", "" ), # s
( "services", [ "", ], ), # as
( "ports", [ ( "", "" ), ], ), # a(ss)
( "icmp_blocks", [ "", ], ), # as
( "masquerade", False ), # b
( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss)
( "rich_rules", [ "" ] ), # as
( "protocols", [ "", ], ), # as
( "source_ports", [ ( "", "" ), ], ), # a(ss)
( "priority", 0 ), # i
( "ingress_zones", [ "" ] ), # as
( "egress_zones", [ "" ] ), # as
)
ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"policy": ["target"],
"service": [ "name" ],
"port": [ "port", "protocol" ],
"icmp-block": [ "name" ],
"icmp-type": [ "name" ],
"masquerade": None,
"forward-port": [ "port", "protocol" ],
"rule": None,
"source": None,
"destination": None,
"protocol": [ "value" ],
"source-port": [ "port", "protocol" ],
"log": None,
"audit": None,
"accept": None,
"reject": None,
"drop": None,
"mark": [ "set" ],
"limit": [ "value" ],
"ingress-zone": [ "name" ],
"egress-zone": [ "name" ],
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"policy": [ "version", "priority" ],
"forward-port": [ "to-port", "to-addr" ],
"rule": [ "family", "priority" ],
"source": [ "address", "mac", "invert", "family", "ipset" ],
"destination": [ "address", "invert", "ipset" ],
"log": [ "prefix", "level" ],
"reject": [ "type" ],
"limit": ["burst"],
}
def __init__(self):
super(Policy, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.target = DEFAULT_POLICY_TARGET
self.services = [ ]
self.ports = [ ]
self.protocols = [ ]
self.icmp_blocks = [ ]
self.masquerade = False
self.forward_ports = [ ]
self.source_ports = [ ]
self.fw_config = None # to be able to check services and a icmp_blocks
self.rules = [ ]
self.rules_str = [ ]
self.applied = False
self.priority = self.priority_default
self.derived_from_zone = None
self.ingress_zones = []
self.egress_zones = []
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.target = DEFAULT_POLICY_TARGET
del self.services[:]
del self.ports[:]
del self.protocols[:]
del self.icmp_blocks[:]
self.masquerade = False
del self.forward_ports[:]
del self.source_ports[:]
self.fw_config = None # to be able to check services and a icmp_blocks
del self.rules[:]
del self.rules_str[:]
self.applied = False
self.priority = self.priority_default
del self.ingress_zones[:]
del self.egress_zones[:]
def __getattr__(self, name):
if name == "rich_rules":
return self.rules_str
else:
return getattr(super(Policy, self), name)
def __setattr__(self, name, value):
if name == "rich_rules":
self.rules = [rich.Rich_Rule(rule_str=s) for s in value]
# must convert back to string to get the canonical string.
self.rules_str = [str(s) for s in self.rules]
else:
super(Policy, self).__setattr__(name, value)
def _check_config(self, config, item, all_config):
common_check_config(self, config, item, all_config)
if item == "target":
if config not in POLICY_TARGETS:
raise FirewallError(errors.INVALID_TARGET, "'%s' is invalid target" % (config))
elif item == "priority":
if config in self.priority_reserved or \
config > self.priority_max or \
config < self.priority_min:
raise FirewallError(errors.INVALID_PRIORITY, "%d is invalid priority. Must be in range [%d, %d]. The following are reserved: %s" %
(config, self.priority_min, self.priority_max, self.priority_reserved))
elif item in ["ingress_zones", "egress_zones"]:
existing_zones = ["ANY", "HOST"]
if self.fw_config:
existing_zones += self.fw_config.get_zones()
for zone in config:
if zone not in existing_zones:
raise FirewallError(errors.INVALID_ZONE,
"'%s' not among existing zones" % (zone))
if ((zone not in ["ANY", "HOST"] and (set(["ANY", "HOST"]) & set(config))) or \
(zone in ["ANY", "HOST"] and (set(config) - set([zone])))):
raise FirewallError(errors.INVALID_ZONE,
"'%s' may only contain one of: many regular zones, ANY, or HOST" % (item))
if zone == "HOST" and \
((item == "ingress_zones" and "egress_zones" in all_config and "HOST" in all_config["egress_zones"]) or \
(item == "egress_zones" and "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"])):
raise FirewallError(errors.INVALID_ZONE,
"'HOST' can only appear in either ingress or egress zones, but not both")
elif item == "masquerade" and config:
if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for egress zone 'HOST'")
elif "ingress_zones" in all_config:
if "HOST" in all_config["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for ingress zone 'HOST'")
for zone in all_config["ingress_zones"]:
if zone == "ANY":
continue
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'masquerade' cannot be used in a policy if an ingress zone has assigned interfaces")
elif item == "rich_rules":
for rule in config:
obj = rich.Rich_Rule(rule_str=rule)
if obj.element and isinstance(obj.element, rich.Rich_Masquerade):
if "egress_zones" in all_config and "HOST" in all_config["egress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for egress zone 'HOST'")
elif "ingress_zones" in all_config:
if "HOST" in all_config["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'masquerade' is invalid for ingress zone 'HOST'")
for zone in all_config["ingress_zones"]:
if zone == "ANY":
continue
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'masquerade' cannot be used in a policy if an ingress zone has assigned interfaces")
elif obj.element and isinstance(obj.element, rich.Rich_ForwardPort):
if "egress_zones" in all_config:
if "HOST" in all_config["egress_zones"]:
if obj.element.to_address:
raise FirewallError(errors.INVALID_FORWARD, "A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'")
elif all_config["egress_zones"]:
if not obj.element.to_address:
raise FirewallError(errors.INVALID_FORWARD, "'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone")
if "ANY" not in all_config["egress_zones"]:
for zone in all_config["egress_zones"]:
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'forward-port' cannot be used in a policy if an egress zone has assigned interfaces")
elif obj.action and isinstance(obj.action, rich.Rich_Mark):
if "egress_zones" in all_config:
for zone in all_config["egress_zones"]:
if zone in ["ANY", "HOST"]:
continue
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'mark' action cannot be used in a policy if an egress zone has assigned interfaces")
elif item == "forward_ports":
for fwd_port in config:
if "ingress_zones" in all_config and "HOST" in all_config["ingress_zones"]:
raise FirewallError(errors.INVALID_ZONE, "'forward-port' is invalid for ingress zone 'HOST'")
elif "egress_zones" in all_config:
if "HOST" in all_config["egress_zones"]:
if fwd_port[3]:
raise FirewallError(errors.INVALID_FORWARD, "A 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'")
elif all_config["egress_zones"]:
if not fwd_port[3]:
raise FirewallError(errors.INVALID_FORWARD, "'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zone")
if "ANY" not in all_config["egress_zones"]:
for zone in all_config["egress_zones"]:
z_obj = self.fw_config.get_zone(zone)
if self.fw_config and "interfaces" in self.fw_config.get_zone_config_dict(z_obj):
raise FirewallError(errors.INVALID_ZONE, "'forward-port' cannot be used in a policy if an egress zone has assigned interfaces")
def check_name(self, name):
super(Policy, self).check_name(name)
if name.startswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't start with '/'" % name)
elif name.endswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't end with '/'" % name)
elif name.count('/') > 1:
raise FirewallError(errors.INVALID_NAME,
"more than one '/' in '%s'" % name)
else:
if "/" in name:
checked_name = name[:name.find('/')]
else:
checked_name = name
if len(checked_name) > max_policy_name_len():
raise FirewallError(errors.INVALID_NAME,
"Policy of '%s' has %d chars, max is %d" % (
name, len(checked_name),
max_policy_name_len()))
if self.fw_config:
if checked_name in self.fw_config.get_zones():
raise FirewallError(errors.NAME_CONFLICT, "Policies can't have the same name as a zone.")
# PARSER
class policy_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self._rule = None
self._rule_error = False
self._limit_ok = None
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
if self._rule_error:
return
self.item.parser_check_element_attrs(name, attrs)
if common_startElement(self, name, attrs):
return
elif name == "policy":
if "version" in attrs:
self.item.version = attrs["version"]
if "priority" in attrs:
self.item.priority = int(attrs["priority"])
if "target" in attrs:
target = attrs["target"]
if target not in POLICY_TARGETS:
raise FirewallError(errors.INVALID_TARGET, target)
if target:
self.item.target = target
elif name == "ingress-zone":
if attrs["name"] not in self.item.ingress_zones:
self.item.ingress_zones.append(attrs["name"])
else:
log.warning("Ingress zone '%s' already set, ignoring.", attrs["name"])
elif name == "egress-zone":
if attrs["name"] not in self.item.egress_zones:
self.item.egress_zones.append(attrs["name"])
else:
log.warning("Egress zone '%s' already set, ignoring.", attrs["name"])
elif name == "source":
if not self._rule:
log.warning('Invalid rule: Source outside of rule')
self._rule_error = True
return
if self._rule.source:
log.warning("Invalid rule: More than one source in rule '%s', ignoring.",
str(self._rule))
self._rule_error = True
return
invert = False
if "invert" in attrs and \
attrs["invert"].lower() in [ "yes", "true" ]:
invert = True
addr = mac = ipset = None
if "address" in attrs:
addr = attrs["address"]
if "mac" in attrs:
mac = attrs["mac"]
if "ipset" in attrs:
ipset = attrs["ipset"]
self._rule.source = rich.Rich_Source(addr, mac, ipset,
invert=invert)
return
else:
log.warning("Unknown XML element '%s'", name)
return
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
common_endElement(self, name)
def policy_reader(filename, path, no_check_name=False):
policy = Policy()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
policy.name = filename[:-4]
if not no_check_name:
policy.check_name(policy.name)
policy.filename = filename
policy.path = path
policy.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
policy.default = policy.builtin
handler = policy_ContentHandler(policy)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_POLICY,
"not a valid policy file: %s" % \
msg.getException())
del handler
del parser
return policy
def policy_writer(policy, path=None):
_path = path if path else policy.path
if policy.filename:
name = "%s/%s" % (_path, policy.filename)
else:
name = "%s/%s.xml" % (_path, policy.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start policy element
attrs = {}
if policy.version and policy.version != "":
attrs["version"] = policy.version
if policy.priority != policy.priority_default:
attrs["priority"] = str(policy.priority)
attrs["target"] = policy.target
handler.startElement("policy", attrs)
handler.ignorableWhitespace("\n")
common_writer(policy, handler)
# ingress-zones
for zone in uniqify(policy.ingress_zones):
handler.ignorableWhitespace(" ")
handler.simpleElement("ingress-zone", { "name": zone })
handler.ignorableWhitespace("\n")
# egress-zones
for zone in uniqify(policy.egress_zones):
handler.ignorableWhitespace(" ")
handler.simpleElement("egress-zone", { "name": zone })
handler.ignorableWhitespace("\n")
# end policy element
handler.endElement("policy")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! γ1 1 lockdown_whitelist.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.logger import log
from firewall.functions import uniqify, checkUser, checkUid, checkCommand, \
checkContext, u2b_if_py2
from firewall import errors
from firewall.errors import FirewallError
class lockdown_whitelist_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self.whitelist = False
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "whitelist":
if self.whitelist:
raise FirewallError(errors.PARSE_ERROR,
"More than one whitelist.")
self.whitelist = True
elif name == "command":
if not self.whitelist:
log.error("Parse Error: command outside of whitelist")
return
command = attrs["name"]
self.item.add_command(command)
elif name == "user":
if not self.whitelist:
log.error("Parse Error: user outside of whitelist")
return
if "id" in attrs:
try:
uid = int(attrs["id"])
except ValueError:
log.error("Parse Error: %s is not a valid uid" %
attrs["id"])
return
self.item.add_uid(uid)
elif "name" in attrs:
self.item.add_user(attrs["name"])
elif name == "selinux":
if not self.whitelist:
log.error("Parse Error: selinux outside of whitelist")
return
if "context" not in attrs:
log.error("Parse Error: no context")
return
self.item.add_context(attrs["context"])
else:
log.error('Unknown XML element %s' % name)
return
class LockdownWhitelist(IO_Object):
""" LockdownWhitelist class """
IMPORT_EXPORT_STRUCTURE = (
( "commands", [ "" ] ), # as
( "contexts", [ "" ] ), # as
( "users", [ "" ] ), # as
( "uids", [ 0 ] ) # ai
)
DBUS_SIGNATURE = '(asasasai)'
ADDITIONAL_ALNUM_CHARS = [ "_" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"whitelist": None,
"command": [ "name" ],
"user": None,
# "group": None,
"selinux": [ "context" ],
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"user": [ "id", "name" ],
# "group": [ "id", "name" ],
}
def __init__(self, filename):
super(LockdownWhitelist, self).__init__()
self.filename = filename
self.parser = None
self.commands = [ ]
self.contexts = [ ]
self.users = [ ]
self.uids = [ ]
# self.gids = [ ]
# self.groups = [ ]
def _check_config(self, config, item, all_config):
if item in [ "commands", "contexts", "users", "uids" ]:
for x in config:
self._check_config(x, item[:-1], all_config)
elif item == "command":
if not checkCommand(config):
raise FirewallError(errors.INVALID_COMMAND, config)
elif item == "context":
if not checkContext(config):
raise FirewallError(errors.INVALID_CONTEXT, config)
elif item == "user":
if not checkUser(config):
raise FirewallError(errors.INVALID_USER, config)
elif item == "uid":
if not checkUid(config):
raise FirewallError(errors.INVALID_UID, config)
def cleanup(self):
del self.commands[:]
del self.contexts[:]
del self.users[:]
del self.uids[:]
# del self.gids[:]
# del self.groups[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.commands = [ u2b_if_py2(x) for x in self.commands ]
self.contexts = [ u2b_if_py2(x) for x in self.contexts ]
self.users = [ u2b_if_py2(x) for x in self.users ]
# commands
def add_command(self, command):
if not checkCommand(command):
raise FirewallError(errors.INVALID_COMMAND, command)
if command not in self.commands:
self.commands.append(command)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'Command "%s" already in whitelist' % command)
def remove_command(self, command):
if command in self.commands:
self.commands.remove(command)
else:
raise FirewallError(errors.NOT_ENABLED,
'Command "%s" not in whitelist.' % command)
def has_command(self, command):
return (command in self.commands)
def match_command(self, command):
for _command in self.commands:
if _command.endswith("*"):
if command.startswith(_command[:-1]):
return True
else:
if _command == command:
return True
return False
def get_commands(self):
return self.commands
# user ids
def add_uid(self, uid):
if not checkUid(uid):
raise FirewallError(errors.INVALID_UID, str(uid))
if uid not in self.uids:
self.uids.append(uid)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'Uid "%s" already in whitelist' % uid)
def remove_uid(self, uid):
if uid in self.uids:
self.uids.remove(uid)
else:
raise FirewallError(errors.NOT_ENABLED,
'Uid "%s" not in whitelist.' % uid)
def has_uid(self, uid):
return (uid in self.uids)
def match_uid(self, uid):
return (uid in self.uids)
def get_uids(self):
return self.uids
# users
def add_user(self, user):
if not checkUser(user):
raise FirewallError(errors.INVALID_USER, user)
if user not in self.users:
self.users.append(user)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'User "%s" already in whitelist' % user)
def remove_user(self, user):
if user in self.users:
self.users.remove(user)
else:
raise FirewallError(errors.NOT_ENABLED,
'User "%s" not in whitelist.' % user)
def has_user(self, user):
return (user in self.users)
def match_user(self, user):
return (user in self.users)
def get_users(self):
return self.users
# # group ids
#
# def add_gid(self, gid):
# if gid not in self.gids:
# self.gids.append(gid)
#
# def remove_gid(self, gid):
# if gid in self.gids:
# self.gids.remove(gid)
# else:
# raise FirewallError(errors.NOT_ENABLED,
# 'Gid "%s" not in whitelist.' % gid)
#
# def has_gid(self, gid):
# return (gid in self.gids)
#
# def match_gid(self, gid):
# return (gid in self.gids)
#
# def get_gids(self):
# return self.gids
# # groups
#
# def add_group(self, group):
# if group not in self.groups:
# self.groups.append(group)
#
# def remove_group(self, group):
# if group in self.groups:
# self.groups.remove(group)
# else:
# raise FirewallError(errors.NOT_ENABLED,
# 'Group "%s" not in whitelist.' % group)
#
# def has_group(self, group):
# return (group in self.groups)
#
# def match_group(self, group):
# return (group in self.groups)
#
# def get_groups(self):
# return self.groups
# selinux contexts
def add_context(self, context):
if not checkContext(context):
raise FirewallError(errors.INVALID_CONTEXT, context)
if context not in self.contexts:
self.contexts.append(context)
else:
raise FirewallError(errors.ALREADY_ENABLED,
'Context "%s" already in whitelist' % context)
def remove_context(self, context):
if context in self.contexts:
self.contexts.remove(context)
else:
raise FirewallError(errors.NOT_ENABLED,
'Context "%s" not in whitelist.' % context)
def has_context(self, context):
return (context in self.contexts)
def match_context(self, context):
return (context in self.contexts)
def get_contexts(self):
return self.contexts
# read and write
def read(self):
self.cleanup()
if not self.filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % self.filename)
handler = lockdown_whitelist_ContentHandler(self)
parser = sax.make_parser()
parser.setContentHandler(handler)
try:
parser.parse(self.filename)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_TYPE,
"Not a valid file: %s" % \
msg.getException())
del handler
del parser
if PY2:
self.encode_strings()
def write(self):
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.old" % self.filename)
except Exception as msg:
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
f = io.open(self.filename, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start whitelist element
handler.startElement("whitelist", { })
handler.ignorableWhitespace("\n")
# commands
for command in uniqify(self.commands):
handler.ignorableWhitespace(" ")
handler.simpleElement("command", { "name": command })
handler.ignorableWhitespace("\n")
for uid in uniqify(self.uids):
handler.ignorableWhitespace(" ")
handler.simpleElement("user", { "id": str(uid) })
handler.ignorableWhitespace("\n")
for user in uniqify(self.users):
handler.ignorableWhitespace(" ")
handler.simpleElement("user", { "name": user })
handler.ignorableWhitespace("\n")
# for gid in uniqify(self.gids):
# handler.ignorableWhitespace(" ")
# handler.simpleElement("user", { "id": str(gid) })
# handler.ignorableWhitespace("\n")
# for group in uniqify(self.groups):
# handler.ignorableWhitespace(" ")
# handler.simpleElement("group", { "name": group })
# handler.ignorableWhitespace("\n")
for context in uniqify(self.contexts):
handler.ignorableWhitespace(" ")
handler.simpleElement("selinux", { "context": context })
handler.ignorableWhitespace("\n")
# end whitelist element
handler.endElement("whitelist")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! (5 5 io_object.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
"""Generic io_object handler, io specific check methods."""
__all__ = [ "PY2",
"IO_Object", "IO_Object_ContentHandler", "IO_Object_XMLGenerator",
"check_port", "check_tcpudp", "check_protocol", "check_address" ]
import xml.sax as sax
import xml.sax.saxutils as saxutils
import copy
import sys
from collections import OrderedDict
from firewall import functions
from firewall.functions import b2u
from firewall import errors
from firewall.errors import FirewallError
PY2 = sys.version < '3'
class IO_Object(object):
""" Abstract IO_Object as base for icmptype, service and zone """
IMPORT_EXPORT_STRUCTURE = ( )
DBUS_SIGNATURE = '()'
ADDITIONAL_ALNUM_CHARS = [ ] # additional to alnum
PARSER_REQUIRED_ELEMENT_ATTRS = { }
PARSER_OPTIONAL_ELEMENT_ATTRS = { }
def __init__(self):
self.filename = ""
self.path = ""
self.name = ""
self.default = False
self.builtin = False
def export_config(self):
ret = [ ]
for x in self.IMPORT_EXPORT_STRUCTURE:
ret.append(copy.deepcopy(getattr(self, x[0])))
return tuple(ret)
def export_config_dict(self):
conf = {}
type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE])
for key in type_formats:
if getattr(self, key) or isinstance(getattr(self, key), bool):
conf[key] = copy.deepcopy(getattr(self, key))
return conf
def import_config(self, conf):
self.check_config(conf)
for i,(element,dummy) in enumerate(self.IMPORT_EXPORT_STRUCTURE):
if isinstance(conf[i], list):
# remove duplicates without changing the order
_conf = [ ]
_set = set()
for x in conf[i]:
if x not in _set:
_conf.append(x)
_set.add(x)
del _set
setattr(self, element, copy.deepcopy(_conf))
else:
setattr(self, element, copy.deepcopy(conf[i]))
def import_config_dict(self, conf):
self.check_config_dict(conf)
for key in conf:
if not hasattr(self, key):
raise FirewallError(errors.UNKNOWN_ERROR, "Internal error. '{}' is not a valid attribute".format(key))
if isinstance(conf[key], list):
# maintain list order while removing duplicates
setattr(self, key, list(OrderedDict.fromkeys(copy.deepcopy(conf[key]))))
else:
setattr(self, key, copy.deepcopy(conf[key]))
def check_name(self, name):
if not isinstance(name, str):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % (name, type(""),
type(name)))
if len(name) < 1:
raise FirewallError(errors.INVALID_NAME, "name can't be empty")
for char in name:
if not char.isalnum() and char not in self.ADDITIONAL_ALNUM_CHARS:
raise FirewallError(
errors.INVALID_NAME,
"'%s' is not allowed in '%s'" % ((char, name)))
def check_config(self, conf):
if len(conf) != len(self.IMPORT_EXPORT_STRUCTURE):
raise FirewallError(
errors.INVALID_TYPE,
"structure size mismatch %d != %d" % \
(len(conf), len(self.IMPORT_EXPORT_STRUCTURE)))
conf_dict = {}
for i,(x,y) in enumerate(self.IMPORT_EXPORT_STRUCTURE):
conf_dict[x] = conf[i]
self.check_config_dict(conf_dict)
def check_config_dict(self, conf):
type_formats = dict([(x[0], x[1]) for x in self.IMPORT_EXPORT_STRUCTURE])
for key in conf:
if key not in [x for (x,y) in self.IMPORT_EXPORT_STRUCTURE]:
raise FirewallError(errors.INVALID_OPTION, "option '{}' is not valid".format(key))
self._check_config_structure(conf[key], type_formats[key])
self._check_config(conf[key], key, conf)
def _check_config(self, dummy1, dummy2, dummy3):
# to be overloaded by sub classes
return
def _check_config_structure(self, conf, structure):
if not isinstance(conf, type(structure)):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % \
(conf, type(structure), type(conf)))
if isinstance(structure, list):
# same type elements, else struct
if len(structure) != 1:
raise FirewallError(errors.INVALID_TYPE,
"len('%s') != 1" % structure)
for x in conf:
self._check_config_structure(x, structure[0])
elif isinstance(structure, tuple):
if len(structure) != len(conf):
raise FirewallError(errors.INVALID_TYPE,
"len('%s') != %d" % (conf,
len(structure)))
for i,value in enumerate(structure):
self._check_config_structure(conf[i], value)
elif isinstance(structure, dict):
# only one key value pair in structure
(skey, svalue) = list(structure.items())[0]
for (key, value) in conf.items():
if not isinstance(key, type(skey)):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % (\
key, type(skey), type(key)))
if not isinstance(value, type(svalue)):
raise FirewallError(errors.INVALID_TYPE,
"'%s' not of type %s, but %s" % (\
value, type(svalue), type(value)))
# check required elements and attributes and also optional attributes
def parser_check_element_attrs(self, name, attrs):
_attrs = attrs.getNames()
found = False
if name in self.PARSER_REQUIRED_ELEMENT_ATTRS:
found = True
if self.PARSER_REQUIRED_ELEMENT_ATTRS[name] is not None:
for x in self.PARSER_REQUIRED_ELEMENT_ATTRS[name]:
if x in _attrs:
_attrs.remove(x)
else:
raise FirewallError(
errors.PARSE_ERROR,
"Missing attribute %s for %s" % (x, name))
if name in self.PARSER_OPTIONAL_ELEMENT_ATTRS:
found = True
for x in self.PARSER_OPTIONAL_ELEMENT_ATTRS[name]:
if x in _attrs:
_attrs.remove(x)
if not found:
raise FirewallError(errors.PARSE_ERROR,
"Unexpected element %s" % name)
# raise attributes[0]
for x in _attrs:
raise FirewallError(errors.PARSE_ERROR,
"%s: Unexpected attribute %s" % (name, x))
# PARSER
class UnexpectedElementError(Exception):
def __init__(self, name):
super(UnexpectedElementError, self).__init__()
self.name = name
def __str__(self):
return "Unexpected element '%s'" % (self.name)
class MissingAttributeError(Exception):
def __init__(self, name, attribute):
super(MissingAttributeError, self).__init__()
self.name = name
self.attribute = attribute
def __str__(self):
return "Element '%s': missing '%s' attribute" % \
(self.name, self.attribute)
class UnexpectedAttributeError(Exception):
def __init__(self, name, attribute):
super(UnexpectedAttributeError, self).__init__()
self.name = name
self.attribute = attribute
def __str__(self):
return "Element '%s': unexpected attribute '%s'" % \
(self.name, self.attribute)
class IO_Object_ContentHandler(sax.handler.ContentHandler):
def __init__(self, item):
self.item = item
self._element = ""
def startDocument(self):
self._element = ""
def startElement(self, name, attrs):
self._element = ""
def endElement(self, name):
if name == "short":
self.item.short = self._element
elif name == "description":
self.item.description = self._element
def characters(self, content):
self._element += content.replace('\n', ' ')
class IO_Object_XMLGenerator(saxutils.XMLGenerator):
def __init__(self, out):
# fix memory leak in saxutils.XMLGenerator.__init__:
# out = _gettextwriter(out, encoding)
# creates unbound object results in garbage in gc
#
# saxutils.XMLGenerator.__init__(self, out, "utf-8")
# replaced by modified saxutils.XMLGenerator.__init__ code:
sax.handler.ContentHandler.__init__(self)
self._write = out.write
self._flush = out.flush
self._ns_contexts = [{}] # contains uri -> prefix dicts
self._current_context = self._ns_contexts[-1]
self._undeclared_ns_maps = []
self._encoding = "utf-8"
self._pending_start_element = False
self._short_empty_elements = False
def startElement(self, name, attrs):
""" saxutils.XMLGenerator.startElement() expects name and attrs to be
unicode and bad things happen if any of them is (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
if PY2:
attrs = { b2u(name):b2u(value) for name, value in attrs.items() }
saxutils.XMLGenerator.startElement(self, name, attrs)
def simpleElement(self, name, attrs):
""" slightly modified startElement()
"""
if PY2:
self._write(u'<' + b2u(name))
for (name, value) in attrs.items():
self._write(u' %s=%s' % (b2u(name),
saxutils.quoteattr(b2u(value))))
self._write(u'/>')
else:
self._write('<' + name)
for (name, value) in attrs.items():
self._write(' %s=%s' % (name, saxutils.quoteattr(value)))
self._write('/>')
def endElement(self, name):
""" saxutils.XMLGenerator.endElement() expects name to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
saxutils.XMLGenerator.endElement(self, b2u(name))
def characters(self, content):
""" saxutils.XMLGenerator.characters() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
saxutils.XMLGenerator.characters(self, b2u(content))
def ignorableWhitespace(self, content):
""" saxutils.XMLGenerator.ignorableWhitespace() expects content to be
unicode and bad things happen if it's (utf-8) encoded.
We override the method here to sanitize this case.
Can be removed once we drop Python2 support.
"""
saxutils.XMLGenerator.ignorableWhitespace(self, b2u(content))
def check_port(port):
port_range = functions.getPortRange(port)
if port_range == -2:
raise FirewallError(errors.INVALID_PORT,
"port number in '%s' is too big" % port)
elif port_range == -1:
raise FirewallError(errors.INVALID_PORT,
"'%s' is invalid port range" % port)
elif port_range is None:
raise FirewallError(errors.INVALID_PORT,
"port range '%s' is ambiguous" % port)
elif len(port_range) == 2 and port_range[0] >= port_range[1]:
raise FirewallError(errors.INVALID_PORT,
"'%s' is invalid port range" % port)
def check_tcpudp(protocol):
if protocol not in [ "tcp", "udp", "sctp", "dccp" ]:
raise FirewallError(errors.INVALID_PROTOCOL,
"'%s' not from {'tcp'|'udp'|'sctp'|'dccp'}" % \
protocol)
def check_protocol(protocol):
if not functions.checkProtocol(protocol):
raise FirewallError(errors.INVALID_PROTOCOL, protocol)
def check_address(ipv, addr):
if not functions.check_address(ipv, addr):
raise FirewallError(errors.INVALID_ADDR,
"'%s' is not valid %s address" % (addr, ipv))
PK ! *y y functions.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2018 Red Hat, Inc.
#
# Authors:
# Eric Garver
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
import os
from firewall import config
from firewall.errors import FirewallError
from firewall.core.fw_config import FirewallConfig
from firewall.core.io.zone import zone_reader
from firewall.core.io.service import service_reader
from firewall.core.io.ipset import ipset_reader
from firewall.core.io.icmptype import icmptype_reader
from firewall.core.io.helper import helper_reader
from firewall.core.io.policy import policy_reader
from firewall.core.io.direct import Direct
from firewall.core.io.lockdown_whitelist import LockdownWhitelist
from firewall.core.io.firewalld_conf import firewalld_conf
def check_config(fw):
fw_config = FirewallConfig(fw)
readers = {
"ipset": {"reader": ipset_reader,
"add": fw_config.add_ipset,
"dirs": [config.FIREWALLD_IPSETS, config.ETC_FIREWALLD_IPSETS],
},
"helper": {"reader": helper_reader,
"add": fw_config.add_helper,
"dirs": [config.FIREWALLD_HELPERS, config.ETC_FIREWALLD_HELPERS],
},
"icmptype": {"reader": icmptype_reader,
"add": fw_config.add_icmptype,
"dirs": [config.FIREWALLD_ICMPTYPES, config.ETC_FIREWALLD_ICMPTYPES],
},
"service": {"reader": service_reader,
"add": fw_config.add_service,
"dirs": [config.FIREWALLD_SERVICES, config.ETC_FIREWALLD_SERVICES],
},
"zone": {"reader": zone_reader,
"add": fw_config.add_zone,
"dirs": [config.FIREWALLD_ZONES, config.ETC_FIREWALLD_ZONES],
},
"policy": {"reader": policy_reader,
"add": fw_config.add_policy_object,
"dirs": [config.FIREWALLD_POLICIES, config.ETC_FIREWALLD_POLICIES],
},
}
for reader in readers.keys():
for _dir in readers[reader]["dirs"]:
if not os.path.isdir(_dir):
continue
for file in sorted(os.listdir(_dir)):
if file.endswith(".xml"):
try:
obj = readers[reader]["reader"](file, _dir)
if reader in ["zone", "policy"]:
obj.fw_config = fw_config
obj.check_config_dict(obj.export_config_dict())
readers[reader]["add"](obj)
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (file, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (file, msg))
if os.path.isfile(config.FIREWALLD_DIRECT):
try:
obj = Direct(config.FIREWALLD_DIRECT)
obj.read()
obj.check_config(obj.export_config())
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_DIRECT, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (config.FIREWALLD_DIRECT, msg))
if os.path.isfile(config.LOCKDOWN_WHITELIST):
try:
obj = LockdownWhitelist(config.LOCKDOWN_WHITELIST)
obj.read()
obj.check_config(obj.export_config())
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg))
if os.path.isfile(config.FIREWALLD_CONF):
try:
obj = firewalld_conf(config.FIREWALLD_CONF)
obj.read()
except FirewallError as error:
raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg))
except Exception as msg:
raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg))
PK ! 8M M zone.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
__all__ = [ "Zone", "zone_reader", "zone_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import checkIPnMask, checkIP6nMask, checkInterface, uniqify, max_zone_name_len, u2b_if_py2, check_mac
from firewall.core.base import DEFAULT_ZONE_TARGET, ZONE_TARGETS
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator
from firewall.core.io.policy import common_startElement, common_endElement, common_check_config, common_writer
from firewall.core import rich
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class Zone(IO_Object):
""" Zone class """
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ), # s
( "short", "" ), # s
( "description", "" ), # s
( "UNUSED", False ), # b
( "target", "" ), # s
( "services", [ "", ], ), # as
( "ports", [ ( "", "" ), ], ), # a(ss)
( "icmp_blocks", [ "", ], ), # as
( "masquerade", False ), # b
( "forward_ports", [ ( "", "", "", "" ), ], ), # a(ssss)
( "interfaces", [ "" ] ), # as
( "sources", [ "" ] ), # as
( "rules_str", [ "" ] ), # as
( "protocols", [ "", ], ), # as
( "source_ports", [ ( "", "" ), ], ), # a(ss)
( "icmp_block_inversion", False ), # b
( "forward", False ), # b
)
ADDITIONAL_ALNUM_CHARS = [ "_", "-", "/" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"zone": None,
"service": [ "name" ],
"port": [ "port", "protocol" ],
"icmp-block": [ "name" ],
"icmp-type": [ "name" ],
"forward": None,
"forward-port": [ "port", "protocol" ],
"interface": [ "name" ],
"rule": None,
"source": None,
"destination": None,
"protocol": [ "value" ],
"source-port": [ "port", "protocol" ],
"log": None,
"audit": None,
"accept": None,
"reject": None,
"drop": None,
"mark": [ "set" ],
"limit": [ "value" ],
"icmp-block-inversion": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"zone": [ "name", "immutable", "target", "version" ],
"masquerade": [ "enabled" ],
"forward-port": [ "to-port", "to-addr" ],
"rule": [ "family", "priority" ],
"source": [ "address", "mac", "invert", "family", "ipset" ],
"destination": [ "address", "invert", "ipset" ],
"log": [ "prefix", "level" ],
"reject": [ "type" ],
"limit": ["burst"],
}
@staticmethod
def index_of(element):
for i, (el, dummy) in enumerate(Zone.IMPORT_EXPORT_STRUCTURE):
if el == element:
return i
raise FirewallError(errors.UNKNOWN_ERROR, "index_of()")
def __init__(self):
super(Zone, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.UNUSED = False
self.target = DEFAULT_ZONE_TARGET
self.services = [ ]
self.ports = [ ]
self.protocols = [ ]
self.icmp_blocks = [ ]
self.forward = False
self.masquerade = False
self.forward_ports = [ ]
self.source_ports = [ ]
self.interfaces = [ ]
self.sources = [ ]
self.fw_config = None # to be able to check services and a icmp_blocks
self.rules = [ ]
self.rules_str = [ ]
self.icmp_block_inversion = False
self.combined = False
self.applied = False
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
self.UNUSED = False
self.target = DEFAULT_ZONE_TARGET
del self.services[:]
del self.ports[:]
del self.protocols[:]
del self.icmp_blocks[:]
self.forward = False
self.masquerade = False
del self.forward_ports[:]
del self.source_ports[:]
del self.interfaces[:]
del self.sources[:]
self.fw_config = None # to be able to check services and a icmp_blocks
del self.rules[:]
del self.rules_str[:]
self.icmp_block_inversion = False
self.combined = False
self.applied = False
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.target = u2b_if_py2(self.target)
self.services = [u2b_if_py2(s) for s in self.services]
self.ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr) in self.ports]
self.protocols = [u2b_if_py2(pr) for pr in self.protocols]
self.icmp_blocks = [u2b_if_py2(i) for i in self.icmp_blocks]
self.forward_ports = [(u2b_if_py2(p1),u2b_if_py2(p2),u2b_if_py2(p3),u2b_if_py2(p4)) for (p1,p2,p3,p4) in self.forward_ports]
self.source_ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr)
in self.source_ports]
self.interfaces = [u2b_if_py2(i) for i in self.interfaces]
self.sources = [u2b_if_py2(s) for s in self.sources]
self.rules = [u2b_if_py2(s) for s in self.rules]
self.rules_str = [u2b_if_py2(s) for s in self.rules_str]
def __setattr__(self, name, value):
if name == "rules_str":
self.rules = [rich.Rich_Rule(rule_str=s) for s in value]
# must convert back to string to get the canonical string.
super(Zone, self).__setattr__(name, [str(s) for s in self.rules])
else:
super(Zone, self).__setattr__(name, value)
def export_config_dict(self):
conf = super(Zone, self).export_config_dict()
del conf["UNUSED"]
return conf
def _check_config(self, config, item, all_config):
common_check_config(self, config, item, all_config)
if item == "target":
if config not in ZONE_TARGETS:
raise FirewallError(errors.INVALID_TARGET, config)
elif item == "interfaces":
for interface in config:
if not checkInterface(interface):
raise FirewallError(errors.INVALID_INTERFACE, interface)
if self.fw_config:
for zone in self.fw_config.get_zones():
if zone == self.name:
continue
if interface in self.fw_config.get_zone(zone).interfaces:
raise FirewallError(errors.INVALID_INTERFACE,
"interface '{}' already bound to zone '{}'".format(interface, zone))
elif item == "sources":
for source in config:
if not checkIPnMask(source) and not checkIP6nMask(source) and \
not check_mac(source) and not source.startswith("ipset:"):
raise FirewallError(errors.INVALID_ADDR, source)
if self.fw_config:
for zone in self.fw_config.get_zones():
if zone == self.name:
continue
if source in self.fw_config.get_zone(zone).sources:
raise FirewallError(errors.INVALID_ADDR,
"source '{}' already bound to zone '{}'".format(source, zone))
def check_name(self, name):
super(Zone, self).check_name(name)
if name.startswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't start with '/'" % name)
elif name.endswith('/'):
raise FirewallError(errors.INVALID_NAME,
"'%s' can't end with '/'" % name)
elif name.count('/') > 1:
raise FirewallError(errors.INVALID_NAME,
"more than one '/' in '%s'" % name)
else:
if "/" in name:
checked_name = name[:name.find('/')]
else:
checked_name = name
if len(checked_name) > max_zone_name_len():
raise FirewallError(errors.INVALID_NAME,
"Zone of '%s' has %d chars, max is %d %s" % (
name, len(checked_name),
max_zone_name_len(),
self.combined))
if self.fw_config:
if checked_name in self.fw_config.get_policy_objects():
raise FirewallError(errors.NAME_CONFLICT, "Zones can't have the same name as a policy.")
def combine(self, zone):
self.combined = True
self.filename = None
self.version = ""
self.short = ""
self.description = ""
for interface in zone.interfaces:
if interface not in self.interfaces:
self.interfaces.append(interface)
for source in zone.sources:
if source not in self.sources:
self.sources.append(source)
for service in zone.services:
if service not in self.services:
self.services.append(service)
for port in zone.ports:
if port not in self.ports:
self.ports.append(port)
for proto in zone.protocols:
if proto not in self.protocols:
self.protocols.append(proto)
for icmp in zone.icmp_blocks:
if icmp not in self.icmp_blocks:
self.icmp_blocks.append(icmp)
if zone.forward:
self.forward = True
if zone.masquerade:
self.masquerade = True
for forward in zone.forward_ports:
if forward not in self.forward_ports:
self.forward_ports.append(forward)
for port in zone.source_ports:
if port not in self.source_ports:
self.source_ports.append(port)
for rule in zone.rules:
self.rules.append(rule)
self.rules_str.append(str(rule))
if zone.icmp_block_inversion:
self.icmp_block_inversion = True
# PARSER
class zone_ContentHandler(IO_Object_ContentHandler):
def __init__(self, item):
IO_Object_ContentHandler.__init__(self, item)
self._rule = None
self._rule_error = False
self._limit_ok = None
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
if self._rule_error:
return
self.item.parser_check_element_attrs(name, attrs)
if common_startElement(self, name, attrs):
return
elif name == "zone":
if "name" in attrs:
log.warning("Ignoring deprecated attribute name='%s'",
attrs["name"])
if "version" in attrs:
self.item.version = attrs["version"]
if "immutable" in attrs:
log.warning("Ignoring deprecated attribute immutable='%s'",
attrs["immutable"])
if "target" in attrs:
target = attrs["target"]
if target not in ZONE_TARGETS:
raise FirewallError(errors.INVALID_TARGET, target)
if target != "" and target != DEFAULT_ZONE_TARGET:
self.item.target = target
elif name == "forward":
if self.item.forward:
log.warning("Forward already set, ignoring.")
else:
self.item.forward = True
elif name == "interface":
if self._rule:
log.warning('Invalid rule: interface use in rule.')
self._rule_error = True
return
# zone bound to interface
if "name" not in attrs:
log.warning('Invalid interface: Name missing.')
self._rule_error = True
return
if attrs["name"] not in self.item.interfaces:
self.item.interfaces.append(attrs["name"])
else:
log.warning("Interface '%s' already set, ignoring.",
attrs["name"])
elif name == "source":
if self._rule:
if self._rule.source:
log.warning("Invalid rule: More than one source in rule '%s', ignoring.",
str(self._rule))
self._rule_error = True
return
invert = False
if "invert" in attrs and \
attrs["invert"].lower() in [ "yes", "true" ]:
invert = True
addr = mac = ipset = None
if "address" in attrs:
addr = attrs["address"]
if "mac" in attrs:
mac = attrs["mac"]
if "ipset" in attrs:
ipset = attrs["ipset"]
self._rule.source = rich.Rich_Source(addr, mac, ipset,
invert=invert)
return
# zone bound to source
if "address" not in attrs and "ipset" not in attrs:
log.warning('Invalid source: No address no ipset.')
return
if "address" in attrs and "ipset" in attrs:
log.warning('Invalid source: Address and ipset.')
return
if "family" in attrs:
log.warning("Ignoring deprecated attribute family='%s'",
attrs["family"])
if "invert" in attrs:
log.warning('Invalid source: Invertion not allowed here.')
return
if "address" in attrs:
if not checkIPnMask(attrs["address"]) and \
not checkIP6nMask(attrs["address"]) and \
not check_mac(attrs["address"]):
raise FirewallError(errors.INVALID_ADDR, attrs["address"])
if "ipset" in attrs:
entry = "ipset:%s" % attrs["ipset"]
if entry not in self.item.sources:
self.item.sources.append(entry)
else:
log.warning("Source '%s' already set, ignoring.",
attrs["address"])
if "address" in attrs:
entry = attrs["address"]
if entry not in self.item.sources:
self.item.sources.append(entry)
else:
log.warning("Source '%s' already set, ignoring.",
attrs["address"])
elif name == "icmp-block-inversion":
if self.item.icmp_block_inversion:
log.warning("Icmp-Block-Inversion already set, ignoring.")
else:
self.item.icmp_block_inversion = True
else:
log.warning("Unknown XML element '%s'", name)
return
def endElement(self, name):
IO_Object_ContentHandler.endElement(self, name)
common_endElement(self, name)
def zone_reader(filename, path, no_check_name=False):
zone = Zone()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
zone.name = filename[:-4]
if not no_check_name:
zone.check_name(zone.name)
zone.filename = filename
zone.path = path
zone.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
zone.default = zone.builtin
handler = zone_ContentHandler(zone)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_ZONE,
"not a valid zone file: %s" % \
msg.getException())
del handler
del parser
if PY2:
zone.encode_strings()
return zone
def zone_writer(zone, path=None):
_path = path if path else zone.path
if zone.filename:
name = "%s/%s" % (_path, zone.filename)
else:
name = "%s/%s.xml" % (_path, zone.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start zone element
attrs = {}
if zone.version and zone.version != "":
attrs["version"] = zone.version
if zone.target != DEFAULT_ZONE_TARGET:
attrs["target"] = zone.target
handler.startElement("zone", attrs)
handler.ignorableWhitespace("\n")
common_writer(zone, handler)
# interfaces
for interface in uniqify(zone.interfaces):
handler.ignorableWhitespace(" ")
handler.simpleElement("interface", { "name": interface })
handler.ignorableWhitespace("\n")
# source
for source in uniqify(zone.sources):
handler.ignorableWhitespace(" ")
if "ipset:" in source:
handler.simpleElement("source", { "ipset": source[6:] })
else:
handler.simpleElement("source", { "address": source })
handler.ignorableWhitespace("\n")
# icmp-block-inversion
if zone.icmp_block_inversion:
handler.ignorableWhitespace(" ")
handler.simpleElement("icmp-block-inversion", { })
handler.ignorableWhitespace("\n")
# forward
if zone.forward:
handler.ignorableWhitespace(" ")
handler.simpleElement("forward", { })
handler.ignorableWhitespace("\n")
# end zone element
handler.endElement("zone")
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! 915 5 firewalld_conf.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2012 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
import os.path
import io
import tempfile
import shutil
from firewall import config
from firewall.core.logger import log
from firewall.functions import b2u, u2b, PY2
valid_keys = [ "DefaultZone", "MinimalMark", "CleanupOnExit",
"CleanupModulesOnExit", "Lockdown", "IPv6_rpfilter",
"IndividualCalls", "LogDenied", "AutomaticHelpers",
"FirewallBackend", "FlushAllOnReload", "RFC3964_IPv4",
"AllowZoneDrifting" ]
class firewalld_conf(object):
def __init__(self, filename):
self._config = { }
self._deleted = [ ]
self.filename = filename
self.clear()
def clear(self):
self._config = { }
self._deleted = [ ]
def cleanup(self):
self._config.clear()
self._deleted = [ ]
def get(self, key):
return self._config.get(key.strip())
def set(self, key, value):
_key = b2u(key.strip())
self._config[_key] = b2u(value.strip())
if _key in self._deleted:
self._deleted.remove(_key)
def __str__(self):
s = ""
for (key,value) in self._config.items():
if s:
s += '\n'
s += '%s=%s' % (key, value)
return u2b(s) if PY2 else s
# load self.filename
def read(self):
self.clear()
try:
f = open(self.filename, "r")
except Exception as msg:
log.error("Failed to load '%s': %s", self.filename, msg)
self.set("DefaultZone", config.FALLBACK_ZONE)
self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK))
self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no")
self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no")
self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no")
self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no")
self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no")
self.set("LogDenied", config.FALLBACK_LOG_DENIED)
self.set("AutomaticHelpers", config.FALLBACK_AUTOMATIC_HELPERS)
self.set("FirewallBackend", config.FALLBACK_FIREWALL_BACKEND)
self.set("FlushAllOnReload", "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no")
self.set("RFC3964_IPv4", "yes" if config.FALLBACK_RFC3964_IPV4 else "no")
self.set("AllowZoneDrifting", "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no")
raise
for line in f:
if not line:
break
line = line.strip()
if len(line) < 1 or line[0] in ['#', ';']:
continue
# get key/value pair
pair = [ x.strip() for x in line.split("=") ]
if len(pair) != 2:
log.error("Invalid option definition: '%s'", line.strip())
continue
elif pair[0] not in valid_keys:
log.error("Invalid option: '%s'", line.strip())
continue
elif pair[1] == '':
log.error("Missing value: '%s'", line.strip())
continue
elif self._config.get(pair[0]) is not None:
log.error("Duplicate option definition: '%s'", line.strip())
continue
self._config[pair[0]] = pair[1]
f.close()
# check default zone
if not self.get("DefaultZone"):
log.error("DefaultZone is not set, using default value '%s'",
config.FALLBACK_ZONE)
self.set("DefaultZone", str(config.FALLBACK_ZONE))
# check minimal mark
value = self.get("MinimalMark")
try:
int(value)
except (ValueError, TypeError):
if value is not None:
log.warning("MinimalMark '%s' is not valid, using default "
"value '%d'", value if value else '',
config.FALLBACK_MINIMAL_MARK)
self.set("MinimalMark", str(config.FALLBACK_MINIMAL_MARK))
# check cleanup on exit
value = self.get("CleanupOnExit")
if not value or value.lower() not in [ "no", "false", "yes", "true" ]:
if value is not None:
log.warning("CleanupOnExit '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_CLEANUP_ON_EXIT)
self.set("CleanupOnExit", "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no")
# check module cleanup on exit
value = self.get("CleanupModulesOnExit")
if not value or value.lower() not in [ "no", "false", "yes", "true" ]:
if value is not None:
log.warning("CleanupModulesOnExit '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_CLEANUP_MODULES_ON_EXIT)
self.set("CleanupModulesOnExit", "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no")
# check lockdown
value = self.get("Lockdown")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("Lockdown '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_LOCKDOWN)
self.set("Lockdown", "yes" if config.FALLBACK_LOCKDOWN else "no")
# check ipv6_rpfilter
value = self.get("IPv6_rpfilter")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("IPv6_rpfilter '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_IPV6_RPFILTER)
self.set("IPv6_rpfilter","yes" if config.FALLBACK_IPV6_RPFILTER else "no")
# check individual calls
value = self.get("IndividualCalls")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("IndividualCalls '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_INDIVIDUAL_CALLS)
self.set("IndividualCalls", "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no")
# check log denied
value = self.get("LogDenied")
if not value or value not in config.LOG_DENIED_VALUES:
if value is not None:
log.warning("LogDenied '%s' is invalid, using default value '%s'",
value, config.FALLBACK_LOG_DENIED)
self.set("LogDenied", str(config.FALLBACK_LOG_DENIED))
# check automatic helpers
value = self.get("AutomaticHelpers")
if not value or value.lower() not in config.AUTOMATIC_HELPERS_VALUES:
if value is not None:
log.warning("AutomaticHelpers '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_AUTOMATIC_HELPERS)
self.set("AutomaticHelpers", str(config.FALLBACK_AUTOMATIC_HELPERS))
value = self.get("FirewallBackend")
if not value or value.lower() not in config.FIREWALL_BACKEND_VALUES:
if value is not None:
log.warning("FirewallBackend '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_FIREWALL_BACKEND)
self.set("FirewallBackend", str(config.FALLBACK_FIREWALL_BACKEND))
value = self.get("FlushAllOnReload")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("FlushAllOnReload '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_FLUSH_ALL_ON_RELOAD)
self.set("FlushAllOnReload", str(config.FALLBACK_FLUSH_ALL_ON_RELOAD))
value = self.get("RFC3964_IPv4")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("RFC3964_IPv4 '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_RFC3964_IPV4)
self.set("RFC3964_IPv4", str(config.FALLBACK_RFC3964_IPV4))
value = self.get("AllowZoneDrifting")
if not value or value.lower() not in [ "yes", "true", "no", "false" ]:
if value is not None:
log.warning("AllowZoneDrifting '%s' is not valid, using default "
"value %s", value if value else '',
config.FALLBACK_ALLOW_ZONE_DRIFTING)
self.set("AllowZoneDrifting", str(config.FALLBACK_ALLOW_ZONE_DRIFTING))
# save to self.filename if there are key/value changes
def write(self):
if len(self._config) < 1:
# no changes: nothing to do
return
# handled keys
done = [ ]
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
try:
temp_file = tempfile.NamedTemporaryFile(mode='wt',
prefix="%s." % os.path.basename(self.filename),
dir=os.path.dirname(self.filename), delete=False)
except Exception as msg:
log.error("Failed to open temporary file: %s" % msg)
raise
modified = False
empty = False
try:
f= io.open(self.filename, mode='rt', encoding='UTF-8')
except Exception as msg:
if os.path.exists(self.filename):
log.error("Failed to open '%s': %s" % (self.filename, msg))
raise
else:
f = None
else:
for line in f:
if not line:
break
# remove newline
line = line.strip("\n")
if len(line) < 1:
if not empty:
temp_file.write(u"\n")
empty = True
elif line[0] == '#':
empty = False
temp_file.write(line)
temp_file.write(u"\n")
else:
p = line.split("=")
if len(p) != 2:
empty = False
temp_file.write(line+u"\n")
continue
key = p[0].strip()
value = p[1].strip()
# check for modified key/value pairs
if key not in done:
if (key in self._config and \
self._config[key] != value):
empty = False
temp_file.write(u'%s=%s\n' %
(key, self._config[key]))
modified = True
elif key in self._deleted:
modified = True
else:
empty = False
temp_file.write(line+u"\n")
done.append(key)
else:
modified = True
# write remaining key/value pairs
if len(self._config) > 0:
for (key,value) in self._config.items():
if key in done:
continue
if key in ["MinimalMark", "AutomaticHelpers"]: # omit deprecated from new config
continue
if not empty:
temp_file.write(u"\n")
empty = True
temp_file.write(u'%s=%s\n' % (key, value))
modified = True
if f:
f.close()
temp_file.close()
if not modified: # not modified: remove tempfile
os.remove(temp_file.name)
return
# make backup
if os.path.exists(self.filename):
try:
shutil.copy2(self.filename, "%s.old" % self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Backup of '%s' failed: %s" % (self.filename, msg))
# copy tempfile
try:
shutil.move(temp_file.name, self.filename)
except Exception as msg:
os.remove(temp_file.name)
raise IOError("Failed to create '%s': %s" % (self.filename, msg))
else:
os.chmod(self.filename, 0o600)
PK ! mL2 2
service.pynu [ # -*- coding: utf-8 -*-
#
# Copyright (C) 2011-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
__all__ = [ "Service", "service_reader", "service_writer" ]
import xml.sax as sax
import os
import io
import shutil
from firewall import config
from firewall.functions import u2b_if_py2
from firewall.core.io.io_object import PY2, IO_Object, \
IO_Object_ContentHandler, IO_Object_XMLGenerator, check_port, \
check_tcpudp, check_protocol, check_address
from firewall.core.logger import log
from firewall import errors
from firewall.errors import FirewallError
class Service(IO_Object):
IMPORT_EXPORT_STRUCTURE = (
( "version", "" ),
( "short", "" ),
( "description", "" ),
( "ports", [ ( "", "" ), ], ),
( "modules", [ "", ], ),
( "destination", { "": "", }, ),
( "protocols", [ "", ], ),
( "source_ports", [ ( "", "" ), ], ),
( "includes", [ "" ], ),
( "helpers", [ "", ], ),
)
ADDITIONAL_ALNUM_CHARS = [ "_", "-" ]
PARSER_REQUIRED_ELEMENT_ATTRS = {
"short": None,
"description": None,
"service": None,
}
PARSER_OPTIONAL_ELEMENT_ATTRS = {
"service": [ "name", "version" ],
"port": [ "port", "protocol" ],
"protocol": [ "value" ],
"module": [ "name" ],
"destination": [ "ipv4", "ipv6" ],
"source-port": [ "port", "protocol" ],
"include": [ "service" ],
"helper": [ "name" ],
}
def __init__(self):
super(Service, self).__init__()
self.version = ""
self.short = ""
self.description = ""
self.ports = [ ]
self.protocols = [ ]
self.modules = [ ]
self.destination = { }
self.source_ports = [ ]
self.includes = [ ]
self.helpers = [ ]
def cleanup(self):
self.version = ""
self.short = ""
self.description = ""
del self.ports[:]
del self.protocols[:]
del self.modules[:]
self.destination.clear()
del self.source_ports[:]
del self.includes[:]
del self.helpers[:]
def encode_strings(self):
""" HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support."""
self.version = u2b_if_py2(self.version)
self.short = u2b_if_py2(self.short)
self.description = u2b_if_py2(self.description)
self.ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr) in self.ports]
self.modules = [u2b_if_py2(m) for m in self.modules]
self.destination = {u2b_if_py2(k):u2b_if_py2(v) for k,v in self.destination.items()}
self.protocols = [u2b_if_py2(pr) for pr in self.protocols]
self.source_ports = [(u2b_if_py2(po),u2b_if_py2(pr)) for (po,pr)
in self.source_ports]
self.includes = [u2b_if_py2(s) for s in self.includes]
self.helpers = [u2b_if_py2(s) for s in self.helpers]
def _check_config(self, config, item, all_config):
if item == "ports":
for port in config:
if port[0] != "":
check_port(port[0])
check_tcpudp(port[1])
else:
# only protocol
check_protocol(port[1])
elif item == "protocols":
for proto in config:
check_protocol(proto)
elif item == "source_ports":
for port in config:
check_port(port[0])
check_tcpudp(port[1])
elif item == "destination":
for destination in config:
if destination not in [ "ipv4", "ipv6" ]:
raise FirewallError(errors.INVALID_DESTINATION,
"'%s' not in {'ipv4'|'ipv6'}" % \
destination)
check_address(destination, config[destination])
elif item == "modules":
for module in config:
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
if len(module) < 2:
raise FirewallError(errors.INVALID_MODULE, module)
# PARSER
class service_ContentHandler(IO_Object_ContentHandler):
def startElement(self, name, attrs):
IO_Object_ContentHandler.startElement(self, name, attrs)
self.item.parser_check_element_attrs(name, attrs)
if name == "service":
if "name" in attrs:
log.warning("Ignoring deprecated attribute name='%s'",
attrs["name"])
if "version" in attrs:
self.item.version = attrs["version"]
elif name == "short":
pass
elif name == "description":
pass
elif name == "port":
if attrs["port"] != "":
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (attrs["port"], attrs["protocol"])
if entry not in self.item.ports:
self.item.ports.append(entry)
else:
log.warning("Port '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
else:
check_protocol(attrs["protocol"])
if attrs["protocol"] not in self.item.protocols:
self.item.protocols.append(attrs["protocol"])
else:
log.warning("Protocol '%s' already set, ignoring.",
attrs["protocol"])
elif name == "protocol":
check_protocol(attrs["value"])
if attrs["value"] not in self.item.protocols:
self.item.protocols.append(attrs["value"])
else:
log.warning("Protocol '%s' already set, ignoring.",
attrs["value"])
elif name == "source-port":
check_port(attrs["port"])
check_tcpudp(attrs["protocol"])
entry = (attrs["port"], attrs["protocol"])
if entry not in self.item.source_ports:
self.item.source_ports.append(entry)
else:
log.warning("SourcePort '%s/%s' already set, ignoring.",
attrs["port"], attrs["protocol"])
elif name == "destination":
for x in [ "ipv4", "ipv6" ]:
if x in attrs:
check_address(x, attrs[x])
if x in self.item.destination:
log.warning("Destination address for '%s' already set, ignoring",
x)
else:
self.item.destination[x] = attrs[x]
elif name == "module":
module = attrs["name"]
if module.startswith("nf_conntrack_"):
module = module.replace("nf_conntrack_", "")
if "_" in module:
module = module.replace("_", "-")
if module not in self.item.modules:
self.item.modules.append(module)
else:
log.warning("Module '%s' already set, ignoring.",
module)
elif name == "include":
if attrs["service"] not in self.item.includes:
self.item.includes.append(attrs["service"])
else:
log.warning("Include '%s' already set, ignoring.",
attrs["service"])
elif name == "helper":
if attrs["name"] not in self.item.helpers:
self.item.helpers.append(attrs["name"])
else:
log.warning("Helper '%s' already set, ignoring.",
attrs["name"])
def service_reader(filename, path):
service = Service()
if not filename.endswith(".xml"):
raise FirewallError(errors.INVALID_NAME,
"'%s' is missing .xml suffix" % filename)
service.name = filename[:-4]
service.check_name(service.name)
service.filename = filename
service.path = path
service.builtin = False if path.startswith(config.ETC_FIREWALLD) else True
service.default = service.builtin
handler = service_ContentHandler(service)
parser = sax.make_parser()
parser.setContentHandler(handler)
name = "%s/%s" % (path, filename)
with open(name, "rb") as f:
source = sax.InputSource(None)
source.setByteStream(f)
try:
parser.parse(source)
except sax.SAXParseException as msg:
raise FirewallError(errors.INVALID_SERVICE,
"not a valid service file: %s" % \
msg.getException())
del handler
del parser
if PY2:
service.encode_strings()
return service
def service_writer(service, path=None):
_path = path if path else service.path
if service.filename:
name = "%s/%s" % (_path, service.filename)
else:
name = "%s/%s.xml" % (_path, service.name)
if os.path.exists(name):
try:
shutil.copy2(name, "%s.old" % name)
except Exception as msg:
log.error("Backup of file '%s' failed: %s", name, msg)
dirpath = os.path.dirname(name)
if dirpath.startswith(config.ETC_FIREWALLD) and not os.path.exists(dirpath):
if not os.path.exists(config.ETC_FIREWALLD):
os.mkdir(config.ETC_FIREWALLD, 0o750)
os.mkdir(dirpath, 0o750)
f = io.open(name, mode='wt', encoding='UTF-8')
handler = IO_Object_XMLGenerator(f)
handler.startDocument()
# start service element
attrs = {}
if service.version and service.version != "":
attrs["version"] = service.version
handler.startElement("service", attrs)
handler.ignorableWhitespace("\n")
# short
if service.short and service.short != "":
handler.ignorableWhitespace(" ")
handler.startElement("short", { })
handler.characters(service.short)
handler.endElement("short")
handler.ignorableWhitespace("\n")
# description
if service.description and service.description != "":
handler.ignorableWhitespace(" ")
handler.startElement("description", { })
handler.characters(service.description)
handler.endElement("description")
handler.ignorableWhitespace("\n")
# ports
for port in service.ports:
handler.ignorableWhitespace(" ")
handler.simpleElement("port", { "port": port[0], "protocol": port[1] })
handler.ignorableWhitespace("\n")
# protocols
for protocol in service.protocols:
handler.ignorableWhitespace(" ")
handler.simpleElement("protocol", { "value": protocol })
handler.ignorableWhitespace("\n")
# source ports
for port in service.source_ports:
handler.ignorableWhitespace(" ")
handler.simpleElement("source-port", { "port": port[0],
"protocol": port[1] })
handler.ignorableWhitespace("\n")
# modules
for module in service.modules:
handler.ignorableWhitespace(" ")
handler.simpleElement("module", { "name": module })
handler.ignorableWhitespace("\n")
# destination
if len(service.destination) > 0:
handler.ignorableWhitespace(" ")
handler.simpleElement("destination", service.destination)
handler.ignorableWhitespace("\n")
# includes
for include in service.includes:
handler.ignorableWhitespace(" ")
handler.simpleElement("include", { "service": include })
handler.ignorableWhitespace("\n")
# helpers
for helper in service.helpers:
handler.ignorableWhitespace(" ")
handler.simpleElement("helper", { "name": helper })
handler.ignorableWhitespace("\n")
# end service element
handler.endElement('service')
handler.ignorableWhitespace("\n")
handler.endDocument()
f.close()
del handler
PK ! G nonblock.rbnu [ require "fcntl"
class IO
def nonblock?
(fcntl(Fcntl::F_GETFL) & File::NONBLOCK) != 0
end
def nonblock=(nb)
f = fcntl(Fcntl::F_GETFL)
if nb
f |= File::NONBLOCK
else
f &= ~File::NONBLOCK
end
fcntl(Fcntl::F_SETFL, f)
end
def nonblock(nb = true)
nb, self.nonblock = nonblock?, nb
yield
ensure
self.nonblock = nb
end
end if defined?(Fcntl::F_GETFL)
PK ! k7 simple.gonu [ PK ! ; 2 ports.gonu [ PK ! L console/size.rbnu [ PK ! \0p 0p
p console.sonu ȯ PK ! n^ buffer.hnu [ PK ! ף 0 dumb.rbnu [ PK ! %DC DC
6 windows.rbnu [ PK ! F' ' Nz ansi.rbnu [ PK ! h?n$ n$ LC_MESSAGES/iso_3166-1.monu [ PK ! I.X .X LC_MESSAGES/gtk20.monu [ PK ! o o 2 LC_MESSAGES/gdk-pixbuf.monu [ PK ! ,:< < 3 __init__.pynu [ PK ! / a: helper.pynu [ PK ! Cc== = M[ direct.pynu [ PK ! m f ifcfg.pynu [ PK ! 5 icmptype.pynu [ PK ! z!
* b __pycache__/functions.cpython-36.opt-1.pycnu [ PK ! ?xR`/ `/ $ j __pycache__/io_object.cpython-36.pycnu [ PK ! g2 2 % __pycache__/zone.cpython-36.opt-1.pycnu [ PK ! qޝ # :; __pycache__/icmptype.cpython-36.pycnu [ PK ! @* / *O __pycache__/firewalld_conf.cpython-36.opt-1.pycnu [ PK ! qޝ ) m __pycache__/icmptype.cpython-36.opt-1.pycnu [ PK ! (# (
__pycache__/service.cpython-36.opt-1.pycnu [ PK ! ) ) ' d __pycache__/helper.cpython-36.opt-1.pycnu [ PK ! h% h% 3 __pycache__/lockdown_whitelist.cpython-36.opt-1.pycnu [ PK ! FmR R ! __pycache__/policy.cpython-36.pycnu [ PK ! @* ) 2 __pycache__/firewalld_conf.cpython-36.pycnu [ PK ! ) ) ! qP __pycache__/helper.cpython-36.pycnu [ PK ! Vq/ & g __pycache__/ifcfg.cpython-36.opt-1.pycnu [ PK ! 9), ), x __pycache__/ipset.cpython-36.pycnu [ PK ! z!
$ __pycache__/functions.cpython-36.pycnu [ PK ! ?xR`/ `/ * __pycache__/io_object.cpython-36.opt-1.pycnu [ PK ! h% h% - G __pycache__/lockdown_whitelist.cpython-36.pycnu [ PK ! (# " __pycache__/service.cpython-36.pycnu [ PK ! g2 2 ]& __pycache__/zone.cpython-36.pycnu [ PK ! Vq/ sY __pycache__/ifcfg.cpython-36.pycnu [ PK ! I>. . ' i __pycache__/direct.cpython-36.opt-1.pycnu [ PK ! r # __pycache__/__init__.cpython-36.pycnu [ PK ! r ) __pycache__/__init__.cpython-36.opt-1.pycnu [ PK ! 9), ), & x __pycache__/ipset.cpython-36.opt-1.pycnu [ PK ! I>. . ! __pycache__/direct.cpython-36.pycnu [ PK ! FmR R ' __pycache__/policy.cpython-36.opt-1.pycnu [ PK ! oU U L ipset.pynu [ PK !
Ϣ Ϣ Ţ policy.pynu [ PK ! γ1 1 E lockdown_whitelist.pynu [ PK ! (5 5 w io_object.pynu [ PK ! *y y functions.pynu [ PK ! 8M M zone.pynu [ PK ! 915 5 s
firewalld_conf.pynu [ PK ! mL2 2
C service.pynu [ PK ! G v nonblock.rbnu [ PK 3 3 x