Tc @ s d d k l Z d d k l Z l Z l Z l Z l Z l Z l Z d d k Z d d k
l Z l Z l
Z
l Z l Z d d k l Z d d k l Z d d k Z d d k Z d Z d Z d Z d Z d
Z d Z d Z d
e f d YZ d Z d Z! d Z" d d Z$ d e f d YZ% d d Z& d e' d d Z( d d d Z) d d e' d Z* d d e' d Z+ d Z, d S( i( t copy( t Optiont OptionErrort OptionParsert Valuest
SUPPRESS_HELPt BadOptionErrort OptionGroupN( t getPortIDt getPortRanget getServiceNamet checkIPt checkInterface( t getByKeyc C s6 t } y | i d \ } } Wn
t } n Xt | i } | d j o
t } np | d j o t t d | | nF t | d j o2 | d | d j o t t d | | n | p: | i } | d j o t t d
| | qn | o t t d | | n | | f S(
Nt :is port range %s is not unique.i i i s1 %s is not a valid range (start port >= end port).t tcpt udps %s is not a valid protocol.s invalid port definition %s.( R R ( t Falset splitt TrueR t stript NoneR t _t len( t optiont optt valuet failuret portst protocolt range( ( s. /usr/share/system-config-firewall/fw_parser.pyt _check_port s(
(
! c C s d } d } | i d d } t | d j o8 | d t i j o$ | d } | d i d d } n t | d j o8 | d t i j o$ | d } | d i d d } n d i | } | d j o& | d j o t t d | n | | | f S( Nt ipv4t filterR i i t ipv6t nats ipv6 has no nat support.( R R t fw_configt FIREWALL_TYPESt FIREWALL_TABLESt joinR R ( R R R t typet tablet splitst filename( ( s. /usr/share/system-config-firewall/fw_parser.pyt _check_rulesfile6 s '
'
c C s. t | p t t d | | n | S( Ns invalid service '%s'.( t getServiceByKeyR R ( R R R ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _check_serviceG s
c C sB t | p1 h | d 6| d 6} t t d | | n | S( NR R s1 option %(option)s: invalid icmp type '%(value)s'.( t getICMPTypeByKeyR R ( R R R t dict( ( s. /usr/share/system-config-firewall/fw_parser.pyt _check_icmp_typeL s
c
C s h } d } | i d d } xwt | d j oc| d i d } t | d j o t d | d } Pn | \ } } | d j o
t | p4 | d j o
| d j p | d j o t | o | | | <nW | d j p
| d
j o' t | d j o t | | | <n t d | d } Pt | d j oE | d i d d j o | d g } q| d i d d } q! | i q! W| o8 h | d 6| d 6| d 6} t t d | | n t
} x4 d d d g D]# } | | i j o
t } qqWd
| i j o d | i j o
t } n | o1 h | d 6| d 6} t t d | | n | S( NR i i t =i s Invalid argument %st ift protoR R t toaddrt portt toportR R t errors? option %(option)s: invalid forward_port '%(value)s': %(error)s.s4 option %(option)s: invalid forward_port '%(value)s'.( s tcps udp(
R R R R R R R t countt popR R t keysR (
R R R t resultR8 R* t key_valt keyt valR0 ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _check_forward_portS sN - &
c C s. t | p t t d | | n | S( Ns invalid interface '%s'.( R R R ( R R R ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _check_interface s
c O sQ t | i | i } | o | | j o d S| i i | i g i | d S( N( t getattrt valuest destt ensure_valuet append( R R R t parsert argst kwargst vals( ( s. /usr/share/system-config-firewall/fw_parser.pyt _append_unique s t _Optionc B s` e Z e i d Z e e i Z e e d <e e d <e e d <e e d <e
e d <e e d <RS( R6 t rulesfilet servicet forward_portt icmp_typet interface( s portRM RN RO RP RQ ( t __name__t
__module__R t TYPESR t TYPE_CHECKERR R, R. R@ R1 RA ( ( ( s. /usr/share/system-config-firewall/fw_parser.pyRL s
c C s | i d d d d d d t d t d | i d d d
d d d t d | i d d d
d d d d d t d d
t d t d | i d d d
d d d d d t d d
t d t d | i d d d d
d d d d d g d t d d
t d t d | i d d d d
d d d d d t d! d
t d t d" | i d# d$ d d
d d% d d& d t d' d
t d t d( | i d) d* d d
d d+ d d& d t d' d
t d t d, | i d- d. d d d d d t d/ | i d0 d d
d d1 d d2 d t d3 d
t d t d4 | i d5 d d
d d6 d d6 d t d7 d
t d t d8 | i d9 d d
d d: d d; d g d
t d t d< d t d= d S(> Ns --enabledt actiont
store_trueRD t enabledt defaultt helps Enable firewall (default)s
--disabledt store_falses Disable firewalls --addmodulet callbackt
add_moduleR( t stringt metavars <module>s Enable an iptables modules --removemodulet
remove_modules Disable an iptables modules -ss --servicet servicesRN s <service>s* Open the firewall for a service (e.g, ssh)s -ps --portR R6 s <port>[-<port>]:<protocol>s2 Open specific ports in the firewall (e.g, ssh:tcp)s -ts --trustt trustRQ s <interface>s) Allow all traffic on the specified devices -ms --masqt masqsA Masquerades traffic from the specified device. This is IPv4 only.s --highs --mediums- Backwards compatibility, aliased to --enableds --custom-rulest custom_rulesRM s [<type>:][<table>:]<filename>s Specify a custom rules file for inclusion in the firewall, after the default rules. Default protocol type: ipv4, default table: filter. (Example: ipv4:filter:/etc/sysconfig/ipv4_filter_addon)s --forward-portRO sf if=<interface>:port=<port>:proto=<protocol>[:toport=<destination port>][:toaddr=<destination address>]s Forward the port with protocol for the interface to either another local destination port (no destination address given) or to an other destination address with an optional destination port. This is IPv4 only.s --block-icmpt
block_icmpRP s <icmp type>s> Block this ICMP type. The default is to accept all ICMP types.( t
add_optionR R RK ( RG ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _addStandardOptions sh
c C ss | i d d d d d d t d | i d d d d d d t d
| i d d d d d d t d
d S( Ns
--no-ipsecRV RW RD t no_ipsecRZ s* Disable Internet Protocol Security (IPsec)s --no-ippt no_ipps( Disable Internet Printing Protocol (IPP)s --no-mdnst no_mdnss Disable Multicast DNS (mDNS)( Rf R ( RG ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _addCompatOptions s
c C s t | t d t d } | i d d d d d d d d
t d d t i d
t d d i t i | i d d d d d d d d
t d d
t d | i | d S( Ns SELinux Options (deprecated)s Using these options with no additional firewall options will not create or alter firewall configuration, only SELinux will be configured.s --selinuxRV t storeRD t selinuxR( t choiceR_ s <mode>t choicesRZ s Configure SELinux mode: %ss , s
--selinuxtypet selinuxtypeR^ s <type>s9 Configure SELinux type: Usually targeted or strict Policy( R R Rf R$ t
SELINUX_MODESR' t add_option_group( RG t group( ( s. /usr/share/system-config-firewall/fw_parser.pyt _addSELinuxOptions s
c C s y | i | | \ } } Wn# t j
o } | i | d SXt | d j o, x) | D] } | i t d | q\ Wn | i o/ t i o t i i d q t
i d n t | d p
d | _
n t | d p
t | _ n | S( Ni s no such option: %si R+ t converted( t
parse_argst ExceptionR8 R R R t _fw_exitR$ t uit
parse_exitt syst exitt hasattrR+ R Ru ( RG RH t optionst _optionst _argsR8 t arg( ( s. /usr/share/system-config-firewall/fw_parser.pyt _parse_args s$
t
_OptionParserc B s\ e Z d d Z d d Z d d d Z d Z d Z d Z d Z d Z
RS(
c C sl | d j o
t i } n | i } t | t o% | i | } | i | d } n | i | d S( Nt replace( R R{ t stdoutt format_helpt
isinstancet unicodet
_get_encodingt encodet write( t selft filet strt encoding( ( s. /usr/share/system-config-firewall/fw_parser.pyt
print_help s
c C s d S( N( ( R R ( ( s. /usr/share/system-config-firewall/fw_parser.pyt print_usage s i c C sQ | o/ t i o t i i | q6 t i | IJn t i p
t | _ n d S( N( R$ Ry t parse_errorR{ t stderrR Rx ( R t statust msg( ( s. /usr/share/system-config-firewall/fw_parser.pyR| s
c C sD | i o d | i | f } n
t | } | i d d | d S( Ns %s: %si R ( t
_fw_sourceR R| ( R R t text( ( s. /usr/share/system-config-firewall/fw_parser.pyR8 $ s
c C s( | i i | o | St | d S( N( t _long_optt has_keyR ( R R ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _match_long_opt* s c C s= y | i | | Wn" t j
o } | i | n Xd S( N( t _OptionParser__process_long_optRw R8 ( R t rargsRC R ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _process_long_opt. s c C s@ y t i | | | Wn" t j
o } | i | n Xd S( N( R t _process_short_optsRw R8 ( R R RC R ( ( s. /usr/share/system-config-firewall/fw_parser.pyR 5 s c C s | i d } d | j o" | i d d \ } } t } n
| } t } | i | } | i | } | i o| i } t | t | | j oW | d j o | i
t d | qh | d 6| d 6} | i
t d | q| d j o | o
| }
q| d j o | i d }
q| o0 t | g | d | d ! }
| d | d 5qt | d | ! }
| d | 5n) | o | i
t d | n d }
| i | |
| | d S( Ni R2 i s %s option requires an argumentR R9 s. %(option)s option requires %(count)s argumentss %s option does not take a value( R: R R R R R t takes_valuet nargsR t intR8 R t tupleR t process( R R RC R R t next_argt had_explicit_valueR R R0 R ( ( s. /usr/share/system-config-firewall/fw_parser.pyt __process_long_opt; s:
N( RR RS R R R R| R8 R R R R ( ( ( s. /usr/share/system-config-firewall/fw_parser.pyR s c C s+ t d t d t } | | _ t | _ | S( Nt add_help_optiont option_class( R R RL R Rx ( t sourceRG ( ( s. /usr/share/system-config-firewall/fw_parser.pyt _gen_parsere s c C s; t | } t | | o t | n t | | | S( N( R Rg Rk R ( RH R~ t compatR RG ( ( s. /usr/share/system-config-firewall/fw_parser.pyt parseSysconfigArgsk s
c C s& t | } t | t | | | S( N( R Rt R ( RH R~ R RG ( ( s. /usr/share/system-config-firewall/fw_parser.pyt parseSELinuxArgsr s
c C s t } | i d d d d d d d t d | i d d d d
d d d t d
| i d d d d
d d d t d | i d d d
d d d t d | i d d d d
d d d t d | i d d d
d d d t d | i d d d
d d d t d | i d d d d d! d" d# d$ t d% d& t i d t d' d( i t i | i d) d d
d d* d t d+ | i d, d d
d d- d t d. t | t | t t i
d/ j o | i t i d0 n t
| | | } t | _ | d j ok | od t } t } x5 t i
d1 D]& } | i d2 o
t } q@t } q@W| o | o
t | _ qn | S(3 Ns -?s -hs --helps --usageRV RZ s Show this help messages -qs --quietRW RD t quiets9 Run noninteractively; process only command-line argumentss -vs --verboset verboses Be more verboses --versiont versions Show versions -ns --nostartt nostarts< Configure firewall but do not activate the new configurations -ft forces Ignore actual settingss --updatet updates Update firewall non-interactively if the firewall is enabled. This will also restart the firewall. The -n and -f options will be ignored.s --defaultRl RY R( Rn R_ s <type>Ro sJ Set firewall default type: %s. This overwrites any existing configuration.s , s --list-servicest
list_servicess List predefined services.s --list-icmp-typest list_icmp_typess List the supported icmp types.i i i s --selinux( R Rf R R$ t
DEFAULT_TYPESR' Rt Rg R R{ t argvR R| R R t nofwR t
startswithR ( RH R~ R RG R Rm t firewallR ( ( s. /usr/share/system-config-firewall/fw_parser.pyt parseLokkitArgsw sd
c C s t } | i d d d d d d d t d | i d d
d d d d d t d | i d
d d d d d t d | i d d d d d d t d | i d d d d d d d d t d d t i d t d d i t i t | t | t | | | S( Ns -vs --verboseRV RW RD R RZ s Be more verboses -ns --nostartR s< Configure firewall but do not activate the new configurations -fR s Ignore actual settingss --updateR s Update firewall non-interactively if the firewall is enabled. This will also restart the firewall. The -n and -f options will be ignored.s --defaultRl RY R( Rn R_ s <type>Ro sJ Set firewall default type: %s. This overwrites any existing configuration.s , ( R Rf R R$ R R' Rt Rg R ( RH R~ R RG ( ( s. /usr/share/system-config-firewall/fw_parser.pyt
parseDBUSArgs s*
c C s+ | p d St } t | i | _ | S( N( R R R t __dict__( RC t
new_values( ( s. /usr/share/system-config-firewall/fw_parser.pyt
copyValues s
(- R t optparseR R R R R R R R$ t fw_functionsR R R
R R t fw_servicesR
R- t fw_icmpR/ t os.patht osR{ R R, R. R1 R@ RA RK RL Rg Rk Rt R R R R R R R R R R ( ( ( s. /usr/share/system-config-firewall/fw_parser.pyt <module> s4 4 ( / D V >
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`
