File: //bin/firewall-offline-cmd
#!/usr/bin/python -Es
# -*- coding: utf-8 -*-
#
# Copyright (C) 2009-2014 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>
# Jiri Popelka <jpopelka@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import argparse
import dbus
import os
#from firewall.config import *
from firewall.core.fw_test import Firewall_test
from firewall.client import *
from firewall.errors import *
from firewall.functions import joinArgs, splitArgs
# check for root user
if os.getuid() != 0:
print(_("You need to be root to run %s.") % sys.argv[0])
sys.exit(-1)
def __usage():
print ("""
Usage: firewall-offline-cmd [OPTIONS...]
If no options are given, configuration from '/etc/sysconfig/system-config-firewall' will be migrated.
General Options
-h, --help Prints a short help text and exists
-V, --version Print the version string of firewalld
Lokkit Compatibility Options
--enabled Enable firewall (default)
--disabled Disable firewall
--addmodule=<module> Ignored option, was used to enable an iptables module
--removemodule=<module>
Ignored option, was used to disable an iptables module
-s <service>, --service=<service>
Enable a service in the default zone (example: ssh)
--remove-service=<service>
Disable a service in the default zone (example: ssh)
-p <port>[-<port>]:<protocol>, --port=<port>[-<port>]:<protocol>
Enable a port in the default zone (example: ssh:tcp)
-t <interface>, --trust=<interface>
Bind an interface to the trusted zone
-m <interface>, --masq=<interface>
Enables masquerading in the default zone, interface
argument is ignored. This is IPv4 only.
--custom-rules=[<type>:][<table>:]<filename>
Ignored option. Was used to add custom rules to the
firewall (Example:
ipv4:filter:/etc/sysconfig/ipv4_filter_addon)
--forward-port=if=<interface>:port=<port>:proto=<protocol>[:toport=<destination port>][:toaddr=<destination address>]
Forward the port with protocol for the interface to
either another local destination port (no destination
address given) or to an other destination address with
an optional destination port. This will be added to
the default zone. This is IPv4 only.
--block-icmp=<icmp type>
Block this ICMP type in the default zone. The default
is to accept all ICMP types.
Zone Options
--get-default-zone Print default zone for connections and interfaces
--set-default-zone=<zone>
Set default zone
--get-zones Print predefined zones
--get-services Print predefined services
--get-icmptypes Print predefined icmptypes
--get-zone-of-interface=<interface>
Print name of the zone the interface is bound to
--get-zone-of-source=<source>[/<mask>]
Print name of the zone the source[/mask] is bound to
--list-all-zones List everything added for or enabled in all zones
--new-zone=<zone> Add a new zone
--delete-zone=<zone> Delete an existing zone
--zone=<zone> Use this zone to set or query options, else default zone
Usable for options maked with [Z]
--get-target Get the zone target
--set-target=<target>
Set the zone target
IcmpType Options
--new-icmptype=<icmptype>
Add a new icmptype
--delete-icmptype=<icmptype>
Delete and existing icmptype
Service Options
--new-service=<service>
Add a new service
--delete-service=<service>
Delete and existing service
Options to Adapt and Query Zones
--list-all List everything added for or enabled in a zone [Z]
--list-services List services added for a zone [Z]
--add-service=<service>
Add a service for a zone [Z]
--remove-service-from-zone=<service>
Remove a service from a zone [Z]
--query-service=<service>
Return whether service has been added for a zone [Z]
--list-ports List ports added for a zone [Z]
--add-port=<portid>[-<portid>]/<protocol>
Add the port for a zone [Z]
--remove-port=<portid>[-<portid>]/<protocol>
Remove the port from a zone [Z]
--query-port=<portid>[-<portid>]/<protocol>
Return whether the port has been added for zone [Z]
--list-icmp-blocks List Internet ICMP type blocks added for a zone [Z]
--add-icmp-block=<icmptype>
Add an ICMP block for a zone [Z]
--remove-icmp-block=<icmptype>
Remove the ICMP block from a zone [Z]
--query-icmp-block=<icmptype>
Return whether an ICMP block has been added for a zone
[Z]
--list-forward-ports List IPv4 forward ports added for a zone [Z]
--add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Add the IPv4 forward port for a zone [Z]
--remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Remove the IPv4 forward port from a zone [Z]
--query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Return whether the IPv4 forward port has been added for
a zone [Z]
--add-masquerade Enable IPv4 masquerade for a zone [Z]
--remove-masquerade Disable IPv4 masquerade for a zone [Z]
--query-masquerade Return whether IPv4 masquerading has been enabled for a
zone [Z]
--list-rich-rules List rich language rules added for a zone [Z]
--add-rich-rule=<rule>
Add rich language rule 'rule' for a zone [Z]
--remove-rich-rule=<rule>
Remove rich language rule 'rule' from a zone [Z]
--query-rich-rule=<rule>
Return whether a rich language rule 'rule' has been
added for a zone [Z]
Options to Handle Bindings of Interfaces
--list-interfaces List interfaces that are bound to a zone [Z]
--add-interface=<interface>
Bind the <interface> to a zone [Z]
--change-interface=<interface>
Change zone the <interface> is bound to [Z]
--query-interface=<interface>
Query whether <interface> is bound to a zone [Z]
--remove-interface=<interface>
Remove binding of <interface> from a zone [Z]
Options to Handle Bindings of Sources
--list-sources List sources that are bound to a zone [Z]
--add-source=<source>[/<mask>]
Bind <source>[/<mask>] to a zone [Z]
--change-source=<source>[/<mask>]
Change zone the <source>[/<mask>] is bound to [Z]
--query-source=<source>[/<mask>]
Query whether <source>[/<mask>] is bound to a zone
[Z]
--remove-source=<source>[/<mask>]
Remove binding of <source>[/<mask>] from a zone [Z]
Direct Options
--direct First option for all direct options
--get-all-chains
Get all chains
--get-chains {ipv4|ipv6|eb} <table>
Get all chains added to the table
--add-chain {ipv4|ipv6|eb} <table> <chain>
Add a new chain to the table
--remove-chain {ipv4|ipv6|eb} <table> <chain>
Remove the chain from the table
--query-chain {ipv4|ipv6|eb} <table> <chain>
Return whether the chain has been added to the table
--get-all-rules
Get all rules
--get-rules {ipv4|ipv6|eb} <table> <chain>
Get all rules added to chain in table
--add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Add rule to chain in table
--remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Remove rule with priority from chain in table
--remove-rules {ipv4|ipv6|eb} <table> <chain>
Remove rules from chain in table
--query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Return whether a rule with priority has been added to
chain in table
--get-all-passthroughs
Get all passthrough rules
--get-passthroughs {ipv4|ipv6|eb} <arg>...
Get passthrough rules
--add-passthrough {ipv4|ipv6|eb} <arg>...
Add a new passthrough rule
--remove-passthrough {ipv4|ipv6|eb} <arg>...
Remove a passthrough rule
--query-passthrough {ipv4|ipv6|eb} <arg>...
Return whether the passthrough rule has been added
Lockdown Options
--lockdown-on Enable lockdown.
--lockdown-off Disable lockdown.
--query-lockdown Query whether lockdown is enabled
Lockdown Whitelist Options
--list-lockdown-whitelist-commands
List all command lines that are on the whitelist
--add-lockdown-whitelist-command=<command>
Add the command to the whitelist
--remove-lockdown-whitelist-command=<command>
Remove the command from the whitelist
--query-lockdown-whitelist-command=<command>
Query whether the command is on the whitelist
--list-lockdown-whitelist-contexts
List all contexts that are on the whitelist
--add-lockdown-whitelist-context=<context>
Add the context context to the whitelist
--remove-lockdown-whitelist-context=<context>
Remove the context from the whitelist
--query-lockdown-whitelist-context=<context>
Query whether the context is on the whitelist
--list-lockdown-whitelist-uids
List all user ids that are on the whitelist
--add-lockdown-whitelist-uid=<uid>
Add the user id uid to the whitelist
--remove-lockdown-whitelist-uid=<uid>
Remove the user id uid from the whitelist
--query-lockdown-whitelist-uid=<uid>
Query whether the user id uid is on the whitelist
--list-lockdown-whitelist-users
List all user names that are on the whitelist
--add-lockdown-whitelist-user=<user>
Add the user name user to the whitelist
--remove-lockdown-whitelist-user=<user>
Remove the user name user from the whitelist
--query-lockdown-whitelist-user=<user>
Query whether the user name user is on the whitelist
""")
def __print(msg=None):
if msg:
print(msg)
def __print_and_exit(msg=None, exit_code=0):
FAIL = '\033[91m'
OK = '\033[92m'
END = '\033[00m'
if exit_code != 0:
__print(msg)
#__print(FAIL + msg + END)
else:
__print(msg)
#__print(OK + msg + END)
sys.exit(exit_code)
def __fail(msg=None):
__print_and_exit(msg, 2)
def __parse_port(value):
try:
(port, proto) = value.split("/")
except Exception as e:
__fail("bad port (most likely missing protocol), correct syntax is portid[-portid]/protocol")
return (port, proto)
def __parse_port_lokkit(value):
try:
(port, proto) = value.split(":")
except Exception as e:
__fail("bad port (most likely missing protocol), correct syntax is portid[-portid]:protocol")
return (port, proto)
def __parse_forward_port(value):
port = None
protocol = None
toport = None
toaddr = None
args = value.split(":")
for arg in args:
try:
(opt,val) = arg.split("=")
if opt == "port":
port = val
elif opt == "proto":
protocol = val
elif opt == "toport":
toport = val
elif opt == "toaddr":
toaddr = val
except:
__fail("invalid forward port arg '%s'" % (arg))
if not port:
__fail("missing port")
if not protocol:
__fail("missing protocol")
if not (toport or toaddr):
__fail("missing destination")
return (port, protocol, toport, toaddr)
def _check_ipv(value):
if value != "ipv4" and value != "ipv6" and value != "eb":
__fail("invalid argument: %s (choose from 'ipv4', 'ipv6', 'eb')" % value)
return value
def __print_all(zone, interfaces, sources, services, ports, masquerade, forward_ports, icmp_blocks, rules):
attributes = []
if zone == fw.get_default_zone():
attributes.append("default")
if attributes:
zone = zone + " (%s)" % ", ".join(attributes)
__print(zone)
__print(" interfaces: " + " ".join(interfaces))
__print(" sources: " + " ".join(sources))
__print(" services: " + " ".join(services))
__print(" ports: " + " ".join(["%s/%s" % (port[0], port[1]) for port in ports]))
__print(" masquerade: %s" % ("yes" if masquerade else "no"))
__print(" forward-ports: " + "\n\t".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % (port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in forward_ports]))
__print(" icmp-blocks: " + " ".join(icmp_blocks))
__print(" rich rules: \n\t" + "\n\t".join(rules))
def __list_all_permanent(fw_settings, zone):
interfaces = fw_settings.getInterfaces()
sources = fw_settings.getSources()
services = fw_settings.getServices()
ports = fw_settings.getPorts()
masquerade = fw_settings.getMasquerade()
forward_ports = fw_settings.getForwardPorts()
icmp_blocks = fw_settings.getIcmpBlocks()
rules = fw_settings.getRichRules()
__print_all(zone, interfaces, sources, services, ports, masquerade, forward_ports, icmp_blocks, rules)
def __print_query_result(value):
if value:
__print_and_exit("yes")
else:
__print_and_exit("no", 1)
# system-config-firewall: fw_sysconfig
CONFIG = '/etc/sysconfig/system-config-firewall'
def read_sysconfig_args():
filename = None
if os.path.exists(CONFIG) and os.path.isfile(CONFIG):
filename = CONFIG
try:
f = open(filename, 'r')
except:
return None
argv = [ ]
for line in f:
if not line:
break
line = line.strip()
if len(line) < 1 or line[0] == '#':
continue
argv.append(line)
f.close()
return argv
##############################################################################
parser = argparse.ArgumentParser(usage="see firewall-offline-cmd man page",
add_help=False)
parser_group_lokkit = parser.add_argument_group()
parser_group_lokkit.add_argument("--enabled", action="store_true")
parser_group_lokkit.add_argument("--disabled", action="store_true")
parser_group_lokkit.add_argument("--addmodule", metavar="<module>", action='append')
parser_group_lokkit.add_argument("--removemodule", metavar="<module>", action='append')
parser_group_lokkit.add_argument("--service", "-s", metavar="<service>", action='append')
parser_group_lokkit.add_argument("--remove-service", metavar="<service>", action='append')
parser_group_lokkit.add_argument("--port", "-p", metavar="<port>", action='append')
parser_group_lokkit.add_argument("--trust", "-t", metavar="<iface>", action='append')
parser_group_lokkit.add_argument("--masq", "-m", metavar="<iface>", action='append')
parser_group_lokkit.add_argument("--custom-rules", metavar="<filename>", action='append')
parser_group_lokkit.add_argument("--forward-port", metavar="<port>", action='append')
parser_group_lokkit.add_argument("--block-icmp", metavar="<icmptype>", action='append')
parser_group_standalone = parser.add_mutually_exclusive_group()
parser_group_standalone.add_argument("-h", "--help",
action="store_true")
parser_group_standalone.add_argument("-V", "--version", action="store_true")
parser_group_standalone.add_argument("--lockdown-on", action="store_true")
parser_group_standalone.add_argument("--lockdown-off", action="store_true")
parser_group_standalone.add_argument("--query-lockdown", action="store_true")
parser_group_standalone.add_argument("--get-default-zone", action="store_true")
parser_group_standalone.add_argument("--set-default-zone", metavar="<zone>")
parser_group_standalone.add_argument("--get-zones", action="store_true")
parser_group_standalone.add_argument("--get-services", action="store_true")
parser_group_standalone.add_argument("--get-icmptypes", action="store_true")
parser_group_standalone.add_argument("--get-zone-of-interface", metavar="<iface>")
parser_group_standalone.add_argument("--get-zone-of-source", metavar="<source>")
parser_group_standalone.add_argument("--list-all-zones", action="store_true")
parser_group_config = parser.add_mutually_exclusive_group()
parser_group_config.add_argument("--new-icmptype", metavar="<icmptype>")
parser_group_config.add_argument("--delete-icmptype", metavar="<icmptype>")
parser_group_config.add_argument("--new-service", metavar="<service>")
parser_group_config.add_argument("--delete-service", metavar="<service>")
parser_group_config.add_argument("--new-zone", metavar="<zone>")
parser_group_config.add_argument("--delete-zone", metavar="<zone>")
parser_group_lockdown_whitelist = parser.add_mutually_exclusive_group()
parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-commands", action="store_true")
parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-command", metavar="<command>")
parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-command", metavar="<command>")
parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-command", metavar="<command>")
parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-contexts", action="store_true")
parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-context", metavar="<context>")
parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-context", metavar="<context>")
parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-context", metavar="<context>")
parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-uids", action="store_true")
parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-uid", metavar="<uid>", type=int)
parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-uid", metavar="<uid>", type=int)
parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-uid", metavar="<uid>", type=int)
parser_group_lockdown_whitelist.add_argument("--list-lockdown-whitelist-users", action="store_true")
parser_group_lockdown_whitelist.add_argument("--add-lockdown-whitelist-user", metavar="<user>")
parser_group_lockdown_whitelist.add_argument("--remove-lockdown-whitelist-user", metavar="<user>")
parser_group_lockdown_whitelist.add_argument("--query-lockdown-whitelist-user", metavar="<user>")
parser.add_argument("--zone", default="", metavar="<zone>")
parser_group_zone = parser.add_mutually_exclusive_group()
parser_group_zone.add_argument("--add-interface", metavar="<iface>")
parser_group_zone.add_argument("--remove-interface", metavar="<iface>")
parser_group_zone.add_argument("--query-interface", metavar="<iface>")
parser_group_zone.add_argument("--change-interface", "--change-zone", metavar="<iface>")
parser_group_zone.add_argument("--list-interfaces", action="store_true")
parser_group_zone.add_argument("--add-source", metavar="<source>")
parser_group_zone.add_argument("--remove-source", metavar="<source>")
parser_group_zone.add_argument("--query-source", metavar="<source>")
parser_group_zone.add_argument("--change-source", metavar="<source>")
parser_group_zone.add_argument("--list-sources", action="store_true")
parser_group_zone.add_argument("--add-rich-rule", metavar="<rule>", action='append')
parser_group_zone.add_argument("--remove-rich-rule", metavar="<rule>", action='append')
parser_group_zone.add_argument("--query-rich-rule", metavar="<rule>")
parser_group_zone.add_argument("--add-service", metavar="<service>", action='append')
parser_group_zone.add_argument("--remove-service-from-zone", metavar="<zone>", action='append')
parser_group_zone.add_argument("--query-service", metavar="<zone>")
parser_group_zone.add_argument("--add-port", metavar="<port>", action='append')
parser_group_zone.add_argument("--remove-port", metavar="<port>", action='append')
parser_group_zone.add_argument("--query-port", metavar="<port>")
parser_group_zone.add_argument("--add-masquerade", action="store_true")
parser_group_zone.add_argument("--remove-masquerade", action="store_true")
parser_group_zone.add_argument("--query-masquerade", action="store_true")
parser_group_zone.add_argument("--add-icmp-block", metavar="<icmptype>", action='append')
parser_group_zone.add_argument("--remove-icmp-block", metavar="<icmptype>", action='append')
parser_group_zone.add_argument("--query-icmp-block", metavar="<icmptype>")
parser_group_zone.add_argument("--add-forward-port", metavar="<port>", action='append')
parser_group_zone.add_argument("--remove-forward-port", metavar="<port>", action='append')
parser_group_zone.add_argument("--query-forward-port", metavar="<port>")
parser_group_zone.add_argument("--list-rich-rules", action="store_true")
parser_group_zone.add_argument("--list-services", action="store_true")
parser_group_zone.add_argument("--list-ports", action="store_true")
parser_group_zone.add_argument("--list-icmp-blocks", action="store_true")
parser_group_zone.add_argument("--list-forward-ports", action="store_true")
parser_group_zone.add_argument("--list-all", action="store_true")
parser_group_zone.add_argument("--get-target", action="store_true")
parser_group_zone.add_argument("--set-target", metavar="<target>")
parser.add_argument("--direct", action="store_true")
parser_direct = parser.add_mutually_exclusive_group()
parser_direct.add_argument("--add-passthrough", nargs=argparse.REMAINDER,
metavar=("{ ipv4 | ipv6 | eb }", "<args>"))
parser_direct.add_argument("--remove-passthrough", nargs=argparse.REMAINDER,
metavar=("{ ipv4 | ipv6 | eb }", "<args>"))
parser_direct.add_argument("--query-passthrough", nargs=argparse.REMAINDER,
metavar=("{ ipv4 | ipv6 | eb }", "<args>"))
parser_direct.add_argument("--get-passthroughs", nargs=1,
metavar=("{ ipv4 | ipv6 | eb }"))
parser_direct.add_argument("--get-all-passthroughs", action="store_true")
parser_direct.add_argument("--add-chain", nargs=3,
metavar=("{ ipv4 | ipv6 | eb }", "<table>", "<chain>"))
parser_direct.add_argument("--remove-chain", nargs=3,
metavar=("{ ipv4 | ipv6 | eb }", "<table>", "<chain>"))
parser_direct.add_argument("--query-chain", nargs=3,
metavar=("{ ipv4 | ipv6 | eb }", "<table>", "<chain>"))
parser_direct.add_argument("--get-all-chains", action="store_true")
parser_direct.add_argument("--get-chains", nargs=2,
metavar=("{ ipv4 | ipv6 | eb }", "<table>"))
parser_direct.add_argument("--add-rule", nargs=argparse.REMAINDER,
metavar=("{ ipv4 | ipv6 | eb }", "<table> <chain> <priority> <args>"))
parser_direct.add_argument("--remove-rule", nargs=argparse.REMAINDER,
metavar=("{ ipv4 | ipv6 | eb }", "<table> <chain> <priority> <args>"))
parser_direct.add_argument("--remove-rules", nargs=3,
metavar=("{ ipv4 | ipv6 | eb }", "<table> <chain>"))
parser_direct.add_argument("--query-rule", nargs=argparse.REMAINDER,
metavar=("{ ipv4 | ipv6 | eb }", "<table> <chain> <priority> <args>"))
parser_direct.add_argument("--get-rules", nargs=3,
metavar=("{ ipv4 | ipv6 | eb }", "<table>", "<chain>"))
parser_direct.add_argument("--get-all-rules", action="store_true")
##############################################################################
if len(sys.argv) > 1:
i = -1
args = sys.argv[1:]
if '--add-passthrough' in args:
i = args.index('--add-passthrough') + 1
elif '--remove-passthrough' in args:
i = args.index('--remove-passthrough') + 1
elif '--query-passthrough' in args:
i = args.index('--query-passthrough') + 1
elif '--add-rule' in args:
i = args.index('--add-rule') + 4
elif '--remove-rule' in args:
i = args.index('--remove-rule') + 4
elif '--query-rule' in args:
i = args.index('--query-rule') + 4
# join <args> into one argument to prevent parser from parsing each iptables
# option, because they can conflict with firewall-cmd options
# # e.g. --delete (iptables) and --delete-* (firewall-cmd)
if (i > -1) and (i < len(args) - 1):
aux_args = args[:]
args = aux_args[:i+1] # all but not <args>
args.append(joinArgs(aux_args[i+1:])) # add <args> as one arg
a = parser.parse_args(args)
else:
# migrate configuration from /etc/sysconfig/system-config-firewall
args = read_sysconfig_args()
if args:
a = parser.parse_args(args)
else:
__fail("Opening of '%s' failed, exiting." % CONFIG)
options_lokkit = a.enabled or a.disabled or a.addmodule or a.removemodule or \
a.trust or a.masq or a.custom_rules or \
a.service or a.remove_service or a.port or \
a.trust or a.masq or a.forward_port or a.block_icmp
options_standalone = a.help or a.version or \
a.lockdown_on or a.lockdown_off or a.query_lockdown or \
a.get_default_zone or a.set_default_zone
options_lockdown_whitelist = \
a.list_lockdown_whitelist_commands or a.add_lockdown_whitelist_command or \
a.remove_lockdown_whitelist_command or \
a.query_lockdown_whitelist_command or \
a.list_lockdown_whitelist_contexts or a.add_lockdown_whitelist_context or \
a.remove_lockdown_whitelist_context or \
a.query_lockdown_whitelist_context or \
a.list_lockdown_whitelist_uids or a.add_lockdown_whitelist_uid != None or \
a.remove_lockdown_whitelist_uid != None or \
a.query_lockdown_whitelist_uid != None or \
a.list_lockdown_whitelist_users or a.add_lockdown_whitelist_user or \
a.remove_lockdown_whitelist_user or \
a.query_lockdown_whitelist_user
options_config = a.get_zones or a.get_services or a.get_icmptypes or \
options_lockdown_whitelist or a.list_all_zones or \
a.get_zone_of_interface or a.get_zone_of_source
options_zone_action_action = \
a.add_service or a.remove_service_from_zone or a.query_service or \
a.add_port or a.remove_port or a.query_port or \
a.add_icmp_block or a.remove_icmp_block or a.query_icmp_block or \
a.add_forward_port or a.remove_forward_port or a.query_forward_port
options_zone_interfaces_sources = \
a.list_interfaces or a.change_interface or \
a.add_interface or a.remove_interface or a.query_interface or \
a.list_sources or a.change_source or \
a.add_source or a.remove_source or a.query_source
options_zone_adapt_query = \
a.add_rich_rule or a.remove_rich_rule or a.query_rich_rule or \
a.add_masquerade or a.remove_masquerade or a.query_masquerade or \
a.list_services or a.list_ports or a.list_icmp_blocks or \
a.list_forward_ports or a.list_rich_rules or a.list_all or \
a.get_target or a.set_target
options_zone_ops = options_zone_interfaces_sources or \
options_zone_action_action or options_zone_adapt_query
options_zone = a.zone or options_zone_ops
options_permanent = options_config or options_zone or \
a.new_icmptype or a.delete_icmptype or \
a.new_service or a.delete_service or \
a.new_zone or a.delete_zone
options_direct = \
a.add_chain or a.remove_chain or a.query_chain or \
a.get_chains or a.get_all_chains or \
a.add_rule or a.remove_rule or a.remove_rules or a.query_rule or \
a.get_rules or a.get_all_rules or \
a.add_passthrough or a.remove_passthrough or a.query_passthrough or \
a.get_passthroughs or a.get_all_passthroughs
# these are supposed to only write out some output
options_list_get = a.help or a.version or a.list_all or a.list_all_zones or \
a.list_lockdown_whitelist_commands or a.list_lockdown_whitelist_contexts or \
a.list_lockdown_whitelist_uids or a.list_lockdown_whitelist_users or \
a.list_services or a.list_ports or a.list_icmp_blocks or a.list_forward_ports \
or a.list_rich_rules or a.list_interfaces or a.list_sources or \
a.get_default_zone or a.get_zone_of_interface or \
a.get_zone_of_source or a.get_zones or a.get_services or a.get_icmptypes or \
a.get_target or a.set_target
###############################################################################
# Check various impossible combinations of options
if not (options_lokkit or options_standalone or \
options_permanent or options_direct):
__fail(parser.format_usage() + "No option specified.")
if options_lokkit and (options_standalone or \
options_permanent or options_direct):
__fail(parser.format_usage() +
"Can't use lokkit options with other options.")
if options_standalone and (options_permanent or \
options_direct):
__fail(parser.format_usage() +
"Can't use stand-alone options with other options.")
if options_direct and options_zone:
__fail(parser.format_usage() +
"Can't use 'direct' options with other options.")
if (a.direct and not options_direct) or (options_direct and not a.direct):
__fail(parser.format_usage() +
"Wrong usage of 'direct' options.")
if options_config and options_zone:
__fail(parser.format_usage() +
"Wrong usage of --get-zones | --get-services | --get-icmptypes.")
if a.help:
__usage()
sys.exit(0)
zone = a.zone
fw = Firewall_test()
fw.start()
try:
if a.version:
__print_and_exit(VERSION)
# Lokkit Compatibility Options
if options_lokkit:
trusted_zone = "trusted"
default_zone = fw.get_default_zone()
fw_zone = fw.config.get_zone(default_zone)
fw_settings = FirewallClientZoneSettings(
list(fw.config.get_zone_config(fw_zone)))
if a.enabled:
# Enable firewall (default)
os.system("systemctl enable firewalld.service")
if a.disabled:
# Disable firewall
os.system("systemctl disable firewalld.service")
if a.addmodule:
for m in a.addmodule:
__print("Ignoring addmodule '%s'" % m)
if a.removemodule:
for m in a.removemodule:
__print("Ignoring removemodule '%s'" % m)
if a.custom_rules:
for c in a.custom_rules:
__print("Ignoring custom-rule '%s'" % c)
if a.service:
for s in a.service:
__print("Adding service '%s' to default zone." % s)
fw_settings.addService(s)
if a.remove_service:
for s in a.remove_service:
__print("Removing service '%s' from default zone." % s)
fw_settings.removeService(s)
if a.port:
for port_proto in a.port:
(port, proto) = __parse_port_lokkit(port_proto)
__print("Adding port '%s/%s' to default zone." % (port, proto))
fw_settings.addPort(port, proto)
if a.trust:
if default_zone != trusted_zone:
fw_trusted = fw.config.get_zone("trusted")
fw_trusted_settings = FirewallClientZoneSettings(
list(fw.config.get_zone_config(fw_trusted)))
# Bind an interface to the trusted zone
for i in a.trust:
__print("Interface '%s' will be bound to zone '%s'." % \
(i, trusted_zone))
fw_trusted_settings.addInterface(i)
fw.config.set_zone_config(fw_trusted, fw_trusted_settings.settings)
else:
for i in a.trust:
__print("Interface '%s' will be bound to zone '%s'." % \
(i, trusted_zone))
fw_settings.addInterface(i)
if a.masq:
# Enables masquerading in the default zone, interface argument is ignored
__print("Enabling masquerade for the default zone.")
fw_settings.setMasquerade(True)
if a.forward_port:
for fp in a.forward_port:
(port, protocol, toport, toaddr) = __parse_forward_port(fp)
__print("Adding forward port %s:%s:%s:%s to default zone." % \
(port, protocol, toport, toaddr))
fw_settings.addForwardPort(port, protocol, toport, toaddr)
if a.block_icmp:
for ib in a.block_icmp:
__print("Adding icmpblock '%s' to default zone." % ib)
fw_settings.addIcmpBlock(ib)
fw.config.set_zone_config(fw_zone, fw_settings.settings)
# options from firewall-cmd
elif a.get_default_zone:
__print_and_exit(fw.get_default_zone())
elif a.set_default_zone:
fw.set_default_zone(a.set_default_zone)
# lockdown
elif a.lockdown_on:
fw.enable_lockdown()
elif a.lockdown_off:
fw.disable_lockdown()
elif a.query_lockdown:
__print_query_result(fw.policies.query_lockdown())
# zones
elif a.get_zones:
zones = fw.config.get_zones()
__print_and_exit(" ".join(zones))
elif a.get_services:
services = fw.config.get_services()
__print_and_exit(" ".join(services))
elif a.get_icmptypes:
icmptypes = fw.config.get_icmptypes()
__print_and_exit(" ".join(icmptypes))
elif a.new_zone:
fw.config.new_zone(a.new_zone, FirewallClientZoneSettings().settings)
elif a.delete_zone:
obj = fw.config.get_zone(a.delete_zone)
fw.config.remove_zone(obj)
elif a.new_service:
fw.config.new_service(a.new_service,
FirewallClientServiceSettings().settings)
elif a.delete_service:
obj = fw.config.get_service(a.delete_service)
fw.config.remove_service(obj)
elif a.new_icmptype:
fw.config.new_icmptype(a.new_icmptype,
FirewallClientIcmpTypeSettings().settings)
elif a.delete_icmptype:
obj = fw.config.get_icmptype(a.delete_icmptype)
fw.config.remove_icmptype(obj)
# lockdown whitelist
elif options_lockdown_whitelist:
whitelist = fw.config.get_policies().lockdown_whitelist
# commands
if a.list_lockdown_whitelist_commands:
l = whitelist.get_commands()
__print_and_exit("\n".join(l))
elif a.add_lockdown_whitelist_command:
whitelist.add_command(a.add_lockdown_whitelist_command)
elif a.remove_lockdown_whitelist_command:
whitelist.remove_command(a.remove_lockdown_whitelist_command)
elif a.query_lockdown_whitelist_command:
__print_query_result(a.query_lockdown_whitelist_command in
whitelist.get_commands())
# contexts
elif a.list_lockdown_whitelist_contexts:
l = whitelist.get_contexts()
__print_and_exit("\n".join(l))
elif a.add_lockdown_whitelist_context:
whitelist.add_context(a.add_lockdown_whitelist_context)
elif a.remove_lockdown_whitelist_context:
whitelist.remove_context(a.remove_lockdown_whitelist_context)
elif a.query_lockdown_whitelist_context:
__print_query_result(a.query_lockdown_whitelist_context in
whitelist.get_contexts())
# uids
elif a.list_lockdown_whitelist_uids:
l = whitelist.get_uids()
__print_and_exit(" ".join(map(str, l)))
elif a.add_lockdown_whitelist_uid != None:
whitelist.add_uid(a.add_lockdown_whitelist_uid)
elif a.remove_lockdown_whitelist_uid != None:
whitelist.remove_uid(a.remove_lockdown_whitelist_uid)
elif a.query_lockdown_whitelist_uid != None:
__print_query_result(a.query_lockdown_whitelist_uid in
whitelist.get_uids())
# users
elif a.list_lockdown_whitelist_users:
l = whitelist.get_users()
__print_and_exit("\n".join(l))
elif a.add_lockdown_whitelist_user:
whitelist.add_user(a.add_lockdown_whitelist_user)
elif a.remove_lockdown_whitelist_user:
whitelist.remove_user(a.remove_lockdown_whitelist_user)
elif a.query_lockdown_whitelist_user:
__print_query_result(a.query_lockdown_whitelist_user in
whitelist.get_users())
# apply whitelist changes
whitelist.write()
elif options_direct:
settings = fw.config.get_direct()
if a.add_passthrough:
if len (a.add_passthrough) < 2:
__fail("usage: --direct --add-passthrough { ipv4 | ipv6 | eb } <args>")
__print(settings.add_passthrough(_check_ipv(a.add_passthrough[0]),
splitArgs(a.add_passthrough[1])))
elif a.remove_passthrough:
if len (a.remove_passthrough) < 2:
__fail("usage: --direct --remove-passthrough { ipv4 | ipv6 | eb } <args>")
settings.remove_passthrough(_check_ipv(a.remove_passthrough[0]),
splitArgs(a.remove_passthrough[1]))
elif a.query_passthrough:
if len (a.query_passthrough) < 2:
__fail("usage: --direct --query-passthrough { ipv4 | ipv6 | eb } <args>")
__print_query_result(
settings.query_passthrough(_check_ipv(a.query_passthrough[0]),
splitArgs(a.query_passthrough[1])))
sys.exit(0)
elif a.get_passthroughs:
rules = settings.get_passthroughs(_check_ipv(a.get_passthroughs[0]))
for rule in rules:
__print(joinArgs(rule))
sys.exit(0)
elif a.get_all_passthroughs:
pt = settings.get_all_passthroughs()
for ipv in pt:
for rule in pt[ipv]:
__print("%s %s" % (ipv, joinArgs(rule)))
sys.exit(0)
elif a.add_chain:
settings.add_chain(_check_ipv(a.add_chain[0]),
a.add_chain[1], a.add_chain[2])
elif a.remove_chain:
settings.remove_chain(_check_ipv(a.remove_chain[0]),
a.remove_chain[1], a.remove_chain[2])
elif a.query_chain:
__print_query_result(
settings.query_chain(_check_ipv(a.query_chain[0]),
a.query_chain[1], a.query_chain[2]))
sys.exit(0)
elif a.get_chains:
__print_and_exit(
" ".join(settings.get_chains(_check_ipv(a.get_chains[0]),
a.get_chains[1])))
sys.exit(0)
elif a.get_all_chains:
chains = settings.get_all_chains()
for (ipv, table) in chains:
for chain in chains[(ipv,table)]:
__print("%s %s %s" % (ipv, table, chain))
sys.exit(0)
elif a.add_rule:
if len (a.add_rule) < 5:
__fail("usage: --direct --add-rule { ipv4 | ipv6 | eb } <table> <chain> <priority> <args>")
try:
priority = int(a.add_rule[3])
except ValueError:
__fail("wrong priority\nusage: --direct --add-rule { ipv4 | ipv6 | eb } <table> <chain> <priority> <args>")
settings.add_rule(_check_ipv(a.add_rule[0]), a.add_rule[1],
a.add_rule[2], priority, splitArgs(a.add_rule[4]))
elif a.remove_rule:
if len (a.remove_rule) < 5:
__fail("usage: --direct --remove-rule { ipv4 | ipv6 | eb } <table> <chain> <priority> <args>")
try:
priority = int(a.remove_rule[3])
except ValueError:
__fail("usage: --direct --remove-rule { ipv4 | ipv6 | eb } <table> <chain> <priority> <args>")
settings.remove_rule(_check_ipv(a.remove_rule[0]), a.remove_rule[1],
a.remove_rule[2], priority, splitArgs(a.remove_rule[4]))
elif a.remove_rules:
if len (a.remove_rules) < 3:
__fail("usage: --direct --remove-rules { ipv4 | ipv6 | eb } <table> <chain>")
settings.remove_rules(_check_ipv(a.remove_rules[0]),
a.remove_rules[1], a.remove_rules[2])
elif a.query_rule:
if len (a.query_rule) < 5:
__fail("usage: --direct --query-rule { ipv4 | ipv6 | eb } <table> <chain> <priority> <args>")
try:
priority = int(a.query_rule[3])
except ValueError:
__fail("usage: --direct --query-rule { ipv4 | ipv6 | eb } <table> <chain> <priority> <args>")
__print_query_result(
settings.query_rule(_check_ipv(a.query_rule[0]),
a.query_rule[1], a.query_rule[2],
priority, splitArgs(a.query_rule[4])))
sys.exit(0)
elif a.get_rules:
rules = settings.get_rules(_check_ipv(a.get_rules[0]),
a.get_rules[1], a.get_rules[2])
for (priority, rule) in rules:
__print("%d %s" % (priority, joinArgs(rule)))
sys.exit(0)
elif a.get_all_rules:
rules = settings.get_all_rules()
for (ipv, table, chain) in rules:
for (priority, rule) in rules[(ipv, table, chain)]:
__print("%s %s %s %d %s" % (ipv, table, chain, priority,
joinArgs(rule)))
sys.exit(0)
settings.write()
else:
if zone == "":
zone = fw.get_default_zone()
fw_zone = fw.config.get_zone(zone)
fw_settings = FirewallClientZoneSettings(
list(fw.config.get_zone_config(fw_zone))) # convert to list, for setMasquerade
# interface
if a.list_interfaces:
l = fw_settings.getInterfaces()
__print_and_exit(" ".join(l))
elif a.get_zone_of_interface:
ret = []
for zone in fw.config.get_zones():
obj = fw.config.get_zone(zone)
if a.get_zone_of_interface in obj.interfaces:
ret.append(obj.name)
if len(ret) > 1:
# Even it shouldn't happen, it's actually possible that
# the same interface is in several zone XML files
__print_and_exit(" ".join(ret) + " (ERROR: interface '%s' is in %s zone XML files, can be only in one)" % (a.get_zone_of_interface, len(ret)))
if len(ret) == 1:
__print_and_exit(ret[0])
else:
__print_and_exit("no zone", 2)
elif a.change_interface:
ret = []
for old_zone in fw.config.get_zones():
old_zone_obj = fw.config.get_zone(old_zone)
if a.change_interface in old_zone_obj.interfaces:
if old_zone_obj.name != zone:
old_zone_settings = FirewallClientZoneSettings(
fw.config.get_zone_config(old_zone_obj))
old_zone_settings.removeInterface(a.change_interface) # remove from old
fw.config.set_zone_config(old_zone_obj, old_zone_settings.settings)
fw_settings.addInterface(a.change_interface) # add to new
elif a.add_interface:
fw_settings.addInterface(a.add_interface)
elif a.remove_interface:
fw_settings.removeInterface(a.remove_interface)
elif a.query_interface:
__print_query_result(fw_settings.queryInterface(a.query_interface))
# source
if a.list_sources:
sources = fw_settings.getSources()
__print_and_exit(" ".join(sources))
elif a.get_zone_of_source:
ret = []
for zone in fw.config.get_zones():
obj = fw.config.get_zone(zone)
if a.get_zone_of_source in obj.sources:
ret.append(obj.name)
if len(ret) > 1:
# Even it shouldn't happen, it's actually possible that
# the same source is in several zone XML files
__print_and_exit(" ".join(ret) + " (ERROR: source '%s' is in %s zone XML files, can be only in one)" % (a.get_zone_of_source, len(ret)))
if len(ret) == 1:
__print_and_exit(ret[0])
else:
__print_and_exit("no zone", 2)
elif a.change_source:
ret = []
for old_zone in fw.config.get_zones():
old_zone_obj = fw.config.get_zone(old_zone)
if a.change_source in old_zone_obj.sources:
if old_zone_obj.name != zone:
old_zone_settings = FirewallClientZoneSettings(
fw.config.get_zone_config(old_zone_obj))
old_zone_settings.removeSource(a.change_source) # remove from old
fw.config.set_zone_config(old_zone_obj, old_zone_settings.settings)
fw_settings.addSource(a.change_source) # add to new
elif a.add_source:
fw_settings.addSource(a.add_source)
elif a.remove_source:
fw_settings.removeSource(a.remove_source)
elif a.query_source:
__print_query_result(fw_settings.querySource(a.query_source))
# rich rules
if a.list_rich_rules:
l = fw_settings.getRichRules()
__print_and_exit("\n".join(l))
elif a.add_rich_rule:
for s in a.add_rich_rule:
fw_settings.addRichRule(s)
elif a.remove_rich_rule:
for s in a.remove_rich_rule:
fw_settings.removeRichRule(s)
elif a.query_rich_rule:
__print_query_result(fw_settings.queryRichRule(a.query_rich_rule))
# service
if a.list_services:
l = fw_settings.getServices()
__print_and_exit(" ".join(l))
elif a.add_service:
for s in a.add_service:
fw_settings.addService(s)
elif a.remove_service_from_zone:
for s in a.remove_service_from_zone:
fw_settings.removeService(s)
elif a.query_service:
__print_query_result(fw_settings.queryService(a.query_service))
# port
elif a.list_ports:
l = fw_settings.getPorts()
__print_and_exit(" ".join(["%s/%s" % (port[0], port[1]) for port in l]))
elif a.add_port:
for port_proto in a.add_port:
(port, proto) = __parse_port(port_proto)
fw_settings.addPort(port, proto)
elif a.remove_port:
for port_proto in a.remove_port:
(port, proto) = __parse_port(port_proto)
fw_settings.removePort(port, proto)
elif a.query_port:
(port, proto) = __parse_port(a.query_port)
__print_query_result(fw_settings.queryPort(port, proto))
# masquerade
elif a.add_masquerade:
fw_settings.setMasquerade(True)
elif a.remove_masquerade:
fw_settings.setMasquerade(False)
elif a.query_masquerade:
__print_query_result(fw_settings.getMasquerade())
# forward port
elif a.list_forward_ports:
l = fw_settings.getForwardPorts()
__print_and_exit("\n".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % (port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l]))
elif a.add_forward_port:
for fp in a.add_forward_port:
(port, protocol, toport, toaddr) = __parse_forward_port(fp)
fw_settings.addForwardPort(port, protocol, toport, toaddr)
elif a.remove_forward_port:
for fp in a.remove_forward_port:
(port, protocol, toport, toaddr) = __parse_forward_port(fp)
fw_settings.removeForwardPort(port, protocol, toport, toaddr)
elif a.query_forward_port:
(port, protocol, toport, toaddr) = __parse_forward_port(a.query_forward_port)
__print_query_result(fw_settings.queryForwardPort(port, protocol, toport, toaddr))
# block icmp
elif a.list_icmp_blocks:
l = fw_settings.getIcmpBlocks()
__print_and_exit(" ".join(l))
elif a.add_icmp_block:
for ib in a.add_icmp_block:
fw_settings.addIcmpBlock(ib)
elif a.remove_icmp_block:
for ib in a.remove_icmp_block:
fw_settings.removeIcmpBlock(ib)
elif a.query_icmp_block:
__print_query_result(fw_settings.queryIcmpBlock(a.query_icmp_block))
# zone target
elif a.get_target:
__print_and_exit(fw_settings.getTarget())
elif a.set_target:
fw_settings.setTarget(a.set_target)
# list all zone settings
elif a.list_all:
__list_all_permanent(fw_settings, zone if zone else fw.get_default_zone())
sys.exit(0)
# list everything
elif a.list_all_zones:
zones = fw.config.get_zones()
for zone in zones:
fw_zone = fw.config.get_zone(zone)
fw_settings = FirewallClientZoneSettings(list(fw.config.get_zone_config(fw_zone)))
__list_all_permanent(fw_settings, zone)
__print("")
sys.exit(0)
fw.config.set_zone_config(fw_zone, fw_settings.settings)
except Exception as msg:
__fail("%s" % msg)
else:
__print_and_exit("success")