
    b%                     ~    d dl Z d dlmZmZ d dlmZ d dlmZ d dlZd dl	m
Z
 d dlmZ d Zd Z G d	 d
e
          ZdS )    N)PopenPIPE)blake2b)which)
gp_pol_ext)logc                      t          d          }|a|g}|                    t          |                      t          |t          t                    }|                                \  }}|j        |fS dS )Nzfirewall-cmd)stdoutstderr)zfirewall-cmd not found)r   extendlistr   r   communicate
returncode)argsfw_cmdcmdp
stdoutdata_s         ;/usr/lib/python3/dist-packages/samba/gp/gp_firewalld_ext.pyfirewall_cmdr      sl    >""Fh

4::#d4000
A|Z''++    c                     t          |t                    r
| d|dz   S | dd                    d |                                D                       dS )N= c                 "    g | ]\  }}|d |S )r    ).0kvs      r   
<listcomp>z&rule_segment_parse.<locals>.<listcomp>*   s'    HHH41aAA&HHHr   )
isinstancestrjoinitems)namerule_segments     r   rule_segment_parser)   %   sn    ,$$ K44.#5544HHHH<3E3E3G3GHHHIIIIK 	Kr   c                   ,    e Zd Zd Zd Zd Zd Zd ZdS )gp_firewalld_extc                     dS )NzSecurity/Firewalldr   )selfs    r   __str__zgp_firewalld_ext.__str__-   s    ##r   c                    t          dd|z            d         }|dk    rt          j        d|           n,| j                            t          |           d|z  |           t          d          \  }}|dk    rt          j        d|           |                                                                D ]F}t          dd|z  d	|                                z            }|dk    rt          j        d|           Gd S )
N--permanentz--new-zone=%sr   zFailed to add new zonezzone:%sz--list-interfacesz!Failed to set interfaces for zone	--zone=%sz--add-interface=%s)	r   r   errorgp_dbstorer$   stripsplitdecode)r-   zoneretout	interfaces        r   
apply_zonezgp_firewalld_ext.apply_zone0   s	   =/D*@AA!D!88I.5555JSYY	D(8$??? 344S!88I94@@@**,, 	E 	EI}kD.@3i6F6F6H6HHJ JCaxx	=tDDD		E 	Er   c           
         |                                 D ]\  }}|D ]}d|v rt          d|d                   }nd}dD ]@fd|                                D             }|D ]}|t          |||                   z  }At          g d          }t          |                                          }	|                    |	          }
t          |
          dk    r@|t          t          |
          d         |t          |
          d                            z  }nt          j        d           t          d	d
|z  d|
                                          d         }|dk    rt          j        d|           [t          |                                                                          }| j                            t!          |           d|d||           d S )Nrulezrule )sourcedestinationserviceportprotocolz
icmp-block
masqueradez	icmp-typezforward-portzsource-portr   auditc                 >    g | ]}|                               |S r   )
startswith)r   ssegments     r   r"   z0gp_firewalld_ext.apply_rules.<locals>.<listcomp>K   s*    MMM1q||G7L7LMQMMMr   )acceptrejectdropmark   r   zInvalid firewall rule syntaxr0   r1   z--add-rich-rulezFailed to add firewall rulezrule::)r&   r)   keyssetintersectionlenr   r   r2   r   r5   r   encode	hexdigestr3   r4   r$   )r-   	rule_dictr8   rulesr>   rule_parsednamesr'   actionssegmentsactionr9   rhashrI   s                @r   apply_ruleszgp_firewalld_ext.apply_rules@   s   $??,, 	2 	2KD% 2 2T>>"4VT&\"J"JKK")K 0 L LG NMMM		MMME % L L#'9$T
'K'KKLBBBCCtyy{{++ --h77v;;!###5d6ll1o6:4<<?6K$M $M MKK I<==="=+2D#4k6G6G6I6IK KKLN!88I;[IIII#K$6$6$8$899CCEEEJ$$SYYYee0L%02 2 2 252	2 	2r   c                 h   |D ]z\  }}| j                             |           t          |           |v r/|t          |                                                    D ]\  }}|                    d          r^t          dd|z            d         }|dk    rt          j        d|           P| j                             t          |           |           y|                    d          rx|	                    d          \  }}	}t          dd|	z  d	|          d         }|dk    rt          j        d
|           | j                             t          |           |           | j         
                                 ||D ]/}
|
j        r$d}| j                             |
j                   d}t          j                            |
j        |          }|                     |          }|sk|j        D ]}|j                            |          r|j                            d          r-|                     t+          j        |j                             c|j                            d          r&|j        dk    r|                     |j                   | j         
                                 1d S )Nr8   r0   z--delete-zone=%sr   zFailed to remove zoner>   rO   r1   z--remove-rich-rulezFailed to remove firewall rule/Software\Policies\Samba\Unix Settings\FirewalldMACHINE/Registry.polRulesZonesz
**delvals.)r3   set_guidr$   r&   rG   r   r   r2   deleter6   commitfile_sys_pathr'   ospathr%   parseentrieskeynameendswithr^   jsonloadsdata	valuenamer<   )r-   deleted_gpo_listchanged_gpo_listguidsettings	attributevaluer9   r   r8   gposectionpol_fileri   pol_confes                   r   process_group_policyz%gp_firewalld_ext.process_group_policy_   s   . 	  	 ND(J%%%4yyH$$(0T(;(A(A(C(C D D$Iu ++F33 D*=+=+EG GGHJ!88I&=uEEEE J--c$iiCCCC"--f55 D%.__S%9%9
4*=+:L+?H HHIK!88I&FNNNN J--c$iiCCCJ# 	$ 	$C  $O
##CH---1w||C$5x@@::d++ !) 4 4Ay++G44 49--g66 4 ,,TZ-?-?@@@@Y//88 4 {l:: ( OOAF333
!!####	$ 	$r   c                 `   i }d}d}|j         rt          j                            |j         |          }|                     |          }|s|S |j        D ]}|j                            |          r|j                            d          r<d|	                                vrg |d<   |d         
                    |j                   r|j                            d          rMd|	                                vrg |d<   |d         
                    t          j        |j                             |S )Nra   r`   Zonerc   rb   )rg   rh   ri   r%   rj   rk   rl   rG   rm   rP   appendrp   rn   ro   )r-   rx   outputrz   ry   ri   r{   r|   s           r   rsopzgp_firewalld_ext.rsop   s1   )G 	C7<< 18<<Dzz$''H % 	C 	C9''00 Cy))&11 C"&++--77.0F7Ow..qv6666++G44 C"&++--77.0F7Ow..tz!&/A/ABBBr   N)__name__
__module____qualname__r.   r<   r^   r}   r   r   r   r   r+   r+   ,   sc        $ $ $E E E 2 2 2>'$ '$ '$R    r   r+   )rh   
subprocessr   r   hashlibr   shutilr   rn   samba.gp.gpclassr   samba.gp.util.loggingr   r   r)   r+   r   r   r   <module>r      s   " 
			 " " " " " " " "              ' ' ' ' ' ' % % % % % %
, 
, 
,K K Ko o o o oz o o o o or   