
    Id                     v    d dl Z d dlmZmZ d dlmZ d dlmZ d dlZd dl	m
Z
 d dlmZ d Zd Z G d	 d
e
      Zy)    N)PopenPIPE)blake2b)which)
gp_pol_ext)logc                      t        d      }|T|g}|j                  t        |              t        |t        t              }|j                         \  }}|j                  |fS y)Nzfirewall-cmd)stdoutstderr)zfirewall-cmd not found)r   extendlistr   r   communicate
returncode)argsfw_cmdcmdp
stdoutdata_s         ;/usr/lib/python3/dist-packages/samba/gp/gp_firewalld_ext.pyfirewall_cmdr      sX    >"Fh

4:#d40
A||Z''+    c                     t        |t              r
| d|dz   S | ddj                  |j                         D cg c]  \  }}|d| c}}      dS c c}}w )N= )
isinstancestrjoinitems)namerule_segmentkvs       r   rule_segment_parser%   %   sW    ,$.#55HH<3E3E3GH41aA&HIK 	KHs   Ac                   *    e Zd Zd Zd Zd Zd Zd Zy)gp_firewalld_extc                      y)NzSecurity/Firewalld )selfs    r   __str__zgp_firewalld_ext.__str__-   s    #r   c                    t        dd|z        d   }|dk7  rt        j                  d|       n)| j                  j	                  t        |       d|z  |       t        d      \  }}|dk7  rt        j                  d|       |j                         j                         D ]?  }t        dd|z  d	|j                         z        }|dk7  s*t        j                  d|       A y )
N--permanentz--new-zone=%sr   zFailed to add new zonezzone:%sz--list-interfacesz!Failed to set interfaces for zone	--zone=%sz--add-interface=%s)	r   r   errorgp_dbstorer   stripsplitdecode)r*   zoneretout	interfaces        r   
apply_zonezgp_firewalld_ext.apply_zone0   s    =/D*@A!D!8II.5JJSY	D(8$? 34S!8II94@**, 	EI}kD.@3i6F6F6HHJCax		=tD		Er   c           
      L   |j                         D ]  \  }}|D ]  }d|v rt        d|d         }nd}dD ]J  }|j                         D cg c]  }|j                  |      s| }}|D ]  }	|t        |	||	         z  } L t	        g d      }
t	        |j                               }|
j                  |      }t        |      dk(  r+|t        t        |      d   |t        |      d            z  }nt        j                  d       t        dd	|z  d
|j                               d   }|dk7  rt        j                  d|       -t        |j                               j                         }| j                  j!                  t#        |       d|d||         y c c}w )Nrulezrule )sourcedestinationserviceportprotocolz
icmp-block
masqueradez	icmp-typezforward-portzsource-portr   audit)acceptrejectdropmark   r   zInvalid firewall rule syntaxr-   r.   z--add-rich-rulezFailed to add firewall rulezrule::)r    r%   keys
startswithsetintersectionlenr   r   r/   r   r2   r   encode	hexdigestr0   r1   r   )r*   	rule_dictr5   rulesr;   rule_parsedsegmentsnamesr!   actionssegmentsactionr6   rhashs                  r   apply_ruleszgp_firewalld_ext.apply_rules@   s   $??, 	2KD% 2T>"4VT&\"JK")K 0 LG )-		M1q||G7LQMEM % L#'9$T
'KKLL BCtyy{+ --h7v;!##5d6l1o6:4<?6K$M MK II<="=+2D#4k6G6G6IKKLN!8II;[I#K$6$6$89CCEEJJ$$SYe0L%0252	2 Ns   F!
"F!
c                 V   |D ]N  \  }}| j                   j                  |       t        |       |v r|t        |          j                         D ]  \  }}|j	                  d      rTt        dd|z        d   }|dk7  rt        j                  d|       E| j                   j                  t        |       |       k|j	                  d      s}|j                  d      \  }}	}t        dd|	z  d	|      d   }|dk7  rt        j                  d
|       | j                   j                  t        |       |        | j                   j                          Q |D ]O  }
|
j                  sd}| j                   j                  |
j                         d}t        j                  j                  |
j                  |      }| j!                  |      }|sx|j"                  D ]  }|j$                  j	                  |      s|j$                  j'                  d      r/| j)                  t+        j,                  |j.                               i|j$                  j'                  d      s|j0                  dk(  r| j3                  |j.                          | j                   j                          R y )Nr5   r-   z--delete-zone=%sr   zFailed to remove zoner;   rH   r.   z--remove-rich-rulezFailed to remove firewall rule/Software\Policies\Samba\Unix Settings\FirewalldMACHINE/Registry.polRulesZones
**delvals.)r0   set_guidr   r    rJ   r   r   r/   deleter3   commitfile_sys_pathr!   ospathr   parseentrieskeynameendswithrZ   jsonloadsdata	valuenamer9   )r*   deleted_gpo_listchanged_gpo_listguidsettings	attributevaluer6   r   r5   gposectionpol_filerf   pol_confes                   r   process_group_policyz%gp_firewalld_ext.process_group_policy_   s8   . 	 ND(JJ%4yH$(0T(;(A(A(C D$Iu ++F3*=+=+EGGHJ!8II&=uE JJ--c$iC"--f5%.__S%9
4*=+:L+?HHIK!8II&FN JJ--c$iCD  JJ'	 * $ 	$C  O

##CHH-1ww||C$5$5x@::d+!)) 4Ayy++G499--g6 ,,TZZ-?@YY//8 {{l: ( OOAFF34 

!!##	$r   c                    i }d}d}|j                   r1t        j                  j                  |j                   |      }| j	                  |      }|s|S |j
                  D ]  }|j                  j                  |      s|j                  j                  d      rF|j                  dk(  rJd|j                         vrg |d<   |d   j                  |j                         |j                  j                  d      sd|j                         vrg |d<   |d   j                  t        j                  |j                                |S )Nr]   r\   r_   r`   r^   )rd   re   rf   r   rg   rh   ri   rJ   rj   rn   rI   appendrm   rk   rl   )r*   ru   outputrw   rv   rf   rx   ry   s           r   rsopzgp_firewalld_ext.rsop   s   )G77<< 1 18<Dzz$'H%% C99''0yy))'2;;,6$"&++-7.0F7Ow..qvv6++G4"&++-7.0F7Ow..tzz!&&/ABC r   N)__name__
__module____qualname__r+   r9   rZ   rz   r~   r)   r   r   r'   r'   ,   s    $E 2>'$Rr   r'   )re   
subprocessr   r   hashlibr   shutilr   rk   samba.gp.gpclassr   samba.gp.util.loggingr   r   r%   r'   r)   r   r   <module>r      s5   " 
 "    ' %
,Kqz qr   