
    g$                     p    S SK r S SKJrJr  S SKJr  S SKrS SKJrJ	r	  S SK
Jr  S rS r " S S	\\	5      rg)
    N)PopenPIPE)which)
gp_pol_ext
gp_applier)logc                      [        S5      nUbP  U/nUR                  [        U 5      5        [        U[        [        S9nUR                  5       u  pEUR                  U4$ g)Nzfirewall-cmd)stdoutstderr)zfirewall-cmd not found)r   extendlistr   r   communicate
returncode)argsfw_cmdcmdp
stdoutdata_s         ;/usr/lib/python3/dist-packages/samba/gp/gp_firewalld_ext.pyfirewall_cmdr      sV    >"Fh

4:#d40
||Z''+    c                     [        U[        5      (       a  U < SU< 3S-   $ U < SSR                  UR                  5        VVs/ s H  u  p#U< SU< 3PM     snn5      < S3$ s  snnf )N= )
isinstancestrjoinitems)namerule_segmentkvs       r   rule_segment_parser%   $   s^    ,$$.#55HH<3E3E3GH3G41A&3GHIK 	KHs   A%c                   >    \ rS rSrS rS rS rS rS rS r	S r
S	rg
)gp_firewalld_ext+   c                     g)NzSecurity/Firewalld )selfs    r   __str__gp_firewalld_ext.__str__,   s    #r   c                    / n[        SSU-  5      S   nUS:w  a  [        R                  " SU5        O(SU-  nU R                  XU5        UR	                  U5        [        S5      u  pFUS:w  a  [        R                  " SU5        UR                  5       R                  5        HC  n[        SSU-  S	UR                  5       -  5      nUS:w  d  M,  [        R                  " SU5        ME     U$ )
N--permanentz--new-zone=%sr   zFailed to add new zonezzone:%sz--list-interfacesz!Failed to set interfaces for zone	--zone=%sz--add-interface=%s)r   r   errorcache_add_attributeappendstripsplitdecode)r+   guidzone
zone_attrsret	attributeout	interfaces           r   
apply_zonegp_firewalld_ext.apply_zone/   s    
=/D*@A!D!8II.5!D(I$$Td;i( 34!8II94@**,I}kD.@3i6F6F6HHJCax		=tD	 -
 r   c           
      T   / nUR                  5        GH  u  pEU GH~  nSU;   a  [        SUS   5      nOSnS HT  nUR                  5        V	s/ s H  oR                  U5      (       d  M  U	PM     n
n	U
 H  nU[        XU   5      -  nM     MV     [	        / SQ5      n[	        UR                  5       5      nUR                  U5      n[        U5      S:X  a+  U[        [        U5      S   U[        U5      S      5      -  nO[        R                  " S5        [        SS	U-  S
UR                  5       5      S   nUS:w  a  [        R                  " SU5        GM?  U R                  U5      nSU< SU< 3nU R                  UUU5        UR                  U5        GM     GM     U$ s  sn	f )Nrulezrule )sourcedestinationserviceportprotocolz
icmp-block
masqueradez	icmp-typezforward-portzsource-portr   audit)acceptrejectdropmark   r   zInvalid firewall rule syntaxr/   r0   z--add-rich-rulezFailed to add firewall rulezrule::)r    r%   keys
startswithsetintersectionlenr   r   r1   r   r4   generate_value_hashr2   r3   )r+   r7   	rule_dict
rule_attrsr8   rulesrA   rule_parsedsegmentsnamesr!   actionssegmentsactionr:   rhashr;   s                     r   apply_rulesgp_firewalld_ext.apply_rulesC   s   
$??,KDT>"4VT&\"JK")K 0G )-		M1||G7LQEM %#'9$T
'KK !& 0 BCtyy{+ --h7v;!##5d6l1o6:4<?6K$M MK II<="=+2D#4k6G6G6IKKLN!8II;[I 44[AE04e <I,,T9kJ%%i09  -< ) Ns   F%
+F%
c                    UR                  S5      (       aB  [        SSU-  5      S   nUS:w  a  [        R                  " SU5        g U R	                  X5        g UR                  S5      (       aX  UR                  S5      u  pVn[        SSU-  S	U5      S   nUS:w  a  [        R                  " S
U5        g U R	                  X5        g g )Nr8   r/   z--delete-zone=%sr   zFailed to remove zonerA   rN   r0   z--remove-rich-rulezFailed to remove firewall rule)rP   r   r   r1   cache_remove_attributer5   )r+   r7   r;   valuer:   r   r8   s          r   unapplygp_firewalld_ext.unapplye   s    ''}1E9;;<>Cax		159++D<!!&))"-JAQ}kD.@3U<<=?Cax		:EB++D< *r   c                     U" U6 $ )Nr*   )r+   applier_funcr   s      r   applygp_firewalld_ext.applyv   s    T""r   c                    U HM  u  p4[        U 5      U;   d  M  U[        U 5         R                  5        H  u  pVU R                  X5U5        M     MO     U GH  nUR                  (       d  M  SnSn	[        R
                  R                  UR                  U	5      n
U R                  U
5      nU(       d  M_  / nUR                   GH  nUR                  R                  U5      (       d  M&  UR                  R                  S5      (       aV  UR                  U R                  U R                  UR                  [         R"                  " UR$                  5      5      5        M  UR                  R                  S5      (       d  M  UR&                  S:X  a  M  UR                  U R                  U R(                  UR                  UR$                  5      5        GM     U R+                  UR                  US9  GM     g )N/Software\Policies\Samba\Unix Settings\FirewalldMACHINE/Registry.polRulesZones
**delvals.)keep)r   r    re   file_sys_pathospathr   parseentrieskeynamerP   endswithr   ri   r`   r!   jsonloadsdata	valuenamer>   clean)r+   deleted_gpo_listchanged_gpo_listr7   settingsr;   rd   gposectionpol_filert   pol_confattrses                 r   process_group_policy%gp_firewalld_ext.process_group_policyy   sr   .ND4yH$(0T(;(A(A(C$ILL%8 )D /
 $C   O1ww||C$5$5x@::d+!))Ayy++G4499--g66!LLD4D4Dchh48JJqvv4F*H IYY//88 {{l: (!LLDOOSXX45FF*< = * 

388%
0+ $r   c                    0 nSnSnUR                   (       GaQ  [        R                  R                  UR                   U5      nU R	                  U5      nU(       d  U$ UR
                   H  nUR                  R                  U5      (       d  M%  UR                  R                  S5      (       aK  UR                  S:X  a  MW  SUR                  5       ;  a  / US'   US   R                  UR                  5        M  UR                  R                  S5      (       d  M  SUR                  5       ;  a  / US'   US   R                  [        R                  " UR                  5      5        M     U$ )Nrm   rl   ro   rp   rn   )rr   rs   rt   r   ru   rv   rw   rP   rx   r|   rO   r3   r{   ry   rz   )r+   r   outputr   r   rt   r   r   s           r   rsopgp_firewalld_ext.rsop   s   )G77<< 1 18<Dzz$'H%%99''00yy))'22;;,6$"&++-7.0F7Ow..qvv6++G44"&++-7.0F7Ow..tzz!&&/AB & r   r*   N)__name__
__module____qualname____firstlineno__r,   r>   r`   re   ri   r   r   __static_attributes__r*   r   r   r'   r'   +   s&    $( D="#1:r   r'   )rs   
subprocessr   r   shutilr   ry   samba.gp.gpclassr   r   samba.gp.util.loggingr   r   r%   r'   r*   r   r   <module>r      s4   " 
 "   3 %
,K@z: @r   