
    ~ gC                     0    S SK JrJrJr   " S S\\5      rg)    )PluginIndependentPluginSoSPredicatec                   D    \ rS rSrSrSrSrSrSrSr	S r
S	 rS
 rS rSrg)FirewallTables   a  Collects information about local firewall tables, such as iptables,
and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
information, which is handled by a separate plugin.

Collections from this plugin are largely gated byt the presence of relevant
kernel modules - for example,  the plugin will not collect the nf_tables
ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
currently loaded (unless using the --allow-system-changes option).
zfirewall tablesfirewall_tables)networksystem)/etc/nftables)	ip_tables
ip6_tables	nf_tables	nfnetlinkebtablesc                 P    SU-   nSU-   S-   nU R                  U[        XS/S9S9  g)zCollecting iptables rules for a table loads either kernel module
of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
If neither module is present, the rules must be empty.iptable_ziptables -t  -nvLr   kmodspredNadd_cmd_outputr   self	tablenamemodnamecmds       D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.pycollect_iptableFirewallTables.collect_iptable   sA    
 y(y(72dK*@A 	 	C    c                 P    SU-   nSU-   S-   nU R                  U[        XS/S9S9  g)z%Same as function above, but for ipv6 	ip6table_zip6tables -t r   r   r   r   Nr   r   s       r    collect_ip6tableFirewallTables.collect_ip6table*   sA     	)	)G3dK*@A 	 	Cr#   c                 B    [        U SS/SS0S9nU R                  SUSS9$ )	zJCollects nftables rulesets with 'nft' commands if the modules
are present r   r   r   all)r   requiredznft -a list rulesetT)r   changes)r   collect_cmd_output)r   nft_preds     r    collect_nftablesFirewallTables.collect_nftables3   sB    
  '2K&@*15)9; &&'<8/3 ' 5 	5r#   c                    U R                  5       n/ / S.nUS   S:X  a  US   OSnUR                  5        HV  nUR                  5       SS n[        U5      S:X  d  M'  US   S:X  d  M2  US   U;   d  M=  X%S      R	                  US	   5        MX     S
n Sn[        USSS9 nUR                  5       n	S S S 5        W	R                  5        H)  n
US   S:X  d  M  XS   ;   d  M  U R                  U
5        M+      Sn[        USSS9 nUR                  5       n	S S S 5        U	R                  5        H)  n
US   S:X  d  M  XS   ;   d  M  U R                  U
5        M+     US   S:w  d	  SUS   ;   a  U R                  S[        U SS/S9S9  US   S:w  d	  SUS   ;   a  U R                  S[        U SS/S9S9  U R                  / SQ5        g ! , (       d  f       GN= f! [         a    Un	 GN.f = f! , (       d  f       N= f! [         a    Un	 Nf = f)N)ipip6statusr   output    table      zmangle
filter
nat
z/proc/net/ip_tables_namesrzUTF-8)encodingr1   z/proc/net/ip6_tables_namesr2   filterziptables -vnxLiptable_filterr   r   r   zip6tables -vnxLip6table_filter)r   z/etc/sysconfig/nftables.confz/etc/nftables.conf)r.   
splitlinessplitlenappendopenreadIOErrorr!   r&   r   r   add_copy_spec)r   nft_listnft_ip_tables	nft_lineslinewordsdefault_ip_tablesproc_net_ip_tablesifileip_tables_namesr7   proc_net_ip6_tablesipfiles                r    setupFirewallTables.setup>   s8   
 ((*!"-*28*<*AHX&r	((*DJJL1%E5zQ58w#6!H-Ah'..uQx8	 + 4	0!<(#@E"'**, A %//1E!Q&5$4G+G$$U+ 2	0">)3AV"(++- B %//1E!Q&5%4H+H%%e, 2 H"h-2E&E !$/?.MN    H"h-2F&F!!$/@+.NO   
 	 
 	E A@ 	0/O	0 BA 	0/O	0s`   G  G1G 7G< G+G< 
GG G G('G(+
G95G< 9G< <H
H N)__name__
__module____qualname____firstlineno____doc__
short_descplugin_nameprofilesfileskernel_modsr!   r&   r.   rR   __static_attributes__rT   r#   r    r   r      s:     #J#K$HEK	CC	59r#   r   N)sos.report.pluginsr   r   r   r   rT   r#   r    <module>ra      s    I HkV. kr#   