3
ܓiC @ s* d dl mZmZmZ G dd deeZdS ) )PluginIndependentPlugin SoSPredicatec @ sD e Zd ZdZdZdZdZdZdZd d
Z dd Z
dd Z dd Z dS )FirewallTablesa Collects information about local firewall tables, such as iptables,
and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
information, which is handled by a separate plugin.
Collections from this plugin are largely gated byt the presence of relevant
kernel modules - for example, the plugin will not collect the nf_tables
ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
currently loaded (unless using the --allow-system-changes option).
zfirewall tablesZfirewall_tablesnetworksystem
/etc/nftables ip_tables
ip6_tables nf_tables nfnetlinkebtablesc C s2 d| }d| d }| j |t| |dgdd dS )z Collecting iptables rules for a table loads either kernel module
of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
If neither module is present, the rules must be empty.Ziptable_z iptables -t z -nvLr )kmods)predN)add_cmd_outputr )self tablenamemodnamecmd r %/usr/lib/python3.6/firewall_tables.pycollect_iptable s
z FirewallTables.collect_iptablec C s2 d| }d| d }| j |t| |dgdd dS )z& Same as function above, but for ipv6 Z ip6table_z
ip6tables -t z -nvLr )r )r N)r r )r r r r r r r collect_ip6table* s
z FirewallTables.collect_ip6tablec C s& t | ddgddid}| jd|ddS ) zS Collects nftables rulesets with 'nft' commands if the modules
are present r r r all)r Zrequiredznft -a list rulesetT)r Zchanges)r Zcollect_cmd_output)r Znft_predr r r collect_nftables3 s
z FirewallTables.collect_nftablesc
C s | j }g g d}|d dkr&|d nd}xZ|j D ]N}|j dd }t|dkr4|d dkr4|d |kr4||d j|d q4W d
}y*d }t|d d
d}|j } W d Q R X W n tk
r |} Y nX x2| j D ]&}
|d dkr|
|d kr| j|
qW y*d} t| d d
d} | j } W d Q R X W n tk
rF |} Y nX x8| j D ],}
|d dkrR|
|d krR| j |
qRW |d dksd|d kr| j
dt | ddgdd |d dksd|d kr| j
dt | ddgdd | j ddd g d S ) N)ipip6Zstatusr output table zmangle
filter
nat
z/proc/net/ip_tables_namesrzUTF-8)encodingr z/proc/net/ip6_tables_namesr filterziptables -vnxLZiptable_filterr )r )r zip6tables -vnxLZip6table_filterz
/etc/nftablesz /etc/sysconfig/nftables.confz/etc/nftables.conf)
r
splitlinessplitlenappendopenreadIOErrorr r r r Z
add_copy_spec)
r Znft_listZ
nft_ip_tablesZ nft_lineslineZwordsZdefault_ip_tablesZproc_net_ip_tablesZifileZip_tables_namesr Zproc_net_ip6_tablesZipfiler r r setup> sN
zFirewallTables.setupN)r r )r )r r
r r r
)
__name__
__module__ __qualname____doc__Z
short_descZ plugin_nameZprofilesfilesZ kernel_modsr r r r. r r r r r s r N)Zsos.report.pluginsr r r r r r r r s