<s> '''<STR_LIT>''' <EOL> from __future__ import absolute_import <EOL> import logging <EOL> import re <EOL> from salt . exceptions import CommandExecutionError <EOL> import salt . utils <EOL> log = logging . getLogger ( __name__ ) <EOL> def __virtual__ ( ) : <EOL> '''<STR_LIT>''' <EOL> if salt . utils . which ( '<STR_LIT>' ) : <EOL> return True <EOL> return ( False , '<STR_LIT>' ) <EOL> def __firewall_cmd ( cmd ) : <EOL> '''<STR_LIT>''' <EOL> firewall_cmd = '<STR_LIT>' . format ( salt . utils . which ( '<STR_LIT>' ) , cmd ) <EOL> out = __salt__ [ '<STR_LIT>' ] ( firewall_cmd ) <EOL> if out [ '<STR_LIT>' ] != <NUM_LIT:0> : <EOL> if not out [ '<STR_LIT>' ] : <EOL> msg = out [ '<STR_LIT>' ] <EOL> else : <EOL> msg = out [ '<STR_LIT>' ] <EOL> raise CommandExecutionError ( <EOL> '<STR_LIT>' . format ( msg ) <EOL> ) <EOL> return out [ '<STR_LIT>' ] <EOL> def __mgmt ( name , _type , action ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( action , _type , name ) <EOL> return __firewall_cmd ( cmd ) <EOL> def version ( ) : <EOL> '''<STR_LIT>''' <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> def default_zone ( ) : <EOL> '''<STR_LIT>''' <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> def list_zones ( permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> zones = { } <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> for i in __firewall_cmd ( cmd ) . splitlines ( ) : <EOL> if i . strip ( ) : <EOL> if bool ( re . match ( '<STR_LIT>' , i , re . I ) ) : <EOL> zone_name = i . rstrip ( ) <EOL> else : <EOL> ( id_ , val ) = i . strip ( ) . split ( '<STR_LIT::>' ) <EOL> if zones . get ( zone_name , None ) : <EOL> zones [ zone_name ] . update ( { id_ : val } ) <EOL> else : <EOL> zones [ zone_name ] = { id_ : val } <EOL> return zones <EOL> def get_zones ( permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def get_services ( permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def get_icmp_types ( permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def new_zone ( zone , restart = True ) : <EOL> '''<STR_LIT>''' <EOL> out = __mgmt ( zone , '<STR_LIT>' , '<STR_LIT>' ) <EOL> if restart : <EOL> if out == '<STR_LIT:success>' : <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> return out <EOL> def delete_zone ( zone , restart = True ) : <EOL> '''<STR_LIT>''' <EOL> out = __mgmt ( zone , '<STR_LIT>' , '<STR_LIT>' ) <EOL> if restart : <EOL> if out == '<STR_LIT:success>' : <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> return out <EOL> def set_default_zone ( zone ) : <EOL> '''<STR_LIT>''' <EOL> return __firewall_cmd ( '<STR_LIT>' . format ( zone ) ) <EOL> def new_service ( name , restart = True ) : <EOL> '''<STR_LIT>''' <EOL> out = __mgmt ( name , '<STR_LIT>' , '<STR_LIT>' ) <EOL> if restart : <EOL> if out == '<STR_LIT:success>' : <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> return out <EOL> def delete_service ( name , restart = True ) : <EOL> '''<STR_LIT>''' <EOL> out = __mgmt ( name , '<STR_LIT>' , '<STR_LIT>' ) <EOL> if restart : <EOL> if out == '<STR_LIT:success>' : <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> return out <EOL> def list_all ( zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> _zone = { } <EOL> id_ = '<STR_LIT>' <EOL> if zone : <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> else : <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> for i in __firewall_cmd ( cmd ) . splitlines ( ) : <EOL> if re . match ( '<STR_LIT>' , i , re . I ) : <EOL> zone_name = i . rstrip ( ) <EOL> else : <EOL> if i . startswith ( '<STR_LIT:\t>' ) : <EOL> _zone [ zone_name ] [ id_ ] . append ( i . strip ( ) ) <EOL> continue <EOL> ( id_ , val ) = i . split ( '<STR_LIT::>' , <NUM_LIT:1> ) <EOL> id_ = id_ . strip ( ) <EOL> if _zone . get ( zone_name , None ) : <EOL> _zone [ zone_name ] . update ( { id_ : [ val . strip ( ) ] } ) <EOL> else : <EOL> _zone [ zone_name ] = { id_ : [ val . strip ( ) ] } <EOL> return _zone <EOL> def list_services ( zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if zone : <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> else : <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def add_service ( service , zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if zone : <EOL> cmd = '<STR_LIT>' . format ( zone , service ) <EOL> else : <EOL> cmd = '<STR_LIT>' . format ( service ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_service ( service , zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if zone : <EOL> cmd = '<STR_LIT>' . format ( zone , service ) <EOL> else : <EOL> cmd = '<STR_LIT>' . format ( service ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def get_masquerade ( zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> zone_info = list_all ( zone , permanent ) <EOL> if '<STR_LIT>' in [ zone_info [ i ] [ '<STR_LIT>' ] [ <NUM_LIT:0> ] for i in zone_info . keys ( ) ] : <EOL> return False <EOL> return True <EOL> def add_masquerade ( zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if zone : <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> else : <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_masquerade ( zone = None , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if zone : <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> else : <EOL> cmd = '<STR_LIT>' <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def add_port ( zone , port , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if not get_masquerade ( zone ) : <EOL> add_masquerade ( zone ) <EOL> cmd = '<STR_LIT>' . format ( zone , port ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_port ( zone , port , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( zone , port ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def list_ports ( zone , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def add_port_fwd ( zone , src , dest , proto = '<STR_LIT>' , dstaddr = '<STR_LIT>' , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if not get_masquerade ( zone ) : <EOL> add_masquerade ( zone , permanent ) <EOL> cmd = '<STR_LIT>' . format ( <EOL> zone , <EOL> src , <EOL> proto , <EOL> dest , <EOL> dstaddr <EOL> ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_port_fwd ( zone , src , dest , proto = '<STR_LIT>' , dstaddr = '<STR_LIT>' , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( <EOL> zone , <EOL> src , <EOL> proto , <EOL> dest , <EOL> dstaddr <EOL> ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def list_port_fwd ( zone , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> ret = [ ] <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> for i in __firewall_cmd ( cmd ) . splitlines ( ) : <EOL> ( src , proto , dest , addr ) = i . split ( '<STR_LIT::>' ) <EOL> ret . append ( <EOL> { '<STR_LIT>' : src . split ( '<STR_LIT:=>' ) [ <NUM_LIT:1> ] , <EOL> '<STR_LIT>' : proto . split ( '<STR_LIT:=>' ) [ <NUM_LIT:1> ] , <EOL> '<STR_LIT>' : dest . split ( '<STR_LIT:=>' ) [ <NUM_LIT:1> ] , <EOL> '<STR_LIT>' : addr . split ( '<STR_LIT:=>' ) [ <NUM_LIT:1> ] } <EOL> ) <EOL> return ret <EOL> def block_icmp ( zone , icmp , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if icmp not in get_icmp_types ( permanent ) : <EOL> log . error ( '<STR_LIT>' ) <EOL> return False <EOL> if icmp in list_icmp_block ( zone , permanent ) : <EOL> log . info ( '<STR_LIT>' ) <EOL> return '<STR_LIT:success>' <EOL> cmd = '<STR_LIT>' . format ( zone , icmp ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def allow_icmp ( zone , icmp , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if icmp not in get_icmp_types ( permanent ) : <EOL> log . error ( '<STR_LIT>' ) <EOL> return False <EOL> if icmp not in list_icmp_block ( zone , permanent ) : <EOL> log . info ( '<STR_LIT>' ) <EOL> return '<STR_LIT:success>' <EOL> cmd = '<STR_LIT>' . format ( zone , icmp ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def list_icmp_block ( zone , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def make_permanent ( ) : <EOL> '''<STR_LIT>''' <EOL> return __firewall_cmd ( '<STR_LIT>' ) <EOL> def get_interfaces ( zone , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def add_interface ( zone , interface , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if interface in get_interfaces ( zone , permanent ) : <EOL> log . info ( '<STR_LIT>' ) <EOL> cmd = '<STR_LIT>' . format ( zone , interface ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_interface ( zone , interface , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if interface not in get_interfaces ( zone , permanent ) : <EOL> log . info ( '<STR_LIT>' ) <EOL> cmd = '<STR_LIT>' . format ( zone , interface ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def get_sources ( zone , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . split ( ) <EOL> def add_source ( zone , source , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if source in get_sources ( zone , permanent ) : <EOL> log . info ( '<STR_LIT>' ) <EOL> cmd = '<STR_LIT>' . format ( zone , source ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_source ( zone , source , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> if source not in get_sources ( zone , permanent ) : <EOL> log . info ( '<STR_LIT>' ) <EOL> cmd = '<STR_LIT>' . format ( zone , source ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def get_rich_rules ( zone , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = '<STR_LIT>' . format ( zone ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) . splitlines ( ) <EOL> def add_rich_rule ( zone , rule , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = "<STR_LIT>" . format ( zone , rule ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) <EOL> def remove_rich_rule ( zone , rule , permanent = True ) : <EOL> '''<STR_LIT>''' <EOL> cmd = "<STR_LIT>" . format ( zone , rule ) <EOL> if permanent : <EOL> cmd += '<STR_LIT>' <EOL> return __firewall_cmd ( cmd ) </s>
