| Current File : //usr/lib/python3/dist-packages/sos/report/plugins/__pycache__/firewall_tables.cpython-312.pyc |
�
-�_gC � �0 � d dl mZmZmZ G d� dee� Zy)� )�Plugin�IndependentPlugin� SoSPredicatec �< � e Zd ZdZdZdZdZdZdZd� Z d� Z
d � Z d
� Z y ) �FirewallTablesa Collects information about local firewall tables, such as iptables,
and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
information, which is handled by a separate plugin.
Collections from this plugin are largely gated byt the presence of relevant
kernel modules - for example, the plugin will not collect the nf_tables
ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
currently loaded (unless using the --allow-system-changes option).
zfirewall tables�firewall_tables)�network�system)�
/etc/nftables)� ip_tables�
ip6_tables� nf_tables� nfnetlink�ebtablesc �^ � d|z }d|z dz }| j |t | |dg�� �� y)z� Collecting iptables rules for a table loads either kernel module
of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
If neither module is present, the rules must be empty.�iptable_z iptables -t � -nvLr ��kmods��predN��add_cmd_outputr ��self� tablename�modname�cmds �D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.py�collect_iptablez FirewallTables.collect_iptable sC � �
�y�(�� �y�(�7�2�� ��� � �d�7�K�*@�A� � C� c �^ � d|z }d|z dz }| j |t | |dg�� �� y)z& Same as function above, but for ipv6 � ip6table_z
ip6tables -t r r r r Nr r s r �collect_ip6tablez FirewallTables.collect_ip6table* sC � � � �)�� � �)�G�3�� ��� � �d�7�K�*@�A� � Cr! c �N � t | ddgddi�� }| j d|d�� S ) zS Collects nftables rulesets with 'nft' commands if the modules
are present r r r �all)r �requiredznft -a list rulesetT)r �changes)r �collect_cmd_output)r �nft_preds r �collect_nftablesz FirewallTables.collect_nftables3 sB � �
��'2�K�&@�*1�5�)9�;�� �&�&�'<�8�/3� '� 5� 5r! c �� � | j � }g g d�}|d dk( r|d nd}|j � D ]O }|j � dd }t |� dk( s�%|d dk( s�.|d |v s�6||d j |d � �Q d
} d }t |d d
�� 5 }|j
� } d d d � j � D ]$ }
|d dk( s� |
|d v s�| j |
� �& d} t | d d
�� 5 } | j
� } d d d � | j � D ]$ }
|d dk( s� |
|d v s�| j |
� �& |d dk7 sd|d v r | j dt | ddg�� �� |d dk7 sd|d v r | j dt | ddg�� �� | j g d�� y # 1 sw Y ��xY w# t $ r |} Y ��%w xY w# 1 sw Y ��xY w# t $ r |} Y ��w xY w)N)�ip�ip6�statusr �output� � �table� � zmangle
filter
nat
z/proc/net/ip_tables_names�rzUTF-8)�encodingr- z/proc/net/ip6_tables_namesr. �filterziptables -vnxL�iptable_filterr r r zip6tables -vnxL�ip6table_filter)r z /etc/sysconfig/nftables.confz/etc/nftables.conf)
r+ �
splitlines�split�len�append�open�read�IOErrorr r$ r r �
add_copy_spec)
r �nft_list�
nft_ip_tables� nft_lines�line�words�default_ip_tables�proc_net_ip_tables�ifile�ip_tables_namesr3 �proc_net_ip6_tables�ipfiles
r �setupzFirewallTables.setup> sW � �
�(�(�*�� !�"�-�
�*2�8�*<��*A�H�X�&�r� � �(�(�*� 9�D��J�J�L��1�%�E��5�z�Q��5��8�w�#6��!�H�
�-� �e�A�h�'�.�.�u�Q�x�8� 9� 4�� 0�!<� ��(�#��@�
/�E�"'�*�*�,��
/� %�/�/�1� ,�E���!�Q�&�5�M�$�4G�+G��$�$�U�+� ,� 0�">� ��)�3��A�
0�V�"(�+�+�-��
0� %�/�/�1� -�E���!�Q�&�5�M�%�4H�+H��%�%�e�,� -� �H� �� "�h�-��2E�&E� � � � �!�$�/?��.M�N�
�
� �H� �� "�h�-��2F�&F� � � �!�!�$�/@�+�.N�O�
�
�
���
� �E
/�
/��� 0� /�O� 0��
0�
0��� 0� /�O� 0�sT �
G
�F=�+G
�+G( �;G � G( �=G�G
�
G�G� G%�!G( �( G6�5G6N)
�__name__�
__module__� __qualname__�__doc__�
short_desc� plugin_name�profiles�files� kernel_modsr r$ r+ rN � r! r r r s: � �� #�J�#�K�$�H� �E� �K� C�C� 5�9 r! r N)�sos.report.pluginsr r r r rX r! r �<module>rZ s �� I� H�k �V� .� k r!