Current File : //usr/lib/python2.7/site-packages/salt/modules/firewalld.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l m Z d d l Z
d d l Z
e j e
� Z d � Z d � Z d � Z d � Z d � Z d
� Z e d � Z e d � Z e d
� Z e d � Z e d � Z e d � Z d � Z e d � Z e d � Z d e d � Z d e d � Z! d e d � Z" d e d � Z# d � Z$ d � Z% d � Z& d � Z' d � Z( d � Z) d e d � Z* d e d � Z+ d e d � Z, e d d! � Z- e d" � Z. e d# � Z/ d$ d% e d d& � Z0 d$ d% e d' � Z1 e d( � Z2 e d) � Z3 e d* � Z4 e d+ � Z5 d, � Z6 e d- � Z7 e d. � Z8 e d/ � Z9 e d0 � Z: e d1 � Z; e d2 � Z< e d3 � Z= e d4 � Z> e d5 � Z? d S(6 u4
Support for firewalld.
.. versionadded:: 2015.2.0
i ( t absolute_importt print_functiont unicode_literalsN( t CommandExecutionErrorc C@ s# t j j j d � r t St d f S( u-
Check to see if firewall-cmd exists
u firewall-cmdu\ The firewalld execution module cannot be loaded: the firewall-cmd binary is not in the path.( t saltt utilst patht whicht Truet False( ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt __virtual__ s c C@ s� d j t j j j d � | � } t d | � } | d d k rz | d sX | d } n
| d } t d j | � � � n | d S( u*
Return the firewall-cmd location
u {0} {1}u firewall-cmdu cmd.run_allu retcodei u stderru stdoutu firewall-cmd failed: {0}( t formatR R R R t __salt__R ( t cmdt firewall_cmdt outt msg( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt __firewall_cmd s !
c C@ s d j | | | � } t | � S( u!
Perform zone management
u --{0}-{1}={2} --permanent( R R ( t namet _typet actionR
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt __mgmt1 s c C@ s
t d � S( uz
Return version from firewall-cmd
CLI Example:
.. code-block:: bash
salt '*' firewalld.version
u --version( R ( ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt version; s
c C@ s
t d � S( u
Reload the firewall rules, which makes the permanent configuration the new
runtime configuration without losing state information.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.reload
u --reload( R ( ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt reload_rulesH s
c C@ s
t d � S( u�
Print default zone for connections and interfaces
CLI Example:
.. code-block:: bash
salt '*' firewalld.default_zone
u --get-default-zone( R ( ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt default_zoneX s
c C@ s� i } d } | r | d 7} n x� t | � j � D]� } | j � r2 t t j d | t j � � rq | j � } q� | j � j d � \ } } | j | d � r� | | j i | | 6� q� i | | 6| | <q2 q2 W| S( u�
List everything added for or enabled in all zones
CLI Example:
.. code-block:: bash
salt '*' firewalld.list_zones
u --list-all-zonesu --permanentu ^[a-z0-9]u :N( R t
splitlinest stript boolt ret matcht It rstript splitt gett Nonet update( t permanentt zonesR
t it zone_namet id_t val( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
list_zonese s
c C@ s) d } | r | d 7} n t | � j � S( ur
Print predefined zones
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_zones
u --get-zonesu --permanent( R R ( R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_zones� s
c C@ s) d } | r | d 7} n t | � j � S( ux
Print predefined services
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_services
u --get-servicesu --permanent( R R ( R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_services� s
c C@ s) d } | r | d 7} n t | � j � S( u{
Print predefined icmptypes
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_icmp_types
u --get-icmptypesu --permanent( R R ( R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_icmp_types� s
c C@ s5 t | d d � } | r1 | d k r1 t d � Sn | S( u3
Add a new zone
CLI Example:
.. code-block:: bash
salt '*' firewalld.new_zone my_zone
By default firewalld will be reloaded. However, to avoid reloading
you need to specify the restart as False
.. code-block:: bash
salt '*' firewalld.new_zone my_zone False
u zoneu newu successu --reload( R R ( t zonet restartR ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt new_zone� s
c C@ s5 t | d d � } | r1 | d k r1 t d � Sn | S( uB
Delete an existing zone
CLI Example:
.. code-block:: bash
salt '*' firewalld.delete_zone my_zone
By default firewalld will be reloaded. However, to avoid reloading
you need to specify the restart as False
.. code-block:: bash
salt '*' firewalld.delete_zone my_zone False
u zoneu deleteu successu --reload( R R ( R. R/ R ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt delete_zone� s
c C@ s t d j | � � S( uz
Set default zone
CLI Example:
.. code-block:: bash
salt '*' firewalld.set_default_zone damian
u --set-default-zone={0}( R R ( R. ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt set_default_zone� s
c C@ s5 t | d d � } | r1 | d k r1 t d � Sn | S( uB
Add a new service
CLI Example:
.. code-block:: bash
salt '*' firewalld.new_service my_service
By default firewalld will be reloaded. However, to avoid reloading
you need to specify the restart as False
.. code-block:: bash
salt '*' firewalld.new_service my_service False
u serviceu newu successu --reload( R R ( R R/ R ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt new_service� s
c C@ s5 t | d d � } | r1 | d k r1 t d � Sn | S( uQ
Delete an existing service
CLI Example:
.. code-block:: bash
salt '*' firewalld.delete_service my_service
By default firewalld will be reloaded. However, to avoid reloading
you need to specify the restart as False
.. code-block:: bash
salt '*' firewalld.delete_service my_service False
u serviceu deleteu successu --reload( R R ( R R/ R ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt delete_service s
c C@ s) i } d } | r$ d j | � } n d } | r= | d 7} n x� t | � j � D]� } t j d | t j � r} | j � } qP | j d � r� | | | j | j � � qP n | j
d d � \ } } | j � } | j | d � r| | j
i | j � g | 6� qP i | j � g | 6| | <qP W| S(
u�
List everything added for or enabled in a zone
CLI Example:
.. code-block:: bash
salt '*' firewalld.list_all
List a specific zone
.. code-block:: bash
salt '*' firewalld.list_all my_zone
u u --zone={0} --list-allu
--list-allu --permanentu ^[a-z0-9]u u :i N( R R R R R R R t
startswitht appendR R R! R" R# ( R. R$ t _zoneR( R
R& R' R) ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt list_all4 s&
$ c C@ sA | r d j | � } n d } | r1 | d 7} n t | � j � S( u0
List services added for zone as a space separated list.
If zone is omitted, default zone will be used.
CLI Example:
.. code-block:: bash
salt '*' firewalld.list_services
List a specific zone
.. code-block:: bash
salt '*' firewalld.list_services my_zone
u --zone={0} --list-servicesu --list-servicesu --permanent( R R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
list_servicesc s
c C@ sG | r d j | | � } n d j | � } | r= | d 7} n t | � S( u#
Add a service for zone. If zone is omitted, default zone will be used.
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_service ssh
To assign a service to a specific zone:
.. code-block:: bash
salt '*' firewalld.add_service ssh my_zone
u --zone={0} --add-service={1}u --add-service={0}u --permanent( R R ( t serviceR. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt add_service s
c C@ sG | r d j | | � } n d j | � } | r= | d 7} n t | � S( u[
Remove a service from zone. This option can be specified multiple times.
If zone is omitted, default zone will be used.
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_service ssh
To remove a service from a specific zone
.. code-block:: bash
salt '*' firewalld.remove_service ssh dmz
u --zone={0} --remove-service={1}u --remove-service={0}u --permanent( R R ( R: R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_service� s
c C@ s@ | t d t � k r$ t d � � n d j | | � } t | � S( u�
Add a new port to the specified service.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_service_port zone 80
R$ u The service does not exist.u( --permanent --service={0} --add-port={1}( R, R R R R ( R: t portR
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt add_service_port� s c C@ s@ | t d t � k r$ t d � � n d j | | � } t | � S( u�
Remove a port from the specified service.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_service_port zone 80
R$ u The service does not exist.u+ --permanent --service={0} --remove-port={1}( R, R R R R ( R: R= R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_service_port� s c C@ s d j | � } t | � j � S( u�
List ports of a service.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_service_ports zone
u% --permanent --service={0} --get-ports( R R R ( R: R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_service_ports� s c C@ s d j | | � } t | � S( u�
Add a new protocol to the specified service.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_service_protocol zone ssh
u, --permanent --service={0} --add-protocol={1}( R R ( R: t protocolR
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt add_service_protocol� s c C@ s d j | | � } t | � S( u�
Remove a protocol from the specified service.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_service_protocol zone ssh
u/ --permanent --service={0} --remove-protocol={1}( R R ( R: RA R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_service_protocol� s c C@ s d j | � } t | � j � S( u�
List protocols of a service.
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_service_protocols zone
u) --permanent --service={0} --get-protocols( R R R ( R: R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_service_protocols s c C@ sH t | | � } d g | j � D] } | | d d ^ q k rD t St S( u�
Show if masquerading is enabled on a zone.
If zone is omitted, default zone will be used.
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_masquerade zone
u nou
masqueradei ( R8 t keysR R ( R. R$ t zone_infoR& ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_masquerade s 1c C@ s; | r d j | � } n d } | r1 | d 7} n t | � S( uF
Enable masquerade on a zone.
If zone is omitted, default zone will be used.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_masquerade
To enable masquerade on a specific zone
.. code-block:: bash
salt '*' firewalld.add_masquerade dmz
u --zone={0} --add-masqueradeu --add-masqueradeu --permanent( R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt add_masquerade1 s
c C@ s; | r d j | � } n d } | r1 | d 7} n t | � S( uL
Remove masquerade on a zone.
If zone is omitted, default zone will be used.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_masquerade
To remove masquerade on a specific zone
.. code-block:: bash
salt '*' firewalld.remove_masquerade dmz
u --zone={0} --remove-masqueradeu --remove-masqueradeu --permanent( R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_masqueradeO s
c C@ sz | d k r+ t } t j j j d d � n | rK t | � rK t | � n d j | | � } | rp | d 7} n t | � S( u�
Allow specific ports in a zone.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_port internal 443/tcp
u Neonuy add_port function will no longer force enable masquerading in future releases. Use add_masquerade to enable masquerading.u --zone={0} --add-port={1}u --permanentN(
R" R R R t versionst
warn_untilRG RH R R ( R. R= R$ t force_masqueradeR
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt add_portn s
c C@ s/ d j | | � } | r% | d 7} n t | � S( u�
Remove a specific port from a zone.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_port internal 443/tcp
u --zone={0} --remove-port={1}u --permanent( R R ( R. R= R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_port� s
c C@ s2 d j | � } | r" | d 7} n t | � j � S( u�
List all ports in a zone.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.list_ports
u --zone={0} --list-portsu --permanent( R R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
list_ports� s
u tcpu c C@ s� | d k r+ t } t j j j d d � n | rK t | � rK t | � n d j | | | | | � } | ry | d 7} n t | � S( u�
Add port forwarding.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_port_fwd public 80 443 tcp
u Neonu} add_port_fwd function will no longer force enable masquerading in future releases. Use add_masquerade to enable masquerading.uF --zone={0} --add-forward-port=port={1}:proto={2}:toport={3}:toaddr={4}u --permanentN(
R" R R R RJ RK RG RH R R ( R. t srct destt protot dstaddrR$ RL R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt add_port_fwd� s
c C@ s8 d j | | | | | � } | r. | d 7} n t | � S( u�
Remove Port Forwarding.
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_port_fwd public 80 443 tcp
uI --zone={0} --remove-forward-port=port={1}:proto={2}:toport={3}:toaddr={4}u --permanent( R R ( R. RP RQ RR RS R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_port_fwd� s
c C@ s� g } d j | � } | r( | d 7} n x� t | � j � D]~ } | j d � \ } } } } | j i | j d � d d 6| j d � d d 6| j d � d d 6| j d � d d 6� q; W| S(
u�
List port forwarding
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.list_port_fwd public
u --zone={0} --list-forward-portsu --permanentu :u =i u Source portu Protocolu Destination portu Destination address( R R R R R6 ( R. R$ t retR
R& RP RR RQ t addr( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
list_port_fwd� s
c C@ sx | t | � k r# t j d � t S| t | | � k rI t j d � d Sd j | | � } | rn | d 7} n t | � S( u�
Block a specific ICMP type on a zone
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.block_icmp zone echo-reply
u Invalid ICMP typeu ICMP block already existsu successu --zone={0} --add-icmp-block={1}u --permanent( R- t logt errorR t list_icmp_blockt infoR R ( R. t icmpR$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
block_icmp s
c C@ sx | t | � k r# t j d � t S| t | | � k rI t j d � d Sd j | | � } | rn | d 7} n t | � S( u�
Allow a specific ICMP type on a zone
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.allow_icmp zone echo-reply
u Invalid ICMP typeu ICMP Type is already permittedu successu" --zone={0} --remove-icmp-block={1}u --permanent( R- RY RZ R R[ R\ R R ( R. R] R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
allow_icmp9 s
c C@ s2 d j | � } | r" | d 7} n t | � j � S( u�
List ICMP blocks on a zone
.. versionadded:: 2015.8.0
CLI Example:
.. code-block:: bash
salt '*' firewlld.list_icmp_block zone
u --zone={0} --list-icmp-blocksu --permanent( R R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyR[ U s
c C@ s
t d � S( u�
Make current runtime configuration permanent.
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.make_permanent
u --runtime-to-permanent( R ( ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt make_permanenti s c C@ s2 d j | � } | r" | d 7} n t | � j � S( u�
List interfaces bound to a zone
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_interfaces zone
u --zone={0} --list-interfacesu --permanent( R R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_interfacesx s
c C@ sT | t | | � k r% t j d � n d j | | � } | rJ | d 7} n t | � S( u�
Bind an interface to a zone
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_interface zone eth0
u# Interface is already bound to zone.u --zone={0} --add-interface={1}u --permanent( Ra RY R\ R R ( R. t interfaceR$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
add_interface� s
c C@ sT | t | | � k r% t j d � n d j | | � } | rJ | d 7} n t | � S( u�
Remove an interface bound to a zone
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_interface zone eth0
u Interface is not bound to zone.u! --zone={0} --remove-interface={1}u --permanent( Ra RY R\ R R ( R. Rb R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_interface� s
c C@ s2 d j | � } | r" | d 7} n t | � j � S( u�
List sources bound to a zone
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_sources zone
u --zone={0} --list-sourcesu --permanent( R R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_sources� s
c C@ sT | t | | � k r% t j d � n d j | | � } | rJ | d 7} n t | � S( u�
Bind a source to a zone
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_source zone 192.168.1.0/24
u Source is already bound to zone.u --zone={0} --add-source={1}u --permanent( Re RY R\ R R ( R. t sourceR$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
add_source� s
c C@ sT | t | | � k r% t j d � n d j | | � } | rJ | d 7} n t | � S( u�
Remove a source bound to a zone
.. versionadded:: 2016.3.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_source zone 192.168.1.0/24
u Source is not bound to zone.u --zone={0} --remove-source={1}u --permanent( Re RY R\ R R ( R. Rf R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
remove_source� s
c C@ s2 d j | � } | r" | d 7} n t | � j � S( u�
List rich rules bound to a zone
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.get_rich_rules zone
u --zone={0} --list-rich-rulesu --permanent( R R R ( R. R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt get_rich_rules� s
c C@ s/ d j | | � } | r% | d 7} n t | � S( u�
Add a rich rule to a zone
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.add_rich_rule zone 'rule'
u --zone={0} --add-rich-rule='{1}'u --permanent( R R ( R. t ruleR$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt
add_rich_rule s
c C@ s/ d j | | � } | r% | d 7} n t | � S( u�
Add a rich rule to a zone
.. versionadded:: 2016.11.0
CLI Example:
.. code-block:: bash
salt '*' firewalld.remove_rich_rule zone 'rule'
u# --zone={0} --remove-rich-rule='{1}'u --permanent( R R ( R. Rj R$ R
( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt remove_rich_rule$ s
(@ t __doc__t
__future__R R R t loggingR t salt.exceptionsR t salt.utils.pathR t salt.utils.versionst getLoggert __name__RY R
R R R R R R R* R+ R, R- R0 R1 R2 R3 R4 R" R8 R9 R; R< R> R? R@ RB RC RD RG RH RI RM RN RO RT RU RX R^ R_ R[ R` Ra Rc Rd Re Rg Rh Ri Rk Rl ( ( ( s: /usr/lib/python2.7/site-packages/salt/modules/firewalld.pyt <module> sl
/ # )
Mini Shell