
    -_gC                     0    d dl mZmZmZ  G d dee      Zy)    )PluginIndependentPluginSoSPredicatec                   <    e Zd ZdZdZdZdZdZdZd Z	d Z
d	 Zd
 Zy)FirewallTablesa   Collects information about local firewall tables, such as iptables,
    and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
    information, which is handled by a separate plugin.

    Collections from this plugin are largely gated byt the presence of relevant
    kernel modules - for example,  the plugin will not collect the nf_tables
    ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
    currently loaded (unless using the --allow-system-changes option).
    zfirewall tablesfirewall_tables)networksystem)/etc/nftables)	ip_tables
ip6_tables	nf_tables	nfnetlinkebtablesc                 ^    d|z   }d|z   dz   }| j                  |t        | |dg             y)z Collecting iptables rules for a table loads either kernel module
        of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
        If neither module is present, the rules must be empty.iptable_ziptables -t  -nvLr   kmodspredNadd_cmd_outputr   self	tablenamemodnamecmds       D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.pycollect_iptablezFirewallTables.collect_iptable   sC    
 y(y(72d7K*@A 	 	C    c                 ^    d|z   }d|z   dz   }| j                  |t        | |dg             y)z& Same as function above, but for ipv6 	ip6table_zip6tables -t r   r   r   r   Nr   r   s       r   collect_ip6tablezFirewallTables.collect_ip6table*   sC     	)	)G3d7K*@A 	 	Cr!   c                 N    t        | ddgddi      }| j                  d|d      S )	zS Collects nftables rulesets with 'nft' commands if the modules
        are present r   r   r   all)r   requiredznft -a list rulesetT)r   changes)r   collect_cmd_output)r   nft_preds     r   collect_nftableszFirewallTables.collect_nftables3   sB    
  '2K&@*15)9; &&'<8/3 ' 5 	5r!   c                    | j                         }g g d}|d   dk(  r|d   nd}|j                         D ]O  }|j                         dd }t        |      dk(  s%|d   dk(  s.|d   |v s6||d      j	                  |d	          Q d
}	 d}t        |dd      5 }|j                         }	d d d        	j                         D ]$  }
|d   dk(  s|
|d   v s| j                  |
       & 	 d}t        |dd      5 }|j                         }	d d d        |	j                         D ]$  }
|d   dk(  s|
|d   v s| j                  |
       & |d   dk7  sd|d   v r | j                  dt        | ddg             |d   dk7  sd|d   v r | j                  dt        | ddg             | j                  g d       y # 1 sw Y   xY w# t        $ r |}	Y %w xY w# 1 sw Y   xY w# t        $ r |}	Y w xY w)N)ipip6statusr   output    table      zmangle
filter
nat
z/proc/net/ip_tables_namesrzUTF-8)encodingr-   z/proc/net/ip6_tables_namesr.   filterziptables -vnxLiptable_filterr   r   r   zip6tables -vnxLip6table_filter)r   z/etc/sysconfig/nftables.confz/etc/nftables.conf)r+   
splitlinessplitlenappendopenreadIOErrorr    r$   r   r   add_copy_spec)r   nft_listnft_ip_tables	nft_lineslinewordsdefault_ip_tablesproc_net_ip_tablesifileip_tables_namesr3   proc_net_ip6_tablesipfiles                r   setupzFirewallTables.setup>   sW   
 ((*!"-*28*<*AHX&r	((* 	9DJJL1%E5zQ58w#6!H-eAh'..uQx8		9 4	0!<(#@ /E"'**,/ %//1 	,E!Q&5M$4G+G$$U+	,	0">)3A 0V"(++-0 %//1 	-E!Q&5M%4H+H%%e,	- H"h-2E&E !$/?.MN    H"h-2F&F!!$/@+.NO   
 	 
 	E/ / 	0/O	00 0 	0/O	0sT   
G
 F=+G
 +G( ;GG( =GG
 
GGG%!G( (G65G6N)__name__
__module____qualname____doc__
short_descplugin_nameprofilesfileskernel_modsr    r$   r+   rN    r!   r   r   r      s:     #J#K$HEK	CC	59r!   r   N)sos.report.pluginsr   r   r   r   rX   r!   r   <module>rZ      s    I HkV. kr!   