U

i��d_�@s*dd
lm
Z
mZmZ
Gdd�de
e�ZdS)�)�Plugin�IndependentPlugin�SoSPredicatec@sDeZ
dZd
ZdZdZdZdZdZdd�Z	dd	�Z
d
d�Zdd
�ZdS)�firewall_tablesaCollects information about local firewall tables, such as iptables,
    and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
    information, which is handled by a separate plugin.

    Collections from this plugin are largely gated byt the presence of relevant
    kernel modules - for example,  the plugin will not collect the nf_tables
    ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
    currently loaded (unless using the --allow-system-changes option).
    zfirewall tables)Znetwork�system)
�
/etc/nftables)Z	ip_tablesZ
ip6_tables�	nf_tables�	nfnetlinkZebtablescCs2d
|
}d|
d}|j|t
||dgd�d�
dS)z� Collecting iptables rules for a table loads either kernel module
        of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
        If neither module is present, the rules must be empty.Ziptable_ziptables -t � -nvLr�
�kmods�
�predN��add_cmd_outputr��selfZ	tablename�modname�cmd�r�D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.py�collect_iptables



�zfirewall_tables.collect_iptablecCs2d
|
}d|
d}|j|t
||dgd�d�
dS)z& Same as function above, but for ipv6 Z	ip6table_z
ip6tables -t r
rrr
Nrrrrr�collect_ip6table*s



�z firewall_tables.collect_ip6tablec
Cs&t|d
dgddi
d�}
|j
d|
dd�S)	zS Collects nftables rulesets with 'nft' commands if the modules
        are present rr	r�all)rZrequiredznft list rulesetT)rZchanges)rZcollect_cmd_output)rZnft_predrrr�collect_nftables3s

�
�z firewall_tables.collect_nftablesc
	Cs�
|��}
ggd
�}|
ddkr&|
dnd}|�
�D]R}|��dd�}t|�
dkr2|ddkr2|d|��kr2||d�|d	�

q2d
}ztd�
��}Wntk
r�


|}YnX|�
�D]&}|
ddkr�||dkr�|�	|�

q�ztd
�
��}Wntk
�
r


|}YnX|�
�D],}|
ddk�
r||dk�
r|�
|�

�
q|
ddk�
sbd|dk�
r||jdt|ddgd�d�
|
ddk�
s�d|dk�
r�|jdt|ddgd�d�
|�
dddg�

dS)N)�ip�ip6Zstatusr
�output���table�
�zmangle
filter
z/proc/net/ip_tables_namesrz/proc/net/ip6_tables_namesr�filterziptables -vnxLZiptable_filterrrr
zip6tables -vnxLZip6table_filterrz/etc/sysconfig/nftables.confz/etc/nftables.conf)r�
splitlines�split�len�keys�append�open�read�IOErrorrrrrZ
add_copy_spec)	rZnft_listZ
nft_ip_tablesZ	nft_lines�lineZwordsZdefault_ip_tablesZip_tables_namesr rrr�setup>sN






�

















�


�


�zfirewall_tables.setupN)
�__name__�
__module__�__qualname__�__doc__Z
short_descZplugin_nameZprofiles�filesZkernel_modsrrrr-rrrrrs




	rN)Zsos.report.pluginsrrrrrrrr�<module>	s