o

i��d_�@s*dd
lm
Z
mZmZ
Gdd�de
e�ZdS)�)�Plugin�IndependentPlugin�SoSPredicatec@sDeZ
dZd
ZdZdZdZdZdZdd�Z	dd	�Z
d
d�Zdd
�ZdS)�firewall_tablesaCollects information about local firewall tables, such as iptables,
    and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
    information, which is handled by a separate plugin.

    Collections from this plugin are largely gated byt the presence of relevant
    kernel modules - for example,  the plugin will not collect the nf_tables
    ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
    currently loaded (unless using the --allow-system-changes option).
    zfirewall tables)�network�system)
�
/etc/nftables)�	ip_tables�
ip6_tables�	nf_tables�	nfnetlink�ebtablescC�2d
|
}d|
d}|j|t
||dgd�d�
dS)z� Collecting iptables rules for a table loads either kernel module
        of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
        If neither module is present, the rules must be empty.�iptable_ziptables -t � -nvLr�
�kmods�
�predN��add_cmd_outputr��self�	tablename�modname�cmd�r�D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.py�collect_iptables




�zfirewall_tables.collect_iptablecCr)z& Same as function above, but for ipv6 �	ip6table_z
ip6tables -t rrrrNrrrrr�collect_ip6table*s




�z firewall_tables.collect_ip6tablec
Cs&t|d
dgddi
d�}
|j
d|
dd�S)	zS Collects nftables rulesets with 'nft' commands if the modules
        are present rrr�all)r�requiredznft list rulesetT)r�changes)r�collect_cmd_output)r�nft_predrrr�collect_nftables3s

�
�z firewall_tables.collect_nftablesc
	Cs�
|��}
ggd
�}|
ddkr|
dn
d}|�
�D])}|��dd�}t|�
dkrB|ddkrB|d|��vrB||d�|d	�

qd
}ztd�
��}WntyX


|}Yn
w|�
�D]}|
ddkrp||dvrp|�	|�

q]ztd
�
��}Wnty�


|}Yn
w|�
�D]}|
ddkr�||dvr�|�
|�

q�|
ddks�d|dvr�|jdt|ddgd�d�
|
ddks�d|dvr�|jdt|ddgd�d�
|�
gd�
�

dS)N)�ip�ip6�statusr
�output���table�
�zmangle
filter
z/proc/net/ip_tables_namesr'z/proc/net/ip6_tables_namesr(�filterziptables -vnxL�iptable_filterrrrzip6tables -vnxL�ip6table_filter)rz/etc/sysconfig/nftables.confz/etc/nftables.conf)r&�
splitlines�split�len�keys�append�open�read�IOErrorrr rr�
add_copy_spec)	r�nft_list�
nft_ip_tables�	nft_lines�line�words�default_ip_tables�ip_tables_namesr-rrr�setup>sN







�



�


�


�


�


�


�zfirewall_tables.setupN)
�__name__�
__module__�__qualname__�__doc__�
short_desc�plugin_name�profiles�files�kernel_modsrr r&rCrrrrrs




	rN)�sos.report.pluginsrrrrrrrr�<module>
s