← Back
Editing: firewall_tables.cpython-312.pyc
� ܓ�iC � �0 � d dl mZmZmZ G d� dee� Zy)� )�Plugin�IndependentPlugin� SoSPredicatec �< � e Zd ZdZdZdZdZdZdZd� Z d� Z d � Z d � Z y ) �FirewallTablesa Collects information about local firewall tables, such as iptables, and nf_tables (via nft). Note that this plugin does _not_ collect firewalld information, which is handled by a separate plugin. Collections from this plugin are largely gated byt the presence of relevant kernel modules - for example, the plugin will not collect the nf_tables ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not currently loaded (unless using the --allow-system-changes option). zfirewall tables�firewall_tables)�network�system)� /etc/nftables)� ip_tables� ip6_tables� nf_tables� nfnetlink�ebtablesc �^ � d|z }d|z dz }| j |t | |dg�� �� y)z� Collecting iptables rules for a table loads either kernel module of the table name (for kernel <= 3), or nf_tables (for kernel >= 4). If neither module is present, the rules must be empty.�iptable_z iptables -t � -nvLr ��kmods��predN��add_cmd_outputr ��self� tablename�modname�cmds �G/usr/lib/python3.12/site-packages/sos/report/plugins/firewall_tables.py�collect_iptablez FirewallTables.collect_iptable sC � � �y�(�� �y�(�7�2�� ��� � �d�7�K�*@�A� � C� c �^ � d|z }d|z dz }| j |t | |dg�� �� y)z& Same as function above, but for ipv6 � ip6table_z ip6tables -t r r r r Nr r s r �collect_ip6tablez FirewallTables.collect_ip6table* sC � � � �)�� � �)�G�3�� ��� � �d�7�K�*@�A� � Cr! c �N � t | ddgddi�� }| j d|d�� S ) zS Collects nftables rulesets with 'nft' commands if the modules are present r r r �all)r �requiredznft -a list rulesetT)r �changes)r �collect_cmd_output)r �nft_preds r �collect_nftablesz FirewallTables.collect_nftables3 sB � � ��'2�K�&@�*1�5�)9�;�� �&�&�'<�8�/3� '� 5� 5r! c �� � | j � }g g d�}|d dk( r|d nd}|j � D ]O }|j � dd }t |� dk( s�%|d dk( s�.|d |v s�6||d j |d � �Q d } d }t |d d �� 5 }|j � } d d d � j � D ]$ } |d dk( s� | |d v s�| j | � �& d} t | d d �� 5 } | j � } d d d � | j � D ]$ } |d dk( s� | |d v s�| j | � �& |d dk7 sd|d v r | j dt | ddg�� �� |d dk7 sd|d v r | j dt | ddg�� �� | j g d�� y # 1 sw Y ��xY w# t $ r |} Y ��%w xY w# 1 sw Y ��xY w# t $ r |} Y ��w xY w)N)�ip�ip6�statusr �output� � �table� � zmangle filter nat z/proc/net/ip_tables_names�rzUTF-8)�encodingr- z/proc/net/ip6_tables_namesr. �filterziptables -vnxL�iptable_filterr r r zip6tables -vnxL�ip6table_filter)r z /etc/sysconfig/nftables.confz/etc/nftables.conf) r+ � splitlines�split�len�append�open�read�IOErrorr r$ r r � add_copy_spec) r �nft_list� nft_ip_tables� nft_lines�line�words�default_ip_tables�proc_net_ip_tables�ifile�ip_tables_namesr3 �proc_net_ip6_tables�ipfiles r �setupzFirewallTables.setup> s> � � �(�(�*�� !�"�-� �*2�8�*<��*A�H�X�&�r� � �(�(�*�D��J�J�L��1�%�E��5�z�Q��5��8�w�#6��!�H� �-� �e�A�h�'�.�.�u�Q�x�8� +� 4�� 0�!<� ��(�#��@�E�"'�*�*�,�� A� %�/�/�1�E���!�Q�&�5�M�$�4G�+G��$�$�U�+� 2� 0�">� ��)�3��A�V�"(�+�+�-�� B� %�/�/�1�E���!�Q�&�5�M�%�4H�+H��%�%�e�,� 2� �H� �� "�h�-��2E�&E� � � � �!�$�/?��.M�N� � � �H� �� "�h�-��2F�&F� � � �!�!�$�/@�+�.N�O� � � ��� � �E A�@��� 0� /�O� 0�� B�A��� 0� /�O� 0�sT � G �F=�+G �+G( �;G � G( �=G�G � G�G� G%�!G( �( G6�5G6N) �__name__� __module__� __qualname__�__doc__� short_desc� plugin_name�profiles�files� kernel_modsr r$ r+ rN � r! r r r s: � �� #�J�#�K�$�H� �E� �K� C�C� 5�9 r! r N)�sos.report.pluginsr r r r rX r! r �<module>rZ s �� I� H�k �V� .� k r!
Save File
Cancel