U
    -_gC                     @   s*   d dl mZmZmZ G dd deeZdS )    )PluginIndependentPluginSoSPredicatec                   @   sD   e Zd ZdZdZdZdZdZdZdd Z	d	d
 Z
dd Zdd ZdS )FirewallTablesa   Collects information about local firewall tables, such as iptables,
    and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
    information, which is handled by a separate plugin.

    Collections from this plugin are largely gated byt the presence of relevant
    kernel modules - for example,  the plugin will not collect the nf_tables
    ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
    currently loaded (unless using the --allow-system-changes option).
    zfirewall tablesZfirewall_tables)Znetworksystem)/etc/nftables)Z	ip_tablesZ
ip6_tables	nf_tables	nfnetlinkZebtablesc                 C   s2   d| }d| d }| j |t| |dgdd dS )z Collecting iptables rules for a table loads either kernel module
        of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
        If neither module is present, the rules must be empty.Ziptable_ziptables -t  -nvLr   kmodspredNadd_cmd_outputr   selfZ	tablenamemodnamecmd r   D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.pycollect_iptable   s    zFirewallTables.collect_iptablec                 C   s2   d| }d| d }| j |t| |dgdd dS )z& Same as function above, but for ipv6 Z	ip6table_zip6tables -t r
   r   r   r   Nr   r   r   r   r   collect_ip6table*   s    zFirewallTables.collect_ip6tablec                 C   s&   t | ddgddid}| jd|ddS )	zS Collects nftables rulesets with 'nft' commands if the modules
        are present r   r	   r   all)r   Zrequiredznft -a list rulesetT)r   Zchanges)r   Zcollect_cmd_output)r   Znft_predr   r   r   collect_nftables3   s    zFirewallTables.collect_nftablesc              	   C   s  |   }g g d}|d dkr&|d nd}| D ]N}| dd }t|dkr2|d dkr2|d |kr2||d  |d	  q2d
}z*d}t|ddd}| }	W 5 Q R X W n tk
r   |}	Y nX |	 D ]&}
|d dkr|
|d kr| |
 qz*d}t|ddd}| }	W 5 Q R X W n tk
r>   |}	Y nX |	 D ],}
|d dkrH|
|d krH| 	|
 qH|d dksd|d kr| j
dt| ddgdd |d dksd|d kr| j
dt| ddgdd | dddg d S )N)ipip6Zstatusr   output    table      zmangle
filter
nat
z/proc/net/ip_tables_namesrzUTF-8)encodingr   z/proc/net/ip6_tables_namesr   filterziptables -vnxLZiptable_filterr   r   r   zip6tables -vnxLZip6table_filterr   z/etc/sysconfig/nftables.confz/etc/nftables.conf)r   
splitlinessplitlenappendopenreadIOErrorr   r   r   r   Zadd_copy_spec)r   Znft_listZnft_ip_tablesZ	nft_lineslineZwordsZdefault_ip_tablesZproc_net_ip_tablesZifileZip_tables_namesr    Zproc_net_ip6_tablesZipfiler   r   r   setup>   sV    



zFirewallTables.setupN)__name__
__module____qualname____doc__Z
short_descZplugin_nameZprofilesfilesZkernel_modsr   r   r   r.   r   r   r   r   r      s   
	r   N)Zsos.report.pluginsr   r   r   r   r   r   r   r   <module>	   s   