o
    *b                     @   s*   d dl mZmZmZ G dd deeZdS )    )PluginIndependentPluginSoSPredicatec                   @   s8   e Zd ZdZd ZdZdd Zdd Zdd Zd	d
 Z	dS )firewall_tableszfirewall tables)Znetworksystemc                 C   2   d| }d| d }| j |t| |dgdd dS )z Collecting iptables rules for a table loads either kernel module
        of the table name (for kernel <= 3), or nf_tables (for kernel >= 4).
        If neither module is present, the rules must be empty.Ziptable_ziptables -t  -nvL	nf_tableskmodspredNadd_cmd_outputr   selfZ	tablenamemodnamecmd r   D/usr/lib/python3/dist-packages/sos/report/plugins/firewall_tables.pycollect_iptable   s   
zfirewall_tables.collect_iptablec                 C   r   )z& Same as function above, but for ipv6 Z	ip6table_zip6tables -t r   r	   r
   r   Nr   r   r   r   r   collect_ip6table   s   
z firewall_tables.collect_ip6tablec                 C   s&   t | ddgddid}| jd|ddS )	zS Collects nftables rulesets with 'nft' commands if the modules
        are present r	   Z	nfnetlinkr   all)r   requiredznft list rulesetT)r   Zchanges)r   Zcollect_cmd_output)r   Znft_predr   r   r   collect_nftables'   s   z firewall_tables.collect_nftablesc           	      C   s  |   }g g d}|d dkr|d nd}| D ])}| dd }t|dkrB|d dkrB|d | v rB||d  |d	  qd
}ztd }W n tyX   |}Y nw | D ]}|d dkrp||d v rp| 	| q]ztd }W n ty   |}Y nw | D ]}|d dkr||d v r| 
| q|d dksd|d v r| jdt| ddgdd |d dksd|d v r| jdt| ddgdd | g d d S )N)ipip6statusr   output    table      zmangle
filter
z/proc/net/ip_tables_namesr   z/proc/net/ip6_tables_namesr   filterziptables -vnxLZiptable_filterr	   r
   r   zip6tables -vnxLZip6table_filter)z/etc/nftablesz/etc/sysconfig/nftables.confz/etc/nftables.conf)r   
splitlinessplitlenkeysappendopenreadIOErrorr   r   r   r   Zadd_copy_spec)	r   Znft_listZnft_ip_tablesZ	nft_lineslineZwordsZdefault_ip_tablesZip_tables_namesr!   r   r   r   setup2   sP   


zfirewall_tables.setupN)
__name__
__module____qualname__Z
short_descZplugin_nameZprofilesr   r   r   r.   r   r   r   r   r      s    	r   N)Zsos.report.pluginsr   r   r   r   r   r   r   r   <module>   s   