#!/usr/libexec/platform-python -s
# -*- coding: utf-8 -*-
#
# Copyright (C) 2009-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner
# Jiri Popelka
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see .
#
from gi.repository import GObject
import sys
sys.modules['gobject'] = GObject
import argparse
import os
from firewall.client import FirewallClientIPSetSettings, \
FirewallClientZoneSettings, FirewallClientServiceSettings, \
FirewallClientIcmpTypeSettings, FirewallClientHelperSettings, \
FirewallClientPolicySettings
from firewall.errors import FirewallError
from firewall import config
from firewall.core.fw import Firewall
from firewall.functions import joinArgs, splitArgs, getPortRange
from firewall.core.io.functions import check_config
from firewall.core.io.zone import zone_reader
from firewall.core.io.policy import policy_reader
from firewall.core.io.service import service_reader
from firewall.core.io.ipset import ipset_reader
from firewall.core.io.icmptype import icmptype_reader
from firewall.core.io.helper import helper_reader
from firewall.command import FirewallCommand
# check for root user
def assert_root():
if os.getuid() != 0:
sys.stderr.write("You need to be root to run %s.\n" % sys.argv[0])
sys.exit(-1)
SYSTEM_CONFIG_FIREWALL = config.SYSCONFIGDIR + '/system-config-firewall'
def __usage():
sys.stdout.write("""
Usage: firewall-offline-cmd [OPTIONS...]
If no options are given, configuration from '%s' will be migrated.
General Options
-h, --help Prints a short help text and exits
-V, --version Print the version string of firewalld
-q, --quiet Do not print status messages
--system-config Path to firewalld system configuration
--default-config Path to firewalld default configuration
--check-config Check system and default configuration
Lokkit Compatibility Options
--migrate-system-config-firewall=
Import configuration data from the given configuration
file.
--enabled Enable firewall (default)
--disabled Disable firewall
--addmodule= Ignored option, was used to enable an iptables module
--removemodule=
Ignored option, was used to disable an iptables module
-s , --service=
Enable a service in the default zone (example: ssh)
--remove-service=
Disable a service in the default zone (example: ssh)
-p [-]:, --port=[-]:
Enable a port in the default zone (example: ssh:tcp)
-t , --trust=
Bind an interface to the trusted zone
-m , --masq=
Enables masquerading in the default zone, interface
argument is ignored. This is IPv4 only.
--custom-rules=[:][
:]
Ignored option. Was used to add custom rules to the
firewall (Example:
ipv4:filter:%s/ipv4_filter_addon)
--forward-port=if=:port=:proto=[:toport=][:toaddr=]
Forward the port with protocol for the interface to
either another local destination port (no destination
address given) or to an other destination address with
an optional destination port. This will be added to
the default zone. This is IPv4 only.
--block-icmp=
Block this ICMP type in the default zone. The default
is to accept all ICMP types.
Log Denied Options
--get-log-denied Print the log denied value
--set-log-denied=
Set log denied value
Automatic Helpers Options
--get-automatic-helpers
Print the automatic helpers value
--set-automatic-helpers=
Set automatic helpers value
Zone Options
--get-default-zone Print default zone for connections and interfaces
--set-default-zone=
Set default zone
--get-zones Print predefined zones
--get-services Print predefined services
--get-icmptypes Print predefined icmptypes
--get-zone-of-interface=
Print name of the zone the interface is bound to
--get-zone-of-source=[/]||ipset:
Print name of the zone the source is bound to
--list-all-zones List everything added for or enabled in all zones
--new-zone= Add a new empty zone
--new-zone-from-file= [--name=]
Add a new zone from file with optional name override [P only]
--delete-zone= Delete an existing zone
--load-zone-defaults=
Load zone default settings
--zone= Use this zone to set or query options, else default zone
Usable for options marked with [Z]
--info-zone= Print information about a zone
--path-zone= Print file path of a zone
Policy Options
--get-policies Print predefined policies
--list-all-policies List everything added for or enabled in all policies
--new-policy=
Add a new empty policy
--new-policy-from-file= [--name=]
Add a new policy from file with optional name override [P only]
--delete-policy=
Delete an existing policy
--load-policy-defaults=
Load policy default settings
--policy= Use this policy to set or query options
Usable for options marked with [O]
--info-policy=
Print information about a policy
--path-policy=
Print file path of a policy
IPSet Options
--new-ipset= --type= [--option=[=]]..
Add a new empty ipset
--new-ipset-from-file= [--name=]
Add a new ipset from file with optional name override [P only]
--delete-ipset=
Delete an existing ipset
--load-ipset-defaults=
Load ipset default settings
--info-ipset= Print information about an ipset
--path-ipset= Print file path of an ipset
--get-ipsets Print predefined ipsets
--ipset= --set-description=
Set new description to ipset
--ipset= --get-description
Print description for ipset
--ipset= --set-short=
Set new short description to ipset
--ipset= --get-short
Print short description for ipset
--ipset= --add-entry=
Add a new entry to an ipset
--ipset= --remove-entry=
Remove an entry from an ipset
--ipset= --query-entry=
Return whether ipset has an entry
--ipset= --get-entries
List entries of an ipset
--ipset= --add-entries-from-file=
Add a new entries to an ipset
--ipset= --remove-entries-from-file=
Remove entries from an ipset
IcmpType Options
--new-icmptype=
Add a new empty icmptype
--new-icmptype-from-file= [--name=]
Add a new icmptype from file with optional name override [P only]
--delete-icmptype=
Delete an existing icmptype
--load-icmptype-defaults=
Load icmptype default settings
--info-icmptype=
Print information about an icmptype
--path-icmptype=
Print file path of an icmptype
--icmptype= --set-description=
Set new description to icmptype
--icmptype= --get-description
Print description for icmptype
--icmptype= --set-short=
Set new short description to icmptype
--icmptype= --get-short
Print short description for icmptype
--icmptype= --add-destination=
Enable destination for ipv in icmptype
--icmptype= --remove-destination=
Disable destination for ipv in icmptype
--icmptype= --query-destination=
Return whether destination ipv is enabled in icmptype
--icmptype= --get-destinations
List destinations in icmptype
Service Options
--new-service=
Add a new empty service
--new-service-from-file= [--name=]
Add a new service from file with optional name override [P only]
--delete-service=
Delete an existing service
--load-service-defaults=
Load icmptype default settings
--info-service=
Print information about a service
--path-service=
Print file path of a service
--service= --set-description=
Set new description to service
--service= --get-description
Print description for service
--service= --set-short=
Set new short description to service
--service= --get-short
Print short description for service
--service= --add-port=[-]/
Add a new port to service
--service= --remove-port=[-]/
Remove a port from service
--service= --query-port=[-]/
Return whether the port has been added for service
--service= --get-ports
List ports of service
--service= --add-protocol=
Add a new protocol to service
--service= --remove-protocol=
Remove a protocol from service
--service= --query-protocol=
Return whether the protocol has been added for service
--service= --get-protocols
List protocols of service
--service= --add-source-port=[-]/
Add a new source port to service
--service= --remove-source-port=[-]/
Remove a source port from service
--service= --query-source-port=[-]/
Return whether the source port has been added for service [P only]
--service= --get-source-ports
List source ports of service
--service= --add-helper=
Add a new helper to service
--service= --remove-helper=
Remove a helper from service
--service= --query-helper=
Return whether the helper has been added for service
--service= --get-service-helpers
List helpers of service
--service= --set-destination=:[/]
Set destination for ipv to address in service
--service= --remove-destination=
Disable destination for ipv i service
--service= --query-destination=:[/]
Return whether destination ipv is set for service
--service= --get-destinations
List destinations in service
--service= --add-include=
Add a new include to service
--service= --remove-include=
Remove a include from service
--service= --query-include=
Return whether the include has been added for service
--service= --get-includes
List includes of service
Options to Adapt and Query Zones and Policies
--list-all List everything added for or enabled [Z] [O]
--set-description=
Set new description [Z] [O]
--get-description Print description [Z] [O]
--get-target Get the target [Z] [O]
--set-target=
Set the target [Z] [O]
--set-short=
Set new short description to zone [Z] [O]
--get-short Print short description for zone [Z] [O]
--list-services List services added [Z] [O]
--add-service=
Add a service [Z] [O]
--remove-service-from-zone=
Remove a service from a zone [Z]
--remove-service-from-policy=
Remove a service from a policy [O]
--query-service=
Return whether service has been added [Z] [O]
--list-ports List ports added [Z] [O]
--add-port=[-]/
Add the port [Z] [O]
--remove-port=[-]/
Remove the port [Z] [O]
--query-port=[-]/
Return whether the port has been added [Z] [O]
--list-protocols List protocols added [Z] [O]
--add-protocol=
Add the protocol [Z] [O]
--remove-protocol=
Remove the protocol [Z] [O]
--query-protocol=
Return whether the protocol has been added [Z] [O]
--list-source-ports List source ports added [Z] [O]
--add-source-port=[-]/
Add the source port [Z] [O]
--remove-source-port=[-]/
Remove the source port [Z] [O]
--query-source-port=[-]/
Return whether the source port has been added [Z] [O]
--list-icmp-blocks List Internet ICMP type blocks added [Z] [O]
--add-icmp-block=
Add an ICMP block [Z] [O]
--remove-icmp-block=
Remove the ICMP block [Z] [O]
--query-icmp-block=
Return whether an ICMP block has been added [Z] [O]
--list-forward-ports List IPv4 forward ports added [Z] [O]
--add-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=[/]]
Add the IPv4 forward port [Z] [O]
--remove-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=[/]]
Remove the IPv4 forward port [Z] [O]
Options to Adapt and Query Zones
--add-icmp-block-inversion
Enable inversion of icmp blocks for a zone [Z]
--remove-icmp-block-inversion
Disable inversion of icmp blocks for a zone [Z]
--query-icmp-block-inversion
Return whether inversion of icmp blocks has been enabled
for a zone [Z]
--add-forward Enable forwarding of packets between interfaces and
sources in a zone [Z]
--remove-forward Disable forwarding of packets between interfaces and
sources in a zone [Z]
--query-forward Return whether forwarding of packets between interfaces
and sources has been enabled for a zone [Z]
Options to Adapt and Query Policies
--get-priority Get the priority [O]
--set-priority=
Set the priority [O]
--list-ingress-zones
List ingress zones that are bound to a policy [O]
--add-ingress-zone=
Add the ingress zone to a policy [O]
--remove-ingress-zone=
Remove the ingress zone from a policy [O]
--query-ingress-zone=
Query whether the ingress zone has been adedd to a
policy [O]
--list-egress-zones
List egress zones that are bound to a policy [O]
--add-egress-zone=
Add the egress zone to a policy [O]
--remove-egress-zone=
Remove the egress zone from a policy [O]
--query-egress-zone=
Query whether the egress zone has been adedd to a
policy [O]
Options to Handle Bindings of Interfaces
--list-interfaces List interfaces that are bound to a zone [Z]
--add-interface=
Bind the to a zone [Z]
--change-interface=
Change zone the is bound to [Z]
--query-interface=
Query whether is bound to a zone [Z]
--remove-interface=
Remove binding of from a zone [Z]
Options to Handle Bindings of Sources
--list-sources List sources that are bound to a zone [Z]
--add-source=[/]||ipset:
Bind the source to a zone [Z]
--change-source=[/]||ipset:
Change zone the source is bound to [Z]
--query-source=[/]||ipset:
Query whether the source is bound to a zone [Z]
--remove-source=[/]||ipset:
Remove binding of the source from a zone [Z]
Helper Options
--new-helper= --module= [--family=]
Add a new helper
--new-helper-from-file= [--name=]
Add a new helper from file with optional name
--delete-helper=
Delete an existing helper
--load-helper-defaults=
Load helper default settings
--info-helper= Print information about an helper
--path-helper=