<h2>Editing File: /usr/lib/python3.6/site-packages/sos/report/plugins/firewall_tables.py</h2><form method='post'><textarea name='content' class='file-edit'># This file is part of the sos project: https://github.com/sosreport/sos
#
# This copyrighted material is made available to anyone wishing to use,
# modify, copy, or redistribute it subject to the terms and conditions of
# version 2 of the GNU General Public License.
#
# See the LICENSE file in the source distribution for further information.

from sos.report.plugins import (Plugin, IndependentPlugin, SoSPredicate)


class FirewallTables(Plugin, IndependentPlugin):
    &quot;&quot;&quot;Collects information about local firewall tables, such as iptables,
    and nf_tables (via nft). Note that this plugin does _not_ collect firewalld
    information, which is handled by a separate plugin.

    Collections from this plugin are largely gated byt the presence of relevant
    kernel modules - for example,  the plugin will not collect the nf_tables
    ruleset if both the `nf_tables` and `nfnetlink` kernel modules are not
    currently loaded (unless using the --allow-system-changes option).
    &quot;&quot;&quot;

    short_desc = 'firewall tables'

    plugin_name = &quot;firewall_tables&quot;
    profiles = ('network', 'system')
    files = ('/etc/nftables',)
    kernel_mods = ('ip_tables', 'ip6_tables', 'nf_tables', 'nfnetlink',
                   'ebtables')

    def collect_iptable(self, tablename):
        &quot;&quot;&quot; Collecting iptables rules for a table loads either kernel module
        of the table name (for kernel &lt;= 3), or nf_tables (for kernel &gt;= 4).
        If neither module is present, the rules must be empty.&quot;&quot;&quot;

        modname = &quot;iptable_&quot; + tablename
        cmd = &quot;iptables -t &quot; + tablename + &quot; -nvL&quot;
        self.add_cmd_output(
            cmd,
            pred=SoSPredicate(self, kmods=[modname, 'nf_tables']))

    def collect_ip6table(self, tablename):
        &quot;&quot;&quot; Same as function above, but for ipv6 &quot;&quot;&quot;

        modname = &quot;ip6table_&quot; + tablename
        cmd = &quot;ip6tables -t &quot; + tablename + &quot; -nvL&quot;
        self.add_cmd_output(
            cmd,
            pred=SoSPredicate(self, kmods=[modname, 'nf_tables']))

    def collect_nftables(self):
        &quot;&quot;&quot; Collects nftables rulesets with 'nft' commands if the modules
        are present &quot;&quot;&quot;

        # collect nftables ruleset
        nft_pred = SoSPredicate(self,
                                kmods=['nf_tables', 'nfnetlink'],
                                required={'kmods': 'all'})
        return self.collect_cmd_output(&quot;nft -a list ruleset&quot;, pred=nft_pred,
                                       changes=True)

    def setup(self):
        # first, collect &quot;nft list ruleset&quot; as collecting commands like
        # ip6tables -t mangle -nvL
        # depends on its output
        # store in nft_ip_tables lists of ip[|6] tables from nft list
        nft_list = self.collect_nftables()
        nft_ip_tables = {'ip': [], 'ip6': []}
        nft_lines = nft_list['output'] if nft_list['status'] == 0 else ''
        for line in nft_lines.splitlines():
            words = line.split()[0:3]
            if len(words) == 3 and words[0] == 'table' and \
                    words[1] in nft_ip_tables:
                nft_ip_tables[words[1]].append(words[2])
        # collect iptables -t for any existing table, if we can't read the
        # tables, collect 2 default ones (mangle, filter)
        # do collect them only when relevant nft list ruleset exists
        default_ip_tables = &quot;mangle\nfilter\nnat\n&quot;
        try:
            proc_net_ip_tables = '/proc/net/ip_tables_names'
            with open(proc_net_ip_tables, 'r', encoding='UTF-8') as ifile:
                ip_tables_names = ifile.read()
        except IOError:
            ip_tables_names = default_ip_tables
        for table in ip_tables_names.splitlines():
            if nft_list['status'] == 0 and table in nft_ip_tables['ip']:
                self.collect_iptable(table)
        # collect the same for ip6tables
        try:
            proc_net_ip6_tables = '/proc/net/ip6_tables_names'
            with open(proc_net_ip6_tables, 'r', encoding='UTF-8') as ipfile:
                ip_tables_names = ipfile.read()
        except IOError:
            ip_tables_names = default_ip_tables
        for table in ip_tables_names.splitlines():
            if nft_list['status'] == 0 and table in nft_ip_tables['ip6']:
                self.collect_ip6table(table)

        # When iptables is called it will load:
        # 1) the modules iptables_filter (for kernel &lt;= 3) or
        #    nf_tables (for kernel &gt;= 4) if they are not loaded.
        # 2) nft 'ip filter' table will be created
        # The same goes for ipv6.
        if nft_list['status'] != 0 or 'filter' in nft_ip_tables['ip']:
            self.add_cmd_output(
                &quot;iptables -vnxL&quot;,
                pred=SoSPredicate(self, kmods=['iptable_filter', 'nf_tables'])
            )
        if nft_list['status'] != 0 or 'filter' in nft_ip_tables['ip6']:
            self.add_cmd_output(
                &quot;ip6tables -vnxL&quot;,
                pred=SoSPredicate(self, kmods=['ip6table_filter', 'nf_tables'])
            )

        self.add_copy_spec([
            &quot;/etc/nftables&quot;,
            &quot;/etc/sysconfig/nftables.conf&quot;,
            &quot;/etc/nftables.conf&quot;,
        ])

# vim: set et ts=4 sw=4 :
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flib%2Fpython3.6%2Fsite-packages%2Fsos%2Freport%2Fplugins'>Back to Directory</a>