我试图firewalld通过Pythondbus模块进行控制。
firewalld
dbus
我想为当前的运行时以及永久配置添加一个IP地址到受信任的区域。
以下firewalld是dbus界面的文档:http : //manpages.ubuntu.com/manpages/wily/man5/firewalld.dbus.5.html
什么有效:运行时配置
我可以将其添加到运行时配置中:
def trustIP(ip): ''' firewalld must already be running ''' from dbus import SystemBus bus = SystemBus() runtimeProxy = bus.get_object('org.fedoraproject.FirewallD1', '/org/fedoraproject/FirewallD1') runtimeProxy.addSource('trusted', ip)
很简单
什么不起作用:永久配置
事实证明,将其添加到永久配置中比较困难。到目前为止,我已经尝试过以下方式:
>>> from dbus import SystemBus >>> bus = SystemBus() # First I need to find out which object is for the trusted zone... >>> config = bus.get_object('org.fedoraproject.FirewallD1', '/org/fedoraproject/FirewallD1/config') >>> config.getZoneByName('trusted') dbus.ObjectPath('/org/fedoraproject/FirewallD1/config/zone/7') >>> permanentProxy = bus.get_object('org.fedoraproject.FirewallD1', '/org/fedoraproject/FirewallD1/config/zone/7') # A quick check to make sure I have the right object: >>> permanentProxy.getShort() dbus.String(u'Trusted') # Exactly what I expected, so move on and... >>> permanentProxy.addSource('aaa.xxx.yyy.zzz') # Actual ip removed... Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) dbus.exceptions.DBusException: org.freedesktop.DBus.Python.dbus.exceptions.DBusException: dbus_to_python() takes exactly 1 argument (2 given)
我还尝试了检查permanentProxy.getDescription(),该检查返回了应有的描述,并且尝试permanentProxy.setDescription('test')了失败,并且堆栈跟踪与完全相同permanentProxy.addSource('aaa.xxx.yyy.zzz')。
permanentProxy.getDescription()
permanentProxy.setDescription('test')
permanentProxy.addSource('aaa.xxx.yyy.zzz')
我会得出一个结论,即该错误位于pythondbus模块中,并假定它以某种方式无法正确处理参数,除了runtimeProxy.addSource('trusted', ip)涉及两个参数且可以正常工作的事实。config.getZoneByName('trusted')甚至具有与永久代理.addSource(’aaa.xxx.yyy.zzz’)`相同的签名,并且只有一个字符串,并且可以完美地工作。
runtimeProxy.addSource('trusted', ip)
config.getZoneByName('trusted')
所以也许我缺少某种奇怪的东西?但是我不知道那会是什么…
我尝试过的更多东西没有成功
我考虑了可能完全addSource不使用字符串参数调用并且可能以某种方式咖喱的可能性,因此我尝试了以下方法:
addSource
>>> permanentProxy.addSource() Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) dbus.exceptions.DBusException: org.freedesktop.DBus.Python.TypeError: Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/slip/dbus/service.py", line 123, in reply_handler result = method(self, *p, **k) TypeError: addSource() takes at least 2 arguments (2 given)
现在这甚至更奇怪了。我在另一个回溯中有一个回溯,坚持我需要传递至少两个参数,还说我给了它两个参数(实际上我只给了一个,所以怎么样想出两个吗?)
我尝试过的一些尝试均未成功:
>>> permanentProxy.addSource(dbus_interface='org.fedoraproject.FirewallD1.config.zone') ERROR:dbus.connection:Unable to set arguments () according to signature u's': <type 'exceptions.TypeError'>: More items found in D-Bus signature than in Python arguments Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 641, in call_blocking message.append(signature=signature, *args) TypeError: More items found in D-Bus signature than in Python arguments >>> permanentProxy.addSource('aaa.xxx.yyy.zzz', dbus_interface='org.fedoraproject.FirewallD1.config.zone') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) dbus.exceptions.DBusException: org.freedesktop.DBus.Python.dbus.exceptions.DBusException: dbus_to_python() takes exactly 1 argument (2 given) >>> from dbus import Interface >>> Interface(permanentProxy, 'org.fedoraproject.FirewallD1.config.zone').addSource('aaa.xxx.yyy.zzz') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib64/python2.7/site-packages/dbus/proxies.py", line 145, in __call__ **keywords) File "/usr/lib64/python2.7/site-packages/dbus/connection.py", line 651, in call_blocking message, timeout) dbus.exceptions.DBusException: org.freedesktop.DBus.Python.dbus.exceptions.DBusException: dbus_to_python() takes exactly 1 argument (2 given)
加!
这确实看起来像是一个错误dbus……某种程度上,它最初是错误地解决了,addSource并认为它需要更少的参数,但是如果给它更少的参数,它将通过错误的检查,然后正确地解决并失败,因为您的参数不匹配。
无论如何,这是我的理论。有人看到我没有的东西吗?如果确实存在此错误,有什么办法可以解决此错误?IE …我可以在dbus上使用某种内部方法来强制它调用正确的方法吗?
以下对我有用:
>>> import dbus >>> bus = dbus.SystemBus() >>> config = bus.get_object('org.fedoraproject.FirewallD1', ... '/org/fedoraproject/FirewallD1/config') >>> path = config.getZoneByName('trusted') >>> zone = bus.get_object('org.fedoraproject.FirewallD1', path) >>> zone.addSource('192.168.1.0/24')
此时,如果查看/etc/firewalld/zones/trusted.xml,可以看到已按预期添加了源地址:
/etc/firewalld/zones/trusted.xml
<?xml version="1.0" encoding="utf-8"?> <zone target="ACCEPT"> <short>Trusted</short> <description>All network connections are accepted.</description> <interface name="docker0"/> <interface name="virbr0"/> <source address="192.168.1.0/24"/> </zone>
…表明我已经成功更改了持久配置。
如果我在第二个get_object调用中使用文字路径,而不是中的返回值,则以上内容也适用config.getZoneByName。
get_object
config.getZoneByName
为了它的价值,我正在跑步:
更新
您没有看到任何新内容,因为您使用的是CentOS,而不是Fedora。解决此特定任务的最简单方法似乎是使用firewallFirewallD随附的python模块。以下内容适用于CentOS 7:
firewall
>>> from firewall.client import * >>> client = FirewallClient() >>> zone = client.config().getZoneByName('public') >>> settings = zone.getSettings() >>> settings.addSource('192.168.1.0/24') >>> zone.update(settings)
另一个更新
浏览源代码到firewall.client模块,您可以通过如下所示的直接dbus进行此操作:
firewall.client
>>> zone = bus.get_object('org.fedoraproject.FirewallD1', path) >>> settings = zone.getSettings() >>> settings[11].append('192.168.20.0/24') >>> zone.update(settings)
这 也 能正常工作下的CentOS ......但你的时候使用更好的firewall模块。