🔐 Sid Gifari File Manager Pro
v8.0.5 | 2026-06-14 14:34:07 | PHP 8.1.34
📂
/ (Root)
/
usr
/
lib
/
python3.9
/
site-packages
/
firewall
/
core
/
__pycache__
📍 /usr/lib/python3.9/site-packages/firewall/core/__pycache__
🔄 Refresh
✏️
Editing: fw_policy.cpython-39.pyc
Read Only
a ��iD# � @ s� d dl Z d dlmZ d dlmZmZmZmZmZm Z m Z m Z m Z m Z mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" G d d � d e#�Z$dS ) � N)�log) �portStr� checkIPnMask� checkIP6nMask� checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange�checkTcpMssClamp) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock� Rich_IcmpType�Rich_Tcp_Mss_Clamp)�FirewallTransaction)�errors)� FirewallError)�SOURCE_IPSET_TYPESc @ sv e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z d�dd�Z dd� Z�d dd�Z�dd d �Z�dd d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Z�dd*d+�Zd,d-� Z�dd.d/�Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z �dd:d;�Z d<d=� Z �dd>d?�Z d@dA� Z!dBdC� Z"dDdE� Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'�ddNdO�Z(dPdQ� Z)�ddRdS�Z*dTdU� Z+dVdW� Z,dXdY� Z-dZd[� Z.d\d]� Z/�d d^d_�Z0d`da� Z1�d dbdc�Z2ddde� Z3dfdg� Z4dhdi� Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9�d drds�Z:dtdu� Z;�d dvdw�Z<dxdy� Z=dzd{� Z>d|d}� Z?d~d� Z@d�d�� ZAd�d�� ZB�d d�d��ZCd�d�� ZD�dd�d��ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZI�dd�d��ZJd�d�� ZK�dd�d��ZLd�d�� ZMd�d�� ZNd�d�� ZO�dd�d��ZPd�d�� ZQ�dd�d��ZRd�d�� ZSd�d�� ZT�dd�d��ZU�dd�d��ZV�dd�d��ZWd�d�� ZX�dd�d��ZYd�d�� ZZ�dd�d��Z[d�d�� Z\d�d�� Z]d�d�� Z^�dd�d��Z_d�d�� Z`�dd�d��Zad�dÄ Zbd�dń Zcd�dDŽ Zd�dd�dɄZed�d˄ Zfd�d̈́ Zg�dd�dτZhd�dф Zid�dӄ Zjd�dՄ Zkd�dׄ Zld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zq�d d�d�Zr�d d�d�Zsd�d� Ztd�d� Zud�d� Zvd�d� Zw�d d�d�Zxd�d� Zyd�d� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~�d d�d��ZdS ( �FirewallPolicyc C s || _ i | _i | _d S �N)�_fw�_chains� _policies)�self�fw� r$ �;/usr/lib/python3.9/site-packages/firewall/core/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r! �r" r$ r$ r% �__repr__ s zFirewallPolicy.__repr__c C s | j �� | j�� d S r )r �clearr! r( r$ r$ r% �cleanup s zFirewallPolicy.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r" �tr$ r$ r% �new_transaction$ s z FirewallPolicy.new_transactionc C s t | j�� �S r )�sortedr! �keysr( r$ r$ r% � get_policies+ s zFirewallPolicy.get_policiesc C s4 g }| � � D ] }| �|�}|js |�|� q t|�S r )r1 � get_policy�derived_from_zone�appendr/ )r" �policies�p�p_objr$ r$ r% �"get_policies_not_derived_from_zone. s z1FirewallPolicy.get_policies_not_derived_from_zonec C sv g }| � � D ]d}| �|�}t|j�t| jj�� �tddg�B @ r t|j�t| jj�� �tddg�B @ r |�|� q |S )N�HOST�ANY) r8 r2 �set� ingress_zonesr �zoneZget_active_zones� egress_zonesr4 )r" Zactive_policies�policyr7 r$ r$ r% �)get_active_policies_not_derived_from_zone6 s &$� z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j �|�}| j| S r )r � check_policyr! )r" r? r6 r$ r$ r% r2 @ s zFirewallPolicy.get_policyc C s || j |j< d S r )r! �name)r" �objr$ r$ r% � add_policyD s zFirewallPolicy.add_policyc C s& | j | }|jr| �|� | j |= d S r )r! �applied�unapply_policy_settings)r" r? rC r$ r$ r% � remove_policyG s z FirewallPolicy.remove_policyNc C sJ | � � D ]<}| j| }|jr q|| �� v rt�d|� | j||d� qd S )NzApplying policy '%s'��use_transaction)r1 r! r3 r@ r Zdebug1�apply_policy_settings)r" rI r? r7 r$ r$ r% �apply_policiesM s z FirewallPolicy.apply_policiesc C s | j | }||_d S r )r! rE )r" r? rE rC r$ r$ r% �set_policy_appliedV s z!FirewallPolicy.set_policy_appliedc C sz | j �|�}| j| }|r |js*|s.|js.d S |r8d|_|d u rJ| �� }n|}|r�|jsb| �|�n| �|�D ]\}}| �|d|||� ql|js�| � |||� dD �]x} t | � |�| �} t | t �r�|r�| s�|s�| s�q�| g} | D �]:} | dkr�| �||| |� q�| dk�r q�q�| dk�r,| j|||g| �R � q�| dk�rH| �||| |� q�| dk�rn| �||| d | d |� q�| d k�r�| �||| |� q�| d k�r�| �||| d | d |� q�| d k�r�| �|||� q�| d k�r�| �||t| d�|� q�| dk�r�q�q�| dk�rq�q�t�d|| | � q�q�|�sb|j�s4| �|�n| �|�D ] \}}| �|d|||� �q>d|_|d u �rv|�|� d S )NT) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks� rules_str� protocols�icmp_block_inversionr< r> rR rU rP rM rN r � rT rQ rO rS ��rule_strr< r> z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rA r! rE r. r3 �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rules�_ingress_egress_zones�getattrr2 � isinstance�bool� _icmp_block� _forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler r �warning�execute) r" �enabler? rI �_policyrC � transaction�table�chain�keyZ args_list�argsr$ r$ r% �_policy_settingsZ s� � � � � � �� z FirewallPolicy._policy_settingsc C s | j d||d� d S )NTrH �rq �r" r? rI r$ r$ r% rJ � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NFrH rr rs r$ r$ r% rF � s z&FirewallPolicy.unapply_policy_settingsc C s | � |��� S r )r2 Zexport_config_dict�r" r? r$ r$ r% � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d � �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j �j f||f�j �j f�j�jf�j�jf�j�jfd� }��|�}t�|�}|�|�j�� � �j�d|gi� ��|�} �j�| |�\} } | D ]n} t | | t ��rF| | D ]>} t | t ��r.|| d |g| �R � n|| d || � �qq�|| d |� q�| D ]�} t | | t ��r�| | D ]L} t | t ��r�|| d |g| �R d|d �� n|| d || d|d � �qxn|| d |d|d � �q\d S ) Nr )r c s �j | � |d�d|d� d S )NrW r ��timeout�sender)�add_rule)r? rX rw rx �r r" r$ r% �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �� | � |d�� d S )NrW )� remove_rule)r? rX rz r$ r% �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper) rM rN rR rO rP Z rich_rulesrT rQ r< r> r5 rV rv )r N) �firewall.core.richr � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_protocol�remove_protocol�add_source_port�remove_source_port�add_ingress_zone�remove_ingress_zone�add_egress_zone�remove_egress_zoner2 �copyZimport_config_dictr Zget_all_io_objects_dictr, ru Z get_added_and_removed_settingsr^ �list�tuple)r" r? Zsettingsrx r{ r} Z setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsro rp r$ rz r% � set_config_with_settings_dict� sD � " z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dvr"| j�|� d S �N)r9 r: �r r Z INVALID_ZONEr Z check_zone�r" r= r$ r$ r% �check_ingress_zone� s z!FirewallPolicy.check_ingress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__ingress_zone_id� s z FirewallPolicy.__ingress_zone_idr Tc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| � � } n|} |r�|j r�| � d|| � | � || ||� | �| j|| � |j s�|| �� v r�| j|| d� | �| j|d� n| � d|| � n | � || ||� | �| j|| � |d u �r| �d� d S �N�'%s' already in '%s'FrH T)r rA � check_timeout� check_panicr! � _FirewallPolicy__ingress_zone_idr< r r �ALREADY_ENABLEDr. rE r\ �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner@ rJ rL ri � r" r? r= rw rx rI Z allow_applyrk �_obj�zone_idrl r$ r$ r% r� � s4 � z FirewallPolicy.add_ingress_zonec C s |j �|� d S r )r< r4 �r" r� r� rw rx r$ r$ r% Z__register_ingress_zone s z&FirewallPolicy.__register_ingress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j r�t |j�dkr�| � ||� n| � d||� | �||� |�| j||d d � || �� v r�| � d||� n|�| j||� |d u r�|�d� |S �N�'%s' not in '%s'rV FT)r rA r� r! r� r< r r � NOT_ENABLEDr. rE �lenrF r\ r� r� r� r@ �add_postri �r" r? r= rI rk r� r� rl r$ r$ r% r� s. � z"FirewallPolicy.remove_ingress_zonec C s ||j v r|j �|� d S r )r< �remove�r" r� r� r$ r$ r% Z__unregister_ingress_zone4 s z(FirewallPolicy.__unregister_ingress_zonec C s | � |�| �|�jv S r )r� r2 r< �r" r? r= r$ r$ r% �query_ingress_zone8 s z!FirewallPolicy.query_ingress_zonec C s | � |�jS r )r2 r< rt r$ r$ r% �list_ingress_zones; s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dvr"| j�|� d S r� r� r� r$ r$ r% �check_egress_zone@ s z FirewallPolicy.check_egress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__egress_zone_idF s z FirewallPolicy.__egress_zone_idc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| � � } n|} |r�|j r�| � d|| � | � || ||� | �| j|| � |j s�|| �� v r�| j|| d� | �| j|d� n| � d|| � n | � || ||� | �| j|| � |d u �r| �d� d S r� )r rA r� r� r! � _FirewallPolicy__egress_zone_idr> r r r� r. rE r\ �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner@ rJ rL ri r� r$ r$ r% r� J s4 � z FirewallPolicy.add_egress_zonec C s |j �|� d S r )r> r4 r� r$ r$ r% Z__register_egress_zonep s z%FirewallPolicy.__register_egress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j r�t |j�dkr�| � ||� n| � d||� | �||� |�| j||d d � || �� v r�| � d||� n|�| j||� |d u r�|�d� |S r� )r rA r� r! r� r> r r r� r. rE r� rF r\ r� r� r� r@ r� ri r� r$ r$ r% r� s s. � z!FirewallPolicy.remove_egress_zonec C s ||j v r|j �|� d S r )r> r� r� r$ r$ r% Z__unregister_egress_zone� s z'FirewallPolicy.__unregister_egress_zonec C s | � |�| �|�jv S r )r� r2 r> r� r$ r$ r% �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s | � |�jS r )r2 r> rt r$ r$ r% �list_egress_zones� s z FirewallPolicy.list_egress_zonesc C s |� � d S r )�check�r" �ruler$ r$ r% � check_rule� s zFirewallPolicy.check_rulec C s | � |� t|�S r )r� �strr� r$ r$ r% Z __rule_id� s zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| �|j� | �|j� | �|j�S d S )N�ipv4�ipv6�mac� �ipset) �addrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied� _ipset_family)r" �sourcer$ r$ r% �_rule_source_ipv� s z FirewallPolicy._rule_source_ipvc C s | � ||||� d S r )� _rule_prepare)r" rj r? r� rl r$ r$ r% Z__rule� s zFirewallPolicy.__rulec C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S �Nr� T)r rA r� r� r! �_FirewallPolicy__rule_idrS r3 r r r� r. rE rg � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_ruleri ) r" r? r� rw rx rI rk r� �rule_id�_namerl r$ r$ r% ry � s( � zFirewallPolicy.add_rulec C s |j �|� d S r )rS r4 )r" r� r� rw rx r$ r$ r% Z__register_rule� s z FirewallPolicy.__register_rulec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S �Nr� FT)r rA r� r! r� rS r3 r r r� r. rE rg r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r| � s$ � zFirewallPolicy.remove_rulec C s ||j v r|j �|� d S r )rS r� )r" r� r� r$ r$ r% Z__unregister_rule� s z FirewallPolicy.__unregister_rulec C s | � |�| �|�jv S r )r� r2 rS )r" r? r� r$ r$ r% � query_rule� s zFirewallPolicy.query_rulec C s | � |�jS r )r2 rS rt r$ r$ r% � list_rules s zFirewallPolicy.list_rulesc C s | j �|� d S r )r � check_service�r" �servicer$ r$ r% r� s z FirewallPolicy.check_servicec C s | � |� |S r )r� r� r$ r$ r% Z __service_id s zFirewallPolicy.__service_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! �_FirewallPolicy__service_idrM r3 r r r� r. rE rb �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_serviceri ) r" r? r� rw rx rI rk r� � service_idr� rl r$ r$ r% r s( � zFirewallPolicy.add_servicec C s |j �|� d S r )rM r4 )r" r� r� rw rx r$ r$ r% Z__register_service) s z!FirewallPolicy.__register_servicec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r� rM r3 r r r� r. rE rb r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r� , s$ � z FirewallPolicy.remove_servicec C s ||j v r|j �|� d S r )rM r� )r" r� r� r$ r$ r% Z__unregister_serviceG s z#FirewallPolicy.__unregister_servicec C s | � |�| �|�jv S r )r� r2 rM )r" r? r� r$ r$ r% � query_serviceK s z FirewallPolicy.query_servicec C s | � |�jS r )r2 rM rt r$ r$ r% � list_servicesN s z FirewallPolicy.list_servicesc C sN g }|D ]@}z| j j�|�}W n ty< ttj|��Y n0 |�|� q|S r )r �helper� get_helperr r �INVALID_HELPERr4 )r" �helpers�_helpersr� �_helperr$ r$ r% � get_helpers_for_service_helpersQ s z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }|D ]�}z| j j�|�}W n ty< ttj|��Y n0 t|j�dk r�t|j �}z | j j�|�}|� |� W q� ty� |r�t � d| � Y qY q�0 q|� |� q|S )NrV z Helper '%s' is not available) r r� r� r r r� r� rN r �moduler4 r rh )r" �modulesrj r� r� r� �_module_short_namer� r$ r$ r% � get_helpers_for_service_modules[ s" z.FirewallPolicy.get_helpers_for_service_modulesc C s | j �|� | j �|� d S r )r � check_port� check_tcpudp�r" �port�protocolr$ r$ r% r� t s zFirewallPolicy.check_portc C s | � ||� t|d�|fS �N�-�r� r r� r$ r$ r% Z __port_idx s zFirewallPolicy.__port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8} t|| d �rH|j rf|j n|} t t j d|� | f ��qHt |dd� | D ��\} } |d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�| D ] }| �d |t|d�� |� q�| D ]0}| �|� �} | �|| ||� |�| j|| � q�| D ]"}| �|� �} |�| j|| � �q4|d u �rl|�d� |S ) Nc s | d � kS �NrV r$ ��x�r� r$ r% �<lambda>� � z)FirewallPolicy.add_port.<locals>.<lambda>r �'%s:%s' already in '%s'c S s g | ] \}}|�qS r$ r$ ��.0rc rd r$ r$ r% � <listcomp>� r� z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� �filterrN r r3 r r r� r r. rE rc r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� ri �r" r? r� r� rw rx rI rk r� �existing_port_ids�port_idr� � added_ranges�removed_rangesrl �ranger$ r� r% r� | s< � zFirewallPolicy.add_portc C s |j �|� d S r )rN r4 �r" r� r� rw rx r$ r$ r% Z__register_port� s z FirewallPolicy.__register_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u r�| � � } n|} |jr�| D ] } | �d|t| d�� | � q�| D ] } | �d |t| d�� | � q�| D ]0} | �| � �}| �||dd � | �| j||� q�| D ]"} | �| � �}| �| j||� �q,|d u �rd| �d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� � r� z,FirewallPolicy.remove_port.<locals>.<lambda>r �'%s:%s' not in '%s'c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� � r� z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rN r r3 r r r� r r. rE rc r r� r� r� r� r� ri �r" r? r� r� rI rk r� r� r� r� r� r rl r r$ r� r% r� � s< � zFirewallPolicy.remove_portc C s ||j v r|j �|� d S r )rN r� �r" r� r� r$ r$ r% Z__unregister_port� s z FirewallPolicy.__unregister_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS �NTF)r2 rN r �r" r? r� r� rc rd r$ r$ r% � query_port� s zFirewallPolicy.query_portc C s | � |�jS r )r2 rN rt r$ r$ r% � list_ports� s zFirewallPolicy.list_portsc C s t |�sttj|��d S r )r r r ZINVALID_PROTOCOL�r" r� r$ r$ r% �check_protocol� s z FirewallPolicy.check_protocolc C s t |�sttjd| ��d S )Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')r r r � INVALID_RULE)r" �tcp_mss_clamp_valuer$ r$ r% �check_tcp_mss_clamp� s z"FirewallPolicy.check_tcp_mss_clampc C s | � |� |S r )r r r$ r$ r% Z __protocol_id� s z FirewallPolicy.__protocol_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! � _FirewallPolicy__protocol_idrT r3 r r r� r. rE rd �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolri ) r" r? r� rw rx rI rk r� � protocol_idr� rl r$ r$ r% r� � s( � zFirewallPolicy.add_protocolc C s |j �|� d S r )rT r4 )r" r� r rw rx r$ r$ r% Z__register_protocol s z"FirewallPolicy.__register_protocolc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r rT r3 r r r� r. rE rd r� r ri ) r" r? r� rI rk r� r r� rl r$ r$ r% r� s( � � z FirewallPolicy.remove_protocolc C s ||j v r|j �|� d S r )rT r� )r" r� r r$ r$ r% Z__unregister_protocol( s z$FirewallPolicy.__unregister_protocolc C s | � |�| �|�jv S r )r r2 rT )r" r? r� r$ r$ r% �query_protocol, s z FirewallPolicy.query_protocolc C s | � |�jS r )r2 rT rt r$ r$ r% �list_protocols/ s z FirewallPolicy.list_protocolsc C s | � ||� t|d�|fS r� r� r� r$ r$ r% Z__source_port_id4 s z FirewallPolicy.__source_port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8} t|| d �rH|j rf|j n|} t t j d|� | f ��qHt |dd� | D ��\} } |d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�| D ] }| �d |t|d�� |� q�| D ]0}| �|� �} | �|| ||� |�| j|| � q�| D ]"}| �|� �} |�| j|| � �q4|d u �rl|�d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� ? r� z0FirewallPolicy.add_source_port.<locals>.<lambda>r r� c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� F r� z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� r� rQ r r3 r r r� r r. rE re r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� ri r� r$ r� r% r� 8 s< � z FirewallPolicy.add_source_portc C s |j �|� d S r )rQ r4 r r$ r$ r% Z__register_source_port` s z%FirewallPolicy.__register_source_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t j d|� | f ��t |dd� |D ��\} } |d u r�| � � } n|} |jr�| D ] } | �d|t| d�� | � q�| D ] } | �d |t| d�� | � q�| D ]0} | �| � �}| �||dd � | �| j||� q�| D ]"} | �| � �}| �| j||� �q,|d u �rd| �d� |S ) Nc s | d � kS r� r$ r� r� r$ r% r� i r� z3FirewallPolicy.remove_source_port.<locals>.<lambda>r r c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� r r� z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rQ r r3 r r r� r r. rE re r r r r� r r� ri r r$ r� r% r� c s< � z!FirewallPolicy.remove_source_portc C s ||j v r|j �|� d S r )rQ r� r r$ r$ r% Z__unregister_source_port� s z'FirewallPolicy.__unregister_source_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS r )r2 rQ r r r$ r$ r% �query_source_port� s z FirewallPolicy.query_source_portc C s | � |�jS r )r2 rQ rt r$ r$ r% �list_source_ports� s z FirewallPolicy.list_source_portsc C s� | j �|�}| j �|� | j �� | j| }|jrR|jr>|jn|}ttj d| ��|d u rd| � � }n|}|j r|| � d||� | � |||� |�| j|� |d u r�|�d� |S )Nz"masquerade already enabled in '%s'T)r rA r� r� r! rO r3 r r r� r. rE rf �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderi ) r" r? rw rx rI rk r� r� rl r$ r$ r% r� � s& � z FirewallPolicy.add_masqueradec C s d|_ d S �NT�rO )r" r� rw rx r$ r$ r% Z__register_masquerade� s z$FirewallPolicy.__register_masqueradec C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j rp| � d||� |� | j |� |d u r�|�d� |S )Nz masquerade not enabled in '%s'FT)r rA r� r! rO r3 r r r� r. rE rf r� r ri )r" r? rI rk r� r� rl r$ r$ r% r� � s" � z FirewallPolicy.remove_masqueradec C s d|_ d S �NFr �r" r� r$ r$ r% Z__unregister_masquerade� s z&FirewallPolicy.__unregister_masqueradec C s | � |�jS r )r2 rO rt r$ r$ r% �query_masquerade� s z FirewallPolicy.query_masqueradec C sZ | j �|� | j �|� |r(| j �|� |rBt||�sBttj|��|sV|sVttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRZINVALID_FORWARD)r" �ipvr� r� �toport�toaddrr$ r$ r% �check_forward_port� s �z!FirewallPolicy.check_forward_portc C sL t d|�r | �d||||� n| �d||||� t|d�|t|d�t|�fS )Nr� r� r� )r r$ r r� )r" r� r� r" r# r$ r$ r% Z__forward_port_id� s �z FirewallPolicy.__forward_port_idc C s� | j �|�} | j �|� | j �� | j| } | �||||�} | | jv rp| jrR| jn| } tt j d||||| f ��|d u r�| � � } n|} | j r�| � d| | ||||� | �| | ||� | �| j| | � |d u r�| �d� | S )Nz '%s:%s:%s:%s' already in '%s'T)r rA r� r� r! � _FirewallPolicy__forward_port_idrP r3 r r r� r. rE ra �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portri )r" r? r� r� r" r# rw rx rI rk r� � forward_idr� rl r$ r$ r% r� � s0 �� � z FirewallPolicy.add_forward_portc C s |j �|� d S r )rP r4 )r" r� r( rw rx r$ r$ r% Z__register_forward_port s z&FirewallPolicy.__register_forward_portc C s� | j �|�}| j �� | j| }| �||||�} | |jvrd|jrF|jn|} ttj d||||| f ��|d u rv| � � } n|} |j r�| � d|| ||||� | � | j|| � |d u r�| �d� |S )Nz'%s:%s:%s:%s' not in '%s'FT)r rA r� r! r% rP r3 r r r� r. rE ra r� r' ri ) r" r? r� r� r" r# rI rk r� r( r� rl r$ r$ r% r� s, �� � z"FirewallPolicy.remove_forward_portc C s ||j v r|j �|� d S r )rP r� )r" r� r( r$ r$ r% Z__unregister_forward_port1 s z(FirewallPolicy.__unregister_forward_portc C s | � ||||�}|| �|�jv S r )r% r2 rP )r" r? r� r� r" r# r( r$ r$ r% �query_forward_port5 s z!FirewallPolicy.query_forward_portc C s | � |�jS r )r2 rP rt r$ r$ r% �list_forward_ports: s z!FirewallPolicy.list_forward_portsc C s | j �|� d S r )r Zcheck_icmptype�r" �icmpr$ r$ r% �check_icmp_block? s z FirewallPolicy.check_icmp_blockc C s | � |� |S r )r- r+ r$ r$ r% Z__icmp_block_idB s z FirewallPolicy.__icmp_block_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j d|| f ��|d u rv| � � } n|} |j r�| � d||| � | �||||� | �| j||� |d u r�| �d� |S r� )r rA r� r� r! � _FirewallPolicy__icmp_block_idrR r3 r r r� r. rE r` �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockri ) r" r? r, rw rx rI rk r� �icmp_idr� rl r$ r$ r% r� F s( � z FirewallPolicy.add_icmp_blockc C s |j �|� d S r )rR r4 )r" r� r1 rw rx r$ r$ r% Z__register_icmp_blockc s z$FirewallPolicy.__register_icmp_blockc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| � � }n|}|j r�| � d|||� |� | j||� |d u r�|�d� |S r� )r rA r� r! r. rR r3 r r r� r. rE r` r� r0 ri ) r" r? r, rI rk r� r1 r� rl r$ r$ r% r� f s$ � z FirewallPolicy.remove_icmp_blockc C s ||j v r|j �|� d S r )rR r� )r" r� r1 r$ r$ r% Z__unregister_icmp_block� s z&FirewallPolicy.__unregister_icmp_blockc C s | � |�| �|�jv S r )r. r2 rR )r" r? r, r$ r$ r% �query_icmp_block� s z FirewallPolicy.query_icmp_blockc C s | � |�jS r )r2 rR rt r$ r$ r% �list_icmp_blocks� s z FirewallPolicy.list_icmp_blocksc C s� | j �|�}| j �� | j| }|jrF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j r�|j D ]}| � d|||� qh| � d||� | �||� |�| j||� |j r�|j D ]}| � d|||� q�| � d||� |d u r�|�d� |S )Nz,icmp-block-inversion already enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionri ) r" r? rx rI rk r� r� rl rp r$ r$ r% �add_icmp_block_inversion� s2 � z'FirewallPolicy.add_icmp_block_inversionc C s d|_ d S r �rU )r" r� rx r$ r$ r% Z __register_icmp_block_inversion� s z.FirewallPolicy.__register_icmp_block_inversionc C s` | � � }|jr*|jD ]}| �d|||� qd|_|jrR|jD ]}| �d|||� q<|�d� d S )NFT)r. rE rR r` rU ri )r" rk r� rl rp r$ r$ r% Z__undo_icmp_block_inversion� s z*FirewallPolicy.__undo_icmp_block_inversionc C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j r�|j D ]}| � d|||� qh| � d||� | �|� |�| j|d � |j r�|j D ]}| � d|||� q�| � d||� |d u r�|�d� |S )Nz(icmp-block-inversion not enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` r4 �0_FirewallPolicy__unregister_icmp_block_inversionr� r5 ri )r" r? rI rk r� r� rl rp r$ r$ r% �remove_icmp_block_inversion� s6 � � z*FirewallPolicy.remove_icmp_block_inversionc C s d|_ d S r r8 r r$ r$ r% Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | � |�jS r )r2 rU rt r$ r$ r% �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc C s� | j j�|�}|jr*| j jj|j d }n|}|rT|| jv rt||f| j| v rtd S n || jvsp||f| j| vrtd S | j �� D ]2}|jr~||� � v r~|� ||||�} |� || � q~| � ||||fg� |� | j || ||fg� d S �Nr )r r? r2 r3 r= Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� ) r" r? �createrm rn rl rC Ztracking_policy�backend�rulesr$ r$ r% r[ � s* � � �z FirewallPolicy.gen_chain_rulesc C s^ |D ]T\}}|r*| j �|g ��||f� q| j | �||f� t| j | �dkr| j |= qd S r< )r � setdefaultr4 r� r� )r" r? rA Ztablesrm rn r$ r$ r% r@ s z FirewallPolicy._register_chainsc C s$ | j j�|�dkrd S | j j�|�S )Nzhash:mac)r r� �get_typeZ get_family�r" rB r$ r$ r% r� s z FirewallPolicy._ipset_familyc C s | j j�|�S r )r r� rE rF r$ r$ r% Z __ipset_type! s zFirewallPolicy.__ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z get_dimension)r" rB �flagr$ r$ r% �_ipset_match_flags$ s z!FirewallPolicy._ipset_match_flagsc C s | j j�|�S r )r r� Z check_appliedrF r$ r$ r% r� ' s z#FirewallPolicy._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z INVALID_IPSET)r" rB Z_typer$ r$ r% r� * s ��z+FirewallPolicy._check_ipset_type_for_sourcec s� t |j�tkr��jj�|jj�}|d u r2|jjg}|jD ]H}||v rFq8��|� |� |� t � |�}||j_�j |||||d� q8g } |j r�|j g} nH|jr�t|jt�s�t|jt�rވjj�|jj�� � jrއ fdd�dD �} ��|j�} | �r"|j �r |j | k�r"ttjd| |j f ��n| g} | �s0ddg} �fdd�| D �} | |_t�fd d�| D ��D �]2} t |j�tk�r��jj�|jj�}g } t|j�d k�r�|j�r�ttjd ��| D ].} | |jv �r�| � | ��r�| � |j| � �q�n | � d � | D �]�}t |j �t k�r�� |j |�}|��!|j"�7 }t#t|�d d � d�}g }|D ]�}|j$}t%|�}|�&dd�}|� |� |j dk�r�| � |j ��s��qBt|j'�dk �r�|� |� n6|j'D ].\}}| �(||||||j|�}|�)| |� �q��qB|�*|� |j'D ]*\}}| �+||||||�}|�)| |� �q�|j,D ]$}| �-|||||�}|�)| |� �q |j.D ]*\}}| �/||||||�}|�)| |� �qL�q�q^t |j�t0k�r�|jj1}|jj2}��3||� | �+||||d |�}|�)| |� �q^t |j�t4k�r|jj5}��6|� | �-|||d |�}|�)| |� �q^t |j�t7k�rX|jj5}��8|� | �9|||d |�}|�)| |� �q^t |j�t:k�r�|�r�| D ] } | � | ��rr|�;t<| � �qr| �=|||�}|�)| |� �q^t |j�t>k�rH|jj1}|jj2}|jj?}|jj@}| D ]<} | � | ��r��A| ||||� |�r�|�r�|�;t<| � �q�| �B|||||||�}|�)| |� �q^t |j�tCk�r�|jj1}|jj2}��3||� | �/||||d |�}|�)| |� n�t |j�tk�s�t |j�tk�rR�jj�|jj�� |j �r � j�r |j � jv�r ttjDd|j |jjf ��t |j�tk�r4|j �r4t |j �t k�r4ttjd��| �E||� |�}|�)| |� n>|jd u �rz| �F|||�}|�)| |� nttjdt |j� ���q^d S )N��included_servicesc s g | ]}|� j v r|�qS r$ )� destination�r� r! )�ictr$ r% r� G r� z0FirewallPolicy._rule_prepare.<locals>.<listcomp>�r� r� z;Source address family '%s' conflicts with rule family '%s'.r� r� c s g | ]}� j �|�r|�qS r$ )r �is_ipv_enabledrO r( r$ r% r� X r� c s g | ]}� j �|��qS r$ )r �get_backend_by_ipv)r� r� r( r$ r% r� ] r� r z"Destination conflict with service.c S s | j S r �rB r� r$ r$ r% r� u r� z.FirewallPolicy._rule_prepare.<locals>.<lambda>�ro � conntrack�natr� rV z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)G�type�elementr r r� � get_servicerB �includesr� r4 r� �deepcopyr� �familyr^ r r �config� get_icmptyperN r� r� r r r �ipvsr; r� �is_ipv_supported�actionr r� r� r� r� r/ r� r �replacerN � build_policy_helper_ports_rulesr? Z add_modules�build_policy_ports_rulesrT �build_policy_protocol_rulesrQ � build_policy_source_ports_rulesr r� r� r� r �valuer r r Z build_policy_tcp_mss_clamp_rulesr r� r � build_policy_masquerade_rulesr Zto_portZ to_addressr$ � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules) r" rj r? r� rl rM �svc�includeZ_ruler` Z source_ipvrB Z destinationsr! rN r� r� r� r� r� � nat_moduler� �protorC r� r r" r# r$ )rP r" r% r� 2 sJ � � � � � � � � � � � � � � ��� �� ��z FirewallPolicy._rule_preparec C s> | j j�|�}| �|j|�}|| �|j�7 }tt|�dd� d�}|d u rN|g}|j D ]6}||v rbqT| � |� |� |� | j |||||d� qTg } dD ]f} | j � | �s�q�| j �| �} t|j�dkr�| |jv r�| � | |j| f� q�| d f| vr�| � | d f� q�| D �]6\} } |D ]�} | j}t|�}| j�dd�}|�|� | jd k�rV| �| j��sV�qt| j�d k �rr|�|� n6| jD ].\}}| �||||| | j|�}|�| |� �qx�q|jD ](\}}| �||||| �}|�| |� �q�|j D ]"}| � |||| �}|�| |� �q�|j D ](\}}| � ||||| �}|�| |� �q �q d S ) Nc S s | j S r rT r� r$ r$ r% r� � r� z)FirewallPolicy._service.<locals>.<lambda>rU rL rQ r rV rW r� rV ) r r� rZ r� r� r� r� r/ r; r[ r� r4 rb rR rS r� rN r� r rc Z add_moduler] ra rN rd rB r? re rT rf rQ rg )r" rj r? r� rl rM rl r� rm Z backends_ipvr! rB rN r� r� r� rn r� ro rC r� r$ r$ r% rb � sj � � � �zFirewallPolicy._servicec C s8 | j �� D ](}|jsq |�||||�}|�||� q d S r )r r= r> re r? �r" rj r? r� r� rl rB rC r$ r$ r% rc : s �zFirewallPolicy._portc C s6 | j �� D ]&}|jsq |�|||�}|�||� q d S r )r r= r> rf r? )r" rj r? r� rl rB rC r$ r$ r% rd C s zFirewallPolicy._protocolc C s8 | j �� D ](}|jsq |�||||�}|�||� q d S r )r r= r> rg r? rp r$ r$ r% re K s zFirewallPolicy._source_portc C s8 d}|� t|� | j�|�}|�||�}|�||� d S )Nr� )r� r r rS ri r? )r" rj r? rl r! rB rC r$ r$ r% rf S s zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|�t|� | j�|�} | �||||||�} |�| | � d S )Nr� r� )r r� r r rS rj r? ) r" rj r? rl r� r� r" r# r! rB rC r$ r$ r% ra [ s �z FirewallPolicy._forward_portc C sz | j j�|�}| j �� D ]\}|js$qd}|jrTdD ] }||jv r2|�|�s2d} qTq2|rZq|�|||�} |�|| � qd S )NFrQ T) r r^ r_ r= r> rN ra rk r? ) r" rj r? r, rl rP rB Z skip_backendr! rC r$ r$ r% r` j s zFirewallPolicy._icmp_blockc C sb | j | j}|dv rd S | �|�s.|dkr.d S | j�� D ]$}|jsDq8|�||�}|�||� q8d S )N)ZDROPz %%REJECT%%ZREJECTZACCEPT)r! �targetr; r r= r> Z'build_policy_icmp_block_inversion_rulesr? )r" rj r? rl rq rB rC r$ r$ r% r4 s z$FirewallPolicy._icmp_block_inversionc C s& t | j�}| �|||� |�d� d S r )r r r\ ri )r" rj r? rl r$ r$ r% �!_ingress_egress_zones_transaction� s z0FirewallPolicy._ingress_egress_zones_transactionc C s | j | }|j}|j}t� }t� }t� } t� } |D ]:} | dv r@q2|t| jj�| ��O }| t| jj�| ��O } q2|D ]:} | dv r�qr|t| jj�| ��O }| t| jj�| ��O } qr| j�� D ]D} | j s�q�| � |�D ],\} }| � ||| |||| | �}|� | |� q�q�d S )N)r: r9 ) r! r< r> r; r r= Zlist_interfacesZ list_sourcesr= r> rY Z!build_policy_ingress_egress_rulesr? )r" rj r? rl rC r< r> Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr= rB rm rn rC r$ r$ r% r\ � s4 �z$FirewallPolicy._ingress_egress_zonesc C s | j | }d|jv r<d|jv r<g d�}| jjs8|�d� |S d|jv rbdg}| jjs^|�d� |S d|jv rtddgS d|jv r�d|jv r�g d�}| jjs�|�d� |S d|jv �rg d �}| jjs�|�d� | jjd kr�|�d � n,|jD ]}| jj�|�j r� �qq�|�d � |S d|jv �rzd d g}| jj�s<|�d� |jD ] }| jj�|�j �rB �qv�qB|�d � |�d� |S d g}| jj�s�|�d� | jjd k�r�|�d � n0|jD ] }| jj�|�j �r� �qސq�|�d � |jD ] }| jj�|�j �r� �q�q�|�d � |�d� |S dS )z:Create a list of (table, chain) needed for policy dispatchr: r9 )�r� ZINPUT�rW � PREROUTING��mangleru ��rawru rs )r� �OUTPUT)rW rz )�r� ZFORWARDrt �rW Z POSTROUTINGrv �r{ rt rv Znftablesr| r{ rt rv N) r! r< r> r �nftables_enabledr4 Z_firewall_backendr= Zget_zoneZ interfaces)r" r? rC �tcr= r$ r$ r% rY � sl z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sf | j | }d|jv r0dg}| jjs,|�d� |S d|jv rBg d�S d|jv rRdgS ttjd| ��dS ) z8Create a list of (table, chain) needed for zone dispatchr9 rs rx r: r} r| zInvalid policy: %sN) r! r> r r~ r4 r< r r �INVALID_POLICY)r" r? rC r r$ r$ r% rZ s z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j j�|�}|jr |j}n|| }d|jv rh|dkr>d| S |dkrNd| S |jsd|dv rdd| S �nd|jv r�|js�|dv r�d| S n�d |jv r�|dkr�d | S |d kr�|r�d | S d| S n|d v r�d| S n�d |jv �r.|dkr�d | S |d k�r|�rd | S d| S n|d v �r||j�s|d| S nN|j�s||dk�rHd | S |d k�rj|�r`d | S d| S n|d v �r|d| S ttjd|||f ��d S )Nr9 r� ZIN_ry ZPRE_)rw rW )r� rW ZOUT_r: ZFWD_rW ZPOST_)rw ry z.Can't convert policy to chain name: %s, %s, %s) r r? r2 r3 r> r< r r r� )r" r? rm Z policy_prefixZisSNATrC �suffixr$ r$ r% �policy_base_chain_name! sZ z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__� __module__� __qualname__r& r) r+ r. r1 r8 r@ r2 rD rG rK rL rq rJ rF ru r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rg ry r� r| r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r� r r� r r r r r� r r� r r r r� r r� r r r$ r% r� r& r� r' r) r* r- r. r� r/ r� r0 r2 r3 r7 r5 r6 r: r9 r; r[ r@ r� rK rJ r� r� r� rb rc rd re rf ra r` r4 rr r\ rY rZ r� r$ r$ r$ r% r s> F 5 � & # � & # � � � � � (� ) � � � (� ) � � � � � � ' ' I @ � Vr )%r� Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r r r r r~ r r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.core.baser �objectr r$ r$ r$ r% �<module> s 44
💾 Save Changes
❌ Cancel