a
«°iD# ã @ sÀ d dl Z d dlmZ d dlmZmZmZmZmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" G d d
„ d
e#ƒZ$dS ) é N)Úlog) ÚportStrÚ checkIPnMaskÚ
checkIP6nMaskÚ
checkProtocolÚenable_ip_forwardingÚcheck_single_addressÚportInPortRangeÚget_nf_conntrack_short_nameÚcoalescePortRangeÚbreakPortRangeÚcheckTcpMssClamp) Ú Rich_RuleÚ Rich_AcceptÚ Rich_ServiceÚ Rich_PortÚ
Rich_ProtocolÚRich_MasqueradeÚRich_ForwardPortÚRich_SourcePortÚRich_IcmpBlockÚ
Rich_IcmpTypeÚRich_Tcp_Mss_Clamp)ÚFirewallTransaction)Úerrors)Ú
FirewallError)ÚSOURCE_IPSET_TYPESc @ sv e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd d
„ Zd d „ Zd
d„ Z dd„ Z
dd„ Z dd„ Z dÿdd„Z
dd„ Zd dd„Zdd d „Zdd d „Zd d!„ Zd"d#„ Zd$d%„ Zd&d'„ Zdd*d+„Zd,d-„ Zdd.d/„Zd0d1„ Zd2d3„ Zd4d5„ Zd6d7„ Z d8d9„ Z dd:d;„Z dd?„Z d@dA„ Z!dBdC„ Z"dDdE„ Z#dFdG„ Z$dHdI„ Z%dJdK„ Z&dLdM„ Z'ddNdO„Z(dPdQ„ Z)ddRdS„Z*dTdU„ Z+dVdW„ Z,dXdY„ Z-dZd[„ Z.d\d]„ Z/d d^d_„Z0d`da„ Z1d
dbdc„Z2ddde„ Z3dfdg„ Z4dhdi„ Z5djdk„ Z6dldm„ Z7dndo„ Z8dpdq„ Z9d drds„Z:dtdu„ Z;d dvdw„Zd|d}„ Z?d~d„ Z@d€d„ ZAd‚dƒ„ ZBd
d„d…„ZCd†d‡„ ZDddˆd‰„ZEdŠd‹„ ZFdŒd„ ZGdŽd„ ZHdd‘„ ZIdd’d“„ZJd”d•„ ZKdd–d—„ZLd˜d™„ ZMdšd›„ ZNdœd„ ZOddždŸ„ZPd d¡„ ZQdd¢d£„ZRd¤d¥„ ZSd¦d§„ ZTdd¨d©„ZUddªd«„ZVdd¬d„ZWd®d¯„ ZXdd°d±„ZYd²d³„ ZZdd´dµ„Z[d¶d·„ Z\d¸d¹„ Z]dºd»„ Z^dd¼d½„Z_d¾d¿„ Z`ddÀdÁ„ZadÂdÄ ZbdÄdÅ„ ZcdÆdÇ„ ZdddÈdÉ„ZedÊdË„ ZfdÌdÍ„ ZgddÎdÏ„ZhdÐdÑ„ ZidÒdÓ„ ZjdÔdÕ„ ZkdÖdׄ ZldØdÙ„ ZmdÚdÛ„ ZndÜdÝ„ ZodÞdß„ Zpdàdá„ Zqd dâdã„Zrd dädå„Zsdædç„ Ztdèdé„ Zudêdë„ Zvdìdí„ Zwd dîdï„Zxdðdñ„ Zydòdó„ Zzdôdõ„ Z{död÷„ Z|dødù„ Z}dúdû„ Z~d dýdþ„ZdS ( ÚFirewallPolicyc C s || _ i | _i | _d S ©N)Ú_fwÚ_chainsÚ _policies)ÚselfÚfw© r$ ú;/usr/lib/python3.9/site-packages/firewall/core/fw_policy.pyÚ__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))Ú __class__r r! ©r" r$ r$ r% Ú__repr__ s zFirewallPolicy.__repr__c C s | j ¡ | j ¡ d S r )r Úclearr! r( r$ r$ r% Úcleanup s
zFirewallPolicy.cleanupc C s t | jƒ}| | jj¡ |S r )r r Zadd_preÚfull_check_config)r" Útr$ r$ r% Únew_transaction$ s
z FirewallPolicy.new_transactionc C s t | j ¡ ƒS r )Úsortedr! Úkeysr( r$ r$ r% Ú get_policies+ s zFirewallPolicy.get_policiesc C s4 g }| ¡ D ] }| |¡}|js | |¡ q t|ƒS r )r1 Ú
get_policyÚderived_from_zoneÚappendr/ )r" ÚpoliciesÚpÚp_objr$ r$ r% Ú"get_policies_not_derived_from_zone. s
z1FirewallPolicy.get_policies_not_derived_from_zonec C sv g }| ¡ D ]d}| |¡}t|jƒt| jj ¡ ƒtddgƒB @ r t|jƒt| jj ¡ ƒtddgƒB @ r | |¡ q |S )NÚHOSTÚANY) r8 r2 ÚsetÚ
ingress_zonesr ÚzoneZget_active_zonesÚ egress_zonesr4 )r" Zactive_policiesÚpolicyr7 r$ r$ r% Ú)get_active_policies_not_derived_from_zone6 s
&$ÿ z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j |¡}| j| S r )r Ú check_policyr! )r" r? r6 r$ r$ r% r2 @ s zFirewallPolicy.get_policyc C s || j |j< d S r )r! Úname)r" Úobjr$ r$ r% Ú
add_policyD s zFirewallPolicy.add_policyc C s& | j | }|jr| |¡ | j |= d S r )r! ÚappliedÚunapply_policy_settings)r" r? rC r$ r$ r% Ú
remove_policyG s
z FirewallPolicy.remove_policyNc C sJ | ¡ D ]<}| j| }|jr q|| ¡ v rt d|¡ | j||d qd S )NzApplying policy '%s'©Úuse_transaction)r1 r! r3 r@ r Zdebug1Úapply_policy_settings)r" rI r? r7 r$ r$ r% Úapply_policiesM s
z FirewallPolicy.apply_policiesc C s | j | }||_d S r )r! rE )r" r? rE rC r$ r$ r% Úset_policy_appliedV s
z!FirewallPolicy.set_policy_appliedc C sz | j |¡}| j| }|r |js*|s.|js.d S |r8d|_|d u rJ| ¡ }n|}|rˆ|jsb| |¡n| |¡D ]\}}| |d|||¡ ql|jsœ| |||¡ dD ]x} t
| |¡| ƒ}
t |
t
ƒrØ|rÈ|
sÒ|s |
sÒq |
g}
|
D ]:} | dkrü| ||| |¡ qÜ| dkr
qÜqÜ| dkr,| j|||g| ¢R Ž qÜ| dkrH| ||| |¡ qÜ| dkrn| ||| d | d |¡ qÜ| d
krŠ| ||| |¡ qÜ| d kr°| ||| d | d |¡ qÜ| d krÊ| |||¡ qÜ| d
krì| ||t| d|¡ qÜ| dkrúqÜqÜ| dkrqÜqÜt d|| | ¡ qÜq |sb|js4| |¡n| |¡D ] \}}| |d|||¡ q>d|_|d u rv| |¡ d S )NT) ÚservicesÚportsÚ
masqueradeÚ
forward_portsÚ source_portsÚ icmp_blocksÚ rules_strÚ protocolsÚicmp_block_inversionr< r> rR rU rP rM rN r é rT rQ rO rS ©Úrule_strr< r> z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rA r! rE r. r3 Ú%_get_table_chains_for_policy_dispatchÚ#_get_table_chains_for_zone_dispatchÚgen_chain_rulesÚ_ingress_egress_zonesÚgetattrr2 Ú
isinstanceÚboolÚ _icmp_blockÚ
_forward_portÚ_serviceÚ_portÚ _protocolÚ _source_portÚ _masqueradeÚ_FirewallPolicy__ruler r ÚwarningÚexecute) r" Úenabler? rI Ú_policyrC Ú transactionÚtableÚchainÚkeyZ args_listÚargsr$ r$ r% Ú_policy_settingsZ s€
ÿ
ÿ
ÿ
ÿ
ÿ
ÿÿ
z FirewallPolicy._policy_settingsc C s | j d||d d S )NTrH ©rq ©r" r? rI r$ r$ r% rJ s z$FirewallPolicy.apply_policy_settingsc C s | j d||d d S )NFrH rr rs r$ r$ r% rF £ s z&FirewallPolicy.unapply_policy_settingsc C s | |¡ ¡ S r )r2 Zexport_config_dict©r" r? r$ r$ r% Ú get_config_with_settings_dict¦ s z,FirewallPolicy.get_config_with_settings_dictc sæ ddl m‰ d ‡ ‡fdd„ }‡ ‡fdd„}ˆjˆjfˆjˆjfˆjˆjfˆjˆj fˆj
ˆj f||fˆj ˆj
fˆjˆjfˆjˆjfˆjˆjfdœ
}ˆ |¡}t |¡}| |ˆj ¡ ¡ ˆj d|gi¡ ˆ |¡} ˆj | |¡\}
} | D ]n} t | | t ƒrF| | D ]>}
t |
t ƒr.|| d |g|
¢R Ž n|| d ||
ƒ qqè|| d |ƒ qè|
D ]„} t |
| t ƒrÈ|
| D ]L}
t |
t ƒrª|| d |g|
¢R d|d
œŽ n|| d ||
d|d
qxn|| d |d|d
q\d S ) Nr )r c s ˆj | ˆ |dd|d d S )NrW r ©ÚtimeoutÚsender)Úadd_rule)r? rX rw rx ©r r" r$ r% Úadd_rule_wrapper¬ s zFFirewallPolicy.set_config_with_settings_dict..add_rule_wrapperc s ˆ | ˆ |d¡ d S )NrW )Ú remove_rule)r? rX rz r$ r% Úremove_rule_wrapper® s zIFirewallPolicy.set_config_with_settings_dict..remove_rule_wrapper)
rM rN rR rO rP Z
rich_rulesrT rQ r< r> r5 rV rv )r N) Úfirewall.core.richr Ú add_serviceÚremove_serviceÚadd_portÚ remove_portÚadd_icmp_blockÚremove_icmp_blockÚadd_masqueradeÚremove_masqueradeÚadd_forward_portÚremove_forward_portÚ add_protocolÚremove_protocolÚadd_source_portÚremove_source_portÚadd_ingress_zoneÚremove_ingress_zoneÚadd_egress_zoneÚremove_egress_zoner2 ÚcopyZimport_config_dictr Zget_all_io_objects_dictr, ru Z get_added_and_removed_settingsr^ ÚlistÚtuple)r" r? Zsettingsrx r{ r} Z
setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsro rp r$ rz r% Ú set_config_with_settings_dict© sD
ö
" z,FirewallPolicy.set_config_with_settings_dictc C s& |st tjƒ‚|dvr"| j |¡ d S ©N)r9 r: ©r r Z INVALID_ZONEr Z
check_zone©r" r= r$ r$ r% Úcheck_ingress_zoneÞ s
z!FirewallPolicy.check_ingress_zonec C s | |¡ |S r )r˜ r— r$ r$ r% Z__ingress_zone_idä s
z FirewallPolicy.__ingress_zone_idr Tc C s | j |¡}| j |¡ | j ¡ | j| }| |¡} | |jv rTttj d||f ƒ‚|d u rf|
¡ }
n|}
|rä|j r‚| d||
¡ |
|| ||¡ |
| j|| ¡ |j sÔ|| ¡ v râ| j||
d |
| j|d¡ n| d||
¡ n |
|| ||¡ |
| j|| ¡ |d u r|
d¡ d S ©Nú'%s' already in '%s'FrH T)r rA Ú
check_timeoutÚ check_panicr! Ú _FirewallPolicy__ingress_zone_idr< r r ÚALREADY_ENABLEDr. rE r\ Ú&_FirewallPolicy__register_ingress_zoneÚadd_failÚ(_FirewallPolicy__unregister_ingress_zoner@ rJ rL ri © r" r? r= rw rx rI Z allow_applyrk Ú_objÚzone_idrl r$ r$ r% r è s4
ÿ
z FirewallPolicy.add_ingress_zonec C s |j |¡ d S r )r< r4 ©r" r£ r¤ rw rx r$ r$ r% Z__register_ingress_zone s z&FirewallPolicy.__register_ingress_zonec C sð | j |¡}| j ¡ | j| }| |¡}||jvrHttjd||f ƒ‚|d u rZ| ¡ }n|}|j
rÊt |jƒdkr€| ||¡ n|
d||¡ | ||¡ | | j||d d ¡ || ¡ v rÚ|
d||¡ n| | j||¡ |d u rì| d¡ |S ©Nú'%s' not in '%s'rV FT)r rA rœ r! r r< r r Ú NOT_ENABLEDr. rE ÚlenrF r\ r¡ r rŸ r@ Úadd_postri ©r" r? r= rI rk r£ r¤ rl r$ r$ r% rŽ s.
ÿ
z"FirewallPolicy.remove_ingress_zonec C s ||j v r|j |¡ d S r )r< Úremove©r" r£ r¤ r$ r$ r% Z__unregister_ingress_zone4 s
z(FirewallPolicy.__unregister_ingress_zonec C s | |¡| |¡jv S r )r r2 r< ©r" r? r= r$ r$ r% Úquery_ingress_zone8 s z!FirewallPolicy.query_ingress_zonec C s | |¡jS r )r2 r< rt r$ r$ r% Úlist_ingress_zones; s z!FirewallPolicy.list_ingress_zonesc C s& |st tjƒ‚|dvr"| j |¡ d S r• r– r— r$ r$ r% Úcheck_egress_zone@ s
z FirewallPolicy.check_egress_zonec C s | |¡ |S r )r± r— r$ r$ r% Z__egress_zone_idF s
z FirewallPolicy.__egress_zone_idc C s | j |¡}| j |¡ | j ¡ | j| }| |¡} | |jv rTttj d||f ƒ‚|d u rf|
¡ }
n|}
|rä|j r‚| d||
¡ |
|| ||¡ |
| j|| ¡ |j sÔ|| ¡ v râ| j||
d |
| j|d¡ n| d||
¡ n |
|| ||¡ |
| j|| ¡ |d u r|
d¡ d S r™ )r rA r› rœ r! Ú _FirewallPolicy__egress_zone_idr> r r rž r. rE r\ Ú%_FirewallPolicy__register_egress_zoner Ú'_FirewallPolicy__unregister_egress_zoner@ rJ rL ri r¢ r$ r$ r% r J s4
ÿ
z FirewallPolicy.add_egress_zonec C s |j |¡ d S r )r> r4 r¥ r$ r$ r% Z__register_egress_zonep s z%FirewallPolicy.__register_egress_zonec C sð | j |¡}| j ¡ | j| }| |¡}||jvrHttjd||f ƒ‚|d u rZ| ¡ }n|}|j
rÊt |jƒdkr€| ||¡ n|
d||¡ | ||¡ | | j||d d ¡ || ¡ v rÚ|
d||¡ n| | j||¡ |d u rì| d¡ |S r¦ )r rA rœ r! r² r> r r r¨ r. rE r© rF r\ r´ r r³ r@ rª ri r« r$ r$ r% r s s.
ÿ
z!FirewallPolicy.remove_egress_zonec C s ||j v r|j |¡ d S r )r> r¬ r r$ r$ r% Z__unregister_egress_zone– s
z'FirewallPolicy.__unregister_egress_zonec C s | |¡| |¡jv S r )r² r2 r> r® r$ r$ r% Úquery_egress_zoneš s z FirewallPolicy.query_egress_zonec C s | |¡jS r )r2 r> rt r$ r$ r% Úlist_egress_zones s z FirewallPolicy.list_egress_zonesc C s | ¡ d S r )Úcheck©r" Úruler$ r$ r% Ú
check_rule¢ s zFirewallPolicy.check_rulec C s | |¡ t|ƒS r )rº Ústrr¸ r$ r$ r% Z __rule_id¥ s
zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j ƒr dS t|j ƒrtdS nHt|dƒr@|jr@dS t|dƒrt|jrt| |j¡ | |j¡ | |j¡S d S )NÚipv4Úipv6ÚmacÚ Úipset) Úaddrr r Úhasattrr¾ rÀ Ú _check_ipset_type_for_sourceÚ_check_ipset_appliedÚ
_ipset_family)r" Úsourcer$ r$ r% Ú_rule_source_ipv© s
z FirewallPolicy._rule_source_ipvc C s | ||||¡ d S r )Ú
_rule_prepare)r" rj r? r¹ rl r$ r$ r% Z__rule» s zFirewallPolicy.__rulec C sÆ | j |¡}| j |¡ | j ¡ | j| }| |¡}||jv rd|jrL|jn|} tt j
d|| f ƒ‚|d u rv| ¡ }
n|}
|j r|
d|||
¡ | ||||¡ |
| j||¡ |d u rÂ|
d¡ |S ©Nrš T)r rA r› rœ r! Ú_FirewallPolicy__rule_idrS r3 r r rž r. rE rg Ú _FirewallPolicy__register_ruler Ú _FirewallPolicy__unregister_ruleri ) r" r? r¹ rw rx rI rk r£ Úrule_idÚ_namerl r$ r$ r% ry ¾ s(
ÿ
zFirewallPolicy.add_rulec C s |j |¡ d S r )rS r4 )r" r£ rÍ rw rx r$ r$ r% Z__register_ruleÛ s z FirewallPolicy.__register_rulec C sª | j |¡}| j ¡ | j| }| |¡}||jvrX|jr@|jn|}ttj d||f ƒ‚|d u rj|
¡ }n|}|j r„| d|||¡ |
| j||¡ |d u r¦| d¡ |S ©Nr§ FT)r rA rœ r! rÊ rS r3 r r r¨ r. rE rg rª rÌ ri ) r" r? r¹ rI rk r£ rÍ rÎ rl r$ r$ r% r| Þ s$
ÿ
zFirewallPolicy.remove_rulec C s ||j v r|j |¡ d S r )rS r¬ )r" r£ rÍ r$ r$ r% Z__unregister_ruleù s
z FirewallPolicy.__unregister_rulec C s | |¡| |¡jv S r )rÊ r2 rS )r" r? r¹ r$ r$ r% Ú
query_ruleý s zFirewallPolicy.query_rulec C s | |¡jS r )r2 rS rt r$ r$ r% Ú
list_rules s zFirewallPolicy.list_rulesc C s | j |¡ d S r )r Ú
check_service©r" Úservicer$ r$ r% rÒ s z FirewallPolicy.check_servicec C s | |¡ |S r )rÒ rÓ r$ r$ r% Z __service_id s
zFirewallPolicy.__service_idc C sÆ | j |¡}| j |¡ | j ¡ | j| }| |¡}||jv rd|jrL|jn|} tt j
d|| f ƒ‚|d u rv| ¡ }
n|}
|j r|
d|||
¡ | ||||¡ |
| j||¡ |d u rÂ|
d¡ |S rÉ )r rA r› rœ r! Ú_FirewallPolicy__service_idrM r3 r r rž r. rE rb Ú!_FirewallPolicy__register_servicer Ú#_FirewallPolicy__unregister_serviceri ) r" r? rÔ rw rx rI rk r£ Ú
service_idrÎ rl r$ r$ r% r s(
ÿ
zFirewallPolicy.add_servicec C s |j |¡ d S r )rM r4 )r" r£ rØ rw rx r$ r$ r% Z__register_service) s z!FirewallPolicy.__register_servicec C sª | j |¡}| j ¡ | j| }| |¡}||jvrX|jr@|jn|}ttj d||f ƒ‚|d u rj|
¡ }n|}|j r„| d|||¡ |
| j||¡ |d u r¦| d¡ |S rÏ )r rA rœ r! rÕ rM r3 r r r¨ r. rE rb rª r× ri ) r" r? rÔ rI rk r£ rØ rÎ rl r$ r$ r% r€ , s$
ÿ
z FirewallPolicy.remove_servicec C s ||j v r|j |¡ d S r )rM r¬ )r" r£ rØ r$ r$ r% Z__unregister_serviceG s
z#FirewallPolicy.__unregister_servicec C s | |¡| |¡jv S r )rÕ r2 rM )r" r? rÔ r$ r$ r% Ú
query_serviceK s z FirewallPolicy.query_servicec C s | |¡jS r )r2 rM rt r$ r$ r% Ú
list_servicesN s z FirewallPolicy.list_servicesc C sN g }|D ]@}z| j j |¡}W n ty< ttj|ƒ‚Y n0 | |¡ q|S r )r ÚhelperÚ
get_helperr r ÚINVALID_HELPERr4 )r" ÚhelpersÚ_helpersrÛ Ú_helperr$ r$ r% Ú get_helpers_for_service_helpersQ s z.FirewallPolicy.get_helpers_for_service_helpersc C s® g }|D ] }z| j j |¡}W n ty< ttj|ƒ‚Y n0 t|jƒdk ržt|j ƒ}z | j j |¡}|
|¡ W q¨ tyš |r’t d| ¡ Y qY q¨0 q|
|¡ q|S )NrV z Helper '%s' is not available)
r rÛ rÜ r r rÝ r© rN r
Úmoduler4 r rh )r" Úmodulesrj rß râ rÛ Ú_module_short_namerà r$ r$ r% Ú get_helpers_for_service_modules[ s"
z.FirewallPolicy.get_helpers_for_service_modulesc C s | j |¡ | j |¡ d S r )r Ú
check_portÚ check_tcpudp©r" ÚportÚprotocolr$ r$ r% ræ t s zFirewallPolicy.check_portc C s | ||¡ t|dƒ|fS ©Nú-©ræ r rè r$ r$ r% Z __port_idx s zFirewallPolicy.__port_idc sp | j |¡}| j |¡ | j ¡ | j| }tt‡ fdd„|jƒƒ} | D ]8}
t||
d ƒrH|j rf|j n|} t
t j d|ˆ | f ƒ‚qHt
|dd„ | D ƒƒ\} }
|d u r¬| ¡ }n|}|jrú| D ] }| d|t|dƒˆ |¡ qº|
D ] }| d |t|dƒˆ |¡ qÜ| D ]0}| |ˆ ¡}
| ||
||¡ | | j||
¡ qþ|
D ]"}| |ˆ ¡}
| | j||
¡ q4|d u rl| d¡ |S )
Nc s | d ˆ kS ©NrV r$ ©Úx©rê r$ r% Úƒ ó z)FirewallPolicy.add_port..r ú'%s:%s' already in '%s'c S s g | ] \}}|‘qS r$ r$ ©Ú.0rc rd r$ r$ r% Ú
Š ró z+FirewallPolicy.add_port..Trì F)r rA r› rœ r! r’ ÚfilterrN r r3 r r rž r r. rE rc r Ú_FirewallPolicy__port_idÚ _FirewallPolicy__register_portr Ú _FirewallPolicy__unregister_portrª ri ©r" r? ré rê rw rx rI rk r£ Úexisting_port_idsÚport_idrÎ Ú added_rangesÚremoved_rangesrl Úranger$ rñ r% r | s<
ÿ
zFirewallPolicy.add_portc C s |j |¡ d S r )rN r4 ©r" r£ rþ rw rx r$ r$ r% Z__register_port¤ s z FirewallPolicy.__register_portc sh | j |¡}| j ¡ | j| }tt‡ fdd„|jƒƒ}|D ]}t||d ƒr< qzq<|jr`|jn|} t t
j d|ˆ | f ƒ‚t |dd„ |D ƒƒ\}
} |d u r¤|
¡ } n|} |jrò|
D ] }
| d|t|
dƒˆ | ¡ q²| D ] }
| d |t|
dƒˆ | ¡ qÔ|
D ]0}
| |
ˆ ¡}| ||dd ¡ | | j||¡ qö| D ]"}
| |
ˆ ¡}| | j||¡ q,|d u rd| d¡ |S )
Nc s | d ˆ kS rî r$ rï rñ r$ r% rò ró z,FirewallPolicy.remove_port..r ú'%s:%s' not in '%s'c S s g | ] \}}|‘qS r$ r$ rõ r$ r$ r% r÷ ¶ ró z.FirewallPolicy.remove_port..Trì F)r rA rœ r! r’ rø rN r r3 r r r¨ r r. rE rc r rù rú r rû rª ri ©r" r? ré rê rI rk r£ rý rþ rÎ rÿ r rl r r$ rñ r% r‚ § s<
ÿ
zFirewallPolicy.remove_portc C s ||j v r|j |¡ d S r )rN r¬ ©r" r£ rþ r$ r$ r% Z__unregister_portÐ s
z FirewallPolicy.__unregister_portc C s2 | |¡jD ] \}}t||ƒr ||kr dS q dS ©NTF)r2 rN r ©r" r? ré rê rc rd r$ r$ r% Ú
query_portÔ s zFirewallPolicy.query_portc C s | |¡jS r )r2 rN rt r$ r$ r% Ú
list_portsÛ s zFirewallPolicy.list_portsc C s t |ƒsttj|ƒ‚d S r )r r r ZINVALID_PROTOCOL©r" rê r$ r$ r% Úcheck_protocolà s z FirewallPolicy.check_protocolc C s t |ƒsttjd| ƒ‚d S )Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')r
r r Ú INVALID_RULE)r" Útcp_mss_clamp_valuer$ r$ r% Úcheck_tcp_mss_clampä s z"FirewallPolicy.check_tcp_mss_clampc C s | |¡ |S r )r r
r$ r$ r% Z
__protocol_idè s
z FirewallPolicy.__protocol_idc C sÆ | j |¡}| j |¡ | j ¡ | j| }| |¡}||jv rd|jrL|jn|} tt j
d|| f ƒ‚|d u rv| ¡ }
n|}
|j r|
d|||
¡ | ||||¡ |
| j||¡ |d u rÂ|
d¡ |S rÉ )r rA r› rœ r! Ú _FirewallPolicy__protocol_idrT r3 r r rž r. rE rd Ú"_FirewallPolicy__register_protocolr Ú$_FirewallPolicy__unregister_protocolri ) r" r? rê rw rx rI rk r£ Ú protocol_idrÎ rl r$ r$ r% r‰ ì s(
ÿ
zFirewallPolicy.add_protocolc C s |j |¡ d S r )rT r4 )r" r£ r rw rx r$ r$ r% Z__register_protocol s z"FirewallPolicy.__register_protocolc C sª | j |¡}| j ¡ | j| }| |¡}||jvrX|jr@|jn|}ttj d||f ƒ‚|d u rj|
¡ }n|}|j r„| d|||¡ |
| j||¡ |d u r¦| d¡ |S rÏ )r rA rœ r! r rT r3 r r r¨ r. rE rd rª r ri ) r" r? rê rI rk r£ r rÎ rl r$ r$ r% rŠ s(
ÿ
ÿ
z FirewallPolicy.remove_protocolc C s ||j v r|j |¡ d S r )rT r¬ )r" r£ r r$ r$ r% Z__unregister_protocol( s
z$FirewallPolicy.__unregister_protocolc C s | |¡| |¡jv S r )r r2 rT )r" r? rê r$ r$ r% Úquery_protocol, s z FirewallPolicy.query_protocolc C s | |¡jS r )r2 rT rt r$ r$ r% Úlist_protocols/ s z FirewallPolicy.list_protocolsc C s | ||¡ t|dƒ|fS rë rí rè r$ r$ r% Z__source_port_id4 s z FirewallPolicy.__source_port_idc sp | j |¡}| j |¡ | j ¡ | j| }tt‡ fdd„|jƒƒ} | D ]8}
t||
d ƒrH|j rf|j n|} t
t j d|ˆ | f ƒ‚qHt
|dd„ | D ƒƒ\} }
|d u r¬| ¡ }n|}|jrú| D ] }| d|t|dƒˆ |¡ qº|
D ] }| d |t|dƒˆ |¡ qÜ| D ]0}| |ˆ ¡}
| ||
||¡ | | j||
¡ qþ|
D ]"}| |ˆ ¡}
| | j||
¡ q4|d u rl| d¡ |S )
Nc s | d ˆ kS rî r$ rï rñ r$ r% rò ? ró z0FirewallPolicy.add_source_port..r rô c S s g | ] \}}|‘qS r$ r$ rõ r$ r$ r% r÷ F ró z2FirewallPolicy.add_source_port..Trì F)r rA r› rœ r! r’ rø rQ r r3 r r rž r r. rE re r Ú _FirewallPolicy__source_port_idÚ%_FirewallPolicy__register_source_portr Ú'_FirewallPolicy__unregister_source_portrª ri rü r$ rñ r% r‹ 8 s<
ÿ
z FirewallPolicy.add_source_portc C s |j |¡ d S r )rQ r4 r r$ r$ r% Z__register_source_port` s z%FirewallPolicy.__register_source_portc sh | j |¡}| j ¡ | j| }tt‡ fdd„|jƒƒ}|D ]}t||d ƒr< qzq<|jr`|jn|} t t
j d|ˆ | f ƒ‚t |dd„ |D ƒƒ\}
} |d u r¤|
¡ } n|} |jrò|
D ] }
| d|t|
dƒˆ | ¡ q²| D ] }
| d |t|
dƒˆ | ¡ qÔ|
D ]0}
| |
ˆ ¡}| ||dd ¡ | | j||¡ qö| D ]"}
| |
ˆ ¡}| | j||¡ q,|d u rd| d¡ |S )
Nc s | d ˆ kS rî r$ rï rñ r$ r% rò i ró z3FirewallPolicy.remove_source_port..r r c S s g | ] \}}|‘qS r$ r$ rõ r$ r$ r% r÷ r ró z5FirewallPolicy.remove_source_port..Trì F)r rA rœ r! r’ rø rQ r r3 r r r¨ r r. rE re r r r r r rª ri r r$ rñ r% rŒ c s<
ÿ
z!FirewallPolicy.remove_source_portc C s ||j v r|j |¡ d S r )rQ r¬ r r$ r$ r% Z__unregister_source_portŒ s
z'FirewallPolicy.__unregister_source_portc C s2 | |¡jD ] \}}t||ƒr ||kr dS q dS r )r2 rQ r r r$ r$ r% Úquery_source_port s z FirewallPolicy.query_source_portc C s | |¡jS r )r2 rQ rt r$ r$ r% Úlist_source_ports— s z FirewallPolicy.list_source_portsc C s® | j |¡}| j |¡ | j ¡ | j| }|jrR|jr>|jn|}ttj d| ƒ‚|d u rd|
¡ }n|}|j r|| d||¡ |
|||¡ | | j|¡ |d u rª| d¡ |S )Nz"masquerade already enabled in '%s'T)r rA r› rœ r! rO r3 r r rž r. rE rf Ú$_FirewallPolicy__register_masquerader Ú&_FirewallPolicy__unregister_masqueraderi ) r" r? rw rx rI rk r£ rÎ rl r$ r$ r% r… œ s&
ÿ
z FirewallPolicy.add_masqueradec C s
d|_ d S ©NT©rO )r" r£ rw rx r$ r$ r% Z__register_masquerade¸ s z$FirewallPolicy.__register_masqueradec C s” | j |¡}| j ¡ | j| }|jsF|jr2|jn|}ttjd| ƒ‚|d u rX| ¡ }n|}|j
rp| d||¡ | | j
|¡ |d u r| d¡ |S )Nz masquerade not enabled in '%s'FT)r rA rœ r! rO r3 r r r¨ r. rE rf rª r ri )r" r? rI rk r£ rÎ rl r$ r$ r% r† » s"
ÿ
z FirewallPolicy.remove_masqueradec C s
d|_ d S ©NFr ©r" r£ r$ r$ r% Z__unregister_masqueradeÔ s z&FirewallPolicy.__unregister_masqueradec C s | |¡jS r )r2 rO rt r$ r$ r% Úquery_masquerade× s z FirewallPolicy.query_masqueradec C sZ | j |¡ | j |¡ |r(| j |¡ |rBt||ƒsBttj|ƒ‚|sV|sVttjdƒ‚d S )Nz.port-forwarding is missing to-port AND to-addr)r ræ rç r r r Z INVALID_ADDRZINVALID_FORWARD)r" Úipvré rê ÚtoportÚtoaddrr$ r$ r% Úcheck_forward_portÜ s
þz!FirewallPolicy.check_forward_portc C sL t d|ƒr | d||||¡ n| d||||¡ t|dƒ|t|dƒt|ƒfS )Nr½ r¼ rì )r r$ r r» )r" ré rê r" r# r$ r$ r% Z__forward_port_idé s
ÿz FirewallPolicy.__forward_port_idc C sØ | j |¡} | j |¡ | j ¡ | j| }
| ||||¡} | |
jv rp|
jrR|
jn| } tt j
d||||| f ƒ‚|d u r‚| ¡ }
n|}
|
j r¢|
d| |
||||¡ | |
| ||¡ |
| j|
| ¡ |d u rÔ|
d¡ | S )Nz '%s:%s:%s:%s' already in '%s'T)r rA r› rœ r! Ú _FirewallPolicy__forward_port_idrP r3 r r rž r. rE ra Ú&_FirewallPolicy__register_forward_portr Ú(_FirewallPolicy__unregister_forward_portri )r" r? ré rê r" r# rw rx rI rk r£ Ú
forward_idrÎ rl r$ r$ r% r‡ ñ s0
ÿÿ
ÿ
z FirewallPolicy.add_forward_portc C s |j |¡ d S r )rP r4 )r" r£ r( rw rx r$ r$ r% Z__register_forward_port s z&FirewallPolicy.__register_forward_portc C s¼ | j |¡}| j ¡ | j| }| ||||¡} | |jvrd|jrF|jn|}
ttj d|||||
f ƒ‚|d u rv|
¡ } n|} |j r–| d|| ||||¡ |
| j|| ¡ |d u r¸| d¡ |S )Nz'%s:%s:%s:%s' not in '%s'FT)r rA rœ r! r% rP r3 r r r¨ r. rE ra rª r' ri ) r" r? ré rê r" r# rI rk r£ r( rÎ rl r$ r$ r% rˆ s,
ÿÿ
ÿ
z"FirewallPolicy.remove_forward_portc C s ||j v r|j |¡ d S r )rP r¬ )r" r£ r( r$ r$ r% Z__unregister_forward_port1 s
z(FirewallPolicy.__unregister_forward_portc C s | ||||¡}|| |¡jv S r )r% r2 rP )r" r? ré rê r" r# r( r$ r$ r% Úquery_forward_port5 s z!FirewallPolicy.query_forward_portc C s | |¡jS r )r2 rP rt r$ r$ r% Úlist_forward_ports: s z!FirewallPolicy.list_forward_portsc C s | j |¡ d S r )r Zcheck_icmptype©r" Úicmpr$ r$ r% Úcheck_icmp_block? s z FirewallPolicy.check_icmp_blockc C s | |¡ |S r )r- r+ r$ r$ r% Z__icmp_block_idB s
z FirewallPolicy.__icmp_block_idc C sÆ | j |¡}| j |¡ | j ¡ | j| }| |¡}||jv rd|jrL|jn|} tt j
d|| f ƒ‚|d u rv| ¡ }
n|}
|j r|
d|||
¡ | ||||¡ |
| j||¡ |d u rÂ|
d¡ |S rÉ )r rA r› rœ r! Ú _FirewallPolicy__icmp_block_idrR r3 r r rž r. rE r` Ú$_FirewallPolicy__register_icmp_blockr Ú&_FirewallPolicy__unregister_icmp_blockri ) r" r? r, rw rx rI rk r£ Úicmp_idrÎ rl r$ r$ r% rƒ F s(
ÿ
z FirewallPolicy.add_icmp_blockc C s |j |¡ d S r )rR r4 )r" r£ r1 rw rx r$ r$ r% Z__register_icmp_blockc s z$FirewallPolicy.__register_icmp_blockc C sª | j |¡}| j ¡ | j| }| |¡}||jvrX|jr@|jn|}ttj d||f ƒ‚|d u rj|
¡ }n|}|j r„| d|||¡ |
| j||¡ |d u r¦| d¡ |S rÏ )r rA rœ r! r. rR r3 r r r¨ r. rE r` rª r0 ri ) r" r? r, rI rk r£ r1 rÎ rl r$ r$ r% r„ f s$
ÿ
z FirewallPolicy.remove_icmp_blockc C s ||j v r|j |¡ d S r )rR r¬ )r" r£ r1 r$ r$ r% Z__unregister_icmp_block€ s
z&FirewallPolicy.__unregister_icmp_blockc C s | |¡| |¡jv S r )r. r2 rR )r" r? r, r$ r$ r% Úquery_icmp_block„ s z FirewallPolicy.query_icmp_blockc C s | |¡jS r )r2 rR rt r$ r$ r% Úlist_icmp_blocks‡ s z FirewallPolicy.list_icmp_blocksc C sî | j |¡}| j ¡ | j| }|jrF|jr2|jn|}ttjd| ƒ‚|d u rX| ¡ }n|}|j
rŒ|j D ]}| d|||¡ qh|
d||¡ | ||¡ | | j||¡ |j
rØ|j D ]}| d|||¡ q´|
d||¡ |d u rê| d¡ |S )Nz,icmp-block-inversion already enabled in '%s'FT)r rA rœ r! rU r3 r r rž r. rE rR r` Ú_icmp_block_inversionÚ._FirewallPolicy__register_icmp_block_inversionr Ú*_FirewallPolicy__undo_icmp_block_inversionri ) r" r? rx rI rk r£ rÎ rl rp r$ r$ r% Úadd_icmp_block_inversionŒ s2
þ
z'FirewallPolicy.add_icmp_block_inversionc C s
d|_ d S r ©rU )r" r£ rx r$ r$ r% Z __register_icmp_block_inversion³ s z.FirewallPolicy.__register_icmp_block_inversionc C s` | ¡ }|jr*|jD ]}| d|||¡ qd|_|jrR|jD ]}| d|||¡ q<| d¡ d S )NFT)r. rE rR r` rU ri )r" rk r£ rl rp r$ r$ r% Z__undo_icmp_block_inversion¶ s
z*FirewallPolicy.__undo_icmp_block_inversionc C sì | j |¡}| j ¡ | j| }|jsF|jr2|jn|}ttjd| ƒ‚|d u rX| ¡ }n|}|j
rŒ|j D ]}| d|||¡ qh|
d||¡ | |¡ | | j|d ¡ |j
rÖ|j D ]}| d|||¡ q²|
d||¡ |d u rè| d¡ |S )Nz(icmp-block-inversion not enabled in '%s'FT)r rA rœ r! rU r3 r r r¨ r. rE rR r` r4 Ú0_FirewallPolicy__unregister_icmp_block_inversionr r5 ri )r" r? rI rk r£ rÎ rl rp r$ r$ r% Úremove_icmp_block_inversionÇ s6
þ
ÿ
z*FirewallPolicy.remove_icmp_block_inversionc C s
d|_ d S r r8 r r$ r$ r% Z!__unregister_icmp_block_inversionî s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | |¡jS r )r2 rU rt r$ r$ r% Úquery_icmp_block_inversionñ s z)FirewallPolicy.query_icmp_block_inversionc
C sä | j j |¡}|jr*| j jj|j d }n|}|rT|| jv rt||f| j| v rtd S n || jvsp||f| j| vrtd S | j ¡ D ]2}|jr~|| ¡ v r~|
||||¡} | || ¡ q~| ||||fg¡ |
| j || ||fg¡ d S ©Nr )r r? r2 r3 r= Z_zone_policiesr Úenabled_backendsÚpolicies_supportedZget_available_tablesZbuild_policy_chain_rulesÚ add_rulesÚ_register_chainsr )
r" r? Úcreaterm rn rl rC Ztracking_policyÚbackendÚrulesr$ r$ r% r[ ô s*
ÿ
ÿ
ÿz FirewallPolicy.gen_chain_rulesc C s^ |D ]T\}}|r*| j |g ¡ ||f¡ q| j | ||f¡ t| j | ƒdkr| j |= qd S r< )r Ú
setdefaultr4 r¬ r© )r" r? rA Ztablesrm rn r$ r$ r% r@ s z FirewallPolicy._register_chainsc C s$ | j j |¡dkrd S | j j |¡S )Nzhash:mac)r rÀ Úget_typeZ
get_family©r" rB r$ r$ r% rÅ s z FirewallPolicy._ipset_familyc C s | j j |¡S r )r rÀ rE rF r$ r$ r% Z __ipset_type! s zFirewallPolicy.__ipset_typec C s d |g| jj |¡ ¡S )Nú,)Újoinr rÀ Z
get_dimension)r" rB Úflagr$ r$ r% Ú_ipset_match_flags$ s z!FirewallPolicy._ipset_match_flagsc C s | j j |¡S r )r rÀ Z
check_appliedrF r$ r$ r% rÄ ' s z#FirewallPolicy._check_ipset_appliedc C s* | |¡}|tvr&ttjd||f ƒ‚d S )Nz.ipset '%s' with type '%s' not usable as source)Ú_FirewallPolicy__ipset_typer r r Z
INVALID_IPSET)r" rB Z_typer$ r$ r% rà * s
ÿþz+FirewallPolicy._check_ipset_type_for_sourcec
s˜ t |jƒtkr‚ˆjj |jj¡}|d u r2|jjg}|jD ]H}||v rFq8ˆ |¡ | |¡ t
|¡}||j_ˆj |||||d q8g } |j
r–|j
g} nH|jrÞt|jtƒs´t|jtƒrÞˆjj |jj¡‰ ˆ jrÞ‡ fdd„dD ƒ} ˆ |j¡}
|
r"|j
r |j
|
kr"ttjd|
|j
f ƒ‚n|
g} | s0ddg} ‡fdd„| D ƒ} | |_t‡fd d„| D ƒƒD ]2} t |jƒtkr€ˆjj |jj¡}g } t|jƒd
krä|jr®ttjd ƒ‚| D ].}
|
|jv r²| |
¡r²| |j|
¡ q²n
| d ¡ | D ]†}t |j ƒt krèˆ |j |¡}|ˆ !|j"¡7 }t#t|ƒd d
„ d}g }|D ]š}|j$}t%|ƒ}| &dd¡}| |¡ |j
dkrˆ| |j
¡sˆqBt|j'ƒdk r¤| |¡ n6|j'D ].\}}| (||||||j|¡}| )| |¡ qªqB| *|¡ |j'D ]*\}}| +||||||¡}| )| |¡ qî|j,D ]$}| -|||||¡}| )| |¡ q |j.D ]*\}}| /||||||¡}| )| |¡ qLqòq^t |jƒt0krÐ|jj1}|jj2}ˆ 3||¡ | +||||d |¡}| )| |¡ q^t |jƒt4kr|jj5}ˆ 6|¡ | -|||d |¡}| )| |¡ q^t |jƒt7krX|jj5}ˆ 8|¡ | 9|||d |¡}| )| |¡ q^t |jƒt:kr°|r’| D ] }
| |
¡rr| ;t<|
¡ qr| =|||¡}| )| |¡ q^t |jƒt>krH|jj1}|jj2}|jj?}|jj@}| D ]<}
| |
¡rˆ A|
||||¡ |rä|rä| ;t<|
¡ qä| B|||||||¡}| )| |¡ q^t |jƒtCkr–|jj1}|jj2}ˆ 3||¡ | /||||d |¡}| )| |¡ nút |jƒtks¶t |jƒtkrRˆjj |jj¡‰ |j
r ˆ jr |j
ˆ jvr ttjDd|j
|jjf ƒ‚t |jƒtkr4|j r4t |j ƒt kr4ttjdƒ‚| E||ˆ |¡}| )| |¡ n>|jd u rz| F|||¡}| )| |¡ nttjdt |jƒ ƒ‚q^d S )N©Úincluded_servicesc s g | ]}|ˆ j v r|‘qS r$ )Ú destination©rö r! )Úictr$ r% r÷ G ró z0FirewallPolicy._rule_prepare..©r¼ r½ z;Source address family '%s' conflicts with rule family '%s'.r¼ r½ c s g | ]}ˆ j |¡r|‘qS r$ )r Úis_ipv_enabledrO r( r$ r% r÷ X ró c s g | ]}ˆ j |¡‘qS r$ )r Úget_backend_by_ipv)rö rð r( r$ r% r÷ ] ró r z"Destination conflict with service.c S s | j S r ©rB rï r$ r$ r% rò u ró z.FirewallPolicy._rule_prepare..©ro Ú conntrackÚnatr¿ rV z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)GÚtypeÚelementr r rÔ Ú get_servicerB ÚincludesrÒ r4 r‘ ÚdeepcopyrÈ Úfamilyr^ r r ÚconfigÚ get_icmptyperN rÇ rÆ r r r Úipvsr; r© Úis_ipv_supportedÚactionr rå rã rá rÞ r/ râ r
ÚreplacerN Ú build_policy_helper_ports_rulesr? Z add_modulesÚbuild_policy_ports_rulesrT Úbuild_policy_protocol_rulesrQ Ú build_policy_source_ports_rulesr ré rê ræ r Úvaluer r r Z build_policy_tcp_mss_clamp_rulesr rª r Ú build_policy_masquerade_rulesr Zto_portZ
to_addressr$ Ú build_policy_forward_port_rulesr ZINVALID_ICMPTYPEÚ build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules) r" rj r? r¹ rl rM ÚsvcÚincludeZ_ruler` Z
source_ipvrB Z destinationsr! rN rÞ rã rÛ râ rä Ú
nat_moduleré ÚprotorC rê r
r" r# r$ )rP r" r% rÈ 2 sJ
ÿ ÿ
ÿ
þ
ÿ
ÿ ÿ ÿ
ÿ
ÿ
þ ÿ ÿ
ÿ ÿÿÿ ÿÿ ÿÿz FirewallPolicy._rule_preparec C s> | j j |¡}| |j|¡}|| |j¡7 }tt|ƒdd„ d}|d u rN|g}|j D ]6}||v rbqT|
|¡ | |¡ | j |||||d qTg } dD ]f}
| j
|
¡s¦q”| j |
¡} t|jƒdkrà|
|jv rú| | |j|
f¡ q”| d f| vr”| | d f¡ q”| D ]6\} } |D ]œ}
|
j}t|ƒ}|
j dd¡}| |¡ |
jd krV| |
j¡sVqt|
jƒd
k rr| |¡ n6|
jD ].\}}| ||||| |
j|¡}| | |¡ qxq|jD ](\}}| ||||| ¡}| | |¡ q²|j D ]"}| |||| ¡}| | |¡ qâ|j D ](\}}| ||||| ¡}| | |¡ q q d S ) Nc S s | j S r rT rï r$ r$ r% rò þ ró z)FirewallPolicy._service..rU rL rQ r rV rW r¿ rV ) r rÔ rZ rå rã rá rÞ r/ r; r[ rÒ r4 rb rR rS r© rN râ r
rc Z
add_moduler] ra rN rd rB r? re rT rf rQ rg )r" rj r? rÔ rl rM rl rÞ rm Z backends_ipvr! rB rN rÛ râ rä rn ré ro rC rê r$ r$ r% rb ú sj
þ
ÿ
ÿ
ÿzFirewallPolicy._servicec C s8 | j ¡ D ](}|jsq
| ||||¡}| ||¡ q
d S r )r r= r> re r? ©r" rj r? ré rê rl rB rC r$ r$ r% rc : s
ÿzFirewallPolicy._portc C s6 | j ¡ D ]&}|jsq
| |||¡}| ||¡ q
d S r )r r= r> rf r? )r" rj r? rê rl rB rC r$ r$ r% rd C s
zFirewallPolicy._protocolc C s8 | j ¡ D ](}|jsq
| ||||¡}| ||¡ q
d S r )r r= r> rg r? rp r$ r$ r% re K s
zFirewallPolicy._source_portc C s8 d}| t|¡ | j |¡}| ||¡}| ||¡ d S )Nr¼ )rª r r rS ri r? )r" rj r? rl r! rB rC r$ r$ r% rf S s
zFirewallPolicy._masqueradec C sX t d|ƒrd}nd}|r(|r(| t|¡ | j |¡} | ||||||¡}
| | |
¡ d S )Nr½ r¼ )r rª r r rS rj r? ) r" rj r? rl ré rê r" r# r! rB rC r$ r$ r% ra [ s
þz FirewallPolicy._forward_portc
C sz | j j |¡}| j ¡ D ]\}|js$qd}|jrTdD ] }||jv r2| |¡s2d} qTq2|rZq| |||¡} | || ¡ qd S )NFrQ T) r r^ r_ r= r> rN ra rk r? )
r" rj r? r, rl rP rB Z skip_backendr! rC r$ r$ r% r` j s
zFirewallPolicy._icmp_blockc C sb | j | j}|dv rd S | |¡s.|dkr.d S | j ¡ D ]$}|jsDq8| ||¡}| ||¡ q8d S )N)ZDROPz
%%REJECT%%ZREJECTZACCEPT)r! Útargetr; r r= r> Z'build_policy_icmp_block_inversion_rulesr? )r" rj r? rl rq rB rC r$ r$ r% r4 s z$FirewallPolicy._icmp_block_inversionc C s& t | jƒ}| |||¡ | d¡ d S r )r r r\ ri )r" rj r? rl r$ r$ r% Ú!_ingress_egress_zones_transaction’ s
z0FirewallPolicy._ingress_egress_zones_transactionc C s | j | }|j}|j}tƒ }tƒ }tƒ } tƒ }
|D ]:} | dv r@q2|t| jj | ¡ƒO }| t| jj | ¡ƒO } q2|D ]:} | dv r€qr|t| jj | ¡ƒO }|
t| jj | ¡ƒO }
qr| j ¡ D ]D} | j sÄq¸|
|¡D ],\}
}| |||
|||| |
¡}| | |¡ qÎq¸d S )N)r: r9 )
r! r< r> r; r r= Zlist_interfacesZ list_sourcesr= r> rY Z!build_policy_ingress_egress_rulesr? )r" rj r? rl rC r< r> Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr= rB rm rn rC r$ r$ r% r\ — s4
þz$FirewallPolicy._ingress_egress_zonesc C s | j | }d|jv r r Únftables_enabledr4 Z_firewall_backendr= Zget_zoneZ
interfaces)r" r? rC Útcr= r$ r$ r% rY · sl
z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sf | j | }d|jv r0dg}| jjs,| d¡ |S d|jv rBg d¢S d|jv rRdgS ttjd| ƒ‚dS ) z8Create a list of (table, chain) needed for zone dispatchr9 rs rx r: r} r| zInvalid policy: %sN) r! r> r r~ r4 r< r r ÚINVALID_POLICY)r" r? rC r r$ r$ r% rZ
s
z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s– | j j |¡}|jr |j}n|| }d|jv rh|dkr>d| S |dkrNd| S |jsd|dv rdd| S nd|jv rŠ|jsˆ|dv rˆd| S nòd |jv rÔ|dkr¤d
| S |d krÂ|r¸d | S d| S n|d
v rÒd| S n¨d |jv r.|dkrðd
| S |d kr|rd | S d| S n|d
v r||js|d| S nN|js||dkrHd
| S |d krj|r`d | S d| S n|d
v r|d| S ttjd|||f ƒ‚d S )Nr9 rø ZIN_ry ZPRE_)rw rW )rø rW ZOUT_r: ZFWD_rW ZPOST_)rw ry z.Can't convert policy to chain name: %s, %s, %s) r r? r2 r3 r> r< r r r€ )r" r? rm Z
policy_prefixZisSNATrC Úsuffixr$ r$ r% Úpolicy_base_chain_name! sZ
z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)€Ú__name__Ú
__module__Ú __qualname__r& r) r+ r. r1 r8 r@ r2 rD rG rK rL rq rJ rF ru r” r˜ r r rŸ rŽ r¡ r¯ r° r± r² r r³ r r´ rµ r¶ rº rÊ rÇ rg ry rË r| rÌ rÐ rÑ rÒ rÕ r rÖ r€ r× rÙ rÚ rá rå ræ rù r rú r‚ rû r r r r r r‰ r rŠ r r r r r‹ r rŒ r r r r… r r† r r r$ r% r‡ r& rˆ r' r) r* r- r. rƒ r/ r„ r0 r2 r3 r7 r5 r6 r: r9 r; r[ r@ rÅ rK rJ rÄ rà rÈ rb rc rd re rf ra r` r4 rr r\ rY rZ r‚ r$ r$ r$ r% r s>
F 5 ÿ
& # ÿ
& # ÿ
ÿ
ÿ
ÿ
ÿ
(ÿ
) ÿ
ÿ
ÿ
(ÿ
) ÿ
þ
ÿ
ÿ
ÿ
ÿ
' ' I @ ÿ
Vr )%r‘ Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r
r r r
r~ r r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.core.baser Úobjectr r$ r$ r$ r% Ú s 44