a
«°iß© ã @ sÀ d dl Z d dlmZmZmZ d dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
mZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZm Z d d l m Z d d
l m Z G d d „ d e!ƒZ"dS )
é N)Ú SHORTCUTSÚDEFAULT_ZONE_TARGETÚSOURCE_IPSET_TYPES)ÚFirewallTransaction)ÚPolicy)Úlog) ÚRich_ForwardPortÚRich_IcmpBlockÚ
Rich_IcmpTypeÚ Rich_MarkÚRich_MasqueradeÚ Rich_PortÚ
Rich_ProtocolÚ Rich_RuleÚ Rich_ServiceÚRich_SourcePortÚRich_Tcp_Mss_Clamp)Únm_get_bus_name)Ú checkIPnMaskÚ
checkIP6nMaskÚ check_mac)Úerrors)Ú
FirewallErrorc @ s& e Zd ZdZdd„ Zdd„ Zdd„ Zdd „ Zd
d „ Zd d
„ Z dd„ Z
dd„ Z dd„ Z dd„ Z
dd„ Zdd„ Zdd„ Zd½d d „Zd d „ Zd!d"„ Zd#d$„ Zd¾d%d&„Zd'd(„ Zd¿d)d*„ZdÀd+d,„Zd-d.„ Zd/d0„ Zd1d2„ Zd3d4„ Z d5d6„ Z dÁd8d9„Z d:d;„ Z dÂdd?„Z!dÄd@dA„Z"dBdC„ Z#dDdE„ Z$dFdG„ Z%dÅdIdJ„Z&dÆdKdL„Z'dÇdMdN„Z(dOdP„ Z)dÈdQdR„Z*dÉdSdT„Z+dUdV„ Z,dWdX„ Z-dYdZ„ Z.dÊd[d\„Z/d]d^„ Z0d_d`„ Z1dadb„ Z2dcdd„ Z3dedf„ Z4dgdh„ Z5dËdidj„Z6dkdl„ Z7dmdn„ Z8dodp„ Z9dÌdqdr„Z:dsdt„ Z;dudv„ Zd{d|„ Z?d}d~„ Z@dd€„ ZAdd‚„ ZBdÎdƒd„„ZCd…d†„ ZDd‡dˆ„ ZEd‰dŠ„ ZFdÏd‹dŒ„ZGddŽ„ ZHdd„ ZId‘d’„ ZJdÐd“d”„ZKd•d–„ ZLd—d˜„ ZMdÑd™dš„ZNdÒd›dœ„ZOdÓddž„ZPdŸd „ ZQdÔd¡d¢„ZRd£d¤„ ZSd¥d¦„ ZTd§d¨„ ZUdÕd©dª„ZVd«d¬„ ZWdd®„ ZXd¯d°„ ZYd±d²„ ZZdÖd³d´„Z[dµd¶„ Z\d×d·d¸„Z]d¹dº„ Z^d»d¼„ Z_d S )ØÚ FirewallZoner c C s || _ i | _i | _d S ©N)Ú_fwÚ_zonesÚ_zone_policies)ÚselfÚfw© r ú9/usr/lib/python3.9/site-packages/firewall/core/fw_zone.pyÚ__init__0 s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))Ú __class__r ©r r r r! Ú__repr__5 s zFirewallZone.__repr__c C s | j ¡ | j ¡ d S r )r Úclearr r$ r r r! Úcleanup8 s
zFirewallZone.cleanupc C s t | jƒ}| | jj¡ |S r )r r Zadd_preÚfull_check_config)r Útr r r! Únew_transaction< s
z FirewallZone.new_transactionc C s dj ||dS )Nzzone_{fromZone}_{toZone})ÚfromZoneÚtoZone)Úformat)r r+ r, r r r! Úpolicy_name_from_zonesA s z#FirewallZone.policy_name_from_zonesc C s t | j ¡ ƒS r )Úsortedr Úkeysr$ r r r! Ú get_zonesF s zFirewallZone.get_zonesc C s4 g }| ¡ D ]"}| |¡s$| |¡r | |¡ q |S r )r1 Úlist_interfacesÚ list_sourcesÚappend)r Z active_zonesÚzoner r r! Úget_active_zonesI s
z FirewallZone.get_active_zonesc C s2 | |¡}| jD ] }|| j| jv r| S qd S r )Ú_FirewallZone__interface_idr Ú
interfaces)r Ú interfaceÚ interface_idr5 r r r! Úget_zone_of_interfaceP s
z"FirewallZone.get_zone_of_interfacec C s2 | |¡}| jD ] }|| j| jv r| S qd S r )Ú_FirewallZone__source_idr Úsources)r ÚsourceÚ source_idr5 r r r! Úget_zone_of_sourceX s
z FirewallZone.get_zone_of_sourcec C s | j |¡}| j| S r )r Ú
check_zoner )r r5 Úzr r r! Úget_zone` s zFirewallZone.get_zonec C sH t ƒ }|j|_| ||¡|_| j|_|j|_|g|_|g|_dD ] }||jkrz|dkrz|dv rzt ||t
t ||ƒ¡ƒ q@|dkr®||jkr®|dv r®t ||t
t ||ƒ¡ƒ q@||jkrâ|dkrâ|dv rât ||t
t ||ƒ¡ƒ q@|dv r@g |_
g |_|j
D ]D}| ||¡}t|d}|| |j|¡v rü|j
|¡ |j |¡ qüq@|S ) N) ÚservicesÚportsÚ
masqueradeÚ
forward_portsÚ source_portsÚ icmp_blocksÚicmp_block_inversionÚ rules_strÚ protocolsÚHOST)rD rE rH rI rJ rL ÚANY)rF )rG )rK ©Úrule_str)r ÚnameZderived_from_zoner. ÚZONE_POLICY_PRIORITYÚpriorityÚtargetZ
ingress_zonesZ egress_zonesÚsetattrÚcopyÚdeepcopyÚgetattrrK Úrulesr Ú_rich_rule_to_policiesr4 ) r Úz_objr+ r, Úp_objZsettingrP Zcurrent_policyÚruler r r! Úpolicy_obj_from_zone_objd s8
ÿÿ
z%FirewallZone.policy_obj_from_zone_objc C sr || j |j< g | j|j< |jdfd|jf|jdffD ]8\}}| |||¡}| jj |¡ | j|j |j¡ q4d S )NrM rN )r rQ r r^ r ÚpolicyZ
add_policyr4 )r Úobjr+ r, r\ r r r! Úadd_zoneŽ s ÿ zFirewallZone.add_zonec C s. | j | }|jr| |¡ | j |= | j|= d S r )r ÚappliedÚunapply_zone_settingsr )r r5 r` r r r! Ú remove_zone¡ s
zFirewallZone.remove_zoneNc C sR | ¡ D ]D}| j| }t|jƒdks2t|jƒdkrt d|¡ | j||d qd S )Nr zApplying zone '%s'©Úuse_transaction)r1 r Úlenr8 r= r Údebug1Úapply_zone_settings)r rf r5 r[ r r r! Ú apply_zones¨ s
zFirewallZone.apply_zonesc C s | j | }||_d S r )r rb )r r5 rb r` r r r! Úset_zone_applied¯ s
z FirewallZone.set_zone_appliedc C s˜ d|vr d S | d¡}t|ƒdk r&d S d }tD ]}|d t| kr.|}q.|d ur”|d | ¡ vrdd S t|ƒdksˆt|ƒdkr”|d dv r”|d |fS d S )NÚ_é r é é )Zprer ZdenyZallowZpost)Úsplitrg r r1 )r ÚchainZsplitsÚ_chainÚxr r r! Úzone_from_chainµ s&
ÿ
ÿ z FirewallZone.zone_from_chainc C st | |¡}|d u rd S |\}}|dv r0|}d}n4|dv rB|}d}n"|dv rTd}|}nttjd| ƒ‚| ||¡|fS )N)Z
PREROUTINGZFORWARDrN )ZINPUTrM )Z POSTROUTINGz&chain '%s' can't be mapped to a policy)rt r r Z
INVALID_CHAINr. )r rq rs r5 rr r+ r, r r r! Úpolicy_from_chainÉ s
z FirewallZone.policy_from_chainc C sj |dv rf| |¡}|d urf| |¡\}}|d u r:| ¡ }n|}| jj |d|||¡ |d u rf| d¡ d S )N)Úipv4Úipv6T)ru r* r r_ Zgen_chain_rulesÚexecute) r ÚipvÚtablerq rf rs r_ rr Ú transactionr r r! Úcreate_zone_base_by_chainÞ s
ÿz&FirewallZone.create_zone_base_by_chainc C s° dD ]”}t | |¡|ƒ}t|tƒr(|g}|D ]j}|dkrJ| ||||¡ q,|dkrp| |¡}| |||||¡ q,|dkr|q,q,|dkr†q,t d|||¡ q,q|r¬| |||¡ d S )N)r8 r= ÚforwardrJ r8 r= rJ r} z3Zone '%s': Unknown setting '%s:%s', unable to apply)
rX rC Ú
isinstanceÚboolÚ
_interfaceÚ check_sourceÚ_sourcer ZwarningÚ_icmp_block_inversion)r Úenabler5 r{ ÚkeyZ args_listÚargsry r r r! Ú_zone_settingsñ s&
ÿzFirewallZone._zone_settingsc C s | j |¡}| j| }|jr d S d|_|d u r8| ¡ }n|}| j| D ]$}t d||¡ | j jj ||d qF|
d||¡ |d u rŒ| d¡ d S )NTz+Applying policy (%s) derived from zone '%s're ) r rA r rb r* r r rh r_ Úapply_policy_settingsr‡ rx ©r r5 rf Ú_zoner` r{ r_ r r r! ri s
z FirewallZone.apply_zone_settingsc C s| | j |¡}| j| }|js d S |d u r2| ¡ }n|}| j| D ]}| j jj||d q@| d||¡ |d u rx| d¡ d S )Nre FT)
r rA r rb r* r r_ Úunapply_policy_settingsr‡ rx r‰ r r r! rc s
z"FirewallZone.unapply_zone_settingsc C sz | |¡}| |¡}g }tdƒD ]P}|j| d |vrX| t t||j| d ƒ¡¡ q | ||j| d ¡ q t|ƒS )úH
:return: exported config updated with runtime settings
é r ) rC Ú get_config_with_settings_dictÚrangeZIMPORT_EXPORT_STRUCTUREr4 rV rW rX Útuple)r r5 r` Z conf_dictZ conf_listÚir r r! Úget_config_with_settings1 s
"z%FirewallZone.get_config_with_settingsc C s– | |¡ ¡ }|d tkr"d|d< | |¡| |¡| |¡| |¡| |¡| |¡| |¡|
|¡| |¡| |¡|
|¡| |¡dœ }| j ||¡S )rŒ rT Údefault© rD rE rI rF rG r8 r= rK rL rH rJ r} )rC Zexport_config_dictr Ú
list_servicesÚ
list_portsÚlist_icmp_blocksÚquery_masqueradeÚlist_forward_portsr2 r3 Ú
list_rulesÚlist_protocolsÚlist_source_portsÚquery_icmp_block_inversionÚ
query_forwardr Z'combine_runtime_with_permanent_settings)r r5 Z permanentZruntimer r r! rŽ A s" õ
z*FirewallZone.get_config_with_settings_dictc
s, d
‡ fdd„ }‡ fdd„}ˆ j ˆ jfˆ jˆ jfˆ jˆ jfˆ jˆ jfˆ jˆ j fˆ j
ˆ j fˆ j ˆ j
f||fˆ jˆ jfˆ jˆ jfˆ jˆ jfˆ jˆ jfdœ }ˆ |¡}t |¡}| |ˆ j ¡ ¡ ˆ j d|gi¡ ˆ |¡} ˆ j | |¡\}
} | D ]n} t | | t ƒrJ| | D ]>}
t |
t ƒr2|| d |g|
¢R Ž n|| d ||
ƒ qqì|| d |ƒ qì|
D ]Æ} t |
| t ƒrî|
| D ]n}
| d v r¢|| d ||
|d
nFt |
t ƒrÐ|| d |g|
¢R d|d œŽ n|| d ||
d|d q|n6| d v r|| d ||d
n|| d |d|d q`d S )Nr c s ˆ j | t|dd|d d S )NrO r ©ÚtimeoutÚsender)Úadd_ruler )r5 rP r r¡ r$ r r! Úadd_rule_wrapperY s zDFirewallZone.set_config_with_settings_dict..add_rule_wrapperc s ˆ | t|d¡ d S )NrO )Ú remove_ruler )r5 rP r$ r r! Úremove_rule_wrapper[ s zGFirewallZone.set_config_with_settings_dict..remove_rule_wrapperr” Zzonesrn )r8 r= )r¡ rŸ )rJ )r N)!Ú add_serviceÚremove_serviceÚadd_portÚ remove_portÚadd_icmp_blockÚremove_icmp_blockÚadd_masqueradeÚremove_masqueradeÚadd_forward_portÚremove_forward_portÚ
add_interfaceÚremove_interfaceÚ
add_sourceÚ
remove_sourceÚ add_protocolÚremove_protocolÚadd_source_portÚremove_source_portÚadd_icmp_block_inversionÚremove_icmp_block_inversionÚ add_forwardÚremove_forwardrC rV Zimport_config_dictr Zget_all_io_objects_dictr( rŽ Z get_added_and_removed_settingsr~ Úlistr )r r5 Zsettingsr¡ r£ r¥ Z
setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsr… r† r r$ r! Ú set_config_with_settings_dictW sN
ô
"
z*FirewallZone.set_config_with_settings_dictc C s | j |¡ d S r )r Úcheck_interface©r r9 r r r! r¾ • s z FirewallZone.check_interfacec C s | |¡ |S r )r¾ r¿ r r r! Z__interface_id˜ s
zFirewallZone.__interface_idTc C s
| j ¡ | j |¡}| j| }| |¡}||jv rHttjd||f ƒ‚| |¡} | d urnttj
d|| f ƒ‚t d||f ¡ |d u r’|
¡ }
n|}
|js¾|r¾| j||
d |
| j|d¡ |rÒ| d|||
¡ | ||||¡ |
| j||¡ |d u r|
d¡ |S )Nú'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s're FT)r Ú check_panicrA r r7 r8 r r ÚZONE_ALREADY_SETr; Ú
ZONE_CONFLICTr rh r* rb ri Úadd_failrk r€ Ú!_FirewallZone__register_interfaceÚ#_FirewallZone__unregister_interfacerx ) r r5 r9 r¡ rf Ú allow_applyrŠ Ú_objr: Úzoir{ r r r! r° œ sJ
ÿÿ
ÿÿÿ
ÿ
ÿ
zFirewallZone.add_interfacec C sB |j |¡ |r|dkr&| jj |¡ |tƒ kr>| jj |¡ d S )NÚ )r8 r4 r Ú_default_zone_interfacesr Ú_nm_assigned_interfaces)r rÈ r: r5 r¡ r r r! Z__register_interfaceÇ s
z!FirewallZone.__register_interfacec C sR | j ¡ | |¡}| j |¡}||kr,|S |d ur@| ||¡ | |||¡}|S r )r rÁ r; rA r± r° )r r5 r9 r¡ Ú _old_zoneÚ _new_zonerŠ r r r! Úchange_zone_of_interfaceÎ s
z%FirewallZone.change_zone_of_interfacec C sz | j ¡ |d u r | ¡ }n|}| ||¡ | jd|d|dd |d urd|dkrd| jd|d|dd |d u rv| d¡ d S )NTú+)r4 rÊ F)r rÁ r* ri r€ rx )r Zold_zoneZnew_zonerf r{ r r r! Úchange_default_zoneÝ s
z FirewallZone.change_default_zonec C s | j ¡ | |¡}|d u r,ttjd| ƒ‚|dkr8|n
| j |¡}||krbttjd|||f ƒ‚|d u rt| ¡ }n|}| j | }|
|¡}| | j ||¡ |
d|||¡ |d u r¾| d¡ |S )Nú'%s' is not in any zonerÊ z"remove_interface(%s, %s): zoi='%s'FT)r rÁ r; r r ZUNKNOWN_INTERFACErA rà r* r r7 Úadd_postrÆ r€ rx ) r r5 r9 rf rÉ rŠ r{ rÈ r: r r r! r± í s.
ÿÿÿ
z FirewallZone.remove_interfacec C sN ||j v r|j |¡ || jjv r0| jj |¡ || jjv rJ| jj |¡ d S r )r8 Úremover rË rÌ )r rÈ r: r r r! Z__unregister_interface s
z#FirewallZone.__unregister_interfacec C s | |¡| |¡jv S r )r7 rC r8 )r r5 r9 r r r! Úquery_interface s z FirewallZone.query_interfacec C s | |¡jS r )rC r8 ©r r5 r r r! r2 s z FirewallZone.list_interfacesFc C sx t |ƒr dS t|ƒrdS t|ƒr$dS | d¡rh| |dd … ¡ |rV| |dd … ¡ | |dd … ¡S ttj |ƒ‚d S )Nrv rw rÊ zipset:é )
r r r Ú
startswithÚ _check_ipset_type_for_sourceÚ_check_ipset_appliedÚ
_ipset_familyr r Z INVALID_ADDR©r r> rb r r r! r s
zFirewallZone.check_sourcec C s | j ||d |S )N©rb )r rÜ r r r! Z __source_id( s zFirewallZone.__source_idc C s | j ¡ | j |¡}| j| }t|ƒr0| ¡ }| j||d}| j||d} | |jv rjt t
j d||f ƒ‚| |¡d urˆt t
j
d| ƒ‚|d u rš| ¡ }
n|}
|jsÆ|rÆ| j||
d |
| j|d¡ |rÜ| d||| |
¡ | || ||¡ |
| j|| ¡ |d u r|
d¡ |S )NrÝ rÀ z '%s' already bound to a zonere FT)r rÁ rA r r Úupperr r< r= r r r r@ rà r* rb ri rÄ rk r‚ Ú _FirewallZone__register_sourceÚ _FirewallZone__unregister_sourcerx ) r r5 r> r¡ rf rÇ rŠ rÈ ry r? r{ r r r! r² , s<
ÿÿ
ÿ
zFirewallZone.add_sourcec C s |j |¡ d S r )r= r4 )r rÈ r? r5 r¡ r r r! Z__register_sourceT s z FirewallZone.__register_sourcec C sb | j ¡ | |¡}| j |¡}||kr,|S t|ƒr<| ¡ }|d urP| ||¡ | |||¡}|S r )r rÁ r@ rA r rÞ r³ r² )r r5 r> r¡ rÍ rÎ rŠ r r r! Úchange_zone_of_sourceW s
z"FirewallZone.change_zone_of_sourcec
C sÞ | j ¡ t|ƒr| ¡ }| |¡}|d u r rf ZzosrŠ r{ rÈ ry r? r r r! r³ i s4
ÿÿÿ
zFirewallZone.remove_sourcec C s ||j v r|j |¡ d S r )r= rÔ )r rÈ r? r r r! Z__unregister_sourceˆ s
z FirewallZone.__unregister_sourcec C s& t |ƒr| ¡ }| |¡| |¡jv S r )r rÞ r< rC r= )r r5 r> r r r! Ú query_sourceŒ s zFirewallZone.query_sourcec C s | |¡jS r )rC r= rÖ r r r! r3 ‘ s zFirewallZone.list_sourcesc sp ˆ j ¡ D ]–}|jsq
ˆ j| D ]>}ˆ j j |¡D ]*\}} | |||||| |¡}
| ||
¡ q2q ˆ |d¡}ˆ |¡j
r
|dvr
|j |||d|d}
| ||
¡ q
ˆ j j ¡ D ]¼}|ˆ j j
|¡vrØ|ˆ j j |¡vrØq®|ˆ j j ¡ v rRˆ j j |¡jrR|s*tˆ |¡ƒdkr*ˆ j jj||d n&ˆ j j d||¡ | ‡ fdd „|¡ q®|r®| ‡ fd
d „|¡ q®d S ) NrN )rÐ Ú*Úfilter©r9 rn re Fc s | ˆ j j ¡ v o ˆ j j d| ¡S ©NT©r r_ Ú)get_active_policies_not_derived_from_zoneZ!_ingress_egress_zones_transaction©Úpr$ r r! Ú¸ s z)FirewallZone._interface..c s | ˆ j j ¡ v o ˆ j j | ¡S r ©r r_ rè rˆ ré r$ r r! rë » s )r Úenabled_backendsÚpolicies_supportedr r_ Ú#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rulesÚ add_rulesr. rC r} Úbuild_zone_forward_rulesÚ"get_policies_not_derived_from_zoneÚlist_ingress_zonesÚlist_egress_zonesrè Ú
get_policyrb rg r2 r‹ Ú_ingress_egress_zonesrÓ ) r r„ r5 r9 r{ r4 Úbackendr_ rz rq rY r r$ r! r€ ” s: ÿ ÿ$ÿÿzFirewallZone._interfacec C s$ | |¡dkrd S | jjj|ddS )Nzhash:macFrÝ )Ú _ipset_typer ÚipsetZ
get_family©r rQ r r r! rÛ À s zFirewallZone._ipset_familyc C s | j jj|ddS )NFrÝ )r rù Zget_typerú r r r! rø Å s zFirewallZone._ipset_typec C s d |g| jj |¡ ¡S )Nú,)Újoinr rù Z
get_dimension)r rQ Úflagr r r! Ú_ipset_match_flagsÈ s z FirewallZone._ipset_match_flagsc C s | j j |¡S r )r rù Z
check_appliedrú r r r! rÚ Ë s z!FirewallZone._check_ipset_appliedc C s* | |¡}|tvr&ttjd||f ƒ‚d S )Nz.ipset '%s' with type '%s' not usable as source)rø r r r Z
INVALID_IPSET)r rQ Z_typer r r! rÙ Î s
ÿþz)FirewallZone._check_ipset_type_for_sourcec sx |rˆ j |¡gnˆ j ¡ D ]Œ}|js(q ˆ j| D ]<}ˆ j j |¡D ](\}} | |||||| ¡}
| ||
¡ qDq2ˆ |d¡}ˆ
|¡j r |j |||d|d}
| ||
¡ q ˆ j j
¡ D ]¼}|ˆ j j |¡vrà|ˆ j j |¡vràq¶|ˆ j j ¡ v rZˆ j j |¡jrZ|s2tˆ |¡ƒdkr2ˆ j jj||d n&ˆ j j d||¡ | ‡ fdd„|¡ q¶|r¶| ‡ fd d„|¡ q¶d S )
NrN rä ©r> rn re Fc s | ˆ j j ¡ v o ˆ j j d| ¡S ræ rç ré r$ r r! rë ø s z&FirewallZone._source..c s | ˆ j j ¡ v o ˆ j j | ¡S r rì ré r$ r r! rë û s )r Úget_backend_by_ipvrí rî r r_ rï Z build_zone_source_address_rulesrð r. rC r} rñ rò ró rô rè rõ rb rg r3 r‹ rö rÓ ) r r„ r5 ry r> r{ r÷ r_ rz rq rY r r$ r! r‚ Ö s: ÿ ÿ$ÿÿzFirewallZone._sourcec C s0 | j |¡}| |d¡}| j j ||||¡ |S ©NrM )r rA r. r_ r¦ )r r5 Úservicer r¡ Úp_namer r r! r¦ þ s zFirewallZone.add_servicec C s, | j |¡}| |d¡}| j j ||¡ |S r )r rA r. r_ r§ ©r r5 r r r r r! r§ s zFirewallZone.remove_servicec C s( | j |¡}| |d¡}| j j ||¡S r )r rA r. r_ Ú
query_servicer r r r! r
s zFirewallZone.query_servicec C s& | j |¡}| |d¡}| j j |¡S r )r rA r. r_ r• ©r r5 r r r r! r• s zFirewallZone.list_servicesc C s2 | j |¡}| |d¡}| j j |||||¡ |S r )r rA r. r_ r¨ )r r5 ÚportÚprotocolr r¡ r r r r! r¨ s zFirewallZone.add_portc C s. | j |¡}| |d¡}| j j |||¡ |S r )r rA r. r_ r© ©r r5 r r r r r r! r© s zFirewallZone.remove_portc C s* | j |¡}| |d¡}| j j |||¡S r )r rA r. r_ Ú
query_portr r r r! r
s zFirewallZone.query_portc C s& | j |¡}| |d¡}| j j |¡S r )r rA r. r_ r– r r r r! r– % s zFirewallZone.list_portsc C s2 | j |¡}| |d¡}| j j |||||¡ |S r )r rA r. r_ r¶ )r r5 Ú source_portr r r¡ r r r r! r¶ * s z FirewallZone.add_source_portc C s. | j |¡}| |d¡}| j j |||¡ |S r )r rA r. r_ r· ©r r5 r r r r r r! r· 0 s z FirewallZone.remove_source_portc C s* | j |¡}| |d¡}| j j |||¡S r )r rA r. r_ Úquery_source_portr r r r! r
6 s z FirewallZone.query_source_portc C s& | j |¡}| |d¡}| j j |¡S r )r rA r. r_ rœ r r r r! rœ ; s z FirewallZone.list_source_portsc C sÜ | j |¡}t|jƒtkr(| |d¡gS t|jƒttt t
t t fv rP| |d¡gS t|jƒt
fv rn| |d¡gS t|jƒtfv rŒ| d|¡gS t|jƒtfv rª| |d¡gS |jd u rÂ| |d¡gS ttjdt|jƒ ƒ‚d S )NrN rM z Rich rule type (%s) not handled.)r rA ÚtypeÚactionr r. Úelementr r
r r r r
r r r r r Z INVALID_RULE)r r5 r] r r r! rZ @ s ÿ
z#FirewallZone._rich_rule_to_policiesc C s* | ||¡D ]}| jj ||||¡ q |S r )rZ r r_ r¢ )r r5 r] r r¡ r r r r! r¢ R s zFirewallZone.add_rulec C s& | ||¡D ]}| jj ||¡ q |S r )rZ r r_ r¤ )r r5 r] r r r r! r¤ W s zFirewallZone.remove_rulec C s. d}| ||¡D ]}|o&| jj ||¡}q|S ræ )rZ r r_ Ú
query_rule)r r5 r] Úretr r r r! r \ s zFirewallZone.query_rulec C sZ | j |¡}tƒ }| |d¡| |d¡| d|¡fD ] }| t| j j |¡ƒ¡ q4t|ƒS )NrN rM )r rA Úsetr. Úupdater_ rš r¼ )r r5 r r r r r! rš b s
þzFirewallZone.list_rulesc C s0 | j |¡}| |d¡}| j j ||||¡ |S r )r rA r. r_ r´ )r r5 r r r¡ r r r r! r´ k s zFirewallZone.add_protocolc C s, | j |¡}| |d¡}| j j ||¡ |S r )r rA r. r_ rµ ©r r5 r r r r r! rµ q s z FirewallZone.remove_protocolc C s( | j |¡}| |d¡}| j j ||¡S r )r rA r. r_ Úquery_protocolr r r r! r w s zFirewallZone.query_protocolc C s& | j |¡}| |d¡}| j j |¡S r )r rA r. r_ r› r r r r! r› | s zFirewallZone.list_protocolsc C s. | j |¡}| d|¡}| j j |||¡ |S ©NrN )r rA r. r_ r¬ )r r5 r r¡ r r r r! r¬ s zFirewallZone.add_masqueradec C s* | j |¡}| d|¡}| j j |¡ |S r )r rA r. r_ r r r r r! r ‡ s z FirewallZone.remove_masqueradec C s& | j |¡}| d|¡}| j j |¡S r )r rA r. r_ r˜ r r r r! r˜ s z FirewallZone.query_masqueradec C s6 | j |¡}| |d¡}| j j |||||||¡ |S r )r rA r. r_ r® ) r r5 r r ÚtoportÚtoaddrr r¡ r r r r! r® ’ s ÿz FirewallZone.add_forward_portc C s2 | j |¡}| |d¡}| j j |||||¡ |S r )r rA r. r_ r¯ ©r r5 r r r r r r r r! r¯ š s z FirewallZone.remove_forward_portc C s. | j |¡}| |d¡}| j j |||||¡S r )r rA r. r_ Úquery_forward_portr r r r! r ¡ s
ÿz FirewallZone.query_forward_portc C s& | j |¡}| |d¡}| j j |¡S r )r rA r. r_ r™ r r r r! r™ ¨ s z FirewallZone.list_forward_portsc C s0 | j |¡}| |d¡}| j j ||||¡ |S r )r rA r. r_ rª )r r5 Úicmpr r¡ r r r r! rª s zFirewallZone.add_icmp_blockc C s, | j |¡}| |d¡}| j j ||¡ |S r )r rA r. r_ r« )r r5 r r r r r! r« ´ s z FirewallZone.remove_icmp_blockc C s( | j |¡}| |d¡}| j j ||¡S r )r rA r. r_ Úquery_icmp_block)r r5 r Ú p_name_hostr r r! r » s z FirewallZone.query_icmp_blockc C s. | j |¡}| |d¡}tt| j j |¡ƒƒS r )r rA r. r/ r r_ r— ©r r5 r r r r! r— À s z FirewallZone.list_icmp_blocksc C s, | j |¡}| |d¡}| j j ||¡ |S r )r rA r. r_ r¸ )r r5 r¡ r r r r! r¸ Å s z%FirewallZone.add_icmp_block_inversionc C s. | j |¡}| |d¡}| j j |||¡ d S r )r rA r. r_ rƒ )r r„ r5 r{ r r r r! rƒ Ì s z"FirewallZone._icmp_block_inversionc C s* | j |¡}| |d¡}| j j |¡ |S r )r rA r. r_ r¹ r r r r! r¹ Ñ s z(FirewallZone.remove_icmp_block_inversionc C s& | j |¡}| |d¡}| j j |¡S r )r rA r. r_ r r r r r! r Ø s z'FirewallZone.query_icmp_block_inversionc
C sÀ | |d¡}| j| jD ]<}| j ¡ D ],}|js2q&|j|||d|d}| ||¡ q&q| j| jD ]X}| |¡} | r‚| j
| ¡gn| j ¡ D ],}|js˜qŒ|j|||d|d}| ||¡ qŒqbd S )NrN rä rå rÿ ) r. r r8 r rí rî rñ rð r= r r )
r r„ r5 r{ r r9 r÷ rY r> ry r r r! Ú_forwardÝ s
zFirewallZone._forwardc C sž | j |¡}| j |¡ | j ¡ | j| }|jrBttjd| ƒ‚|d u rT| ¡ }n|}|j
rl| d||¡ | |||¡ |
| j|¡ |d u rš| d¡ |S )Nz forward already enabled in '%s'T)r rA Z
check_timeoutrÁ r r} r r ZALREADY_ENABLEDr* rb r Ú _FirewallZone__register_forwardrÄ Ú!_FirewallZone__unregister_forwardrx )r r5 r r¡ rf rŠ rÈ r{ r r r! rº ï s$
ÿ
zFirewallZone.add_forwardc C s
d|_ d S ræ ©r} )r rÈ r r¡ r r r! Z__register_forward
s z FirewallZone.__register_forwardc C s„ | j |¡}| j ¡ | j| }|js6ttjd| ƒ‚|d u rH| ¡ }n|}|j r`|
d||¡ | | j |¡ |d u r€|
d¡ |S )Nzforward not enabled in '%s'FT)r rA rÁ r r} r r Z NOT_ENABLEDr* rb r rÓ r" rx )r r5 rf rŠ rÈ r{ r r r! r»
s
ÿ
zFirewallZone.remove_forwardc C s
d|_ d S )NFr# )r rÈ r r r! Z__unregister_forward% s z!FirewallZone.__unregister_forwardc C s | |¡jS r )rC r} rÖ r r r! rž ( s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)`Ú__name__Ú
__module__Ú __qualname__rR r" r% r' r* r. r1 r6 r; r@ rC r^ ra rd rj rk rt ru r| r‡ ri rc r’ rŽ r½ r¾ r7 r° rÅ rÏ rÑ r± rÆ rÕ r2 r r< r² rß rá r³ rà râ r3 r€ rÛ rø rþ rÚ rÙ r‚ r¦ r§ r r• r¨ r© r
r– r¶ r· r
rœ rZ r¢ r¤ r rš r´ rµ r r› r¬ r r˜ r® r¯ r r™ rª r« r r— r¸ rƒ r¹ r r rº r! r» r" rž r r r r! r - sØ *
ÿ
> ÿ
+
ÿ
ÿ
(
ÿ
,(
ÿ
ÿ
ÿ
ÿ
r )#rV Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr Zfirewall.core.richr r r
r r r
r r r r r Zfirewall.core.fw_nmr Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr Úobjectr r r r r! Ú s 4