JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/firewall/core/__pycache__/fw_policy.cpython-39.opt-1.pyc
a
� iD# � @ s� d dl Z d dlmZ d dlmZmZmZmZmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" G d d
� d
e#�Z$dS ) � N)�log) �portStr� checkIPnMask�
checkIP6nMask�
checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange�checkTcpMssClamp) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port�
Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock�
Rich_IcmpType�Rich_Tcp_Mss_Clamp)�FirewallTransaction)�errors)�
FirewallError)�SOURCE_IPSET_TYPESc @ sv e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z d�dd�Z
dd� Z�d dd�Z�dd d �Z�dd d �Zd d!� Zd"d#� Zd$d%� Zd&d'� Z�dd*d+�Zd,d-� Z�dd.d/�Zd0d1� Zd2d3� Zd4d5� Zd6d7� Z d8d9� Z �dd:d;�Z d<d=� Z �dd>d?�Z d@dA� Z!dBdC� Z"dDdE� Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'�ddNdO�Z(dPdQ� Z)�ddRdS�Z*dTdU� Z+dVdW� Z,dXdY� Z-dZd[� Z.d\d]� Z/�d d^d_�Z0d`da� Z1�d
dbdc�Z2ddde� Z3dfdg� Z4dhdi� Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9�d drds�Z:dtdu� Z;�d dvdw�Z<dxdy� Z=dzd{� Z>d|d}� Z?d~d� Z@d�d�� ZAd�d�� ZB�d
d�d��ZCd�d�� ZD�dd�d��ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZI�dd�d��ZJd�d�� ZK�dd�d��ZLd�d�� ZMd�d�� ZNd�d�� ZO�dd�d��ZPd�d�� ZQ�dd�d��ZRd�d�� ZSd�d�� ZT�dd�d��ZU�dd�d��ZV�dd�d��ZWd�d�� ZX�dd�d��ZYd�d�� ZZ�dd�d��Z[d�d�� Z\d�d�� Z]d�d�� Z^�dd�d��Z_d�d�� Z`�dd�d��Zad�dÄ Zbd�dń Zcd�dDŽ Zd�dd�dɄZed�d˄ Zfd�d̈́ Zg�dd�dτZhd�dф Zid�dӄ Zjd�dՄ Zkd�dׄ Zld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zq�d d�d�Zr�d d�d�Zsd�d� Ztd�d� Zud�d� Zvd�d� Zw�d d�d�Zxd�d� Zyd�d� Zzd�d�� Z{d�d�� Z|d�d�� Z}d�d�� Z~�d d�d��ZdS ( �FirewallPolicyc C s || _ i | _i | _d S �N)�_fw�_chains� _policies)�self�fw� r$ �;/usr/lib/python3.9/site-packages/firewall/core/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz
%s(%r, %r))� __class__r r! �r" r$ r$ r% �__repr__ s zFirewallPolicy.__repr__c C s | j �� | j�� d S r )r �clearr! r( r$ r$ r% �cleanup s
zFirewallPolicy.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r" �tr$ r$ r% �new_transaction$ s
z FirewallPolicy.new_transactionc C s t | j�� �S r )�sortedr! �keysr( r$ r$ r% � get_policies+ s zFirewallPolicy.get_policiesc C s4 g }| � � D ] }| �|�}|js |�|� q t|�S r )r1 �
get_policy�derived_from_zone�appendr/ )r" �policies�p�p_objr$ r$ r% �"get_policies_not_derived_from_zone. s
z1FirewallPolicy.get_policies_not_derived_from_zonec C sv g }| � � D ]d}| �|�}t|j�t| jj�� �tddg�B @ r t|j�t| jj�� �tddg�B @ r |�|� q |S )N�HOST�ANY) r8 r2 �set�
ingress_zonesr �zoneZget_active_zones� egress_zonesr4 )r" Zactive_policies�policyr7 r$ r$ r% �)get_active_policies_not_derived_from_zone6 s
&$� z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j �|�}| j| S r )r � check_policyr! )r" r? r6 r$ r$ r% r2 @ s zFirewallPolicy.get_policyc C s || j |j< d S r )r! �name)r" �objr$ r$ r% �
add_policyD s zFirewallPolicy.add_policyc C s& | j | }|jr| �|� | j |= d S r )r! �applied�unapply_policy_settings)r" r? rC r$ r$ r% �
remove_policyG s
z FirewallPolicy.remove_policyNc C sJ | � � D ]<}| j| }|jr q|| �� v rt�d|� | j||d� qd S )NzApplying policy '%s'��use_transaction)r1 r! r3 r@ r Zdebug1�apply_policy_settings)r" rI r? r7 r$ r$ r% �apply_policiesM s
z FirewallPolicy.apply_policiesc C s | j | }||_d S r )r! rE )r" r? rE rC r$ r$ r% �set_policy_appliedV s
z!FirewallPolicy.set_policy_appliedc C sz | j �|�}| j| }|r |js*|s.|js.d S |r8d|_|d u rJ| �� }n|}|r�|jsb| �|�n| �|�D ]\}}| �|d|||� ql|js�| � |||� dD �]x} t
| � |�| �}
t |
t
�r�|r�|
s�|s�|
s�q�|
g}
|
D �]:} | dkr�| �||| |� q�| dk�r
q�q�| dk�r,| j|||g| �R � q�| dk�rH| �||| |� q�| dk�rn| �||| d | d |� q�| d
k�r�| �||| |� q�| d k�r�| �||| d | d |� q�| d k�r�| �|||� q�| d
k�r�| �||t| d�|� q�| dk�r�q�q�| dk�rq�q�t�d|| | � q�q�|�sb|j�s4| �|�n| �|�D ] \}}| �|d|||� �q>d|_|d u �rv|�|� d S )NT) �services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks� rules_str� protocols�icmp_block_inversionr< r> rR rU rP rM rN r � rT rQ rO rS ��rule_strr< r> z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rA r! rE r. r3 �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rules�_ingress_egress_zones�getattrr2 �
isinstance�bool� _icmp_block�
_forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler r �warning�execute) r" �enabler? rI �_policyrC � transaction�table�chain�keyZ args_list�argsr$ r$ r% �_policy_settingsZ s�
�
�
�
�
�
��
z FirewallPolicy._policy_settingsc C s | j d||d� d S )NTrH �rq �r" r? rI r$ r$ r% rJ � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NFrH rr rs r$ r$ r% rF � s z&FirewallPolicy.unapply_policy_settingsc C s | � |��� S r )r2 Zexport_config_dict�r" r? r$ r$ r% � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d � �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j
�j f||f�j �j
f�j�jf�j�jf�j�jfd�
}��|�}t�|�}|�|�j�� � �j�d|gi� ��|�} �j�| |�\}
} | D ]n} t | | t ��rF| | D ]>}
t |
t ��r.|| d |g|
�R � n|| d ||
� �qq�|| d |� q�|
D ]�} t |
| t ��r�|
| D ]L}
t |
t ��r�|| d |g|
�R d|d
�� n|| d ||
d|d
� �qxn|| d |d|d
� �q\d S ) Nr )r c s �j | � |d�d|d� d S )NrW r ��timeout�sender)�add_rule)r? rX rw rx �r r" r$ r% �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �� | � |d�� d S )NrW )� remove_rule)r? rX rz r$ r% �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper)
rM rN rR rO rP Z
rich_rulesrT rQ r< r> r5 rV rv )r N) �firewall.core.richr � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_protocol�remove_protocol�add_source_port�remove_source_port�add_ingress_zone�remove_ingress_zone�add_egress_zone�remove_egress_zoner2 �copyZimport_config_dictr Zget_all_io_objects_dictr, ru Z get_added_and_removed_settingsr^ �list�tuple)r" r? Zsettingsrx r{ r} Z
setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsro rp r$ rz r% � set_config_with_settings_dict� sD
�
" z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dvr"| j�|� d S �N)r9 r: �r r Z INVALID_ZONEr Z
check_zone�r" r= r$ r$ r% �check_ingress_zone� s
z!FirewallPolicy.check_ingress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__ingress_zone_id� s
z FirewallPolicy.__ingress_zone_idr Tc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| �
� }
n|}
|r�|j r�| � d||
� | �
|| ||� |
�| j|| � |j s�|| �� v r�| j||
d� |
�| j|d� n| � d||
� n | �
|| ||� |
�| j|| � |d u �r|
�d� d S �N�'%s' already in '%s'FrH T)r rA �
check_timeout� check_panicr! � _FirewallPolicy__ingress_zone_idr< r r �ALREADY_ENABLEDr. rE r\ �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner@ rJ rL ri � r" r? r= rw rx rI Z allow_applyrk �_obj�zone_idrl r$ r$ r% r� � s4
�
z FirewallPolicy.add_ingress_zonec C s |j �|� d S r )r< r4 �r" r� r� rw rx r$ r$ r% Z__register_ingress_zone s z&FirewallPolicy.__register_ingress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j
r�t |j�dkr�| � ||� n| �
d||� | �||� |�| j||d d � || �� v r�| �
d||� n|�| j||� |d u r�|�d� |S �N�'%s' not in '%s'rV FT)r rA r� r! r� r< r r � NOT_ENABLEDr. rE �lenrF r\ r� r� r� r@ �add_postri �r" r? r= rI rk r� r� rl r$ r$ r% r� s.
�
z"FirewallPolicy.remove_ingress_zonec C s ||j v r|j �|� d S r )r< �remove�r" r� r� r$ r$ r% Z__unregister_ingress_zone4 s
z(FirewallPolicy.__unregister_ingress_zonec C s | � |�| �|�jv S r )r� r2 r< �r" r? r= r$ r$ r% �query_ingress_zone8 s z!FirewallPolicy.query_ingress_zonec C s | � |�jS r )r2 r< rt r$ r$ r% �list_ingress_zones; s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dvr"| j�|� d S r� r� r� r$ r$ r% �check_egress_zone@ s
z FirewallPolicy.check_egress_zonec C s | � |� |S r )r� r� r$ r$ r% Z__egress_zone_idF s
z FirewallPolicy.__egress_zone_idc C s | j �|�}| j �|� | j �� | j| }| �|�} | |jv rTttj d||f ��|d u rf| �
� }
n|}
|r�|j r�| � d||
� | �
|| ||� |
�| j|| � |j s�|| �� v r�| j||
d� |
�| j|d� n| � d||
� n | �
|| ||� |
�| j|| � |d u �r|
�d� d S r� )r rA r� r� r! � _FirewallPolicy__egress_zone_idr> r r r� r. rE r\ �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner@ rJ rL ri r� r$ r$ r% r� J s4
�
z FirewallPolicy.add_egress_zonec C s |j �|� d S r )r> r4 r� r$ r$ r% Z__register_egress_zonep s z%FirewallPolicy.__register_egress_zonec C s� | j �|�}| j �� | j| }| �|�}||jvrHttjd||f ��|d u rZ| � � }n|}|j
r�t |j�dkr�| � ||� n| �
d||� | �||� |�| j||d d � || �� v r�| �
d||� n|�| j||� |d u r�|�d� |S r� )r rA r� r! r� r> r r r� r. rE r� rF r\ r� r� r� r@ r� ri r� r$ r$ r% r� s s.
�
z!FirewallPolicy.remove_egress_zonec C s ||j v r|j �|� d S r )r> r� r� r$ r$ r% Z__unregister_egress_zone� s
z'FirewallPolicy.__unregister_egress_zonec C s | � |�| �|�jv S r )r� r2 r> r� r$ r$ r% �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s | � |�jS r )r2 r> rt r$ r$ r% �list_egress_zones� s z FirewallPolicy.list_egress_zonesc C s |� � d S r )�check�r" �ruler$ r$ r% �
check_rule� s zFirewallPolicy.check_rulec C s | � |� t|�S r )r� �strr� r$ r$ r% Z __rule_id� s
zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| �|j� | �|j� | �|j�S d S )N�ipv4�ipv6�mac� �ipset) �addrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied�
_ipset_family)r" �sourcer$ r$ r% �_rule_source_ipv� s
z FirewallPolicy._rule_source_ipvc C s | � ||||� d S r )�
_rule_prepare)r" rj r? r� rl r$ r$ r% Z__rule� s zFirewallPolicy.__rulec C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j
d|| f ��|d u rv| � � }
n|}
|j r�| �
d|||
� | �||||� |
�| j||� |d u r�|
�d� |S �Nr� T)r rA r� r� r! �_FirewallPolicy__rule_idrS r3 r r r� r. rE rg � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_ruleri ) r" r? r� rw rx rI rk r� �rule_id�_namerl r$ r$ r% ry � s(
�
zFirewallPolicy.add_rulec C s |j �|� d S r )rS r4 )r" r� r� rw rx r$ r$ r% Z__register_rule� s z FirewallPolicy.__register_rulec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| �
� }n|}|j r�| � d|||� |�
| j||� |d u r�|�d� |S �Nr� FT)r rA r� r! r� rS r3 r r r� r. rE rg r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r| � s$
�
zFirewallPolicy.remove_rulec C s ||j v r|j �|� d S r )rS r� )r" r� r� r$ r$ r% Z__unregister_rule� s
z FirewallPolicy.__unregister_rulec C s | � |�| �|�jv S r )r� r2 rS )r" r? r� r$ r$ r% �
query_rule� s zFirewallPolicy.query_rulec C s | � |�jS r )r2 rS rt r$ r$ r% �
list_rules s zFirewallPolicy.list_rulesc C s | j �|� d S r )r �
check_service�r" �servicer$ r$ r% r� s z FirewallPolicy.check_servicec C s | � |� |S r )r� r� r$ r$ r% Z __service_id s
zFirewallPolicy.__service_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j
d|| f ��|d u rv| � � }
n|}
|j r�| �
d|||
� | �||||� |
�| j||� |d u r�|
�d� |S r� )r rA r� r� r! �_FirewallPolicy__service_idrM r3 r r r� r. rE rb �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_serviceri ) r" r? r� rw rx rI rk r� �
service_idr� rl r$ r$ r% r s(
�
zFirewallPolicy.add_servicec C s |j �|� d S r )rM r4 )r" r� r� rw rx r$ r$ r% Z__register_service) s z!FirewallPolicy.__register_servicec C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| �
� }n|}|j r�| � d|||� |�
| j||� |d u r�|�d� |S r� )r rA r� r! r� rM r3 r r r� r. rE rb r� r� ri ) r" r? r� rI rk r� r� r� rl r$ r$ r% r� , s$
�
z FirewallPolicy.remove_servicec C s ||j v r|j �|� d S r )rM r� )r" r� r� r$ r$ r% Z__unregister_serviceG s
z#FirewallPolicy.__unregister_servicec C s | � |�| �|�jv S r )r� r2 rM )r" r? r� r$ r$ r% �
query_serviceK s z FirewallPolicy.query_servicec C s | � |�jS r )r2 rM rt r$ r$ r% �
list_servicesN s z FirewallPolicy.list_servicesc C sN g }|D ]@}z| j j�|�}W n ty< ttj|��Y n0 |�|� q|S r )r �helper�
get_helperr r �INVALID_HELPERr4 )r" �helpers�_helpersr� �_helperr$ r$ r% � get_helpers_for_service_helpersQ s z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }|D ]�}z| j j�|�}W n ty< ttj|��Y n0 t|j�dk r�t|j �}z | j j�|�}|�
|� W q� ty� |r�t � d| � Y qY q�0 q|�
|� q|S )NrV z Helper '%s' is not available)
r r� r� r r r� r� rN r
�moduler4 r rh )r" �modulesrj r� r� r� �_module_short_namer� r$ r$ r% � get_helpers_for_service_modules[ s"
z.FirewallPolicy.get_helpers_for_service_modulesc C s | j �|� | j �|� d S r )r �
check_port� check_tcpudp�r" �port�protocolr$ r$ r% r� t s zFirewallPolicy.check_portc C s | � ||� t|d�|fS �N�-�r� r r� r$ r$ r% Z __port_idx s zFirewallPolicy.__port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8}
t||
d �rH|j rf|j n|} t
t j d|� | f ��qHt
|dd� | D ��\} }
|d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�|
D ] }| �d |t|d�� |� q�| D ]0}| �|� �}
| �||
||� |�| j||
� q�|
D ]"}| �|� �}
|�| j||
� �q4|d u �rl|�d� |S )
Nc s | d � kS �NrV r$ ��x�r� r$ r% �<lambda>� � z)FirewallPolicy.add_port.<locals>.<lambda>r �'%s:%s' already in '%s'c S s g | ] \}}|�qS r$ r$ ��.0rc rd r$ r$ r% �
<listcomp>� r� z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� �filterrN r r3 r r r� r r. rE rc r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� ri �r" r? r� r� rw rx rI rk r� �existing_port_ids�port_idr� � added_ranges�removed_rangesrl �ranger$ r� r% r� | s<
�
zFirewallPolicy.add_portc C s |j �|� d S r )rN r4 �r" r� r� rw rx r$ r$ r% Z__register_port� s z FirewallPolicy.__register_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t
j d|� | f ��t |dd� |D ��\}
} |d u r�| �
� } n|} |jr�|
D ] }
| �d|t|
d�� | � q�| D ] }
| �d |t|
d�� | � q�|
D ]0}
| �|
� �}| �||dd � | �| j||� q�| D ]"}
| �|
� �}| �| j||� �q,|d u �rd| �d� |S )
Nc s | d � kS r� r$ r� r� r$ r% r� � r� z,FirewallPolicy.remove_port.<locals>.<lambda>r �'%s:%s' not in '%s'c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� � r� z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rN r r3 r r r� r r. rE rc r r� r� r� r� r� ri �r" r? r� r� rI rk r� r� r� r� r� r rl r r$ r� r% r� � s<
�
zFirewallPolicy.remove_portc C s ||j v r|j �|� d S r )rN r� �r" r� r� r$ r$ r% Z__unregister_port� s
z FirewallPolicy.__unregister_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS �NTF)r2 rN r �r" r? r� r� rc rd r$ r$ r% �
query_port� s zFirewallPolicy.query_portc C s | � |�jS r )r2 rN rt r$ r$ r% �
list_ports� s zFirewallPolicy.list_portsc C s t |�sttj|��d S r )r r r ZINVALID_PROTOCOL�r" r� r$ r$ r% �check_protocol� s z FirewallPolicy.check_protocolc C s t |�sttjd| ��d S )Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')r
r r � INVALID_RULE)r" �tcp_mss_clamp_valuer$ r$ r% �check_tcp_mss_clamp� s z"FirewallPolicy.check_tcp_mss_clampc C s | � |� |S r )r r
r$ r$ r% Z
__protocol_id� s
z FirewallPolicy.__protocol_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j
d|| f ��|d u rv| � � }
n|}
|j r�| �
d|||
� | �||||� |
�| j||� |d u r�|
�d� |S r� )r rA r� r� r! � _FirewallPolicy__protocol_idrT r3 r r r� r. rE rd �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolri ) r" r? r� rw rx rI rk r� � protocol_idr� rl r$ r$ r% r� � s(
�
zFirewallPolicy.add_protocolc C s |j �|� d S r )rT r4 )r" r� r rw rx r$ r$ r% Z__register_protocol s z"FirewallPolicy.__register_protocolc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| �
� }n|}|j r�| � d|||� |�
| j||� |d u r�|�d� |S r� )r rA r� r! r rT r3 r r r� r. rE rd r� r ri ) r" r? r� rI rk r� r r� rl r$ r$ r% r� s(
�
�
z FirewallPolicy.remove_protocolc C s ||j v r|j �|� d S r )rT r� )r" r� r r$ r$ r% Z__unregister_protocol( s
z$FirewallPolicy.__unregister_protocolc C s | � |�| �|�jv S r )r r2 rT )r" r? r� r$ r$ r% �query_protocol, s z FirewallPolicy.query_protocolc C s | � |�jS r )r2 rT rt r$ r$ r% �list_protocols/ s z FirewallPolicy.list_protocolsc C s | � ||� t|d�|fS r� r� r� r$ r$ r% Z__source_port_id4 s z FirewallPolicy.__source_port_idc sp | j �|�}| j �|� | j �� | j| }tt� fdd�|j��} | D ]8}
t||
d �rH|j rf|j n|} t
t j d|� | f ��qHt
|dd� | D ��\} }
|d u r�| �� }n|}|jr�| D ] }| �d|t|d�� |� q�|
D ] }| �d |t|d�� |� q�| D ]0}| �|� �}
| �||
||� |�| j||
� q�|
D ]"}| �|� �}
|�| j||
� �q4|d u �rl|�d� |S )
Nc s | d � kS r� r$ r� r� r$ r% r� ? r� z0FirewallPolicy.add_source_port.<locals>.<lambda>r r� c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� F r� z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r rA r� r� r! r� r� rQ r r3 r r r� r r. rE re r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� ri r� r$ r� r% r� 8 s<
�
z FirewallPolicy.add_source_portc C s |j �|� d S r )rQ r4 r r$ r$ r% Z__register_source_port` s z%FirewallPolicy.__register_source_portc sh | j �|�}| j �� | j| }tt� fdd�|j��}|D ]}t||d �r< qzq<|jr`|jn|} t t
j d|� | f ��t |dd� |D ��\}
} |d u r�| �
� } n|} |jr�|
D ] }
| �d|t|
d�� | � q�| D ] }
| �d |t|
d�� | � q�|
D ]0}
| �|
� �}| �||dd � | �| j||� q�| D ]"}
| �|
� �}| �| j||� �q,|d u �rd| �d� |S )
Nc s | d � kS r� r$ r� r� r$ r% r� i r� z3FirewallPolicy.remove_source_port.<locals>.<lambda>r r c S s g | ] \}}|�qS r$ r$ r� r$ r$ r% r� r r� z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r rA r� r! r� r� rQ r r3 r r r� r r. rE re r r r r� r r� ri r r$ r� r% r� c s<
�
z!FirewallPolicy.remove_source_portc C s ||j v r|j �|� d S r )rQ r� r r$ r$ r% Z__unregister_source_port� s
z'FirewallPolicy.__unregister_source_portc C s2 | � |�jD ] \}}t||�r ||kr dS q dS r )r2 rQ r r r$ r$ r% �query_source_port� s z FirewallPolicy.query_source_portc C s | � |�jS r )r2 rQ rt r$ r$ r% �list_source_ports� s z FirewallPolicy.list_source_portsc C s� | j �|�}| j �|� | j �� | j| }|jrR|jr>|jn|}ttj d| ��|d u rd| �
� }n|}|j r|| � d||� | �
|||� |�| j|� |d u r�|�d� |S )Nz"masquerade already enabled in '%s'T)r rA r� r� r! rO r3 r r r� r. rE rf �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderi ) r" r? rw rx rI rk r� r� rl r$ r$ r% r� � s&
�
z FirewallPolicy.add_masqueradec C s
d|_ d S �NT�rO )r" r� rw rx r$ r$ r% Z__register_masquerade� s z$FirewallPolicy.__register_masqueradec C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j
rp| � d||� |� | j
|� |d u r�|�d� |S )Nz masquerade not enabled in '%s'FT)r rA r� r! rO r3 r r r� r. rE rf r� r ri )r" r? rI rk r� r� rl r$ r$ r% r� � s"
�
z FirewallPolicy.remove_masqueradec C s
d|_ d S �NFr �r" r� r$ r$ r% Z__unregister_masquerade� s z&FirewallPolicy.__unregister_masqueradec C s | � |�jS r )r2 rO rt r$ r$ r% �query_masquerade� s z FirewallPolicy.query_masqueradec C sZ | j �|� | j �|� |r(| j �|� |rBt||�sBttj|��|sV|sVttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRZINVALID_FORWARD)r" �ipvr� r� �toport�toaddrr$ r$ r% �check_forward_port� s
�z!FirewallPolicy.check_forward_portc C sL t d|�r | �d||||� n| �d||||� t|d�|t|d�t|�fS )Nr� r� r� )r r$ r r� )r" r� r� r" r# r$ r$ r% Z__forward_port_id� s
�z FirewallPolicy.__forward_port_idc C s� | j �|�} | j �|� | j �� | j| }
| �||||�} | |
jv rp|
jrR|
jn| } tt j
d||||| f ��|d u r�| � � }
n|}
|
j r�| �
d| |
||||� | �|
| ||� |
�| j|
| � |d u r�|
�d� | S )Nz '%s:%s:%s:%s' already in '%s'T)r rA r� r� r! � _FirewallPolicy__forward_port_idrP r3 r r r� r. rE ra �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portri )r" r? r� r� r" r# rw rx rI rk r� �
forward_idr� rl r$ r$ r% r� � s0
��
�
z FirewallPolicy.add_forward_portc C s |j �|� d S r )rP r4 )r" r� r( rw rx r$ r$ r% Z__register_forward_port s z&FirewallPolicy.__register_forward_portc C s� | j �|�}| j �� | j| }| �||||�} | |jvrd|jrF|jn|}
ttj d|||||
f ��|d u rv| �
� } n|} |j r�| � d|| ||||� | �
| j|| � |d u r�| �d� |S )Nz'%s:%s:%s:%s' not in '%s'FT)r rA r� r! r% rP r3 r r r� r. rE ra r� r' ri ) r" r? r� r� r" r# rI rk r� r( r� rl r$ r$ r% r� s,
��
�
z"FirewallPolicy.remove_forward_portc C s ||j v r|j �|� d S r )rP r� )r" r� r( r$ r$ r% Z__unregister_forward_port1 s
z(FirewallPolicy.__unregister_forward_portc C s | � ||||�}|| �|�jv S r )r% r2 rP )r" r? r� r� r" r# r( r$ r$ r% �query_forward_port5 s z!FirewallPolicy.query_forward_portc C s | � |�jS r )r2 rP rt r$ r$ r% �list_forward_ports: s z!FirewallPolicy.list_forward_portsc C s | j �|� d S r )r Zcheck_icmptype�r" �icmpr$ r$ r% �check_icmp_block? s z FirewallPolicy.check_icmp_blockc C s | � |� |S r )r- r+ r$ r$ r% Z__icmp_block_idB s
z FirewallPolicy.__icmp_block_idc C s� | j �|�}| j �|� | j �� | j| }| �|�}||jv rd|jrL|jn|} tt j
d|| f ��|d u rv| � � }
n|}
|j r�| �
d|||
� | �||||� |
�| j||� |d u r�|
�d� |S r� )r rA r� r� r! � _FirewallPolicy__icmp_block_idrR r3 r r r� r. rE r` �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockri ) r" r? r, rw rx rI rk r� �icmp_idr� rl r$ r$ r% r� F s(
�
z FirewallPolicy.add_icmp_blockc C s |j �|� d S r )rR r4 )r" r� r1 rw rx r$ r$ r% Z__register_icmp_blockc s z$FirewallPolicy.__register_icmp_blockc C s� | j �|�}| j �� | j| }| �|�}||jvrX|jr@|jn|}ttj d||f ��|d u rj| �
� }n|}|j r�| � d|||� |�
| j||� |d u r�|�d� |S r� )r rA r� r! r. rR r3 r r r� r. rE r` r� r0 ri ) r" r? r, rI rk r� r1 r� rl r$ r$ r% r� f s$
�
z FirewallPolicy.remove_icmp_blockc C s ||j v r|j �|� d S r )rR r� )r" r� r1 r$ r$ r% Z__unregister_icmp_block� s
z&FirewallPolicy.__unregister_icmp_blockc C s | � |�| �|�jv S r )r. r2 rR )r" r? r, r$ r$ r% �query_icmp_block� s z FirewallPolicy.query_icmp_blockc C s | � |�jS r )r2 rR rt r$ r$ r% �list_icmp_blocks� s z FirewallPolicy.list_icmp_blocksc C s� | j �|�}| j �� | j| }|jrF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j
r�|j D ]}| � d|||� qh| �
d||� | �||� |�| j||� |j
r�|j D ]}| � d|||� q�| �
d||� |d u r�|�d� |S )Nz,icmp-block-inversion already enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionri ) r" r? rx rI rk r� r� rl rp r$ r$ r% �add_icmp_block_inversion� s2
�
z'FirewallPolicy.add_icmp_block_inversionc C s
d|_ d S r �rU )r" r� rx r$ r$ r% Z __register_icmp_block_inversion� s z.FirewallPolicy.__register_icmp_block_inversionc C s` | � � }|jr*|jD ]}| �d|||� qd|_|jrR|jD ]}| �d|||� q<|�d� d S )NFT)r. rE rR r` rU ri )r" rk r� rl rp r$ r$ r% Z__undo_icmp_block_inversion� s
z*FirewallPolicy.__undo_icmp_block_inversionc C s� | j �|�}| j �� | j| }|jsF|jr2|jn|}ttjd| ��|d u rX| � � }n|}|j
r�|j D ]}| � d|||� qh| �
d||� | �|� |�| j|d � |j
r�|j D ]}| � d|||� q�| �
d||� |d u r�|�d� |S )Nz(icmp-block-inversion not enabled in '%s'FT)r rA r� r! rU r3 r r r� r. rE rR r` r4 �0_FirewallPolicy__unregister_icmp_block_inversionr� r5 ri )r" r? rI rk r� r� rl rp r$ r$ r% �remove_icmp_block_inversion� s6
�
�
z*FirewallPolicy.remove_icmp_block_inversionc C s
d|_ d S r r8 r r$ r$ r% Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | � |�jS r )r2 rU rt r$ r$ r% �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc
C s� | j j�|�}|jr*| j jj|j d }n|}|rT|| jv rt||f| j| v rtd S n || jvsp||f| j| vrtd S | j �� D ]2}|jr~||� � v r~|�
||||�} |� || � q~| � ||||fg� |�
| j || ||fg� d S �Nr )r r? r2 r3 r= Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� )
r" r? �createrm rn rl rC Ztracking_policy�backend�rulesr$ r$ r% r[ � s*
�
�
�z FirewallPolicy.gen_chain_rulesc C s^ |D ]T\}}|r*| j �|g ��||f� q| j | �||f� t| j | �dkr| j |= qd S r< )r �
setdefaultr4 r� r� )r" r? rA Ztablesrm rn r$ r$ r% r@ s z FirewallPolicy._register_chainsc C s$ | j j�|�dkrd S | j j�|�S )Nzhash:mac)r r� �get_typeZ
get_family�r" rB r$ r$ r% r� s z FirewallPolicy._ipset_familyc C s | j j�|�S r )r r� rE rF r$ r$ r% Z __ipset_type! s zFirewallPolicy.__ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z
get_dimension)r" rB �flagr$ r$ r% �_ipset_match_flags$ s z!FirewallPolicy._ipset_match_flagsc C s | j j�|�S r )r r� Z
check_appliedrF r$ r$ r% r� ' s z#FirewallPolicy._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z
INVALID_IPSET)r" rB Z_typer$ r$ r% r� * s
��z+FirewallPolicy._check_ipset_type_for_sourcec
s� t |j�tkr��jj�|jj�}|d u r2|jjg}|jD ]H}||v rFq8��|� |� |� t
� |�}||j_�j |||||d� q8g } |j
r�|j
g} nH|jr�t|jt�s�t|jt�rވjj�|jj�� � jrއ fdd�dD �} ��|j�}
|
�r"|j
�r |j
|
k�r"ttjd|
|j
f ��n|
g} | �s0ddg} �fdd�| D �} | |_t�fd d�| D ��D �]2} t |j�tk�r��jj�|jj�}g } t|j�d
k�r�|j�r�ttjd ��| D ].}
|
|jv �r�| � |
��r�| � |j|
� �q�n
| � d � | D �]�}t |j �t k�r�� |j |�}|��!|j"�7 }t#t|�d d
� d�}g }|D ]�}|j$}t%|�}|�&dd�}|� |� |j
dk�r�| � |j
��s��qBt|j'�dk �r�|� |� n6|j'D ].\}}| �(||||||j|�}|�)| |� �q��qB|�*|� |j'D ]*\}}| �+||||||�}|�)| |� �q�|j,D ]$}| �-|||||�}|�)| |� �q |j.D ]*\}}| �/||||||�}|�)| |� �qL�q�q^t |j�t0k�r�|jj1}|jj2}��3||� | �+||||d |�}|�)| |� �q^t |j�t4k�r|jj5}��6|� | �-|||d |�}|�)| |� �q^t |j�t7k�rX|jj5}��8|� | �9|||d |�}|�)| |� �q^t |j�t:k�r�|�r�| D ] }
| � |
��rr|�;t<|
� �qr| �=|||�}|�)| |� �q^t |j�t>k�rH|jj1}|jj2}|jj?}|jj@}| D ]<}
| � |
��r��A|
||||� |�r�|�r�|�;t<|
� �q�| �B|||||||�}|�)| |� �q^t |j�tCk�r�|jj1}|jj2}��3||� | �/||||d |�}|�)| |� n�t |j�tk�s�t |j�tk�rR�jj�|jj�� |j
�r � j�r |j
� jv�r ttjDd|j
|jjf ��t |j�tk�r4|j �r4t |j �t k�r4ttjd��| �E||� |�}|�)| |� n>|jd u �rz| �F|||�}|�)| |� nttjdt |j� ���q^d S )N��included_servicesc s g | ]}|� j v r|�qS r$ )� destination�r� r! )�ictr$ r% r� G r� z0FirewallPolicy._rule_prepare.<locals>.<listcomp>�r� r� z;Source address family '%s' conflicts with rule family '%s'.r� r� c s g | ]}� j �|�r|�qS r$ )r �is_ipv_enabledrO r( r$ r% r� X r� c s g | ]}� j �|��qS r$ )r �get_backend_by_ipv)r� r� r( r$ r% r� ] r� r z"Destination conflict with service.c S s | j S r �rB r� r$ r$ r% r� u r� z.FirewallPolicy._rule_prepare.<locals>.<lambda>�ro � conntrack�natr� rV z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)G�type�elementr r r� � get_servicerB �includesr� r4 r� �deepcopyr� �familyr^ r r �config� get_icmptyperN r� r� r r r �ipvsr; r� �is_ipv_supported�actionr r� r� r� r� r/ r� r
�replacerN � build_policy_helper_ports_rulesr? Z add_modules�build_policy_ports_rulesrT �build_policy_protocol_rulesrQ � build_policy_source_ports_rulesr r� r� r� r �valuer r r Z build_policy_tcp_mss_clamp_rulesr r� r � build_policy_masquerade_rulesr Zto_portZ
to_addressr$ � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules) r" rj r? r� rl rM �svc�includeZ_ruler` Z
source_ipvrB Z destinationsr! rN r� r� r� r� r� �
nat_moduler� �protorC r� r
r" r# r$ )rP r" r% r� 2 sJ
� �
�
�
�
� � �
�
�
� � �
� ��� �� ��z FirewallPolicy._rule_preparec C s> | j j�|�}| �|j|�}|| �|j�7 }tt|�dd� d�}|d u rN|g}|j D ]6}||v rbqT| �
|� |� |� | j |||||d� qTg } dD ]f}
| j �
|
�s�q�| j �|
�} t|j�dkr�|
|jv r�| � | |j|
f� q�| d f| vr�| � | d f� q�| D �]6\} } |D ]�}
|
j}t|�}|
j�dd�}|�|� |
jd k�rV| �|
j��sV�qt|
j�d
k �rr|�|� n6|
jD ].\}}| �||||| |
j|�}|�| |� �qx�q|jD ](\}}| �||||| �}|�| |� �q�|j D ]"}| � |||| �}|�| |� �q�|j D ](\}}| � ||||| �}|�| |� �q �q d S ) Nc S s | j S r rT r� r$ r$ r% r� � r� z)FirewallPolicy._service.<locals>.<lambda>rU rL rQ r rV rW r� rV ) r r� rZ r� r� r� r� r/ r; r[ r� r4 rb rR rS r� rN r� r
rc Z
add_moduler] ra rN rd rB r? re rT rf rQ rg )r" rj r? r� rl rM rl r� rm Z backends_ipvr! rB rN r� r� r� rn r� ro rC r� r$ r$ r% rb � sj
�
�
�
�zFirewallPolicy._servicec C s8 | j �� D ](}|jsq
|�||||�}|�||� q
d S r )r r= r> re r? �r" rj r? r� r� rl rB rC r$ r$ r% rc : s
�zFirewallPolicy._portc C s6 | j �� D ]&}|jsq
|�|||�}|�||� q
d S r )r r= r> rf r? )r" rj r? r� rl rB rC r$ r$ r% rd C s
zFirewallPolicy._protocolc C s8 | j �� D ](}|jsq
|�||||�}|�||� q
d S r )r r= r> rg r? rp r$ r$ r% re K s
zFirewallPolicy._source_portc C s8 d}|� t|� | j�|�}|�||�}|�||� d S )Nr� )r� r r rS ri r? )r" rj r? rl r! rB rC r$ r$ r% rf S s
zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|�t|� | j�|�} | �||||||�}
|�| |
� d S )Nr� r� )r r� r r rS rj r? ) r" rj r? rl r� r� r" r# r! rB rC r$ r$ r% ra [ s
�z FirewallPolicy._forward_portc
C sz | j j�|�}| j �� D ]\}|js$qd}|jrTdD ] }||jv r2|�|�s2d} qTq2|rZq|�|||�} |�|| � qd S )NFrQ T) r r^ r_ r= r> rN ra rk r? )
r" rj r? r, rl rP rB Z skip_backendr! rC r$ r$ r% r` j s
zFirewallPolicy._icmp_blockc C sb | j | j}|dv rd S | �|�s.|dkr.d S | j�� D ]$}|jsDq8|�||�}|�||� q8d S )N)ZDROPz
%%REJECT%%ZREJECTZACCEPT)r! �targetr; r r= r> Z'build_policy_icmp_block_inversion_rulesr? )r" rj r? rl rq rB rC r$ r$ r% r4 s z$FirewallPolicy._icmp_block_inversionc C s& t | j�}| �|||� |�d� d S r )r r r\ ri )r" rj r? rl r$ r$ r% �!_ingress_egress_zones_transaction� s
z0FirewallPolicy._ingress_egress_zones_transactionc C s | j | }|j}|j}t� }t� }t� } t� }
|D ]:} | dv r@q2|t| jj�| ��O }| t| jj�| ��O } q2|D ]:} | dv r�qr|t| jj�| ��O }|
t| jj�| ��O }
qr| j�� D ]D} | j s�q�| �
|�D ],\}
}| � |||
|||| |
�}|� | |� q�q�d S )N)r: r9 )
r! r< r> r; r r= Zlist_interfacesZ list_sourcesr= r> rY Z!build_policy_ingress_egress_rulesr? )r" rj r? rl rC r< r> Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr= rB rm rn rC r$ r$ r% r\ � s4
�z$FirewallPolicy._ingress_egress_zonesc C s | j | }d|jv r<d|jv r<g d�}| jjs8|�d� |S d|jv rbdg}| jjs^|�d� |S d|jv rtddgS d|jv r�d|jv r�g d�}| jjs�|�d� |S d|jv �rg d �}| jjs�|�d� | jjd
kr�|�d � n,|jD ]}| jj�|�j r� �qq�|�d � |S d|jv �rzd d g}| jj�s<|�d� |jD ] }| jj�|�j �rB �qv�qB|�d
� |�d� |S d g}| jj�s�|�d� | jjd
k�r�|�d � n0|jD ] }| jj�|�j �r� �qސq�|�d � |jD ] }| jj�|�j �r� �q�q�|�d
� |�d� |S dS )z:Create a list of (table, chain) needed for policy dispatchr: r9 )�r� ZINPUT�rW �
PREROUTING��mangleru ��rawru rs )r� �OUTPUT)rW rz )�r� ZFORWARDrt �rW Z POSTROUTINGrv �r{ rt rv Znftablesr| r{ rt rv N)
r! r< r> r �nftables_enabledr4 Z_firewall_backendr= Zget_zoneZ
interfaces)r" r? rC �tcr= r$ r$ r% rY � sl
z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sf | j | }d|jv r0dg}| jjs,|�d� |S d|jv rBg d�S d|jv rRdgS ttjd| ��dS ) z8Create a list of (table, chain) needed for zone dispatchr9 rs rx r: r} r| zInvalid policy: %sN) r! r> r r~ r4 r< r r �INVALID_POLICY)r" r? rC r r$ r$ r% rZ
s
z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j j�|�}|jr |j}n|| }d|jv rh|dkr>d| S |dkrNd| S |jsd|dv rdd| S �nd|jv r�|js�|dv r�d| S n�d |jv r�|dkr�d
| S |d kr�|r�d | S d| S n|d
v r�d| S n�d |jv �r.|dkr�d
| S |d k�r|�rd | S d| S n|d
v �r||j�s|d| S nN|j�s||dk�rHd
| S |d k�rj|�r`d | S d| S n|d
v �r|d| S ttjd|||f ��d S )Nr9 r� ZIN_ry ZPRE_)rw rW )r� rW ZOUT_r: ZFWD_rW ZPOST_)rw ry z.Can't convert policy to chain name: %s, %s, %s) r r? r2 r3 r> r< r r r� )r" r? rm Z
policy_prefixZisSNATrC �suffixr$ r$ r% �policy_base_chain_name! sZ
z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__�
__module__� __qualname__r& r) r+ r. r1 r8 r@ r2 rD rG rK rL rq rJ rF ru r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rg ry r� r| r� r� r� r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r� r r� r r r r r� r r� r r r r� r r� r r r$ r% r� r& r� r' r) r* r- r. r� r/ r� r0 r2 r3 r7 r5 r6 r: r9 r; r[ r@ r� rK rJ r� r� r� rb rc rd re rf ra r` r4 rr r\ rY rZ r� r$ r$ r$ r% r s>
F 5 �
& # �
& # �
�
�
�
�
(�
) �
�
�
(�
) �
�
�
�
�
�
' ' I @ �
Vr )%r� Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r
r r r
r~ r r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.core.baser �objectr r$ r$ r$ r% �<module> s 44 Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg