JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/firewall/core/__pycache__/fw_zone.cpython-39.opt-1.pyc
a
� iߩ � @ s� d dl Z d dlmZmZmZ d dlmZ d dlmZ d dl m
Z
d dl m Z m
Z
mZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZm Z d d l m Z d d
l m Z G d d � d e!�Z"dS )
� N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) �Rich_ForwardPort�Rich_IcmpBlock�
Rich_IcmpType� Rich_Mark�Rich_Masquerade� Rich_Port�
Rich_Protocol� Rich_Rule� Rich_Service�Rich_SourcePort�Rich_Tcp_Mss_Clamp)�nm_get_bus_name)� checkIPnMask�
checkIP6nMask� check_mac)�errors)�
FirewallErrorc @ s& e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd�d d �Zd d � Zd!d"� Zd#d$� Zd�d%d&�Zd'd(� Zd�d)d*�Zd�d+d,�Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d�d8d9�Z d:d;� Z d�d<d=�Z d�d>d?�Z!d�d@dA�Z"dBdC� Z#dDdE� Z$dFdG� Z%d�dIdJ�Z&d�dKdL�Z'd�dMdN�Z(dOdP� Z)d�dQdR�Z*d�dSdT�Z+dUdV� Z,dWdX� Z-dYdZ� Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2dcdd� Z3dedf� Z4dgdh� Z5d�didj�Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�� ZBd�d�d��ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�d��ZNd�d�d��ZOd�d�d��ZPd�d�� ZQd�d�d��ZRd�d�� ZSd�d�� ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�� ZZd�d�d��Z[d�d�� Z\d�d�d��Z]d�d�� Z^d�d�� Z_d S )�� FirewallZoner c C s || _ i | _i | _d S �N)�_fw�_zones�_zone_policies)�self�fw� r �9/usr/lib/python3.9/site-packages/firewall/core/fw_zone.py�__init__0 s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r! �__repr__5 s zFirewallZone.__repr__c C s | j �� | j�� d S r )r �clearr r$ r r r! �cleanup8 s
zFirewallZone.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r �tr r r! �new_transaction< s
z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r+ r, r r r! �policy_name_from_zonesA s z#FirewallZone.policy_name_from_zonesc C s t | j�� �S r )�sortedr �keysr$ r r r! � get_zonesF s zFirewallZone.get_zonesc C s4 g }| � � D ]"}| �|�s$| �|�r |�|� q |S r )r1 �list_interfaces� list_sources�append)r Z active_zones�zoner r r! �get_active_zonesI s
z FirewallZone.get_active_zonesc C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__interface_idr �
interfaces)r � interface� interface_idr5 r r r! �get_zone_of_interfaceP s
z"FirewallZone.get_zone_of_interfacec C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__source_idr �sources)r �source� source_idr5 r r r! �get_zone_of_sourceX s
z FirewallZone.get_zone_of_sourcec C s | j �|�}| j| S r )r �
check_zoner )r r5 �zr r r! �get_zone` s zFirewallZone.get_zonec C sH t � }|j|_| �||�|_| j|_|j|_|g|_|g|_dD �] }||jkrz|dkrz|dv rzt ||t
� t ||��� q@|dkr�||jkr�|dv r�t ||t
� t ||��� q@||jkr�|dkr�|dv r�t ||t
� t ||��� q@|dv r@g |_
g |_|j
D ]D}| �||�}t|d�}|| �|j|�v r�|j
�|� |j�|� q�q@|S ) N) �services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks�icmp_block_inversion� rules_str� protocols�HOST)rD rE rH rI rJ rL �ANY)rF )rG )rK ��rule_str)r �nameZderived_from_zoner. �ZONE_POLICY_PRIORITY�priority�targetZ
ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrK �rulesr �_rich_rule_to_policiesr4 ) r �z_objr+ r, �p_objZsettingrP Zcurrent_policy�ruler r r! �policy_obj_from_zone_objd s8
��
z%FirewallZone.policy_obj_from_zone_objc C sr || j |j< g | j|j< |jdfd|jf|jdffD ]8\}}| �|||�}| jj�|� | j|j �|j� q4d S )NrM rN )r rQ r r^ r �policyZ
add_policyr4 )r �objr+ r, r\ r r r! �add_zone� s � zFirewallZone.add_zonec C s. | j | }|jr| �|� | j |= | j|= d S r )r �applied�unapply_zone_settingsr )r r5 r` r r r! � remove_zone� s
zFirewallZone.remove_zoneNc C sR | � � D ]D}| j| }t|j�dks2t|j�dkrt�d|� | j||d� qd S )Nr zApplying zone '%s'��use_transaction)r1 r �lenr8 r= r �debug1�apply_zone_settings)r rf r5 r[ r r r! � apply_zones� s
zFirewallZone.apply_zonesc C s | j | }||_d S r )r rb )r r5 rb r` r r r! �set_zone_applied� s
z FirewallZone.set_zone_appliedc C s� d|vr d S |� d�}t|�dk r&d S d }tD ]}|d t| kr.|}q.|d ur�|d | �� vrdd S t|�dks�t|�dkr�|d dv r�|d |fS d S )N�_� r � � )Zprer ZdenyZallowZpost)�splitrg r r1 )r �chainZsplits�_chain�xr r r! �zone_from_chain� s&
�
� z FirewallZone.zone_from_chainc C st | � |�}|d u rd S |\}}|dv r0|}d}n4|dv rB|}d}n"|dv rTd}|}nttjd| ��| �||�|fS )N)Z
PREROUTINGZFORWARDrN )ZINPUTrM )Z POSTROUTINGz&chain '%s' can't be mapped to a policy)rt r r Z
INVALID_CHAINr. )r rq rs r5 rr r+ r, r r r! �policy_from_chain� s
z FirewallZone.policy_from_chainc C sj |dv rf| � |�}|d urf| � |�\}}|d u r:| �� }n|}| jj�|d|||� |d u rf|�d� d S )N)�ipv4�ipv6T)ru r* r r_ Zgen_chain_rules�execute) r �ipv�tablerq rf rs r_ rr � transactionr r r! �create_zone_base_by_chain� s
�z&FirewallZone.create_zone_base_by_chainc C s� dD ]�}t | �|�|�}t|t�r(|g}|D ]j}|dkrJ| �||||� q,|dkrp| �|�}| �|||||� q,|dkr|q,q,|dkr�q,t�d|||� q,q|r�| � |||� d S )N)r8 r= �forwardrJ r8 r= rJ r} z3Zone '%s': Unknown setting '%s:%s', unable to apply)
rX rC �
isinstance�bool�
_interface� check_source�_sourcer Zwarning�_icmp_block_inversion)r �enabler5 r{ �keyZ args_list�argsry r r r! �_zone_settings� s&
�zFirewallZone._zone_settingsc C s� | j �|�}| j| }|jr d S d|_|d u r8| �� }n|}| j| D ]$}t�d||� | j jj ||d� qF| �
d||� |d u r�|� d� d S )NTz+Applying policy (%s) derived from zone '%s're ) r rA r rb r* r r rh r_ �apply_policy_settingsr� rx �r r5 rf �_zoner` r{ r_ r r r! ri s
z FirewallZone.apply_zone_settingsc C s| | j �|�}| j| }|js d S |d u r2| �� }n|}| j| D ]}| j jj||d� q@| �d||� |d u rx|� d� d S )Nre FT)
r rA r rb r* r r_ �unapply_policy_settingsr� rx r� r r r! rc s
z"FirewallZone.unapply_zone_settingsc C sz | � |�}| �|�}g }td�D ]P}|j| d |vrX|�t�t||j| d ��� q |�||j| d � q t|�S )�H
:return: exported config updated with runtime settings
� r ) rC � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr4 rV rW rX �tuple)r r5 r` Z conf_dictZ conf_list�ir r r! �get_config_with_settings1 s
"z%FirewallZone.get_config_with_settingsc C s� | � |��� }|d tkr"d|d< | �|�| �|�| �|�| �|�| �|�| �|�| � |�| �
|�| � |�| � |�| �
|�| �|�d� }| j�||�S )r� rT �default� rD rE rI rF rG r8 r= rK rL rH rJ r} )rC Zexport_config_dictr �
list_services�
list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr2 r3 �
list_rules�list_protocols�list_source_ports�query_icmp_block_inversion�
query_forwardr Z'combine_runtime_with_permanent_settings)r r5 Z permanentZruntimer r r! r� A s" �
z*FirewallZone.get_config_with_settings_dictc
s, d
� fdd� }� fdd�}� j � jf� j� jf� j� jf� j� jf� j� j f� j
� j f� j � j
f||f� j� jf� j� jf� j� jf� j� jfd� }� �|�}t�|�}|�|� j�� � � j�d|gi� � � |�} � j� | |�\}
} | D ]n} t | | t ��rJ| | D ]>}
t |
t ��r2|| d |g|
�R � n|| d ||
� �qq�|| d |� q�|
D ]�} t |
| t ��r�|
| D ]n}
| d v �r�|| d ||
|d
� nFt |
t ��r�|| d |g|
�R d|d �� n|| d ||
d|d � �q|n6| d v �r|| d ||d
� n|| d |d|d � �q`d S )Nr c s � j | t|d�d|d� d S )NrO r ��timeout�sender)�add_ruler )r5 rP r� r� r$ r r! �add_rule_wrapperY s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s � � | t|d�� d S )NrO )� remove_ruler )r5 rP r$ r r! �remove_rule_wrapper[ s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapperr� Zzonesrn )r8 r= )r� r� )rJ )r N)!� add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port�
add_interface�remove_interface�
add_source�
remove_source� add_protocol�remove_protocol�add_source_port�remove_source_port�add_icmp_block_inversion�remove_icmp_block_inversion� add_forward�remove_forwardrC rV Zimport_config_dictr Zget_all_io_objects_dictr( r� Z get_added_and_removed_settingsr~ �listr� )r r5 Zsettingsr� r� r� Z
setting_to_fnZold_objZ check_objZ old_settingsZ add_settingsZremove_settingsr� r� r r$ r! � set_config_with_settings_dictW sN
�
"
z*FirewallZone.set_config_with_settings_dictc C s | j �|� d S r )r �check_interface�r r9 r r r! r� � s z FirewallZone.check_interfacec C s | � |� |S r )r� r� r r r! Z__interface_id� s
zFirewallZone.__interface_idTc C s
| j �� | j �|�}| j| }| �|�}||jv rHttjd||f ��| � |�} | d urnttj
d|| f ��t � d||f � |d u r�| �
� }
n|}
|js�|r�| j||
d� |
�| j|d� |r�| �d|||
� | �||||� |
�| j||� |d u �r|
�d� |S )N�'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s're FT)r � check_panicrA r r7 r8 r r �ZONE_ALREADY_SETr; �
ZONE_CONFLICTr rh r* rb ri �add_failrk r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacerx ) r r5 r9 r� rf � allow_applyr� �_objr: �zoir{ r r r! r� � sJ
��
���
�
�
zFirewallZone.add_interfacec C sB |j �|� |r|dkr&| jj�|� |t� kr>| jj�|� d S )N� )r8 r4 r �_default_zone_interfacesr �_nm_assigned_interfaces)r r� r: r5 r� r r r! Z__register_interface� s
z!FirewallZone.__register_interfacec C sR | j �� | �|�}| j �|�}||kr,|S |d ur@| �||� | �|||�}|S r )r r� r; rA r� r� )r r5 r9 r� � _old_zone� _new_zoner� r r r! �change_zone_of_interface� s
z%FirewallZone.change_zone_of_interfacec C sz | j �� |d u r | �� }n|}| �||� | jd|d|dd� |d urd|dkrd| jd|d|dd� |d u rv|�d� d S )NT�+)r4 r� F)r r� r* ri r� rx )r Zold_zoneZnew_zonerf r{ r r r! �change_default_zone� s
z FirewallZone.change_default_zonec C s� | j �� | �|�}|d u r,ttjd| ��|dkr8|n
| j �|�}||krbttjd|||f ��|d u rt| �� }n|}| j | }| �
|�}|� | j ||� | �
d|||� |d u r�|�d� |S )N�'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r; r r ZUNKNOWN_INTERFACErA r� r* r r7 �add_postr� r� rx ) r r5 r9 rf r� r� r{ r� r: r r r! r� � s.
���
z FirewallZone.remove_interfacec C sN ||j v r|j �|� || jjv r0| jj�|� || jjv rJ| jj�|� d S r )r8 �remover r� r� )r r� r: r r r! Z__unregister_interface s
z#FirewallZone.__unregister_interfacec C s | � |�| �|�jv S r )r7 rC r8 )r r5 r9 r r r! �query_interface s z FirewallZone.query_interfacec C s | � |�jS r )rC r8 �r r5 r r r! r2 s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |�d�rh| �|dd � � |rV| �|dd � � | �|dd � �S ttj |��d S )Nrv rw r� zipset:� )
r r r �
startswith� _check_ipset_type_for_source�_check_ipset_applied�
_ipset_familyr r Z INVALID_ADDR�r r> rb r r r! r� s
zFirewallZone.check_sourcec C s | j ||d� |S )N�rb )r� r� r r r! Z __source_id( s zFirewallZone.__source_idc C s | j �� | j �|�}| j| }t|�r0|�� }| j||d�}| j||d�} | |jv rjt t
j d||f ��| � |�d ur�t t
j
d| ��|d u r�| �� }
n|}
|js�|r�| j||
d� |
�| j|d� |r�| �d||| |
� | �|| ||� |
�| j|| � |d u �r|
�d� |S )Nr� r� z '%s' already bound to a zonere FT)r r� rA r r �upperr� r< r= r r r� r@ r� r* rb ri r� rk r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcerx ) r r5 r> r� rf r� r� r� ry r? r{ r r r! r� , s<
��
�
zFirewallZone.add_sourcec C s |j �|� d S r )r= r4 )r r� r? r5 r� r r r! Z__register_sourceT s z FirewallZone.__register_sourcec C sb | j �� | �|�}| j �|�}||kr,|S t|�r<|�� }|d urP| �||� | �|||�}|S r )r r� r@ rA r r� r� r� )r r5 r> r� r� r� r� r r r! �change_zone_of_sourceW s
z"FirewallZone.change_zone_of_sourcec
C s� | j �� t|�r|�� }| �|�}|d u r<ttjd| ��|dkrH|n
| j �|�}||krrttj d|||f ��|d u r�| �
� }n|}| j | }| � |�}| �
|�} |�| j|| � | �d||| |� |d u r�|�d� |S )Nr� r� z remove_source(%s, %s): zos='%s'FT)r r� r r� r@ r r ZUNKNOWN_SOURCErA r� r* r r� r< r� r� r� rx )
r r5 r> rf Zzosr� r{ r� ry r? r r r! r� i s4
���
zFirewallZone.remove_sourcec C s ||j v r|j �|� d S r )r= r� )r r� r? r r r! Z__unregister_source� s
z FirewallZone.__unregister_sourcec C s& t |�r|�� }| �|�| �|�jv S r )r r� r< rC r= )r r5 r> r r r! � query_source� s zFirewallZone.query_sourcec C s | � |�jS r )rC r= r� r r r! r3 � s zFirewallZone.list_sourcesc sp � j �� D ]�}|jsq
� j| D ]>}� j j�|�D ]*\}} |�|||||| |�}
|�||
� q2q � �|d�}� � |�j
r
|dvr
|j |||d|d�}
|�||
� q
� j j� � D ]�}|� j j�
|�vr�|� j j�|�vr�q�|� j j�� v �rR� j j�|�j�rR|�s*t� �|��dk�r*� j jj||d� n&� j j�d||� |�� fdd �|� q�|r�|�� fd
d �|� q�d S ) NrN )r� �*�filter�r9 rn re Fc s | � j j�� v o � j j�d| �S �NT�r r_ �)get_active_policies_not_derived_from_zoneZ!_ingress_egress_zones_transaction��pr$ r r! �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j j�� v o � j j�| �S r �r r_ r� r� r� r$ r r! r� � s )r �enabled_backends�policies_supportedr r_ �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr. rC r} �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� �
get_policyrb rg r2 r� �_ingress_egress_zonesr� ) r r� r5 r9 r{ r4 �backendr_ rz rq rY r r$ r! r� � s: � �$��zFirewallZone._interfacec C s$ | � |�dkrd S | jjj|dd�S )Nzhash:macFr� )� _ipset_typer �ipsetZ
get_family�r rQ r r r! r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NFr� )r r� Zget_typer� r r r! r� � s zFirewallZone._ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r� Z
get_dimension)r rQ �flagr r r! �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j j�|�S r )r r� Z
check_appliedr� r r r! r� � s z!FirewallZone._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z
INVALID_IPSET)r rQ Z_typer r r! r� � s
��z)FirewallZone._check_ipset_type_for_sourcec sx |r� j �|�gn� j �� D ]�}|js(q � j| D ]<}� j j�|�D ](\}} |�|||||| �}
|�||
� qDq2� � |d�}� �
|�j r |j |||d|d�}
|�||
� q � j j�
� D ]�}|� j j�|�vr�|� j j�|�vr�q�|� j j�� v �rZ� j j�|�j�rZ|�s2t� �|��dk�r2� j jj||d� n&� j j�d||� |�� fdd�|� q�|r�|�� fd d�|� q�d S )
NrN r� �r> rn re Fc s | � j j�� v o � j j�d| �S r� r� r� r$ r r! r� � s z&FirewallZone._source.<locals>.<lambda>c s | � j j�� v o � j j�| �S r r� r� r$ r r! r� � s )r �get_backend_by_ipvr� r� r r_ r� Z build_zone_source_address_rulesr� r. rC r} r� r� r� r� r� r� rb rg r3 r� r� r� ) r r� r5 ry r> r{ r� r_ rz rq rY r r$ r! r� � s: � �$��zFirewallZone._sourcec C s0 | j �|�}| �|d�}| j j�||||� |S �NrM )r rA r. r_ r� )r r5 �servicer� r� �p_namer r r! r� � s zFirewallZone.add_servicec C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� �r r5 r r r r r! r� s zFirewallZone.remove_servicec C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �
query_servicer r r r! r
s zFirewallZone.query_servicec C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� �r r5 r r r r! r� s zFirewallZone.list_servicesc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� )r r5 �port�protocolr� r� r r r r! r� s zFirewallZone.add_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rA r. r_ r� �r r5 r r r r r r! r� s zFirewallZone.remove_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rA r. r_ �
query_portr r r r! r
s zFirewallZone.query_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� % s zFirewallZone.list_portsc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� )r r5 � source_portr r� r� r r r r! r� * s z FirewallZone.add_source_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rA r. r_ r� �r r5 r r r r r r! r� 0 s z FirewallZone.remove_source_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rA r. r_ �query_source_portr r r r! r
6 s z FirewallZone.query_source_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� ; s z FirewallZone.list_source_portsc C s� | j �|�}t|j�tkr(| �|d�gS t|j�ttt t
t t fv rP| �|d�gS t|j�t
fv rn| �|d�gS t|j�tfv r�| �d|�gS t|j�tfv r�| �|d�gS |jd u r�| �|d�gS ttjdt|j� ��d S )NrN rM z Rich rule type (%s) not handled.)r rA �type�actionr r. �elementr r
r r r r
r r r r r Z INVALID_RULE)r r5 r] r r r! rZ @ s �
z#FirewallZone._rich_rule_to_policiesc C s* | � ||�D ]}| jj�||||� q |S r )rZ r r_ r� )r r5 r] r� r� r r r r! r� R s zFirewallZone.add_rulec C s& | � ||�D ]}| jj�||� q |S r )rZ r r_ r� )r r5 r] r r r r! r� W s zFirewallZone.remove_rulec C s. d}| � ||�D ]}|o&| jj�||�}q|S r� )rZ r r_ �
query_rule)r r5 r] �retr r r r! r \ s zFirewallZone.query_rulec C sZ | j �|�}t� }| �|d�| �|d�| �d|�fD ] }|�t| j j�|��� q4t|�S )NrN rM )r rA �setr. �updater_ r� r� )r r5 r r r r r! r� b s
�zFirewallZone.list_rulesc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rA r. r_ r� )r r5 r r� r� r r r r! r� k s zFirewallZone.add_protocolc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� �r r5 r r r r r! r� q s z FirewallZone.remove_protocolc C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �query_protocolr r r r! r w s zFirewallZone.query_protocolc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� | s zFirewallZone.list_protocolsc C s. | j �|�}| �d|�}| j j�|||� |S �NrN )r rA r. r_ r� )r r5 r� r� r r r r! r� � s zFirewallZone.add_masqueradec C s* | j �|�}| �d|�}| j j�|� |S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.remove_masqueradec C s& | j �|�}| �d|�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.query_masqueradec C s6 | j �|�}| �|d�}| j j�|||||||� |S r )r rA r. r_ r� ) r r5 r r �toport�toaddrr� r� r r r r! r� � s �z FirewallZone.add_forward_portc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rA r. r_ r� �r r5 r r r r r r r r! r� � s z FirewallZone.remove_forward_portc C s. | j �|�}| �|d�}| j j�|||||�S r )r rA r. r_ �query_forward_portr r r r! r � s
�z FirewallZone.query_forward_portc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z FirewallZone.list_forward_portsc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rA r. r_ r� )r r5 �icmpr� r� r r r r! r� � s zFirewallZone.add_icmp_blockc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� )r r5 r r r r r! r� � s z FirewallZone.remove_icmp_blockc C s( | j �|�}| �|d�}| j j�||�S r )r rA r. r_ �query_icmp_block)r r5 r � p_name_hostr r r! r � s z FirewallZone.query_icmp_blockc C s. | j �|�}| �|d�}tt| j j�|���S r )r rA r. r/ r r_ r� �r r5 r r r r! r� � s z FirewallZone.list_icmp_blocksc C s, | j �|�}| �|d�}| j j�||� |S r )r rA r. r_ r� )r r5 r� r r r r! r� � s z%FirewallZone.add_icmp_block_inversionc C s. | j �|�}| �|d�}| j j�|||� d S r )r rA r. r_ r� )r r� r5 r{ r r r r! r� � s z"FirewallZone._icmp_block_inversionc C s* | j �|�}| �|d�}| j j�|� |S r )r rA r. r_ r� r r r r! r� � s z(FirewallZone.remove_icmp_block_inversionc C s& | j �|�}| �|d�}| j j�|�S r )r rA r. r_ r� r r r r! r� � s z'FirewallZone.query_icmp_block_inversionc
C s� | � |d�}| j| jD ]<}| j�� D ],}|js2q&|j|||d|d�}|�||� q&q| j| jD ]X}| � |�} | r�| j�
| �gn| j�� D ],}|js�q�|j|||d|d�}|�||� q�qbd S )NrN r� r� r� ) r. r r8 r r� r� r� r� r= r� r )
r r� r5 r{ r r9 r� rY r> ry r r r! �_forward� s
zFirewallZone._forwardc C s� | j �|�}| j �|� | j �� | j| }|jrBttjd| ��|d u rT| � � }n|}|j
rl| � d||� | � |||� |�
| j|� |d u r�|�d� |S )Nz forward already enabled in '%s'T)r rA Z
check_timeoutr� r r} r r ZALREADY_ENABLEDr* rb r � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardrx )r r5 r� r� rf r� r� r{ r r r! r� � s$
�
zFirewallZone.add_forwardc C s
d|_ d S r� �r} )r r� r� r� r r r! Z__register_forward
s z FirewallZone.__register_forwardc C s� | j �|�}| j �� | j| }|js6ttjd| ��|d u rH| �� }n|}|j r`| �
d||� |� | j |� |d u r�|�
d� |S )Nzforward not enabled in '%s'FT)r rA r� r r} r r Z NOT_ENABLEDr* rb r r� r" rx )r r5 rf r� r� r{ r r r! r�
s
�
zFirewallZone.remove_forwardc C s
d|_ d S )NFr# )r r� r r r! Z__unregister_forward% s z!FirewallZone.__unregister_forwardc C s | � |�jS r )rC r} r� r r r! r� ( s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)`�__name__�
__module__� __qualname__rR r" r% r' r* r. r1 r6 r; r@ rC r^ ra rd rj rk rt ru r| r� ri rc r� r� r� r� r7 r� r� r� r� r� r� r� r2 r� r< r� r� r� r� r� r� r3 r� r� r� r� r� r� r� r� r� r r� r� r� r
r� r� r� r
r� rZ r� r� r r� r� r� r r� r� r� r� r� r� r r� r� r� r r� r� r� r� r� r r� r! r� r" r� r r r r! r - s� *
�
> �
+
�
�
(
�
,(
�
�
�
�
r )#rV Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr Zfirewall.core.richr r r
r r r
r r r r r Zfirewall.core.fw_nmr Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr �objectr r r r r! �<module> s 4
Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg