a 7Irj1ã@sÌddlmZddlZddlmZddlmZmZmZm Z m Z m Z m Z m Z mZmZmZddlmZmZmZmZmZmZmZmZmZmZmZddlmZddlm Z ddl!m"Z"dd l#m$Z$Gd d „d e%ƒZ&dS) é)ÚGLibN)Úlog) ÚportStrÚ checkIPnMaskÚ checkIP6nMaskÚ checkProtocolÚenable_ip_forwardingÚcheck_single_addressÚportInPortRangeÚget_nf_conntrack_short_nameÚcoalescePortRangeÚbreakPortRangeÚcheckTcpMssClamp) Ú Rich_RuleÚ Rich_AcceptÚ Rich_ServiceÚ Rich_PortÚ Rich_ProtocolÚRich_MasqueradeÚRich_ForwardPortÚRich_SourcePortÚRich_IcmpBlockÚ Rich_IcmpTypeÚRich_Tcp_Mss_Clamp)ÚFirewallTransaction)Úerrors)Ú FirewallError)ÚSOURCE_IPSET_TYPESc@sŒeZdZdd„Zdd„Zdd„Zdd„Zd d „Zd d „Zd d„Z dd„Z dd„Z dd„Z ddd„Z dd„Zddd„Zddd„Zddd„Zd d!„Zd"d#„Zd$d%„Zd&d'„Zd(d)„Zd*d+„Zdd.d/„Zd0d1„Zdd2d3„Zd4d5„Zd6d7„Zd8d9„Zd:d;„Zdd?„Z d@dA„Z!d dBdC„Z"dDdE„Z#dFdG„Z$dHdI„Z%dJdK„Z&dLdM„Z'dNdO„Z(dPdQ„Z)d dRdS„Z*dTdU„Z+d dVdW„Z,dXdY„Z-dZd[„Z.d\d]„Z/d^d_„Z0d`da„Z1d dbdc„Z2ddde„Z3ddfdg„Z4dhdi„Z5djdk„Z6dldm„Z7dndo„Z8dpdq„Z9drds„Z:dtdu„Z;ddvdw„Zd|d}„Z?d~d„Z@d€d„ZAd‚dƒ„ZBd„d…„ZCd†d‡„ZDddˆd‰„ZEdŠd‹„ZFddŒd„ZGdŽd„ZHdd‘„ZId’d“„ZJd”d•„ZKdd–d—„ZLd˜d™„ZMddšd›„ZNdœd„ZOdždŸ„ZPd d¡„ZQdd¢d£„ZRd¤d¥„ZSdd¦d§„ZTd¨d©„ZUdªd«„ZVdd¬d­„ZWdd®d¯„ZXdd°d±„ZYd²d³„ZZdd´dµ„Z[d¶d·„Z\dd¸d¹„Z]dºd»„Z^d¼d½„Z_d¾d¿„Z`ddÀdÁ„ZadÂdÄZbddÄdÅ„ZcdÆdÇ„ZddÈdÉ„ZedÊdË„ZfddÌdÍ„ZgdÎdÏ„ZhdÐdÑ„ZiddÒdÓ„ZjdÔdÕ„ZkdÖdׄZldØdÙ„ZmdÚdÛ„ZndÜdÝ„ZodÞdß„Zpdàdá„Zqdâdã„Zrdädå„Zsd dædç„Ztd!dèdé„Zudêdë„Zvdìdí„Zwdîdï„Zxdðdñ„Zyd"dòdó„Zzdôdõ„Z{död÷„Z|dødù„Z}dúdû„Z~düdý„Zdþdÿ„Z€d#dd„ZdS($ÚFirewallPolicycCs||_i|_i|_i|_dS©N)Ú_fwÚ_chainsÚ _policiesÚ _timeouts)ÚselfÚfw©r&ú;/usr/lib/python3.9/site-packages/firewall/core/fw_policy.pyÚ__init__szFirewallPolicy.__init__cCsd|j|j|jfS)Nz %s(%r, %r))Ú __class__r!r"©r$r&r&r'Ú__repr__szFirewallPolicy.__repr__cCs.|j ¡|j ¡|jD]}| |¡qdSr)r!Úclearr"r#Ú removeTimeout©r$Ú_idr&r&r'Úcleanup!s   zFirewallPolicy.cleanupcCst|jƒ}| |jj¡|Sr)rr Zadd_preÚfull_check_config)r$Útr&r&r'Únew_transaction)s zFirewallPolicy.new_transactioncCst|j ¡ƒSr)Úsortedr"Úkeysr*r&r&r'Ú get_policies0szFirewallPolicy.get_policiescCs4g}| ¡D]}| |¡}|js | |¡q t|ƒSr)r6Ú get_policyÚderived_from_zoneÚappendr4)r$ÚpoliciesÚpÚp_objr&r&r'Ú"get_policies_not_derived_from_zone3s    z1FirewallPolicy.get_policies_not_derived_from_zonecCsvg}| ¡D]d}| |¡}t|jƒt|jj ¡ƒtddgƒB@r t|jƒt|jj ¡ƒtddgƒB@r | |¡q |S)NÚHOSTÚANY) r=r7ÚsetÚ ingress_zonesr ÚzoneZget_active_zonesÚ egress_zonesr9)r$Zactive_policiesÚpolicyr<r&r&r'Ú)get_active_policies_not_derived_from_zone;s  &$ÿ z8FirewallPolicy.get_active_policies_not_derived_from_zonecCs|j |¡}|j|Sr)r Ú check_policyr")r$rDr;r&r&r'r7Es zFirewallPolicy.get_policycCs||j|j<dSr)r"Úname)r$Úobjr&r&r'Ú add_policyIszFirewallPolicy.add_policycCs&|j|}|jr| |¡|j|=dSr)r"ÚappliedÚunapply_policy_settings)r$rDrHr&r&r'Ú remove_policyLs  zFirewallPolicy.remove_policyNcCsJ| ¡D]<}|j|}|jrq|| ¡vrt d|¡|j||dqdS)NzApplying policy '%s'©Úuse_transaction)r6r"r8rErZdebug1Úapply_policy_settings)r$rNrDr<r&r&r'Úapply_policiesRs    zFirewallPolicy.apply_policiescCs|j|}||_dSr)r"rJ)r$rDrJrHr&r&r'Úset_policy_applied[s z!FirewallPolicy.set_policy_appliedc Csz|j |¡}|j|}|r |js*|s.|js.dS|r8d|_|durJ| ¡}n|}|rˆ|jsb| |¡n| |¡D]\}}| |d|||¡ql|jsœ|  |||¡dD]x} t |  |¡| ƒ} t | t ƒrØ|rÈ| sÒ|s | sÒq | g} | D]:} | dkrü| ||| |¡qÜ| dkr qÜqÜ| dkr,|j|||g| ¢RŽqÜ| dkrH| ||| |¡qÜ| dkrn| ||| d| d |¡qÜ| d krŠ| ||| |¡qÜ| d kr°| ||| d| d |¡qÜ| d krÊ| |||¡qÜ| d krì| ||t| d|¡qÜ| dkrúqÜqÜ| dkrqÜqÜt d|| | ¡qÜq |sb|js4| |¡n| |¡D]\}}| |d|||¡q>d|_|durv| |¡dS)NT) ÚservicesÚportsÚ masqueradeÚ forward_portsÚ source_portsÚ icmp_blocksÚ rules_strÚ protocolsÚicmp_block_inversionrArCrWrZrUrRrSrérYrVrTrX©Úrule_strrArCz5Policy '%s': Unknown setting '%s:%s', unable to applyF)r rFr"rJr3r8Ú%_get_table_chains_for_policy_dispatchÚ#_get_table_chains_for_zone_dispatchÚgen_chain_rulesÚ_ingress_egress_zonesÚgetattrr7Ú isinstanceÚboolÚ _icmp_blockÚ _forward_portÚ_serviceÚ_portÚ _protocolÚ _source_portÚ _masqueradeÚ_FirewallPolicy__rulerrÚwarningÚexecute) r$ÚenablerDrNÚ_policyrHÚ transactionÚtableÚchainÚkeyZ args_listÚargsr&r&r'Ú_policy_settings_s€   ÿ       ÿ   ÿ  ÿ  ÿ  ÿÿ  zFirewallPolicy._policy_settingscCs|jd||ddS)NTrM©rv©r$rDrNr&r&r'rO¥sz$FirewallPolicy.apply_policy_settingscCs|jd||ddS)NFrMrwrxr&r&r'rK¨sz&FirewallPolicy.unapply_policy_settingscCs| |¡ ¡Sr)r7Zexport_config_dict©r$rDr&r&r'Úget_config_with_settings_dict«sz,FirewallPolicy.get_config_with_settings_dictc s ddlm‰d ‡‡fdd„ }‡‡fdd„}ˆjˆjfˆjˆjfˆjˆjfˆjˆj fˆj ˆj f||fˆj ˆj fˆjˆjfˆjˆjfˆjˆjfdœ }d}d|vr´|d}t |¡}|d=ˆ |¡}t |¡} |  |ˆj ¡¡ˆj d | gi¡ˆ |¡} ˆj | |¡\} } | D]p} t| | tƒrj| | D]>}t|tƒrR|| d |g|¢RŽn|| d ||ƒq(n|| d |ƒq | D]„} t| | tƒrî| | D]L}t|tƒrÐ|| d|g|¢R||d œŽn|| d||||d qžn|| d|||d q‚dS) Nr)rcsˆj|ˆ|d||ddS)Nr\©ÚtimeoutÚsender)Úadd_rule)rDr]r|r}©rr$r&r'Úadd_rule_wrapper±szFFirewallPolicy.set_config_with_settings_dict..add_rule_wrappercsˆ |ˆ|d¡dS)Nr\)Ú remove_rule)rDr]rr&r'Úremove_rule_wrapper³szIFirewallPolicy.set_config_with_settings_dict..remove_rule_wrapper) rRrSrWrTrUZ rich_rulesrYrVrArCr|r:r[r{)rN)Úfirewall.core.richrÚ add_serviceÚremove_serviceÚadd_portÚ remove_portÚadd_icmp_blockÚremove_icmp_blockÚadd_masqueradeÚremove_masqueradeÚadd_forward_portÚremove_forward_portÚ add_protocolÚremove_protocolÚadd_source_portÚremove_source_portÚadd_ingress_zoneÚremove_ingress_zoneÚadd_egress_zoneÚremove_egress_zoneÚcopyr7Zimport_config_dictr Zget_all_io_objects_dictr1rzZget_added_and_removed_settingsrcÚlistÚtuple)r$rDZsettingsr}r€r‚Z setting_to_fnr|Zold_objZ check_objZ old_settingsZ add_settingsZremove_settingsrtrur&rr'Úset_config_with_settings_dict®sZ          ö          ÿÿÿ z,FirewallPolicy.set_config_with_settings_dictcCs||jvr||j|<dSr)r#)r$Útagr/r&r&r'Ú addTimeoutés zFirewallPolicy.addTimeoutcCs&||jvr"t |j|¡|j|=dSr)r#rZ source_remover.r&r&r'r-ís zFirewallPolicy.removeTimeoutcCs&|sttjƒ‚|dvr"|j |¡dS©N)r>r?©rrZ INVALID_ZONEr Z check_zone©r$rBr&r&r'Úcheck_ingress_zoneôs z!FirewallPolicy.check_ingress_zonecCs| |¡|Sr)rŸržr&r&r'Z__ingress_zone_idús z FirewallPolicy.__ingress_zone_idrTc CsJ|j |¡}|j |¡|j ¡|j|}| |¡} | |jvrTttj d||fƒ‚|durf|  ¡} n|} |rä|j r‚|  d|| ¡|  || ||¡|  |j|| ¡|j sÔ|| ¡vrâ|j|| d|  |j|d¡n|  d|| ¡n |  || ||¡|  |j|| ¡|dkr2t ||j||¡} | | d||f¡|durF|  d¡dS)Nú'%s' already in '%s'FrMTrÚ ingress_zone)r rFÚ check_timeoutÚ check_panicr"Ú _FirewallPolicy__ingress_zone_idrArrÚALREADY_ENABLEDr3rJraÚ&_FirewallPolicy__register_ingress_zoneÚadd_failÚ(_FirewallPolicy__unregister_ingress_zonerErOrQrÚtimeout_add_secondsr“r›rn© r$rDrBr|r}rNZ allow_applyrpÚ_objÚzone_idrqršr&r&r'r’þs>       ÿ    ÿ zFirewallPolicy.add_ingress_zonecCs|j |¡dSr)rAr9©r$r«r¬r|r}r&r&r'Z__register_ingress_zone*sz&FirewallPolicy.__register_ingress_zonecCs|j |¡}|j ¡|j|}| |¡}||jvrHttjd||fƒ‚|durZ|  ¡}n|}|j rÊt |jƒdkr€|  ||¡n|  d||¡| ||¡| |j||dd¡|| ¡vrÚ|  d||¡n| |j||¡| d||f¡|durü| d¡|S)Nú'%s' not in '%s'r[FTr¡)r rFr£r"r¤rArrÚ NOT_ENABLEDr3rJÚlenrKrar¨r§r¦rEÚadd_postr-rn©r$rDrBrNrpr«r¬rqr&r&r'r“-s0      ÿ    z"FirewallPolicy.remove_ingress_zonecCs||jvr|j |¡dSr)rAÚremove©r$r«r¬r&r&r'Z__unregister_ingress_zoneRs z(FirewallPolicy.__unregister_ingress_zonecCs| |¡| |¡jvSr)r¤r7rA©r$rDrBr&r&r'Úquery_ingress_zoneVsz!FirewallPolicy.query_ingress_zonecCs | |¡jSr)r7rAryr&r&r'Úlist_ingress_zonesYsz!FirewallPolicy.list_ingress_zonescCs&|sttjƒ‚|dvr"|j |¡dSrœrržr&r&r'Úcheck_egress_zone^s z FirewallPolicy.check_egress_zonecCs| |¡|Sr)r¸ržr&r&r'Z__egress_zone_idds zFirewallPolicy.__egress_zone_idc CsJ|j |¡}|j |¡|j ¡|j|}| |¡} | |jvrTttj d||fƒ‚|durf|  ¡} n|} |rä|j r‚|  d|| ¡|  || ||¡|  |j|| ¡|j sÔ|| ¡vrâ|j|| d|  |j|d¡n|  d|| ¡n |  || ||¡|  |j|| ¡|dkr2t ||j||¡} | | d||f¡|durF|  d¡dS)Nr FrMTrÚ egress_zone)r rFr¢r£r"Ú_FirewallPolicy__egress_zone_idrCrrr¥r3rJraÚ%_FirewallPolicy__register_egress_zoner§Ú'_FirewallPolicy__unregister_egress_zonerErOrQrr©r•r›rnrªr&r&r'r”hs>       ÿ    ÿ zFirewallPolicy.add_egress_zonecCs|j |¡dSr)rCr9r­r&r&r'Z__register_egress_zone”sz%FirewallPolicy.__register_egress_zonecCs|j |¡}|j ¡|j|}| |¡}||jvrHttjd||fƒ‚|durZ|  ¡}n|}|j rÊt |jƒdkr€|  ||¡n|  d||¡| ||¡| |j||dd¡|| ¡vrÚ|  d||¡n| |j||¡| d||f¡|durü| d¡|S)Nr®r[FTr¹)r rFr£r"rºrCrrr¯r3rJr°rKrar¼r§r»rEr±r-rnr²r&r&r'r•—s0      ÿ    z!FirewallPolicy.remove_egress_zonecCs||jvr|j |¡dSr)rCr³r´r&r&r'Z__unregister_egress_zone¼s z'FirewallPolicy.__unregister_egress_zonecCs| |¡| |¡jvSr)rºr7rCrµr&r&r'Úquery_egress_zoneÀsz FirewallPolicy.query_egress_zonecCs | |¡jSr)r7rCryr&r&r'Úlist_egress_zonesÃsz FirewallPolicy.list_egress_zonescCs | ¡dSr)Úcheck©r$Úruler&r&r'Ú check_ruleÈszFirewallPolicy.check_rulecCs| |¡t|ƒSr)rÂÚstrrÀr&r&r'Z __rule_idËs zFirewallPolicy.__rule_idcCsx|sdS|jr,t|jƒrdSt|jƒrtdSnHt|dƒr@|jr@dSt|dƒrt|jrt| |j¡| |j¡| |j¡SdS)NÚipv4Úipv6ÚmacÚÚipset) ÚaddrrrÚhasattrrÆrÈÚ_check_ipset_type_for_sourceÚ_check_ipset_appliedÚ _ipset_family)r$Úsourcer&r&r'Ú_rule_source_ipvÏs     zFirewallPolicy._rule_source_ipvcCs| ||||¡dSr)Ú _rule_prepare)r$rorDrÁrqr&r&r'Z__ruleászFirewallPolicy.__rulec Csò|j |¡}|j |¡|j ¡|j|}| |¡}||jvrd|jrL|jn|} tt j d|| fƒ‚|durv|  ¡} n|} |j r|  d||| ¡|dkr¼t ||j||¡} | | d||f¡| ||||¡|  |j||¡|durî|  d¡|S)Nr TrrÁ)r rFr¢r£r"Ú_FirewallPolicy__rule_idrXr8rrr¥r3rJrlrr©rr›Ú_FirewallPolicy__register_ruler§Ú _FirewallPolicy__unregister_rulern) r$rDrÁr|r}rNrpr«Úrule_idÚ_namerqršr&r&r'r~äs.       ÿ  zFirewallPolicy.add_rulecCs|j |¡dSr)rXr9)r$r«rÔr|r}r&r&r'Z__register_ruleszFirewallPolicy.__register_rulec Csº|j |¡}|j ¡|j|}| |¡}||jvrX|jr@|jn|}ttj d||fƒ‚|durj|  ¡}n|}|j r„|  d|||¡|  d||f¡| |j||¡|dur¶| d¡|S)Nr®FrÁT)r rFr£r"rÑrXr8rrr¯r3rJrlr-r±rÓrn) r$rDrÁrNrpr«rÔrÕrqr&r&r'rs&      ÿ  zFirewallPolicy.remove_rulecCs||jvr|j |¡dSr)rXr³)r$r«rÔr&r&r'Z__unregister_rule%s z FirewallPolicy.__unregister_rulecCs| |¡| |¡jvSr)rÑr7rX)r$rDrÁr&r&r'Ú query_rule)szFirewallPolicy.query_rulecCs | |¡jSr)r7rXryr&r&r'Ú list_rules,szFirewallPolicy.list_rulescCs|j |¡dSr)r Ú check_service©r$Úservicer&r&r'rØ1szFirewallPolicy.check_servicecCs| |¡|Sr)rØrÙr&r&r'Z __service_id4s zFirewallPolicy.__service_idc Csò|j |¡}|j |¡|j ¡|j|}| |¡}||jvrd|jrL|jn|} tt j d|| fƒ‚|durv|  ¡} n|} |j r|  d||| ¡|dkr¼t ||j||¡} | | d||f¡| ||||¡|  |j||¡|durî|  d¡|S)Nr TrrÚ)r rFr¢r£r"Ú_FirewallPolicy__service_idrRr8rrr¥r3rJrgrr©r…r›Ú!_FirewallPolicy__register_servicer§Ú#_FirewallPolicy__unregister_servicern) r$rDrÚr|r}rNrpr«Ú service_idrÕrqršr&r&r'r„8s2       ÿ  ÿ zFirewallPolicy.add_servicecCs|j |¡dSr)rRr9)r$r«rÞr|r}r&r&r'Z__register_service[sz!FirewallPolicy.__register_servicec Csº|j |¡}|j ¡|j|}| |¡}||jvrX|jr@|jn|}ttj d||fƒ‚|durj|  ¡}n|}|j r„|  d|||¡|  d||f¡| |j||¡|dur¶| d¡|S)Nr®FrÚT)r rFr£r"rÛrRr8rrr¯r3rJrgr-r±rÝrn) r$rDrÚrNrpr«rÞrÕrqr&r&r'r…^s&      ÿ  zFirewallPolicy.remove_servicecCs||jvr|j |¡dSr)rRr³)r$r«rÞr&r&r'Z__unregister_service{s z#FirewallPolicy.__unregister_servicecCs| |¡| |¡jvSr)rÛr7rR)r$rDrÚr&r&r'Ú query_serviceszFirewallPolicy.query_servicecCs | |¡jSr)r7rRryr&r&r'Ú list_services‚szFirewallPolicy.list_servicesc CsNg}|D]@}z|jj |¡}Wnty<ttj|ƒ‚Yn0| |¡q|Sr)r ÚhelperÚ get_helperrrÚINVALID_HELPERr9)r$ÚhelpersÚ_helpersráÚ_helperr&r&r'Úget_helpers_for_service_helpers…s  z.FirewallPolicy.get_helpers_for_service_helpersc Cs®g}|D] }z|jj |¡}Wnty<ttj|ƒ‚Yn0t|jƒdkržt|j ƒ}z|jj |¡}|  |¡Wq¨tyš|r’t   d|¡YqYq¨0q|  |¡q|S)Nr[zHelper '%s' is not available) r rárârrrãr°rSr Úmoduler9rrm)r$ÚmodulesrorårèráÚ_module_short_namerær&r&r'Úget_helpers_for_service_moduless"     z.FirewallPolicy.get_helpers_for_service_modulescCs|j |¡|j |¡dSr)r Ú check_portÚ check_tcpudp©r$ÚportÚprotocolr&r&r'rì¨s zFirewallPolicy.check_portcCs| ||¡t|dƒ|fS©Nú-©rìrrîr&r&r'Z __port_id¬s zFirewallPolicy.__port_idcs¢|j |¡}|j |¡|j ¡|j|}tt‡fdd„|jƒƒ} | D]8} t|| dƒrH|j rf|j n|} t t j d|ˆ| fƒ‚qHt |dd„| Dƒƒ\} } |dur¬| ¡}n|}|jrú| D]}| d|t|dƒˆ|¡qº| D]}| d |t|dƒˆ|¡qÜ| D]0}| |ˆ¡} | || ||¡| |j|| ¡qþ| D]"}| |ˆ¡} | |j|| ¡q4|dkrŠt ||j||ˆ¡}| |d ||ˆf¡|durž| d¡|S) Ncs |dˆkS©Nr[r&©Úx©rðr&r'Ú·óz)FirewallPolicy.add_port..rú'%s:%s' already in '%s'cSsg|] \}}|‘qSr&r&©Ú.0rhrir&r&r'Ú ¾rùz+FirewallPolicy.add_port..TròFrï)r rFr¢r£r"r—ÚfilterrSr r8rrr¥r r3rJrhrÚ_FirewallPolicy__port_idÚ_FirewallPolicy__register_portr§Ú _FirewallPolicy__unregister_portr±rr©r‡r›rn©r$rDrïrðr|r}rNrpr«Úexisting_port_idsÚport_idrÕÚ added_rangesÚremoved_rangesrqÚrangeršr&r÷r'r†°sF     ÿ     ÿ  zFirewallPolicy.add_portcCs|j |¡dSr)rSr9©r$r«rr|r}r&r&r'Z__register_portÞszFirewallPolicy.__register_portcsz|j |¡}|j ¡|j|}tt‡fdd„|jƒƒ}|D]}t||dƒr<qzq<|jr`|jn|} t t j d|ˆ| fƒ‚t |dd„|Dƒƒ\} } |dur¤|  ¡} n|} |jrò| D]} | d|t| dƒˆ| ¡q²| D]} | d |t| dƒˆ| ¡qÔ| D]0} | | ˆ¡}| ||dd¡|  |j||¡qö| D]"} | | ˆ¡}|  |j||¡q,| d ||ˆf¡|durv|  d¡|S) Ncs |dˆkSrôr&rõr÷r&r'røçrùz,FirewallPolicy.remove_port..rú'%s:%s' not in '%s'cSsg|] \}}|‘qSr&r&rûr&r&r'rýðrùz.FirewallPolicy.remove_port..TròFrï)r rFr£r"r—rþrSr r8rrr¯r r3rJrhrrÿrr§rr±r-rn©r$rDrïrðrNrpr«rrrÕrrrqrr&r÷r'r‡ás>    ÿ     zFirewallPolicy.remove_portcCs||jvr|j |¡dSr)rSr³©r$r«rr&r&r'Z__unregister_port s z FirewallPolicy.__unregister_portcCs2| |¡jD] \}}t||ƒr ||kr dSq dS©NTF)r7rSr ©r$rDrïrðrhrir&r&r'Ú query_portszFirewallPolicy.query_portcCs | |¡jSr)r7rSryr&r&r'Ú list_portsszFirewallPolicy.list_portscCst|ƒsttj|ƒ‚dSr)rrrZINVALID_PROTOCOL©r$rðr&r&r'Úcheck_protocolszFirewallPolicy.check_protocolcCst|ƒsttjd|ƒ‚dS)Nzatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s')rrrÚ INVALID_RULE)r$Útcp_mss_clamp_valuer&r&r'Úcheck_tcp_mss_clamp sz"FirewallPolicy.check_tcp_mss_clampcCs| |¡|Sr)rrr&r&r'Z __protocol_id$s zFirewallPolicy.__protocol_idc Csò|j |¡}|j |¡|j ¡|j|}| |¡}||jvrd|jrL|jn|} tt j d|| fƒ‚|durv|  ¡} n|} |j r|  d||| ¡|dkr¼t ||j||¡} | | d||f¡| ||||¡|  |j||¡|durî|  d¡|S)Nr Trrð)r rFr¢r£r"Ú_FirewallPolicy__protocol_idrYr8rrr¥r3rJrirr©rr›Ú"_FirewallPolicy__register_protocolr§Ú$_FirewallPolicy__unregister_protocolrn) r$rDrðr|r}rNrpr«Ú protocol_idrÕrqršr&r&r'rŽ(s2       ÿ  ÿ zFirewallPolicy.add_protocolcCs|j |¡dSr)rYr9)r$r«rr|r}r&r&r'Z__register_protocolKsz"FirewallPolicy.__register_protocolc Csº|j |¡}|j ¡|j|}| |¡}||jvrX|jr@|jn|}ttj d||fƒ‚|durj|  ¡}n|}|j r„|  d|||¡|  d||f¡| |j||¡|dur¶| d¡|S)Nr®FrðT)r rFr£r"rrYr8rrr¯r3rJrir-r±rrn) r$rDrðrNrpr«rrÕrqr&r&r'rNs*      ÿ  ÿ zFirewallPolicy.remove_protocolcCs||jvr|j |¡dSr)rYr³)r$r«rr&r&r'Z__unregister_protocolls z$FirewallPolicy.__unregister_protocolcCs| |¡| |¡jvSr)rr7rY)r$rDrðr&r&r'Úquery_protocolpszFirewallPolicy.query_protocolcCs | |¡jSr)r7rYryr&r&r'Úlist_protocolssszFirewallPolicy.list_protocolscCs| ||¡t|dƒ|fSrñrórîr&r&r'Z__source_port_idxs zFirewallPolicy.__source_port_idcs¢|j |¡}|j |¡|j ¡|j|}tt‡fdd„|jƒƒ} | D]8} t|| dƒrH|j rf|j n|} t t j d|ˆ| fƒ‚qHt |dd„| Dƒƒ\} } |dur¬| ¡}n|}|jrú| D]}| d|t|dƒˆ|¡qº| D]}| d |t|dƒˆ|¡qÜ| D]0}| |ˆ¡} | || ||¡| |j|| ¡qþ| D]"}| |ˆ¡} | |j|| ¡q4|dkrŠt ||j||ˆ¡}| |d ||ˆf¡|durž| d¡|S) Ncs |dˆkSrôr&rõr÷r&r'røƒrùz0FirewallPolicy.add_source_port..rrúcSsg|] \}}|‘qSr&r&rûr&r&r'rýŠrùz2FirewallPolicy.add_source_port..TròFÚ source_port)r rFr¢r£r"r—rþrVr r8rrr¥r r3rJrjrÚ_FirewallPolicy__source_port_idÚ%_FirewallPolicy__register_source_portr§Ú'_FirewallPolicy__unregister_source_portr±rr©r‘r›rnrr&r÷r'r|sF     ÿ     ÿ  zFirewallPolicy.add_source_portcCs|j |¡dSr)rVr9rr&r&r'Z__register_source_portªsz%FirewallPolicy.__register_source_portcsz|j |¡}|j ¡|j|}tt‡fdd„|jƒƒ}|D]}t||dƒr<qzq<|jr`|jn|} t t j d|ˆ| fƒ‚t |dd„|Dƒƒ\} } |dur¤|  ¡} n|} |jrò| D]} | d|t| dƒˆ| ¡q²| D]} | d |t| dƒˆ| ¡qÔ| D]0} | | ˆ¡}| ||dd¡|  |j||¡qö| D]"} | | ˆ¡}|  |j||¡q,| d ||ˆf¡|durv|  d¡|S) Ncs |dˆkSrôr&rõr÷r&r'rø³rùz3FirewallPolicy.remove_source_port..rr cSsg|] \}}|‘qSr&r&rûr&r&r'rý¼rùz5FirewallPolicy.remove_source_port..TròFr)r rFr£r"r—rþrVr r8rrr¯r r3rJrjrrrr§rr±r-rnr r&r÷r'r‘­s>    ÿ     z!FirewallPolicy.remove_source_portcCs||jvr|j |¡dSr)rVr³r r&r&r'Z__unregister_source_portØs z'FirewallPolicy.__unregister_source_portcCs2| |¡jD] \}}t||ƒr ||kr dSq dSr )r7rVr r r&r&r'Úquery_source_portÜsz FirewallPolicy.query_source_portcCs | |¡jSr)r7rVryr&r&r'Úlist_source_portsãsz FirewallPolicy.list_source_portsc CsÖ|j |¡}|j |¡|j ¡|j|}|jrR|jr>|jn|}ttj d|ƒ‚|durd|  ¡}n|}|j r||  d||¡|dkr¤t  ||j|¡} | | d|f¡| |||¡| |j|¡|durÒ| d¡|S)Nz"masquerade already enabled in '%s'TrrT)r rFr¢r£r"rTr8rrr¥r3rJrkrr©r‹r›Ú$_FirewallPolicy__register_masquerader§Ú&_FirewallPolicy__unregister_masqueradern) r$rDr|r}rNrpr«rÕrqršr&r&r'rŠès,    ÿ  zFirewallPolicy.add_masqueradecCs d|_dS©NT©rT)r$r«r|r}r&r&r'Z__register_masqueradesz$FirewallPolicy.__register_masqueradecCs¢|j |¡}|j ¡|j|}|jsF|jr2|jn|}ttjd|ƒ‚|durX|  ¡}n|}|j rp|  d||¡|  d|f¡|  |j|¡|durž| d¡|S)Nzmasquerade not enabled in '%s'FrTT)r rFr£r"rTr8rrr¯r3rJrkr-r±r"rn)r$rDrNrpr«rÕrqr&r&r'r‹ s$   ÿ  z FirewallPolicy.remove_masqueradecCs d|_dS©NFr$©r$r«r&r&r'Z__unregister_masquerade&sz&FirewallPolicy.__unregister_masqueradecCs | |¡jSr)r7rTryr&r&r'Úquery_masquerade)szFirewallPolicy.query_masqueradecCsZ|j |¡|j |¡|r(|j |¡|rBt||ƒsBttj|ƒ‚|sV|sVttjdƒ‚dS)Nz.port-forwarding is missing to-port AND to-addr)r rìrír rrZ INVALID_ADDRZINVALID_FORWARD)r$ÚipvrïrðÚtoportÚtoaddrr&r&r'Úcheck_forward_port.s     þz!FirewallPolicy.check_forward_portcCsLtd|ƒr| d||||¡n| d||||¡t|dƒ|t|dƒt|ƒfS)NrÅrÄrò)r r+rrÃ)r$rïrðr)r*r&r&r'Z__forward_port_id;s   ÿz FirewallPolicy.__forward_port_idc  Cs|j |¡} |j |¡|j ¡|j| } | ||||¡} | | jvrp| jrR| jn| } tt j d||||| fƒ‚|dur‚|  ¡} n|} | j r¢|  d| | ||||¡|dkrÚt ||j| ||||¡}| |d| ||||f¡| | | ||¡|  |j| | ¡|dur|  d¡| S)Nz'%s:%s:%s:%s' already in '%s'TrÚ forward_port)r rFr¢r£r"Ú _FirewallPolicy__forward_port_idrUr8rrr¥r3rJrfrr©rr›Ú&_FirewallPolicy__register_forward_portr§Ú(_FirewallPolicy__unregister_forward_portrn)r$rDrïrðr)r*r|r}rNrpr«Ú forward_idrÕrqršr&r&r'rŒCsJ      ÿÿ ÿù ÿ  zFirewallPolicy.add_forward_portcCs|j |¡dSr)rUr9)r$r«r0r|r}r&r&r'Z__register_forward_portqsz&FirewallPolicy.__register_forward_portc CsÒ|j |¡}|j ¡|j|}| ||||¡} | |jvrd|jrF|jn|} ttj d||||| fƒ‚|durv|  ¡} n|} |j r–|  d|| ||||¡|  d|||||f¡|  |j|| ¡|durÎ|  d¡|S)Nz'%s:%s:%s:%s' not in '%s'Fr,T)r rFr£r"r-rUr8rrr¯r3rJrfr-r±r/rn) r$rDrïrðr)r*rNrpr«r0rÕrqr&r&r'rts2     ÿÿ ÿÿ z"FirewallPolicy.remove_forward_portcCs||jvr|j |¡dSr)rUr³)r$r«r0r&r&r'Z__unregister_forward_port•s z(FirewallPolicy.__unregister_forward_portcCs | ||||¡}|| |¡jvSr)r-r7rU)r$rDrïrðr)r*r0r&r&r'Úquery_forward_port™sz!FirewallPolicy.query_forward_portcCs | |¡jSr)r7rUryr&r&r'Úlist_forward_portsžsz!FirewallPolicy.list_forward_portscCs|j |¡dSr)r Zcheck_icmptype©r$Úicmpr&r&r'Úcheck_icmp_block£szFirewallPolicy.check_icmp_blockcCs| |¡|Sr)r5r3r&r&r'Z__icmp_block_id¦s zFirewallPolicy.__icmp_block_idc Csò|j |¡}|j |¡|j ¡|j|}| |¡}||jvrd|jrL|jn|} tt j d|| fƒ‚|durv|  ¡} n|} |j r|  d||| ¡|dkr¼t ||j||¡} | | d||f¡| ||||¡|  |j||¡|durî|  d¡|S)Nr TrÚ icmp_block)r rFr¢r£r"Ú_FirewallPolicy__icmp_block_idrWr8rrr¥r3rJrerr©r‰r›Ú$_FirewallPolicy__register_icmp_blockr§Ú&_FirewallPolicy__unregister_icmp_blockrn) r$rDr4r|r}rNrpr«Úicmp_idrÕrqršr&r&r'rˆªs2       ÿ  ÿ zFirewallPolicy.add_icmp_blockcCs|j |¡dSr)rWr9)r$r«r:r|r}r&r&r'Z__register_icmp_blockÍsz$FirewallPolicy.__register_icmp_blockc Csº|j |¡}|j ¡|j|}| |¡}||jvrX|jr@|jn|}ttj d||fƒ‚|durj|  ¡}n|}|j r„|  d|||¡|  d||f¡| |j||¡|dur¶| d¡|S)Nr®Fr6T)r rFr£r"r7rWr8rrr¯r3rJrer-r±r9rn) r$rDr4rNrpr«r:rÕrqr&r&r'r‰Ðs&      ÿ  z FirewallPolicy.remove_icmp_blockcCs||jvr|j |¡dSr)rWr³)r$r«r:r&r&r'Z__unregister_icmp_blockìs z&FirewallPolicy.__unregister_icmp_blockcCs| |¡| |¡jvSr)r7r7rW)r$rDr4r&r&r'Úquery_icmp_blockðszFirewallPolicy.query_icmp_blockcCs | |¡jSr)r7rWryr&r&r'Úlist_icmp_blocksószFirewallPolicy.list_icmp_blocksc Csî|j |¡}|j ¡|j|}|jrF|jr2|jn|}ttjd|ƒ‚|durX|  ¡}n|}|j rŒ|j D]}|  d|||¡qh|  d||¡| ||¡| |j||¡|j rØ|j D]}|  d|||¡q´|  d||¡|durê| d¡|S)Nz,icmp-block-inversion already enabled in '%s'FT)r rFr£r"rZr8rrr¥r3rJrWreÚ_icmp_block_inversionÚ._FirewallPolicy__register_icmp_block_inversionr§Ú*_FirewallPolicy__undo_icmp_block_inversionrn) r$rDr}rNrpr«rÕrqrur&r&r'Úadd_icmp_block_inversionøs2   þ     z'FirewallPolicy.add_icmp_block_inversioncCs d|_dSr#©rZ)r$r«r}r&r&r'Z__register_icmp_block_inversionsz.FirewallPolicy.__register_icmp_block_inversioncCs`| ¡}|jr*|jD]}| d|||¡qd|_|jrR|jD]}| d|||¡q<| d¡dS)NFT)r3rJrWrerZrn)r$rpr«rqrur&r&r'Z__undo_icmp_block_inversion"s  z*FirewallPolicy.__undo_icmp_block_inversioncCsì|j |¡}|j ¡|j|}|jsF|jr2|jn|}ttjd|ƒ‚|durX|  ¡}n|}|j rŒ|j D]}|  d|||¡qh|  d||¡| |¡| |j|d¡|j rÖ|j D]}|  d|||¡q²|  d||¡|durè| d¡|S)Nz(icmp-block-inversion not enabled in '%s'FT)r rFr£r"rZr8rrr¯r3rJrWrer=Ú0_FirewallPolicy__unregister_icmp_block_inversionr§r>rn)r$rDrNrpr«rÕrqrur&r&r'Úremove_icmp_block_inversion3s6   þ    ÿ  z*FirewallPolicy.remove_icmp_block_inversioncCs d|_dSr%rAr&r&r&r'Z!__unregister_icmp_block_inversionZsz0FirewallPolicy.__unregister_icmp_block_inversioncCs | |¡jSr)r7rZryr&r&r'Úquery_icmp_block_inversion]sz)FirewallPolicy.query_icmp_block_inversionc Csä|jj |¡}|jr*|jjj|jd}n|}|rT||jvrt||f|j|vrtdSn ||jvsp||f|j|vrtdS|j ¡D]2}|jr~||  ¡vr~|  ||||¡} |  || ¡q~|  ||||fg¡|  |j || ||fg¡dS©Nr)r rDr7r8rBZ_zone_policiesr!Úenabled_backendsÚpolicies_supportedZget_available_tablesZbuild_policy_chain_rulesÚ add_rulesÚ_register_chainsr§) r$rDÚcreaterrrsrqrHZtracking_policyÚbackendÚrulesr&r&r'r``s* ÿ ÿ ÿzFirewallPolicy.gen_chain_rulescCs^|D]T\}}|r*|j |g¡ ||f¡q|j| ||f¡t|j|ƒdkr|j|=qdSrE)r!Ú setdefaultr9r³r°)r$rDrJZtablesrrrsr&r&r'rI}s  zFirewallPolicy._register_chainscCs$|jj |¡dkrdS|jj |¡S)Nzhash:mac)r rÈÚget_typeZ get_family©r$rGr&r&r'r͈szFirewallPolicy._ipset_familycCs|jj |¡Sr)r rÈrNrOr&r&r'Z __ipset_typeszFirewallPolicy.__ipset_typecCsd |g|jj |¡¡S)Nú,)Újoinr rÈZ get_dimension)r$rGÚflagr&r&r'Ú_ipset_match_flagssz!FirewallPolicy._ipset_match_flagscCs|jj |¡Sr)r rÈZ check_appliedrOr&r&r'rÌ“sz#FirewallPolicy._check_ipset_appliedcCs*| |¡}|tvr&ttjd||fƒ‚dS)Nz.ipset '%s' with type '%s' not usable as source)Ú_FirewallPolicy__ipset_typerrrZ INVALID_IPSET)r$rGZ_typer&r&r'rË–s ÿþz+FirewallPolicy._check_ipset_type_for_sourcec s˜t|jƒtkr‚ˆjj |jj¡}|dur2|jjg}|jD]H}||vrFq8ˆ |¡|  |¡t   |¡}||j_ˆj |||||dq8g} |j r–|j g} nH|jrÞt|jtƒs´t|jtƒrÞˆjj |jj¡‰ˆjrÞ‡fdd„dDƒ} ˆ |j¡} | r"|j r|j | kr"ttjd| |j fƒ‚n| g} | s0ddg} ‡fdd„| Dƒ} | |_t‡fd d„| DƒƒD]2} t|jƒtkr€ˆjj |jj¡}g} t|jƒd krä|jr®ttjd ƒ‚| D].} | |jvr²|  | ¡r²|   |j| ¡q²n |   d¡| D]†}t|jƒtkr舠|j |¡}|ˆ !|j"¡7}t#t|ƒd d „d}g}|D]š}|j$}t%|ƒ}| &dd¡}|  |¡|j dkrˆ|  |j ¡sˆqBt|j'ƒdkr¤|  |¡n6|j'D].\}}|  (||||||j|¡}| )| |¡qªqB| *|¡|j'D]*\}}|  +||||||¡}| )| |¡qî|j,D]$}|  -|||||¡}| )| |¡q |j.D]*\}}|  /||||||¡}| )| |¡qLqòq^t|jƒt0krÐ|jj1}|jj2}ˆ 3||¡|  +||||d|¡}| )| |¡q^t|jƒt4kr|jj5}ˆ 6|¡|  -|||d|¡}| )| |¡q^t|jƒt7krX|jj5}ˆ 8|¡|  9|||d|¡}| )| |¡q^t|jƒt:kr°|r’| D]} |  | ¡rr| ;t<| ¡qr|  =|||¡}| )| |¡q^t|jƒt>krH|jj1}|jj2}|jj?}|jj@}| D]<} |  | ¡rˆ A| ||||¡|rä|rä| ;t<| ¡qä|  B|||||||¡}| )| |¡q^t|jƒtCkr–|jj1}|jj2}ˆ 3||¡|  /||||d|¡}| )| |¡nút|jƒtks¶t|jƒtkrRˆjj |jj¡‰|j rˆjr|j ˆjvrttjDd|j |jjfƒ‚t|jƒtkr4|jr4t|jƒtkr4ttjdƒ‚|  E||ˆ|¡}| )| |¡n>|jdurz|  F|||¡}| )| |¡nttjdt|jƒƒ‚q^dS)N©Úincluded_servicescsg|]}|ˆjvr|‘qSr&)Ú destination©rür()Úictr&r'rý³rùz0FirewallPolicy._rule_prepare..©rÄrÅz;Source address family '%s' conflicts with rule family '%s'.rÄrÅcsg|]}ˆj |¡r|‘qSr&)r Úis_ipv_enabledrXr*r&r'rýÄrùcsg|]}ˆj |¡‘qSr&)r Úget_backend_by_ipv)rürör*r&r'rýÉrùrz"Destination conflict with service.cSs|jSr©rGrõr&r&r'røárùz.FirewallPolicy._rule_prepare..©rtÚ conntrackÚnatrÇr[z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)GÚtypeÚelementrr rÚÚ get_servicerGÚincludesrØr9r–ÚdeepcopyrÐÚfamilyrcrrÚconfigÚ get_icmptyperWrÏrÎrrrÚipvsr@r°Úis_ipv_supportedÚactionrrërérçrär4rèr ÚreplacerSÚbuild_policy_helper_ports_rulesrHZ add_modulesÚbuild_policy_ports_rulesrYÚbuild_policy_protocol_rulesrVÚbuild_policy_source_ports_rulesrrïrðrìrÚvaluerrrZ build_policy_tcp_mss_clamp_rulesrr±rÚbuild_policy_masquerade_rulesrZto_portZ to_addressr+Úbuild_policy_forward_port_rulesrZINVALID_ICMPTYPEÚbuild_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules)r$rorDrÁrqrVÚsvcÚincludeZ_ruleriZ source_ipvrKZ destinationsr(rWrärérárèrêÚ nat_modulerïÚprotorLrðrr)r*r&)rYr$r'rОsJ         ÿÿ  ÿ   þ  ÿ  ÿ ÿ  ÿ  ÿ  ÿ    þ  ÿ ÿ ÿ ÿÿÿ ÿÿ ÿÿzFirewallPolicy._rule_preparec Cs>|jj |¡}| |j|¡}|| |j¡7}tt|ƒdd„d}|durN|g}|j D]6}||vrbqT|  |¡|  |¡|j |||||dqTg} dD]f} |j  | ¡s¦q”|j | ¡} t|jƒdkrà| |jvrú|   | |j| f¡q”| df| vr”|   | df¡q”| D]6\} } |D]œ} | j}t|ƒ}| j dd¡}| |¡| jd krV|  | j¡sVqt| jƒd krr| |¡n6| jD].\}}|  ||||| | j|¡}| | |¡qxq|jD](\}}|  ||||| ¡}| | |¡q²|jD]"}|  |||| ¡}| | |¡qâ|jD](\}}|  ||||| ¡}| | |¡q qdS) NcSs|jSrr]rõr&r&r'røjrùz)FirewallPolicy._service..r^rUrZrr_r`rÇr[) r rÚrcrërérçrär4r@rdrØr9rgr[r\r°rWrèr rlZ add_modulerfrjrSrmrGrHrnrYrorVrp)r$rorDrÚrqrVrurärvZ backends_ipvr(rKrWrárèrêrwrïrxrLrðr&r&r'rgfsj         þ ÿ ÿ ÿzFirewallPolicy._servicecCs8|j ¡D](}|jsq | ||||¡}| ||¡q dSr)r rFrGrnrH©r$rorDrïrðrqrKrLr&r&r'rh¦s ÿzFirewallPolicy._portcCs6|j ¡D]&}|jsq | |||¡}| ||¡q dSr)r rFrGrorH)r$rorDrðrqrKrLr&r&r'ri¯s zFirewallPolicy._protocolcCs8|j ¡D](}|jsq | ||||¡}| ||¡q dSr)r rFrGrprHryr&r&r'rj·s zFirewallPolicy._source_portcCs8d}| t|¡|j |¡}| ||¡}| ||¡dS)NrÄ)r±rr r\rrrH)r$rorDrqr(rKrLr&r&r'rk¿s    zFirewallPolicy._masqueradec CsXtd|ƒrd}nd}|r(|r(| t|¡|j |¡} |  ||||||¡} | | | ¡dS)NrÅrÄ)r r±rr r\rsrH) r$rorDrqrïrðr)r*r(rKrLr&r&r'rfÇs    þzFirewallPolicy._forward_portc Csz|jj |¡}|j ¡D]\}|js$qd}|jrTdD] }||jvr2| |¡s2d}qTq2|rZq| |||¡} | || ¡qdS)NFrZT) r rgrhrFrGrWrjrtrH) r$rorDr4rqrYrKZ skip_backendr(rLr&r&r'reÖs  zFirewallPolicy._icmp_blockcCsb|j|j}|dvrdS| |¡s.|dkr.dS|j ¡D]$}|jsDq8| ||¡}| ||¡q8dS)N)ZDROPz %%REJECT%%ZREJECTZACCEPT)r"ÚtargetrDr rFrGZ'build_policy_icmp_block_inversion_rulesrH)r$rorDrqrzrKrLr&r&r'r=ës  z$FirewallPolicy._icmp_block_inversioncCs&t|jƒ}| |||¡| d¡dSr#)rr rarn)r$rorDrqr&r&r'Ú!_ingress_egress_zones_transactionþs z0FirewallPolicy._ingress_egress_zones_transactionc Cs|j|}|j}|j}tƒ}tƒ}tƒ} tƒ} |D]:} | dvr@q2|t|jj | ¡ƒO}| t|jj | ¡ƒO} q2|D]:} | dvr€qr|t|jj | ¡ƒO}| t|jj | ¡ƒO} qr|j ¡D]D} | j sÄq¸|  |¡D],\} }|   ||| |||| | ¡}|  | |¡qÎq¸dS)N)r?r>) r"rArCr@r rBZlist_interfacesZ list_sourcesrFrGr^Z!build_policy_ingress_egress_rulesrH)r$rorDrqrHrArCZingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesrBrKrrrsrLr&r&r'ras4  þz$FirewallPolicy._ingress_egress_zonescCs |j|}d|jvr)©rþZINPUT©r`Ú PREROUTING©Úmangler~©Úrawr~r|)rþÚOUTPUT)r`rƒ)©rþZFORWARDr}©r`Z POSTROUTINGr©r„r}rZnftablesr…r„r}rN) r"rArCr Únftables_enabledr9Z_firewall_backendrBZget_zoneZ interfaces)r$rDrHÚtcrBr&r&r'r^#sl                             z4FirewallPolicy._get_table_chains_for_policy_dispatchcCsf|j|}d|jvr0dg}|jjs,| d¡|Sd|jvrBgd¢Sd|jvrRdgSttjd|ƒ‚dS) z8Create a list of (table, chain) needed for zone dispatchr>r|rr?r†r…zInvalid policy: %sN) r"rCr r‡r9rArrÚINVALID_POLICY)r$rDrHrˆr&r&r'r_ys     z2FirewallPolicy._get_table_chains_for_zone_dispatchFcCs–|jj |¡}|jr|j}n||}d|jvrh|dkr>d|S|dkrNd|S|jsd|dvrdd|Snd|jvrŠ|jsˆ|dvrˆd|Snòd |jvrÔ|dkr¤d |S|d krÂ|r¸d |Sd|Sn|d vrÒd|Sn¨d |jvr.|dkrðd |S|d kr|rd |Sd|Sn|d vr||js|d|SnN|js||dkrHd |S|d krj|r`d |Sd|Sn|d vr|d|Sttjd|||fƒ‚dS)Nr>rþZIN_r‚ZPRE_)r€r`)rþr`ZOUT_r?ZFWD_r`ZPOST_)r€r‚z.Can't convert policy to chain name: %s, %s, %s) r rDr7r8rCrArrr‰)r$rDrrZ policy_prefixZisSNATrHÚsuffixr&r&r'Úpolicy_base_chain_namesZ                z%FirewallPolicy.policy_base_chain_name)N)N)N)N)rNNT)N)rNNT)N)rNN)N)rNN)N)rNN)N)rNN)N)rNN)N)rNN)N)NN)NN)NNrNN)NNN)NN)rNN)N)NN)N)N)N)NN)F)‚Ú__name__Ú __module__Ú __qualname__r(r+r0r3r6r=rEr7rIrLrPrQrvrOrKrzr™r›r-rŸr¤r’r¦r“r¨r¶r·r¸rºr”r»r•r¼r½r¾rÂrÑrÏrlr~rÒrrÓrÖr×rØrÛr„rÜr…rÝrßràrçrërìrÿr†rr‡rrrrrrrŽrrrrrrrrr‘rrr rŠr!r‹r"r'r+r-rŒr.rr/r1r2r5r7rˆr8r‰r9r;r<r@r>r?rCrBrDr`rIrÍrTrSrÌrËrÐrgrhrirjrkrfrer=r{rar^r_r‹r&r&r&r'rsB   F  ;ÿ , %ÿ , %ÿ !ÿ ÿ #ÿ  ÿ .ÿ +ÿ #ÿ ÿ .ÿ +ÿ   þ .ÿ !ÿ ÿ # ÿ ' '  I @  ÿ  Vr)'Z gi.repositoryrr–Zfirewall.core.loggerrZfirewall.functionsrrrrrr r r r r rrƒrrrrrrrrrrrZfirewall.core.fw_transactionrZfirewallrZfirewall.errorsrZfirewall.core.baserÚobjectrr&r&r&r'Ús  44