a 7IrjD­ã@sÌddlmZddlZddlmZmZmZddlmZddl m Z ddl m Z ddl mZmZmZmZmZmZmZmZmZmZmZddlmZdd lmZmZmZdd lm Z dd l!m"Z"Gd d „d e#ƒZ$dS)é)ÚGLibN)Ú SHORTCUTSÚDEFAULT_ZONE_TARGETÚSOURCE_IPSET_TYPES)ÚFirewallTransaction)ÚPolicy)Úlog) ÚRich_ForwardPortÚRich_IcmpBlockÚ Rich_IcmpTypeÚ Rich_MarkÚRich_MasqueradeÚ Rich_PortÚ Rich_ProtocolÚ Rich_RuleÚ Rich_ServiceÚRich_SourcePortÚRich_Tcp_Mss_Clamp)Únm_get_bus_name)Ú checkIPnMaskÚ checkIP6nMaskÚ check_mac)Úerrors)Ú FirewallErrorc@s6eZdZdZdd„Zdd„Zdd„Zdd „Zd d „Zd d „Z dd„Z dd„Z dd„Z dd„Z dd„Zdd„Zdd„ZdÁdd„Zdd „Zd!d"„Zd#d$„ZdÂd%d&„Zd'd(„ZdÃd)d*„ZdÄd+d,„Zd-d.„Zd/d0„Zd1d2„Zd3d4„Zd5d6„Zd7d8„Zd9d:„ZdÅdd?„Z!dÆd@dA„Z"dÇdBdC„Z#dÈdDdE„Z$dFdG„Z%dHdI„Z&dJdK„Z'dÉdMdN„Z(dÊdOdP„Z)dËdQdR„Z*dSdT„Z+dÌdUdV„Z,dÍdWdX„Z-dYdZ„Z.d[d\„Z/d]d^„Z0dÎd_d`„Z1dadb„Z2dcdd„Z3dedf„Z4dgdh„Z5didj„Z6dkdl„Z7dÏdmdn„Z8dodp„Z9dqdr„Z:dsdt„Z;dÐdudv„Zd{d|„Z?dÑd}d~„Z@dd€„ZAdd‚„ZBdƒd„„ZCd…d†„ZDdÒd‡dˆ„ZEd‰dŠ„ZFd‹dŒ„ZGddŽ„ZHdÓdd„ZId‘d’„ZJd“d”„ZKd•d–„ZLdÔd—d˜„ZMd™dš„ZNd›dœ„ZOdÕddž„ZPdÖdŸd „ZQd×d¡d¢„ZRd£d¤„ZSdØd¥d¦„ZTd§d¨„ZUd©dª„ZVd«d¬„ZWdÙd­d®„ZXd¯d°„ZYd±d²„ZZd³d´„Z[dµd¶„Z\dÚd·d¸„Z]d¹dº„Z^dÛd»d¼„Z_d½d¾„Z`d¿dÀ„ZadS)ÜÚ FirewallZonercCs||_i|_i|_i|_dS©N)Ú_fwÚ_zonesÚ_zone_policiesÚ _timeouts)ÚselfÚfw©r"ú9/usr/lib/python3.9/site-packages/firewall/core/fw_zone.pyÚ__init__2szFirewallZone.__init__cCsd|j|jfS)Nz%s(%r))Ú __class__r©r r"r"r#Ú__repr__8szFirewallZone.__repr__cCs.|j ¡|j ¡|jD]}| |¡qdSr)rÚclearrrÚ removeTimeout©r Ú_idr"r"r#Úcleanup;s   zFirewallZone.cleanupcCst|jƒ}| |jj¡|Sr)rrZadd_preÚfull_check_config)r Útr"r"r#Únew_transactionAs zFirewallZone.new_transactioncCsdj||dS)Nzzone_{fromZone}_{toZone})ÚfromZoneÚtoZone)Úformat)r r0r1r"r"r#Úpolicy_name_from_zonesFsz#FirewallZone.policy_name_from_zonescCst|j ¡ƒSr)ÚsortedrÚkeysr&r"r"r#Ú get_zonesKszFirewallZone.get_zonescCs4g}| ¡D]"}| |¡s$| |¡r | |¡q |Sr)r6Úlist_interfacesÚ list_sourcesÚappend)r Z active_zonesÚzoner"r"r#Úget_active_zonesNs   zFirewallZone.get_active_zonescCs2| |¡}|jD]}||j|jvr|SqdSr)Ú_FirewallZone__interface_idrÚ interfaces)r Ú interfaceÚ interface_idr:r"r"r#Úget_zone_of_interfaceUs    z"FirewallZone.get_zone_of_interfacecCs2| |¡}|jD]}||j|jvr|SqdSr)Ú_FirewallZone__source_idrÚsources)r ÚsourceÚ source_idr:r"r"r#Úget_zone_of_source]s    zFirewallZone.get_zone_of_sourcecCs|j |¡}|j|Sr)rÚ check_zoner)r r:Úzr"r"r#Úget_zonees zFirewallZone.get_zonec CsHtƒ}|j|_| ||¡|_|j|_|j|_|g|_|g|_dD]}||jkrz|dkrz|dvrzt ||t   t ||ƒ¡ƒq@|dkr®||jkr®|dvr®t ||t   t ||ƒ¡ƒq@||jkrâ|dkrâ|dvrât ||t   t ||ƒ¡ƒq@|dvr@g|_ g|_|j D]D}| ||¡}t|d}|| |j|¡vrü|j  |¡|j |¡qüq@|S) N) ÚservicesÚportsÚ masqueradeÚ forward_portsÚ source_portsÚ icmp_blocksÚicmp_block_inversionÚ rules_strÚ protocolsÚHOST)rIrJrMrNrOrQÚANY)rK)rL)rP©Úrule_str)rÚnameZderived_from_zoner3ÚZONE_POLICY_PRIORITYÚpriorityÚtargetZ ingress_zonesZ egress_zonesÚsetattrÚcopyÚdeepcopyÚgetattrrPÚrulesrÚ_rich_rule_to_policiesr9) r Úz_objr0r1Úp_objZsettingrUZcurrent_policyÚruler"r"r#Úpolicy_obj_from_zone_objis8 ÿÿ    z%FirewallZone.policy_obj_from_zone_objcCsr||j|j<g|j|j<|jdfd|jf|jdffD]8\}}| |||¡}|jj |¡|j|j |j¡q4dS)NrRrS)rrVrrcrÚpolicyZ add_policyr9)r Úobjr0r1rar"r"r#Úadd_zone“s  ÿ zFirewallZone.add_zonecCs.|j|}|jr| |¡|j|=|j|=dSr)rÚappliedÚunapply_zone_settingsr)r r:rer"r"r#Ú remove_zone¦s   zFirewallZone.remove_zoneNcCsR| ¡D]D}|j|}t|jƒdks2t|jƒdkrt d|¡|j||dqdS)NrzApplying zone '%s'©Úuse_transaction)r6rÚlenr=rBrÚdebug1Úapply_zone_settings)r rkr:r`r"r"r#Ú apply_zones­s    zFirewallZone.apply_zonescCs|j|}||_dSr)rrg)r r:rgrer"r"r#Úset_zone_applied´s zFirewallZone.set_zone_appliedcCs˜d|vr dS| d¡}t|ƒdkr&dSd}tD]}|dt|kr.|}q.|dur”|d| ¡vrddSt|ƒdksˆt|ƒdkr”|ddvr”|d|fSdS)NÚ_éréé)ZprerZdenyZallowZpost)Úsplitrlrr6)r ÚchainZsplitsÚ_chainÚxr"r"r#Úzone_from_chainºs&    ÿ ÿ zFirewallZone.zone_from_chaincCst| |¡}|durdS|\}}|dvr0|}d}n4|dvrB|}d}n"|dvrTd}|}nttjd|ƒ‚| ||¡|fS)N)Z PREROUTINGZFORWARDrS)ZINPUTrR)Z POSTROUTINGz&chain '%s' can't be mapped to a policy)ryrrZ INVALID_CHAINr3)r rvrxr:rwr0r1r"r"r#Úpolicy_from_chainÎs zFirewallZone.policy_from_chainc Csj|dvrf| |¡}|durf| |¡\}}|dur:| ¡}n|}|jj |d|||¡|durf| d¡dS)N)Úipv4Úipv6T)rzr/rrdZgen_chain_rulesÚexecute) r ÚipvÚtablervrkrxrdrwÚ transactionr"r"r#Úcreate_zone_base_by_chainãs  ÿz&FirewallZone.create_zone_base_by_chainc Cs°dD]”}t| |¡|ƒ}t|tƒr(|g}|D]j}|dkrJ| ||||¡q,|dkrp| |¡}| |||||¡q,|dkr|q,q,|dkr†q,t d|||¡q,q|r¬|  |||¡dS)N)r=rBÚforwardrOr=rBrOr‚z3Zone '%s': Unknown setting '%s:%s', unable to apply) r]rHÚ isinstanceÚboolÚ _interfaceÚ check_sourceÚ_sourcerZwarningÚ_icmp_block_inversion)r Úenabler:r€ÚkeyZ args_listÚargsr~r"r"r#Ú_zone_settingsös&  ÿzFirewallZone._zone_settingscCs|j |¡}|j|}|jr dSd|_|dur8| ¡}n|}|j|D]$}t d||¡|jjj ||dqF|  d||¡|durŒ|  d¡dS)NTz+Applying policy (%s) derived from zone '%s'rj) rrFrrgr/rrrmrdÚapply_policy_settingsrŒr}©r r:rkÚ_zonerer€rdr"r"r#rns   z FirewallZone.apply_zone_settingscCs||j |¡}|j|}|js dS|dur2| ¡}n|}|j|D]}|jjj||dq@| d||¡|durx|  d¡dS)NrjFT) rrFrrgr/rrdÚunapply_policy_settingsrŒr}rŽr"r"r#rh#s   z"FirewallZone.unapply_zone_settingsc Csz| |¡}| |¡}g}tdƒD]P}|j|d|vrX| t t||j|dƒ¡¡q | ||j|d¡q t|ƒS)úH :return: exported config updated with runtime settings ér) rHÚget_config_with_settings_dictÚrangeZIMPORT_EXPORT_STRUCTUREr9r[r\r]Útuple)r r:reZ conf_dictZ conf_listÚir"r"r#Úget_config_with_settings6s   "z%FirewallZone.get_config_with_settingscCs–| |¡ ¡}|dtkr"d|d<| |¡| |¡| |¡| |¡| |¡| |¡|  |¡|  |¡|  |¡|  |¡|  |¡| |¡dœ }|j ||¡S)r‘rYÚdefault© rIrJrNrKrLr=rBrPrQrMrOr‚)rHZexport_config_dictrÚ list_servicesÚ list_portsÚlist_icmp_blocksÚquery_masqueradeÚlist_forward_portsr7r8Ú list_rulesÚlist_protocolsÚlist_source_portsÚquery_icmp_block_inversionÚ query_forwardrZ'combine_runtime_with_permanent_settings)r r:Z permanentZruntimer"r"r#r“Fs" õ z*FirewallZone.get_config_with_settings_dictc sRd‡fdd„ }‡fdd„}ˆjˆjfˆjˆjfˆjˆjfˆjˆjfˆjˆj fˆj ˆj fˆj ˆj f||fˆjˆjfˆjˆjfˆjˆjfˆjˆjfdœ }d}d|vr¸|d}t |¡}|d=ˆ |¡}t |¡} |  |ˆj ¡¡ˆj d| gi¡ˆ |¡} ˆj | |¡\} } | D]p} t| | tƒrn| | D]>}t|t ƒrV|| d |g|¢RŽn|| d ||ƒq,n|| d |ƒq| D]Æ} t| | tƒr| | D]n}| d vrÈ|| d|||d nFt|t ƒrö|| d|g|¢R||d œŽn|| d||||d q¢n6| d vr4|| d||d n|| d|||d q†dS)Nrcsˆj|t|d||ddS)NrT©ÚtimeoutÚsender)Úadd_ruler)r:rUr¥r¦r&r"r#Úadd_rule_wrapper^szDFirewallZone.set_config_with_settings_dict..add_rule_wrappercsˆ |t|d¡dS)NrT)Ú remove_ruler)r:rUr&r"r#Úremove_rule_wrapper`szGFirewallZone.set_config_with_settings_dict..remove_rule_wrapperr™r¥Zzonesrs)r=rB)r¦r¤)rO)rN)!Ú add_serviceÚremove_serviceÚadd_portÚ remove_portÚadd_icmp_blockÚremove_icmp_blockÚadd_masqueradeÚremove_masqueradeÚadd_forward_portÚremove_forward_portÚ add_interfaceÚremove_interfaceÚ add_sourceÚ remove_sourceÚ add_protocolÚremove_protocolÚadd_source_portÚremove_source_portÚadd_icmp_block_inversionÚremove_icmp_block_inversionÚ add_forwardÚremove_forwardr[rHZimport_config_dictrZget_all_io_objects_dictr-r“Zget_added_and_removed_settingsrƒÚlistr•)r r:Zsettingsr¦r¨rªZ setting_to_fnr¥Zold_objZ check_objZ old_settingsZ add_settingsZremove_settingsrŠr‹r"r&r#Úset_config_with_settings_dict\sd            ô          ÿÿÿ  z*FirewallZone.set_config_with_settings_dictcCs||jvr||j|<dSr)r)r Útagr+r"r"r#Ú addTimeout s zFirewallZone.addTimeoutcCs&||jvr"t |j|¡|j|=dSr)rrZ source_remover*r"r"r#r)¤s zFirewallZone.removeTimeoutcCs|j |¡dSr)rÚcheck_interface©r r>r"r"r#rÅ«szFirewallZone.check_interfacecCs| |¡|Sr)rÅrÆr"r"r#Z__interface_id®s zFirewallZone.__interface_idTc Cs |j ¡|j |¡}|j|}| |¡}||jvrHttjd||fƒ‚|  |¡} | durnttj d|| fƒ‚t   d||f¡|dur’|  ¡} n|} |js¾|r¾|j|| d|  |j|d¡|rÒ| d||| ¡| ||||¡|  |j||¡|dur|  d¡|S)Nú'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s'rjFT)rÚ check_panicrFrr<r=rrÚZONE_ALREADY_SETr@Ú ZONE_CONFLICTrrmr/rgrnÚadd_failrpr…Ú!_FirewallZone__register_interfaceÚ#_FirewallZone__unregister_interfacer}) r r:r>r¦rkÚ allow_applyrÚ_objr?Úzoir€r"r"r#rµ²sJ     ÿÿ ÿÿÿ  ÿ ÿ  zFirewallZone.add_interfacecCsB|j |¡|r|dkr&|jj |¡|tƒkr>|jj |¡dS)NÚ)r=r9rÚ_default_zone_interfacesrÚ_nm_assigned_interfaces)r rÏr?r:r¦r"r"r#Z__register_interfaceÝs    z!FirewallZone.__register_interfacecCsR|j ¡| |¡}|j |¡}||kr,|S|dur@| ||¡| |||¡}|Sr)rrÈr@rFr¶rµ)r r:r>r¦Ú _old_zoneÚ _new_zonerr"r"r#Úchange_zone_of_interfaceäs    z%FirewallZone.change_zone_of_interfacecCsz|j ¡|dur| ¡}n|}| ||¡|jd|d|dd|durd|dkrd|jd|d|dd|durv| d¡dS)NTú+)r9rÑF)rrÈr/rnr…r})r Zold_zoneZnew_zonerkr€r"r"r#Úchange_default_zoneós   z FirewallZone.change_default_zonec CsÂ|j ¡| |¡}|dur,ttjd|ƒ‚|dkr8|n |j |¡}||krbttjd|||fƒ‚|durt| ¡}n|}|j |}|  |¡}|  |j ||¡|  d|||¡|dur¾| d¡|S)Nú'%s' is not in any zonerÑz"remove_interface(%s, %s): zoi='%s'FT)rrÈr@rrZUNKNOWN_INTERFACErFrÊr/rr<Úadd_postrÍr…r}) r r:r>rkrÐrr€rÏr?r"r"r#r¶s.  ÿÿÿ    zFirewallZone.remove_interfacecCsN||jvr|j |¡||jjvr0|jj |¡||jjvrJ|jj |¡dSr)r=ÚremoverrÒrÓ)r rÏr?r"r"r#Z__unregister_interfaces     z#FirewallZone.__unregister_interfacecCs| |¡| |¡jvSr)r<rHr=)r r:r>r"r"r#Úquery_interface'szFirewallZone.query_interfacecCs | |¡jSr)rHr=©r r:r"r"r#r7*szFirewallZone.list_interfacesFcCsxt|ƒr dSt|ƒrdSt|ƒr$dS| d¡rh| |dd…¡|rV| |dd…¡| |dd…¡Sttj |ƒ‚dS)Nr{r|rÑzipset:é) rrrÚ startswithÚ_check_ipset_type_for_sourceÚ_check_ipset_appliedÚ _ipset_familyrrZ INVALID_ADDR©r rCrgr"r"r#r†/s zFirewallZone.check_sourcecCs|j||d|S)N©rg)r†rãr"r"r#Z __source_id>szFirewallZone.__source_idc Cs|j ¡|j |¡}|j|}t|ƒr0| ¡}|j||d}|j||d} | |jvrjt t j d||fƒ‚|  |¡durˆt t j d|ƒ‚|durš| ¡} n|} |jsÆ|rÆ|j|| d|  |j|d¡|rÜ| d||| | ¡| || ||¡|  |j|| ¡|dur|  d¡|S)NrärÇz'%s' already bound to a zonerjFT)rrÈrFrrÚupperr†rArBrrrÉrErÊr/rgrnrËrpr‡Ú_FirewallZone__register_sourceÚ _FirewallZone__unregister_sourcer}) r r:rCr¦rkrÎrrÏr~rDr€r"r"r#r·Bs<     ÿÿ  ÿ  zFirewallZone.add_sourcecCs|j |¡dSr)rBr9)r rÏrDr:r¦r"r"r#Z__register_sourcejszFirewallZone.__register_sourcecCsb|j ¡| |¡}|j |¡}||kr,|St|ƒr<| ¡}|durP| ||¡| |||¡}|Sr)rrÈrErFrrår¸r·)r r:rCr¦rÔrÕrr"r"r#Úchange_zone_of_sourcems    z"FirewallZone.change_zone_of_sourcec CsÞ|j ¡t|ƒr| ¡}| |¡}|dur}ˆjj |¡D]*\}} | |||||| |¡} | || ¡q2q ˆ |d¡}ˆ  |¡j r |dvr |j |||d|d} | || ¡q ˆjj  ¡D]¼}|ˆjj  |¡vrØ|ˆjj |¡vrØq®|ˆjj ¡vrRˆjj |¡jrR|s*tˆ |¡ƒdkr*ˆjjj||dn&ˆjj d||¡| ‡fdd „|¡q®|r®| ‡fd d „|¡q®dS) NrS)r×Ú*Úfilter©r>rsrjFcs |ˆjj ¡voˆjj d|¡S©NT©rrdÚ)get_active_policies_not_derived_from_zoneZ!_ingress_egress_zones_transaction©Úpr&r"r#ÚÎsz)FirewallZone._interface..cs|ˆjj ¡voˆjj |¡Sr©rrdrïrrðr&r"r#ròÑs)rÚenabled_backendsÚpolicies_supportedrrdÚ#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rulesÚ add_rulesr3rHr‚Úbuild_zone_forward_rulesÚ"get_policies_not_derived_from_zoneÚlist_ingress_zonesÚlist_egress_zonesrïÚ get_policyrgrlr7rÚ_ingress_egress_zonesrÚ) r r‰r:r>r€r9Úbackendrdrrvr^r"r&r#r…ªs: ÿ ÿ$ÿÿzFirewallZone._interfacecCs$| |¡dkrdS|jjj|ddS)Nzhash:macFrä)Ú _ipset_typerÚipsetZ get_family©r rVr"r"r#râÖszFirewallZone._ipset_familycCs|jjj|ddS)NFrä)rrZget_typerr"r"r#rÿÛszFirewallZone._ipset_typecCsd |g|jj |¡¡S)Nú,)ÚjoinrrZ get_dimension)r rVÚflagr"r"r#Ú_ipset_match_flagsÞszFirewallZone._ipset_match_flagscCs|jj |¡Sr)rrZ check_appliedrr"r"r#ráász!FirewallZone._check_ipset_appliedcCs*| |¡}|tvr&ttjd||fƒ‚dS)Nz.ipset '%s' with type '%s' not usable as source)rÿrrrZ INVALID_IPSET)r rVZ_typer"r"r#ràäs ÿþz)FirewallZone._check_ipset_type_for_sourcec sx|rˆj |¡gnˆj ¡D]Œ}|js(qˆj|D]<}ˆjj |¡D](\}} | |||||| ¡} | || ¡qDq2ˆ  |d¡}ˆ  |¡j r|j |||d|d} | || ¡qˆjj  ¡D]¼}|ˆjj |¡vrà|ˆjj |¡vràq¶|ˆjj ¡vrZˆjj |¡jrZ|s2tˆ |¡ƒdkr2ˆjjj||dn&ˆjj d||¡| ‡fdd„|¡q¶|r¶| ‡fd d„|¡q¶dS) NrSrë©rCrsrjFcs |ˆjj ¡voˆjj d|¡Srírîrðr&r"r#ròsz&FirewallZone._source..cs|ˆjj ¡voˆjj |¡Srrórðr&r"r#ròs)rÚget_backend_by_ipvrôrõrrdröZbuild_zone_source_address_rulesr÷r3rHr‚rørùrúrûrïrürgrlr8rrýrÚ) r r‰r:r~rCr€rþrdrrvr^r"r&r#r‡ìs: ÿ  ÿ$ÿÿzFirewallZone._sourcecCs0|j |¡}| |d¡}|jj ||||¡|S©NrR)rrFr3rdr«)r r:Úservicer¥r¦Úp_namer"r"r#r«s  zFirewallZone.add_servicecCs,|j |¡}| |d¡}|jj ||¡|Sr)rrFr3rdr¬©r r:r r r"r"r#r¬s  zFirewallZone.remove_servicecCs(|j |¡}| |d¡}|jj ||¡Sr)rrFr3rdÚ query_servicer r"r"r#r  s  zFirewallZone.query_servicecCs&|j |¡}| |d¡}|jj |¡Sr)rrFr3rdrš©r r:r r"r"r#rš%s  zFirewallZone.list_servicescCs2|j |¡}| |d¡}|jj |||||¡|Sr)rrFr3rdr­)r r:ÚportÚprotocolr¥r¦r r"r"r#r­*s  zFirewallZone.add_portcCs.|j |¡}| |d¡}|jj |||¡|Sr)rrFr3rdr®©r r:rrr r"r"r#r®0s  zFirewallZone.remove_portcCs*|j |¡}| |d¡}|jj |||¡Sr)rrFr3rdÚ query_portrr"r"r#r6s  zFirewallZone.query_portcCs&|j |¡}| |d¡}|jj |¡Sr)rrFr3rdr›r r"r"r#r›;s  zFirewallZone.list_portscCs2|j |¡}| |d¡}|jj |||||¡|Sr)rrFr3rdr»)r r:Ú source_portrr¥r¦r r"r"r#r»@s  zFirewallZone.add_source_portcCs.|j |¡}| |d¡}|jj |||¡|Sr)rrFr3rdr¼©r r:rrr r"r"r#r¼Fs  zFirewallZone.remove_source_portcCs*|j |¡}| |d¡}|jj |||¡Sr)rrFr3rdÚquery_source_portrr"r"r#rLs  zFirewallZone.query_source_portcCs&|j |¡}| |d¡}|jj |¡Sr)rrFr3rdr¡r r"r"r#r¡Qs  zFirewallZone.list_source_portscCsÜ|j |¡}t|jƒtkr(| |d¡gSt|jƒttt t t t fvrP| |d¡gSt|jƒt fvrn| |d¡gSt|jƒtfvrŒ| d|¡gSt|jƒtfvrª| |d¡gS|jdurÂ| |d¡gSttjdt|jƒƒ‚dS)NrSrRz Rich rule type (%s) not handled.)rrFÚtypeÚactionr r3Úelementrrrrr r r r rrrZ INVALID_RULE)r r:rbr"r"r#r_Vs  ÿ z#FirewallZone._rich_rule_to_policiescCs*| ||¡D]}|jj ||||¡q |Sr)r_rrdr§)r r:rbr¥r¦r r"r"r#r§hszFirewallZone.add_rulecCs&| ||¡D]}|jj ||¡q |Sr)r_rrdr©)r r:rbr r"r"r#r©mszFirewallZone.remove_rulecCs.d}| ||¡D]}|o&|jj ||¡}q|Srí)r_rrdÚ query_rule)r r:rbÚretr r"r"r#rrszFirewallZone.query_rulecCsZ|j |¡}tƒ}| |d¡| |d¡| d|¡fD]}| t|jj |¡ƒ¡q4t|ƒS)NrSrR)rrFÚsetr3ÚupdaterdrŸrÁ)r r:rr r"r"r#rŸxs    þzFirewallZone.list_rulescCs0|j |¡}| |d¡}|jj ||||¡|Sr)rrFr3rdr¹)r r:rr¥r¦r r"r"r#r¹s  zFirewallZone.add_protocolcCs,|j |¡}| |d¡}|jj ||¡|Sr)rrFr3rdrº©r r:rr r"r"r#rº‡s  zFirewallZone.remove_protocolcCs(|j |¡}| |d¡}|jj ||¡Sr)rrFr3rdÚquery_protocolrr"r"r#rs  zFirewallZone.query_protocolcCs&|j |¡}| |d¡}|jj |¡Sr)rrFr3rdr r r"r"r#r ’s  zFirewallZone.list_protocolscCs.|j |¡}| d|¡}|jj |||¡|S©NrS)rrFr3rdr±)r r:r¥r¦r r"r"r#r±—s  zFirewallZone.add_masqueradecCs*|j |¡}| d|¡}|jj |¡|Sr)rrFr3rdr²r r"r"r#r²s  zFirewallZone.remove_masqueradecCs&|j |¡}| d|¡}|jj |¡Sr)rrFr3rdrr r"r"r#r£s  zFirewallZone.query_masqueradec Cs6|j |¡}| |d¡}|jj |||||||¡|Sr)rrFr3rdr³) r r:rrÚtoportÚtoaddrr¥r¦r r"r"r#r³¨s   ÿzFirewallZone.add_forward_portcCs2|j |¡}| |d¡}|jj |||||¡|Sr)rrFr3rdr´©r r:rrrr r r"r"r#r´°s  z FirewallZone.remove_forward_portcCs.|j |¡}| |d¡}|jj |||||¡Sr)rrFr3rdÚquery_forward_portr!r"r"r#r"·s   ÿzFirewallZone.query_forward_portcCs&|j |¡}| |d¡}|jj |¡Sr)rrFr3rdržr r"r"r#rž¾s  zFirewallZone.list_forward_portscCs0|j |¡}| |d¡}|jj ||||¡|Sr)rrFr3rdr¯)r r:Úicmpr¥r¦r r"r"r#r¯Ãs  zFirewallZone.add_icmp_blockcCs,|j |¡}| |d¡}|jj ||¡|Sr)rrFr3rdr°)r r:r#r r"r"r#r°Ês  zFirewallZone.remove_icmp_blockcCs(|j |¡}| |d¡}|jj ||¡Sr)rrFr3rdÚquery_icmp_block)r r:r#Ú p_name_hostr"r"r#r$Ñs  zFirewallZone.query_icmp_blockcCs.|j |¡}| |d¡}tt|jj |¡ƒƒSr)rrFr3r4rrdrœ©r r:r%r"r"r#rœÖs  zFirewallZone.list_icmp_blockscCs,|j |¡}| |d¡}|jj ||¡|Sr)rrFr3rdr½)r r:r¦r r"r"r#r½Ûs  z%FirewallZone.add_icmp_block_inversioncCs.|j |¡}| |d¡}|jj |||¡dSr)rrFr3rdrˆ)r r‰r:r€r r"r"r#rˆâs  z"FirewallZone._icmp_block_inversioncCs*|j |¡}| |d¡}|jj |¡|Sr)rrFr3rdr¾r r"r"r#r¾çs  z(FirewallZone.remove_icmp_block_inversioncCs&|j |¡}| |d¡}|jj |¡Sr)rrFr3rdr¢r&r"r"r#r¢îs  z'FirewallZone.query_icmp_block_inversionc CsÀ| |d¡}|j|jD]<}|j ¡D],}|js2q&|j|||d|d}| ||¡q&q|j|jD]X}|  |¡} | r‚|j  | ¡gn|j ¡D],}|js˜qŒ|j|||d|d}| ||¡qŒqbdS)NrSrërìr) r3rr=rrôrõrør÷rBr†r) r r‰r:r€r r>rþr^rCr~r"r"r#Ú_forwardós   zFirewallZone._forwardc CsÆ|j |¡}|j |¡|j ¡|j|}|jrBttjd|ƒ‚|durT|  ¡}n|}|j rl|  d||¡|dkr”t   ||j|¡}| |d|f¡| |||¡| |j|¡|durÂ| d¡|S)Nzforward already enabled in '%s'Trr‚)rrFZ check_timeoutrÈrr‚rrZALREADY_ENABLEDr/rgr'rZtimeout_add_secondsrÀrÄÚ_FirewallZone__register_forwardrËÚ!_FirewallZone__unregister_forwardr}) r r:r¥r¦rkrrÏr€rÃr"r"r#r¿s*    ÿ  zFirewallZone.add_forwardcCs d|_dSrí©r‚)r rÏr¥r¦r"r"r#Z__register_forward$szFirewallZone.__register_forwardcCs’|j |¡}|j ¡|j|}|js6ttjd|ƒ‚|durH| ¡}n|}|j r`|  d||¡|  d|f¡|  |j |¡|durŽ| d¡|S)Nzforward not enabled in '%s'Fr‚T)rrFrÈrr‚rrZ NOT_ENABLEDr/rgr'r)rÚr)r})r r:rkrrÏr€r"r"r#rÀ's"   ÿ  zFirewallZone.remove_forwardcCs d|_dS)NFr*)r rÏr"r"r#Z__unregister_forwardAsz!FirewallZone.__unregister_forwardcCs | |¡jSr)rHr‚rÝr"r"r#r£DszFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)rN)rN)rN)rN)rN)rN)NNrN)NN)NN)rN)N)rNN)N)bÚ__name__Ú __module__Ú __qualname__rWr$r'r,r/r3r6r;r@rErHrcrfrirorpryrzrrŒrnrhr—r“rÂrÄr)rÅr<rµrÌrÖrØr¶rÍrÜr7r†rAr·rærèr¸rçrér8r…rârÿrráràr‡r«r¬r ršr­r®rr›r»r¼rr¡r_r§r©rrŸr¹rºrr r±r²rr³r´r"ržr¯r°r$rœr½rˆr¾r¢r'r¿r(rÀr)r£r"r"r"r#r/sÜ* ÿ   Dÿ +  ÿ   ÿ ( ÿ  ,(      ÿ ÿ ÿ   ÿ  r)%Z gi.repositoryrr[Zfirewall.core.baserrrZfirewall.core.fw_transactionrZfirewall.core.io.policyrZfirewall.core.loggerrZfirewall.core.richr r r r r rrrrrrZfirewall.core.fw_nmrZfirewall.functionsrrrZfirewallrZfirewall.errorsrÚobjectrr"r"r"r#Ús    4