3
��gy� � @ s� d dl Z d dlZd dlmZmZmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZ d d l m Z d d
l m Z G d d � d e �Z!dS )
� N)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) � Rich_Service� Rich_Port�
Rich_Protocol�Rich_SourcePort�Rich_ForwardPort�Rich_IcmpBlock�
Rich_IcmpType�Rich_Masquerade� Rich_Mark)� checkIPnMask�
checkIP6nMask� check_mac)�errors)�
FirewallError)�LastUpdatedOrderedDictc @ sN e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd d � Zd�d d �Zd!d"� Zd#d$� Zd%d&� Zd�d'd(�Zd)d*� Zd+d,� Zd-d.� Zd�d/d0�Zd�d1d2�Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!d�d@dA�Z"dBdC� Z#d�dDdE�Z$d�dFdG�Z%d�dHdI�Z&dJdK� Z'dLdM� Z(dNdO� Z)d�dQdR�Z*d�dSdT�Z+d�dUdV�Z,dWdX� Z-d�dYdZ�Z.d�d[d\�Z/d]d^� Z0d_d`� Z1dadb� Z2d�dcdd�Z3dedf� Z4dgdh� Z5didj� Z6dkdl� Z7dmdn� Z8dodp� Z9d�dqdr�Z:dsdt� Z;dudv� Z<dwdx� Z=d�dydz�Z>d{d|� Z?d}d~� Z@dd�� ZAd�d�d��ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�d��ZOd�d�� ZPd�d�� ZQd�d�d��ZRd�d�d��ZSd�d�d��ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�� ZXd�d�� ZYd�d�d��ZZd�d�� Z[d�d�� Z\d�d�� Z]d�d�� Z^d�d�� Z_d�d�d��Z`d�d�� Zad�d�dZbd�dĄ Zcd�dƄ Zdd S )�� FirewallZoner c C s || _ i | _i | _d S )N)�_fw�_zones�_zone_policies)�self�fw� r � /usr/lib/python3.6/fw_zone.py�__init__& s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__+ s zFirewallZone.__repr__c C s | j j� | jj� d S )N)r �clearr )r r r r �cleanup. s
zFirewallZone.cleanupc C s
t | j�S )N)r r )r r r r �new_transaction2 s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r% r& r r r �policy_name_from_zones5 s z#FirewallZone.policy_name_from_zonesc C s t | jj� �S )N)�sortedr �keys)r r r r � get_zones: s zFirewallZone.get_zonesc C s8 g }x.| j � D ]"}| j|�s&| j|�r|j|� qW |S )N)r+ �list_interfaces� list_sources�append)r Z active_zones�zoner r r �get_active_zones= s
z FirewallZone.get_active_zonesc C s6 | j |�}x&| jD ] }|| j| jd kr|S qW d S )N�
interfaces)�_FirewallZone__interface_idr �settings)r � interface� interface_idr/ r r r �get_zone_of_interfaceD s
z"FirewallZone.get_zone_of_interfacec C s6 | j |�}x&| jD ] }|| j| jd kr|S qW d S )N�sources)�_FirewallZone__source_idr r3 )r �source� source_idr/ r r r �get_zone_of_sourceL s
z FirewallZone.get_zone_of_sourcec C s | j j|�}| j| S )N)r �
check_zoner )r r/ �zr r r �get_zoneT s zFirewallZone.get_zonec C sB t � }|j|_| j||�|_| j|_|j|_|g|_|g|_� x�d D � ]�}||jkr~|d kr~|d kr~t ||t
j t ||��� qD|d
kr�||jkr�|d
kr�t ||t
j t ||��� qD||jko�|d
ko�|dk� r�t ||t
j t ||��� qD|dkrDg |_
xB|j
D ]8}| j||�}|| j|j|�k� r�|j
jt
j |�� � q�W qDW |S )N�services�ports�
masquerade�
forward_ports� source_ports� icmp_blocks�rules� protocols�HOST�ANY)r? r@ rA rB rC rD rE rF )r? r@ rC rD rF )rA )rD rB )rE )r �nameZderived_from_zoner( �ZONE_POLICY_PRIORITYZpriority�targetZ
ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrE �_rich_rule_to_policiesr. )r �z_objr% r& �p_objZsetting�ruleZcurrent_policyr r r �policy_obj_from_zone_objX s6
z%FirewallZone.policy_obj_from_zone_objc C s� dd� d D �|_ || j|j< g | j|j< xX|jdfd|jf|jdfgD ]8\}}| j|||�}| jjj|� | j|j j|j� qFW | j |j� d S )
Nc S s i | ] }t � |�qS r )r )�.0�xr r r �
<dictcomp> s z)FirewallZone.add_zone.<locals>.<dictcomp>r1 r7 �icmp_block_inversion�forwardrG rH )r1 r7 rX rY )
r3 r rI r rT r �policyZ
add_policyr. �copy_permanent_to_runtime)r �objr% r& rR r r r �add_zone~ s
zFirewallZone.add_zonec C sn | j | }x |jD ]}| j||dd� qW x |jD ]}| j||dd� q2W |jrZ| j|� |jrj| j|� d S )NF)� allow_apply) r r1 �
add_interfacer7 �
add_sourcerY � add_forwardrX �add_icmp_block_inversion)r r/ r\ �argr r r r[ � s
z&FirewallZone.copy_permanent_to_runtimec C s8 | j | }|jr| j|� |jj� | j |= | j|= d S )N)r �applied�unapply_zone_settingsr3 r" r )r r/ r\ r r r � remove_zone� s
zFirewallZone.remove_zoneNc C sV xP| j � D ]D}| j| }t|j�dks4t|j�dkr
tjd|� | j||d� q
W d S )Nr zApplying zone '%s')�use_transaction)r+ r �lenr1 r7 r �debug1�apply_zone_settings)r rg r/ rQ r r r � apply_zones� s
zFirewallZone.apply_zonesc C s | j | }||_d S )N)r rd )r r/ rd r\ r r r �set_zone_applied� s
z FirewallZone.set_zone_appliedc C s� d|kr d S |j d�}t|�dk r&d S d }x tD ]}|d t| kr0|}q0W |d k r�|d | j� krhd S t|�dks�t|�dkr�|d d kr�|d |fS d S ) N�_� r � � �prer �deny�allow�post)rq r rr rs rt )�splitrh r r+ )r �chainZsplits�_chainrV r r r �zone_from_chain� s
z FirewallZone.zone_from_chainc C st | j |�}|d krd S |\}}|d kr0|}d}n4|d
krB|}d}n"|d krTd}|}nttjd| ��| j||�|fS ) N�
PREROUTING�
FORWARD_INrH �INPUTrG � POSTROUTING� FORWARD_OUTz&chain '%s' can't be mapped to a policy)ry rz )r{ )r| r} )rx r r Z
INVALID_CHAINr( )r rv rV r/ rw r% r& r r r �policy_from_chain� s
z FirewallZone.policy_from_chainc C sj |dkrf| j |�}|d k rf| j |�\}}|d kr:| j� }n|}| jjj|d|||� |d krf|jd� d S )N�ipv4�ipv6T)r r� )r~ r$ r rZ Zgen_chain_rules�execute) r �ipv�tablerv rg rV rZ rw � transactionr r r �create_zone_base_by_chain� s
z&FirewallZone.create_zone_base_by_chainc C s t j � ||d�}|S )N)Zdate�sender�timeout)�time)r r� r� �retr r r Z__gen_settings� s zFirewallZone.__gen_settingsc C s | j |�jS )N)r> r3 )r r/ r r r � get_settings� s zFirewallZone.get_settingsc C s� | j |�}x�|D ]z}xt|| D ]h}|dkr<| j||||� q |dkr`| j|||d |d |� q |dkrlq q |dkrvq tjd|||� q W qW |r�| j|||� d S )Nr1 r7 r ro rX rY z3Zone '%s': Unknown setting '%s:%s', unable to apply)r� �
_interface�_sourcer Zwarning�_icmp_block_inversion)r �enabler/ r� r3 �key�argsr r r �_zone_settings s
zFirewallZone._zone_settingsc C s� | j j|�}| j| }|jr d S d|_|d kr8| j� }n|}x2| j| D ]$}tjd||� | j jj ||d� qHW | j
d||� |d kr�|j d� d S )NTz+Applying policy (%s) derived from zone '%s')rg ) r r< r rd r$ r r ri rZ �apply_policy_settingsr� r� )r r/ rg �_zoner\ r� rZ r r r rj s
z FirewallZone.apply_zone_settingsc C s� | j j|�}| j| }|js d S |d kr2| j� }n|}x$| j| D ]}| j jj||d� qBW | jd||� |d kr||j d� d S )N)rg FT)
r r< r rd r$ r rZ �unapply_policy_settingsr� r� )r r/ rg r� r\ r� rZ r r r re , s
z"FirewallZone.unapply_zone_settingsc C s~ | j |�}| j|�}g }x\td�D ]P}|j| d |krZ|jtjt||j| d ��� q"|j||j| d � q"W t|�S )zH
:return: exported config updated with runtime settings
� r ) r> � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr. rM rN rO �tuple)r r/ r\ Z conf_dictZ conf_list�ir r r �get_config_with_settings? s
" z%FirewallZone.get_config_with_settingsc
C s� | j |�j� }|d tkr"d|d< | j|�| j|�| j|�| j|�| j|�| j|�| j |�| j
|�| j |�| j |�| j
|�| j|�d� }| jj||�S )zH
:return: exported config updated with runtime settings
rK �default) r? r@ rD rA rB r1 r7 � rules_strrF rC rX rY )r> Zexport_config_dictr �
list_services�
list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr, r- �
list_rules�list_protocols�list_source_ports�query_icmp_block_inversion�
query_forwardr Z'combine_runtime_with_permanent_settings)r r/ Z permanentZruntimer r r r� O s z*FirewallZone.get_config_with_settings_dictc
s ddl m� d� �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j
�j f�j �j
f�j�jf||f�j�jf�j�jf�j�jf�j�jfd� }�j|�}�jj||�\}} xv| D ]n}
t| |
t ��r$xX| |
D ]:} t| t ��r ||
d |f| �� q�||
d || � q�W q�||
d |� q�W x�|D ]�}
t||
t ��r�x�||
D ]l} |
dk�r�||
d || |d � nDt| t ��r�||
d |f| �d|d �� n||
d || d|d � �q\W n6|
dk�r�||
d ||d � n||
d |d|d � �q>W d S )Nr )� Rich_Rulec s �j | � |d�d|d� d S )N)�rule_strr )r� r� )�add_rule)r/ r� r� r� )r� r r r �add_rule_wrapperh s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �j | � |d�� d S )N)r� )� remove_rule)r/ r� )r� r r r �remove_rule_wrapperj s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapper) r? r@ rD rA rB r1 r7 r� rF rC rX rY ro r1 r7 )r� )r� r� rX )r N)r1 r7 )rX ) �firewall.core.richr� � add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_portr_ �remove_interfacer` �
remove_source� add_protocol�remove_protocol�add_source_port�remove_source_portrb �remove_icmp_block_inversionra �remove_forwardr� r Z get_added_and_removed_settings�
isinstance�listr� ) r r/ r3 r� r� r� Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr� r� r )r� r r � set_config_with_settings_dicte sF
z*FirewallZone.set_config_with_settings_dictc C s | j j|� d S )N)r �check_interface)r r4 r r r r� � s z FirewallZone.check_interfacec C s\ | j j|�}| j| }| j|�}||jd krX|jd | }d|krX|d d k rX|d S d S )Nr1 r� )r r< r r2 r3 )r r/ r4 r� �_objr5 r3 r r r �interface_get_sender� s
z!FirewallZone.interface_get_senderc C s | j |� |S )N)r� )r r4 r r r Z__interface_id� s
zFirewallZone.__interface_idTc
C s | j j� | j j|�}| j| }| j|�}||jd krLttjd||f ��| j |�d k rjttj
d| ��t j d||f � |d kr�| j
� } n|} |j r�|r�| j|| d� | j| j|d� |r�| jd||| � | j||||� | j| j||� |d k�r| jd� |S )Nr1 z'%s' already bound to '%s'z '%s' already bound to a zonez&Setting zone of interface '%s' to '%s')rg FT)r � check_panicr< r r2 r3 r r �ZONE_ALREADY_SETr6 �
ZONE_CONFLICTr ri r$ rd rj �add_failrl r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacer� )
r r/ r4 r� rg r^ r� r� r5 r� r r r r_ � s8
zFirewallZone.add_interfacec C s6 | j d|�|jd |< | p"|dk|jd | d< d S )Nr r1 � � __default__)�_FirewallZone__gen_settingsr3 )r r� r5 r/ r� r r r Z__register_interface� s z!FirewallZone.__register_interfacec C sR | j j� | j|�}| j j|�}||kr,|S |d k r@| j||� | j|||�}|S )N)r r� r6 r< r� r_ )r r/ r4 r� � _old_zone� _new_zoner� r r r �change_zone_of_interface� s
z%FirewallZone.change_zone_of_interfacec C sz | j j� |d kr | j� }n|}| j||� | jd|d|dd� |d k rd|dkrd| jd|d|dd� |d krv|jd� d S )NT�+)r. r� F)r r� r$ rj r� r� )r Zold_zoneZnew_zonerg r� r r r �change_default_zone� s
z FirewallZone.change_default_zonec C s� | j j� | j|�}|d kr,ttjd| ��|dkr8|n
| j j|�}||krbttjd|||f ��|d krt| j� }n|}| j | }| j
|�}|j | j ||� | j
d|||� |d kr�|jd� |S )Nz'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r6 r r ZUNKNOWN_INTERFACEr< r� r$ r r2 �add_postr� r� r� ) r r/ r4 rg Zzoir� r� r� r5 r r r r� � s(
z FirewallZone.remove_interfacec C s ||j d kr|j d |= d S )Nr1 )r3 )r r� r5 r r r Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | j |�| j|�d kS )Nr1 )r2 r� )r r/ r4 r r r �query_interface s z FirewallZone.query_interfacec C s | j |�d j� S )Nr1 )r� r* )r r/ r r r r, " s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |jd�rh| j|dd � � |rV| j|dd � � | j|dd � �S ttj |��d S )Nr r� r� zipset:� )
r r r �
startswith� _check_ipset_type_for_source�_check_ipset_applied�
_ipset_familyr r Z INVALID_ADDR)r r9 rd r r r � check_source' s
zFirewallZone.check_sourcec C s | j ||d�}||fS )N)rd )r� )r r9 rd r� r r r Z __source_id6 s zFirewallZone.__source_idc
C s | j j� | j j|�}| j| }t|�r0|j� }| j||d�}||jd kr`tt j
d||f ��| j |�d k r~tt j d| ��|d kr�| j
� } n|} |j r�|r�| j|| d� | j| j|d� |r�| jd||d |d | � | j||||� | j| j||� |d k�r| jd� |S )
N)rd r7 z'%s' already bound to '%s'z '%s' already bound to a zone)rg FTr ro )r r� r< r r �upperr8 r3 r r r� r; r� r$ rd rj r� rl r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcer� )
r r/ r9 r� rg r^ r� r� r: r� r r r r` : s4
zFirewallZone.add_sourcec C s6 | j d|�|jd |< | p"|dk|jd | d< d S )Nr r7 r� r� )r� r3 )r r� r: r/ r� r r r Z__register_sourcea s z FirewallZone.__register_sourcec C sb | j j� | j|�}| j j|�}||kr,|S t|�r<|j� }|d k rP| j||� | j|||�}|S )N)r r� r; r< r r� r� r` )r r/ r9 r� r� r� r� r r r �change_zone_of_sourceg s
z"FirewallZone.change_zone_of_sourcec C s� | j j� t|�r|j� }| j|�}|d kr<ttjd| ��|dkrH|n
| j j|�}||krrttj d|||f ��|d kr�| j
� }n|}| j | }| j |�}|j
| j||� | jd||d |d |� |d kr�|jd� |S )Nz'%s' is not in any zoner� z remove_source(%s, %s): zos='%s'Fr ro T)r r� r r� r; r r ZUNKNOWN_SOURCEr< r� r$ r r8 r� r� r� r� ) r r/ r9 rg Zzosr� r� r� r: r r r r� y s,
zFirewallZone.remove_sourcec C s ||j d kr|j d |= d S )Nr7 )r3 )r r� r: r r r Z__unregister_source� s z FirewallZone.__unregister_sourcec C s( t |�r|j� }| j|�| j|�d kS )Nr7 )r r� r8 r� )r r/ r9 r r r � query_source� s zFirewallZone.query_sourcec C s dd� | j |�d j� D �S )Nc S s g | ] }|d �qS )ro r )rU �kr r r �
<listcomp>� s z-FirewallZone.list_sources.<locals>.<listcomp>r7 )r� r* )r r/ r r r r- � s zFirewallZone.list_sourcesc s� x�� j j� D ]�}|jsq xP� j| D ]B}x<� j jj|�D ]*\}} |j|||||| |�}
|j||
� q8W q$W � j|d�}� j |�d r |d
kr |j
|||d|d�}
|j||
� q W xΈ j jj � D ]�}|� j jj |�kr�|� j jj
|�kr�q�|� j jj� k�rd� j jj|�j�rd| �r<t� j|��dk�r<� j jj||d� n&� j jjd ||� |j� fd
d �|� q�|r�|j� fd d �|� q�W d S )NrH rY r� �*�filter)r4 ro )rg Fc s | � j jj� ko � j jjd| �S )NT)r rZ �)get_active_policies_not_derived_from_zone�!_ingress_egress_zones_transaction)�p)r r r �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j jj� ko � j jj| �S )N)r rZ r� r� )r� )r r r r� � s )r� r� )r �enabled_backends�policies_supportedr rZ �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr( r� �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� �
get_policyrd rh r, r� �_ingress_egress_zonesr� ) r r� r/ r4 r� r. �backendrZ r� rv rE r )r r r� � s2 $ zFirewallZone._interfacec C s$ | j |�dkrd S | jjj|dd�S )Nzhash:macF)rd )� _ipset_typer �ipsetZ
get_family)r rI r r r r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NF)rd )r r� Zget_type)r rI r r r r� � s zFirewallZone._ipset_typec C s dj |g| jjj|� �S )N�,)�joinr r� Z
get_dimension)r rI �flagr r r �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j jj|�S )N)r r� Z
check_applied)r rI r r r r� � s z!FirewallZone._check_ipset_appliedc C s* | j |�}|tkr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z
INVALID_IPSET)r rI Z_typer r r r� � s
z)FirewallZone._check_ipset_type_for_sourcec
s� x�|r� j j|�gn� j j� D ]�}|js*q xN� j| D ]@}x:� j jj|�D ](\}} |j|||||| �}
|j||
� qJW q6W � j |d�}� j
|�d r |j |||d|d�}
|j||
� q W xΈ j jj � D ]�}|� j jj
|�kr�|� j jj|�kr�q�|� j jj� k�rl� j jj|�j�rl| �rDt� j|��dk�rD� j jj||d� n&� j jjd||� |j� fdd �|� q�|r�|j� fd
d �|� q�W d S ) NrH rY r� )r9 ro )rg Fc s | � j jj� ko � j jjd| �S )NT)r rZ r� r� )r� )r r r r� s z&FirewallZone._source.<locals>.<lambda>c s | � j jj� ko � j jj| �S )N)r rZ r� r� )r� )r r r r�
s )r �get_backend_by_ipvr� r� r rZ r� Z build_zone_source_address_rulesr� r( r� r� r� r� r� r� r� rd rh r- r� r� r� ) r r� r/ r� r9 r� r� rZ r� rv rE r )r r r� � s2 " $ zFirewallZone._sourcec C s0 | j j|�}| j|d�}| j jj||||� |S )NrG )r r< r( rZ r� )r r/ �servicer� r� �p_namer r r r�
s zFirewallZone.add_servicec C s, | j j|�}| j|d�}| j jj||� |S )NrG )r r< r( rZ r� )r r/ r� r� r r r r� s zFirewallZone.remove_servicec C s( | j j|�}| j|d�}| j jj||�S )NrG )r r< r( rZ �
query_service)r r/ r� r� r r r r� s zFirewallZone.query_servicec C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� s zFirewallZone.list_servicesc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrG )r r< r( rZ r� )r r/ �port�protocolr� r� r� r r r r� # s zFirewallZone.add_portc C s. | j j|�}| j|d�}| j jj|||� |S )NrG )r r< r( rZ r� )r r/ r� r� r� r r r r� ) s zFirewallZone.remove_portc C s* | j j|�}| j|d�}| j jj|||�S )NrG )r r< r( rZ �
query_port)r r/ r� r� r� r r r r / s zFirewallZone.query_portc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� 4 s zFirewallZone.list_portsc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrG )r r< r( rZ r� )r r/ � source_portr� r� r� r� r r r r� 9 s z FirewallZone.add_source_portc C s. | j j|�}| j|d�}| j jj|||� |S )NrG )r r< r( rZ r� )r r/ r r� r� r r r r� ? s z FirewallZone.remove_source_portc C s* | j j|�}| j|d�}| j jj|||�S )NrG )r r< r( rZ �query_source_port)r r/ r r� r� r r r r E s z FirewallZone.query_source_portc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� J s z FirewallZone.list_source_portsc C s� | j j|�}t|j�tkr(| j|d�gS t|j�ttt t
gkrL| j|d�gS t|j�t t gkrv| j|d�| j|d�gS t|j�t
gkr�| j|d�gS t|j�tgkr�| jd|�gS |jd kr�| j|d�gS tdt|j� ��d S )NrH rG z Rich rule type (%s) not handled.)r r< �type�actionr r( �elementr r r
r r
r r r r )r r/ rS r r r rP O s
z#FirewallZone._rich_rule_to_policiesc C s. x(| j ||�D ]}| jjj||||� qW |S )N)rP r rZ r� )r r/ rS r� r� r� r r r r� b s zFirewallZone.add_rulec C s* x$| j ||�D ]}| jjj||� qW |S )N)rP r rZ r� )r r/ rS r� r r r r� g s zFirewallZone.remove_rulec C s2 d}x(| j ||�D ]}|o(| jjj||�}qW |S )NT)rP r rZ �
query_rule)r r/ rS r� r� r r r r l s zFirewallZone.query_rulec C s^ | j j|�}t� }xB| j|d�| j|d�| jd|�gD ] }|jt| j jj|��� q6W t|�S )NrH rG )r r< �setr( �updaterZ r� r� )r r/ r� r� r r r r� r s
zFirewallZone.list_rulesc C s0 | j j|�}| j|d�}| j jj||||� |S )NrG )r r< r( rZ r� )r r/ r� r� r� r� r r r r� { s zFirewallZone.add_protocolc C s, | j j|�}| j|d�}| j jj||� |S )NrG )r r< r( rZ r� )r r/ r� r� r r r r� � s z FirewallZone.remove_protocolc C s( | j j|�}| j|d�}| j jj||�S )NrG )r r< r( rZ �query_protocol)r r/ r� r� r r r r � s zFirewallZone.query_protocolc C s& | j j|�}| j|d�}| j jj|�S )NrG )r r< r( rZ r� )r r/ r� r r r r� � s zFirewallZone.list_protocolsc C s. | j j|�}| jd|�}| j jj|||� |S )NrH )r r< r( rZ r� )r r/ r� r� r� r r r r� � s zFirewallZone.add_masqueradec C s* | j j|�}| jd|�}| j jj|� |S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.remove_masqueradec C s& | j j|�}| jd|�}| j jj|�S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.query_masqueradec C s6 | j j|�}| j|d�}| j jj|||||||� |S )NrH )r r< r( rZ r� ) r r/ r� r� �toport�toaddrr� r� r� r r r r� � s
z FirewallZone.add_forward_portc C s2 | j j|�}| j|d�}| j jj|||||� |S )NrH )r r< r( rZ r� )r r/ r� r� r
r r� r r r r� � s z FirewallZone.remove_forward_portc C s. | j j|�}| j|d�}| j jj|||||�S )NrH )r r< r( rZ �query_forward_port)r r/ r� r� r
r r� r r r r � s z FirewallZone.query_forward_portc C s& | j j|�}| j|d�}| j jj|�S )NrH )r r< r( rZ r� )r r/ r� r r r r� � s z FirewallZone.list_forward_portsc C sP | j j|�}| j|d�}| j jj||||� | j|d�}| j jj||||� |S )NrG rH )r r< r( rZ r� )r r/ �icmpr� r� r� r r r r� � s zFirewallZone.add_icmp_blockc C sH | j j|�}| j|d�}| j jj||� | j|d�}| j jj||� |S )NrG rH )r r< r( rZ r� )r r/ r
r� r r r r� � s z FirewallZone.remove_icmp_blockc C sD | j j|�}| j|d�}| j|d�}| j jj||�oB| j jj||�S )NrG rH )r r< r( rZ �query_icmp_block)r r/ r
� p_name_host�
p_name_fwdr r r r � s
z FirewallZone.query_icmp_blockc C sH | j j|�}| j|d�}| j|d�}tt| j jj|�| j jj|� ��S )NrG rH )r r< r( r) r rZ r� )r r/ r r r r r r� � s
z FirewallZone.list_icmp_blocksc C sH | j j|�}| j|d�}| j jj||� | j|d�}| j jj||� |S )NrG rH )r r< r( rZ rb )r r/ r� r� r r r rb � s z%FirewallZone.add_icmp_block_inversionc C sL | j j|�}| j|d�}| j jj|||� | j|d�}| j jj|||� d S )NrG rH )r r< r( rZ r� )r r� r/ r� r� r r r r� � s
z"FirewallZone._icmp_block_inversionc C sD | j j|�}| j|d�}| j jj|� | j|d�}| j jj|� |S )NrG rH )r r< r( rZ r� )r r/ r� r r r r� � s z(FirewallZone.remove_icmp_block_inversionc C s@ | j j|�}| j|d�}| j|d�}| j jj|�o>| j jj|�S )NrG rH )r r< r( rZ r� )r r/ r r r r r r� � s
z'FirewallZone.query_icmp_block_inversionc
C s� | j |d�}xT| j| jd D ]@}x:| jj� D ],}|js:q.|j|||d|d�}|j||� q.W q W xj| j| jd D ]V\}} xL|r�| jj|�gn| jj� D ],}|js�q�|j|||d| d�}|j||� q�W qtW d S )NrH r1 r� )r4 r7 )r9 ) r( r r3 r r� r� r� r� r� )
r r� r/ r� r� r4 r� rE r� r9 r r r �_forward� s "zFirewallZone._forwardc C s dS )NTr )r r r r Z __forward_id s zFirewallZone.__forward_idc C s� | j j|�}| j j|� | j j� | j| }| j� }||jd krRttj d| ��|d krd| j
� }n|}|j r|| j d||� | j
||||� |j| j||� |d kr�|jd� |S )NrY z forward already enabled in '%s'T)r r< Z
check_timeoutr� r �_FirewallZone__forward_idr3 r r ZALREADY_ENABLEDr$ rd r � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardr� ) r r/ r� r� rg r� r� �
forward_idr� r r r ra s$
zFirewallZone.add_forwardc C s | j ||�|jd |< d S )NrY )r� r3 )r r� r r� r� r r r Z__register_forward. s z FirewallZone.__register_forwardc C s� | j j|�}| j j� | j| }| j� }||jd krFttjd| ��|d krX| j � }n|}|j
rp| j d||� |j | j
||� |d kr�|jd� |S )NrY zforward not enabled in '%s'FT)r r< r� r r r3 r r Z NOT_ENABLEDr$ rd r r� r r� )r r/ rg r� r� r r� r r r r� 2 s
zFirewallZone.remove_forwardc C s ||j d kr|j d |= d S )NrY )r3 )r r� r r r r Z__unregister_forwardK s z!FirewallZone.__unregister_forwardc C s | j � | j|�d kS )NrY )r r� )r r/ r r r r� O s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)e�__name__�
__module__� __qualname__rJ r r! r# r$ r( r+ r0 r6 r; r> rT r] r[ rf rk rl rx r~ r� r� r� r� rj re r� r� r� r� r� r2 r_ r� r� r� r� r� r� r, r� r8 r` r� r� r� r� r� r- r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r� r r� rP r� r� r r� r� r� r r� r� r� r� r� r� r r� r� r� r r� rb r� r� r� r r ra r r� r r� r r r r r # s� &
8
(
&
,(
r )"r� rM Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr r� r r r
r r r
r r r Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr �objectr r r r r �<module> s ,