관리-도구
편집 파일: fw_policy.cpython-36.pyc
3 @)�f=V � @ s� d dl Z d dlZd dlmZ d dlmZmZmZmZm Z m Z m Z m Z m Z mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" d d l#m$Z$ G d d � d e%�Z&dS ) � N)�log) �portStr� checkIPnMask� checkIP6nMask� checkProtocol�enable_ip_forwarding�check_single_address�portInPortRange�get_nf_conntrack_short_name�coalescePortRange�breakPortRange) � Rich_Rule� Rich_Accept� Rich_Service� Rich_Port� Rich_Protocol�Rich_Masquerade�Rich_ForwardPort�Rich_SourcePort�Rich_IcmpBlock� Rich_IcmpType� Rich_Mark)�FirewallTransaction)�errors)� FirewallError)�LastUpdatedOrderedDict)�SOURCE_IPSET_TYPESc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z �d dd�Zdd� Zd d � Zd d � Z�d d d!�Z�d d"d#�Z�dd$d%�Zd&d'� Zd(d)� Zd*d+� Zd,d-� Z�dd0d1�Zd2d3� Z�dd4d5�Zd6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z �dd@dA�Z!dBdC� Z"�ddDdE�Z#dFdG� Z$dHdI� Z%dJdK� Z&dLdM� Z'dNdO� Z(dPdQ� Z)dRdS� Z*�ddTdU�Z+dVdW� Z,�ddXdY�Z-dZd[� Z.d\d]� Z/d^d_� Z0d`da� Z1dbdc� Z2�dddde�Z3dfdg� Z4�ddhdi�Z5djdk� Z6dldm� Z7dndo� Z8dpdq� Z9drds� Z:dtdu� Z;dvdw� Z<�ddxdy�Z=dzd{� Z>�dd|d}�Z?d~d� Z@d�d�� ZAd�d�� ZBd�d�� ZCd�d�� ZD�dd�d��ZEd�d�� ZF�dd�d��ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�� ZK�dd�d��ZLd�d�� ZM�d d�d��ZNd�d�� ZOd�d�� ZPd�d�� ZQd�d�� ZR�d d�d��ZSd�d�� ZT�d d�d��ZUd�d�� ZVd�d�� ZW�d d�d��ZX�d d�d��ZY�d!d�d��ZZd�d�� Z[�d"d�d��Z\d�d�� Z]�d#d�d��Z^d�d�� Z_d�d�� Z`d�d�� Za�d$d�dÄZbd�dń Zc�d%d�dDŽZdd�dɄ Zed�d˄ Zfd�d̈́ Zgd�dτ Zh�d&d�dфZid�dӄ Zjd�dՄ Zk�d'd�dׄZld�dل Zmd�dۄ Znd�d݄ Zod�d߄ Zpd�d� Zqd�d� Zrd�d� Zsd�d� Ztd�d� Zu�d(d�d�Zv�d)d�d�Zwd�d� Zxd�d� Zyd�d� Zzd�d�� Z{�d*d�d��Z|d�d�� Z}d�d�� Z~d�d�� Zd�d�� Z��d �d� Z��d�d� Z��d�d� Z��d�d� Z��d+�d �d �Z�dS (, �FirewallPolicyc C s || _ i | _i | _d S )N)�_fw�_chains� _policies)�self�fw� r# � /usr/lib/python3.6/fw_policy.py�__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz %s(%r, %r))� __class__r r )r! r# r# r$ �__repr__ s zFirewallPolicy.__repr__c C s | j j� | jj� d S )N)r �clearr )r! r# r# r$ �cleanup s zFirewallPolicy.cleanupc C s t | j�S )N)r r )r! r# r# r$ �new_transaction$ s z FirewallPolicy.new_transactionc C s t | jj� �S )N)�sortedr �keys)r! r# r# r$ � get_policies) s zFirewallPolicy.get_policiesc C s8 g }x*| j � D ] }| j|�}|js|j|� qW t|�S )N)r- � get_policy�derived_from_zone�appendr+ )r! Zpolicies�p�p_objr# r# r$ �"get_policies_not_derived_from_zone, s z1FirewallPolicy.get_policies_not_derived_from_zonec C s~ g }xt| j � D ]h}| j|�}t|d �t| jjj� �tddg�B @ rt|d �t| jjj� �tddg�B @ r|j|� qW |S )N� ingress_zones�HOST�ANY� egress_zones)r3 � get_settings�setr �zoneZget_active_zonesr0 )r! Zactive_policies�policy�settingsr# r# r$ �)get_active_policies_not_derived_from_zone4 s ((z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j j|�}| j| S )N)r � check_policyr )r! r; r1 r# r# r$ r. > s zFirewallPolicy.get_policyc C s, dd� dD �|_ || j|j< | j|j� d S )Nc S s i | ] }t � |�qS r# )r )�.0�xr# r# r$ � <dictcomp>C s z-FirewallPolicy.add_policy.<locals>.<dictcomp>�services�ports� masquerade� forward_ports� source_ports� icmp_blocks�rules� protocols�icmp_block_inversionr4 r7 ) rB rC rD rE rF rG rH rI rJ r4 r7 )r< r �name�copy_permanent_to_runtime)r! �objr# r# r$ � add_policyB s zFirewallPolicy.add_policyc C s0 | j | }|jr| j|� |jj� | j |= d S )N)r �applied�unapply_policy_settingsr< r( )r! r; rM r# r# r$ � remove_policyN s z FirewallPolicy.remove_policyc C s� | j | }|jrd S x |jD ]}| j||dd� q W x |jD ]}| j||dd� q<W x|jD ]}| j||� q\W x |jD ]}| j |f|�� qxW x|j D ]}| j ||� q�W xf|j D ]\}y| j |f|�� W q� tk �r } z$|jtjgkr�tj|� n|�W Y d d }~X q�X q�W x |jD ]}| j||� �q W xj|jD ]`}y| j|f|�� W nD tk �r� } z&|jtjgk�r�tj|� n|�W Y d d }~X nX �q:W x |jD ]}| j||� �q�W |j�r�| j|� d S )NF)� allow_apply) r rO r4 �add_ingress_zoner7 �add_egress_zonerG �add_icmp_blockrE �add_forward_portrB � add_servicerC �add_portr �coder �ALREADY_ENABLEDr �warningrI � add_protocolrF �add_source_portrH �add_rulerD �add_masquerade)r! r; rM �args�errorr# r# r$ rL U sB z(FirewallPolicy.copy_permanent_to_runtimeNc C sN xH| j � D ]<}| j| }|jr q || j� kr tjd|� | j||d� q W d S )NzApplying policy '%s')�use_transaction)r- r r/ r= r Zdebug1�apply_policy_settings)r! rb r; r2 r# r# r$ �apply_policies| s z FirewallPolicy.apply_policiesc C s | j | }||_d S )N)r rO )r! r; rO rM r# r# r$ �set_policy_applied� s z!FirewallPolicy.set_policy_appliedc C s t j � ||d�}|S )N)Zdate�sender�timeout)�time)r! rg rf �retr# r# r$ Z__gen_settings� s z FirewallPolicy.__gen_settingsc C s | j |�jS )N)r. r< )r! r; r# r# r$ r8 � s zFirewallPolicy.get_settingsc C sj | j j|�}| j| }|r |js.| r2|j r2d S |r<d|_|d krN| j� }n|}|r�x8|jsh| j|�n| j|�D ]\}}| j|d|||� qrW | j |�} |js�| j |||� �xV| D �]L} �xD| | D �]6} | dkr�| j ||| |� q�| dkr�q�q�| dk�r| j |||f| �� q�| dk�r0| j ||| |� q�| dk�rV| j||| d | d |� q�| d k�rr| j||| |� q�| d k�r�| j||| d | d |� q�| d k�r�| j|||� q�| d k�r�| j||t| d �|� q�| dk�r�q�q�| dk�r�q�q�tjd|| | � q�W q�W |�sRx<|j�s"| j|�n| j|�D ] \}}| j|d|||� �q,W d|_|d k�rf|j|� d S )NTrG rJ rE rB rC r � rI rF rD rH )�rule_strr4 r7 z5Policy '%s': Unknown setting '%s:%s', unable to applyF)r r> r rO r* r/ �%_get_table_chains_for_policy_dispatch�#_get_table_chains_for_zone_dispatch�gen_chain_rulesr8 �_ingress_egress_zones� _icmp_block� _forward_port�_service�_port� _protocol� _source_port� _masquerade�_FirewallPolicy__ruler r r[ �execute) r! �enabler; rb �_policyrM � transaction�table�chainr< �keyr` r# r# r$ �_policy_settings� sj z FirewallPolicy._policy_settingsc C s | j d||d� d S )NT)rb )r )r! r; rb r# r# r$ rc � s z$FirewallPolicy.apply_policy_settingsc C s | j d||d� d S )NF)rb )r )r! r; rb r# r# r$ rP � s z&FirewallPolicy.unapply_policy_settingsc C sr | j |�j� }| j|�| j|�| j|�| j|�| j|�| j|�| j|�| j |�| j |�| j |�d� }| j j ||�S )zH :return: exported config updated with runtime settings ) rB rC rG rD rE � rich_rulesrI rF r4 r7 )r. Zexport_config_dict� list_services� list_ports�list_icmp_blocks�query_masquerade�list_forward_ports� list_rules�list_protocols�list_source_ports�list_ingress_zones�list_egress_zonesr Z'combine_runtime_with_permanent_settings)r! r; Z permanentZruntimer# r# r$ � get_config_with_settings_dict� s z,FirewallPolicy.get_config_with_settings_dictc s� ddl m� d � �fdd� }� �fdd�}�j�jf�j�jf�j�jf�j�j f�j �j f||f�j �j f�j�jf�j�jf�j�jfd� }�j|�}�jj||�\}} xt| D ]l} t| | t��rxV| | D ]8} t| t�r�|| d |f| �� q�|| d || � q�W q�|| d |� q�W x�|D ]�} t|| t��r�xn|| D ]J} t| t��rv|| d |f| �d|d �� n|| d || d|d � �qFW n|| d |d|d � �q(W d S ) Nr )r c s �j | � |d�d|d� d S )N)rk r )rg rf )r^ )r; rk rg rf )r r! r# r$ �add_rule_wrapper� s zFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapperc s �j | � |d�� d S )N)rk )� remove_rule)r; rk )r r! r# r$ �remove_rule_wrapper� s zIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper) rB rC rG rD rE r� rI rF r4 r7 rj )rg rf )r N)�firewall.core.richr rW �remove_servicerX � remove_portrU �remove_icmp_blockr_ �remove_masqueraderV �remove_forward_portr\ �remove_protocolr] �remove_source_portrS �remove_ingress_zonerT �remove_egress_zoner� r Z get_added_and_removed_settings� isinstance�list�tuple) r! r; r< rf r� r� Z setting_to_fnZ old_settingsZ add_settingsZremove_settingsr~ r` r# )r r! r$ � set_config_with_settings_dict� s: z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj��|dkr"| jj|� d S )Nr5 r6 )r5 r6 )r r � INVALID_ZONEr � check_zone)r! r: r# r# r$ �check_ingress_zone s z!FirewallPolicy.check_ingress_zonec C s | j |� |S )N)r� )r! r: r# r# r$ Z__ingress_zone_id" s z FirewallPolicy.__ingress_zone_idr Tc C s� | j j|�}| j j|� | j j� | j| }| j|�} | |jd krXttj d||f ��d|jd ks�d|jd ks�|d kr�|jd r�ttj d��|dkr�d|jd kr�ttj d��|d kr�| j � } n|} |�rJ|j r�| j d|| � | j|| ||� | j| j|| � |j �s:|| j� k�rH| j|| d � | j| j|d� n| j d || � n | j|| ||� | j| j|| � |d k�r~| jd � d S ) Nr4 z'%s' already in '%s'r6 r5 zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTr7 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> � check_timeout� check_panicr � _FirewallPolicy__ingress_zone_idr< r r rZ r� r* rO ro �&_FirewallPolicy__register_ingress_zone�add_fail�(_FirewallPolicy__unregister_ingress_zoner= rc re rx ) r! r; r: rg rf rb rR rz �_obj�zone_idr{ r# r# r$ rS & s< z FirewallPolicy.add_ingress_zonec C s | j ||�|jd |< d S )Nr4 )� _FirewallPolicy__gen_settingsr< )r! r� r� rg rf r# r# r$ Z__register_ingress_zoneS s z&FirewallPolicy.__register_ingress_zonec C s� | j j|�}| j j� | j| }| j|�}||jd krLttjd||f ��|d kr^| j � }n|}|j r�t |jd �dkr�| j ||� n| j d||� | j||� |j| j||d d � || j� kr�| j d||� n|j| j||� |d kr�|jd� |S )Nr4 z'%s' not in '%s'rj FT)r r> r� r r� r< r r � NOT_ENABLEDr* rO �lenrP ro r� r� r� r= �add_postrx )r! r; r: rb rz r� r� r{ r# r# r$ r� V s, z"FirewallPolicy.remove_ingress_zonec C s ||j d kr|j d |= d S )Nr4 )r< )r! r� r� r# r# r$ Z__unregister_ingress_zoney s z(FirewallPolicy.__unregister_ingress_zonec C s | j |�| j|�d kS )Nr4 )r� r8 )r! r; r: r# r# r$ �query_ingress_zone} s z!FirewallPolicy.query_ingress_zonec C s t | j|�d j� �S )Nr4 )r� r8 r, )r! r; r# r# r$ r� � s z!FirewallPolicy.list_ingress_zonesc C s& |st tj��|dkr"| jj|� d S )Nr5 r6 )r5 r6 )r r r� r r� )r! r: r# r# r$ �check_egress_zone� s z FirewallPolicy.check_egress_zonec C s | j |� |S )N)r� )r! r: r# r# r$ Z__egress_zone_id� s z FirewallPolicy.__egress_zone_idc C s� | j j|�}| j j|� | j j� | j| }| j|�} | |jd krXttj d||f ��d|jd ks�d|jd ks�|d kr�|jd r�ttj d��|dkr�d|jd kr�ttj d��|d kr�| j � } n|} |�rJ|j r�| j d|| � | j|| ||� | j| j|| � |j �s:|| j� k�rH| j|| d � | j| j|d� n| j d || � n | j|| ||� | j| j|| � |d k�r~| jd � d S ) Nr7 z'%s' already in '%s'r6 r5 zH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTr4 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> r� r� r � _FirewallPolicy__egress_zone_idr< r r rZ r� r* rO ro �%_FirewallPolicy__register_egress_zoner� �'_FirewallPolicy__unregister_egress_zoner= rc re rx ) r! r; r: rg rf rb rR rz r� r� r{ r# r# r$ rT � s< z FirewallPolicy.add_egress_zonec C s | j ||�|jd |< d S )Nr7 )r� r< )r! r� r� rg rf r# r# r$ Z__register_egress_zone� s z%FirewallPolicy.__register_egress_zonec C s� | j j|�}| j j� | j| }| j|�}||jd krLttjd||f ��|d kr^| j � }n|}|j r�t |jd �dkr�| j ||� n| j d||� | j||� |j| j||d d � || j� kr�| j d||� n|j| j||� |d kr�|jd� |S )Nr7 z'%s' not in '%s'rj FT)r r> r� r r� r< r r r� r* rO r� rP ro r� r� r� r= r� rx )r! r; r: rb rz r� r� r{ r# r# r$ r� � s, z!FirewallPolicy.remove_egress_zonec C s ||j d kr|j d |= d S )Nr7 )r< )r! r� r� r# r# r$ Z__unregister_egress_zone� s z'FirewallPolicy.__unregister_egress_zonec C s | j |�| j|�d kS )Nr7 )r� r8 )r! r; r: r# r# r$ �query_egress_zone� s z FirewallPolicy.query_egress_zonec C s t | j|�d j� �S )Nr7 )r� r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_egress_zonesc C s |j � d S )N)Zcheck)r! �ruler# r# r$ � check_rule� s zFirewallPolicy.check_rulec C s | j |� t|�S )N)r� �str)r! r� r# r# r$ Z __rule_id� s zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j �r dS t|j �rtdS nHt|d�r@|jr@dS t|d�rt|jrt| j|j� | j|j� | j|j�S d S )N�ipv4�ipv6�mac� �ipset) Zaddrr r �hasattrr� r� � _check_ipset_type_for_source�_check_ipset_applied� _ipset_family)r! �sourcer# r# r$ �_rule_source_ipv� s z FirewallPolicy._rule_source_ipvc C s | j ||||� d S )N)� _rule_prepare)r! ry r; r� r{ r# r# r$ Z__rule s zFirewallPolicy.__rulec C sL | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j d|| f ��|j�s�|j r�t |j t �r�d|jd kr�tt jd��d|jd kr�tt jd��x6|jd D ](} | dkr�q�| j jj| �r�tt jd ��q�W |j �r�t |j t��r�d|jd k�r,|j j�r�tt jd ��nb|jd �r�|j j�sNtt jd ��x>|jd D ]0} | dk�rl�qZ| j jj| ��rZtt jd ���qZW |j�r�t |jt��r�x>|jd D ]0} | dk�rq�| j jj| ��r�tt jd ���q�W |d k�r�| j� } n|} |j�r| jd||| � | j||||� | j| j||� |d k�rH| j d� |S )NrH z'%s' already in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfaceszAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesT)r6 r5 ) r r> r� r� r �_FirewallPolicy__rule_idr< r/ r r rZ �elementr� r r� r: �list_interfacesr � to_address�INVALID_FORWARD�actionr r* rO rw � _FirewallPolicy__register_ruler� � _FirewallPolicy__unregister_rulerx ) r! r; r� rg rf rb rz r� �rule_id�_namer: r{ r# r# r$ r^ s` zFirewallPolicy.add_rulec C s | j ||�|jd |< d S )NrH )r� r< )r! r� r� rg rf r# r# r$ Z__register_ruleE s z FirewallPolicy.__register_rulec C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j � }n|}|j r�| j d|||� |j | j||� |d kr�|jd� |S )NrH z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rw r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� I s" zFirewallPolicy.remove_rulec C s ||j d kr|j d |= d S )NrH )r< )r! r� r� r# r# r$ Z__unregister_ruled s z FirewallPolicy.__unregister_rulec C s | j |�| j|�d kS )NrH )r� r8 )r! r; r� r# r# r$ � query_ruleh s zFirewallPolicy.query_rulec C s t | j|�d j� �S )NrH )r� r8 r, )r! r; r# r# r$ r� k s zFirewallPolicy.list_rulesc C s | j j|� d S )N)r � check_service)r! �servicer# r# r$ r� p s z FirewallPolicy.check_servicec C s | j |� |S )N)r� )r! r� r# r# r$ Z __service_ids s zFirewallPolicy.__service_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j d|| f ��|d krz| j � } n|} |j r�| j d||| � | j||||� | j| j||� |d kr�| jd� |S )NrB z'%s' already in '%s'T)r r> r� r� r �_FirewallPolicy__service_idr< r/ r r rZ r* rO rr �!_FirewallPolicy__register_servicer� �#_FirewallPolicy__unregister_servicerx ) r! r; r� rg rf rb rz r� � service_idr� r{ r# r# r$ rW w s& zFirewallPolicy.add_servicec C s | j ||�|jd |< d S )NrB )r� r< )r! r� r� rg rf r# r# r$ Z__register_service� s z!FirewallPolicy.__register_servicec C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j � }n|}|j r�| j d|||� |j | j||� |d kr�|jd� |S )NrB z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rr r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� � s" z FirewallPolicy.remove_servicec C s ||j d kr|j d |= d S )NrB )r< )r! r� r� r# r# r$ Z__unregister_service� s z#FirewallPolicy.__unregister_servicec C s | j |�| j|�d kS )NrB )r� r8 )r! r; r� r# r# r$ � query_service� s z FirewallPolicy.query_servicec C s | j |�d j� S )NrB )r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_servicesc C sT g }xJ|D ]B}y| j jj|�}W n tk r@ ttj|��Y nX |j|� q W |S )N)r �helper� get_helperr r �INVALID_HELPERr0 )r! �helpers�_helpersr� �_helperr# r# r$ � get_helpers_for_service_helpers� s z.FirewallPolicy.get_helpers_for_service_helpersc C s� g }x�|D ]�}y| j jj|�}W n tk r@ ttj|��Y nX t|j�dk r�t|j �}y | j jj|�}|j |� W q� tk r� |r�t j d| � w Y q�X q |j |� q W |S )Nrj z Helper '%s' is not available) r r� r� r r r� r� rC r �moduler0 r r[ )r! �modulesry r� r� r� �_module_short_namer� r# r# r$ � get_helpers_for_service_modules� s" z.FirewallPolicy.get_helpers_for_service_modulesc C s | j j|� | j j|� d S )N)r � check_port� check_tcpudp)r! �port�protocolr# r# r$ r� � s zFirewallPolicy.check_portc C s | j ||� t|d�|fS )N�-)r� r )r! r� r� r# r# r$ Z __port_id� s zFirewallPolicy.__port_idc s� | j j|�}| j j|� | j j� | j| }tt� fdd�|jd ��} x@| D ]8} t|| d �rN|j rl|j n|} t t j d|� | f ��qNW t |dd� | D ��\} } |d kr�| j� }n|}|j�r x$| D ] }| jd|t|d �� |� q�W x$| D ] }| jd |t|d �� |� q�W x:| D ]2}| j|� �} | j|| ||� |j| j|| � �qW x*| D ]"}| j|� �} |j| j|| � �qNW |d k�r�|jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ �<lambda>� s z)FirewallPolicy.add_port.<locals>.<lambda>rC r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ � <listcomp>� s z+FirewallPolicy.add_port.<locals>.<listcomp>Tr� F)r r> r� r� r r� �filterr< r r/ r r rZ r r* rO rs r �_FirewallPolicy__port_id� _FirewallPolicy__register_portr� � _FirewallPolicy__unregister_portr� rx )r! r; r� r� rg rf rb rz r� �existing_port_ids�port_idr� � added_ranges�removed_rangesr{ �ranger# )r� r$ rX � s: zFirewallPolicy.add_portc C s | j ||�|jd |< d S )NrC )r� r< )r! r� r� rg rf r# r# r$ Z__register_port s z FirewallPolicy.__register_portc s� | j j|�}| j j� | j| }tt� fdd�|jd ��}xB|D ]}t||d �rBP qBW |jrf|jn|} t t j d|� | f ��t |dd� |D ��\} } |d kr�| j � } n|} |j�rx$| D ] } | jd|t| d �� | � q�W x$| D ] } | jd |t| d �� | � q�W x:| D ]2} | j| � �}| j||dd � | j| j||� �qW x*| D ]"} | j| � �}| j| j||� �qDW |d k�r~| jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� s z,FirewallPolicy.remove_port.<locals>.<lambda>rC r z'%s:%s' not in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� # s z.FirewallPolicy.remove_port.<locals>.<listcomp>Tr� F)r r> r� r r� r� r< r r/ r r r� r r* rO rs r r� r� r� r� r� rx )r! r; r� r� rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r� s: zFirewallPolicy.remove_portc C s ||j d kr|j d |= d S )NrC )r< )r! r� r� r# r# r$ Z__unregister_port= s z FirewallPolicy.__unregister_portc C s6 x0| j |�d D ] \}}t||�r||krdS qW dS )NrC TF)r8 r )r! r; r� r� rs rt r# r# r$ � query_portA s zFirewallPolicy.query_portc C s t | j|�d j� �S )NrC )r� r8 r, )r! r; r# r# r$ r� H s zFirewallPolicy.list_portsc C s t |�sttj|��d S )N)r r r ZINVALID_PROTOCOL)r! r� r# r# r$ �check_protocolM s z FirewallPolicy.check_protocolc C s | j |� |S )N)r� )r! r� r# r# r$ Z __protocol_idQ s z FirewallPolicy.__protocol_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j d|| f ��|d krz| j � } n|} |j r�| j d||| � | j||||� | j| j||� |d kr�| jd� |S )NrI z'%s' already in '%s'T)r r> r� r� r � _FirewallPolicy__protocol_idr< r/ r r rZ r* rO rt �"_FirewallPolicy__register_protocolr� �$_FirewallPolicy__unregister_protocolrx ) r! r; r� rg rf rb rz r� � protocol_idr� r{ r# r# r$ r\ U s& zFirewallPolicy.add_protocolc C s | j ||�|jd |< d S )NrI )r� r< )r! r� r� rg rf r# r# r$ Z__register_protocolr s z"FirewallPolicy.__register_protocolc C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j � }n|}|j r�| j d|||� |j | j||� |d kr�|jd� |S )NrI z'%s' not in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rt r� r� rx ) r! r; r� rb rz r� r� r� r{ r# r# r$ r� v s$ z FirewallPolicy.remove_protocolc C s ||j d kr|j d |= d S )NrI )r< )r! r� r� r# r# r$ Z__unregister_protocol� s z$FirewallPolicy.__unregister_protocolc C s | j |�| j|�d kS )NrI )r� r8 )r! r; r� r# r# r$ �query_protocol� s z FirewallPolicy.query_protocolc C s t | j|�d j� �S )NrI )r� r8 r, )r! r; r# r# r$ r� � s z FirewallPolicy.list_protocolsc C s | j ||� t|d�|fS )Nr� )r� r )r! r� r� r# r# r$ Z__source_port_id� s z FirewallPolicy.__source_port_idc s� | j j|�}| j j|� | j j� | j| }tt� fdd�|jd ��} x@| D ]8} t|| d �rN|j rl|j n|} t t j d|� | f ��qNW t |dd� | D ��\} } |d kr�| j� }n|}|j�r x$| D ] }| jd|t|d �� |� q�W x$| D ] }| jd |t|d �� |� q�W x:| D ]2}| j|� �} | j|| ||� |j| j|| � �qW x*| D ]"}| j|� �} |j| j|| � �qNW |d k�r�|jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� � s z0FirewallPolicy.add_source_port.<locals>.<lambda>rF r z'%s:%s' already in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� � s z2FirewallPolicy.add_source_port.<locals>.<listcomp>Tr� F)r r> r� r� r r� r� r< r r/ r r rZ r r* rO ru r � _FirewallPolicy__source_port_id�%_FirewallPolicy__register_source_portr� �'_FirewallPolicy__unregister_source_portr� rx )r! r; r� r� rg rf rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r] � s: z FirewallPolicy.add_source_portc C s | j ||�|jd |< d S )NrF )r� r< )r! r� r� rg rf r# r# r$ Z__register_source_port� s z%FirewallPolicy.__register_source_portc s� | j j|�}| j j� | j| }tt� fdd�|jd ��}xB|D ]}t||d �rBP qBW |jrf|jn|} t t j d|� | f ��t |dd� |D ��\} } |d kr�| j � } n|} |j�rx$| D ] } | jd|t| d �� | � q�W x$| D ] } | jd |t| d �� | � q�W x:| D ]2} | j| � �}| j||dd � | j| j||� �qW x*| D ]"} | j| � �}| j| j||� �qDW |d k�r~| jd� |S ) Nc s | d � kS )Nrj r# )r@ )r� r# r$ r� � s z3FirewallPolicy.remove_source_port.<locals>.<lambda>rF r z'%s:%s' not in '%s'c S s g | ] \}}|�qS r# r# )r? rs rt r# r# r$ r� � s z5FirewallPolicy.remove_source_port.<locals>.<listcomp>Tr� F)r r> r� r r� r� r< r r/ r r r� r r* rO ru r r� r� r� r� r� rx )r! r; r� r� rb rz r� r� r� r� r� r� r{ r� r# )r� r$ r� � s: z!FirewallPolicy.remove_source_portc C s ||j d kr|j d |= d S )NrF )r< )r! r� r� r# r# r$ Z__unregister_source_port� s z'FirewallPolicy.__unregister_source_portc C s6 x0| j |�d D ] \}}t||�r||krdS qW dS )NrF TF)r8 r )r! r; r� r� rs rt r# r# r$ �query_source_port� s z FirewallPolicy.query_source_portc C s t | j|�d j� �S )NrF )r� r8 r, )r! r; r# r# r$ r� s z FirewallPolicy.list_source_portsc C s dS )NTr# )r! r# r# r$ Z__masquerade_id s z FirewallPolicy.__masquerade_idc C s8 | j j|�}| j j|� | j j� | j| }| j� }||jd krb|jrN|jn|}tt j d| ��|js�d|jd kr�tt j d��d|jd kr�tt j d��x6|jd D ](} | dkr�q�| j j j | �r�tt j d ��q�W |d kr�| j� } n|} |j�r | jd || � | j||||� | j| j||� |d k�r4| jd � |S ) NrD z"masquerade already enabled in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesT)r r> r� r� r � _FirewallPolicy__masquerade_idr< r/ r r rZ r� r: r� r* rO rv �$_FirewallPolicy__register_masquerader� �&_FirewallPolicy__unregister_masqueraderx ) r! r; rg rf rb rz r� � masquerade_idr� r: r{ r# r# r$ r_ s: z FirewallPolicy.add_masqueradec C s | j ||�|jd |< d S )NrD )r� r< )r! r� r� rg rf r# r# r$ Z__register_masquerade2 s z$FirewallPolicy.__register_masqueradec C s� | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j � }n|}|j r�| j d||� |j | j||� |d kr�|jd� |S )NrD z masquerade not enabled in '%s'FT)r r> r� r r� r< r/ r r r� r* rO rv r� r� rx )r! r; rb rz r� r� r� r{ r# r# r$ r� 6 s" z FirewallPolicy.remove_masqueradec C s ||j d kr|j d |= d S )NrD )r< )r! r� r� r# r# r$ Z__unregister_masqueradeP s z&FirewallPolicy.__unregister_masqueradec C s | j � | j|�d kS )NrD )r� r8 )r! r; r# r# r$ r� T s z FirewallPolicy.query_masqueradec C s^ | j j|� | j j|� |r(| j j|� |rBt||�sBttj|��| rZ| rZttjd��d S )Nz.port-forwarding is missing to-port AND to-addr)r r� r� r r r Z INVALID_ADDRr� )r! �ipvr� r� �toport�toaddrr# r# r$ �check_forward_portY s z!FirewallPolicy.check_forward_portc C sL t d|�r | jd||||� n| jd||||� t|d�|t|d�t|�fS )Nr� r� r� )r r r r� )r! r� r� r� r� r# r# r$ Z__forward_port_idf s z FirewallPolicy.__forward_port_idc C sZ | j j|�} | j j|� | j j� | j| } | j||||�} | | jd krt| jrV| jn| } tt j d||||| f ��| js�d| jd kr�|r�tt j d��nR| jd r�|s�tt j d��x6| jd D ](} | dkr�q�| j j j | �r�tt jd��q�W |d k�r | j� }n|}| j�r"| jd | |||||� | j| | ||� |j| j| | � |d k�rV|jd � | S ) NrE z '%s:%s:%s:%s' already in '%s'r5 r7 zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zoner6 zS'forward-port' cannot be used in a policy if an egress zone has assigned interfacesT)r r> r� r� r � _FirewallPolicy__forward_port_idr< r/ r r rZ r� r: r� r� r* rO rq �&_FirewallPolicy__register_forward_portr� �(_FirewallPolicy__unregister_forward_portrx )r! r; r� r� r� r� rg rf rb rz r� � forward_idr� r: r{ r# r# r$ rV n sB z FirewallPolicy.add_forward_portc C s | j ||�|jd |< d S )NrE )r� r< )r! r� r rg rf r# r# r$ Z__register_forward_port� s z&FirewallPolicy.__register_forward_portc C s� | j j|�}| j j� | j| }| j||||�} | |jd krh|jrJ|jn|} ttj d||||| f ��|d krz| j � } n|} |j r�| j d|| ||||� | j | j|| � |d kr�| jd� |S )NrE z'%s:%s:%s:%s' not in '%s'FT)r r> r� r r r< r/ r r r� r* rO rq r� r rx ) r! r; r� r� r� r� rb rz r� r r� r{ r# r# r$ r� � s& z"FirewallPolicy.remove_forward_portc C s ||j d kr|j d |= d S )NrE )r< )r! r� r r# r# r$ Z__unregister_forward_port� s z(FirewallPolicy.__unregister_forward_portc C s" | j ||||�}|| j|�d kS )NrE )r r8 )r! r; r� r� r� r� r r# r# r$ �query_forward_port� s z!FirewallPolicy.query_forward_portc C s t | j|�d j� �S )NrE )r� r8 r, )r! r; r# r# r$ r� � s z!FirewallPolicy.list_forward_portsc C s | j j|� d S )N)r Zcheck_icmptype)r! �icmpr# r# r$ �check_icmp_block� s z FirewallPolicy.check_icmp_blockc C s | j |� |S )N)r )r! r r# r# r$ Z__icmp_block_id� s z FirewallPolicy.__icmp_block_idc C s� | j j|�}| j j|� | j j� | j| }| j|�}||jd krh|jrP|jn|} tt j d|| f ��|d krz| j � } n|} |j r�| j d||| � | j||||� | j| j||� |d kr�| jd� |S )NrG z'%s' already in '%s'T)r r> r� r� r � _FirewallPolicy__icmp_block_idr< r/ r r rZ r* rO rp �$_FirewallPolicy__register_icmp_blockr� �&_FirewallPolicy__unregister_icmp_blockrx ) r! r; r rg rf rb rz r� �icmp_idr� r{ r# r# r$ rU � s& z FirewallPolicy.add_icmp_blockc C s | j ||�|jd |< d S )NrG )r� r< )r! r� r rg rf r# r# r$ Z__register_icmp_block� s z$FirewallPolicy.__register_icmp_blockc C s� | j j|�}| j j� | j| }| j|�}||jd kr\|jrD|jn|}ttj d||f ��|d krn| j � }n|}|j r�| j d|||� |j | j||� |d kr�|jd� |S )NrG z'%s' not in '%s'FT)r r> r� r r r< r/ r r r� r* rO rp r� r rx ) r! r; r rb rz r� r r� r{ r# r# r$ r� � s" z FirewallPolicy.remove_icmp_blockc C s ||j d kr|j d |= d S )NrG )r< )r! r� r r# r# r$ Z__unregister_icmp_block s z&FirewallPolicy.__unregister_icmp_blockc C s | j |�| j|�d kS )NrG )r r8 )r! r; r r# r# r$ �query_icmp_block s z FirewallPolicy.query_icmp_blockc C s | j |�d j� S )NrG )r8 r, )r! r; r# r# r$ r� s z FirewallPolicy.list_icmp_blocksc C s dS )NTr# )r! r# r# r$ Z__icmp_block_inversion_id s z(FirewallPolicy.__icmp_block_inversion_idc C s | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j � }n|}|j r�x&| j |�d D ]} | j d|| |� q�W | jd||� | j|||� |j| j|||� |j �rx&| j |�d D ]} | j d|| |� q�W | jd||� |d k�r|jd� |S )NrJ z,icmp-block-inversion already enabled in '%s'rG FT)r r> r� r �(_FirewallPolicy__icmp_block_inversion_idr< r/ r r rZ r* rO r8 rp �_icmp_block_inversion�._FirewallPolicy__register_icmp_block_inversionr� �*_FirewallPolicy__undo_icmp_block_inversionrx ) r! r; rf rb rz r� �icmp_block_inversion_idr� r{ r` r# r# r$ �add_icmp_block_inversion s6 z'FirewallPolicy.add_icmp_block_inversionc C s | j d|�|jd |< d S )Nr rJ )r� r< )r! r� r rf r# r# r$ Z __register_icmp_block_inversionE s z.FirewallPolicy.__register_icmp_block_inversionc C s� | j � }|jr6x&| j|�d D ]}| jd|||� q W ||jd krP|jd |= |jr~x&| j|�d D ]}| jd|||� qfW |jd� d S )NrG FrJ T)r* rO r8 rp r< rx )r! rz r� r r{ r` r# r# r$ Z__undo_icmp_block_inversionJ s z*FirewallPolicy.__undo_icmp_block_inversionc C s | j j|�}| j j� | j| }| j� }||jd krV|jrB|jn|}ttj d| ��|d krh| j � }n|}|j r�x&| j |�d D ]}| j d|||� q�W | jd||� | j||� |j| j||d � |j �rx&| j |�d D ]}| j d|||� q�W | jd||� |d k�r|jd� |S )NrJ z(icmp-block-inversion not enabled in '%s'rG FT)r r> r� r r r< r/ r r r� r* rO r8 rp r �0_FirewallPolicy__unregister_icmp_block_inversionr� r rx ) r! r; rb rz r� r r� r{ r` r# r# r$ �remove_icmp_block_inversion\ s6 z*FirewallPolicy.remove_icmp_block_inversionc C s ||j d kr|j d |= d S )NrJ )r< )r! r� r r# r# r$ Z!__unregister_icmp_block_inversion� s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | j � | j|�d kS )NrJ )r r8 )r! r; r# r# r$ �query_icmp_block_inversion� s z)FirewallPolicy.query_icmp_block_inversionc C s� | j jj|�}|jr*| j jj|j d }n|}|rT|| jkrt||f| j| krtd S n || jksp||f| j| krtd S x@| j j� D ]2}|jr�||j � kr�|j ||||�} |j || � q�W | j ||||fg� |j | j || ||fg� d S )Nr )r r; r. r/ r: Z_zone_policiesr �enabled_backends�policies_supportedZget_available_tablesZbuild_policy_chain_rules� add_rules�_register_chainsr� ) r! r; �creater| r} r{ rM Ztracking_policy�backendrH r# r# r$ rn � s$ z FirewallPolicy.gen_chain_rulesc C sb x\|D ]T\}}|r,| j j|g �j||f� q| j | j||f� t| j | �dkr| j |= qW d S )Nr )r � setdefaultr0 �remover� )r! r; r Ztablesr| r} r# r# r$ r � s z FirewallPolicy._register_chainsc C s$ | j jj|�dkrd S | j jj|�S )Nzhash:mac)r r� �get_typeZ get_family)r! rK r# r# r$ r� � s z FirewallPolicy._ipset_familyc C s | j jj|�S )N)r r� r )r! rK r# r# r$ Z __ipset_type� s zFirewallPolicy.__ipset_typec C s dj |g| jjj|� �S )N�,)�joinr r� Z get_dimension)r! rK �flagr# r# r$ �_ipset_match_flags� s z!FirewallPolicy._ipset_match_flagsc C s | j jj|�S )N)r r� Z check_applied)r! rK r# r# r$ r� � s z#FirewallPolicy._check_ipset_appliedc C s* | j |�}|tkr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)�_FirewallPolicy__ipset_typer r r Z INVALID_IPSET)r! rK Z_typer# r# r$ r� � s z+FirewallPolicy._check_ipset_type_for_sourcec s� t |j�tkr��jjj|jj�}|d kr2|jjg}xR|jD ]H}||krHq:�j|� |j |� t j |�}||j_�j |||||d� q:W g } |j r�|j g} nH|jr�t|jt�s�t|jt�r�jjj|jj�� � jr� fdd�dD �} �j|j�} | �r&|j �r |j | k�r&ttjd| |j f ��n| g} | �s4ddg} �fdd�| D �} | |_�x2t�fdd�| D ��D �]} t |j�tk�r��jjj|jj�}g } t|j�d k�r�|j�r�ttjd ��xB| D ].} | |jk�r�| j | ��r�| j |j| � �q�W n | j d � �x~| D �]�}t |j �t k�r�j |j |�}|�j!|j"�7 }t#t|�d d � d �}g }x�|D ]�}|j$}t%|�}|j&dd�}|j |� |j dk�r�| j |j � �r��qTt|j'�dk �r�|j |� n:x8|j'D ].\}}| j(||||||j|�}|j)| |� �q�W �qTW |j*|� x4|j'D ]*\}}| j+||||||�}|j)| |� �q W x.|j,D ]$}| j-|||||�}|j)| |� �q@W x4|j.D ]*\}}| j/||||||�}|j)| |� �qpW �qW �qft |j�t0k�r�|jj1}|jj2}�j3||� | j+||||d |�}|j)| |� �qft |j�t4k�r<|jj5}�j6|� | j-|||d |�}|j)| |� �qft |j�t7k�r�|�rzx&| D ] } | j | ��rX|j8t9| � �qXW | j:|||�}|j)| |� �qft |j�t;k�r4|jj1}|jj2}|jj<}|jj=}xD| D ]<} | j | ��r�j>| ||||� |�r�|�r�|j8t9| � �q�W | j?|||||||�}|j)| |� �qft |j�t@k�r�|jj1}|jj2}�j3||� | j/||||d |�}|j)| |� n�t |j�tk�s�t |j�tk�r>�jjj|jj�� |j �r� j�r�|j � jk�r�ttjAd|j |jjf ��t |j�tk�r |j �r t |j �t k�r ttjd��| jB||� |�}|j)| |� n>|jd k�rf| jC|||�}|j)| |� nttjdt |j� ���qfW d S )N)�included_servicesc s g | ]}|� j kr|�qS r# )� destination)r? r� )�ictr# r$ r� � s z0FirewallPolicy._rule_prepare.<locals>.<listcomp>r� r� z;Source address family '%s' conflicts with rule family '%s'.c s g | ]}� j j|�r|�qS r# )r �is_ipv_enabled)r? r� )r! r# r$ r� � s c s g | ]}� j j|��qS r# )r �get_backend_by_ipv)r? r@ )r! r# r$ r� � s r z"Destination conflict with service.c S s | j S )N)rK )r@ r# r# r$ r� s z.FirewallPolicy._rule_prepare.<locals>.<lambda>)r~ � conntrack�natr� rj z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)r� r� )D�typer� r r r� � get_servicerK �includesr� r0 �copy�deepcopyr� �familyr� r r �config� get_icmptyper% r� r� r r Z INVALID_RULE�ipvsr9 r� �is_ipv_supportedr� r r� r� r� r� r+ r� r �replacerC � build_policy_helper_ports_rulesr Z add_modules�build_policy_ports_rulesrI �build_policy_protocol_rulesrF � build_policy_source_ports_rulesr r� r� r� r �valuer� r r� r � build_policy_masquerade_rulesr Zto_portr� r � build_policy_forward_port_rulesr ZINVALID_ICMPTYPE� build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules)r! ry r; r� r{ r$ �svc�includeZ_ruler3 Z source_ipvr Z destinationsr� r% r� r� r� r� r� � nat_moduler� �protorH r� r� r� r# )r& r! r$ r� � s z FirewallPolicy._rule_preparec C sb | j jj|�}| j|j|�}|| j|j�7 }tt|�dd� d�}|d krN|g}x@|j D ]6}||krdqV| j |� |j |� | j |||||d� qVW g } xnd D ]f} | j j | �s�q�| j j| �} t|j�dkr�| |jkr�| j | |j| f� q�| d f| kr�| j | d f� q�W �xV| D �]L\} } x�|D ]�} | j}t|�}| jjdd �}|j|� | jd k�rf| j| j� �rf�q t| j�d k �r�|j|� n:x8| jD ].\}}| j||||| | j|�}|j| |� �q�W �q W x2|jD ](\}}| j||||| �}|j| |� �q�W x,|j D ]"}| j |||| �}|j| |� �q�W x2|j D ](\}}| j ||||| �}|j| |� �q,W �q W d S ) Nc S s | j S )N)rK )r@ r# r# r$ r� � s z)FirewallPolicy._service.<locals>.<lambda>)r~ )r$ r� r� r r) r* r� rj )r� r� ) r r� r, r� r� r� r� r+ r9 r- r� r0 rr r' r( r� r% r� r r5 Z add_moduler0 r4 rC r6 rK r r7 rI r8 rF r9 )r! ry r; r� r{ r$ r> r� r? Z backends_ipvr� r r% r� r� r� r@ r� rA rH r� r# r# r$ rr � sb zFirewallPolicy._servicec C s< x6| j j� D ](}|jsq |j||||�}|j||� q W d S )N)r r r r7 r )r! ry r; r� r� r{ r rH r# r# r$ rs � s zFirewallPolicy._portc C s: x4| j j� D ]&}|jsq |j|||�}|j||� q W d S )N)r r r r8 r )r! ry r; r� r{ r rH r# r# r$ rt � s zFirewallPolicy._protocolc C s< x6| j j� D ](}|jsq |j||||�}|j||� q W d S )N)r r r r9 r )r! ry r; r� r� r{ r rH r# r# r$ ru � s zFirewallPolicy._source_portc C s8 d}|j t|� | jj|�}|j||�}|j||� d S )Nr� )r� r r r( r; r )r! ry r; r{ r� r rH r# r# r$ rv � s zFirewallPolicy._masqueradec C sX t d|�rd}nd}|r(|r(|jt|� | jj|�} | j||||||�} |j| | � d S )Nr� r� )r r� r r r( r< r ) r! ry r; r{ r� r� r� r� r� r rH r# r# r$ rq � s z FirewallPolicy._forward_portc C s� | j jj|�}xl| j j� D ]^}|js&qd}|jrXx&dD ] }||jkr6|j|�s6d}P q6W |r^q|j|||�} |j|| � qW d S )NFr� r� T)r� r� ) r r1 r2 r r r% r4 r= r ) r! ry r; r r{ r& r Z skip_backendr� rH r# r# r$ rp � s zFirewallPolicy._icmp_blockc C sh | j | j}|dkrd S | j|� r0|dkr0d S x2| jj� D ]$}|jsHq<|j||�}|j||� q<W d S )N�DROP� %%REJECT%%�REJECTZACCEPT)rB rC rD )r �targetr r r r Z'build_policy_icmp_block_inversion_rulesr )r! ry r; r{ rE r rH r# r# r$ r s z$FirewallPolicy._icmp_block_inversionc C s� x|D ]}| j |� qW x|D ]}| j|� q W d|ks@d|krXt|�dkrXttjd��d|kshd|kr�t|�dkr�ttjd��|s�|r�| r�| r�d|kr�d|kr�ttjd| ��|s�|r�| r�| r�d|kr�d|kr�ttjd| ��d S )Nr6 r5 rj zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTzH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTzpolicy "%s" has no ingresszpolicy "%s" has no egress)r� r� r� r r r� ) r! r; r4 r7 �ingress_interfaces�egress_interfaces�ingress_sources�egress_sourcesr: r# r# r$ �check_ingress_egress" s$ z#FirewallPolicy.check_ingress_egressc C s� |dkr&|dkr�|r�t tjd| ��n�|dkrtd|krFt tjd| ��d|kr^t tjd| ��|r�t tjd| ��n||d kr�d|kr�t tjd| ��d|kr�t tjd| ��nB|d kr�d|kr�t tjd | ��n |d kr�d|kr�t tjd | ��d S )N� PREROUTING�rawzFpolicy "%s" egress-zones may not include a zone with added interfaces.� POSTROUTINGr5 z/policy "%s" ingress-zones may not include HOST.z.policy "%s" egress-zones may not include HOST.zGpolicy "%s" ingress-zones may not include a zone with added interfaces.�FORWARD�INPUTz0policy "%s" egress-zones must include only HOST.�OUTPUTz1policy "%s" ingress-zones must include only HOST.)r r r� ) r! r; r| r} r4 r7 rF rG rH rI r# r# r$ �check_ingress_egress_chain< s, z)FirewallPolicy.check_ingress_egress_chainc C s$ | j � }| j|||� |jd� d S )NT)r* ro rx )r! ry r; r{ r# r# r$ �!_ingress_egress_zones_transactionY s z0FirewallPolicy._ingress_egress_zones_transactionc C sL | j | }|jd }|jd }t� }t� }t� } t� } xB|D ]:} | dkrJq<|t| jjj| ��O }| t| jjj| ��O } q<W xB|D ]:} | dkr�q�|t| jjj| ��O }| t| jjj| ��O } q�W | j|||||| | � xr| jj� D ]d} | j s�q�xV| j |�D ]H\} }| j || |||||| | � | j ||| |||| | �}|j | |� � q�W q�W d S )Nr4 r7 r6 r5 )r6 r5 )r6 r5 )r r< r9 r r: r� Z list_sourcesrJ r r rl rQ Z!build_policy_ingress_egress_rulesr )r! ry r; r{ rM r4 r7 rF rG rH rI r: r r| r} rH r# r# r$ ro ^ s@ z$FirewallPolicy._ingress_egress_zonesc C s6 | j | }d|jd krFd|jd krFdddg}| jjsB|jd� |S d|jd krpdg}| jjsl|jd� |S d|jd kr�dgS d|jd ko�d|jd k� r�ddddg}| jj� s�|jd� |S d|jd k�r.d d d g}| jj� s�|jd � x4|jd D ] }| jjj|�d �r P �q W |jd � |S d|jd k�r�d!d"g}| jj�sZ|jd#� x>|jd D ] }| jjj|�d �rfP �qfW |jd$� |jd%� |S d&g}| jj�s�|jd'� x4|jd D ] }| jjj|�d �r�P �q�W |jd(� x>|jd D ] }| jjj|�d �r�P �q�W |jd)� |jd*� |S dS )+z:Create a list of (table, chain) needed for policy dispatchr6 r4 r5 r7 r� rO r* rK �manglerL rP rN rM Z interfacesN)r� rO )r* rK )rS rK )rL rK )r� rO )rL rK )r� rP )r� rN )r* rK )r* rM )rS rK )rL rK )r� rN )r* rK )rS rK )rL rK )r* rM )r� rN )r* rM )rL rK )r* rK )rS rK )r� rN )rL rK )r* rM )r* rK )rS rK )r r< r �nftables_enabledr0 r: r8 )r! r; rM �tcr: r# r# r$ rl � sj z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sr | j | }d|jd kr4dg}| jjs0|jd� |S d|jd krLdddgS d|jd krbddgS td| �S dS )z8Create a list of (table, chain) needed for zone dispatchr5 r7 r� rO rL rK r6 � FORWARD_INr* rS r4 � FORWARD_OUTrM zInvalid policy: %sN)r� rO )rL rK )r� rV )r* rK )rS rK )r� rW )r* rM )r r< r rT r0 r )r! r; rM rU r# r# r$ rm � s z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s� | j jj|�}|jr |j}n|| }d|jd krl|dkrBd| S |dkrRd| S |jsh|dkrhd| S �nJd|jd kr�|js�|dkr�d | S �n"d |jd k� r�|dkr�|jr�d | S d | S n0|dkr�|r�d| S d| S n|dk�r�d| S n�d |jd k�rh|dk�r*|j�r d| S d | S n<|dk�rL|�rBd| S d| S n|dk�r�|j�s�d| S nN|j�s�|dk�r�d | S |dk�r�|�r�d| S d| S n|dk�r�d| S td|||f �S )Nr5 r7 r� ZIN_rL ZPRE_rS r* r4 ZOUT_r6 ZFWDI_ZFWD_ZPOST_ZFWDO_z.Can't convert policy to chain name: %s, %s, %s)rS r* )rS rL )rS rL )rS rL )r r; r. r/ r< r )r! r; r| Z policy_prefixZisSNATrM �suffixr# r# r$ �policy_base_chain_name� sb z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)��__name__� __module__� __qualname__r% r' r) r* r- r3 r= r. rN rQ rL rd re r� r8 r rc rP r� r� r� r� rS r� r� r� r� r� r� r� rT r� r� r� r� r� r� r� r� rw r^ r� r� r� r� r� r� r� rW r� r� r� r� r� r� r� r� r� rX r� r� r� r� r� r� r� r\ r� r� r� r� r� r� r] r� r� r� r� r� r� r_ r� r� r� r� r r rV r r� r r r� r r rU r r� r r r� r r r r r r r rn r r� r# r" r� r� r� rr rs rt ru rv rq rp r rJ rQ rR ro rl rm rY r# r# r# r$ r s$ ' ? . , # , # : ' ( ' ( ' + ) ) @ @ ( P r )'rh r. Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r r r r� r r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr Zfirewall.core.baser �objectr r# r# r# r$ �<module> s 04