+
    i  c                   s   ^ RI t ^ RIt^ RIt^ RIt^ RIt^ RIHtHt ^ RIH	t	 ^ RIH
t
 ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ R	IHt ^ R
IHt ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ RIHt ^ RIH t  ^ RI!H"t" ^ RI#H$t$H%t% ^ RI&H't' ^ RI(H)t) ^ RI*H+t+ ^ RI,H-t- ^ RI.H/t/ ^ RI0H1t1 ^ RI2H3t3H4t4 ^ RI5H6t6 ^ RI7H8t8 ^ RI9H:t: ^ RI;H<t< ^ RI=H>t> ^ R I?H@t@ ^ R!IHAtA ^ R"IBHCtC  ! R# R$4      tDR# )%    N)DictList)config)	functions)	ipXtables)ebtables)nftables)ipset)modules)FirewallIcmpType)FirewallService)FirewallZone)FirewallDirect)FirewallConfig)FirewallIPSet)FirewallTransaction)FirewallHelper)FirewallPolicy)nm_get_bus_namenm_get_interfaces_in_zone)log)	IO_Object)firewalld_conf)Direct)service_reader)icmptype_reader)zone_readerZone)ipset_reader)IPSET_TYPES)helper_reader)policy_reader)check_on_disk_config)	Rich_Rule)errors)FirewallErrorc                   s  a  ] tR t^6t o RJR ltR tR tRKRR/R lltR t/ 3V 3R	 lR
 llt	R t
R tR tR tR tR tR tRLR ltR tR tRLR ltRLR ltR tR tR tR tR tR tR tRJR ltR tR  tR! t R" t!R# t"R$ t#R% t$R& t%R' t&R( t'R) t(R* t)R+ t*R, t+RKR- lt,RKR. lt-RKR/ lt.RMR0 lt/R1 t0R2 t1R3 t2R4 t3R5 t4R6 t5R7 t6R8 t7R9 t8R: t9R; t:R< t;R= t<RJR> lt=R? t>R@ t?RA t@RB tARC tBRD tCRE tDRF tERG tFRH tGRItHV tIR# )NFirewallc                s   \        \        P                  4      V n        Wn        V'       g   \
        P                  ! V 4      V n        \
        P                  ! V 4      V n	        \        P                  ! 4       V n        \        P                  ! 4       V n        \        P                  ! V 4      V n        \         P                   ! 4       V n        \%        V 4      V n        \)        V 4      V n        \-        V 4      V n        \1        V 4      V n        \5        V 4      V n        \7        V 4      V n        \9        V 4      V n        \=        V 4      V n        V PA                  4        R # N)!r   r   FIREWALLD_CONF_firewalld_conf_offliner   	ip4tablesip4tables_backend	ip6tablesip6tables_backendr   ebtables_backendr   ipset_backendr   nftables_backendr	   modules_backendr
   icmptyper   servicer   zoner   directr   r   r   helperr   policy_Firewall__init_vars)selfZoffline   &&5/usr/lib/python3.14/site-packages/firewall/core/fw.py__init__ZFirewall.__init__7   s    -f.C.CD%.%8%8%>D"%.%8%8%>D"$,$5$5$7D!!&D$,$5$5d$;D!#*??#4D (.&t, &	$T*$T*"4(
$T*$T*    c                s   V P                   : R V P                  : RV P                  : RV P                  : RV P                  : RV P
                  : RV P                  : RV P                  : RV P                  : RV P                  : RV P                  : RV P                  : RV P                  : RV P                  : RV P                  : R2# )Z(z, ))Z	__class__ip4tables_enabledip6tables_enabledebtables_enabled_state_panic_default_zone_module_refcount_markscleanup_on_exitcleanup_modules_on_exit_ipv6_rpfilteripset_enabled_individual_calls_log_deniedr9      &r;   __repr__ZFirewall.__repr__N   s    NN""""!!KKKK!!KK  ((""
 	
r=   c                s   R V n         RV n        \        P                  V n        . V n        . V n        / V n        . V n        \        P                  V n
        \        P                  V n        \        P                  V n        \        P                  V n        \        P"                  V n        \        P&                  V n        \        P*                  V n        \        P.                  V n        \        P2                  V n        \        P6                  V n        \        P:                  V n        \        P>                  V n         \        PB                  V n"        V PF                  '       d1   RV n$        RV n%        RV n&        RV n'        \P        V n)        RV n*        R# RV n$        . V n+        RV n%        . V n,        RV n&        RV n'        \P        V n)        RV n*        R# )ZINITFTN)-rB   rC   r   ZFALLBACK_ZONErD   _default_zone_interfaces_nm_assigned_interfacesrE   rF   ZFALLBACK_CLEANUP_ON_EXITrG   Z FALLBACK_CLEANUP_MODULES_ON_EXITrH   ZFALLBACK_IPV6_RPFILTERrI   ZFALLBACK_INDIVIDUAL_CALLSrK   ZFALLBACK_LOG_DENIEDrL   ZFALLBACK_FIREWALL_BACKEND_firewall_backendZFALLBACK_FLUSH_ALL_ON_RELOAD_flush_all_on_reloadZFALLBACK_RFC3964_IPV4_rfc3964_ipv4ZFALLBACK_ALLOW_ZONE_DRIFTING_allow_zone_driftingZFALLBACK_NFTABLES_FLOWTABLE_nftables_flowtableZFALLBACK_NFTABLES_COUNTERS_nftables_countersZFALLBACK_NFTABLES_TABLE_OWNER_nftables_table_ownerZFALLBACK_STRICT_FORWARD_PORTS_strict_forward_portsr)   r?   r@   rA   rJ   r   ipset_supported_typesnftables_enabledipv4_supported_icmp_typesipv6_supported_icmp_typesrM   rN   r;   Z__init_varsZFirewall.__init_varsa   sl   #11(*%')$ "%>>'-'N'N$$;;!'!A!A!55!'!A!A$*$G$G!#99$*$G$G!#)#E#E "("C"C%+%I%I"%+%I%I"===%*D"%*D"$)D!!&D)4D&$)D!%)D"-/D*%)D"-/D*$(D!!%D)4D&$(D!r=   NenableTc               s(     ! R  R4      pV! WV4      # )c                   s2   a  ] tR t^t o R tR tR tRtV tR# )5Firewall.with_transaction.<locals>.TransactionContextc                sx    VR J V n         W0n        V P                   '       d   \        V4      V n        R # W n        R # r&   )is_temporary_enabler   transaction)ctxselfr9   use_transactionr^      &&&&r;   r<   Z>Firewall.with_transaction.<locals>.TransactionContext.__init__   s3    '6$'>$"('''*=d*CG'*9'r=   c                    V P                   # r&   )rb   )rc   rN   r;   	__enter__Z?Firewall.with_transaction.<locals>.TransactionContext.__enter__   s    ***r=   c                s    Vf<   V P                   '       d(   V P                  P                  V P                  4       R # R # R # r&   )r`   rb   executera   )rc   Zexc_typeZ	exc_value	tracebackre   r;   __exit__Z>Firewall.with_transaction.<locals>.TransactionContext.__exit__   s3    #(<(<(<''//@ )=#r=    N)	__name__
__module____qualname____firstlineno__r<   rg   rj   __static_attributes____classdictcell____classdict__   @r;   TransactionContextr_      s     :+A Ar=   ru   rk   )r9   rd   r^   ru   s   &&$ r;   with_transactionZFirewall.with_transaction   s    	A 	A  "$@@r=   c                s   / pV P                   P                  4        Uu/ uF  q"V P                   P                  V4      bK   	  upVR&   V P                  P	                  4        Uu/ uF  pW0P                  P                  V4      bK   	  upVR&   V P                  P                  4        Uu/ uF  pW@P                  P                  V4      bK   	  upVR&   V P                  P                  4        Uu/ uF  pWPP                  P                  V4      bK   	  upVR&   V P                  P                  4        Uu/ uF  qfV P                  P                  V4      bK   	  upVR&   V P                  P!                  4        Uu/ uF  pWpP                  P#                  V4      bK   	  upVR&   / VR&   V P$                  P'                  R4      VR,          R&   / VR	&   / VR	,          R
&   \)        V P*                  P                  4       4      P-                  \)        V P                  P                  4       4      4       F/  pV P*                  P                  V4      VR	,          R
,          V&   K1  	  \)        V P*                  P                  4       4      P/                  \)        V P                  P                  4       4      4       EF  pW@P0                  9  g   W@P2                  9  g   K&  \4        P4                  ! V P*                  P                  V4      4      VR	,          R
,          V&   . VR	,          R
,          V,          n        W@P0                  9  d1   VR	,          R
,          V,          P6                  P9                  R4       W@P2                  9  g   K  VR	,          R
,          V,          P6                  P9                  R4       EK  	  V# u upi u upi u upi u upi u upi u upi )z8
Returns a dict of dicts of all runtime config objects.
ipsetshelpers	icmptypesserviceszonespoliciesZconfFirewallBackendruntimeZicmptypes_unsupportedipv4ipv6)r   
get_ipsets	get_ipsetr6   get_helpers
get_helperr2   get_icmptypesget_icmptyper3   get_servicesget_servicer4   	get_zonesget_zoner7   Z"get_policies_not_derived_from_zoneZ
get_policyr(   getsetr   Z
differenceZintersectionr\   r]   copyZdestinationappend)r9   Z	conf_dict_ipsetr6   r2   r3   r4   r7   s   &       r;   get_all_io_objects_dictZ Firewall.get_all_io_objects_dict   sq    	?Czz?T?T?V
?VVDJJ((00?V
	(
 ++113 
3 KK**6223 
	) !MM779"
9 mm00::9"
	+  <<446!
6 \\--g666!
	*
 8<yy7J7J7L
7Lt$))$$T**7L
	'
 ++HHJ!
J KK**622J!
	*
 	&/3/C/C/G/G0
	&+,  "	)8:	)45DKK5578CC++-.
H
 ((2 i !89
 DKK5578EE++-.
H  > >>#A#AAJN))KK,,X6K	)$%<=hG WY	)$%<=hGS#A#AAi()@A !k&&.#A#AAi()@A !k&&.%
( C
 
"
!

!
s#   $O%$O+$O1$O7$O=$Oc                sF   < V ^8  d   QhRS[ S[S[S[,          3,          /# )i   extra_io_objects)r   strr   r   )formatrs   s   "r;   Z__annotate__ZFirewall.__annotate__   s%     V V$sDO7K2L Vr=   c                s   V P                  4       pV F'  pW,           F  pWBV,          VP                  &   K  	  K)  	  . ROpV FD  pW&,          pVP                  4        F%  w  rV	P                  V	P	                  4       V4       K'  	  KF  	  R# )rw   N)rw   rx   ry   rz   r{   r|   )r   nameitemsZcheck_config_dictZexport_config_dict)
r9   r   Zall_io_objectsZtype_keyobjZorderZio_obj_typeZio_objsr   Zio_objs
   &&        r;   full_check_configZFirewall.full_check_config   s    557(H'1158x(2 2 ) T K$1G '(()B)B)DnU !0 !r=   c                s   V P                   '       d=   R V P                  P                  4       9  d   \        P                  ! R4       RV n         V P
                  '       d=   R V P                  P                  4       9  d   \        P                  ! R4       RV n        V P                  '       d=   R V P                  P                  4       9  d   \        P                  ! R4       RV n        V P                   '       gC   V P
                  '       g/   V P                  '       g   \        \        P                  R4      hR# R# R# )filterziptables is not usable.Fzip6tables is not usable.zebtables is not usable.zNo IPv4 and IPv6 firewall.N)r?   r+   get_available_tablesr   info1r@   r-   rA   r.   r[   r$   r#   UNKNOWN_ERRORrM   rN   r;   _start_check_tablesZFirewall._start_check_tables   s     """ 6 6 K K MMII/0%*D" """ 6 6 K K MMII01%*D" !!! 5 5 J J LLII/0$)D! &&&***))) 4 46RSS * + 'r=   c                s@   V P                   P                  4        V P                   P                  '       gz   V P                   P                  '       d   \        P
                  ! R 4       MFV P                  '       d   \        P                  ! R4       M\        P
                  ! R4       RV n        V P                  '       d"   V P                  P                  R4      V n        M9V P                  '       d!   V P                   P                  4       V n        M. V n        V P                  P                  4        V P                  P                  '       gz   V P                  P                  '       d   \        P
                  ! R4       MFV P                  '       d   \        P                  ! R4       M\        P
                  ! R4       RV n        V P                  '       d"   V P                  P                  R4      V n        M9V P                  '       d!   V P                  P                  4       V n        M. V n        V P                  P                  4        V P                  P                  '       gz   V P                  P                  '       d   \        P
                  ! R	4       MFV P                  '       d   \        P                  ! R
4       M\        P
                  ! R4       RV n        V P                   '       dE   V P"                  '       g3   V P                  P$                  '       g   \        P&                  ! R4       V P                  P)                  4        V P*                  '       d7   V P                  P,                  '       g   \        P                  ! R4       R# R# R# )zFiptables-restore is missing, using individual calls for IPv4 firewall.zMiptables-restore and iptables are missing, IPv4 direct rules won't be usable.zCiptables-restore and iptables are missing, disabling IPv4 firewall.Fr   zGip6tables-restore is missing, using individual calls for IPv6 firewall.zOip6tables-restore and ip6tables are missing, IPv6 direct rules won't be usable.zEip6tables-restore and ip6tables are missing, disabling IPv6 firewall.r   zHebtables-restore is missing, using individual calls for bridge firewall.zKebtables-restore and ebtables are missing, eb direct rules won't be usable.zEebtables-restore and ebtables are missing, disabling bridge firewall.zSebtables-restore is not supporting the --noflush option, will therefore not be usedzpConfiguration has NftablesTableOwner=True, but it's not supported by nftables. Table ownership will be disabled.N)r+   Zfill_existsrestore_command_existsZcommand_existsr   warningr[   r   r?   r0   Zsupported_icmp_typesr\   r-   r@   r]   r.   rA   rK   restore_noflush_optiondebug1Zprobe_supportrX   Zsupports_table_ownerrM   rN   r;   _start_probe_backendsZFirewall._start_probe_backends  s   **,%%<<<%%444:
 (((II=
 KK3 */&   -1-B-B-W-W.D* %%%**??A . 24.**,%%<<<%%444:
 (((II=
 KK3 */&   -1-B-B-W-W.D* %%%**??A . 24.))+$$;;;$$333<
 (((II;
 KK5 ).% !!!***))@@@JJ5
 	++- &&&))>>>IIO ? 'r=   c                sz   \         P                  ! R \        P                  4        V P                  P                  4        V P                  P                  R4      '       d!   V P                  P                  R4      V n        V P                  P                  R4      '       d]   V P                  P                  R4      pVe   VP                  4       R%9   d   RV n	        \         P                  ! RV P                  4       V P                  P                  R4      '       d]   V P                  P                  R4      pVe   VP                  4       R&9   d   RV n
        \         P                  ! R	V P                  4       V P                  P                  R
4      '       d   V P                  P                  R
4      pVe   VP                  4       R%9   d	   RV n        MsVP                  4       R'9   d	   RV n        MVVP                  4       R(9   d	   RV n        M9VP                  4       R)9   d	   RV n        MVP                  4       R*9   d   RV n        \         P                  ! RV P                   R24       V P                  P                  R4      '       dR   V P                  P                  R4      pVe3   VP                  4       R&9   d   \         P                  ! R4       RV n        V P                  P                  R4      '       ds   V P                  P                  R4      pVe   VP                  4       R8X  d	   RV n        M6VP                  4       V n        \         P                  ! RV P                  4       V P                  P                  R4      '       dB   V P                  P                  R4      V n        \         P                  ! RV P                  4       V P                  P                  R4      '       da   V P                  P                  R4      pVP                  4       R%9   d	   RV n        MRV n        \         P                  ! RV P                  4       V P                  P                  R4      '       da   V P                  P                  R4      pVP                  4       R%9   d	   RV n        MRV n        \         P                  ! RV P                   4       V P                  P                  R4      '       dB   V P                  P                  R4      V n        \         P                  ! RV P"                  4       V P                  P                  R4      '       da   V P                  P                  R4      pVP                  4       R%9   d	   RV n        MRV n        \         P                  ! RV P$                  4       V P                  P                  R 4      '       da   V P                  P                  R 4      pVP                  4       R%9   d	   RV n        MRV n        \         P                  ! R!V P&                  4       V P                  P                  R"4      '       da   V P                  P                  R"4      pVP                  4       R%9   d	   RV n        MRV n        \         P                  ! R#V P(                  4       T P                  P/                  \0        P2                  ! T P                  4      4       R#   \*         d7   p\         P,                  ! T4       \         P,                  ! R$4        Rp?LwRp?ii ; i)+z"Loading firewalld config file '%s'DefaultZoneZCleanupOnExitNnoFzCleanupOnExit is set to '%s'ZCleanupModulesOnExitTz#CleanupModulesOnExit is set to '%s'ZIPv6_rpfilterstrictlooseloose-forwardstrict-forwardzIPv6_rpfilter is set to ''ZIndividualCallszIndividualCalls is enabled	LogDeniedZoffzLogDenied is set to '%s'r}   zFirewallBackend is set to '%s'ZFlushAllOnReloadzFlushAllOnReload is set to '%s'ZRFC3964_IPv4zRFC3964_IPv4 is set to '%s'ZNftablesFlowtablez NftablesFlowtable is set to '%s'ZNftablesCounterszNftablesCounters is set to '%s'ZNftablesTableOwnerz!NftablesTableOwner is set to '%s'ZStrictForwardPortsz!StrictForwardPorts is set to '%s'z0Using fallback firewalld configuration settings.)r   Zfalse)yestrue)r   r   r   )r   )r   )r   )r   r   r   r'   r(   readr   rD   ZlowerrG   rH   rI   rK   rL   rR   rS   rT   rV   rW   rX   rY   	Exceptionr   set_firewalld_confr   deepcopy)r9   valuemsg   &  r;   _start_load_firewalld_confZ#Firewall._start_load_firewalld_confx  ss   

79N9NOf	  %%'
 ##''66%)%9%9%=%=m%L"##''88,,00A$/)I+0D(

94;O;OP##''(>??,,001GH$/)I37D0

94;W;W ##''88,,00A${{}7.2+*CC.6+)3.5+*;;.=+*<<.>+

6t7J7J6K1MN##''(9::,,001BC$/)IJJ;<-1D*##''44,,00==EKKMT$9',D$',{{}D$JJ94;K;KL##''(9::)-)=)=)A)ABS)T&

;T=S=ST##''(:;;,,001CD;;=O305D-04D-

<d>W>WX##''77,,00@;;=O3).D&)-D&

8$:L:LM##''(;<<+/+?+?+C+CDW+X(

=t?W?WX##''(:;;,,001CD;;=O3.3D+.2D+

<d>U>UV##''(<==,,001EF;;=O316D.15D.

79S9S ##''(<==,,001EF;;=O316D.15D.

79S9S 	&&t}}T5I5I'JKM  	LKKKKJKK	Ls   [9 9\:,\55\:c                z   V P                  \        P                  4       V P                  \        P                  4       V P                  \        P                  4       V P                  \        P                  4       V P                  \        P                  4       V P                  \        P                  4       R # r&   )_loader_ipsetsr   ZFIREWALLD_IPSETS_loader_icmptypesZFIREWALLD_ICMPTYPES_loader_helpersZFIREWALLD_HELPERS_loader_servicesZFIREWALLD_SERVICES_loader_zonesZFIREWALLD_ZONES_loader_policiesZFIREWALLD_POLICIESrM   rN   r;   _start_load_stock_configZ!Firewall._start_load_stock_config  sz    F334v99:V556f7786112f778r=   c                r   r&   )r   r   ZETC_FIREWALLD_IPSETSr   ZETC_FIREWALLD_ICMPTYPESr   ZETC_FIREWALLD_HELPERSr   ZETC_FIREWALLD_SERVICESr   ZETC_FIREWALLD_ZONESr   ZETC_FIREWALLD_POLICIESrM   rN   r;   _start_load_user_configZ Firewall._start_load_user_config  sz    F778v==>V99:f;;<6556f;;<r=   c                s   V P                   P                  4        FK  pV P                  P                  \        P
                  ! V P                   P                  V4      4      4       KM  	  V P                   P                  4        FK  pV P                  P                  \        P
                  ! V P                   P                  V4      4      4       KM  	  V P                   P                  4        FK  pV P                  P                  \        P
                  ! V P                   P                  V4      4      4       KM  	  V P                   P                  4        FK  pV P                   P#                  \        P
                  ! V P                   P%                  V4      4      4       KM  	  V P                   P'                  4        FK  pV P(                  P+                  \        P
                  ! V P                   P-                  V4      4      4       KM  	  V P.                  P1                  \        P
                  ! V P                   P3                  4       4      4       / pV P                   P5                  4        EFJ  pV P                   P7                  V4      pR VP8                  9  dK   V P:                  P=                  \        P
                  ! V P                   P7                  V4      4      4       Kz  \>        P@                  PC                  VP@                  4      p	W9  dO   \E        4       p
Wn        V
PG                  V
P8                  4       VP@                  V
n         RV
n$        RV
n%        WV	&   \L        PN                  ! RV	VP@                  \>        PP                  VPR                  4       Wi,          PU                  V4       EKM  	  V F$  pV P:                  P=                  Wg,          4       K&  	  R# )/Fz"Combining zone '%s' using '%s%s%s'N)+r   r   r   	add_ipsetr   r   r   r   r2   add_icmptyper   r   r6   
add_helperr   r   r3   add_servicer   get_policy_objectsr7   Z
add_policyget_policy_objectr5   Zset_permanent_configZ
get_directr   r   r   r4   add_zoneospathbasenamer   
check_namedefaultZforwardr   r   sepfilenamecombine)r9   r   r2   r6   r3   r7   Zcombined_zonesr4   Zz_objZcombined_nameZcombined_zones   &          r;   _start_copy_config_to_runtimeZ&Firewall._start_copy_config_to_runtime  s   kk,,.FJJ  t{{/D/DV/L!MN /113HMM&&dkk66x@A 4 kk--/FKK""4==1G1G1O#PQ 0{{//1GLL$$T]]4;;3J3J73S%TU 2kk446FKK""4==1N1Nv1V#WX 7 	((t{{7M7M7O)PQ KK))+DKK((.E%**$		""4==1E1Ed1K#LMGG,,UZZ8M2 $%2"((););<%*ZZ"(-%(-%0=}-JJ4

 )11%81 ,4 #DII~34 #r=   c                s   \        \        P                  4      p\        P                  P                  \        P                  4      '       d=   \        P                  ! R \        P                  ,          4        VP                  4        V P                  P                  V4       R#   \         d1   p\        P                  ! R\        P                  T4        Rp?LSRp?ii ; i)zLoading direct rules file '%s'z)Failed to load direct rules file '%s': %sN)r   r   ZFIREWALLD_DIRECTr   r   Zexistsr   r   r   r   errorZ
set_direct)r9   r   r   r   r;   _start_load_direct_rulesZ!Firewall._start_load_direct_rules%  s    V,,-77>>&1122JJ7&:Q:QQR
 	s#  		?++ s   9B& &C!1&CC!c                s   V P                  4       ;_uu_ 4       pV'       g   V P                  VR 7       V'       d	   V'       gA   V P                  P                  4       '       d2   V P                  P	                  4       '       d   VP                  R4       V'       d9   V'       d1   \        P                  ! R4       V P                  P                  4        V P                  V4       VP                  R4       V P                  P                  4       '       dQ   V P                  P	                  4       '       d1   \        P                  ! R4       V P                  P                  4        \        P                  ! R4       V P                  V4       \        P                  ! R4       V P                  P                  V P                  V4       V P                  P!                  RV P                  RV4       \        P                  ! R4       V P                  P#                  V4       \        P                  ! R4       V P$                  P'                  V4       R	R	R	4       R	#   + '       g   i     R	# ; i)
rd   TzUnloading firewall moduleszApplying ipsetszApplying default rule setzApplying default zoneZ+zApplying used zoneszApplying used policiesN)rv   flushr   backendsZ
has_ipsetsrh   r   r   r1   unload_firewall_modulesapply_default_tablesZapply_ipsetsapply_default_rulesr4   Zapply_zone_settingsrD   Z
_interfaceZapply_zonesr7   Zapply_policies)r9   reloadcomplete_reloadrb      &&& r;   _start_apply_objectsZFirewall._start_apply_objects4  s   ""$$

;
7 ?

##%%$***?*?*A*A##D) /

78$$<<>%%k2% 

##%%4::+@+@+B+B

,-

'')JJ23$$[1JJ./II))$*<*<kJII  t'9'93LJJ,-II!!+.JJ/0KK&&{3Q %$$$s<   "III$III%A1II7DII/	c                s   V P                  4       ;_uu_ 4       pV P                  P                  4       '       dD   \        P                  ! R 4       V P                  P                  V4        VP                  R4       RRR4       R#   \         dK   p\        TP                  RTP                  '       d   TP                  ,          4      hR,          4      hRp?i\         d    h i ; i  + '       g   i     R# ; i)z2Applying direct chains rules and passthrough rulesTz
Direct: %s N)rv   r5   Zhas_configurationr   r   Zapply_directrh   r$   coder   r   )r9   rb   er   r;   _start_apply_direct_rulesZ"Firewall._start_apply_direct_rules_  s    ""$$ {{,,..

OP((5''- %$ % Y'0WXXTV0WXX   %$$s1   AC*,BC'ACC'$C''C**C;	c                sT   R
 FJ  pWP                   P                  4       9  g   K#  \        \        P                  RP                  V4      4      h	  V P                  V P                   P                  4       9  dp   RV P                   P                  4       9   d   RpM$RV P                   P                  4       9   d   RpMR p\        P                  ! RV P                  V4       W n        M!\        P                  ! RV P                  4       V P                  '       g   V P                  4        V P                  4        V P                  R8X  d   RpMV P                  pV P                  V4      '       g4   \        \        P                  RP                  V P                  4      4      hR	# R	# )blockzZone '{}' is not available.ZpublicZexternalz+Default zone '%s' is not valid. Using '%s'.zUsing default zone '%s'Ziptablesr*   z'Firewall backend '{}' is not available.N)r   ZdropZtrusted)r4   r   r$   r#   INVALID_ZONEr   rD   r   r   r   r)   r   r   rR   is_backend_enabledr   )r9   Zzr4   Zbackend_to_checks   &   r;   _start_checkZFirewall._start_checkp  s\   -A		++--#'')F)M)Ma)P  . TYY%8%8%::499..00tyy2244!II=t?Q?QSW "&JJ0$2D2DE}}}""$$$& %%3#. #'#9#9 **+;<<#((=DD..  = r=   c                s   V P                  4        V P                  V P                  4       V P                  '       g   V P	                  4        V P                  4        V P                  4        V P                  4        V P                  4        V P                  4        V P                  '       d   R # \        P                  ! 4       ^ 8  d   \        P                  ! 4       pV P                  WR7       V P                  4        \        P                  ! 4       ^8  d<   \        P                  ! 4       p\        P                  ! RVX,
          ,          4       R # R # )Nr   r   z%Flushing and applying took %f seconds)r   _select_firewall_backendrR   r)   r   r   r   r   r   r   r   ZgetDebugLogLeveltimer   r   Zdebug2)r9   r   r   Ztm1Ztm2s   &&&  r;   _startZFirewall._start  s    '')%%d&<&<=}}}&&(%%'$$&%%'**,===!A%))+C!!!Q&&(!A%))+CJJ>#)LM &r=   c                s   V P                  4        V P                  P                  4        V P                  P	                  \
        P                  ! V P                  4      4       V P                  V P                  4       V P                  4        V P                  4        V P                  4        V P                  4        V P                  WR7       R# )z
This is basically _start() with at least the following differences:
    - built-in defaults for firewalld.conf
    - no user config (/etc/firewalld)
    - no direct rules
r   N)cleanupr(   Zset_defaultsr   r   r   r   r   rR   r   r   r   r   r   )r9   r   r      &&&r;   _start_failsafeZFirewall._start_failsafe  s     	))+&&t}}T5I5I'JK%%d&<&<=""$%%'**,!!!Qr=   c                s    V P                  4        R V n        V P                  R4       R#   \         Ed   pT P                  '       d   h \
        P                  ! R4        T P                  4        RT n        T P                  R4       Th  \         d   p\
        P                  ! T4       \
        P                  ! 4        \
        P                  ! T4       \
        P                  ! R4        T P                  4        M  \         d     Mi ; i\        P                  ! \        P                  4        Rp?ThRp?ii ; iRp?ii ; i)RUNNINGACCEPTzLFailed to load user configuration. Falling back to full stock configuration.FAILEDzFailed to load full stock configuration. This likely indicates a system level issue, e.g. the firewall backend (nftables, iptables) is broken. All hope is lost. Exiting.N)r   rB   
set_policyr   r)   r   r   r   Z	exceptionr   sysZexitr#   r   )r9   Zoriginal_exZnew_exr   r;   startZFirewall.start  s   "	&KKM@ $DKOOH%A  	}}}II,/$$&&)$ #  /		+&		&!		1JJL  --.. #/	sc   , E)E"(B
EE AD;/D ?D; DD;D'D;5E;E  EEc              #  s   "   \         P                  P                  V4      '       g   R # \        \         P                  ! V4      4       F   pVP                  R4      '       g   K  Vx  K"  	  R # 5i)N.xml)r   r   isdirsortedlistdirendswith)r9   r   r      && r;   _loader_config_file_generatorZ&Firewall._loader_config_file_generator  sL     ww}}T""rzz$/0H$$V,,N 1s   A-A/c                T   V P                  V4       EF  p\        P                  ! R V\        P                  V4       \        W!4      pVP                  V P                  P                  4       9   db   V P                  P                  VP                  4      p\        P                  ! RVP                  \        P                  VP                  4       M6VP                  P                  \        P                  4      '       d   RVn        V P                  P                  V4       EK  	  R# )zLoading service file '%s%s%s'Overrides '%s%s%s'TN)r   r   r   r   r   r   r   r   r   r   r   r   
startswithETC_FIREWALLDr   r   r9   r   r   r   orig_obj   &&   r;   r   ZFirewall._loader_services  s    ::4@HJJ6bffhO 0Cxx4;;3355;;22388<

((--ARAR $$V%9%9::"KK##C( Ar=   c                r   )zLoading ipset file '%s%s%s'r   TN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r;   r   ZFirewall._loader_ipsets	  s    ::4@HJJ4dBFFHMx.Cxx4;;1133;;00:

((--ARAR $$V%9%9::"KK!!#& Ar=   c                r   )zLoading helper file '%s%s%s'r   TN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r;   r   ZFirewall._loader_helpers  s    ::4@HJJ5tRVVXN/Cxx4;;2244;;11#((;

((--ARAR $$V%9%9::"KK""3' Ar=   c                r   )zLoading policy file '%s%s%s'r   TN)r   r   r   r   r   r    r   r   r   r   r   r   r   r   r   Zadd_policy_objectr   r   r;   r   ZFirewall._loader_policies'  s    ::4@HJJ5tRVVXN/Cxx4;;99;;;;88B

((--ARAR $$V%9%9::"KK))#. Ar=   c                r   )zLoading icmptype file '%s%s%s'r   TN)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r;   r   ZFirewall._loader_icmptypes6  s    ::4@HJJ7rvvxP!(1Cxx4;;4466;;33CHH=

((--ARAR $$V%9%9::"KK$$S) Ar=   c                s   \         P                  P                  V4      '       g   R # \        \         P                  ! V4      4       EF  pVP                  R4      '       gn   VP                  \        P                  4      '       dG   \         P                  P                  V: RV: 24      '       d   V P                  V: RV: 2RR7       K  V: RV: 2p\        P                  ! RV4       \        W1VR7      pV'       dg   \         P                  P                  V4      : R\         P                  P                  V4      ^ R : 2Vn        VP                  VP                  4       VP                  V P                  P!                  4       9   db   V P                  P#                  VP                  4      p\        P                  ! RVP                  \         P$                  VP&                  4       M6VP                  P                  \        P                  4      '       d   RVn        V P                  P+                  V4       EK  	  R # )	Nr   r   T)r   zLoading zone file '%s')Zno_check_namer   i)r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )r9   r   r   r   r   r   r   s   &&&    r;   r   ZFirewall._loader_zonesE  s   ww}}T""rzz$/0H$$V,,??6#7#788RWW]]#X.> > &&$'A4&P"H-DJJ/6hGDC GG$$T*GG$$X.q4 sxx(xx4;;0022;;//9

((--ARAR $$V%9%9::"KK  %? 1r=   c                s   V P                   P                  4        V P                  P                  4        V P                  P                  4        V P                  P                  4        V P
                  P                  4        V P                  P                  4        V P                  P                  4        V P                  P                  4        V P                  P                  4        V P                  4        R # r&   )r2   r   r3   r4   r   r6   r   r5   r7   r(   r8   rM   rN   r;   r   ZFirewall.cleanupj  s    		

$$&r=   c                sh   V P                   '       g   V P                  '       d<   V P                  4        V P                  P                  4        V P	                  R 4       V P
                  '       d1   \        P                  ! R4       V P                  P                  4        V P                  4        R# )r   z!Unloading firewall kernel modulesN)r)   rG   r   r   r   rH   r   r   r1   r   r   rM   rN   r;   stopZFirewall.stopv  sp    }}}###



  ")+++

>?$$<<>r=   c                sj   ^ pRp\        V4       EF  w  rVV'       d   V P                  P                  V4      w  rxM8V P                  V,          ^8  d   ^ pMV P                  P	                  V4      w  rxV^ 8w  d   V^,          pVX,          pK  V'       d>   V P                  P                  V^ 4       V P                  V;;,          ^,          uu&   K  W`P                  9   g   K  V P                  V;;,          ^,          uu&   V P                  V,          ^ 8X  g   EK  V P                  V EK   	  W43# )r    r   )	enumerater1   Zload_modulerE   Zunload_moduleZ
setdefault)	r9   Z_modulesr^   Z
num_failedZ
error_msgsiZmoduleZstatusr   	   &&&      r;   handle_modulesZFirewall.handle_modules  s   

"8,IA $ 4 4 @ @ H((014F$($8$8$F$Fv$NMV{a
c!
%%00;%%f-2-222))&1Q61,,V49 11&9) -* ''r=   c                s&    VR 8w  d
   RV n         R# R# )r   FN)r[   )r9   backendr:   r;   r   Z!Firewall._select_firewall_backend  s    j $)D! !r=   c                s    V P                  4        F  pVP                  V8X  g   K  Vu # 	  \        \        P                  R V,          4      h)z'%s' backend does not exist)all_backendsr   r$   r#   r   )r9   r   r  r   r;   get_backend_by_nameZFirewall.get_backend_by_name  sB    ((*G||t# + F002ORV2VWWr=   c                s^   V P                   '       d   V P                  # VR 8X  d   V P                  '       d   V P                  # VR8X  d   V P                  '       d   V P
                  # VR8X  d   V P                  '       d   V P                  # \        \        P                  RV,          4      hr   r   ebz-'%s' is not a valid backend or is unavailable)r[   r0   r?   r+   r@   r-   rA   r.   r$   r#   INVALID_IPVr9   ipvr:   r;   get_backend_by_ipvZFirewall.get_backend_by_ipv  s       (((&=T333)))F]t555)))D[T222((( ORU U
 	
r=   c                s"   VR 8X  d   V P                   '       d   V P                  # VR8X  d   V P                  '       d   V P                  # VR8X  d   V P                  '       d   V P
                  # \        \        P                  RV,          4      hr  )	r?   r+   r@   r-   rA   r.   r$   r#   r  r  r:   r;   get_direct_backend_by_ipvZ"Firewall.get_direct_backend_by_ipv  s{    &=T333)))F]t555)))D[T222((( ORU U
 	
r=   c                s    VR 8X  d   V P                   # VR8X  d   V P                  # VR8X  d   V P                  # VR8X  d   V P                  # R# )r*   r,   r   r   F)r?   r@   rA   r[   )r9   r   r:   r;   r   ZFirewall.is_backend_enabled  sU    ;)))[ )))Z(((Z(((r=   c                s    V P                   '       d   R # VR8X  d   V P                  # VR8X  d   V P                  # VR8X  d   V P                  # R# )Tr   r   r  F)r[   r?   r@   rA   r  r:   r;   is_ipv_enabledZFirewall.is_ipv_enabled  sM       &=)))F])))D[(((r=   c                sv   . pV P                   '       d   VP                  V P                  4       V# V P                  '       d   VP                  V P                  4       V P
                  '       d   VP                  V P                  4       V P                  '       d   VP                  V P                  4       V# r&   )	r[   r   r0   r?   r+   r@   r-   rA   r.   r9   r      & r;   enabled_backendsZFirewall.enabled_backends  s       OOD112  %%% 6 67%%% 6 67$$$ 5 56r=   c                sr   . pV P                   '       d   VP                  V P                  4       V P                  '       d   VP                  V P                  4       V P
                  '       d   VP                  V P                  4       V P                  '       d   VP                  V P                  4       V# r&   )	r?   r   r+   r@   r-   rA   r.   r[   r0   r  r  r;   r  ZFirewall.all_backends  s    !!!OOD223!!!OOD223   OOD112   OOD112r=   c                sr    V P                  4        F"  pVP                  W"P                  4       4       K$  	  R # r&   )r  	add_rulesZbuild_default_tables)r9   rb   r  r   r;   r   ZFirewall.apply_default_tables  s,    ,,.G!!'+G+G+IJ /r=   c                s   V P                  4        F/  pVP                  V P                  4      pVP                  W#4       K1  	  V P	                  R 4      '       dd   V P                  R 4      pRVP                  4       9   d>   V P                  R8w  d-   VP                  V P                  4      pVP                  WC4       V P	                  R 4      '       d8   V P                  '       d$   XP                  4       pVP                  WC4       R# R# R# )r   Zrawr   N)r  Zbuild_default_rulesrL   r  r  r
  r   rI   Zbuild_rpfilter_rulesrT   Zbuild_rfc3964_ipv4_rules)r9   rb   r  rulesZipv6_backendr   r;   r   ZFirewall.apply_default_rules  s    ,,.G//0@0@AE!!'1 / v&&226:L99;;&&$.(==d>N>NOE)),>v&&4+=+=+= 99;E!!,6 ,>&r=   c                sn    V P                   '       d#   V P                  P                  4       '       g   R # R# )TF)r[   r5   Zhas_runtime_configurationrM   rN   r;   may_skip_flush_direct_backendsZ'Firewall.may_skip_flush_direct_backends  s&       )N)N)P)Pr=   c                s   V P                  V4      ;_uu_ 4       pV P                  4        F:  pW0P                  4       9   d   K  VP                  4       pVP	                  W44       K<  	  R R R 4       R #   + '       g   i     R # ; ir&   )rv   r  r  build_flush_rulesr  r9   rd   rb   r  r  r   r;   flush_direct_backendsZFirewall.flush_direct_backends  se    ""?33{,,.3355113%%g5	 / 4333s   AA33B	c                s^   V P                  V4      ;_uu_ 4       p\        P                  ! R 4       V P                  4       '       g   V P	                  VR7       V P                  4        F$  pVP                  4       pVP                  W44       K&  	  RRR4       R#   + '       g   i     R# ; i)zFlushing rule setr   N)rv   r   r   r  r  r  r  r  r  r   r;   r   ZFirewall.flush  s    ""?33{JJ*+6688**;*G002113%%g5 3 4333s   A7BB,	c                sR    Vf   VR8X  d   RMRpRVRVRV/pVP                  W#4      # )Nr   DROPZINPUTZOUTPUTZFORWARD)Zbuild_set_policy_rules)r9   r  r7   policy_detailsZdps   &&&& r;   _set_policy_build_rulesZ Firewall._set_policy_build_rules!  s?    !#x/VB"2N
 --fEEr=   c           
     sX   V P                  V4      ;_uu_ 4       p\        P                  ! R TVR8X  d   R\        P                  ! V4       R2MR4       V P                  4        F&  pV P                  WQV4      pVP                  WV4       K(  	  RRR4       R#   + '       g   i     R# ; i)zSetting policy to '%s'%sr  z (ReloadPolicy=r>   r   N)rv   r   r   r   Z_unparse_reload_policyr  r  r  )r9   r7   r  rd   rb   r  r  s   &&&&   r;   r   ZFirewall.set_policy,  s    ""?33{JJ*V# "."G"G"W!XXYZ  00244WnU%%g5 3 4333s   A4BB)	c                s    V'       g   R # V P                  V4      pV'       g"   \        \        P                  RV,          4      hV P	                  V4      '       g   R # VP                  W P                  4      # )r   '%s' is not a valid backend)r  r$   r#   r  r   set_rulerL   )r9   backend_nameruler  r   r;   r  ZFirewall.rule=  sf    **<8""$AL$P  &&|44&6&677r=   c                sL   \        \        R V4      4      pV P                  V4      pV'       g"   \        \        P
                  RV,          4      hV P                  V4      '       g   R # V P                  '       g6   VP                  '       d$   VR8X  dO   V P                  P                  '       g3   \        V4       F!  w  rV VP                  W`P                  4       K#  	  R # VP-                  W0P                  4       R #   \         d   p\        P                   ! \"        P$                  ! 4       4       \        P&                  ! T4       \)        TR T 4       FA  p TP                  TP+                  T4      T P                  4       K1    \         d     K?  i ; i	  ThR p?ii ; i)Nr  r   )listr   r  r$   r#   r  r   rK   r   r.   r   r   r  rL   r   r   r   ri   Z
format_excr   ZreversedZreverse_ruleZ	set_rules)	r9   r  r  Z_rulesr  r   r  r   Zrruler   r;   r  ZFirewall.rulesL  s[   fT5)***<8""$AL$P  &&|44 """111
*--DDD %V,$$T+;+;< -  f&6&67 ! JJy3356IIcN!)&!*!5!#,, ' 4 4U ;T=M=M  ) ! ! "6 Is=   C??F#
AF+FFF	FF	FF#c                s\    V P                   '       d   \        \        P                  4      hR # r&   )rC   r$   r#   Z
PANIC_MODErM   rN   r;   check_panicZFirewall.check_panict  s!    ;;; 1 122 r=   c                sz    TpW P                   P                  4       9  d   \        \        P                  V4      hV# r&   )r7   Zget_policiesr$   r#   ZINVALID_POLICY)r9   r7   Z_policyr   r;   check_policyZFirewall.check_policyx  s2    ++2244 5 5w??r=   c                s    TpV'       d   VR 8X  d   V P                  4       pW P                  P                  4       9  d   \        \        P
                  V4      hV# )r   )get_default_zoner4   r   r$   r#   r   r9   r4   Z_zoner   r;   
check_zoneZFirewall.check_zone~  sI    ))+E		++-- 3 3U;;r=   c                r    \         P                  ! V4      '       g   \        \        P                  V4      hR # r&   )r   ZcheckInterfacer$   r#   ZINVALID_INTERFACE)r9   	interfacer:   r;   check_interfaceZFirewall.check_interface  s+    ''	22 8 8)DD 3r=   c                <    V P                   P                  V4       R # r&   )r3   check_service)r9   r3   r:   r;   r'  ZFirewall.check_service  s    ""7+r=   c                r#  r&   )r   
check_portr$   r#   ZINVALID_PORT)r9   Zportr:   r;   r(  ZFirewall.check_port  s+    ##D)) 3 3T:: *r=   c                s    V'       g   \        \        P                  4      hVR9  d"   \        \        P                  RV,          4      hR# )tcpz''%s' not in {'tcp'|'udp'|'sctp'|'dccp'}N)r)  ZudpZsctpZdccp)r$   r#   ZMISSING_PROTOCOLZINVALID_PROTOCOL)r9   Zprotocolr:   r;   check_tcpudpZFirewall.check_tcpudp  sB     7 78899''9HD  :r=   c                r#  r&   )r   ZcheckIPr$   r#   INVALID_ADDR)r9   Zipr:   r;   check_ipZFirewall.check_ip  s+      $$ 3 3R88 %r=   c                s2   VR 8X  d9   \         P                  ! V4      '       g   \        \        P                  V4      hR# VR8X  d9   \         P
                  ! V4      '       g   \        \        P                  V4      hR# \        \        P                  R4      h)r   r   z'%s' not in {'ipv4'|'ipv6'}N)r   ZcheckIPnMaskr$   r#   r+  ZcheckIP6nMaskr  )r9   r	  Zsourcer   r;   check_addressZFirewall.check_address  sx    &=))&11#F$7$7@@ 2F]**622#F$7$7@@ 3   2 24QRRr=   c                r&  r&   )r2   check_icmptype)r9   Zicmpr:   r;   r.  ZFirewall.check_icmptype  s    $$T*r=   c                s    \        V\        4      '       g   \        V: R \        V4      : R24      h\        V4      ^ 8  d"   \	        \
        P                  RV,          4      hR# )z is z, expected intz#timeout '%d' is not positive numberN)
isinstanceintZ	TypeErrortyper$   r#   INVALID_VALUE)r9   Ztimeoutr:   r;   check_timeoutZFirewall.check_timeout  sR    '3''gOPPw<!$$&Kg&U  r=   c                sF   \        V 4       V P                  pV P                  P                  4       pV P                  pV P
                  pV'       gu   / pV P                  P                  4        F*  pV P                  P                  V4      P                  Wg&   K,  	  V P                  P                  4       pV P                  4       p	. p
V P                  P                  4        F-  pV
P                  V P                  P                  V4      4       K/  	  V'       gC   \         P"                  ! V P$                  P'                  R 4      4      pV P)                  RVR7       V P+                  4        V P-                  4        Rp V P/                  RVR7       V'       dz   V
 Fs  pV P                  P3                  VP4                  4      '       d   K0  V P6                  '       g   KD  V'       d   KN  V P8                  P;                  VP4                  4       Ku  	  V'       Eg   V P                  4       pVX	8w  dQ   VX9  d   / VV&   Wi,           F8  pVV P<                  9   g   K  Wi,          V,          VV,          V&   Wi,          V K:  	  V P                  P                  4        FP  pVX9   d0   Wg,           F  pV P                  P?                  VV4       K!  	  Wg K9  \@        PB                  ! RV4       KR  	  \E        X4      ^ 8  d:   \G        VPI                  4       4       F  p\@        PB                  ! RV4       Wg K  	  ?V
 F  pV P                  P3                  VP4                  4      '       d=   VPJ                   F*  p V P                  PM                  VP4                  V4       K,  	  Kj  V P                  PW                  V4       V P                  PY                  VP4                  4       K  	  V P                  P[                  X4       \]        4       pV'       dZ   V P                  P                  4       R.,            F3  p\_        V4       F!  pV P                  P?                  VVVR	7       K#  	  K5  	  W n        V P                  '       g   V P)                  R
4       V P                  '       Eg   W@P                  8w  d   VR8X  dK   V Pa                  V Pb                  R
4       F)  pV Pb                  Pe                  VV Pf                  4       K+  	  MV Pa                  V Ph                  R
4       F)  pV Ph                  Pe                  VV Pf                  4       K+  	  V Pj                  '       dJ   V Pa                  V Pl                  R
4       F)  pV Pl                  Pe                  VV Pf                  4       K+  	  V'       d
   RV n7        VhRV n7        R#   \0         d   pTp Rp?ELMRp?ii ; i  \N         d.   pTPP                  \R        PT                  8w  d   Th Rp?EK  Rp?ii ; i)ZReloadPolicyr  )r  NTr   zNew zone '%s'.z(Lost zone '%s', zone interfaces dropped.r   )Zsenderr   r   r   r   )8r!   rC   r   Zomit_native_ipsetrR   rS   r4   r   r   Z
interfacesr5   Zget_runtime_configr   r   r   r   r   Z_parse_reload_policyr(   r   r   r   r   r   r   Zquery_ipsetr   rJ   r/   Zset_destroyrP   Zchange_zone_of_interfacer   r   Zlenr  keysZentriesZ	add_entryr$   r   r#   ALREADY_ENABLEDr   Zapply_ipsetZ
set_configr   r   r  r0   r  rL   r+   r@   r-   rB   )r9   r   rC   Z_omit_native_ipsetZold_firewall_backendZ	flush_allZ_zone_interfacesr4   Z_direct_configZ_old_dzZ_ipset_objsZ_nameZreload_policyZstart_exceptionr   r   Z_new_dzZifaceZinterface_idZentryr   Znm_bus_namer$  r  s   &&                      r;   r   ZFirewall.reload  s   T"!ZZ99;  $55--	!		++-)-););D)A)L)L & . "[[;;=N++-GZZ**,Etzz33E:; - *??$$((8M OOF=OA

	 KKtTK: "zz--chh77 )))2D2D**66sxx@ # y ++-G'! "2202$W- .66E = == <L;T!<(1%8 -5e< 7 		++-++(8(>(>		::4N )? ).II.5 . #$q( !1!6!6!89DIIH$O(. : ! #::))#((33!$* JJ005A "- JJ((-JJ**3884 # KK"">2 &'		++-44!:4!@III66i 7  "A 5 {{{OOH% {{{37M7MM#z1 88))8D ))2249I9IJ
 !88**HD **33D$:J:JK ))) $ < <..! ..77d>N>NO!
 "DK!!#DKM  	   O	 p  - *"xx6+A+AA&)	  B*s0    W <&W(W%W  W%(X 3!XX c                rf   r&   )rB   rM   rN   r;   	get_stateZFirewall.get_stateC      {{r=   c                s    V P                   '       d   \        \        P                  R 4      h V P	                  R4       RT n         R#   \
         d    p\        \        P                  T4      hRp?ii ; i)zpanic mode already enabledZPANICNT)rC   r$   r#   r5  r   r   COMMAND_FAILEDr9   r   r  r;   enable_panic_modeZFirewall.enable_panic_modeH  s^    ;;; 6 68TUU	<OOG$   	< 5 5s;;	<   A A2A--A2c                s    V P                   '       g   \        \        P                  R 4      h V P	                  R4       RT n         R#   \
         d    p\        \        P                  T4      hRp?ii ; i)zpanic mode is not enabledr   NF)rC   r$   r#   ZNOT_ENABLEDr   r   r8  r9  r  r;   disable_panic_modeZFirewall.disable_panic_modeR  s^    {{{ 2 24OPP	<OOH%   	< 5 5s;;	<r;  c                rf   r&   )rC   rM   rN   r;   query_panic_modeZFirewall.query_panic_mode\  r7  r=   c                rf   r&   )rL   rM   rN   r;   get_log_deniedZFirewall.get_log_denieda  s    r=   c           	     s   V\         P                  9  dA   \        \        P                  R V: RRP                  \         P                  4      : R 24      hWP                  4       8w  d?   Wn        V P                  P                  RV4       V P                  P                  4        R# \        \        P                  V4      h)r   z', choose from 'z','r   N)r   ZLOG_DENIED_VALUESr$   r#   r2  Zjoinr>  rL   r(   r   writeZALREADY_SET)r9   r   r:   r;   set_log_deniedZFirewall.set_log_deniedd  s    000$$%**V%=%=>@  ''))$  $$[%8  &&( 2 2E::r=   c                rf   r&   )rD   rM   rN   r;   r   ZFirewall.get_default_zoneu  s    !!!r=   c                s    V P                  V4      pW P                  8X  d   \        \        P                  V4      hV P
                  P                  R V4       V P
                  P                  4        R# )r   N)r"  rD   r$   r#   ZZONE_ALREADY_SETr(   r   r?  r!  r   r;   set_default_zoneZFirewall.set_default_zonex  sW    %&&& 7 7??  6""$r=   c                s    VP                  4       pVP                  4        FI  w  rEV'       g-   \        V\        4      '       g   \        V\        4      '       d   WSV&   K?  WC9   g   KG  W4 KK  	  V# r&   )r   r   r/  boolr0  )r9   Z	permanentr~   Zcombinedkeyr   s   &&&   r;   'combine_runtime_with_permanent_settingsZ0Firewall.combine_runtime_with_permanent_settings  sU    >>#!--/JC
5$//:eS3I3I % M * r=   c           
     s   R F8  pW29   g   K  W#,           Uu. uF  p\        \        VR7      4      NK  	  upW#&   K:  	  / p/ p\        VP                  4       4      \        VP                  4       4      ,           EFI  pWr9   g   K  \	        W',          \
        4      '       di   \        Wq9   d	   W,          M. 4      p\        \        W',          4      V,
          4      WW&   \        V\        W',          4      ,          V,          4      Wg&   K  \	        W',          \        4      '       g   \	        W',          \        4      '       dL   W,          '       g   W',          '       d   RWW&   K  W,          '       d   W',          '       g   RWg&   EK  EK  EK  \        \        P                  RP                  \        W',          4      V4      4      h	  WV3# u upi )
rich_rules)rule_strTFz Unhandled setting type {} key {})rE  Z	rules_str)r   r"   r   r4  r/  r  rB  r0  r$   r#   ZINVALID_SETTINGr   r1  )	r9   Zold_settingsZnew_settingsZrich_keyrF  Zadd_settingsZremove_settingsrC  Zoldr   r;   get_added_and_removed_settingsZ'Firewall.get_added_and_removed_settings  s   3H' %1$:*$: 	845$:*& 4 |((*+c,2C2C2E.FFFC"l/6633Fl/BOC(,S1B-Cc-I(JL%+/s<;L7M1MQT0T+UO(   1488J %s= = (,,1B1B,0)%**<3D3D/4, 4E* (..:AA !23S ! G. ..=*s   G),rU   rD   rP   rR   r(   rS   rK   rI   rL   rF   rE   rW   rV   rX   rQ   r)   rC   rT   rB   rY   rH   rG   r   r5   r.   rA   r6   r2   r+   r?   r-   r@   r   r/   rJ   rZ   r\   r]   r1   r0   r[   r7   r3   r4   )Fr&   )FF)NN)Jrl   rm   rn   ro   r<   rO   r8   rv   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r  r
  r  r   r  r  r  r   r   r  r  r   r  r   r  r  r  r  r"  r%  r'  r(  r*  r,  r-  r.  r3  r   r6  r:  r<  r=  r>  r@  r   rA  rD  rG  rp   rq   rr   rt   r;   r%   r%   6   s    .
&&)PAt A&FP PR V VT>dLkLZ9=.5`$)4V"'RN<R*#&J)'(/*#&J
(4*X
	
		
K7 6
6	F6"8$8P3E,;9S+J$\

 ;""%"/ "/r=   r%   )Er   r   r   r   ri   Ztypingr   r   Zfirewallr   r   Zfirewall.corer   r   r   r   r	   Zfirewall.core.fw_icmptyper
   Zfirewall.core.fw_servicer   Zfirewall.core.fw_zoner   Zfirewall.core.fw_directr   Zfirewall.core.fw_configr   Zfirewall.core.fw_ipsetr   Zfirewall.core.fw_transactionr   Zfirewall.core.fw_helperr   Zfirewall.core.fw_policyr   Zfirewall.core.fw_nmr   r   Zfirewall.core.loggerr   Zfirewall.core.io.io_objectr   Zfirewall.core.io.firewalld_confr   Zfirewall.core.io.directr   Zfirewall.core.io.servicer   Zfirewall.core.io.icmptyper   Zfirewall.core.io.zoner   r   Zfirewall.core.io.ipsetr   Zfirewall.core.ipsetr   Zfirewall.core.io.helperr   Zfirewall.core.io.policyr    Zfirewall.core.io.functionsr!   Zfirewall.core.richr"   r#   Zfirewall.errorsr$   r%   rk   r=   r;   <module>rH     s    
 
       # " "  ! 6 4 . 2 2 0 < 2 2 J $ 0 : * 3 5 3 / + 1 1 ; (  )z/ z/r=   