+
    i3 c                   s    ^ RI t ^ RIt^ RIHt ^ RIHtHtHtHtH	t	H
t
HtHtHtHtHt ^ RIHtHtHtHtHtHtHtHtHtHtHt ^ RIHt ^ RIHt ^ RI H!t!  ! R R	4      t"R# )
    N)log)portStrcheckIPnMaskcheckIP6nMaskcheckProtocolenable_ip_forwardingcheck_single_addressportInPortRangeget_nf_conntrack_short_namecoalescePortRangebreakPortRangecheckTcpMssClamp)	Rich_RuleRich_AcceptRich_Service	Rich_PortRich_ProtocolRich_MasqueradeRich_ForwardPortRich_SourcePortRich_IcmpBlockRich_IcmpTypeRich_Tcp_Mss_Clamp)errors)FirewallError)SOURCE_IPSET_TYPESc                   s~  a  ] tR t^'t o R tR tR tR tR tR t	R t
R tR	 tR
 tR tR tR tR tRR ltR tRR ltR tR tR tR tRR ltR tR tR tR tR tR tR t RR lt!R  t"R! t#R" t$R# t%R$ t&R% t'R& t(RR' lt)R( t*R) t+R* t,R+ t-R, t.R- t/R. t0RR/ lt1R0 t2R1 t3R2 t4R3 t5R4 t6R5 t7R6 t8R7 t9R8 t:RR9 lt;R: t<R; t=R< t>R= t?R> t@R? tAR@ tBRA tCRRB ltDRC tERD tFRE tGRF tHRG tIRH tJRRI ltKRJ tLRK tMRL tNRM tORN tPRRO ltQRP tRRQ tSRR tTRS tURRT ltVRRU ltWRRV ltXRW tYRRX ltZRY t[RRZ lt\R[ t]R\ t^R] t_RR^ lt`R_ taR` tbRa tcRb tdRc teRRd ltfRe tgRf thRg tiRh tjRi tkRj tlRk tmRl tnRm toRn tpRo tqRp trRRq ltsRRr lttRs tuRt tvRu twRv txRRw ltyRx tzRy t{RRz lt|RR{ lt}RR| lt~RR} ltR~ tR tRR ltRtV tR# )FirewallPolicyc                s.    Wn         / V n        / V n        R # N)_fw_chains	_policies)selfZfw   &&</usr/lib/python3.14/site-packages/firewall/core/fw_policy.py__init__ZFirewallPolicy.__init__(   s        c                sZ    V P                   : R V P                  : RV P                  : R2# )Z(, Z))Z	__class__r   r   r       &r"   __repr__ZFirewallPolicy.__repr__-   s    #~~t||T^^LLr$   c                sn    V P                   P                  4        V P                  P                  4        R # r   )r   Zclearr   r&   r'   r"   cleanupZFirewallPolicy.cleanup0   s"    r$   c                s    V P                   P                  ! V/ VB pVP                  '       d0   VP                  P	                  V P                   P
                  4       V# r   )r   with_transactionZis_temporarytransactionZadd_prefull_check_config)r    argsZkwargsZctxs   &*, r"   r*   ZFirewallPolicy.with_transaction6   sH    hh''88OO##DHH$>$>?
r$   c                sH    \        V P                  P                  4       4      # r   )sortedr   Zkeysr&   r'   r"   get_policiesZFirewallPolicy.get_policies>   s    dnn))+,,r$   c                s    . pV P                  4        F9  pV P                  V4      pVP                  '       d   K(  VP                  V4       K;  	  \	        V4      # r   )r/   
get_policyderived_from_zoneappendr.   )r    policiespp_obj   &   r"   "get_policies_not_derived_from_zoneZ1FirewallPolicy.get_policies_not_derived_from_zoneA   sM    ""$AOOA&E***" % hr$   c                s   . pV P                  4        F  pV P                  V4      p\        VP                  4      \        V P                  P
                  P                  4       R R.,           4      ,          '       g   Kl  \        VP                  4      \        V P                  P
                  P                  4       R R.,           4      ,          '       g   K  VP                  V4       K  	  V# HOSTANY)	r7   r0   setingress_zonesr   zoneget_active_zonesegress_zonesr2   )r    Zactive_policiespolicyr5   r6   r"   )get_active_policies_not_derived_from_zoneZ8FirewallPolicy.get_active_policies_not_derived_from_zoneI   s    ==?FOOF+EE''(dhhmm446&%HIJ J E&&'dhhmm446&%HIJ J  &&v. @ r$   c                s^    V P                   P                  V4      pV P                  V,          # r   )r   check_policyr   )r    r@   r4      && r"   r0   ZFirewallPolicy.get_policyX   s%    HH!!&)~~a  r$   c                s6    WP                   VP                  &   R # r   )r   name)r    objr!   r"   
add_policyZFirewallPolicy.add_policy\   s    #&sxx r$   c                s    V P                   V,          pVP                  '       d3   V P                  4       ;_uu_ 4       pV P                  W4       R R R 4       V P                   V R #   + '       g   i     L; ir   )r   appliedr*   unapply_policy_settings)r    r@   rE   r+      &&  r"   remove_policyZFirewallPolicy.remove_policy_   sR    nnV$;;;&&((K,,VA )NN6" )(s   A''A7	c                s    V P                  4        Fh  pV P                  V,          pVP                  '       d   K*  W P                  4       9   g   K@  \        P
                  ! R V4       V P                  W!4       Kj  	  R# )zApplying policy '%s'N)r/   r   r1   rA   r   Zdebug1apply_policy_settings)r    r+   r@   r5   rI   r"   apply_policiesZFirewallPolicy.apply_policiesf   s^    '')FNN6*E&&&GGII

16:**6? *r$   c                s8    V P                   V,          pW#n        R # r   )r   rG   )r    r@   rG   rE      &&& r"   set_policy_appliedZ!FirewallPolicy.set_policy_appliedo   s    nnV$r$   c           	     s   V P                   P                  V4      pV P                  V,          pV'       d   VP                  '       g   V'       g   VP                  '       g   R # V'       d   RVn        V'       dR   VP                  '       g   V P                  V4      MV P                  V4       F  w  rgV P                  VRWgV4       K  	  R EF  p\        V P                  V4      V4      p	\        V	\        4      '       d&   V'       d	   V	'       g   V'       g	   V	'       g   KW  V	.p	VR8X  d   \        V	4      p	V	 EF]  p
VR8X  d   V P                  WW4       K  VR
8X  d   K(  VR8X  d   V P                  ! WV.V
O5!   KF  VR8X  d   V P                  WW4       Ka  VR8X  d%   V P!                  WV
^ ,          V
^,          V4       K  VR	8X  d   V P#                  WW4       K  VR8X  d%   V P%                  WV
^ ,          V
^,          V4       K  VR8X  d   V P'                  WV4       K  VR8X  d   V P)                  WW4       EK	  VR8X  d+   VP                  '       g   V P+                  WW4       EK7  EK:  VR8X  d   EKD  \,        P.                  ! RVVV
4       EK`  	  EK  	  V'       g[   VP                  '       g   V P                  V4      MV P                  V4       F  w  rgV P                  VRWgV4       K  	  RVn        R # R # )NTservicesports
masqueradeforward_portssource_portsicmp_blocksrules	protocolsicmp_block_inversionr<   r?   z5Policy '%s': Unknown setting '%s:%s', unable to applyF)rO   rP   rQ   rR   rS   rT   rU   rV   rW   r<   r?   )r   rB   r   rG   r1   %_get_table_chains_for_policy_dispatch#_get_table_chains_for_zone_dispatchgen_chain_rulesZgetattrr0   
isinstanceZboolr.   _icmp_block_forward_port_service_port	_protocol_source_port_masquerade_FirewallPolicy__rule_ingress_zoner   warning)r    enabler@   r+   _policyrE   tablechainkeyZ	args_listr-   s   &&&&       r"   _policy_settingsZFirewallPolicy._policy_settingss   s   ((''/nnW%s{{{F3;;;CK ,,, ::6B==fEF 
 $$VT5M	F
C   7=I)T**Iv)&K	g~"9-	!-'$$VdH22O+&&vKdKJ&MM&4EG^JJvQa+NK'NN6DFN*%%ftAwQUL($$VkBG^KKCO+000**6DN 1N*KKR	5 ")
j  ,,, ::6B==fEF 
 $$VUE+N	F
  CK r$   c                *    V P                  R W4       R# TNrk   r    r@   r+      &&&r"   rK   Z$FirewallPolicy.apply_policy_settings   s    dF8r$   Nc                s    WP                  4       9   d6   V P                  V4      ;_uu_ 4       pV P                  W4       R R R 4       R # R #   + '       g   i     R # ; ir   )rA   r*   rK   r    r@   use_transactionr+   rM   r"   try_apply_policy_settingsZ(FirewallPolicy.try_apply_policy_settings   sJ    CCEE&&77;**6? 87 F777   AA	c                rl   FNrn   ro   rp   r"   rH   Z&FirewallPolicy.unapply_policy_settings   s    eV9r$   c                s    WP                  4       9  d6   V P                  V4      ;_uu_ 4       pV P                  W4       R R R 4       R # R #   + '       g   i     R # ; ir   )rA   r*   rH   rq   rM   r"   try_unapply_policy_settingsZ*FirewallPolicy.try_unapply_policy_settings   sJ    GGII&&77;,,VA 87 J777rt   c                s@    V P                  V4      P                  4       # r   )r0   Zexport_config_dictr    r@   r!   r"   get_config_with_settings_dictZ,FirewallPolicy.get_config_with_settings_dict   s    v&99;;r$   c                sh  a  RV 3R llpV 3R lpRS P                   S P                  3RS P                  S P                  3RS P                  S P
                  3RS P                  S P                  3RS P                  S P                  3R	WE3R
S P                  S P                  3RS P                  S P                  3RS P                  S P                  3RS P                   S P"                  3/
pS P%                  V4      p\&        P&                  ! V4      pVP)                  VS P*                  P-                  4       4       S P*                  P/                  RV./4       S P1                  V4      p	S P*                  P3                  W4      w  rV F  p\5        W,          \6        4      '       dV   W,           FG  p\5        V\8        4      '       d   Wl,          ^,          ! V.VO5!   K2  Wl,          ^,          ! W4       KI  	  Kt  Wl,          ^,          ! V4       K  	  V
 F  p\5        W,          \6        4      '       d]   W,           FN  p\5        V\8        4      '       d   Wl,          ^ ,          ! V.VO5R^ RV/  K6  Wl,          ^ ,          ! W^ VR7       KP  	  K{  Wl,          ^ ,          ! V^ VR7       K  	  R# )r    Nc                 sD   < SP                  V \        VR 7      W#R7       R# )rule_strtimeoutsenderN)add_ruler   )r@   rz   r|   r}   r    s   &&&&r"   add_rule_wrapperZFFirewallPolicy.set_config_with_settings_dict.<locals>.add_rule_wrapper   s     MM	84g  r$   c                 s@   < SP                  V \        VR 7      4       R# )ry   N)remove_ruler   )r@   rz   r    s   &&r"   remove_rule_wrapperZIFirewallPolicy.set_config_with_settings_dict.<locals>.remove_rule_wrapper   s    VY%ABr$   rO   rP   rT   rQ   rR   Z
rich_rulesrV   rS   r<   r?   r3   r|   r}   r{   r    N)add_serviceremove_serviceadd_portremove_portadd_icmp_blockremove_icmp_blockadd_masqueraderemove_masqueradeadd_forward_portremove_forward_portadd_protocolremove_protocoladd_source_portremove_source_portadd_ingress_zoneremove_ingress_zoneadd_egress_zoneremove_egress_zoner0   copyZimport_config_dictr   Zget_all_io_objects_dictr,   rx   Zget_added_and_removed_settingsr[   listZtuple)r    r@   Zsettingsr}   r   r   Zsetting_to_fnZold_objZ	check_objZold_settingsZadd_settingsZremove_settingsrj   r-   s   f&&&          r"   set_config_with_settings_dictZ,FirewallPolicy.set_config_with_settings_dict   sT   	
	C ))4+>+>?dmmT%5%56D//1G1GH4..0F0FGd33T5M5MN+A$++T-A-ABT1143J3JKd33T5M5MNT1143J3JK
 //&)IIg&	$$Xtxx/O/O/QR""J#<=99&A*.((*Q*Q+
' #C/.55+00D!$..%*1-f<t<%*1-f;	 1 "1%f- #  C,+T22(--D!$..%*1-fVtVQVvV%*1-fAfU	 . "1%faG  r$   c                    V'       g   \        \        P                  4      hVR9  d   V P                  P	                  V4       R# R# r9   Nr8   r   r   ZINVALID_ZONEr   Z
check_zoner    r=   r!   r"   check_ingress_zoneZ!FirewallPolicy.check_ingress_zone  5     3 344&HH% 'r$   c                (    V P                  V4       V# r   )r   r   r!   r"   Z__ingress_zone_idZ FirewallPolicy.__ingress_zone_id  s    %r$   c                   V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          pV P                  V4      pWvP                  9   d$   \        \        P                  R V: RV: R 24      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RWRV4       V P                  WgW44       VP                  V P                  Wg4       VP                  '       g   V P!                  WR7       RRR4       R#   + '       g   i     R# ; i'' already in 'T)rr   N)r   rB   check_timeoutcheck_panicr    _FirewallPolicy__ingress_zone_idr<   r   r   ALREADY_ENABLEDr*   rG   rd   &_FirewallPolicy__register_ingress_zoneadd_fail(_FirewallPolicy__unregister_ingress_zoners   	r    r@   r=   r|   r}   rg   _objzone_idr+   	   &&&&&    r"   r   ZFirewallPolicy.add_ingress_zone  s    ((''/w'~~g&((.(((&&$(P  ""$$|||""4D((H  !?!?O<<<..v.S %$$$    A8EE	c                <    VP                   P                  V4       R # r   )r<   r2   r    r   r   r|   r}      &&&&&r"   Z__register_ingress_zoneZ&FirewallPolicy.__register_ingress_zone/  s    !!'*r$   c                b   V P                   P                  V4      pV P                   P                  4        V P                  V,          pV P	                  V4      pWTP
                  9  d$   \        \        P                  R V: RV: R 24      hV P                  4       ;_uu_ 4       pVP                  '       d@   \        VP
                  4      ^8:  d   V P                  W4       MV P                  RW2V4       VP                  V P                  WE4       RRR4       V#   + '       g   i     T# ; ir   
' not in 'FN)r   rB   r   r   r   r<   r   r   NOT_ENABLEDr*   rG   lenrH   rd   add_postr   r    r@   r=   rg   r   r   r+      &&&    r"   r   Z"FirewallPolicy.remove_ingress_zone2  s    ((''/~~g&((.,,,""$$H  ""$$|||t))*a/00E&&ug[I  !?!?O %  %$    %A.DD.	c                `    W!P                   9   d   VP                   P                  V4       R # R # r   )r<   remover    r   r   rp   r"   Z__unregister_ingress_zoneZ(FirewallPolicy.__unregister_ingress_zoneI  s'    (((%%g. )r$   c                \    V P                  V4      V P                  V4      P                  9   # r   )r   r0   r<   r    r@   r=   rp   r"   query_ingress_zoneZ!FirewallPolicy.query_ingress_zoneM  s'    %%d+tv/F/T/TTTr$   c                8    V P                  V4      P                  # r   )r0   r<   rw   r!   r"   list_ingress_zonesZ!FirewallPolicy.list_ingress_zonesP      v&444r$   c                r   r   r   r   r!   r"   check_egress_zoneZ FirewallPolicy.check_egress_zoneU  r   r$   c                r   r   )r   r   r!   r"   Z__egress_zone_idZFirewallPolicy.__egress_zone_id[  s    t$r$   c                r   r   )r   rB   r   r   r   _FirewallPolicy__egress_zone_idr?   r   r   r   r*   rG   _egress_zone%_FirewallPolicy__register_egress_zoner   '_FirewallPolicy__unregister_egress_zoners   r   r   r"   r   ZFirewallPolicy.add_egress_zone_  s    ((''/w'~~g&''-'''&&$(P  ""$$|||!!${C''wG  !>!>N<<<..v.S %$$$r   c                r   r   )r?   r2   r   r   r"   Z__register_egress_zoneZ%FirewallPolicy.__register_egress_zonev        )r$   c                r   r   )r   rB   r   r   r   r?   r   r   r   r*   rG   r   rH   r   r   r   r   r   r"   r   Z!FirewallPolicy.remove_egress_zoney  s    ((''/~~g&''-+++""$$H  ""$$|||t(()Q.00E%%eWKH  !>!>N %  %$ r   c                r   r   )r?   r   r   rp   r"   Z__unregister_egress_zoneZ'FirewallPolicy.__unregister_egress_zone  '    '''$$W- (r$   c                r   r   )r   r0   r?   r   rp   r"   query_egress_zoneZ FirewallPolicy.query_egress_zone  s'    $$T*doof.E.R.RRRr$   c                r   r   )r0   r?   rw   r!   r"   list_egress_zonesZ FirewallPolicy.list_egress_zones      v&333r$   c                s   V'       g   R # VP                   '       d>   \        VP                   4      '       d   R# \        VP                   4      '       d   R#  R # \        VR4      '       d   VP                  '       d   R# \        VR4      '       dd   VP
                  '       dR   V P                  VP
                  4       V P                  VP
                  4       V P                  VP
                  4      # R # )Nipv4ipv6mac ipset)	Zaddrr   r   Zhasattrr   r   _check_ipset_type_for_source_check_ipset_applied_ipset_family)r    sourcer!   r"   _rule_source_ipvZFirewallPolicy._rule_source_ipv  s    ;;;FKK((v{{++ ,  VU##


VW%%&,,,--fll;%%fll3%%fll33r$   c                s*    V P                  WW44       R # r   )_rule_prepare)r    rf   r@   ruler+   r   r"   Z__ruleZFirewallPolicy.__rule  s    64=r$   c                s   V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          pW&P
                  9   dD   VP                  '       d   VP                  MTp\        \        P                  R V: RV: R 24      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RWRV4       V P                  WbW44       VP                  V P                  Wb4       RRR4       V#   + '       g   i     T# ; ir   r   TN)r   rB   r   r   r   rU   r1   r   r   r   r*   rG   rc   _FirewallPolicy__register_ruler    _FirewallPolicy__unregister_rule)	r    r@   r   r|   r}   rg   r   _namer+   r   r"   r~   ZFirewallPolicy.add_rule  s    ((''/w'~~g&::.2.D.D.DD**'E&&$(N  ""$$|||D'=  W=  !7!7D %  %$ s   AD--D>	c                r   r   )rU   Zadd)r    r   r   r|   r}   r   r"   Z__register_ruleZFirewallPolicy.__register_rule  s    

tr$   c                s(   V P                   P                  V4      pV P                   P                  4        V P                  V,          pW$P                  9  dD   VP
                  '       d   VP
                  MTp\        \        P                  R V: RV: R 24      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RW2V4       VP                  V P                  WB4       RRR4       V#   + '       g   i     T# ; ir   )r   rB   r   r   rU   r1   r   r   r   r*   rG   rc   r   r   )r    r@   r   rg   r   r   r+   r   r"   r   ZFirewallPolicy.remove_rule  s    ((''/~~g&zz!.2.D.D.DD**'E 2 2$PU4VWW""$$|||E7+>  !7!7D %  %$ s   4AD  D	c                r   r   )rU   r   )r    r   r   rp   r"   Z__unregister_ruleZ FirewallPolicy.__unregister_rule  s#    ::JJd# r$   c                s<    W P                  V4      P                  9   # r   )r0   rU   )r    r@   r   rp   r"   
query_ruleZFirewallPolicy.query_rule  s    v.4444r$   c                st    V P                  V4      P                   Uu. uF  p\        V4      NK  	  up# u upi r   )r0   rU   str)r    r@   ZrrC   r"   
list_rulesZFirewallPolicy.list_rules  s/     $ 7 = => =1A =>>>s   5c                <    V P                   P                  V4       R # r   )r   check_servicer    servicer!   r"   r   ZFirewallPolicy.check_service  s    w'r$   c                r   r   )r   r   r!   r"   Z__service_idZFirewallPolicy.__service_id  s    7#r$   c                   V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          pV P                  V4      pWvP                  9   dD   VP                  '       d   VP                  MTp\        \        P                  R V: RV: R 24      hV P                  4       ;_uu_ 4       p	VP                  '       d   V P                  RWRV	4       V P                  WgW44       V	P                  V P                   Wg4       RRR4       V#   + '       g   i     T# ; ir   )r   rB   r   r   r   _FirewallPolicy__service_idrO   r1   r   r   r   r*   rG   r^   !_FirewallPolicy__register_servicer   #_FirewallPolicy__unregister_service)
r    r@   r   r|   r}   rg   r   
service_idr   r+   
   &&&&&     r"   r   ZFirewallPolicy.add_service  s   ((''/w'~~g&&&w/
&.2.D.D.DD**'E&&'5(Q  ""$$|||dGkB##DgF  !:!:DM %  %$     AD>>E	c                r   r   )rO   r2   )r    r   r   r|   r}   r   r"   Z__register_serviceZ!FirewallPolicy.__register_service  s    Z(r$   c                J   V P                   P                  V4      pV P                   P                  4        V P                  V,          pV P	                  V4      pWTP
                  9  dD   VP                  '       d   VP                  MTp\        \        P                  R V: RV: R 24      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RW2V4       VP                  V P                  WE4       RRR4       V#   + '       g   i     T# ; ir   )r   rB   r   r   r   rO   r1   r   r   r   r*   rG   r^   r   r   )r    r@   r   rg   r   r   r   r+      &&&     r"   r   ZFirewallPolicy.remove_service	  s    ((''/~~g&&&w/
]]*.2.D.D.DD**'E""'5$I  ""$$|||eW{C  !:!:DM %  %$    ADD"	c                r   r   )rO   r   )r    r   r   rp   r"   Z__unregister_serviceZ#FirewallPolicy.__unregister_service  s#    &MM  , 'r$   c                r   r   )r   r0   rO   )r    r@   r   rp   r"   query_serviceZFirewallPolicy.query_service"  s'      )T__V-D-M-MMMr$   c                r   r   )r0   rO   rw   r!   r"   list_servicesZFirewallPolicy.list_services%  s    v&///r$   c                s    . pV F:  p V P                   P                  P                  V4      pTP                  T4       K<  	  V#   \         d    \        \        P
                  T4      hi ; ir   )r   helper
get_helperr   r   INVALID_HELPERr2   )r    helpers_helpersr   _helper   &&   r"   get_helpers_for_service_helpersZ.FirewallPolicy.get_helpers_for_service_helpers(  sj    FC((//44V< OOG$   ! C#F$9$96BBCs   %A&A+c                s   . pV F  p V P                   P                  P                  V4      p\        TP                  4      ^8  dO   \        TP                  4      p T P                   P                  P                  T4      pTP                  T4       K  TP                  T4       K  	  V#   \         d    \        \        P
                  T4      hi ; i  \         d+    T'       d   \        P                  ! RT,          4        EK  i ; i)   zHelper '%s' is not available)r   r   r   r   r   r   r   rP   r	   moduler2   r   re   )r    modulesrf   r   r   r   _module_short_namer   r   r"   get_helpers_for_service_modulesZ.FirewallPolicy.get_helpers_for_service_modules2  s     FC33F; 6<< 1$%@%O""hhoo889KLGOOG, '    ! C#F$9$96BBC % $BEW$WXs#   %B-6C-&CD)D
Dc                sr    V P                   P                  V4       V P                   P                  V4       R # r   )r   
check_portcheck_tcpudpr    portprotocolrp   r"   r   ZFirewallPolicy.check_portK  s&    D!h'r$   c                @    V P                  W4       \        VR 4      V3# -r   r   r   rp   r"   Z	__port_idZFirewallPolicy.__port_idO       'c"H--r$   c                `  a V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          p\        \        V3R  lVP                  4      4      pV Fb  p	\        W)^ ,          4      '       g   K  VP                  '       d   VP                  MTp
\        \        P                  RV: RS: RV
: R24      h	  \        Y( UUu. uF  w  rVNK	  	  upp4      w  rV P                  4       ;_uu_ 4       pVP                  '       dQ   V F"  pV P!                  RV\#        VR4      SV4       K$  	  V F"  pV P!                  RV\#        VR4      SV4       K$  	  V FC  pV P%                  VS4      p	V P'                  WyWE4       VP)                  V P*                  Wy4       KE  	  V F1  pV P%                  VS4      p	VP-                  V P*                  Wy4       K3  	  RRR4       V# u uppi   + '       g   i     T# ; i)c                    < V ^,          S8H  # r    xr     &r"   <lambda>Z)FirewallPolicy.add_port.<locals>.<lambda>Y      !A$(2Br$   r   :r   Tr  FN)r   rB   r   r   r   r   filterrP   r   r1   r   r   r   r
   r*   rG   r_   r   _FirewallPolicy__port_id_FirewallPolicy__register_portr    _FirewallPolicy__unregister_portr   r    r@   r  r  r|   r}   rg   r   existing_port_idsport_idr   r_   r`   added_rangesremoved_rangesr+   range   &&&f&&           r"   r   ZFirewallPolicy.add_portS  s   ((''/w'~~g& (BDJJ!OP(GtQZ00262H2H2H..g#**15xG  ) (93DE3D/e53DE(
$ ""$$|||)EJJgwuc':Hk * ,EJJws(;X{ ,
 &..9$$TGD$$T%;%;TK & (..9$$T%;%;TK (! %( / F %$(    :H)C#HH-	c                r   r   )rP   r2   r    r   r  r|   r}   r   r"   Z__register_portZFirewallPolicy.__register_port|  s    

'"r$   c                0  a V P                   P                  V4      pV P                   P                  4        V P                  V,          p\	        \        V3R  lVP                  4      4      pV F  p\        W'^ ,          4      '       g   K   MI	  VP                  '       d   VP                  MTp\        \        P                  RV: RS: RV: R24      h\        Y& U	U
u. uF  w  rV	NK	  	  up
p	4      w  rV P                  4       ;_uu_ 4       pVP                  '       dQ   V F"  pV P                  RV\!        VR4      SV4       K$  	  V F"  pV P                  RV\!        VR4      SV4       K$  	  V FD  pV P#                  VS4      pV P%                  WW^ R4       VP'                  V P(                  WW4       KF  	  V F1  pV P#                  VS4      pVP+                  V P(                  WW4       K3  	  RRR4       V# u up
p	i   + '       g   i     T# ; i)c                 r	  r
  r  r  r  r"   r  Z,FirewallPolicy.remove_port.<locals>.<lambda>  r  r$   r   r  r   Tr  FN)r   rB   r   r   r   r  rP   r   r1   r   r   r   r   r*   rG   r_   r   r  r  r   r  r   r    r@   r  r  rg   r   r  r  r   r_   r`   r  r  r+   r     &&&f           r"   r   ZFirewallPolicy.remove_port  s   ((''/~~g& (BDJJ!OP(GtQZ00 ) /3.D.D.DD**'E""T8U$S  (63DE3D/e53DE(
$ ""$$|||)EJJgwuc':Hk * ,EJJws(;X{ ,
 &..9$$TAt<$$T%;%;TK & (..9$$T%;%;TK (! %( / F %$(    !G>C$HH	c                r   r   )rP   r   r    r   r  rp   r"   Z__unregister_portZ FirewallPolicy.__unregister_port  s#    jj JJg& !r$   c                    V P                  V4      P                   F!  w  rE\        W$4      '       g   K  W58X  g   K    R # 	  R# TF)r0   rP   r   r    r@   r  r  r_   r`      &&&&  r"   
query_portZFirewallPolicy.query_port  s6     $ 7 = =Et++0E !> r$   c                r   r   )r0   rP   rw   r!   r"   
list_portsZFirewallPolicy.list_ports  s    v&,,,r$   c                s\    \        V4      '       g   \        \        P                  V4      hR # r   )r   r   r   ZINVALID_PROTOCOLr    r  r!   r"   check_protocolZFirewallPolicy.check_protocol  s%    X&& 7 7BB 'r$   c                sj    \        V4      '       g"   \        \        P                  R V,          4      hR# )zatcp-mss-clamp value must be greater than or equal to 536, or the value 'pmtu'. Invalid value '%s'N)r   r   r   INVALID_RULE)r    tcp_mss_clamp_valuer!   r"   check_tcp_mss_clampZ"FirewallPolicy.check_tcp_mss_clamp  s4     344##s&(  5r$   c                r   r   )r+  r*  r!   r"   Z__protocol_idZFirewallPolicy.__protocol_id  s    H%r$   c                r   r   )r   rB   r   r   r   _FirewallPolicy__protocol_idrV   r1   r   r   r   r*   rG   r`   "_FirewallPolicy__register_protocolr   $_FirewallPolicy__unregister_protocol)
r    r@   r  r|   r}   rg   r   protocol_idr   r+   r   r"   r   ZFirewallPolicy.add_protocol  s   ((''/w'~~g&((2..(.2.D.D.DD**'E&&(E(R  ""$$|||tWD$$TH  !;!;TO %  %$ r   c                r   r   )rV   r2   )r    r   r2  r|   r}   r   r"   Z__register_protocolZ"FirewallPolicy.__register_protocol  s    k*r$   c                r   r   )r   rB   r   r   r/  rV   r1   r   r   r   r*   rG   r`   r   r1  )r    r@   r  rg   r   r2  r   r+   r   r"   r   ZFirewallPolicy.remove_protocol  s    ((''/~~g&((2nn,.2.D.D.DD**'E""(E$J  ""$$|||ugE  !;!;TO %  %$ r   c                r   r   )rV   r   )r    r   r2  rp   r"   Z__unregister_protocolZ$FirewallPolicy.__unregister_protocol  s#    ..(NN!!+. )r$   c                r   r   )r/  r0   rV   )r    r@   r  rp   r"   query_protocolZFirewallPolicy.query_protocol  s'    !!(+tv/F/P/PPPr$   c                r   r   )r0   rV   rw   r!   r"   list_protocolsZFirewallPolicy.list_protocols  s    v&000r$   c                r  r  r  r   rp   r"   Z__source_port_idZFirewallPolicy.__source_port_id  r  r$   c                r  )c                 r	  r
  r  r  r  r"   r  Z0FirewallPolicy.add_source_port.<locals>.<lambda>  r  r$   r   r  r   Tr  FN)r   rB   r   r   r   r   r  rS   r   r1   r   r   r   r
   r*   rG   ra   r   _FirewallPolicy__source_port_id%_FirewallPolicy__register_source_portr   '_FirewallPolicy__unregister_source_portr   r  r  r"   r   ZFirewallPolicy.add_source_port  s   ((''/w'~~g& (BDDUDU!VW(GtQZ00262H2H2H..g#**15xG  ) (93DE3D/e53DE(
$ ""$$|||)E%%gwuc':Hk * ,E%%ws(;X{ ,
 &//x@++D7K$$T%B%BDR & (//x@$$T%B%BDR (! %( / F %$( r  c                r   r   )rS   r2   r  r   r"   Z__register_source_portZ%FirewallPolicy.__register_source_port0  r   r$   c                r  )c                 r	  r
  r  r  r  r"   r  Z3FirewallPolicy.remove_source_port.<locals>.<lambda>8  r  r$   r   r  r   Tr  FN)r   rB   r   r   r   r  rS   r   r1   r   r   r   r   r*   rG   ra   r   r5  r6  r   r7  r   r   r!  r"   r   Z!FirewallPolicy.remove_source_port3  s   ((''/~~g& (BDDUDU!VW(GtQZ00 ) /3.D.D.DD**'E""T8U$S  (63DE3D/e53DE(
$ ""$$|||)E%%gwuc':Hk * ,E%%ws(;X{ ,
 &//x@++D1dC$$T%B%BDR & (//x@$$T%B%BDR (! %( / F %$( r"  c                r   r   )rS   r   r#  rp   r"   Z__unregister_source_portZ'FirewallPolicy.__unregister_source_port\  r   r$   c                r$  r%  )r0   rS   r   r&  r'  r"   query_source_portZ FirewallPolicy.query_source_port`  s7     $ 7 D DEt++0E !E r$   c                r   r   )r0   rS   rw   r!   r"   list_source_portsZ FirewallPolicy.list_source_portsg  r   r$   c                s   V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          pVP
                  '       dB   VP                  '       d   VP                  MTp\        \        P                  R V,          4      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RWG4       V P                  WRV4       VP                  V P                  V4       RRR4       V#   + '       g   i     T# ; i)z"masquerade already enabled in '%s'TN)r   rB   r   r   r   rQ   r1   r   r   r   r*   rG   rb   $_FirewallPolicy__register_masquerader   &_FirewallPolicy__unregister_masquerade)r    r@   r|   r}   rg   r   r   r+   s   &&&&    r"   r   ZFirewallPolicy.add_masqueradel  s    ((''/w'~~g&???.2.D.D.DD**'E&&(Lu(T  ""$$|||  w<&&tf=  !=!=tD %  %$ s   AD,,D=	c                    R Vn         R# rm   rQ   )r    r   r|   r}   s   &&&&r"   Z__register_masqueradeZ$FirewallPolicy.__register_masquerade  s	    r$   c                s&   V P                   P                  V4      pV P                   P                  4        V P                  V,          pVP                  '       gB   VP
                  '       d   VP
                  MTp\        \        P                  R V,          4      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RW%4       VP                  V P                  V4       RRR4       V#   + '       g   i     T# ; i)zmasquerade not enabled in '%s'FN)r   rB   r   r   rQ   r1   r   r   r   r*   rG   rb   r   r;  )r    r@   rg   r   r   r+   s   &&    r"   r   Z FirewallPolicy.remove_masquerade  s    ((''/~~g&.2.D.D.DD**'E""$Du$L  ""$$|||  =  !=!=tD %  %$ s   4AC??D	c                r<  ru   r=  r    r   r!   r"   Z__unregister_masqueradeZ&FirewallPolicy.__unregister_masquerade  s	    r$   c                r   r   )r0   rQ   rw   r!   r"   query_masqueradeZFirewallPolicy.query_masquerade  s    v&111r$   c                sv   V P                   P                  V4       V P                   P                  V4       V'       d   V P                   P                  V4       V'       d,   \        W4      '       g   \	        \
        P                  V4      hV'       g%   V'       g   \	        \
        P                  R 4      hR# R# )z.port-forwarding is missing to-port AND to-addrN)r   r   r   r   r   r   ZINVALID_ADDRZINVALID_FORWARD)r    ipvr  r  toporttoaddrs   &&&&&&r"   check_forward_portZ!FirewallPolicy.check_forward_port  s    D!h'HH''44#F$7$7@@f&&(X  %vr$   c                s    \        R V4      '       d   V P                  R WW44       MV P                  RWW44       \        VR4      V\        VR4      \        V4      3# )r   r   r  )r   rC  r   r   )r    r  r  rA  rB  r   r"   Z__forward_port_idZ FirewallPolicy.__forward_port_id  sT    //##FDFK##FDFKc"Hgfc.BCKPPr$   c                s   V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          p	V P                  W#WE4      p
WP                  9   dP   V	P                  '       d   V	P                  MTp\        \        P                  R V: RV: RV: RV: RV: R 24      hV P                  4       ;_uu_ 4       pV	P                  '       d   V P                  RWW#WE4       V P                  WWg4       VP                  V P                   W4       RRR4       V#   + '       g   i     T# ; i)r   r  r   TN)r   rB   r   r   r    _FirewallPolicy__forward_port_idrR   r1   r   r   r   r*   rG   r]   &_FirewallPolicy__register_forward_portr   (_FirewallPolicy__unregister_forward_port)r    r@   r  r  rA  rB  r|   r}   rg   r   
forward_idr   r+   s   &&&&&&&&     r"   r   ZFirewallPolicy.add_forward_port  s    ((''/w'~~g&++DFK
+++.2.D.D.DD**'E&&665:  ""$$|||""' ((7K  !?!?R %  %$ s   -AEE	c                r   r   )rR   r2   )r    r   rG  r|   r}   r   r"   Z__register_forward_portZ&FirewallPolicy.__register_forward_port  s    !!*-r$   c                sf   V P                   P                  V4      pV P                   P                  4        V P                  V,          pV P	                  W#WE4      pWP
                  9  dP   VP                  '       d   VP                  MTp	\        \        P                  R V: RV: RV: RV: RV	: R 24      hV P                  4       ;_uu_ 4       p
VP                  '       d   V P                  RWjW#WE4       V
P                  V P                  Wx4       RRR4       V#   + '       g   i     T# ; i)r   r  r   FN)r   rB   r   r   rD  rR   r1   r   r   r   r*   rG   r]   r   rF  )r    r@   r  r  rA  rB  rg   r   rG  r   r+   s   &&&&&&     r"   r   Z"FirewallPolicy.remove_forward_port  s    ((''/~~g&++DFK
///.2.D.D.DD**'E""/3XvvuU 
 ""$$|||""7   !?!?R %  %$ s   ADD0	c                r   r   )rR   r   )r    r   rG  rp   r"   Z__unregister_forward_portZ(FirewallPolicy.__unregister_forward_port  s'    +++%%j1 ,r$   c                s`    V P                  W#WE4      pW`P                  V4      P                  9   # r   )rD  r0   rR   )r    r@   r  r  rA  rB  rG  s   &&&&&& r"   query_forward_portZ!FirewallPolicy.query_forward_port  s,    ++DFK
__V4BBBBr$   c                r   r   )r0   rR   rw   r!   r"   list_forward_portsZ!FirewallPolicy.list_forward_ports  r   r$   c                r   r   )r   Zcheck_icmptyper    icmpr!   r"   check_icmp_blockZFirewallPolicy.check_icmp_block  s    %r$   c                r   r   )rL  rJ  r!   r"   Z__icmp_block_idZFirewallPolicy.__icmp_block_id  s    d#r$   c                r   r   )r   rB   r   r   r   _FirewallPolicy__icmp_block_idrT   r1   r   r   r   r*   rG   r\   $_FirewallPolicy__register_icmp_blockr   &_FirewallPolicy__unregister_icmp_block)
r    r@   rK  r|   r}   rg   r   icmp_idr   r+   r   r"   r   ZFirewallPolicy.add_icmp_block  s   ((''/w'~~g&&&t,&&&.2.D.D.DD**'E&&$(N  ""$$|||  wkB&&tgF  !=!=tM %  %$ r   c                r   r   )rT   r2   )r    r   rP  r|   r}   r   r"   Z__register_icmp_blockZ$FirewallPolicy.__register_icmp_block  s    (r$   c                r   r   )r   rB   r   r   rM  rT   r1   r   r   r   r*   rG   r\   r   rO  )r    r@   rK  rg   r   rP  r   r+   r   r"   r   Z FirewallPolicy.remove_icmp_block"  s    ((''/~~g&&&t,***.2.D.D.DD**'E 2 2$PU4VWW""$$|||  {C  !=!=tM %  %$ r   c                r   r   )rT   r   )r    r   rP  rp   r"   Z__unregister_icmp_blockZ&FirewallPolicy.__unregister_icmp_block5  s'    &&&##G, 'r$   c                r   r   )rM  r0   rT   )r    r@   rK  rp   r"   query_icmp_blockZFirewallPolicy.query_icmp_block9  s'    ##D)T__V-D-P-PPPr$   c                r   r   )r0   rT   rw   r!   r"   list_icmp_blocksZFirewallPolicy.list_icmp_blocks<  s    v&222r$   c           	     s(   V P                   P                  V4      pV P                   P                  4        V P                  V,          pVP                  '       dB   VP
                  '       d   VP
                  MTp\        \        P                  R V,          4      hV P                  4       ;_uu_ 4       pVP                  '       d9   VP                   F  pV P                  RW7V4       K  	  V P                  RW64       V P                  WB4       VP                  V P                   W44       VP                  '       d9   VP                   F  pV P                  RW7V4       K  	  V P                  RW64       RRR4       V#   + '       g   i     T# ; i)z,icmp-block-inversion already enabled in '%s'FTN)r   rB   r   r   rW   r1   r   r   r   r*   rG   rT   r\   _icmp_block_inversion._FirewallPolicy__register_icmp_block_inversionr   *_FirewallPolicy__undo_icmp_block_inversion)r    r@   r}   rg   r   r   r+   r-   r   r"   add_icmp_block_inversionZ'FirewallPolicy.add_icmp_block_inversionA  sE   ((''/~~g&$$$.2.D.D.DD**'E&&>F 
 ""$$||| ,,D$$UG;G - **5'G00>  !A!A7Q ||| ,,D$$T7+F - **4F# %& ' %$& s   4CF  F	c                r<  rm   rW   )r    r   r}   rp   r"   Z__register_icmp_block_inversionZ.FirewallPolicy.__register_icmp_block_inversionb  s
    $(!r$   c           	     s^   V P                  4       ;_uu_ 4       pVP                  '       d'   VP                   F  pV P                  R WV4       K  	  R Vn        VP                  '       d'   VP                   F  pV P                  RWV4       K  	  RRR4       R#   + '       g   i     R# ; i)FTN)r*   rG   rT   r\   rW   )r    rg   r   r+   r-   s   &&&  r"   Z__undo_icmp_block_inversionZ*FirewallPolicy.__undo_icmp_block_inversione  s    ""$$ ||| ,,D$$UG;G - ).D% ||| ,,D$$T7+F - %$$$s   AB+&BB,	c           	     s*   V P                   P                  V4      pV P                   P                  4        V P                  V,          pVP                  '       gB   VP
                  '       d   VP
                  MTp\        \        P                  R V,          4      hV P                  4       ;_uu_ 4       pVP                  '       d9   VP                   F  pV P                  RW&V4       K  	  V P                  RW%4       V P                  V4       VP                  V P                   VR4       VP                  '       d9   VP                   F  pV P                  RW&V4       K  	  V P                  RW%4       RRR4       V#   + '       g   i     T# ; i)z(icmp-block-inversion not enabled in '%s'FNT)r   rB   r   r   rW   r1   r   r   r   r*   rG   rT   r\   rS  0_FirewallPolicy__unregister_icmp_block_inversionr   rT  )r    r@   rg   r   r   r+   r-   s   &&     r"   remove_icmp_block_inversionZ*FirewallPolicy.remove_icmp_block_inversiont  sH   ((''/~~g&(((.2.D.D.DD**'E""$NQV$V  ""$$||| ,,D$$UG;G - **5'G2248  !E!EtTR ||| ,,D$$T7+F - **4F# %& ' %$& s   4B
F?8FF	c                r<  ru   rW  r>  r!   r"   Z!__unregister_icmp_block_inversionZ0FirewallPolicy.__unregister_icmp_block_inversion  s
    $)!r$   c                r   r   )r0   rW   rw   r!   r"   query_icmp_block_inversionZ)FirewallPolicy.query_icmp_block_inversion  s    v&;;;r$   c                s   V P                   P                  P                  V4      pVP                  '       d:   V P                   P                  P
                  VP                  ,          ^ ,          pMTpV'       d-   WpP                  9   d   W43V P                  V,          9   d   R# M+WpP                  9  g   W43V P                  V,          9  d   R# V P                   P                  4        FP  pVP                  '       g   K  W8P                  4       9   g   K-  VP                  W!W44      p	VP                  W4       KR  	  V P                  WrW43.4       VP                  V P                  Wr'       * W43.4       R# r   )r   r@   r0   r1   r=   Z_zone_policiesr   enabled_backendspolicies_supportedZget_available_tablesZbuild_policy_chain_rules	add_rules_register_chainsr   )
r    r@   createrh   ri   r+   rE   Ztracking_policybackendrU   s
   &&&&&&    r"   rZ   ZFirewallPolicy.gen_chain_rules  s!   hhoo((0   
 #hhmm::3;P;PQRSTO$O<</Ndll?&CC  ||3>o)FFxx002G)))e7S7S7U.U88V%%g5 3
 	o7GH!!?J%@P	
r$   c                s.   V F  w  rEV'       d/   V P                   P                  V. 4      P                  WE34       K;  V P                   V,          P                  WE34       \	        V P                   V,          4      ^ 8X  g   K  V P                   V K  	  R# r   )r   Z
setdefaultr2   r   r   )r    r@   r_  Ztablesrh   ri   r'  r"   r^  ZFirewallPolicy._register_chains  sm    "LE''3::E>JV$++UN;t||F+,1V, #r$   c                s    V P                   P                  P                  V4      R 8X  d   R# V P                   P                  P                  V4      # )zhash:macN)r   r   get_typeZ
get_familyr    rD   r!   r"   r   ZFirewallPolicy._ipset_family  s9    88>>""4(J6xx~~((..r$   c                L    V P                   P                  P                  V4      # r   )r   r   ra  rb  r!   r"   Z__ipset_typeZFirewallPolicy.__ipset_type  s    xx~~&&t,,r$   c                sz    R P                  V.V P                  P                  P                  V4      ,          4      # )Z,)Zjoinr   r   Zget_dimension)r    rD   Zflagrp   r"   _ipset_match_flagsZ!FirewallPolicy._ipset_match_flags  s+    xx!=!=d!CCDDr$   c                rc  r   )r   r   Zcheck_appliedrb  r!   r"   r   Z#FirewallPolicy._check_ipset_applied  s    xx~~++D11r$   c                s    V P                  V4      pV\        9  d$   \        \        P                  R V: RV: R24      hR# )zipset 'z' with type 'z' not usable as sourceN)_FirewallPolicy__ipset_typer   r   r   ZINVALID_IPSET)r    rD   Z_typerC   r"   r   Z+FirewallPolicy._check_ipset_type_for_source  s>    !!$'**$$DH%P  +r$   c                s   \        VP                  \        4      '       d   V P                  P                  P                  VP                  P                  4      pVf   VP                  P                  .pVP                   Fc  pWu9   d   K  V P                  V4       VP                  V4       V P                  VV\        P                  ! V\        VR7      R7      VVR7       Ke  	  . pVP                  '       d   VP                  .pMVP                  '       d   \        VP                  \        4      '       g!   \        VP                  \        4      '       do   V P                  P                   P#                  VP                  P                  4      p	V	P$                  '       d$   R U
u. uF  qV	P$                  9   g   K  V
NK  	  pp
V P'                  VP(                  4      pV'       dU   VP                  '       d@   VP                  V8w  d.   \+        \,        P.                  RV: RVP                  : R24      hMV.pV'       g   RR.pV U
u. uF'  qP                  P1                  V
4      '       g   K%  V
NK)  	  pp
\3        V Uu. uF  qP                  P5                  V4      NK  	  up4       EF  p\        VP                  \        4      '       Ed   V P                  P                  P                  VP                  P                  4      p. p\7        VP$                  4      ^ 8  d   VP$                  '       d   \+        \,        P.                  R	4      hV FP  p
WP$                  9   g   K  VP9                  V
4      '       g   K.  VP                  VP$                  V
,          4       KR  	  MVP                  R 4       V EF*  p\        VP:                  \<        4      '       EdV   V P?                  VP@                  V4      pVV PC                  VPD                  4      ,          p\G        \3        V4      R
 R7      p. pV F  pVPH                  p\K        V4      pVP                  RR4      pVP                  V4       VP                  R8w  d$   VP9                  VP                  4      '       g   Kq  \7        VPL                  4      ^8  d   VP                  V4       K  VPL                   F9  w  ppVPO                  VVVVVVP                  V4      pVPQ                  VV4       K;  	  K  	  VPS                  V4       VPL                   F,  w  ppVPU                  WVVW4      pVPQ                  VV4       K.  	  VPV                   F(  pVPY                  WVW4      pVPQ                  VV4       K*  	  VPZ                   F,  w  ppVP]                  WVVW4      pVPQ                  VV4       K.  	  EK-  	  EKB  \        VP                  \^        4      '       di   VP                  P`                  pVP                  Pb                  pV Pe                  VV4       VPU                  WVVR V4      pVPQ                  VV4       EK  \        VP                  \f        4      '       dQ   VP                  Ph                  pV Pk                  V4       VPY                  WVR V4      pVPQ                  VV4       EK:  \        VP                  \l        4      '       dQ   VP                  Ph                  pV Po                  V4       VPq                  WVR V4      pVPQ                  VV4       EK  \        VP                  \r        4      '       dh   V'       d9   V F2  p
VP9                  V
4      '       g   K  VPu                  \v        V
4       K4  	  VPy                  WV4      pVPQ                  VV4       EK1  \        VP                  \z        4      '       d   VP                  P`                  pVP                  Pb                  pVP                  P|                  pVP                  P~                  pV FY  p
VP9                  V
4      '       d   V P                  V
VVVV4       V'       g   K9  V'       g   KC  VPu                  \v        V
4       K[  	  VP                  WVVVVV4      pVPQ                  VV4       EK3  \        VP                  \        4      '       di   VP                  P`                  pVP                  Pb                  pV Pe                  VV4       VP]                  WVVR V4      pVPQ                  VV4       EK  \        VP                  \        4      '       g"   \        VP                  \        4      '       EdO   V P                  P                   P#                  VP                  P                  4      p	VP                  '       do   V	P$                  '       d]   VP                  V	P$                  9  dB   \+        \,        P                  RVP                  : RVP                  P                  : R24      h\        VP                  \        4      '       dM   VP:                  '       d;   \        VP:                  \<        4      '       d   \+        \,        P.                  R4      hVP                  WWVR7      pVPQ                  VV4       EKJ  VP                  f(   VP                  WV4      pVPQ                  VV4       EK  \+        \,        P.                  R\        VP                  4      ,          4      h	  R # u up
i u up
i u upi )NrD   )elementincluded_servicesr   r   zSource address family 'z' conflicts with rule family 'z'.z"Destination conflict with service.c                     V P                   # r   rf  r  r'   r"   r  Z.FirewallPolicy._rule_prepare.<locals>.<lambda>)  s    QVVr$   rj   	conntracknatr   zrich rule family 'z' conflicts with icmp type 'r   z'IcmpBlock not usable with accept actionipvszUnknown element %sr   r   )Gr[   rg  r   r   r   get_servicerD   includesr   r2   r   dataclassesreplacefamilyr   r   configget_icmptypedestinationr   r   r   r   r,  is_ipv_enabledr;   get_backend_by_ipvr   is_ipv_supportedZactionr   r   r   r   r   r.   r   r	   rP   build_policy_helper_ports_rulesr]  Zadd_modulesbuild_policy_ports_rulesrV   build_policy_protocol_rulesrS   build_policy_source_ports_rulesr   r  r  r   r   Zvaluer+  r   r.  Z build_policy_tcp_mss_clamp_rulesr   r   r   build_policy_masquerade_rulesr   Zto_portZ
to_addressrC  build_policy_forward_port_rulesr   ZINVALID_ICMPTYPEbuild_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rulesZtype)r    rf   r@   r   r+   ri  svcincluderp  ictr@  Z
source_ipvr  r`  Zdestinationsry  r   r   r   r   r   
nat_moduler  protorU   r  r-  rA  rB  s   &&&&&&                       r"   r   ZFirewallPolicy._rule_prepare  s	   dllL11((""..t||/@/@AC (%)\\%6%6$7!<</""7+!((1""''l6PQ&7 #  ( ;;;KK=D\\\t||^44$,,66((//..t||/@/@AC'7R'7#//;Q'7R**4;;7
{{{;;*,'++%t{{4  - #|F#D  $Dtxx'>'>s'CtDDIDqHH77:DIJG$,,55hh&&224<<3D3DE!s'!+'''+"//1U   $//1g6N6Ns6S6S(//0DE  $
 !''-#/K!$++{;;"&"F"FKK#  4#G#G#TT"(W;K"L"$&-F%+]]F1LV1T.)/U)KJ#NN:6%}}27;S;S &< < !)"6<<014 'v 639<<KD%,3,S,S(.(.(-(,(3(.(:-&E %0$9$9'5$I 4@ '.0 $//8 (+yye ' @ @"E4! $--gu=	 (1 "% ' C C"E;! $--gu=	 "/ (+'7'7e ' G G"E4! $--gu=	 (8e $0r DLL)44||((<<00h/88HdD$ %%gu5 DLL-88<<--##H-;;HdD %%gu5 DLL*<==&*ll&8&8#(()<=@@$7t %%gu5 DLL/::#"33C88'001EsK  $  ==fdS%%gu5 DLL*:;;||((<<00--00C//44//T8VVTv&&#,,-A3G	    ??D(FFD %%gu5 DLL/::||((<<00h/??HdD$ %%gu5 DLL.99Zm> > hhoo224<<3D3DE KKK3??:'//;;(9(9;  t||^<<"4;;<< (++-V   ==CD >  %%gu5%JJD %%gu5 $'')=T\\@R)R q K- S( EIs   +m*m*"m/8m/	#m4c                s   V P                   P                  P                  V4      pV P                  VP                  V4      pWpP                  VP                  4      ,          p\        \        V4      R  R7      pVf   V.pVP                   FC  pW9   d   K  V P                  V4       VP                  V4       V P                  VVVVVR7       KE  	  . p	R F  p
V P                   P                  V
4      '       g   K&  V P                   P                  V
4      p\        VP                   4      ^ 8  d8   WP                   9   d&   V	P                  WP                   V
,          34       K  K  VR3V	9  g   K  V	P                  VR34       K  	  V	 EF  w  rV F  pVP"                  p\%        V4      pVP"                  P'                  RR4      pVP)                  V4       VP*                  R8w  d$   VP-                  VP*                  4      '       g   K{  \        VP.                  4      ^8  d   VP)                  V4       K  VP.                   F9  w  ppVP1                  VVVVVVP2                  V4      pVP5                  VV4       K;  	  K  	  VP.                   F,  w  ppVP7                  WVVV4      pVP5                  VV4       K.  	  VP8                   F(  pVP;                  WVV4      pVP5                  VV4       K*  	  VP<                   F,  w  ppVP?                  WVVV4      pVP5                  VV4       K.  	  EK  	  R# )c                 rj  r   rf  rk  r'   r"   r  Z)FirewallPolicy._service.<locals>.<lambda>  s    QVVr$   rl  Nrh  rm  rn  r   rq  ) r   r   rr  r   r   r   r   r.   r;   rs  r   r2   r^   rz  r{  r   ry  r   r	   ru  Z
add_modulerv  r|  rP   r}  rD   r]  r~  rV   r  rS   r  )r    rf   r@   r   r+   ri  r  r   r  Zbackends_ipvr@  r`  ry  r   r   r   r  r  r  rU   r  s   &&&&&&               r"   r^   ZFirewallPolicy._service  s   hh**7366s{{FK77DDW+;< $!(	||G+w'$$W-MM"3   $  #C88**3//hh11#6G3??#a'//) ''//#2F(GH * T?,6 ''$8 $ %1 G!%@%H"#]]22;F
&&z2==B&w/G/G/V/Vv||$q(**62'-||e ' G G""! '"KK.! $--gu= (4 ".  #yye88E4 %%gu5	  )  MM;;Hk %%gu5	 *  #//e??E4 %%gu5	  0I %1r$   c                    V P                   P                  4        F:  pVP                  '       g   K  VP                  WWC4      pVP	                  Wg4       K<  	  R # r   )r   r[  r\  r~  r]  r    rf   r@   r  r  r+   r`  rU      &&&&&&  r"   r_   ZFirewallPolicy._port  sH    xx002G---44VXTE!!'1 3r$   c                s    V P                   P                  4        F:  pVP                  '       g   K  VP                  WV4      pVP	                  WV4       K<  	  R # r   )r   r[  r\  r  r]  )r    rf   r@   r  r+   r`  rU      &&&&&  r"   r`   ZFirewallPolicy._protocol"  sH    xx002G---77QE!!'1 3r$   c                r  r   )r   r[  r\  r  r]  r  r  r"   ra   ZFirewallPolicy._source_port*  sM    xx002G---;;E !!'1 3r$   c                s    R pVP                  \        V4       V P                  P                  V4      pVP	                  W4      pVP                  WV4       R# )r   N)r   r   r   r{  r  r]  )r    rf   r@   r+   r@  r`  rU      &&&&   r"   rb   ZFirewallPolicy._masquerade4  sJ    137((--c255fEg-r$   c                s    \        R V4      '       d   R pMRpV'       d   V'       d   VP                  \        V4       V P                  P	                  V4      p	V	P                  WWEWg4      p
VP                  W4       R# )r   r   N)r   r   r   r   r{  r  r]  )r    rf   r@   r+   r  r  rA  rB  r@  r`  rU   s   &&&&&&&&   r"   r]   ZFirewallPolicy._forward_port<  sl      //CCf  !5s;((--c277DF
 	g-r$   c                s*   V P                   P                  P                  V4      pR R.pVP                  '       d$   R Uu. uF  qwVP                  9   g   K  VNK  	  ppV Uu. uF'  qpP                   P	                  V4      '       g   K%  VNK)  	  pp\        V Uu. uF  qP                   P                  V4      NK  	  up4       F;  p	V	P                  '       g   K  V	P                  WWVR7      p
VP                  W4       K=  	  R# u upi u upi u upi )r   r   ro  Nrq  )
r   rw  rx  ry  rz  r;   r{  r\  r  r]  )r    rf   r@   rK  r+   r  rp  r@  r  r`  rU   s   &&&&&      r"   r\   ZFirewallPolicy._icmp_blockL  s    hhoo**40???#3N#3Ccoo7MCC#3DN  $Dtxx'>'>s'CtDDIDqHH77:DIJG---99 : E !!'1 K O EIs    DD#"D
D#Dc                s@   V P                   V,          P                  pVR9   d   R# V P                  V4      '       g
   VR8X  d   R# V P                  P	                  4        F9  pVP
                  '       g   K  VP                  W4      pVP                  WV4       K;  	  R# )DROPNZACCEPT)r  z
%%REJECT%%ZREJECT)r   targetrZ  r   r[  r\  Z'build_policy_icmp_block_inversion_rulesr]  )r    rf   r@   r+   r  r`  rU   r  r"   rS  Z$FirewallPolicy._icmp_block_inversion_  s    '.. 55..v666X;M xx002G---CCFSE!!'1 3r$   c                sj   V P                  V4      pR pV'       d'   V P                  P                  P                  V4      pM-V'       d&   V P                  P                  P                  V4      pV'       d   V P                  P	                  V4      .MV P                  P                  4        F  pVP                  '       g   K  VP                  '       g   V P                  V4      MV P                  V4       F3  w  rVP                  VVVVVVVVVVV
R7      pV	P                  VV4       K5  	  K  	  R # )N)last)r0   r   r=   check_sourcer{  r[  r\  r1   rX   rY   Z&build_policy_ingress_egress_pair_rulesr]  )r    rf   r@   ingress_zoneegress_zoneZingress_interfaceZingress_sourceZegress_interfaceZegress_sourcer+   r  r5   r@  r`  rh   ri   rU   s   &&&&&&&&&&&      r"   _ingress_egress_pairZ#FirewallPolicy._ingress_egress_pairr  s    '((--,,^<C((--,,];C 36TXX((-.488;T;T;VV  --- ... ::6B==fEF 
  FF %"$! G  %%gu5#F Wr$   c
                s(   VR 8X  dD   V P                   P                  P                  4       p
VR9  d   WJ9  d   V
P                  V4       MV.p
VR 8X  dD   V P                   P                  P                  4       pVR9  d   W;9  d   VP                  V4       MV.pV
 EF  pVR8X  d   R.p. pMV'       d   V.p. pMV'       d   . pV.pM\	        V P                   P                  P                  V4      4      pWP                   P                  8X  d   RV9  d   VP                  R4       \	        V P                   P                  P                  V4      4      p VP                  V4        TP                  T	4       V EF  pVR8X  d   R.p. pMV'       d   V.p. pMV	'       d   . pV	.pM\	        V P                   P                  P                  V4      4      pWP                   P                  8X  d   RV9  d   VP                  R4       \	        V P                   P                  P                  V4      4      pW8X  dA   V'       d   VV9  d   VP                  V4       V'       d   VV9  d   VP                  V4       V FW  pV F,  pVR8X  d
   VR8X  d   K  V P                  VVVVVRVRV4	       K.  	  V F  pV P                  VVVVVRRVV4	       K  	  KY  	  V F  pV F  pV P                  VVVVRVVRV4	       K  	  V Fk  pV P                   P                  P                  V4      V P                   P                  P                  V4      8w  d   KR  V P                  VVVVRVRVV4	       Km  	  K  	  EK  	  EK  	  R#     EL; i    EL; i)r:   r9   r   Z+Nr8   )r   r=   r>   r2   r   Zlist_interfacesZ_default_zoneZlist_sourcesr   r  r  )r    rf   r@   r  r  r+   ingressInterfaceingressSourceegressInterfaceegressSourceZ_ingress_zonesZ_egress_zonesrd   Z_ingress_interfacesZ_ingress_sourcesr   Z_egress_interfacesZ_egress_sourcesZ_ingress_interfaceZ_egress_interfaceZ_egress_sourceZ_ingress_sources   &&&&&&&&&&            r"   _ingress_egress_zoneZ#FirewallPolicy._ingress_egress_zone  s    5 !XX]];;=N /1k6W%%k2*^N% HHMM::<M O3 5$$\2(MM+M&')d##% #+;*<'')$"*,'(5$*.55mD+' &)?)??'::+2237'+DHHMM,F,F},U'V$ ,22?C(//= !.6)*,&&(O&.=->**,%-/*+7.-1 HHMM99,G.* )HH,B,BB #+= =.55c:*.txx}}/I/I,/W*X )8 0$4<N$N 2 9 9:J K,o1U / 6 6} E*=&-?)-49Jc9Q$11"")(.-'
 .@ +:11"")(.*'
 +: +>6 (8O-?)11"")(+-'
 .@ +:88==55+!XX]]77GH %11"")(+*'
 +: (8} !.G ,8s   N+NN	Nc                s    V P                  V4       FY  pVR9  d8   V P                  P                  P                  V4      P                  '       g   KA  V P                  VVVVVVVR7       K[  	  R# )r9   )r  r  Nr8   )r   r   r=   get_zonerG   r  )r    rf   r@   r  r+   r  r  r     &&&&&&& r"   rd   ZFirewallPolicy._ingress_zone@  sk      11&9K?2..{;CCC%%!1+ &  :r$   c                s    V P                  V4       FY  pVR9  d8   V P                  P                  P                  V4      P                  '       g   KA  V P                  VVVVVVVR7       K[  	  R# )r9   )r  r  Nr8   )r   r   r=   r  rG   r  )r    rf   r@   r  r+   r  r  r  r  r"   r   ZFirewallPolicy._egress_zoneY  sk     !33F;LO3..|<DDD%% /) &  <r$   c                sz   V P                   V,          pRVP                  9   dE   RVP                  9   d4   . ROpV P                  P                  '       g   VP                  R4       V# RVP                  9   d4   . ROpV P                  P                  '       g   VP                  R4       V# RVP                  9   d   RR	.# RVP                  9   dE   RVP                  9   d4   . ROpV P                  P                  '       g   VP                  R4       V# RVP                  9   d   . ROpV P                  P                  '       g   VP                  R4       V P                  P                  R8X  d   VP                  R4       V# VP                   F;  pV P                  P                  P                  V4      P                  '       g   K:   V# 	  VP                  R4       V# RVP                  9   d   R
R.pV P                  P                  '       g   VP                  R4       VP                   F;  pV P                  P                  P                  V4      P                  '       g   K:   V# 	  VP                  R4       VP                  R4       V# R
.pV P                  P                  '       g   VP                  R4       V P                  P                  R8X  d   VP                  R4       M[VP                   F:  pV P                  P                  P                  V4      P                  '       g   K:   M	  VP                  R4       VP                   F;  pV P                  P                  P                  V4      P                  '       g   K:   V# 	  VP                  R4       VP                  R4       V# )z:Create a list of (table, chain) needed for policy dispatchr:   r9   Znftablesrn  
PREROUTINGmangler  )r  ZINPUTr  r  rawr  r  OUTPUTrn  r  r  ZFORWARDrn  ZPOSTROUTING)r  r  r  r  r  r  r  )
r   r<   r?   r   nftables_enabledr2   Z_firewall_backendr=   r  Z
interfaces)r    r@   rE   tcr=   r   r"   rX   Z4FirewallPolicy._get_table_chains_for_policy_dispatchr  s	   nnV$C%%%&C4D4D*DWB 88,,,		/0Is'''WB 88,,,		/0Is((((*;<<c'''ES5E5E,EB 88,,,		/0Ic&&&B 88,,,		/0xx))Z7		01 I  --Dxx}}--d3>>> I . II45Ic'''')?@B 88,,,		/0((88==))$/::: I ) 		/0		23I ((B 88,,,		/0xx))Z7		01--Dxx}}--d3>>> . II45((88==))$/::: I ) 		/0		23Ir$   c                sl   V P                   V,          pRVP                  9   d3   R.pV P                  P                  '       g   VP	                  R4       V# RVP
                  9   d   RR.# RVP                  9   d   . RO# RVP
                  9   d   R	.# \        \        P                  RV,          4      h)
z8Create a list of (table, chain) needed for zone dispatchr9   r:   zInvalid policy: %sr  r  r  r  r  r  )	r   r?   r   r  r2   r<   r   r   INVALID_POLICY)r    r@   rE   r  rI   r"   rY   Z2FirewallPolicy._get_table_chains_for_zone_dispatch  s    nnV$S%%%%&B 88,,,		/0Is((( )*;<<c&&& 
 c'''*++F113G63RSSr$   c           	     s   V P                   P                  P                  V4      pVP                  '       d   VP                  pMW1,           pR VP                  9   d3   VR8X  d
   RV,           # VR8X  d
   RV,           # VR9   d
   RV,           # EMR VP
                  9   d   VR9   d
   RV,           # MRVP                  9   dC   VR8X  d
   RV,           # VR8X  d   V'       d
   R	V,           # RV,           # VR9   d
   RV,           # MRVP
                  9   dC   VR8X  d
   RV,           # VR8X  d   V'       d
   R	V,           # RV,           # VR9   d
   RV,           # MSVP                  '       gB   VR8X  d
   RV,           # VR8X  d   V'       d
   R	V,           # RV,           # VR9   d
   RV,           # \        \        P                  R
V: RV: RV: 24      h)r9   r  ZIN_r  ZPRE_rn  ZOUT_r:   ZFWD_ZPOST_z$Can't convert policy to chain name: r%   )r  rn  )r  rn  )r  r  )	r   r@   r0   r1   r?   r<   r   r   r  )r    r@   rh   Zpolicy_prefixZisSNATrE   Zsuffixr  r"   policy_base_chain_nameZ%FirewallPolicy.policy_base_chain_name  s   hhoo((0   **F"+FS%%% v~%%&++& ,s((())& *c&&& &%"V++!F?*++& ,c''' &%"V++!F?*++& ,&&& &%"V++!F?*++&!!@FvV
 	
r$   )r   r   r   r   r   )NN)NNr    N)F)NNNN)Z__name__Z
__module__Z__qualname__Z__firstlineno__r#   r(   r)   r*   r/   r7   rA   r0   rF   rJ   rL   rN   rk   rK   rs   rH   rv   rx   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rc   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r  r   r  r(  r)  r+  r.  r/  r   r0  r   r1  r3  r4  r5  r   r6  r   r7  r8  r9  r   r:  r   r;  r?  rC  rD  r   rE  r   rF  rH  rI  rL  rM  r   rN  r   rO  rQ  rR  rV  rT  rU  rY  rX  rZ  rZ   r^  r   re  rd  r   r   r   r^   r_   r`   ra   rb   r]   r\   rS  r  r  rd   r   rX   rY   r  Z__static_attributes__Z__classdictcell__)Z__classdict__s   @r"   r   r   '   s    
M- !'#@M ^9@
:B
<5Hr&T.+./U5
&T.*..S4
$>,$$5?
(.)*-N02(.'R#'R'-
C.+*/Q1
.'R*'R.4
,( 2
Q"H.02C5
&.)&-Q3
B)G@*< 
D-/
-E2l\M6^222.. 2&2&,6\^@22ZxT68
 8
r$   r   )#r   rt  Zfirewall.core.loggerr   Zfirewall.functionsr   r   r   r   r   r   r   r	   r
   r   r   Zfirewall.core.richr   r   r   r   r   r   r   r   r   r   r   Zfirewallr   Zfirewall.errorsr   Zfirewall.core.baser   r   r  r$   r"   <module>r     sO      $        ) 1z
 z
r$   