+
    i  c                   s    ^ RI t ^ RIHtHtHt ^ RIHt ^ RIHt ^ RI	H
t
HtHtHtHtHtHtHtHtHtHt ^ RIHt ^ RIHtHtHt ^ RIHt ^ R	IHt  ! R
 R4      tR# )    N)	SHORTCUTSDEFAULT_ZONE_TARGETSOURCE_IPSET_TYPES)Policy)log)Rich_ForwardPortRich_IcmpBlockRich_IcmpType	Rich_MarkRich_Masquerade	Rich_PortRich_Protocol	Rich_RuleRich_ServiceRich_SourcePortRich_Tcp_Mss_Clamp)nm_get_bus_name)checkIPnMaskcheckIP6nMask	check_mac)errors)FirewallErrorc                   s  a  ] tR t^t o ^ tR tR tR tR tR t	R t
RaR ltR tR	 tR
 tR tR tR tR tR tR tR tR tR tR tR tR tR tR tR tR tRbR ltR t RbR lt!R t"R  t#R! t$R" t%RcR# lt&RcR$ lt'RbR% lt(R& t)RbR' lt*R( t+R) t,R* t-R+ t.R, t/RcR- lt0R. t1R/ t2R0 t3R1 t4R2 t5R3 t6R4 t7R5 t8RdR6 lt9R7 t:R8 t;R9 t<RdR: lt=R; t>R< t?R= t@RdR> ltAR? tBR@ tCRA tDRB tERdRC ltFRD tGRE tHRF tIRdRG ltJRH tKRI tLRJ tMRdRK ltNRL tORM tPReRN ltQRfRO ltRRfRP ltSRQ tTRdRR ltURS tVRT tWRU tXRbRV ltYRW tZRX t[RY t\RZ t]RdR[ lt^R\ t_R] t`R^ taR_ tbR`tcV tdR# )gFirewallZonec                s.    Wn         / V n        / V n        R # N)_fw_zones_zone_policies)selfZfw   &&:/usr/lib/python3.14/site-packages/firewall/core/fw_zone.py__init__ZFirewallZone.__init__"   s         c                s>    V P                   : R V P                  : R2# )Z(Z))Z	__class__r   r      &r   __repr__ZFirewallZone.__repr__'   s    >>4;;77r    c                sn    V P                   P                  4        V P                  P                  4        R # r   )r   Zclearr   r!   r"   r   cleanupZFirewallZone.cleanup*   s$    !!#r    c                s    V P                   P                  ! V/ VB pVP                  '       d0   VP                  P	                  V P                   P
                  4       V# r   )r   with_transactionZis_temporarytransactionZadd_prefull_check_config)r   argsZkwargsZctxs   &*, r   r%   ZFirewallZone.with_transaction.   sH    hh''88OO##DHH$>$>?
r    c                s&    R P                  WR7      # )zzone_{fromZone}_{toZone})fromZonetoZone)Zformat)r   r)   r*      &&&r   policy_name_from_zonesZ#FirewallZone.policy_name_from_zones4   s    )00(0RRr    c                sH    \        V P                  P                  4       4      # r   )sortedr   Zkeysr!   r"   r   	get_zonesZFirewallZone.get_zones9   s    dkk&&())r    c                sJ   . pV P                  4        FD  pV P                  V4      '       g   V P                  V4      '       g   K3  VP                  V4       KF  	  V'       dA   V P                  P
                  V9  d&   VP                  V P                  P
                  4       V# r   )r.   list_interfaceslist_sourcesappendr   _default_zone)r   Zappend_defaultZactive_zoneszone   &&  r   get_active_zonesZFirewallZone.get_active_zones<   s{    NN$D##D))T->->t-D-D##D) % dhh44LH 6 67r    c                    V P                  V4      pV P                   F(  pW P                  V,          P                  9   g   K&  Vu # 	  R # r   )_FirewallZone__interface_idr   
interfaces)r   	interfaceinterface_idr3   r4   r   get_zone_of_interfaceZ"FirewallZone.get_zone_of_interfaceE   s?    **95KKD{{40;;;   r    c                r6   r   )_FirewallZone__source_idr   sources)r   source	source_idr3   r4   r   get_zone_of_sourceZFirewallZone.get_zone_of_sourceM   s?    $$V,	KKDKK-555   r    c                s^    V P                   P                  V4      pV P                  V,          # r   )r   
check_zoner   )r   r3   Zz   && r   get_zoneZFirewallZone.get_zoneU   s$    HH%{{1~r    c                s   \        4       pVP                  Vn        V P                  W#4      Vn        V P                  Vn        VP                  Vn        V.Vn        V.Vn        R EFX  pW!P                  8X  d:   VR8X  d3   VR9   d,   \        WE\        P                  ! \        W4      4      4       KM  VR8X  dC   W1P                  8X  d3   VR9   d,   \        WE\        P                  ! \        W4      4      4       K  W!P                  8X  d:   VR8X  d3   VR9   d,   \        WE\        P                  ! \        W4      4      4       K  VR9   g   K  \        4       Vn        VP                   FQ  pV P                  W#4      pWpP                  VP                  V4      8X  g   K6  VP                  P!                  V4       KS  	  EK[  	  V# )servicesHOSTANY)	rD   ports
masqueradeforward_portssource_portsicmp_blocksicmp_block_inversionrules	protocols)rD   rG   rJ   rK   rL   rN   )rH   )rI   )rM   )r   nameZderived_from_zoner,   ZONE_POLICY_PRIORITYZprioritytargetZingress_zonesZegress_zonesZsetattrcopyZdeepcopygetattrsetrM   _get_policy_for_rich_ruleZadd)r   z_objr)   r*   p_objZsettingruleZcurrent_policy   &&&&    r   policy_obj_from_zone_objZ%FirewallZone.policy_obj_from_zone_objY   sf   "'**00B
22||'j$X


G JJ&f$ ge6M(NOE!f

&:w.?X ge6M(NOJJ&eO00 ge6M(NOI%!e!KKD%)%@%@%RN%)G)G

D*  - (Q

` r    c                s   WP                   VP                  &   . V P                  VP                  &   VP                  R 3R VP                  3RVP                  3VP                  R33 Fr  w  r#V P                  WV4      pV P                  P
                  P                  V4       V P                  VP                  ,          P                  VP                  4       Kt  	  R# )rE   rF   N)r   rO   r   rZ   r   policyZ
add_policyr1   )r   objr)   r*   rW      &&   r   add_zoneZFirewallZone.add_zone   s     #CHH(*CHH% XXvSXXCHHXXu	!
H 11#HEHHOO&&u-)00<!
r    c                s   V P                   V,          pVP                  '       d3   V P                  4       ;_uu_ 4       pV P                  W4       R R R 4       V P                   V V P                  V R #   + '       g   i     L,; ir   )r   appliedr%   unapply_zone_settingsr   )r   r3   r\   r&   r4   r   remove_zoneZFirewallZone.remove_zone   s`    kk$;;;&&((K**4= )KK% )(s   A44B	c                s   V P                  4        Ft  pV P                  V,          p\        VP                  4      ^ 8  g   \        VP                  4      ^ 8  g   KL  \
        P                  ! RV4       V P                  W!4       Kv  	  R# )r    zApplying zone '%s'N)r.   r   lenr8   r=   r   debug1apply_zone_settings)r   r&   r3   rV   r4   r   apply_zonesZFirewallZone.apply_zones   sa    NN$DKK%E5##$q(C,>,B

/6((;	 %r    c                s8    V P                   V,          pW#n        R # r   )r   r_   )r   r3   r_   r\      &&& r   set_zone_appliedZFirewallZone.set_zone_applied   s    kk$r    c                sl   R V9  d   R# VP                  R 4      p\        V4      ^8  d   R# Rp\         F   pV^ ,          \        V,          8X  g   K  TpK"  	  VeX   V^,          V P                  4       9  d   R# \        V4      ^8X  g   \        V4      ^8X  d   V^,          R9   d   V^,          V3# R# )Z_N)Zprer   ZdenyZallowZpost)Zsplitrb   r   r.   )r   chainZsplits_chainxr]   r   zone_from_chainZFirewallZone.zone_from_chain   s    eS!v;?AayIaL(  ay 006{aFq 1I!HHq	6**r    c                s    V P                  V4      pVf   R # Vw  r4VR9   d   TpRpM9VR9   d   TpRpM-VR9   d   RpTpM!\        \        P                  RV,          4      hV P	                  WV4      V3# )NrF   rE   z&chain '%s' can't be mapped to a policy)Z
PREROUTINGZFORWARD)ZINPUT)ZPOSTROUTING)rk   r   r   ZINVALID_CHAINr,   )r   rh   rj   r3   ri   r)   r*   s   &&     r   policy_from_chainZFirewallZone.policy_from_chain   s      '9..HFy HF&HF$$&NRW&X  ++H=vFFr    c                s    VR9   dU   V P                  V4      pVe>   V P                  V4      w  rgV P                  P                  P                  VRW'V4       R# R# R# )ipv4NT)rm   ipv6)rl   r   r[   Zgen_chain_rules)r   ipvZtablerh   r&   rj   r[   ri      &&&&&   r   create_zone_base_by_chainZ&FirewallZone.create_zone_base_by_chain   s\    ""&&u-A}#'#9#9%#@ //D%  #r    c           	     s   R F  p\        V P                  V4      V4      p\        V\        4      '       d   V.pV Fv  pVR 8X  d   V P	                  WWc4       K  VR8X  d'   V P                  V4      pV P                  WWvV4       KK  VR8X  d   KT  VR9   d   K]  \        P                  ! RVVV4       Kx  	  K  	  V'       d   V P                  WV4       R# R# )r8   r=   rL   z3Zone '%s': Unknown setting '%s:%s', unable to applyN)r8   r=   forwardrL   )rr   Zingress_priorityZegress_priority)
rS   rC   
isinstanceZbool
_interfacecheck_source_sourcer   Zwarning_icmp_block_inversion)r   enabler3   r&   keyZ	args_listr(   ro   rY   r   _zone_settingsZFirewallZone._zone_settings   s    OCd 3S9I)T**&K	!,&OOF$DI%++D1CLLs+F22NN KKP	 "	 P0 &&v[A r    c                sh   V P                   P                  V4      pV P                  V,          pVP                  '       d   R # RVn        V P                  V,           F?  p\
        P                  ! RWQ4       V P                   P                  P                  WR4       KA  	  V P                  RW24       R # )NTz+Applying policy (%s) derived from zone '%s')
r   rA   r   r_   r   r   rc   r[   Zapply_policy_settingsrz   r   r3   r&   _zoner\   r[      &&&   r   rd   Z FirewallZone.apply_zone_settings  s    ##D)kk% ;;;))%00FJJDfSHHOO11&F 1 	D%5r    c                s,   V P                   P                  V4      pV P                  V,          pVP                  '       g   R # V P                  V,           F(  pV P                   P
                  P                  WR4       K*  	  V P                  RW24       R # )NF)r   rA   r   r_   r   r[   Zunapply_policy_settingsrz   r{   r}   r   r`   Z"FirewallZone.unapply_zone_settings$  sp    ##D)kk% {{{))%00FHHOO33FH 1 	E56r    c                sh    V P                  V4      pVP                  V P                  V4      ^R7      # )8
:return: exported config updated with runtime settings
)Z	conf_dictZlength)rC   Zexport_config_tupleget_config_with_settings_dict)r   r3   r\   rB   r   get_config_with_settingsZ%FirewallZone.get_config_with_settings/  s:     mmD!&&88>r ' 
 	
r    c                s@   V P                  V4      P                  4       pVR,          \        8X  d   RVR&   RV P                  V4      RV P	                  V4      RV P                  V4      RV P                  V4      RV P                  V4      RV P                  V4      R	V P                  V4      R
V P                  V4      RV P                  V4      RV P                  V4      RV P                  V4      RV P                  V4      /pV P                  P!                  W#4      # )r~   rQ   ZdefaultrD   rG   rK   rH   rI   r8   r=   	rules_strrN   rJ   rL   rr   )rC   Zexport_config_dictr   list_services
list_portslist_icmp_blocksquery_masqueradelist_forward_portsr/   r0   
list_ruleslist_protocolslist_source_portsquery_icmp_block_inversionquery_forwardr   Z'combine_runtime_with_permanent_settings)r   r3   Z	permanentZruntimer4   r   r   Z*FirewallZone.get_config_with_settings_dict8  s    MM$'::<	X"55"+Ih**40T__T*4006$//5T44T:$..t4t((..,,T2D2248"D$C$CD$It))$/
 xx??	SSr    c                sF  a  RV 3R llpV 3R lpRS P                   S P                  3RS P                  S P                  3RS P                  S P
                  3RS P                  S P                  3RS P                  S P                  3R	S P                  S P                  3R
S P                  S P                  3RWE3RS P                  S P                  3RS P                   S P"                  3RS P$                  S P&                  3RS P(                  S P*                  3/pS P-                  V4      p\.        P.                  ! V4      pVP1                  VS P2                  P5                  4       4       S P2                  P7                  RV./4       S P9                  V4      p	S P2                  P;                  W4      w  rV F  p\=        W,          \>        4      '       dV   W,           FG  p\=        V\@        4      '       d   Wl,          ^,          ! V.VO5!   K2  Wl,          ^,          ! W4       KI  	  Kt  Wl,          ^,          ! V4       K  	  V
 F  p\=        W,          \>        4      '       d}   W,           Fn  pVR9   d   Wl,          ^ ,          ! WVR7       K#  \=        V\@        4      '       d   Wl,          ^ ,          ! V.VO5R^ RV/  KV  Wl,          ^ ,          ! W^ VR7       Kp  	  K  VR9   d   Wl,          ^ ,          ! WR7       K  Wl,          ^ ,          ! V^ VR7       K  	  R# )r    Nc                 sD   < SP                  V \        VR 7      W#R7       R# )rule_strtimeoutsenderN)add_ruler   )r3   r   r   r   r   s   &&&&r   add_rule_wrapperZDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperQ  s     MMi2G  r    c                 s@   < SP                  V \        VR 7      4       R# )r   N)remove_ruler   )r3   r   r   s   &&r   remove_rule_wrapperZGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapperV  s    T9h#?@r    rD   rG   rK   rH   rI   r8   r=   r   rN   rJ   rL   rr   Zzones)r   r   r   r   r    N)r8   r=   )rL   )!add_serviceremove_serviceadd_portremove_portadd_icmp_blockremove_icmp_blockadd_masqueraderemove_masqueradeadd_forward_portremove_forward_portadd_interfaceremove_interface
add_sourceremove_sourceadd_protocolremove_protocoladd_source_portremove_source_portadd_icmp_block_inversionremove_icmp_block_inversionadd_forwardremove_forwardrC   rR   Zimport_config_dictr   Zget_all_io_objects_dictr'   r   Zget_added_and_removed_settingsrs   listZtuple)r   r3   Zsettingsr   r   r   Zsetting_to_fnZold_objZ	check_objZold_settingsZadd_settingsZremove_settingsry   r(   s   f&&&          r   set_config_with_settings_dictZ*FirewallZone.set_config_with_settings_dictO  s   	
	A ))4+>+>?dmmT%5%56D//1G1GH4..0F0FGd33T5M5MN4--t/D/DE););<*@$++T-A-ABT1143J3JK"--00% (($*=*=>
( --%IIg&	$$Xtxx/O/O/QR""Gi[#9:99$?*.((*Q*Q+
' #C/.55+00D!$..%*1-d:T:%*1-d9	 1 "1%d+ #  C,+T22(--D77%*1-dH%dE22).q1$XXqXQWX).q1$aPVW . 22!&q)$>!&q)$&I!  r    c                s<    V P                   P                  V4       R # r   )r   check_interfacer   r9   r   r   r   ZFirewallZone.check_interface  s      +r    c                s(    V P                  V4       V# r   )r   r   r   r   Z__interface_idZFirewallZone.__interface_id  s    Y'r    Nc                s8   V P                   P                  4        V P                   P                  V4      pV P                  V,          pV P	                  V4      pWeP
                  9   d$   \        \        P                  R V: RV: R 24      hV P                  V4      pVe$   \        \        P                  R V: RV: R 24      h\        P                  ! RV: RV: R 24       V P                  4       ;_uu_ 4       pVP                  '       g/   V P                  W4       VP!                  V P"                  VR4       V P%                  RWBV4       V P'                  WVW4       VP!                  V P(                  WV4       RRR4       V#   + '       g   i     T# ; i)'' already bound to 'NzSetting zone of interface 'z' to 'FT)r   check_panicrA   r   r7   r8   r   r   ZONE_ALREADY_SETr;   ZONE_CONFLICTr   rc   r%   r_   rd   add_failrg   rt   !_FirewallZone__register_interface#_FirewallZone__unregister_interface)	r   r3   r9   r   r|   _objr:   zoir&   	   &&&&     r   r   ZFirewallZone.add_interface  sF   ##D){{5!**95??*''094@  ((3?$$iQT&U  	

y%PQ""$$<<<((;$$T%:%:E5IOOD%K@%%d$G  !<!<dQ %  %$ s   <BFF	c                s   VP                   P                  V4       V'       d   VR 8X  d&   V P                  P                  P                  V4       V\	        4       8X  d(   V P                  P
                  P                  V4       R# R# ) N)r8   r1   r   _default_zone_interfacesr   _nm_assigned_interfaces)r   r   r:   r3   r      &&&&&r   Z__register_interfaceZ!FirewallZone.__register_interface  s]    |,trzHH--44\B_&&HH,,33LA 'r    c                s    V P                   P                  4        V P                  V4      pV P                   P                  V4      pWT8X  d   V# Ve   V P	                  WB4       V P                  WV4      pV# r   )r   r   r;   rA   r   r   )r   r3   r9   r   	_old_zone	_new_zoner|      &&&&   r   change_zone_of_interfaceZ%FirewallZone.change_zone_of_interface  sm    ..y9	HH''-	! !!)7""4F;r    c           
     sX   V P                   P                  4        V P                  V4      pVf"   \        \        P
                  RV,          4      hVR8X  d   TMV P                   P                  V4      pW48w  d(   \        \        P                  RV: RV: RV: R24      hV P                  4       ;_uu_ 4       pV P                  V,          pV P                  V4      pVP                  V P                  Wg4       V P                  RWBV4       R R R 4       V#   + '       g   i     T# ; i)N'%s' is not in any zoner   zremove_interface(, z): zoi='r   F)r   r   r;   r   r   ZUNKNOWN_INTERFACErA   r   r%   r   r7   add_postr   rt   )r   r3   r9   r   r|   r&   r   r:   s   &&&     r   r   ZFirewallZone.remove_interface  s    ((3;((*Ci*O  rztxx':':4'@<$$8<iM 
 ""$$;;u%D..y9L  !<!<dQOOE5[A %  %$ s   :ADD)	c                s\   W!P                   9   d   VP                   P                  V4       W P                  P                  9   d&   V P                  P                  P                  V4       W P                  P                  9   d(   V P                  P                  P                  V4       R # R # r   )r8   remover   r   r   )r   r   r:   r+   r   Z__unregister_interfaceZ#FirewallZone.__unregister_interface  ss    ??*OO""<088<<<HH--44\B88;;;HH,,33LA <r    c                s\    V P                  V4      V P                  V4      P                  9   # r   )r7   rC   r8   )r   r3   r9   r+   r   query_interfaceZFirewallZone.query_interface  s'    ""9-t1D1O1OOOr    c                8    V P                  V4      P                  # r   )rC   r8   r   r3   r   r   r/   ZFirewallZone.list_interfaces  s    }}T"---r    c                sv   \        V4      '       d   R # \        V4      '       d   R# \        V4      '       d   R# VP                  R4      '       dQ   V P	                  VR,          4       V'       d   V P                  VR,          4       V P                  VR,          4      # \        \        P                  V4      h)rm   rn   r   zipset::i   NN)
r   r   r   Z
startswith_check_ipset_type_for_source_check_ipset_applied_ipset_familyr   r   ZINVALID_ADDRr   r>   r_   r+   r   ru   ZFirewallZone.check_source  s    6""vx((--fRj9))&*5%%fRj11 3 3V<<r    c                s*    V P                  WR 7       V# )r_   )ru   r   r+   r   Z__source_idZFirewallZone.__source_id	  s    &2r    c           	     s^   V P                   P                  4        V P                   P                  V4      pV P                  V,          p\	        V4      '       d   VP                  4       pV P                  VR R7      pV P                  VR R7      pWuP                  9   d$   \        \        P                  RV: RV: R24      hV P                  V4      e"   \        \        P                  RV,          4      hV P                  4       ;_uu_ 4       pVP                  '       g/   V P!                  W4       VP#                  V P$                  VR4       V P'                  R WFWx4       V P)                  WWW4       VP#                  V P*                  WW4       RRR4       V#   + '       g   i     T# ; i)Tr   r   r   Nz'%s' already bound to a zoneF)r   r   rA   r   r   upperru   r<   r=   r   r   r   r@   r   r%   r_   rd   r   rg   rv   _FirewallZone__register_source _FirewallZone__unregister_source)	r   r3   r>   r   r|   r   ro   r?   r&   r   r   r   ZFirewallZone.add_source  sa   ##D){{5!V\\^F5$$VT$:	$''QV)W  ""6*6$$&Dv&M  ""$$<<<((;$$T%:%:E5ILLu9B""4DA  !9!94K %  %$ s   BFF,	c                s<    VP                   P                  V4       R # r   )r=   r1   )r   r   r?   r3   r   r   r   Z__register_sourceZFirewallZone.__register_source.  s    I&r    c                s2   V P                   P                  4        V P                  V4      pV P                   P                  V4      pWT8X  d   V# \	        V4      '       d   VP                  4       pVe   V P                  WB4       V P                  WV4      pV# r   )r   r   r@   rA   r   r   r   r   )r   r3   r>   r   r   r   r|   r   r   change_zone_of_sourceZ"FirewallZone.change_zone_of_source1  s    ++F3	HH''-	!V\\^F y1f5r    c           
     s   V P                   P                  4        \        V4      '       d   VP                  4       pV P	                  V4      pVf"   \        \        P                  RV,          4      hVR8X  d   TMV P                   P                  V4      pW48w  d(   \        \        P                  RV: RV: RV: R24      hV P                  4       ;_uu_ 4       pV P                  V,          pV P                  V4      pV P                  V4      pVP                  V P                  Wh4       V P!                  RWGW4       R R R 4       V#   + '       g   i     T# ; i)Nr   r   zremove_source(r   z): zos='r   F)r   r   r   r   r@   r   r   ZUNKNOWN_SOURCErA   r   r%   r   ru   r<   r   r   rv   )	r   r3   r>   Zzosr|   r&   r   ro   r?   s	   &&&      r   r   ZFirewallZone.remove_sourceC  s!   V\\^F%%f-;%%'@6'I  rztxx':':4'@<$$5963G 
 ""$$;;u%D##F+C((0I  !9!94KLLIC %  %$ s   A%E

E	c                s`    W!P                   9   d   VP                   P                  V4       R # R # r   )r=   r   )r   r   r?   r+   r   Z__unregister_sourceZ FirewallZone.__unregister_source]  s#    $LL	* %r    c                s    \        V4      '       d   VP                  4       pV P                  V4      V P                  V4      P                  9   # r   )r   r   r<   rC   r=   )r   r3   r>   r+   r   query_sourceZFirewallZone.query_sourcea  s=    V\\^F'4==+>+F+FFFr    c                r   r   )rC   r=   r   r   r   r0   ZFirewallZone.list_sourcesf      }}T"***r    c           	     s0    V P                  WW4VR R7       R# )TlastN)6_interface_or_source_update_policies_derived_from_zone)r   rx   r3   r9   r>   r&   s   &&&&&&r   ,_interface_or_source_update_zone_terminationZ9FirewallZone._interface_or_source_update_zone_terminationi  s!     	CC)[t 	D 	
r    c                s$   V P                  VR 4      pV P                  P                  P                  VVVR VVRRVVR7
       V P                  R V4      pV P                  P                  P                  VVR VRRVVVVR7
       VR8w  d"   \	        V P                  4       V.,           4      MV P                  P                  .pV EFG  p	W8w  d$   V P                  V	4      P                  '       g   K-  \        V P                  V	4      4      p
\        V P                  V	4      4      pW)8X  d    V'       d   W:9  d   V
P                  V4       W)8X  d    V'       d   WK9  d   VP                  V4       VR8X  d   R.p
. pM2WP                  P                  8X  d   RV
9  d   V
P                  R4       V
 EF  pV P                  VR4      pV P                  P                  P                  VVVV	VVVRVVR7
       V P                  RV4      pV P                  P                  P                  VVV	VVRVVVVR7
       W<8w  g   K  V P                  V	R4      pV P                  P                  P                  VVV	VVRVVVVR7
       V P                  RV	4      pV P                  P                  P                  VVVV	VVVRVVR7
       EK  	  V EF?  pV'       d(   V P                  V4      V P                  V4      8w  d   K3  V P                  VR4      pV P                  P                  P                  VVVV	VVRVVVR7
       V P                  RV4      pV P                  P                  P                  VVV	VRVVVVVR7
       WM8w  g   K  V P                  V	R4      pV P                  P                  P                  VVV	VRVVVVVR7
       V P                  RV	4      pV P                  P                  P                  VVVV	VVRVVVR7
       EKB  	  EKJ  	  R# )rE   r   r   +rF   N)r,   r   r[   Z_ingress_egress_pairrT   r5   r2   rC   r_   r   r/   r0   r1   ru   )r   rx   r3   r9   r>   r&   r   r[   Z_zoneB_listZ_zoneBZ_zoneB_interfacesZ_zoneB_sourcesZ_zoneB_interfaceZ_zoneB_sources   &&&&&&&       r   r   ZCFirewallZone._interface_or_source_update_policies_derived_from_zonep  sL    ,,T6:,, 	- 	
 ,,VT:,, 	- 	
 C %%'4&01(((() 	
 "F~dmmF&;&C&C&C $T%9%9&%A B!$"3"3F";<N~)	0R!((3~&V-I%%f-C%(E!!#88111cAR6R!((-$5 44T5A44$ 5  44UDA44$ 5  0!88GFHHOO88(!#! 9  "88GFHHOO88!(#! 9 U %6l "0d//74;L;L!<  44T5A44! 5  44UDA44! 5  *!88GFHHOO88%!#! 9  "88GFHHOO88!%#! 9 _ "0Q "r    c           
     s   V P                   P                  P                  4        EF(  pV'       dh   V P                   P                  P                  V4      P                  '       g3   VP                  V P                   P                  P                  V4       Ks  V P                   P                  P                  V4      P                  '       g   K  V'       g1   VP                  V P                   P                  P                  V4       V P                   P                  P                  V4      pV P                   P                  P                  V4      pR V9   da   R V9   dZ   V P                   P                  P                  VVVVVVR7       V P                   P                  P                  VVVVVVR7       EK  R V9   d6   RV9   d/   V P                   P                  P                  VVVVVVR7       EK  RV9   d6   R V9   d/   V P                   P                  P                  VVVVVVR7       EK  W'9   da   R V9   dZ   V P                   P                  P                  VVVVVVR7       V P                   P                  P                  VVVVVVR7       EKq  W'9   d6   RV9   d/   V P                   P                  P                  VVVVVVR7       EK  R V9   d`   W(9   dZ   V P                   P                  P                  VVVVVVR7       V P                   P                  P                  VVVVVVR7       EK  RV9   d5   W(9   d/   V P                   P                  P                  VVVVVVR7       EKM  W'9   d`   W(9   dZ   V P                   P                  P                  VVVVVVR7       V P                   P                  P                  VVVVVVR7       EK  W'9   g   R V9   d/   V P                   P                  P                  VVVVVVR7       EK  W(9   g   R V9   g   EK  V P                   P                  P                  VVVVVVR7       EK+  	  R# )rF   )ZingressInterfaceZingressSource)ZegressInterfaceZegressSourcerE   N)r   r[   Z"get_policies_not_derived_from_zoneZ
get_policyr_   r   Ztry_apply_policy_settingsZtry_unapply_policy_settingsZlist_ingress_zonesZlist_egress_zonesZ_ingress_zoneZ_egress_zone)	r   rx   r3   r9   r>   r&   r[   Zingress_zone_listZegress_zone_list	   &&&&&&   r   $_interface_or_source_update_policiesZ1FirewallZone._interface_or_source_update_policies  s   
 hhooHHJFdhhoo88@HHH$$TXX__%N%NPVW++F3;;;((CCV %)HHOO$F$Fv$N!#'88??#D#DV#L --%;K2KHHOO11#)2&, 2  HHOO00#(1%+ 1  //F>N4NHHOO11#)2&, 2  00U>N5NHHOO00#(1%+ 1  .5<L3LHHOO11#)2&, 2  HHOO00#(1%+ 1  .6=M3MHHOO11#)2&, 2  //D4LHHOO11#)2&, 2  HHOO00#(1%+ 1  00T5MHHOO00#(1%+ 1  .43KHHOO11#)2&, 2  HHOO00#(1%+ 1  .%;L2LHHOO11#)2&, 2  -:J1JHHOO00#(1%+ 1 } Kr    c           	     s   V P                   P                  4        F{  pVP                  '       g   K  VR 8X  d   K   V P                  VR4      pV P	                  V4      P
                  '       g   KU  VP                  WVRVR7      pVP                  WW4       K}  	  V P                  WVRV4       V P                  WVRV4       V P                  WVRV4       R# )r   rF   filterr9   r   N)r   enabled_backendspolicies_supportedr,   rC   rr   build_zone_forward_rules	add_rulesr   r   r   )r   rx   r3   r9   r&   backendr[   rM   rp   r   rt   ZFirewallZone._interface  s    xx002G---C 00u=F}}T"***88&(i 9  %%g5 3 	99)R	
 	CC)R	
 	11)R	
r    c                s    V P                  V4      R 8X  d   R# V P                  P                  P                  VRR7      # )zhash:macNFr   )_ipset_typer   ipsetZ
get_familyr   rO   r   r   r   ZFirewallZone._ipset_family  s6    D!Z/xx~~((u(==r    c                sP    V P                   P                  P                  VR R7      # )Fr   )r   r   Zget_typer   r   r   r   ZFirewallZone._ipset_type  s     xx~~&&tU&;;r    c                sz    R P                  V.V P                  P                  P                  V4      ,          4      # )Z,)Zjoinr   r   Zget_dimension)r   rO   Zflagr+   r   _ipset_match_flagsZFirewallZone._ipset_match_flags  s+    xx!=!=d!CCDDr    c                sL    V P                   P                  P                  V4      # r   )r   r   Zcheck_appliedr   r   r   r   Z!FirewallZone._check_ipset_applied  s    xx~~++D11r    c                s    V P                  V4      pV\        9  d$   \        \        P                  R V: RV: R24      hR# )zipset 'z' with type 'z' not usable as sourceN)r   r   r   r   ZINVALID_IPSET)r   rO   Z_typerB   r   r   Z)FirewallZone._check_ipset_type_for_source  s>      &**$$DH%P  +r    c           	     s   V'       d   V P                   P                  V4      .MV P                   P                  4        Fr  pVP                  '       g   K  V P	                  VR 4      pV P                  V4      P                  '       g   KL  VP                  WVRVR7      pVP                  Wh4       Kt  	  V P                  WRWE4       V P                  WRWE4       V P                  WRWE4       R# )rF   r   r>   r   N)r   get_backend_by_ipvr   r   r,   rC   rr   r   r   r   r   r   )	r   rx   r3   ro   r>   r&   r   r[   rM   r   r   rv   ZFirewallZone._source  s     36TXX((-.488;T;T;VV  --- 00u=F}}T"***88&(6 9  %%g5 W 	99"f	
 	CC"f	
 	11&FXr    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WRW44       V# rE   )r   rA   r,   r[   r   )r   r3   servicer   r   p_name   &&&&& r   r   ZFirewallZone.add_service  sE    xx""4(,,T6:##FWEr    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  W24       V# r   )r   rA   r,   r[   r   r   r3   r   r   rf   r   r   ZFirewallZone.remove_service  sC    xx""4(,,T6:&&v7r    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  W24      # r   )r   rA   r,   r[   query_servicer   rf   r   r   ZFirewallZone.query_service  sA    xx""4(,,T6:xx,,V==r    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  V4      # r   )r   rA   r,   r[   r   r   r3   r   rB   r   r   ZFirewallZone.list_services  sA    xx""4(,,T6:xx,,V44r    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WbW4V4       V# r   )r   rA   r,   r[   r   )r   r3   portprotocolr   r   r      &&&&&& r   r   ZFirewallZone.add_port  sG    xx""4(,,T6:  x&Ir    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WBV4       V# r   )r   rA   r,   r[   r   r   r3   r   r   r      &&&& r   r   ZFirewallZone.remove_port
  sE    xx""4(,,T6:##F(;r    c                    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WBV4      # r   )r   rA   r,   r[   
query_portr   r   r   r   ZFirewallZone.query_port  sC    xx""4(,,T6:xx))&AAr    c                r   r   )r   rA   r,   r[   r   r   rB   r   r   ZFirewallZone.list_ports  sA    xx""4(,,T6:xx))&11r    c                r   r   )r   rA   r,   r[   r   )r   r3   source_portr   r   r   r   r   r   r   ZFirewallZone.add_source_port  sH    xx""4(,,T6:''XPVWr    c                r   r   )r   rA   r,   r[   r   r   r3   r   r   r   r   r   r   ZFirewallZone.remove_source_port   sE    xx""4(,,T6:**6Ir    c                r   r   )r   rA   r,   r[   query_source_portr   r   r   r   ZFirewallZone.query_source_port&  sC    xx""4(,,T6:xx00hOOr    c                r   r   )r   rA   r,   r[   r   r   rB   r   r   ZFirewallZone.list_source_ports+  sA    xx""4(,,T6:xx0088r    c           	     s   V P                   P                  V4      p\        VP                  \        4      '       d   V P                  VR 4      # \        VP                  \        \        \        \        \        \        34      '       d   V P                  VR4      # \        VP                  \        4      '       d   V P                  VR 4      # \        VP                  \        4      '       d   V P                  R V4      # \        VP                  \        4      '       d   V P                  VR 4      # VP                  f   V P                  VR4      # \!        \"        P$                  R\'        VP                  4      ,          4      h)rF   rE   z Rich rule type (%s) not handled.)r   rA   rs   Zactionr	   r,   Zelementr   r   r   r   r   r   r   r
   r   r   r   ZINVALID_RULEZtype)r   r3   rX   r+   r   rU   Z&FirewallZone._get_policy_for_rich_rule0  s,   xx""4(dkk9--..tU;;LL

 

 ..tV<<dll$455..tU;;dllO44..ud;;dll$677..tU;;<<..tV<<.$t||2DE
 	
r    c                st    V P                  W4      pV P                  P                  P                  WRW44       V# r   )rU   r   r[   r   )r   r3   rX   r   r   r   r   r   r   ZFirewallZone.add_ruleM  s/    //;  w?r    c                sr    V P                  W4      pV P                  P                  P                  W24       V# r   )rU   r   r[   r   r   r3   rX   r   rf   r   r   ZFirewallZone.remove_ruleR  s-    //;##F1r    c                sn    V P                  W4      pV P                  P                  P                  W24      # r   )rU   r   r[   
query_ruler   rf   r   r  ZFirewallZone.query_ruleW  s+    //;xx))&77r    c                sT   V P                   P                  V4      p\        4       pV P                  VR 4      V P                  VR4      V P                  R V4      3 F@  pVP	                  \        V P                   P
                  P                  V4      4      4       KB  	  \        V4      # )rF   rE   )r   rA   rT   r,   Zupdater[   r   r   )r   r3   Zretr   r4   r   r   ZFirewallZone.list_rules[  s    xx""4(e''e4''f5''t4
F
 JJs488??55f=>?
 Cyr    c                r   r   )r   rA   r,   r[   r   )r   r3   r   r   r   r   r   r   r   ZFirewallZone.add_protocolf  sE    xx""4(,,T6:$$VwGr    c                r   r   )r   rA   r,   r[   r   r   r3   r   r   rf   r   r   ZFirewallZone.remove_protocoll  sC    xx""4(,,T6:''9r    c                r   r   )r   rA   r,   r[   query_protocolr  rf   r   r  ZFirewallZone.query_protocolr  sA    xx""4(,,T6:xx--f??r    c                r   r   )r   rA   r,   r[   r   r   rB   r   r   ZFirewallZone.list_protocolsw  sA    xx""4(,,T6:xx--f55r    c                s    V P                   P                  V4      pV P                  R V4      pV P                   P                  P	                  WBV4       V# rF   )r   rA   r,   r[   r   )r   r3   r   r   r   r   r   r   ZFirewallZone.add_masquerade|  sE    xx""4(,,UD9&&v?r    c                s    V P                   P                  V4      pV P                  R V4      pV P                   P                  P	                  V4       V# r  )r   rA   r,   r[   r   r   rB   r   r   ZFirewallZone.remove_masquerade  sC    xx""4(,,UD9))&1r    c                s    V P                   P                  V4      pV P                  R V4      pV P                   P                  P	                  V4      # r  )r   rA   r,   r[   r   r   rB   r   r   ZFirewallZone.query_masquerade  sA    xx""4(,,UD9xx//77r    c           	     s    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WW4WVV4       V# r  )r   rA   r,   r[   r   )	r   r3   r   r   toporttoaddrr   r   r   s	   &&&&&&&& r   r   ZFirewallZone.add_forward_port  sP     xx""4(,,T59(((FV	
 r    c                r   r  )r   rA   r,   r[   r   r   r3   r   r   r  r  r   r   r   r   Z FirewallZone.remove_forward_port  sG    xx""4(,,T59++F(FSr    c                s    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WbW4V4      # r  )r   rA   r,   r[   query_forward_portr  r   r   r  ZFirewallZone.query_forward_port  sJ    xx""4(,,T59xx11(F
 	
r    c                r   r  )r   rA   r,   r[   r   r   rB   r   r   ZFirewallZone.list_forward_ports  sA    xx""4(,,T59xx11&99r    c                r   r   )r   rA   r,   r[   r   )r   r3   icmpr   r   r   r   r   r   ZFirewallZone.add_icmp_block  sE    xx""4(,,T6:&&vWEr    c                r   r   )r   rA   r,   r[   r   )r   r3   r	  r   rf   r   r   ZFirewallZone.remove_icmp_block  sC    xx""4(,,T6:))&7r    c                r   r   )r   rA   r,   r[   query_icmp_block)r   r3   r	  p_name_hostrf   r   r
  ZFirewallZone.query_icmp_block  sA    xx""4(11$?xx//BBr    c                s    V P                   P                  V4      pV P                  VR 4      p\        \	        V P                   P
                  P                  V4      4      4      # r   )r   rA   r,   r-   rT   r[   r   r   r3   r  rB   r   r   ZFirewallZone.list_icmp_blocks  sK    xx""4(11$?c$((//::;GHIIr    c                r   r   )r   rA   r,   r[   r   )r   r3   r   r   rf   r   r   Z%FirewallZone.add_icmp_block_inversion  sC    xx""4(,,T6:00@r    c                s    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  WV4       R# )rE   N)r   rA   r,   r[   rw   )r   rx   r3   r&   r   r   r   rw   Z"FirewallZone._icmp_block_inversion  s@    xx""4(,,T6:--fkJr    c                s    V P                   P                  V4      pV P                  VR 4      pV P                   P                  P	                  V4       V# r   )r   rA   r,   r[   r   r   rB   r   r   Z(FirewallZone.remove_icmp_block_inversion  sC    xx""4(,,T6:33F;r    c                r   r   )r   rA   r,   r[   r   r  rB   r   r   Z'FirewallZone.query_icmp_block_inversion  sA    xx""4(11$?xx99+FFr    c           
     s   V P                  VR 4      pV P                  V,          P                   F^  pV P                  P	                  4        F=  pVP
                  '       g   K  VP                  WVRVR7      pVP                  Wg4       K?  	  K`  	  V P                  V,          P                   F  pV P                  V4      p	V	'       d   V P                  P                  V	4      .MV P                  P	                  4        F=  pVP
                  '       g   K  VP                  WVRVR7      pVP                  Wg4       K?  	  K  	  R# )rF   r   r   r   N)r,   r   r8   r   r   r   r   r   r=   ru   r   )
r   rx   r3   r&   r   r9   r   rM   r>   ro   s
   &&&&      r   _forwardZFirewallZone._forward  s&   ,,T59T*55I8844611188&(i 9  %%g5 7 6 kk$'//F##F+C  ,,S12XX..01 
 11188&(6 9  %%g51 0r    c                s@   V P                   P                  V4      pV P                   P                  V4       V P                   P                  4        V P                  V,          pVP
                  '       d"   \        \        P                  R V,          4      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RWF4       V P                  WRV4       VP                  V P                  V4       RRR4       V#   + '       g   i     T# ; i)zforward already enabled in '%s'TN)r   rA   Zcheck_timeoutr   r   rr   r   r   ZALREADY_ENABLEDr%   r_   r  _FirewallZone__register_forwardr   !_FirewallZone__unregister_forward)r   r3   r   r   r|   r   r&   r   r   r   ZFirewallZone.add_forward  s    ##D)w'{{5!<<<&&(IE(Q  ""$$|||dE7##D6:  !:!:DA %  %$ s   /ADD	c                    R Vn         R# )TNrr   )r   r   r   r   s   &&&&r   Z__register_forwardZFirewallZone.__register_forward  s	    r    c                s   V P                   P                  V4      pV P                   P                  4        V P                  V,          pVP                  '       g"   \        \        P                  R V,          4      hV P                  4       ;_uu_ 4       pVP                  '       d   V P                  RW$4       VP                  V P                  V4       RRR4       V#   + '       g   i     T# ; i)zforward not enabled in '%s'FN)r   rA   r   r   rr   r   r   ZNOT_ENABLEDr%   r_   r  r   r  )r   r3   r|   r   r&   r]   r   r   ZFirewallZone.remove_forward  s    ##D){{5!|||""$AE$I  ""$$|||eU8  !:!:DA %  %$ s   ACC0	c                r  )FNr  )r   r   r   r   Z__unregister_forwardZ!FirewallZone.__unregister_forward  s	    r    c                r   r   )rC   rr   r   r   r   r   ZFirewallZone.query_forward!  r   r    )r   r   r   )Tr   )Fr   )NNr    N)NN)eZ__name__Z
__module__Z__qualname__Z__firstlineno__rP   r   r#   r$   r%   r,   r.   r5   r;   r@   rC   rZ   r^   ra   re   rg   rk   rl   rq   rz   rd   r`   r   r   r   r   r7   r   r   r   r   r   r   r/   ru   r<   r   r   r   r   r   r   r0   r   r   r   rt   r   r   r   r   r   rv   r   r   r   r   r   r   r   r   r   r   r   r   rU   r   r   r  r   r   r   r  r   r   r   r   r   r   r  r   r   r   r
  r   r   rw   r   r   r  r   r  r   r  r   Z__static_attributes__Z__classdictcell__)Z__classdict__s   @r   r   r      s    !
8$S
*<|=0&<,G.B86	7
T.BJL,BB.BP.
=B'$4+G
+
fPJX
6>
<E2Y2>
5
B
2
P
9

:

8	@
6
8

:
C
J
K
G
64*&+ +r    r   ) rR   Zfirewall.core.baser   r   r   Zfirewall.core.io.policyr   Zfirewall.core.loggerr   Zfirewall.core.richr   r   r   r	   r
   r   r   r   r   r   r   Zfirewall.core.fw_nmr   Zfirewall.functionsr   r   r   Zfirewallr   Zfirewall.errorsr   r   ) r    r   <module>r     sG     Q Q * $    0 E E  )C+ C+r    