Warning: session_start(): Session cannot be started after headers have already been sent in /home/tvrreohg/public_html/manga.php on line 13
3
Yj=V @ s d dl Z d dlZd dlmZ d dlmZmZmZmZm Z m
Z
m Z m Z m
Z
mZ d dlmZmZmZmZmZmZmZmZmZmZmZ d dlm Z d dl m Z d dl m Z d dl!m"Z" d d l#m$Z$ G d
d d e%Z&dS ) N)log)
portStr checkIPnMask
checkIP6nMask
checkProtocolenable_ip_forwardingcheck_single_addressportInPortRangeget_nf_conntrack_short_namecoalescePortRangebreakPortRange) Rich_Rule Rich_Accept Rich_Service Rich_Port
Rich_ProtocolRich_MasqueradeRich_ForwardPortRich_SourcePortRich_IcmpBlock
Rich_IcmpType Rich_Mark)FirewallTransaction)errors)
FirewallError)LastUpdatedOrderedDict)SOURCE_IPSET_TYPESc @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
d ddZdd Zd d Zd d Zd d d!Zd
d"d#Zdd$d%Zd&d' Zd(d) Zd*d+ Zd,d- Zdd0d1Zd2d3 Zdd4d5Zd6d7 Z d8d9 Z d:d; Z dd? Z dd@dAZ!dBdC Z"ddDdEZ#dFdG Z$dHdI Z%dJdK Z&dLdM Z'dNdO Z(dPdQ Z)dRdS Z*ddTdUZ+dVdW Z,ddXdYZ-dZd[ Z.d\d] Z/d^d_ Z0d`da Z1dbdc Z2ddddeZ3dfdg Z4ddhdiZ5djdk Z6dldm Z7dndo Z8dpdq Z9drds Z:dtdu Z;dvdw Z<ddxdyZ=dzd{ Z>dd|d}Z?d~d Z@dd ZAdd ZBdd ZCdd ZDdddZEdd ZFdddZGdd ZHdd ZIdd ZJdd ZKdddZLdd ZMd ddZNdd ZOdd ZPdd ZQdd ZRd ddZSdd ZTd ddZUdd ZVdd ZWd ddZXd ddZYd!ddZZdd Z[d"ddZ\dd Z]d#ddZ^dd Z_dd Z`dd Zad$ddÄZbddń Zcd%ddDŽZdddɄ Zedd˄ Zfdd̈́ Zgddτ Zhd&ddфZiddӄ ZjddՄ Zkd'ddׄZlddل Zmddۄ Zndd݄ Zodd߄ Zpdd Zqdd Zrdd Zsdd Ztdd Zud(ddZvd)ddZwdd Zxdd Zydd Zzdd Z{d*ddZ|dd Z}dd Z~dd Zdd Zd d Zdd Zdd Zdd Zd+d d
ZdS (, FirewallPolicyc C s || _ i | _i | _d S )N)_fw_chains _policies)selffw r# /usr/lib/python3.6/fw_policy.py__init__ s zFirewallPolicy.__init__c C s d| j | j| jf S )Nz
%s(%r, %r)) __class__r r )r! r# r# r$ __repr__ s zFirewallPolicy.__repr__c C s | j j | jj d S )N)r clearr )r! r# r# r$ cleanup s
zFirewallPolicy.cleanupc C s
t | jS )N)r r )r! r# r# r$ new_transaction$ s z FirewallPolicy.new_transactionc C s t | jj S )N)sortedr keys)r! r# r# r$ get_policies) s zFirewallPolicy.get_policiesc C s8 g }x*| j D ] }| j|}|js|j| qW t|S )N)r-
get_policyderived_from_zoneappendr+ )r! Zpoliciespp_objr# r# r$ "get_policies_not_derived_from_zone, s
z1FirewallPolicy.get_policies_not_derived_from_zonec C s~ g }xt| j D ]h}| j|}t|d t| jjj tddgB @ rt|d t| jjj tddgB @ r|j| qW |S )N
ingress_zonesHOSTANY egress_zones)r3 get_settingssetr zoneZget_active_zonesr0 )r! Zactive_policiespolicysettingsr# r# r$ )get_active_policies_not_derived_from_zone4 s
((z8FirewallPolicy.get_active_policies_not_derived_from_zonec C s | j j|}| j| S )N)r check_policyr )r! r; r1 r# r# r$ r. > s zFirewallPolicy.get_policyc C s, dd dD |_ || j|j< | j|j d S )Nc S s i | ] }t |qS r# )r ).0xr# r# r$
C s z-FirewallPolicy.add_policy..servicesports
masquerade
forward_ports source_ports icmp_blocksrules protocolsicmp_block_inversionr4 r7 ) rB rC rD rE rF rG rH rI rJ r4 r7 )r< r namecopy_permanent_to_runtime)r! objr# r# r$
add_policyB s
zFirewallPolicy.add_policyc C s0 | j | }|jr| j| |jj | j |= d S )N)r appliedunapply_policy_settingsr< r( )r! r; rM r# r# r$
remove_policyN s
z FirewallPolicy.remove_policyc C s | j | }|jrd S x |jD ]}| j||dd q W x |jD ]}| j||dd q r rO r* r/ %_get_table_chains_for_policy_dispatch#_get_table_chains_for_zone_dispatchgen_chain_rulesr8 _ingress_egress_zones _icmp_block
_forward_port_service_port _protocol _source_port _masquerade_FirewallPolicy__ruler
r r[ execute) r! enabler; rb _policyrM transactiontablechainr< keyr` r# r# r$ _policy_settings sj
z FirewallPolicy._policy_settingsc C s | j d||d d S )NT)rb )r )r! r; rb r# r# r$ rc s z$FirewallPolicy.apply_policy_settingsc C s | j d||d d S )NF)rb )r )r! r; rb r# r# r$ rP s z&FirewallPolicy.unapply_policy_settingsc C sr | j |j }| j|| j|| j|| j|| j|| j|| j|| j || j
|| j |d
}| j j
||S )zH
:return: exported config updated with runtime settings
)
rB rC rG rD rE
rich_rulesrI rF r4 r7 )r. Zexport_config_dict
list_services
list_portslist_icmp_blocksquery_masqueradelist_forward_ports
list_ruleslist_protocolslist_source_portslist_ingress_zoneslist_egress_zonesr Z'combine_runtime_with_permanent_settings)r! r; Z permanentZruntimer# r# r$ get_config_with_settings_dict s z,FirewallPolicy.get_config_with_settings_dictc s ddl m d
fdd } fdd}jjfjjfjjfjj fj
j f||fj j
fjjfjjfjjfd
}j|}jj||\}} xt| D ]l}
t| |
trxV| |
D ]8} t| tr||
d |f| q||
d || qW q||
d | qW x|D ]}
t||
trxn||
D ]J} t| trv||
d |f| d|d n||
d || d|d qFW n||
d |d|d q(W d S ) Nr )r
c s j | |dd|d d S )N)rk r )rg rf )r^ )r; rk rg rf )r
r! r# r$ add_rule_wrapper s zFFirewallPolicy.set_config_with_settings_dict..add_rule_wrapperc s j | |d d S )N)rk ) remove_rule)r; rk )r
r! r# r$ remove_rule_wrapper s zIFirewallPolicy.set_config_with_settings_dict..remove_rule_wrapper)
rB rC rG rD rE r rI rF r4 r7 rj )rg rf )r N)firewall.core.richr
rW remove_servicerX remove_portrU remove_icmp_blockr_ remove_masqueraderV remove_forward_portr\ remove_protocolr] remove_source_portrS remove_ingress_zonerT remove_egress_zoner r Z get_added_and_removed_settings
isinstancelisttuple) r! r; r< rf r r Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr~ r` r# )r
r! r$ set_config_with_settings_dict s:
z,FirewallPolicy.set_config_with_settings_dictc C s& |st tj|dkr"| jj| d S )Nr5 r6 )r5 r6 )r r INVALID_ZONEr
check_zone)r! r: r# r# r$ check_ingress_zone s
z!FirewallPolicy.check_ingress_zonec C s | j | |S )N)r )r! r: r# r# r$ Z__ingress_zone_id" s
z FirewallPolicy.__ingress_zone_idr Tc C s | j j|}| j j| | j j | j| }| j|} | |jd krXttj d||f d|jd ksd|jd ks|d kr|jd rttj
d|dkrd|jd krttj
d|d kr| j }
n|}
|rJ|j r| j
d||
| j|| || |
j| j|| |j s:|| j krH| j||
d |
j| j|d n| j
d
||
n | j|| || |
j| j|| |d kr~|
jd
d S ) Nr4 z'%s' already in '%s'r6 r5 zI'ingress-zones' may only contain one of: many regular zones, ANY, or HOSTr7 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r>
check_timeout check_panicr _FirewallPolicy__ingress_zone_idr< r r rZ r r* rO ro &_FirewallPolicy__register_ingress_zoneadd_fail(_FirewallPolicy__unregister_ingress_zoner= rc re rx ) r! r; r: rg rf rb rR rz _objzone_idr{ r# r# r$ rS & s<
z FirewallPolicy.add_ingress_zonec C s | j |||jd |< d S )Nr4 ) _FirewallPolicy__gen_settingsr< )r! r r rg rf r# r# r$ Z__register_ingress_zoneS s z&FirewallPolicy.__register_ingress_zonec C s | j j|}| j j | j| }| j|}||jd krLttjd||f |d kr^| j }n|}|j
rt |jd dkr| j || n| j
d|| | j|| |j| j||d d || j kr| j
d|| n|j| j|| |d kr|jd |S )Nr4 z'%s' not in '%s'rj FT)r r> r r r r< r r NOT_ENABLEDr* rO lenrP ro r r r r= add_postrx )r! r; r: rb rz r r r{ r# r# r$ r V s,
z"FirewallPolicy.remove_ingress_zonec C s ||j d kr|j d |= d S )Nr4 )r< )r! r r r# r# r$ Z__unregister_ingress_zoney s z(FirewallPolicy.__unregister_ingress_zonec C s | j || j|d kS )Nr4 )r r8 )r! r; r: r# r# r$ query_ingress_zone} s z!FirewallPolicy.query_ingress_zonec C s t | j|d j S )Nr4 )r r8 r, )r! r; r# r# r$ r s z!FirewallPolicy.list_ingress_zonesc C s& |st tj|dkr"| jj| d S )Nr5 r6 )r5 r6 )r r r r r )r! r: r# r# r$ check_egress_zone s
z FirewallPolicy.check_egress_zonec C s | j | |S )N)r )r! r: r# r# r$ Z__egress_zone_id s
z FirewallPolicy.__egress_zone_idc C s | j j|}| j j| | j j | j| }| j|} | |jd krXttj d||f d|jd ksd|jd ks|d kr|jd rttj
d|dkrd|jd krttj
d|d kr| j }
n|}
|rJ|j r| j
d||
| j|| || |
j| j|| |j s:|| j krH| j||
d |
j| j|d n| j
d
||
n | j|| || |
j| j|| |d kr~|
jd
d S ) Nr7 z'%s' already in '%s'r6 r5 zH'egress-zones' may only contain one of: many regular zones, ANY, or HOSTr4 zF'HOST' can only appear in either ingress or egress zones, but not bothF)rb T)r6 r5 )r r> r r r _FirewallPolicy__egress_zone_idr< r r rZ r r* rO ro %_FirewallPolicy__register_egress_zoner '_FirewallPolicy__unregister_egress_zoner= rc re rx ) r! r; r: rg rf rb rR rz r r r{ r# r# r$ rT s<
z FirewallPolicy.add_egress_zonec C s | j |||jd |< d S )Nr7 )r r< )r! r r rg rf r# r# r$ Z__register_egress_zone s z%FirewallPolicy.__register_egress_zonec C s | j j|}| j j | j| }| j|}||jd krLttjd||f |d kr^| j }n|}|j
rt |jd dkr| j || n| j
d|| | j|| |j| j||d d || j kr| j
d|| n|j| j|| |d kr|jd |S )Nr7 z'%s' not in '%s'rj FT)r r> r r r r< r r r r* rO r rP ro r r r r= r rx )r! r; r: rb rz r r r{ r# r# r$ r s,
z!FirewallPolicy.remove_egress_zonec C s ||j d kr|j d |= d S )Nr7 )r< )r! r r r# r# r$ Z__unregister_egress_zone s z'FirewallPolicy.__unregister_egress_zonec C s | j || j|d kS )Nr7 )r r8 )r! r; r: r# r# r$ query_egress_zone s z FirewallPolicy.query_egress_zonec C s t | j|d j S )Nr7 )r r8 r, )r! r; r# r# r$ r s z FirewallPolicy.list_egress_zonesc C s |j d S )N)Zcheck)r! ruler# r# r$
check_rule s zFirewallPolicy.check_rulec C s | j | t|S )N)r str)r! r r# r# r$ Z __rule_id s
zFirewallPolicy.__rule_idc C sx |sd S |j r,t|j r dS t|j rtdS nHt|dr@|jr@dS t|drt|jrt| j|j | j|j | j|jS d S )Nipv4ipv6mac ipset) Zaddrr r hasattrr r _check_ipset_type_for_source_check_ipset_applied
_ipset_family)r! sourcer# r# r$ _rule_source_ipv s
z FirewallPolicy._rule_source_ipvc C s | j |||| d S )N)
_rule_prepare)r! ry r; r r{ r# r# r$ Z__rule s zFirewallPolicy.__rulec C sL | j j|}| j j| | j j | j| }| j|}||jd krh|jrP|jn|} tt j
d|| f |js|j rt |j t
rd|jd krtt jdd|jd krtt jdx6|jd D ](}
|
dkrq| j jj|
rtt jd qW |j rt |j trd|jd kr,|j jrtt jd
nb|jd r|j jsNtt jd x>|jd D ]0}
|
dkrlqZ| j jj|
rZtt jd qZW |jrt |jtrx>|jd D ]0}
|
dkrq| j jj|
rtt jd
qW |d kr| j } n|} |jr| jd||| | j|||| | j| j|| |d krH| j d |S )NrH z'%s' already in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfaceszAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zonezS'forward-port' cannot be used in a policy if an egress zone has assigned interfaceszR'mark' action cannot be used in a policy if an egress zone has assigned interfacesT)r6 r5 ) r r> r r r _FirewallPolicy__rule_idr< r/ r r rZ elementr r r r: list_interfacesr
to_addressINVALID_FORWARDactionr r* rO rw _FirewallPolicy__register_ruler _FirewallPolicy__unregister_rulerx ) r! r; r rg rf rb rz r rule_id_namer: r{ r# r# r$ r^
s`
zFirewallPolicy.add_rulec C s | j |||jd |< d S )NrH )r r< )r! r r rg rf r# r# r$ Z__register_ruleE s z FirewallPolicy.__register_rulec C s | j j|}| j j | j| }| j|}||jd kr\|jrD|jn|}ttj d||f |d krn| j
}n|}|j r| j d||| |j
| j|| |d kr|jd |S )NrH z'%s' not in '%s'FT)r r> r r r r< r/ r r r r* rO rw r r rx ) r! r; r rb rz r r r r{ r# r# r$ r I s"
zFirewallPolicy.remove_rulec C s ||j d kr|j d |= d S )NrH )r< )r! r r r# r# r$ Z__unregister_ruled s z FirewallPolicy.__unregister_rulec C s | j || j|d kS )NrH )r r8 )r! r; r r# r# r$
query_ruleh s zFirewallPolicy.query_rulec C s t | j|d j S )NrH )r r8 r, )r! r; r# r# r$ r k s zFirewallPolicy.list_rulesc C s | j j| d S )N)r
check_service)r! servicer# r# r$ r p s z FirewallPolicy.check_servicec C s | j | |S )N)r )r! r r# r# r$ Z __service_ids s
zFirewallPolicy.__service_idc C s | j j|}| j j| | j j | j| }| j|}||jd krh|jrP|jn|} tt j
d|| f |d krz| j }
n|}
|j r| j
d|||
| j|||| |
j| j|| |d kr|
jd |S )NrB z'%s' already in '%s'T)r r> r r r _FirewallPolicy__service_idr< r/ r r rZ r* rO rr !_FirewallPolicy__register_servicer #_FirewallPolicy__unregister_servicerx ) r! r; r rg rf rb rz r
service_idr r{ r# r# r$ rW w s&
zFirewallPolicy.add_servicec C s | j |||jd |< d S )NrB )r r< )r! r r rg rf r# r# r$ Z__register_service s z!FirewallPolicy.__register_servicec C s | j j|}| j j | j| }| j|}||jd kr\|jrD|jn|}ttj d||f |d krn| j
}n|}|j r| j d||| |j
| j|| |d kr|jd |S )NrB z'%s' not in '%s'FT)r r> r r r r< r/ r r r r* rO rr r r rx ) r! r; r rb rz r r r r{ r# r# r$ r s"
z FirewallPolicy.remove_servicec C s ||j d kr|j d |= d S )NrB )r< )r! r r r# r# r$ Z__unregister_service s z#FirewallPolicy.__unregister_servicec C s | j || j|d kS )NrB )r r8 )r! r; r r# r# r$
query_service s z FirewallPolicy.query_servicec C s | j |d j S )NrB )r8 r, )r! r; r# r# r$ r s z FirewallPolicy.list_servicesc C sT g }xJ|D ]B}y| j jj|}W n tk
r@ ttj|Y nX |j| q
W |S )N)r helper
get_helperr r INVALID_HELPERr0 )r! helpers_helpersr _helperr# r# r$ get_helpers_for_service_helpers s
z.FirewallPolicy.get_helpers_for_service_helpersc C s g }x|D ]}y| j jj|}W n tk
r@ ttj|Y nX t|jdk rt|j }y | j jj|}|j
| W q tk
r |rt j d| w
Y qX q
|j
| q
W |S )Nrj z Helper '%s' is not available)
r r r r r r r rC r
moduler0 r r[ )r! modulesry r r r _module_short_namer r# r# r$ get_helpers_for_service_modules s"
z.FirewallPolicy.get_helpers_for_service_modulesc C s | j j| | j j| d S )N)r
check_port check_tcpudp)r! portprotocolr# r# r$ r s zFirewallPolicy.check_portc C s | j || t|d|fS )N-)r r )r! r r r# r# r$ Z __port_id s zFirewallPolicy.__port_idc s | j j|}| j j| | j j | j| }tt fdd|jd } x@| D ]8}
t||
d rN|j rl|j n|} t
t j d| | f qNW t
|dd | D \} }
|d kr| j }n|}|jr x$| D ] }| jd|t|d | qW x$|
D ] }| jd
|t|d | qW x:| D ]2}| j| }
| j||
|| |j| j||
qW x*|
D ]"}| j| }
|j| j||
qNW |d kr|jd |S ) Nc s | d kS )Nrj r# )r@ )r r# r$ s z)FirewallPolicy.add_port..rC r z'%s:%s' already in '%s'c S s g | ] \}}|qS r# r# )r? rs rt r# r# r$
s z+FirewallPolicy.add_port..Tr F)r r> r r r r filterr< r r/ r r rZ r r* rO rs r _FirewallPolicy__port_id _FirewallPolicy__register_portr _FirewallPolicy__unregister_portr rx )r! r; r r rg rf rb rz r existing_port_idsport_idr added_rangesremoved_rangesr{ ranger# )r r$ rX s:
zFirewallPolicy.add_portc C s | j |||jd |< d S )NrC )r r< )r! r r rg rf r# r# r$ Z__register_port s z FirewallPolicy.__register_portc s | j j|}| j j | j| }tt fdd|jd }xB|D ]}t||d rBP qBW |jrf|jn|} t t
j d| | f t |dd |D \}
} |d kr| j
} n|} |jrx$|
D ] }
| jd|t|
d | qW x$| D ] }
| jd
|t|
d | qW x:|
D ]2}
| j|
}| j||dd | j| j|| qW x*| D ]"}
| j|
}| j| j|| qDW |d kr~| jd |S ) Nc s | d kS )Nrj r# )r@ )r r# r$ r s z,FirewallPolicy.remove_port..rC r z'%s:%s' not in '%s'c S s g | ] \}}|qS r# r# )r? rs rt r# r# r$ r # s z.FirewallPolicy.remove_port..Tr F)r r> r r r r r< r r/ r r r r r* rO rs r r r r r r rx )r! r; r r rb rz r r r r r r r{ r r# )r r$ r s:
zFirewallPolicy.remove_portc C s ||j d kr|j d |= d S )NrC )r< )r! r r r# r# r$ Z__unregister_port= s z FirewallPolicy.__unregister_portc C s6 x0| j |d D ] \}}t||r||krdS qW dS )NrC TF)r8 r )r! r; r r rs rt r# r# r$
query_portA s zFirewallPolicy.query_portc C s t | j|d j S )NrC )r r8 r, )r! r; r# r# r$ r H s zFirewallPolicy.list_portsc C s t |sttj|d S )N)r r r ZINVALID_PROTOCOL)r! r r# r# r$ check_protocolM s z FirewallPolicy.check_protocolc C s | j | |S )N)r )r! r r# r# r$ Z
__protocol_idQ s
z FirewallPolicy.__protocol_idc C s | j j|}| j j| | j j | j| }| j|}||jd krh|jrP|jn|} tt j
d|| f |d krz| j }
n|}
|j r| j
d|||
| j|||| |
j| j|| |d kr|
jd |S )NrI z'%s' already in '%s'T)r r> r r r _FirewallPolicy__protocol_idr< r/ r r rZ r* rO rt "_FirewallPolicy__register_protocolr $_FirewallPolicy__unregister_protocolrx ) r! r; r rg rf rb rz r protocol_idr r{ r# r# r$ r\ U s&
zFirewallPolicy.add_protocolc C s | j |||jd |< d S )NrI )r r< )r! r r rg rf r# r# r$ Z__register_protocolr s z"FirewallPolicy.__register_protocolc C s | j j|}| j j | j| }| j|}||jd kr\|jrD|jn|}ttj d||f |d krn| j
}n|}|j r| j d||| |j
| j|| |d kr|jd |S )NrI z'%s' not in '%s'FT)r r> r r r r< r/ r r r r* rO rt r r rx ) r! r; r rb rz r r r r{ r# r# r$ r v s$
z FirewallPolicy.remove_protocolc C s ||j d kr|j d |= d S )NrI )r< )r! r r r# r# r$ Z__unregister_protocol s z$FirewallPolicy.__unregister_protocolc C s | j || j|d kS )NrI )r r8 )r! r; r r# r# r$ query_protocol s z FirewallPolicy.query_protocolc C s t | j|d j S )NrI )r r8 r, )r! r; r# r# r$ r s z FirewallPolicy.list_protocolsc C s | j || t|d|fS )Nr )r r )r! r r r# r# r$ Z__source_port_id s z FirewallPolicy.__source_port_idc s | j j|}| j j| | j j | j| }tt fdd|jd } x@| D ]8}
t||
d rN|j rl|j n|} t
t j d| | f qNW t
|dd | D \} }
|d kr| j }n|}|jr x$| D ] }| jd|t|d | qW x$|
D ] }| jd
|t|d | qW x:| D ]2}| j| }
| j||
|| |j| j||
qW x*|
D ]"}| j| }
|j| j||
qNW |d kr|jd |S ) Nc s | d kS )Nrj r# )r@ )r r# r$ r s z0FirewallPolicy.add_source_port..rF r z'%s:%s' already in '%s'c S s g | ] \}}|qS r# r# )r? rs rt r# r# r$ r s z2FirewallPolicy.add_source_port..Tr F)r r> r r r r r r< r r/ r r rZ r r* rO ru r _FirewallPolicy__source_port_id%_FirewallPolicy__register_source_portr '_FirewallPolicy__unregister_source_portr rx )r! r; r r rg rf rb rz r r r r r r r{ r r# )r r$ r] s:
z FirewallPolicy.add_source_portc C s | j |||jd |< d S )NrF )r r< )r! r r rg rf r# r# r$ Z__register_source_port s z%FirewallPolicy.__register_source_portc s | j j|}| j j | j| }tt fdd|jd }xB|D ]}t||d rBP qBW |jrf|jn|} t t
j d| | f t |dd |D \}
} |d kr| j
} n|} |jrx$|
D ] }
| jd|t|
d | qW x$| D ] }
| jd
|t|
d | qW x:|
D ]2}
| j|
}| j||dd | j| j|| qW x*| D ]"}
| j|
}| j| j|| qDW |d kr~| jd |S ) Nc s | d kS )Nrj r# )r@ )r r# r$ r s z3FirewallPolicy.remove_source_port..rF r z'%s:%s' not in '%s'c S s g | ] \}}|qS r# r# )r? rs rt r# r# r$ r s z5FirewallPolicy.remove_source_port..Tr F)r r> r r r r r< r r/ r r r r r* rO ru r r r r r r rx )r! r; r r rb rz r r r r r r r{ r r# )r r$ r s:
z!FirewallPolicy.remove_source_portc C s ||j d kr|j d |= d S )NrF )r< )r! r r r# r# r$ Z__unregister_source_port s z'FirewallPolicy.__unregister_source_portc C s6 x0| j |d D ] \}}t||r||krdS qW dS )NrF TF)r8 r )r! r; r r rs rt r# r# r$ query_source_port s z FirewallPolicy.query_source_portc C s t | j|d j S )NrF )r r8 r, )r! r; r# r# r$ r s z FirewallPolicy.list_source_portsc C s dS )NTr# )r! r# r# r$ Z__masquerade_id s z FirewallPolicy.__masquerade_idc C s8 | j j|}| j j| | j j | j| }| j }||jd krb|jrN|jn|}tt j
d| |jsd|jd krtt j dd|jd krtt j dx6|jd D ](} | dkrq| j j j
| rtt j d qW |d kr| j }
n|}
|jr | jd
||
| j|||| |
j| j|| |d kr4|
jd
|S ) NrD z"masquerade already enabled in '%s'r5 r7 z.'masquerade' is invalid for egress zone 'HOST'r4 z/'masquerade' is invalid for ingress zone 'HOST'r6 zR'masquerade' cannot be used in a policy if an ingress zone has assigned interfacesT)r r> r r r _FirewallPolicy__masquerade_idr< r/ r r rZ r r: r r* rO rv $_FirewallPolicy__register_masquerader &_FirewallPolicy__unregister_masqueraderx ) r! r; rg rf rb rz r
masquerade_idr r: r{ r# r# r$ r_
s:
z FirewallPolicy.add_masqueradec C s | j |||jd |< d S )NrD )r r< )r! r r rg rf r# r# r$ Z__register_masquerade2 s z$FirewallPolicy.__register_masqueradec C s | j j|}| j j | j| }| j }||jd krV|jrB|jn|}ttj d| |d krh| j
}n|}|j r| j d|| |j
| j|| |d kr|jd |S )NrD z masquerade not enabled in '%s'FT)r r> r r r r< r/ r r r r* rO rv r r rx )r! r; rb rz r r r r{ r# r# r$ r 6 s"
z FirewallPolicy.remove_masqueradec C s ||j d kr|j d |= d S )NrD )r< )r! r r r# r# r$ Z__unregister_masqueradeP s z&FirewallPolicy.__unregister_masqueradec C s | j | j|d kS )NrD )r r8 )r! r; r# r# r$ r T s z FirewallPolicy.query_masqueradec C s^ | j j| | j j| |r(| j j| |rBt||sBttj|| rZ| rZttjdd S )Nz.port-forwarding is missing to-port AND to-addr)r r r r r r Z INVALID_ADDRr )r! ipvr r toporttoaddrr# r# r$ check_forward_portY s
z!FirewallPolicy.check_forward_portc C sL t d|r | jd|||| n| jd|||| t|d|t|dt|fS )Nr r r )r r r r )r! r r r r r# r# r$ Z__forward_port_idf s
z FirewallPolicy.__forward_port_idc C sZ | j j|} | j j| | j j | j| }
| j||||} | |
jd krt|
jrV|
jn| } tt j
d||||| f |
jsd|
jd kr|rtt j dnR|
jd r|stt j dx6|
jd D ](}
|
dkrq| j j j
|
rtt jdqW |d kr | j }n|}|
jr"| jd | ||||| | j|
| || |j| j|
| |d krV|jd | S )
NrE z '%s:%s:%s:%s' already in '%s'r5 r7 zAA 'forward-port' with 'to-addr' is invalid for egress zone 'HOST'zC'forward-port' requires 'to-addr' if egress zone is 'ANY' or a zoner6 zS'forward-port' cannot be used in a policy if an egress zone has assigned interfacesT)r r> r r r _FirewallPolicy__forward_port_idr< r/ r r rZ r r: r r r* rO rq &_FirewallPolicy__register_forward_portr (_FirewallPolicy__unregister_forward_portrx )r! r; r r r r rg rf rb rz r
forward_idr r: r{ r# r# r$ rV n sB
z FirewallPolicy.add_forward_portc C s | j |||jd |< d S )NrE )r r< )r! r r rg rf r# r# r$ Z__register_forward_port s z&FirewallPolicy.__register_forward_portc C s | j j|}| j j | j| }| j||||} | |jd krh|jrJ|jn|}
ttj d|||||
f |d krz| j
} n|} |j r| j d|| |||| | j
| j|| |d kr| jd |S )NrE z'%s:%s:%s:%s' not in '%s'FT)r r> r r r r< r/ r r r r* rO rq r r rx ) r! r; r r r r rb rz r r r r{ r# r# r$ r s&
z"FirewallPolicy.remove_forward_portc C s ||j d kr|j d |= d S )NrE )r< )r! r r r# r# r$ Z__unregister_forward_port s z(FirewallPolicy.__unregister_forward_portc C s" | j ||||}|| j|d kS )NrE )r r8 )r! r; r r r r r r# r# r$ query_forward_port s z!FirewallPolicy.query_forward_portc C s t | j|d j S )NrE )r r8 r, )r! r; r# r# r$ r s z!FirewallPolicy.list_forward_portsc C s | j j| d S )N)r Zcheck_icmptype)r! icmpr# r# r$ check_icmp_block s z FirewallPolicy.check_icmp_blockc C s | j | |S )N)r )r! r r# r# r$ Z__icmp_block_id s
z FirewallPolicy.__icmp_block_idc C s | j j|}| j j| | j j | j| }| j|}||jd krh|jrP|jn|} tt j
d|| f |d krz| j }
n|}
|j r| j
d|||
| j|||| |
j| j|| |d kr|
jd |S )NrG z'%s' already in '%s'T)r r> r r r _FirewallPolicy__icmp_block_idr< r/ r r rZ r* rO rp $_FirewallPolicy__register_icmp_blockr &_FirewallPolicy__unregister_icmp_blockrx ) r! r; r rg rf rb rz r icmp_idr r{ r# r# r$ rU s&
z FirewallPolicy.add_icmp_blockc C s | j |||jd |< d S )NrG )r r< )r! r r rg rf r# r# r$ Z__register_icmp_block s z$FirewallPolicy.__register_icmp_blockc C s | j j|}| j j | j| }| j|}||jd kr\|jrD|jn|}ttj d||f |d krn| j
}n|}|j r| j d||| |j
| j|| |d kr|jd |S )NrG z'%s' not in '%s'FT)r r> r r r r< r/ r r r r* rO rp r r
rx ) r! r; r rb rz r r r r{ r# r# r$ r s"
z FirewallPolicy.remove_icmp_blockc C s ||j d kr|j d |= d S )NrG )r< )r! r r r# r# r$ Z__unregister_icmp_block s z&FirewallPolicy.__unregister_icmp_blockc C s | j || j|d kS )NrG )r r8 )r! r; r r# r# r$ query_icmp_block s z FirewallPolicy.query_icmp_blockc C s | j |d j S )NrG )r8 r, )r! r; r# r# r$ r s z FirewallPolicy.list_icmp_blocksc C s dS )NTr# )r! r# r# r$ Z__icmp_block_inversion_id s z(FirewallPolicy.__icmp_block_inversion_idc
C s | j j|}| j j | j| }| j }||jd krV|jrB|jn|}ttj d| |d krh| j
}n|}|j rx&| j |d D ]} | j
d|| | qW | jd|| | j||| |j| j||| |j rx&| j |d D ]} | j
d|| | qW | jd|| |d kr|jd |S )NrJ z,icmp-block-inversion already enabled in '%s'rG FT)r r> r r (_FirewallPolicy__icmp_block_inversion_idr< r/ r r rZ r* rO r8 rp _icmp_block_inversion._FirewallPolicy__register_icmp_block_inversionr *_FirewallPolicy__undo_icmp_block_inversionrx )
r! r; rf rb rz r icmp_block_inversion_idr r{ r` r# r# r$ add_icmp_block_inversion s6
z'FirewallPolicy.add_icmp_block_inversionc C s | j d||jd |< d S )Nr rJ )r r< )r! r r rf r# r# r$ Z __register_icmp_block_inversionE s z.FirewallPolicy.__register_icmp_block_inversionc C s | j }|jr6x&| j|d D ]}| jd||| q W ||jd krP|jd |= |jr~x&| j|d D ]}| jd||| qfW |jd d S )NrG FrJ T)r* rO r8 rp r< rx )r! rz r r r{ r` r# r# r$ Z__undo_icmp_block_inversionJ s z*FirewallPolicy.__undo_icmp_block_inversionc C s | j j|}| j j | j| }| j }||jd krV|jrB|jn|}ttj d| |d krh| j
}n|}|j rx&| j |d D ]}| j
d||| qW | jd|| | j|| |j| j||d |j rx&| j |d D ]}| j
d||| qW | jd|| |d kr|jd |S )NrJ z(icmp-block-inversion not enabled in '%s'rG FT)r r> r r r
r< r/ r r r r* rO r8 rp r 0_FirewallPolicy__unregister_icmp_block_inversionr r rx ) r! r; rb rz r r r r{ r` r# r# r$ remove_icmp_block_inversion\ s6
z*FirewallPolicy.remove_icmp_block_inversionc C s ||j d kr|j d |= d S )NrJ )r< )r! r r r# r# r$ Z!__unregister_icmp_block_inversion s z0FirewallPolicy.__unregister_icmp_block_inversionc C s | j | j|d kS )NrJ )r
r8 )r! r; r# r# r$ query_icmp_block_inversion s z)FirewallPolicy.query_icmp_block_inversionc
C s | j jj|}|jr*| j jj|j d }n|}|rT|| jkrt||f| j| krtd S n || jksp||f| j| krtd S x@| j j D ]2}|jr||j kr|j
||||} |j || qW | j ||||fg |j
| j || ||fg d S )Nr )r r; r. r/ r: Z_zone_policiesr enabled_backendspolicies_supportedZget_available_tablesZbuild_policy_chain_rules add_rules_register_chainsr )
r! r; creater| r} r{ rM Ztracking_policybackendrH r# r# r$ rn s$
z FirewallPolicy.gen_chain_rulesc C sb x\|D ]T\}}|r,| j j|g j||f q| j | j||f t| j | dkr| j |= qW d S )Nr )r
setdefaultr0 remover )r! r; r Ztablesr| r} r# r# r$ r s z FirewallPolicy._register_chainsc C s$ | j jj|dkrd S | j jj|S )Nzhash:mac)r r get_typeZ
get_family)r! rK r# r# r$ r s z FirewallPolicy._ipset_familyc C s | j jj|S )N)r r r )r! rK r# r# r$ Z __ipset_type s zFirewallPolicy.__ipset_typec C s dj |g| jjj| S )N,)joinr r Z
get_dimension)r! rK flagr# r# r$ _ipset_match_flags s z!FirewallPolicy._ipset_match_flagsc C s | j jj|S )N)r r Z
check_applied)r! rK r# r# r$ r s z#FirewallPolicy._check_ipset_appliedc C s* | j |}|tkr&ttjd||f d S )Nz.ipset '%s' with type '%s' not usable as source)_FirewallPolicy__ipset_typer r r Z
INVALID_IPSET)r! rK Z_typer# r# r$ r s
z+FirewallPolicy._check_ipset_type_for_sourcec s t |jtkrjjj|jj}|d kr2|jjg}xR|jD ]H}||krHq:j| |j | t
j |}||j_j |||||d q:W g } |j
r|j
g} nH|jrt|jtst|jtrjjj|jj jr fdddD } j|j}
|
r&|j
r |j
|
kr&ttjd|
|j
f n|
g} | s4ddg} fdd| D } | |_x2tfdd| D D ]} t |jtkrjjj|jj}g } t|jd kr|jrttjd
xB| D ].}
|
|jkr| j |
r| j |j|
qW n
| j d x~| D ]}t |j t krj |j |}|j!|j"7 }t#t|d d d
}g }x|D ]}|j$}t%|}|j&dd}|j | |j
dkr| j |j
rqTt|j'dk r|j | n:x8|j'D ].\}}| j(||||||j|}|j)| | qW qTW |j*| x4|j'D ]*\}}| j+||||||}|j)| | q
W x.|j,D ]$}| j-|||||}|j)| | q@W x4|j.D ]*\}}| j/||||||}|j)| | qpW qW qft |jt0kr|jj1}|jj2}j3|| | j+||||d |}|j)| | qft |jt4kr<|jj5}j6| | j-|||d |}|j)| | qft |jt7kr|rzx&| D ] }
| j |
rX|j8t9|
qXW | j:|||}|j)| | qft |jt;kr4|jj1}|jj2}|jj<}|jj=}xD| D ]<}
| j |
rj>|
|||| |r|r|j8t9|
qW | j?|||||||}|j)| | qft |jt@kr|jj1}|jj2}j3|| | j/||||d |}|j)| | nt |jtkst |jtkr>jjj|jj |j
r jr|j
jkrttjAd|j
|jjf t |jtkr |j r t |j t kr ttjd| jB|| |}|j)| | n>|jd krf| jC|||}|j)| | nttjdt |j qfW d S )N)included_servicesc s g | ]}| j kr|qS r# ) destination)r? r )ictr# r$ r s z0FirewallPolicy._rule_prepare..r r z;Source address family '%s' conflicts with rule family '%s'.c s g | ]} j j|r|qS r# )r is_ipv_enabled)r? r )r! r# r$ r s c s g | ]} j j|qS r# )r get_backend_by_ipv)r? r@ )r! r# r$ r s r z"Destination conflict with service.c S s | j S )N)rK )r@ r# r# r$ r s z.FirewallPolicy._rule_prepare..)r~ conntracknatr rj z3rich rule family '%s' conflicts with icmp type '%s'z'IcmpBlock not usable with accept actionzUnknown element %s)r r )Dtyper r r r get_servicerK includesr r0 copydeepcopyr familyr r r config get_icmptyper% r r r r Z INVALID_RULEipvsr9 r is_ipv_supportedr r r r r r r+ r r
replacerC build_policy_helper_ports_rulesr Z add_modulesbuild_policy_ports_rulesrI build_policy_protocol_rulesrF build_policy_source_ports_rulesr r r r r valuer r r r build_policy_masquerade_rulesr Zto_portr r build_policy_forward_port_rulesr ZINVALID_ICMPTYPE build_policy_icmp_block_rulesZ*build_policy_rich_source_destination_rules)r! ry r; r r{ r$ svcincludeZ_ruler3 Z
source_ipvr Z destinationsr r% r r r r r
nat_moduler protorH r r r r# )r& r! r$ r s
z FirewallPolicy._rule_preparec C sb | j jj|}| j|j|}|| j|j7 }tt|dd d}|d krN|g}x@|j D ]6}||krdqV| j
| |j | | j |||||d qVW g } xnd D ]f}
| j j
|
sq| j j|
} t|jdkr|
|jkr| j | |j|
f q| d f| kr| j | d f qW xV| D ]L\} } x|D ]}
|
j}t|}|
jjdd }|j| |
jd
krf| j|
j rfq t|
jd k r|j| n:x8|
jD ].\}}| j||||| |
j|}|j| | qW q W x2|jD ](\}}| j||||| }|j| | qW x,|j D ]"}| j |||| }|j| | qW x2|j D ](\}}| j ||||| }|j| | q,W q W d S )
Nc S s | j S )N)rK )r@ r# r# r$ r s z)FirewallPolicy._service..)r~ )r$ r r r r) r* r rj )r r ) r r r, r r r r r+ r9 r- r r0 rr r' r( r r% r r
r5 Z
add_moduler0 r4 rC r6 rK r r7 rI r8 rF r9 )r! ry r; r r{ r$ r> r r? Z backends_ipvr r r% r r r r@ r rA rH r r# r# r$ rr sb
zFirewallPolicy._servicec C s< x6| j j D ](}|jsq |j||||}|j|| q W d S )N)r r r r7 r )r! ry r; r r r{ r rH r# r# r$ rs s
zFirewallPolicy._portc C s: x4| j j D ]&}|jsq |j|||}|j|| q W d S )N)r r r r8 r )r! ry r; r r{ r rH r# r# r$ rt s
zFirewallPolicy._protocolc C s< x6| j j D ](}|jsq |j||||}|j|| q W d S )N)r r r r9 r )r! ry r; r r r{ r rH r# r# r$ ru s
zFirewallPolicy._source_portc C s8 d}|j t| | jj|}|j||}|j|| d S )Nr )r r r r( r; r )r! ry r; r{ r r rH r# r# r$ rv s
zFirewallPolicy._masqueradec C sX t d|rd}nd}|r(|r(|jt| | jj|} | j||||||}
|j| |
d S )Nr r )r r r r r( r< r ) r! ry r; r{ r r r r r r rH r# r# r$ rq s
z FirewallPolicy._forward_portc
C s | j jj|}xl| j j D ]^}|js&qd}|jrXx&dD ] }||jkr6|j|s6d}P q6W |r^q|j|||} |j|| qW d S )NFr r T)r r ) r r1 r2 r r r% r4 r= r )
r! ry r; r r{ r& r Z skip_backendr rH r# r# r$ rp s
zFirewallPolicy._icmp_blockc C sh | j | j}|dkrd S | j| r0|dkr0d S x2| jj D ]$}|jsHq<|j||}|j|| q|jd D ] }| jjj|d rfP qfW |jd$ |jd% |S d&g}| jjs|jd' x4|jd D ] }| jjj|d rP qW |jd( x>|jd D ] }| jjj|d rP qW |jd) |jd* |S dS )+z:Create a list of (table, chain) needed for policy dispatchr6 r4 r5 r7 r rO r* rK manglerL rP rN rM Z
interfacesN)r rO )r* rK )rS rK )rL rK )r rO )rL rK )r rP )r rN )r* rK )r* rM )rS rK )rL rK )r rN )r* rK )rS rK )rL rK )r* rM )r rN )r* rM )rL rK )r* rK )rS rK )r rN )rL rK )r* rM )r* rK )rS rK )r r< r nftables_enabledr0 r: r8 )r! r; rM tcr: r# r# r$ rl sj
z4FirewallPolicy._get_table_chains_for_policy_dispatchc C sr | j | }d|jd kr4dg}| jjs0|jd |S d|jd krLdddgS d|jd krbddgS td| S dS )z8Create a list of (table, chain) needed for zone dispatchr5 r7 r rO rL rK r6
FORWARD_INr* rS r4 FORWARD_OUTrM zInvalid policy: %sN)r rO )rL rK )r rV )r* rK )rS rK )r rW )r* rM )r r< r rT r0 r )r! r; rM rU r# r# r$ rm s
z2FirewallPolicy._get_table_chains_for_zone_dispatchFc C s | j jj|}|jr |j}n|| }d|jd krl|dkrBd| S |dkrRd| S |jsh|dkrhd| S nJd|jd kr|js|dkrd
| S n"d |jd k r|dkr|jrd | S d
| S n0|dkr|rd| S d| S n|dkrd| S nd |jd krh|dkr*|jr d| S d
| S n<|dkrL|rBd| S d| S n|dkr|jsd| S nN|js|dkrd
| S |dkr|rd| S d| S n|dkrd| S td|||f S )Nr5 r7 r ZIN_rL ZPRE_rS r* r4 ZOUT_r6 ZFWDI_ZFWD_ZPOST_ZFWDO_z.Can't convert policy to chain name: %s, %s, %s)rS r* )rS rL )rS rL )rS rL )r r; r. r/ r< r )r! r; r| Z
policy_prefixZisSNATrM suffixr# r# r$ policy_base_chain_name sb
z%FirewallPolicy.policy_base_chain_name)N)N)N)N)r NNT)N)r NNT)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)r NN)N)NN)NN)NNr NN)NNN)NN)r NN)N)NN)N)N)N)NN)F)__name__
__module__ __qualname__r% r' r) r* r- r3 r= r. rN rQ rL rd re r r8 r rc rP r r r r rS r r r r r r r rT r r r r r r r r rw r^ r r r r r r r rW r r r r r r r r r rX r r r r r r r r\ r r r r r r r] r r r r r r r_ r r r r r r rV r r r r r r r rU r r r
r r r
r r r r r r rn r r r# r" r r r rr rs rt ru rv rq rp r rJ rQ rR ro rl rm rY r# r# r# r$ r s$
' ? . , # , # :
' ( ' ( '
+ ) ) @ @ ( P r )'rh r. Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r
r r r r
r r r r r r r r r r Z firewall.core.fw_transactionr Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr Zfirewall.core.baser objectr r# r# r# r$ s 04