Warning: session_start(): Session cannot be started after headers have already been sent in /home/tvrreohg/public_html/manga.php on line 13
3
Yjy @ s d dl Z d dlZd dlmZmZmZ d dlmZ d dlm Z d dl
m Z d dl m
Z
mZmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZ d d l m Z d d
l m Z G d d d e Z!dS )
N) SHORTCUTSDEFAULT_ZONE_TARGETSOURCE_IPSET_TYPES)FirewallTransaction)Policy)log) Rich_Service Rich_Port
Rich_ProtocolRich_SourcePortRich_ForwardPortRich_IcmpBlock
Rich_IcmpTypeRich_Masquerade Rich_Mark) checkIPnMask
checkIP6nMask check_mac)errors)
FirewallError)LastUpdatedOrderedDictc @ sN e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd d
Z dd Z
dd Z dd Z dd Z
dd Zdd Zdd Zd d Zdd d Zd!d" Zd#d$ Zd%d& Zdd'd(Zd)d* Zd+d, Zd-d. Zdd/d0Zdd1d2Zd3d4 Z d5d6 Z d7d8 Z d9d: Z d;d< Z d=d> Z!dd@dAZ"dBdC Z#ddDdEZ$ddFdGZ%ddHdIZ&dJdK Z'dLdM Z(dNdO Z)ddQdRZ*ddSdTZ+ddUdVZ,dWdX Z-ddYdZZ.dd[d\Z/d]d^ Z0d_d` Z1dadb Z2ddcddZ3dedf Z4dgdh Z5didj Z6dkdl Z7dmdn Z8dodp Z9ddqdrZ:dsdt Z;dudv Zd{d| Z?d}d~ Z@dd ZAdddZBdd ZCdd ZDdd ZEdd ZFdddZGdd ZHdd ZIdd ZJdddZKdd ZLdd ZMdd ZNdddZOdd ZPdd ZQdddZRdddZSdddZTdd ZUdddZVdd ZWdd ZXdd ZYdddZZdd Z[dd Z\dd Z]dd Z^dd Z_dddZ`dd ZadddZbddĄ ZcddƄ Zdd S ) FirewallZoner c C s || _ i | _i | _d S )N)_fw_zones_zone_policies)selffw r /usr/lib/python3.6/fw_zone.py__init__& s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r)) __class__r )r r r r __repr__+ s zFirewallZone.__repr__c C s | j j | jj d S )N)r clearr )r r r r cleanup. s
zFirewallZone.cleanupc C s
t | jS )N)r r )r r r r new_transaction2 s z FirewallZone.new_transactionc C s dj ||dS )Nzzone_{fromZone}_{toZone})fromZonetoZone)format)r r% r& r r r policy_name_from_zones5 s z#FirewallZone.policy_name_from_zonesc C s t | jj S )N)sortedr keys)r r r r get_zones: s zFirewallZone.get_zonesc C s8 g }x.| j D ]"}| j|s&| j|r|j| qW |S )N)r+ list_interfaces list_sourcesappend)r Z active_zoneszoner r r get_active_zones= s
z FirewallZone.get_active_zonesc C s6 | j |}x&| jD ] }|| j| jd kr|S qW d S )N
interfaces)_FirewallZone__interface_idr settings)r interface interface_idr/ r r r get_zone_of_interfaceD s
z"FirewallZone.get_zone_of_interfacec C s6 | j |}x&| jD ] }|| j| jd kr|S qW d S )Nsources)_FirewallZone__source_idr r3 )r source source_idr/ r r r get_zone_of_sourceL s
z FirewallZone.get_zone_of_sourcec C s | j j|}| j| S )N)r
check_zoner )r r/ zr r r get_zoneT s zFirewallZone.get_zonec C sB t }|j|_| j|||_| j|_|j|_|g|_|g|_ xd D ]}||jkr~|d kr~|d kr~t ||t
j t || qD|d
kr||jkr|d
krt ||t
j t || qD||jko|d
ko|dk rt ||t
j t || qD|dkrDg |_
xB|j
D ]8}| j||}|| j|j|k r|j
jt
j | qW qDW |S )Nservicesports
masquerade
forward_ports source_ports icmp_blocksrules protocolsHOSTANY)r? r@ rA rB rC rD rE rF )r? r@ rC rD rF )rA )rD rB )rE )r nameZderived_from_zoner( ZONE_POLICY_PRIORITYZprioritytargetZ
ingress_zonesZ egress_zonessetattrcopydeepcopygetattrrE _rich_rule_to_policiesr. )r z_objr% r& p_objZsettingruleZcurrent_policyr r r policy_obj_from_zone_objX s6
z%FirewallZone.policy_obj_from_zone_objc C s dd d D |_ || j|j< g | j|j< xX|jdfd|jf|jdfgD ]8\}}| j|||}| jjj| | j|j j|j qFW | j |j d S )
Nc S s i | ] }t |qS r )r ).0xr r r
s z)FirewallZone.add_zone..r1 r7 icmp_block_inversionforwardrG rH )r1 r7 rX rY )
r3 r rI r rT r policyZ
add_policyr. copy_permanent_to_runtime)r objr% r& rR r r r add_zone~ s
zFirewallZone.add_zonec C sn | j | }x |jD ]}| j||dd qW x |jD ]}| j||dd q2W |jrZ| j| |jrj| j| d S )NF) allow_apply) r r1
add_interfacer7
add_sourcerY add_forwardrX add_icmp_block_inversion)r r/ r\ argr r r r[ s
z&FirewallZone.copy_permanent_to_runtimec C s8 | j | }|jr| j| |jj | j |= | j|= d S )N)r appliedunapply_zone_settingsr3 r" r )r r/ r\ r r r remove_zone s
zFirewallZone.remove_zoneNc C sV xP| j D ]D}| j| }t|jdks4t|jdkr
tjd| | j||d q
W d S )Nr zApplying zone '%s')use_transaction)r+ r lenr1 r7 r debug1apply_zone_settings)r rg r/ rQ r r r apply_zones s
zFirewallZone.apply_zonesc C s | j | }||_d S )N)r rd )r r/ rd r\ r r r set_zone_applied s
z FirewallZone.set_zone_appliedc C s d|kr d S |j d}t|dk r&d S d }x tD ]}|d t| kr0|}q0W |d k r|d | j krhd S t|dkst|dkr|d d kr|d |fS d S ) N_ r prer denyallowpost)rq r rr rs rt )splitrh r r+ )r chainZsplits_chainrV r r r zone_from_chain s
z FirewallZone.zone_from_chainc C st | j |}|d krd S |\}}|d kr0|}d}n4|d
krB|}d}n"|d krTd}|}nttjd| | j|||fS ) N
PREROUTING
FORWARD_INrH INPUTrG POSTROUTING FORWARD_OUTz&chain '%s' can't be mapped to a policy)ry rz )r{ )r| r} )rx r r Z
INVALID_CHAINr( )r rv rV r/ rw r% r& r r r policy_from_chain s
z FirewallZone.policy_from_chainc C sj |dkrf| j |}|d k rf| j |\}}|d kr:| j }n|}| jjj|d||| |d krf|jd d S )Nipv4ipv6T)r r )r~ r$ r rZ Zgen_chain_rulesexecute) r ipvtablerv rg rV rZ rw transactionr r r create_zone_base_by_chain s
z&FirewallZone.create_zone_base_by_chainc C s t j ||d}|S )N)Zdatesendertimeout)time)r r r retr r r Z__gen_settings s zFirewallZone.__gen_settingsc C s | j |jS )N)r> r3 )r r/ r r r get_settings s zFirewallZone.get_settingsc C s | j |}x|D ]z}xt|| D ]h}|dkr<| j|||| q |dkr`| j|||d |d | q |dkrlq q |dkrvq tjd||| q W qW |r| j||| d S )Nr1 r7 r ro rX rY z3Zone '%s': Unknown setting '%s:%s', unable to apply)r
_interface_sourcer Zwarning_icmp_block_inversion)r enabler/ r r3 keyargsr r r _zone_settings s
zFirewallZone._zone_settingsc C s | j j|}| j| }|jr d S d|_|d kr8| j }n|}x2| j| D ]$}tjd|| | j jj ||d qHW | j
d|| |d kr|j d d S )NTz+Applying policy (%s) derived from zone '%s')rg ) r r< r rd r$ r r ri rZ apply_policy_settingsr r )r r/ rg _zoner\ r rZ r r r rj s
z FirewallZone.apply_zone_settingsc C s | j j|}| j| }|js d S |d kr2| j }n|}x$| j| D ]}| j jj||d qBW | jd|| |d kr||j d d S )N)rg FT)
r r< r rd r$ r rZ unapply_policy_settingsr r )r r/ rg r r\ r rZ r r r re , s
z"FirewallZone.unapply_zone_settingsc C s~ | j |}| j|}g }x\tdD ]P}|j| d |krZ|jtjt||j| d q"|j||j| d q"W t|S )zH
:return: exported config updated with runtime settings
r ) r> get_config_with_settings_dictrangeZIMPORT_EXPORT_STRUCTUREr. rM rN rO tuple)r r/ r\ Z conf_dictZ conf_listir r r get_config_with_settings? s
" z%FirewallZone.get_config_with_settingsc
C s | j |j }|d tkr"d|d< | j|| j|| j|| j|| j|| j|| j || j
|| j || j || j
|| j|d }| jj||S )zH
:return: exported config updated with runtime settings
rK default) r? r@ rD rA rB r1 r7 rules_strrF rC rX rY )r> Zexport_config_dictr
list_services
list_portslist_icmp_blocksquery_masqueradelist_forward_portsr, r-
list_ruleslist_protocolslist_source_portsquery_icmp_block_inversion
query_forwardr Z'combine_runtime_with_permanent_settings)r r/ Z permanentZruntimer r r r O s z*FirewallZone.get_config_with_settings_dictc
s ddl m d fdd } fdd}jjfjjfjjfjj fj
j fj j
fjjf||fjjfjjfjjfjjfd }j|}jj||\}} xv| D ]n}
t| |
t r$xX| |
D ]:} t| t r ||
d |f| q||
d || qW q||
d | qW x|D ]}
t||
t rx||
D ]l} |
dkr||
d || |d nDt| t r||
d |f| d|d n||
d || d|d q\W n6|
dkr||
d ||d n||
d |d|d q>W d S )Nr ) Rich_Rulec s j | |dd|d d S )N)rule_strr )r r )add_rule)r/ r r r )r r r r add_rule_wrapperh s zDFirewallZone.set_config_with_settings_dict..add_rule_wrapperc s j | |d d S )N)r ) remove_rule)r/ r )r r r r remove_rule_wrapperj s zGFirewallZone.set_config_with_settings_dict..remove_rule_wrapper) r? r@ rD rA rB r1 r7 r rF rC rX rY ro r1 r7 )r )r r rX )r N)r1 r7 )rX ) firewall.core.richr add_serviceremove_serviceadd_port remove_portadd_icmp_blockremove_icmp_blockadd_masqueraderemove_masqueradeadd_forward_portremove_forward_portr_ remove_interfacer`
remove_source add_protocolremove_protocoladd_source_portremove_source_portrb remove_icmp_block_inversionra remove_forwardr r Z get_added_and_removed_settings
isinstancelistr ) r r/ r3 r r r Z
setting_to_fnZ old_settingsZ add_settingsZremove_settingsr r r )r r r set_config_with_settings_dicte sF
z*FirewallZone.set_config_with_settings_dictc C s | j j| d S )N)r check_interface)r r4 r r r r s z FirewallZone.check_interfacec C s\ | j j|}| j| }| j|}||jd krX|jd | }d|krX|d d k rX|d S d S )Nr1 r )r r< r r2 r3 )r r/ r4 r _objr5 r3 r r r interface_get_sender s
z!FirewallZone.interface_get_senderc C s | j | |S )N)r )r r4 r r r Z__interface_id s
zFirewallZone.__interface_idTc
C s | j j | j j|}| j| }| j|}||jd krLttjd||f | j |d k rjttj
d| t j d||f |d kr| j
} n|} |j r|r| j|| d | j| j|d |r| jd||| | j|||| | j| j|| |d kr| jd |S )Nr1 z'%s' already bound to '%s'z '%s' already bound to a zonez&Setting zone of interface '%s' to '%s')rg FT)r check_panicr< r r2 r3 r r ZONE_ALREADY_SETr6
ZONE_CONFLICTr ri r$ rd rj add_failrl r !_FirewallZone__register_interface#_FirewallZone__unregister_interfacer )
r r/ r4 r rg r^ r r r5 r r r r r_ s8
zFirewallZone.add_interfacec C s6 | j d||jd |< | p"|dk|jd | d< d S )Nr r1 __default__)_FirewallZone__gen_settingsr3 )r r r5 r/ r r r r Z__register_interface s z!FirewallZone.__register_interfacec C sR | j j | j|}| j j|}||kr,|S |d k r@| j|| | j|||}|S )N)r r r6 r< r r_ )r r/ r4 r _old_zone _new_zoner r r r change_zone_of_interface s
z%FirewallZone.change_zone_of_interfacec C sz | j j |d kr | j }n|}| j|| | jd|d|dd |d k rd|dkrd| jd|d|dd |d krv|jd d S )NT+)r. r F)r r r$ rj r r )r Zold_zoneZnew_zonerg r r r r change_default_zone s
z FirewallZone.change_default_zonec C s | j j | j|}|d kr,ttjd| |dkr8|n
| j j|}||krbttjd|||f |d krt| j }n|}| j | }| j
|}|j | j || | j
d||| |d kr|jd |S )Nz'%s' is not in any zoner z"remove_interface(%s, %s): zoi='%s'FT)r r r6 r r ZUNKNOWN_INTERFACEr< r r$ r r2 add_postr r r ) r r/ r4 rg Zzoir r r r5 r r r r s(
z FirewallZone.remove_interfacec C s ||j d kr|j d |= d S )Nr1 )r3 )r r r5 r r r Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | j || j|d kS )Nr1 )r2 r )r r/ r4 r r r query_interface s z FirewallZone.query_interfacec C s | j |d j S )Nr1 )r r* )r r/ r r r r, " s z FirewallZone.list_interfacesFc C sx t |r dS t|rdS t|r$dS |jdrh| j|dd |rV| j|dd | j|dd S ttj |d S )Nr r r zipset: )
r r r
startswith _check_ipset_type_for_source_check_ipset_applied
_ipset_familyr r Z INVALID_ADDR)r r9 rd r r r check_source' s
zFirewallZone.check_sourcec C s | j ||d}||fS )N)rd )r )r r9 rd r r r r Z __source_id6 s zFirewallZone.__source_idc
C s | j j | j j|}| j| }t|r0|j }| j||d}||jd kr`tt j
d||f | j |d k r~tt j d| |d kr| j
} n|} |j r|r| j|| d | j| j|d |r| jd||d |d | | j|||| | j| j|| |d kr| jd |S )
N)rd r7 z'%s' already bound to '%s'z '%s' already bound to a zone)rg FTr ro )r r r< r r upperr8 r3 r r r r; r r$ rd rj r rl r _FirewallZone__register_source _FirewallZone__unregister_sourcer )
r r/ r9 r rg r^ r r r: r r r r r` : s4
zFirewallZone.add_sourcec C s6 | j d||jd |< | p"|dk|jd | d< d S )Nr r7 r r )r r3 )r r r: r/ r r r r Z__register_sourcea s z FirewallZone.__register_sourcec C sb | j j | j|}| j j|}||kr,|S t|r<|j }|d k rP| j|| | j|||}|S )N)r r r; r< r r r r` )r r/ r9 r r r r r r r change_zone_of_sourceg s
z"FirewallZone.change_zone_of_sourcec C s | j j t|r|j }| j|}|d kr s z-FirewallZone.list_sources..r7 )r r* )r r/ r r r r- s zFirewallZone.list_sourcesc s x j j D ]}|jsq xP j| D ]B}x< j jj|D ]*\}} |j|||||| |}
|j||
q8W q$W j|d} j |d r |d
kr |j
|||d|d}
|j||
q W xΈ j jj D ]}| j jj |kr| j jj
|krq| j jj krd j jj|jrd| r s z)FirewallZone._interface..c s | j jj ko j jj| S )N)r rZ r r )r )r r r r s )r r )r enabled_backendspolicies_supportedr rZ #_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules add_rulesr( r build_zone_forward_rules"get_policies_not_derived_from_zonelist_ingress_zoneslist_egress_zonesr
get_policyrd rh r, r _ingress_egress_zonesr ) r r r/ r4 r r. backendrZ r rv rE r )r r r s2 $ zFirewallZone._interfacec C s$ | j |dkrd S | jjj|ddS )Nzhash:macF)rd ) _ipset_typer ipsetZ
get_family)r rI r r r r s zFirewallZone._ipset_familyc C s | j jj|ddS )NF)rd )r r Zget_type)r rI r r r r s zFirewallZone._ipset_typec C s dj |g| jjj| S )N,)joinr r Z
get_dimension)r rI flagr r r _ipset_match_flags s z FirewallZone._ipset_match_flagsc C s | j jj|S )N)r r Z
check_applied)r rI r r r r s z!FirewallZone._check_ipset_appliedc C s* | j |}|tkr&ttjd||f d S )Nz.ipset '%s' with type '%s' not usable as source)r r r r Z
INVALID_IPSET)r rI Z_typer r r r s
z)FirewallZone._check_ipset_type_for_sourcec
s x|r j j|gn j j D ]}|js*q xN j| D ]@}x: j jj|D ](\}} |j|||||| }
|j||
qJW q6W j |d} j
|d r |j |||d|d}
|j||
q W xΈ j jj D ]}| j jj
|kr| j jj|krq| j jj krl j jj|jrl| rDt j|dkrD j jj||d n& j jjd|| |j fdd | q|r|j fd
d | qW d S ) NrH rY r )r9 ro )rg Fc s | j jj ko j jjd| S )NT)r rZ r r )r )r r r r s z&FirewallZone._source..c s | j jj ko j jj| S )N)r rZ r r )r )r r r r
s )r get_backend_by_ipvr r r rZ r Z build_zone_source_address_rulesr r( r r r r r r r rd rh r- r r r ) r r r/ r r9 r r rZ r rv rE r )r r r s2 " $ zFirewallZone._sourcec C s0 | j j|}| j|d}| j jj|||| |S )NrG )r r< r( rZ r )r r/ servicer r p_namer r r r
s zFirewallZone.add_servicec C s, | j j|}| j|d}| j jj|| |S )NrG )r r< r( rZ r )r r/ r r r r r r s zFirewallZone.remove_servicec C s( | j j|}| j|d}| j jj||S )NrG )r r< r( rZ
query_service)r r/ r r r r r r s zFirewallZone.query_servicec C s& | j j|}| j|d}| j jj|S )NrG )r r< r( rZ r )r r/ r r r r r s zFirewallZone.list_servicesc C s2 | j j|}| j|d}| j jj||||| |S )NrG )r r< r( rZ r )r r/ portprotocolr r r r r r r # s zFirewallZone.add_portc C s. | j j|}| j|d}| j jj||| |S )NrG )r r< r( rZ r )r r/ r r r r r r r ) s zFirewallZone.remove_portc C s* | j j|}| j|d}| j jj|||S )NrG )r r< r( rZ
query_port)r r/ r r r r r r r / s zFirewallZone.query_portc C s& | j j|}| j|d}| j jj|S )NrG )r r< r( rZ r )r r/ r r r r r 4 s zFirewallZone.list_portsc C s2 | j j|}| j|d}| j jj||||| |S )NrG )r r< r( rZ r )r r/ source_portr r r r r r r r 9 s z FirewallZone.add_source_portc C s. | j j|}| j|d}| j jj||| |S )NrG )r r< r( rZ r )r r/ r r r r r r r ? s z FirewallZone.remove_source_portc C s* | j j|}| j|d}| j jj|||S )NrG )r r< r( rZ query_source_port)r r/ r r r r r r r E s z FirewallZone.query_source_portc C s& | j j|}| j|d}| j jj|S )NrG )r r< r( rZ r )r r/ r r r r r J s z FirewallZone.list_source_portsc C s | j j|}t|jtkr(| j|dgS t|jttt t
gkrL| j|dgS t|jt t gkrv| j|d| j|dgS t|jt
gkr| j|dgS t|jtgkr| jd|gS |jd kr| j|dgS tdt|j d S )NrH rG z Rich rule type (%s) not handled.)r r< typeactionr r( elementr r r
r r
r r r r )r r/ rS r r r rP O s
z#FirewallZone._rich_rule_to_policiesc C s. x(| j ||D ]}| jjj|||| qW |S )N)rP r rZ r )r r/ rS r r r r r r r b s zFirewallZone.add_rulec C s* x$| j ||D ]}| jjj|| qW |S )N)rP r rZ r )r r/ rS r r r r r g s zFirewallZone.remove_rulec C s2 d}x(| j ||D ]}|o(| jjj||}qW |S )NT)rP r rZ
query_rule)r r/ rS r r r r r r l s zFirewallZone.query_rulec C s^ | j j|}t }xB| j|d| j|d| jd|gD ] }|jt| j jj| q6W t|S )NrH rG )r r< setr( updaterZ r r )r r/ r r r r r r r s
zFirewallZone.list_rulesc C s0 | j j|}| j|d}| j jj|||| |S )NrG )r r< r( rZ r )r r/ r r r r r r r r { s zFirewallZone.add_protocolc C s, | j j|}| j|d}| j jj|| |S )NrG )r r< r( rZ r )r r/ r r r r r r s z FirewallZone.remove_protocolc C s( | j j|}| j|d}| j jj||S )NrG )r r< r( rZ query_protocol)r r/ r r r r r r s zFirewallZone.query_protocolc C s& | j j|}| j|d}| j jj|S )NrG )r r< r( rZ r )r r/ r r r r r s zFirewallZone.list_protocolsc C s. | j j|}| jd|}| j jj||| |S )NrH )r r< r( rZ r )r r/ r r r r r r r s zFirewallZone.add_masqueradec C s* | j j|}| jd|}| j jj| |S )NrH )r r< r( rZ r )r r/ r r r r r s z FirewallZone.remove_masqueradec C s& | j j|}| jd|}| j jj|S )NrH )r r< r( rZ r )r r/ r r r r r s z FirewallZone.query_masqueradec C s6 | j j|}| j|d}| j jj||||||| |S )NrH )r r< r( rZ r ) r r/ r r toporttoaddrr r r r r r r s
z FirewallZone.add_forward_portc C s2 | j j|}| j|d}| j jj||||| |S )NrH )r r< r( rZ r )r r/ r r r
r r r r r r s z FirewallZone.remove_forward_portc C s. | j j|}| j|d}| j jj|||||S )NrH )r r< r( rZ query_forward_port)r r/ r r r
r r r r r r s z FirewallZone.query_forward_portc C s& | j j|}| j|d}| j jj|S )NrH )r r< r( rZ r )r r/ r r r r r s z FirewallZone.list_forward_portsc C sP | j j|}| j|d}| j jj|||| | j|d}| j jj|||| |S )NrG rH )r r< r( rZ r )r r/ icmpr r r r r r r s zFirewallZone.add_icmp_blockc C sH | j j|}| j|d}| j jj|| | j|d}| j jj|| |S )NrG rH )r r< r( rZ r )r r/ r
r r r r r s z FirewallZone.remove_icmp_blockc C sD | j j|}| j|d}| j|d}| j jj||oB| j jj||S )NrG rH )r r< r( rZ query_icmp_block)r r/ r
p_name_host
p_name_fwdr r r r s
z FirewallZone.query_icmp_blockc C sH | j j|}| j|d}| j|d}tt| j jj|| j jj| S )NrG rH )r r< r( r) r rZ r )r r/ r r r r r r s
z FirewallZone.list_icmp_blocksc C sH | j j|}| j|d}| j jj|| | j|d}| j jj|| |S )NrG rH )r r< r( rZ rb )r r/ r r r r r rb s z%FirewallZone.add_icmp_block_inversionc C sL | j j|}| j|d}| j jj||| | j|d}| j jj||| d S )NrG rH )r r< r( rZ r )r r r/ r r r r r r s
z"FirewallZone._icmp_block_inversionc C sD | j j|}| j|d}| j jj| | j|d}| j jj| |S )NrG rH )r r< r( rZ r )r r/ r r r r r s z(FirewallZone.remove_icmp_block_inversionc C s@ | j j|}| j|d}| j|d}| j jj|o>| j jj|S )NrG rH )r r< r( rZ r )r r/ r r r r r r s
z'FirewallZone.query_icmp_block_inversionc
C s | j |d}xT| j| jd D ]@}x:| jj D ],}|js:q.|j|||d|d}|j|| q.W q W xj| j| jd D ]V\}} xL|r| jj|gn| jj D ],}|jsq|j|||d| d}|j|| qW qtW d S )NrH r1 r )r4 r7 )r9 ) r( r r3 r r r r r r )
r r r/ r r r4 r rE r r9 r r r _forward s "zFirewallZone._forwardc C s dS )NTr )r r r r Z __forward_id s zFirewallZone.__forward_idc C s | j j|}| j j| | j j | j| }| j }||jd krRttj d| |d krd| j
}n|}|j r|| j d|| | j
|||| |j| j|| |d kr|jd |S )NrY z forward already enabled in '%s'T)r r< Z
check_timeoutr r _FirewallZone__forward_idr3 r r ZALREADY_ENABLEDr$ rd r _FirewallZone__register_forwardr !_FirewallZone__unregister_forwardr ) r r/ r r rg r r
forward_idr r r r ra s$
zFirewallZone.add_forwardc C s | j |||jd |< d S )NrY )r r3 )r r r r r r r r Z__register_forward. s z FirewallZone.__register_forwardc C s | j j|}| j j | j| }| j }||jd krFttjd| |d krX| j }n|}|j
rp| j d|| |j | j
|| |d kr|jd |S )NrY zforward not enabled in '%s'FT)r r< r r r r3 r r Z NOT_ENABLEDr$ rd r r r r )r r/ rg r r r r r r r r 2 s
zFirewallZone.remove_forwardc C s ||j d kr|j d |= d S )NrY )r3 )r r r r r r Z__unregister_forwardK s z!FirewallZone.__unregister_forwardc C s | j | j|d kS )NrY )r r )r r/ r r r r O s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)e__name__
__module__ __qualname__rJ r r! r# r$ r( r+ r0 r6 r; r> rT r] r[ rf rk rl rx r~ r r r r rj re r r r r r r2 r_ r r r r r r r, r r8 r` r r r r r r- r r r r r r r r r r r r r r r r r r r rP r r r r r r r r r r r r r r r r r r r rb r r r r r ra r r r r r r r r r # s &
8
(
&
,(
r )"r rM Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr r r r r
r r r
r r r Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr Zfirewall.fw_typesr objectr r r r r s ,