✏️ 编辑：fw_zone.cpython-39.opt-1.pyc
路径：
/usr/lib/python3.9/site-packages/firewall/core/__pycache__/fw_zone.cpython-39.opt-1.pyc
大小：30.4 KB · 修改：2026-09-15 17:58:31 · 权限：0644 · 只读（保存会失败）
← 返回目录
👁 查看
⬇ 下载
检测到二进制内容，直接保存可能损坏文件。请改用「上传替换」。
a F��jD� � @ s� d dl mZ d dlZd dlmZmZmZ d dlmZ d dl m Z d dl m Z d dl mZmZmZmZmZmZmZmZmZmZmZ d dlmZ d d lm Z m Z m Z d d l m Z d d l!m"Z" G d d � d e#�Z$dS )� )�GLibN)� SHORTCUTS�DEFAULT_ZONE_TARGET�SOURCE_IPSET_TYPES)�FirewallTransaction)�Policy)�log) �Rich_ForwardPort�Rich_IcmpBlock� Rich_IcmpType� Rich_Mark�Rich_Masquerade� Rich_Port� Rich_Protocol� Rich_Rule� Rich_Service�Rich_SourcePort�Rich_Tcp_Mss_Clamp)�nm_get_bus_name)� checkIPnMask� checkIP6nMask� check_mac)�errors)� FirewallErrorc @ s6 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd� Zd�d d �Zd d � Zd!d"� Zd#d$� Zd�d%d&�Zd'd(� Zd�d)d*�Zd�d+d,�Zd-d.� Zd/d0� Zd1d2� Zd3d4� Z d5d6� Z d7d8� Z d9d:� Z d�d<d=�Z d>d?� Z!d�d@dA�Z"d�dBdC�Z#d�dDdE�Z$dFdG� Z%dHdI� Z&dJdK� Z'd�dMdN�Z(d�dOdP�Z)d�dQdR�Z*dSdT� Z+d�dUdV�Z,d�dWdX�Z-dYdZ� Z.d[d\� Z/d]d^� Z0d�d_d`�Z1dadb� Z2dcdd� Z3dedf� Z4dgdh� Z5didj� Z6dkdl� Z7d�dmdn�Z8dodp� Z9dqdr� Z:dsdt� Z;d�dudv�Z<dwdx� Z=dydz� Z>d{d|� Z?d�d}d~�Z@dd�� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�d��ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�d��ZId�d�� ZJd�d�� ZKd�d�� ZLd�d�d��ZMd�d�� ZNd�d�� ZOd�d�d��ZPd�d�d��ZQd�d�d��ZRd�d�� ZSd�d�d��ZTd�d�� ZUd�d�� ZVd�d�� ZWd�d�d��ZXd�d�� ZYd�d�� ZZd�d�� Z[d�d�� Z\d�d�d��Z]d�d�� Z^d�d�d��Z_d�d�� Z`d�d�� Zad S )�� FirewallZoner c C s || _ i | _i | _i | _d S �N)�_fw�_zones�_zone_policies� _timeouts)�self�fw� r" �9/usr/lib/python3.9/site-packages/firewall/core/fw_zone.py�__init__2 s zFirewallZone.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r" r" r# �__repr__8 s zFirewallZone.__repr__c C s. | j �� | j�� | jD ]}| �|� qd S r )r �clearr r � removeTimeout�r �_idr" r" r# �cleanup; s zFirewallZone.cleanupc C s t | j�}|�| jj� |S r )r r Zadd_pre�full_check_config)r �tr" r" r# �new_transactionA s z FirewallZone.new_transactionc C s dj ||d�S )Nzzone_{fromZone}_{toZone})�fromZone�toZone)�format)r r0 r1 r" r" r# �policy_name_from_zonesF s z#FirewallZone.policy_name_from_zonesc C s t | j�� �S r )�sortedr �keysr& r" r" r# � get_zonesK s zFirewallZone.get_zonesc C s4 g }| � � D ]"}| �|�s$| �|�r |�|� q |S r )r6 �list_interfaces� list_sources�append)r Z active_zones�zoner" r" r# �get_active_zonesN s z FirewallZone.get_active_zonesc C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__interface_idr � interfaces)r � interface� interface_idr: r" r" r# �get_zone_of_interfaceU s z"FirewallZone.get_zone_of_interfacec C s2 | � |�}| jD ] }|| j| jv r| S qd S r )�_FirewallZone__source_idr �sources)r �source� source_idr: r" r" r# �get_zone_of_source] s z FirewallZone.get_zone_of_sourcec C s | j �|�}| j| S r )r � check_zoner )r r: �zr" r" r# �get_zonee s zFirewallZone.get_zonec C sH t � }|j|_| �||�|_| j|_|j|_|g|_|g|_dD �] }||jkrz|dkrz|dv rzt ||t � t ||��� q@|dkr�||jkr�|dv r�t ||t � t ||��� q@||jkr�|dkr�|dv r�t ||t � t ||��� q@|dv r@g |_ g |_|j D ]D}| �||�}t|d�}|| �|j|�v r�|j �|� |j�|� q�q@|S ) N) �services�ports� masquerade� forward_ports� source_ports� icmp_blocks�icmp_block_inversion� rules_str� protocols�HOST)rI rJ rM rN rO rQ �ANY)rK )rL )rP ��rule_str)r �nameZderived_from_zoner3 �ZONE_POLICY_PRIORITY�priority�targetZ ingress_zonesZ egress_zones�setattr�copy�deepcopy�getattrrP �rulesr �_rich_rule_to_policiesr9 ) r �z_objr0 r1 �p_objZsettingrU Zcurrent_policy�ruler" r" r# �policy_obj_from_zone_obji s8 �� z%FirewallZone.policy_obj_from_zone_objc C sr || j |j< g | j|j< |jdfd|jf|jdffD ]8\}}| �|||�}| jj�|� | j|j �|j� q4d S )NrR rS )r rV r rc r �policyZ add_policyr9 )r �objr0 r1 ra r" r" r# �add_zone� s � zFirewallZone.add_zonec C s. | j | }|jr| �|� | j |= | j|= d S r )r �applied�unapply_zone_settingsr )r r: re r" r" r# � remove_zone� s zFirewallZone.remove_zoneNc C sR | � � D ]D}| j| }t|j�dks2t|j�dkrt�d|� | j||d� qd S )Nr zApplying zone '%s'��use_transaction)r6 r �lenr= rB r �debug1�apply_zone_settings)r rk r: r` r" r" r# � apply_zones� s zFirewallZone.apply_zonesc C s | j | }||_d S r )r rg )r r: rg re r" r" r# �set_zone_applied� s z FirewallZone.set_zone_appliedc C s� d|vr d S |� d�}t|�dk r&d S d }tD ]}|d t| kr.|}q.|d ur�|d | �� vrdd S t|�dks�t|�dkr�|d dv r�|d |fS d S )N�_� r � � )Zprer ZdenyZallowZpost)�splitrl r r6 )r �chainZsplits�_chain�xr" r" r# �zone_from_chain� s& � � z FirewallZone.zone_from_chainc C st | � |�}|d u rd S |\}}|dv r0|}d}n4|dv rB|}d}n"|dv rTd}|}nttjd| ��| �||�|fS )N)Z PREROUTINGZFORWARDrS )ZINPUTrR )Z POSTROUTINGz&chain '%s' can't be mapped to a policy)ry r r Z INVALID_CHAINr3 )r rv rx r: rw r0 r1 r" r" r# �policy_from_chain� s z FirewallZone.policy_from_chainc C sj |dv rf| � |�}|d urf| � |�\}}|d u r:| �� }n|}| jj�|d|||� |d u rf|�d� d S )N)�ipv4�ipv6T)rz r/ r rd Zgen_chain_rules�execute) r �ipv�tablerv rk rx rd rw � transactionr" r" r# �create_zone_base_by_chain� s �z&FirewallZone.create_zone_base_by_chainc C s� dD ]�}t | �|�|�}t|t�r(|g}|D ]j}|dkrJ| �||||� q,|dkrp| �|�}| �|||||� q,|dkr|q,q,|dkr�q,t�d|||� q,q|r�| � |||� d S )N)r= rB �forwardrO r= rB rO r� z3Zone '%s': Unknown setting '%s:%s', unable to apply) r] rH � isinstance�bool� _interface� check_source�_sourcer Zwarning�_icmp_block_inversion)r �enabler: r� �keyZ args_list�argsr~ r" r" r# �_zone_settings� s& �zFirewallZone._zone_settingsc C s� | j �|�}| j| }|jr d S d|_|d u r8| �� }n|}| j| D ]$}t�d||� | j jj ||d� qF| � d||� |d u r�|� d� d S )NTz+Applying policy (%s) derived from zone '%s'rj ) r rF r rg r/ r r rm rd �apply_policy_settingsr� r} �r r: rk �_zonere r� rd r" r" r# rn s z FirewallZone.apply_zone_settingsc C s| | j �|�}| j| }|js d S |d u r2| �� }n|}| j| D ]}| j jj||d� q@| �d||� |d u rx|� d� d S )Nrj FT) r rF r rg r/ r rd �unapply_policy_settingsr� r} r� r" r" r# rh # s z"FirewallZone.unapply_zone_settingsc C sz | � |�}| �|�}g }td�D ]P}|j| d |vrX|�t�t||j| d ��� q |�||j| d � q t|�S )�H :return: exported config updated with runtime settings � r ) rH � get_config_with_settings_dict�rangeZIMPORT_EXPORT_STRUCTUREr9 r[ r\ r] �tuple)r r: re Z conf_dictZ conf_list�ir" r" r# �get_config_with_settings6 s "z%FirewallZone.get_config_with_settingsc C s� | � |��� }|d tkr"d|d< | �|�| �|�| �|�| �|�| �|�| �|�| � |�| � |�| � |�| � |�| � |�| �|�d� }| j�||�S )r� rY �default� rI rJ rN rK rL r= rB rP rQ rM rO r� )rH Zexport_config_dictr � list_services� list_ports�list_icmp_blocks�query_masquerade�list_forward_portsr7 r8 � list_rules�list_protocols�list_source_ports�query_icmp_block_inversion� query_forwardr Z'combine_runtime_with_permanent_settings)r r: Z permanentZruntimer" r" r# r� F s" � z*FirewallZone.get_config_with_settings_dictc sR d� fdd� }� fdd�}� j � jf� j� jf� j� jf� j� jf� j� j f� j � j f� j � j f||f� j� jf� j� jf� j� jf� j� jfd� }d}d|v r�|d }t�|�}|d= � �|�}t�|�} | �|� j�� � � j�d| gi� � � |�} � j� | |�\} } | D ]p} t | | t ��rn| | D ]>}t |t ��rV|| d |g|�R � n|| d ||� �q,n|| d |� �q| D ]�} t | | t ��r| | D ]n}| d v �r�|| d |||d � nFt |t ��r�|| d |g|�R ||d �� n|| d ||||d � �q�n6| d v �r4|| d ||d � n|| d |||d � �q�d S )Nr c s � j | t|d�||d� d S )NrT ��timeout�sender)�add_ruler )r: rU r� r� r& r" r# �add_rule_wrapper^ s zDFirewallZone.set_config_with_settings_dict.<locals>.add_rule_wrapperc s � � | t|d�� d S )NrT )� remove_ruler )r: rU r& r" r# �remove_rule_wrapper` s zGFirewallZone.set_config_with_settings_dict.<locals>.remove_rule_wrapperr� r� Zzonesrs )r= rB )r� r� )rO )r N)!� add_service�remove_service�add_port� remove_port�add_icmp_block�remove_icmp_block�add_masquerade�remove_masquerade�add_forward_port�remove_forward_port� add_interface�remove_interface� add_source� remove_source� add_protocol�remove_protocol�add_source_port�remove_source_port�add_icmp_block_inversion�remove_icmp_block_inversion� add_forward�remove_forwardr[ rH Zimport_config_dictr Zget_all_io_objects_dictr- r� Z get_added_and_removed_settingsr� �listr� )r r: Zsettingsr� r� r� Z setting_to_fnr� Zold_objZ check_objZ old_settingsZ add_settingsZremove_settingsr� r� r" r& r# � set_config_with_settings_dict\ sd � ��� z*FirewallZone.set_config_with_settings_dictc C s || j vr|| j |< d S r )r )r �tagr+ r" r" r# � addTimeout� s zFirewallZone.addTimeoutc C s& || j v r"t�| j | � | j |= d S r )r r Z source_remover* r" r" r# r) � s zFirewallZone.removeTimeoutc C s | j �|� d S r )r �check_interface�r r> r" r" r# r� � s z FirewallZone.check_interfacec C s | � |� |S r )r� r� r" r" r# Z__interface_id� s zFirewallZone.__interface_idTc C s | j �� | j �|�}| j| }| �|�}||jv rHttjd||f ��| � |�} | d urnttj d|| f ��t � d||f � |d u r�| � � } n|} |js�|r�| j|| d� | �| j|d� |r�| �d||| � | �||||� | �| j||� |d u �r| �d� |S )N�'%s' already bound to '%s'z&Setting zone of interface '%s' to '%s'rj FT)r � check_panicrF r r< r= r r �ZONE_ALREADY_SETr@ � ZONE_CONFLICTr rm r/ rg rn �add_failrp r� �!_FirewallZone__register_interface�#_FirewallZone__unregister_interfacer} ) r r: r> r� rk � allow_applyr� �_objr? �zoir� r" r" r# r� � sJ �� ��� � � zFirewallZone.add_interfacec C sB |j �|� |r|dkr&| jj�|� |t� kr>| jj�|� d S )N� )r= r9 r �_default_zone_interfacesr �_nm_assigned_interfaces)r r� r? r: r� r" r" r# Z__register_interface� s z!FirewallZone.__register_interfacec C sR | j �� | �|�}| j �|�}||kr,|S |d ur@| �||� | �|||�}|S r )r r� r@ rF r� r� )r r: r> r� � _old_zone� _new_zoner� r" r" r# �change_zone_of_interface� s z%FirewallZone.change_zone_of_interfacec C sz | j �� |d u r | �� }n|}| �||� | jd|d|dd� |d urd|dkrd| jd|d|dd� |d u rv|�d� d S )NT�+)r9 r� F)r r� r/ rn r� r} )r Zold_zoneZnew_zonerk r� r" r" r# �change_default_zone� s z FirewallZone.change_default_zonec C s� | j �� | �|�}|d u r,ttjd| ��|dkr8|n | j �|�}||krbttjd|||f ��|d u rt| �� }n|}| j | }| � |�}|� | j ||� | � d|||� |d u r�|�d� |S )N�'%s' is not in any zoner� z"remove_interface(%s, %s): zoi='%s'FT)r r� r@ r r ZUNKNOWN_INTERFACErF r� r/ r r< �add_postr� r� r} ) r r: r> rk r� r� r� r� r? r" r" r# r� s. ��� z FirewallZone.remove_interfacec C sN ||j v r|j �|� || jjv r0| jj�|� || jjv rJ| jj�|� d S r )r= �remover r� r� )r r� r? r" r" r# Z__unregister_interface s z#FirewallZone.__unregister_interfacec C s | � |�| �|�jv S r )r< rH r= )r r: r> r" r" r# �query_interface' s z FirewallZone.query_interfacec C s | � |�jS r )rH r= �r r: r" r" r# r7 * s z FirewallZone.list_interfacesFc C sx t |�r dS t|�rdS t|�r$dS |�d�rh| �|dd � � |rV| �|dd � � | �|dd � �S ttj |��d S )Nr{ r| r� zipset:� ) r r r � startswith� _check_ipset_type_for_source�_check_ipset_applied� _ipset_familyr r Z INVALID_ADDR�r rC rg r" r" r# r� / s zFirewallZone.check_sourcec C s | j ||d� |S )N�rg )r� r� r" r" r# Z __source_id> s zFirewallZone.__source_idc C s | j �� | j �|�}| j| }t|�r0|�� }| j||d�}| j||d�} | |jv rjt t j d||f ��| � |�d ur�t t j d| ��|d u r�| �� } n|} |js�|r�| j|| d� | �| j|d� |r�| �d||| | � | �|| ||� | �| j|| � |d u �r| �d� |S )Nr� r� z '%s' already bound to a zonerj FT)r r� rF r r �upperr� rA rB r r r� rE r� r/ rg rn r� rp r� � _FirewallZone__register_source� _FirewallZone__unregister_sourcer} ) r r: rC r� rk r� r� r� r~ rD r� r" r" r# r� B s< �� � zFirewallZone.add_sourcec C s |j �|� d S r )rB r9 )r r� rD r: r� r" r" r# Z__register_sourcej s z FirewallZone.__register_sourcec C sb | j �� | �|�}| j �|�}||kr,|S t|�r<|�� }|d urP| �||� | �|||�}|S r )r r� rE rF r r� r� r� )r r: rC r� r� r� r� r" r" r# �change_zone_of_sourcem s z"FirewallZone.change_zone_of_sourcec C s� | j �� t|�r|�� }| �|�}|d u r<ttjd| ��|dkrH|n | j �|�}||krrttj d|||f ��|d u r�| � � }n|}| j | }| � |�}| � |�} |�| j|| � | �d||| |� |d u r�|�d� |S )Nr� r� z remove_source(%s, %s): zos='%s'FT)r r� r r� rE r r ZUNKNOWN_SOURCErF r� r/ r r� rA r� r� r� r} ) r r: rC rk Zzosr� r� r� r~ rD r" r" r# r� s4 ��� zFirewallZone.remove_sourcec C s ||j v r|j �|� d S r )rB r� )r r� rD r" r" r# Z__unregister_source� s z FirewallZone.__unregister_sourcec C s& t |�r|�� }| �|�| �|�jv S r )r r� rA rH rB )r r: rC r" r" r# � query_source� s zFirewallZone.query_sourcec C s | � |�jS r )rH rB r� r" r" r# r8 � s zFirewallZone.list_sourcesc sp � j �� D ]�}|jsq � j| D ]>}� j j�|�D ]*\}} |�|||||| |�} |�|| � q2q � �|d�}� � |�j r |dvr |j |||d|d�} |�|| � q � j j� � D ]�}|� j j� |�vr�|� j j�|�vr�q�|� j j�� v �rR� j j�|�j�rR|�s*t� �|��dk�r*� j jj||d� n&� j j�d||� |�� fdd �|� q�|r�|�� fd d �|� q�d S ) NrS )r� �*�filter�r> rs rj Fc s | � j j�� v o � j j�d| �S �NT�r rd �)get_active_policies_not_derived_from_zoneZ!_ingress_egress_zones_transaction��pr& r" r# �<lambda>� s z)FirewallZone._interface.<locals>.<lambda>c s | � j j�� v o � j j�| �S r �r rd r� r� r� r& r" r# r� � s )r �enabled_backends�policies_supportedr rd �#_get_table_chains_for_zone_dispatchZ!build_zone_source_interface_rules� add_rulesr3 rH r� �build_zone_forward_rules�"get_policies_not_derived_from_zone�list_ingress_zones�list_egress_zonesr� � get_policyrg rl r7 r� �_ingress_egress_zonesr� ) r r� r: r> r� r9 �backendrd r rv r^ r" r& r# r� � s: � �$��zFirewallZone._interfacec C s$ | � |�dkrd S | jjj|dd�S )Nzhash:macFr� )� _ipset_typer �ipsetZ get_family�r rV r" r" r# r� � s zFirewallZone._ipset_familyc C s | j jj|dd�S )NFr� )r r Zget_typer r" r" r# r� � s zFirewallZone._ipset_typec C s d� |g| jj�|� �S )N�,)�joinr r Z get_dimension)r rV �flagr" r" r# �_ipset_match_flags� s z FirewallZone._ipset_match_flagsc C s | j j�|�S r )r r Z check_appliedr r" r" r# r� � s z!FirewallZone._check_ipset_appliedc C s* | � |�}|tvr&ttjd||f ��d S )Nz.ipset '%s' with type '%s' not usable as source)r� r r r Z INVALID_IPSET)r rV Z_typer" r" r# r� � s ��z)FirewallZone._check_ipset_type_for_sourcec sx |r� j �|�gn� j �� D ]�}|js(q � j| D ]<}� j j�|�D ](\}} |�|||||| �} |�|| � qDq2� � |d�}� � |�j r |j |||d|d�} |�|| � q � j j� � D ]�}|� j j�|�vr�|� j j�|�vr�q�|� j j�� v �rZ� j j�|�j�rZ|�s2t� �|��dk�r2� j jj||d� n&� j j�d||� |�� fdd�|� q�|r�|�� fd d�|� q�d S ) NrS r� �rC rs rj Fc s | � j j�� v o � j j�d| �S r� r� r� r& r" r# r� s z&FirewallZone._source.<locals>.<lambda>c s | � j j�� v o � j j�| �S r r� r� r& r" r# r� s )r �get_backend_by_ipvr� r� r rd r� Z build_zone_source_address_rulesr� r3 rH r� r� r� r� r� r� r� rg rl r8 r� r� r� ) r r� r: r~ rC r� r� rd r rv r^ r" r& r# r� � s: � �$��zFirewallZone._sourcec C s0 | j �|�}| �|d�}| j j�||||� |S �NrR )r rF r3 rd r� )r r: �servicer� r� �p_namer" r" r# r� s zFirewallZone.add_servicec C s, | j �|�}| �|d�}| j j�||� |S r )r rF r3 rd r� �r r: r r r" r" r# r� s zFirewallZone.remove_servicec C s( | j �|�}| �|d�}| j j�||�S r )r rF r3 rd � query_servicer r" r" r# r s zFirewallZone.query_servicec C s& | j �|�}| �|d�}| j j�|�S r )r rF r3 rd r� �r r: r r" r" r# r� % s zFirewallZone.list_servicesc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rF r3 rd r� )r r: �port�protocolr� r� r r" r" r# r� * s zFirewallZone.add_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rF r3 rd r� �r r: r r r r" r" r# r� 0 s zFirewallZone.remove_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rF r3 rd � query_portr r" r" r# r 6 s zFirewallZone.query_portc C s& | j �|�}| �|d�}| j j�|�S r )r rF r3 rd r� r r" r" r# r� ; s zFirewallZone.list_portsc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rF r3 rd r� )r r: � source_portr r� r� r r" r" r# r� @ s z FirewallZone.add_source_portc C s. | j �|�}| �|d�}| j j�|||� |S r )r rF r3 rd r� �r r: r r r r" r" r# r� F s z FirewallZone.remove_source_portc C s* | j �|�}| �|d�}| j j�|||�S r )r rF r3 rd �query_source_portr r" r" r# r L s z FirewallZone.query_source_portc C s& | j �|�}| �|d�}| j j�|�S r )r rF r3 rd r� r r" r" r# r� Q s z FirewallZone.list_source_portsc C s� | j �|�}t|j�tkr(| �|d�gS t|j�ttt t t t fv rP| �|d�gS t|j�t fv rn| �|d�gS t|j�tfv r�| �d|�gS t|j�tfv r�| �|d�gS |jd u r�| �|d�gS ttjdt|j� ��d S )NrS rR z Rich rule type (%s) not handled.)r rF �type�actionr r3 �elementr r r r r r r r r r r Z INVALID_RULE)r r: rb r" r" r# r_ V s � z#FirewallZone._rich_rule_to_policiesc C s* | � ||�D ]}| jj�||||� q |S r )r_ r rd r� )r r: rb r� r� r r" r" r# r� h s zFirewallZone.add_rulec C s& | � ||�D ]}| jj�||� q |S r )r_ r rd r� )r r: rb r r" r" r# r� m s zFirewallZone.remove_rulec C s. d}| � ||�D ]}|o&| jj�||�}q|S r� )r_ r rd � query_rule)r r: rb �retr r" r" r# r r s zFirewallZone.query_rulec C sZ | j �|�}t� }| �|d�| �|d�| �d|�fD ] }|�t| j j�|��� q4t|�S )NrS rR )r rF �setr3 �updaterd r� r� )r r: r r r" r" r# r� x s �zFirewallZone.list_rulesc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rF r3 rd r� )r r: r r� r� r r" r" r# r� � s zFirewallZone.add_protocolc C s, | j �|�}| �|d�}| j j�||� |S r )r rF r3 rd r� �r r: r r r" r" r# r� � s z FirewallZone.remove_protocolc C s( | j �|�}| �|d�}| j j�||�S r )r rF r3 rd �query_protocolr r" r" r# r � s zFirewallZone.query_protocolc C s& | j �|�}| �|d�}| j j�|�S r )r rF r3 rd r� r r" r" r# r� � s zFirewallZone.list_protocolsc C s. | j �|�}| �d|�}| j j�|||� |S �NrS )r rF r3 rd r� )r r: r� r� r r" r" r# r� � s zFirewallZone.add_masqueradec C s* | j �|�}| �d|�}| j j�|� |S r )r rF r3 rd r� r r" r" r# r� � s z FirewallZone.remove_masqueradec C s& | j �|�}| �d|�}| j j�|�S r )r rF r3 rd r� r r" r" r# r� � s z FirewallZone.query_masqueradec C s6 | j �|�}| �|d�}| j j�|||||||� |S r )r rF r3 rd r� ) r r: r r �toport�toaddrr� r� r r" r" r# r� � s �z FirewallZone.add_forward_portc C s2 | j �|�}| �|d�}| j j�|||||� |S r )r rF r3 rd r� �r r: r r r r r r" r" r# r� � s z FirewallZone.remove_forward_portc C s. | j �|�}| �|d�}| j j�|||||�S r )r rF r3 rd �query_forward_portr! r" r" r# r" � s �z FirewallZone.query_forward_portc C s& | j �|�}| �|d�}| j j�|�S r )r rF r3 rd r� r r" r" r# r� � s z FirewallZone.list_forward_portsc C s0 | j �|�}| �|d�}| j j�||||� |S r )r rF r3 rd r� )r r: �icmpr� r� r r" r" r# r� � s zFirewallZone.add_icmp_blockc C s, | j �|�}| �|d�}| j j�||� |S r )r rF r3 rd r� )r r: r# r r" r" r# r� � s z FirewallZone.remove_icmp_blockc C s( | j �|�}| �|d�}| j j�||�S r )r rF r3 rd �query_icmp_block)r r: r# � p_name_hostr" r" r# r$ � s z FirewallZone.query_icmp_blockc C s. | j �|�}| �|d�}tt| j j�|���S r )r rF r3 r4 r rd r� �r r: r% r" r" r# r� � s z FirewallZone.list_icmp_blocksc C s, | j �|�}| �|d�}| j j�||� |S r )r rF r3 rd r� )r r: r� r r" r" r# r� � s z%FirewallZone.add_icmp_block_inversionc C s. | j �|�}| �|d�}| j j�|||� d S r )r rF r3 rd r� )r r� r: r� r r" r" r# r� � s z"FirewallZone._icmp_block_inversionc C s* | j �|�}| �|d�}| j j�|� |S r )r rF r3 rd r� r r" r" r# r� � s z(FirewallZone.remove_icmp_block_inversionc C s& | j �|�}| �|d�}| j j�|�S r )r rF r3 rd r� r& r" r" r# r� � s z'FirewallZone.query_icmp_block_inversionc C s� | � |d�}| j| jD ]<}| j�� D ],}|js2q&|j|||d|d�}|�||� q&q| j| jD ]X}| � |�} | r�| j� | �gn| j�� D ],}|js�q�|j|||d|d�}|�||� q�qbd S )NrS r� r� r ) r3 r r= r r� r� r� r� rB r� r ) r r� r: r� r r> r� r^ rC r~ r" r" r# �_forward� s zFirewallZone._forwardc C s� | j �|�}| j �|� | j �� | j| }|jrBttjd| ��|d u rT| � � }n|}|j rl| � d||� |dkr�t � || j|�}| �|d|f� | �|||� |�| j|� |d u r�|�d� |S )Nz forward already enabled in '%s'Tr r� )r rF Z check_timeoutr� r r� r r ZALREADY_ENABLEDr/ rg r' r Ztimeout_add_secondsr� r� � _FirewallZone__register_forwardr� �!_FirewallZone__unregister_forwardr} ) r r: r� r� rk r� r� r� r� r" r" r# r� s* � zFirewallZone.add_forwardc C s d|_ d S r� �r� )r r� r� r� r" r" r# Z__register_forward$ s z FirewallZone.__register_forwardc C s� | j �|�}| j �� | j| }|js6ttjd| ��|d u rH| �� }n|}|j r`| � d||� | � d|f� |� | j |� |d u r�|�d� |S )Nzforward not enabled in '%s'Fr� T)r rF r� r r� r r Z NOT_ENABLEDr/ rg r' r) r� r) r} )r r: rk r� r� r� r" r" r# r� ' s" � zFirewallZone.remove_forwardc C s d|_ d S )NFr* )r r� r" r" r# Z__unregister_forwardA s z!FirewallZone.__unregister_forwardc C s | � |�jS r )rH r� r� r" r" r# r� D s zFirewallZone.query_forward)N)N)N)N)NNT)N)N)N)F)F)NNT)N)N)F)r N)r N)r N)r N)r N)r N)NNr N)NN)NN)r N)N)r NN)N)b�__name__� __module__� __qualname__rW r$ r' r, r/ r3 r6 r; r@ rE rH rc rf ri ro rp ry rz r� r� rn rh r� r� r� r� r) r� r< r� r� r� r� r� r� r� r7 r� rA r� r� r� r� r� r� r8 r� r� r� r r� r� r� r� r� r r� r� r� r r� r� r� r r� r_ r� r� r r� r� r� r r� r� r� r� r� r� r" r� r� r� r$ r� r� r� r� r� r' r� r( r� r) r� r" r" r" r# r / s� * � D � + � � ( � ,( � � � � r )%Z gi.repositoryr r[ Zfirewall.core.baser r r Z firewall.core.fw_transactionr Zfirewall.core.io.policyr Zfirewall.core.loggerr Zfirewall.core.richr r r r r r r r r r r Zfirewall.core.fw_nmr Zfirewall.functionsr r r Zfirewallr Zfirewall.errorsr �objectr r" r" r" r# �<module> s 4
💾 保存
取消
保存为 UTF-8，换行统一为 LF