
    VhJ                        d dl mZmZmZ eZdZdZd dlm	Z	 d dl
mZ d dlmZmZ 	 d dlmZ d dlmZ  G d	 d
e      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d de      Z G d d e      Z G d! d"e      Zd# Z e!d$k(  r e         y%y%# e$ r Y w xY w)&    )absolute_importdivisionprint_functiona6  
---
module: firewalld
short_description: Manage arbitrary ports/services with firewalld
description:
  - This module allows for addition or deletion of services and ports (either TCP or UDP) in either running or permanent firewalld rules.
options:
  service:
    description:
      - Name of a service to add/remove to/from firewalld.
      - The service must be listed in output of C(firewall-cmd --get-services).
    type: str
  protocol:
    description:
      - Name of a protocol to add/remove to/from firewalld.
    type: str
  port:
    description:
      - Name of a port or port range to add/remove to/from firewalld.
      - Must be in the form PORT/PROTOCOL or PORT-PORT/PROTOCOL for port ranges.
    type: str
  port_forward:
    description:
      - Port and protocol to forward using firewalld.
    type: list
    elements: dict
    suboptions:
      port:
        type: str
        required: true
        description:
          - Source port to forward from.
      proto:
        type: str
        required: true
        description:
          - protocol to forward.
        choices: [udp, tcp]
      toport:
        type: str
        required: true
        description:
          - destination port.
      toaddr:
        type: str
        description:
          - Optional address to forward to.
  rich_rule:
    description:
      - Rich rule to add/remove to/from firewalld.
      - See L(Syntax for firewalld rich language rules,https://firewalld.org/documentation/man-pages/firewalld.richlanguage.html).
    type: str
  source:
    description:
      - The source/network you would like to add/remove to/from firewalld.
    type: str
  interface:
    description:
      - The interface you would like to add/remove to/from a zone in firewalld.
    type: str
  icmp_block:
    description:
      - The ICMP block you would like to add/remove to/from a zone in firewalld.
    type: str
  icmp_block_inversion:
    description:
      - Enable/Disable inversion of ICMP blocks for a zone in firewalld.
    type: str
  zone:
    description:
      - The firewalld zone to add/remove to/from.
      - Note that the default zone can be configured per system but V(public) is default from upstream.
      - Available choices can be extended based on per-system configs, listed here are "out of the box" defaults.
      - Possible values include V(block), V(dmz), V(drop), V(external), V(home), V(internal), V(public), V(trusted), V(work).
    type: str
  permanent:
    description:
      - Whether to apply this change to the permanent firewalld configuration.
      - As of Ansible 2.3, permanent operations can operate on firewalld configs when it is not running (requires firewalld >= 0.3.9).
      - Note that if this is V(false), O(immediate=true) by default.
    type: bool
    default: false
  immediate:
    description:
      - Whether to apply this change to the runtime firewalld configuration.
      - Defaults to V(true) if O(permanent=false).
    type: bool
    default: false
  state:
    description:
      - Enable or disable a setting.
      - 'For ports: Should this port accept (V(enabled)) or reject (V(disabled)) connections.'
      - The states V(present) and V(absent) can only be used in zone level operations (i.e. when no other parameters but zone and state are set).
    type: str
    required: true
    choices: [ absent, disabled, enabled, present ]
  timeout:
    description:
      - The amount of time in seconds the rule should be in effect for when non-permanent.
    type: int
    default: 0
  forward:
    description:
      - The forward setting you would like to enable/disable to/from zones within firewalld.
      - This option only is supported by firewalld v0.9.0 or later.
    type: str
  masquerade:
    description:
      - The masquerade setting you would like to enable/disable to/from zones within firewalld.
    type: str
  offline:
    description:
      - Ignores O(immediate) if O(permanent=true) and firewalld is not running.
    type: bool
    default: false
  target:
    description:
      - firewalld Zone target.
      - If O(state=absent), this will reset the target to default.
    choices: [ default, ACCEPT, DROP, "%%REJECT%%" ]
    type: str
    version_added: 1.2.0
notes:
  - Not tested on any Debian based system.
  - Requires the python2 bindings of firewalld, which may not be installed by default.
  - For distributions where the python2 firewalld bindings are unavailable (e.g Fedora 28 and later) you will have to set the
    ansible_python_interpreter for these hosts to the python3 interpreter path and install the python3 bindings.
  - Zone transactions (creating, deleting) can be performed by using only the zone and state parameters "present" or "absent".
    Note that zone transactions must explicitly be permanent. This is a limitation in firewalld.
    This also means that you will have to reload firewalld after adding a zone that you wish to perform immediate actions on.
    The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not
    permanent. Therefore, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone
    creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone.
  - This module needs C(python-firewall) or C(python3-firewall) on managed nodes.
    It is usually provided as a subset with C(firewalld) from the OS distributor for the OS default Python interpreter.
requirements:
- firewalld >= 0.9.0
- python-firewall >= 0.9.0
author:
- Adam Miller (@maxamillion)
a  
- name: permanently enable https service, also enable it immediately if possible
  ansible.posix.firewalld:
    service: https
    state: enabled
    permanent: true
    immediate: true
    offline: true

- name: permit traffic in default zone for https service
  ansible.posix.firewalld:
    service: https
    permanent: true
    state: enabled

- name: permit ospf traffic
  ansible.posix.firewalld:
    protocol: ospf
    permanent: true
    state: enabled

- name: do not permit traffic in default zone on port 8081/tcp
  ansible.posix.firewalld:
    port: 8081/tcp
    permanent: true
    state: disabled

- ansible.posix.firewalld:
    port: 161-162/udp
    permanent: true
    state: enabled

- ansible.posix.firewalld:
    zone: dmz
    service: http
    permanent: true
    state: enabled

- ansible.posix.firewalld:
    rich_rule: rule service name="ftp" audit limit value="1/m" accept
    permanent: true
    state: enabled

- ansible.posix.firewalld:
    source: 192.0.2.0/24
    zone: internal
    state: enabled

- ansible.posix.firewalld:
    zone: trusted
    interface: eth2
    permanent: true
    state: enabled

- ansible.posix.firewalld:
    forward: true
    state: enabled
    permanent: true
    zone: internal

- ansible.posix.firewalld:
    masquerade: true
    state: enabled
    permanent: true
    zone: dmz

- ansible.posix.firewalld:
    zone: custom
    state: present
    permanent: true

- ansible.posix.firewalld:
    zone: drop
    state: enabled
    permanent: true
    icmp_block_inversion: true

- ansible.posix.firewalld:
    zone: drop
    state: enabled
    permanent: true
    icmp_block: echo-request

- ansible.posix.firewalld:
    zone: internal
    state: present
    permanent: true
    target: ACCEPT

- name: Redirect port 443 to 8443 with Rich Rule
  ansible.posix.firewalld:
    rich_rule: rule family=ipv4 forward-port port=443 protocol=tcp to-port=8443
    zone: public
    permanent: true
    immediate: true
    state: enabled
)AnsibleModule)boolean)FirewallTransaction
fw_offline)	Rich_Rule)FirewallClientZoneSettingsc                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
IcmpBlockTransactionz
    IcmpBlockTransaction
    c                 8    t         t        |   ||||||       y Naction_argsdesired_statezone	permanent	immediate)superr   __init__selfmoduler   r   r   r   r   	__class__s          k/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/ansible/posix/plugins/modules/firewalld.pyr   zIcmpBlockTransaction.__init__  s'    "D2=t_ht} 	3 	
    c                 P    || j                   j                  | j                        v S N)fwgetIcmpBlocksr   r   
icmp_blocktimeouts      r   get_enabled_immediatez*IcmpBlockTransaction.get_enabled_immediate  s     TWW22499===r   c                 L    | j                         \  }}||j                         v S r   )get_fw_zone_settingsr!   r   r#   r$   fw_zonefw_settingss        r   get_enabled_permanentz*IcmpBlockTransaction.get_enabled_permanent  s)    #88:[66888r   c                 R    | j                   j                  | j                  ||       y r   )r    addIcmpBlockr   r"   s      r   set_enabled_immediatez*IcmpBlockTransaction.set_enabled_immediate  s    TYY
G<r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r-   update_fw_settingsr(   s        r   set_enabled_permanentz*IcmpBlockTransaction.set_enabled_permanent  s3    #88:  ,5r   c                 P    | j                   j                  | j                  |       y r   )r    removeIcmpBlockr   r"   s      r   set_disabled_immediatez+IcmpBlockTransaction.set_disabled_immediate   s    		:6r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r3   r0   r(   s        r   set_disabled_permanentz+IcmpBlockTransaction.set_disabled_permanent#  s3    #88:##J/5r   NNNFF__name__
__module____qualname____doc__r   r%   r+   r.   r1   r4   r6   __classcell__r   s   @r   r   r     s+    

>9=6
76r   r   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
IcmpBlockInversionTransactionz'
    IcmpBlockInversionTransaction
    c                 8    t         t        |   ||||||       y r   )r   r@   r   r   s          r   r   z&IcmpBlockInversionTransaction.__init__.  s'    +T;=t_ht} 	< 	
r   c                 T    | j                   j                  | j                        du ryyNTF)r    queryIcmpBlockInversionr   r   s    r   r%   z3IcmpBlockInversionTransaction.get_enabled_immediate3  s#    77**4995=r   c                 P    | j                         \  }}|j                         du ryyrC   )r'   getIcmpBlockInversionr   r)   r*   s      r   r+   z3IcmpBlockInversionTransaction.get_enabled_permanent9  s,    #88:,,.$6r   c                 N    | j                   j                  | j                         y r   )r    addIcmpBlockInversionr   rE   s    r   r.   z3IcmpBlockInversionTransaction.set_enabled_immediate@  s    %%dii0r   c                 p    | j                         \  }}|j                  d       | j                  ||       y NTr'   setIcmpBlockInversionr0   rH   s      r   r1   z3IcmpBlockInversionTransaction.set_enabled_permanentC  s3    #88:))$/5r   c                 N    | j                   j                  | j                         y r   )r    removeIcmpBlockInversionr   rE   s    r   r4   z4IcmpBlockInversionTransaction.set_disabled_immediateH  s    ((3r   c                 p    | j                         \  }}|j                  d       | j                  ||       y NFrM   rH   s      r   r6   z4IcmpBlockInversionTransaction.set_disabled_permanentK  s3    #88:))%05r   r7   r8   r>   s   @r   r@   r@   )  s+    

16
46r   r@   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
ServiceTransactionz
    ServiceTransaction
    c                 8    t         t        |   ||||||       y r   )r   rT   r   r   s          r   r   zServiceTransaction.__init__V  s'     $0=t_ht} 	1 	
r   c                 T    || j                   j                  | j                        v ryyrC   )r    getServicesr   r   servicer$   s      r   r%   z(ServiceTransaction.get_enabled_immediate[  s#    dgg))$))44r   c                 P    | j                         \  }}||j                         v ryyrC   )r'   rW   r   rY   r$   r)   r*   s        r   r+   z(ServiceTransaction.get_enabled_permanenta  s,    #88:k--//r   c                 R    | j                   j                  | j                  ||       y r   )r    
addServicer   rX   s      r   r.   z(ServiceTransaction.set_enabled_immediatei  s    499gw7r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r]   r0   r[   s        r   r1   z(ServiceTransaction.set_enabled_permanentl  s3    #88:w'5r   c                 P    | j                   j                  | j                  |       y r   )r    removeServicer   rX   s      r   r4   z)ServiceTransaction.set_disabled_immediateq  s    dii1r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r`   r0   r[   s        r   r6   z)ServiceTransaction.set_disabled_permanentt  s3    #88:!!'*5r   r7   r8   r>   s   @r   rT   rT   Q  s+    

86
26r   rT   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
ProtocolTransactionz
    ProtocolTransaction
    c                 8    t         t        |   ||||||       y r   )r   rc   r   r   s          r   r   zProtocolTransaction.__init__  '    !41=t_ht} 	2 	
r   c                 T    || j                   j                  | j                        v ryyrC   )r    getProtocolsr   r   protocolr$   s      r   r%   z)ProtocolTransaction.get_enabled_immediate  s#    tww++DII66r   c                 P    | j                         \  }}||j                         v ryyrC   )r'   rg   r   ri   r$   r)   r*   s        r   r+   z)ProtocolTransaction.get_enabled_permanent  s,    #88:{//11r   c                 R    | j                   j                  | j                  ||       y r   )r    addProtocolr   rh   s      r   r.   z)ProtocolTransaction.set_enabled_immediate  s    DIIx9r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   rm   r0   rk   s        r   r1   z)ProtocolTransaction.set_enabled_permanent  s3    #88:)5r   c                 P    | j                   j                  | j                  |       y r   )r    removeProtocolr   rh   s      r   r4   z*ProtocolTransaction.set_disabled_immediate  s    tyy(3r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   rp   r0   rk   s        r   r6   z*ProtocolTransaction.set_disabled_permanent  s3    #88:""8,5r   r7   r8   r>   s   @r   rc   rc   z  s+    

:6
46r   rc   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
ForwardTransactionz
    ForwardTransaction
    c                     t         t        |   ||||||       d| j                  z  | _        d| j                  z  | _        y )Nr   zAdded forward to zone %szRemoved forward from zone %s)r   rs   r   r   enabled_msgdisabled_msgr   s          r   r   zForwardTransaction.__init__  sK     $0=t_ht} 	1 	
 6		A:TYYFr   c                 T    | j                   j                  | j                        du ryyrC   )r    queryForwardr   rE   s    r   r%   z(ForwardTransaction.get_enabled_immediate  s#    77		*d2r   c                 P    | j                         \  }}|j                         du ryyrC   )r'   rx   rH   s      r   r+   z(ForwardTransaction.get_enabled_permanent  s,    #88:##%-r   c                 N    | j                   j                  | j                         y r   )r    
addForwardr   rE   s    r   r.   z(ForwardTransaction.set_enabled_immediate  s    499%r   c                 p    | j                         \  }}|j                  d       | j                  ||       y rL   r'   
setForwardr0   rH   s      r   r1   z(ForwardTransaction.set_enabled_permanent  s3    #88:t$5r   c                 N    | j                   j                  | j                         y r   )r    removeForwardr   rE   s    r   r4   z)ForwardTransaction.set_disabled_immediate      dii(r   c                 p    | j                         \  }}|j                  d       | j                  ||       y rR   r}   rH   s      r   r6   z)ForwardTransaction.set_disabled_permanent  s3    #88:u%5r   r7   r8   r>   s   @r   rs   rs     s,    G&6
)6r   rs   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
MasqueradeTransactionz
    MasqueradeTransaction
    c                     t         t        |   ||||||       d| j                  z  | _        d| j                  z  | _        y )Nr   zAdded masquerade to zone %szRemoved masquerade from zone %s)r   r   r   r   ru   rv   r   s          r   r   zMasqueradeTransaction.__init__  sK    #T3=t_ht} 	4 	
 9499D=		Ir   c                 T    | j                   j                  | j                        du ryyrC   )r    queryMasquerader   rE   s    r   r%   z+MasqueradeTransaction.get_enabled_immediate  s#    77""499-5r   c                 P    | j                         \  }}|j                         du ryyrC   )r'   getMasqueraderH   s      r   r+   z+MasqueradeTransaction.get_enabled_permanent  s,    #88:$$&$.r   c                 N    | j                   j                  | j                         y r   )r    addMasquerader   rE   s    r   r.   z+MasqueradeTransaction.set_enabled_immediate  r   r   c                 p    | j                         \  }}|j                  d       | j                  ||       y rL   r'   setMasquerader0   rH   s      r   r1   z+MasqueradeTransaction.set_enabled_permanent  s3    #88:!!$'5r   c                 N    | j                   j                  | j                         y r   )r    removeMasquerader   rE   s    r   r4   z,MasqueradeTransaction.set_disabled_immediate  s      +r   c                 p    | j                         \  }}|j                  d       | j                  ||       y rR   r   rH   s      r   r6   z,MasqueradeTransaction.set_disabled_permanent  s3    #88:!!%(5r   r7   r8   r>   s   @r   r   r     s,    J)6
,6r   r   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
PortTransactionz
    PortTransaction
    c                 8    t         t        |   ||||||       y r   )r   r   r   r   s          r   r   zPortTransaction.__init__  s&    ot-=t_ht} 	. 	
r   c                     | j                   r&| j                         \  }}|j                  ||      S | j                  j                  | j                  ||      S )Nportri   )r   r   ri   )r	   r'   	queryPortr    r   r   r   ri   r$   dummyr*   s         r   r%   z%PortTransaction.get_enabled_immediate  sR    ??!%!:!:!<E;((dX(FFww  diidX NNr   c                 N    | j                         \  }}|j                  ||      S )Nr   )r'   r   r   s         r   r+   z%PortTransaction.get_enabled_permanent	  s+    !668{$$$$BBr   c                 T    | j                   j                  | j                  |||       y r   )r    addPortr   r   r   ri   r$   s       r   r.   z%PortTransaction.set_enabled_immediate  s    		47;r   c                 r    | j                         \  }}|j                  ||       | j                  ||       y r   )r'   r   r0   r   r   ri   r$   r)   r*   s         r   r1   z%PortTransaction.set_enabled_permanent  s5    #88:D(+5r   c                 R    | j                   j                  | j                  ||       y r   )r    
removePortr   r   s       r   r4   z&PortTransaction.set_disabled_immediate  s    499dH5r   c                 r    | j                         \  }}|j                  ||       | j                  ||       y r   )r'   r   r0   r   s         r   r6   z&PortTransaction.set_disabled_permanent  s5    #88:tX.5r   r7   r8   r>   s   @r   r   r     s-    

OC<6
66r   r   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
InterfaceTransactionz
    InterfaceTransaction
    c                     t         t        |   ||||||       d| j                  d   d| j                  | _        d| j                  d   d| j                  | _        y )Nr   zChanged r   	 to zone Removed  from zone )r   r   r   r   r   ru   rv   r   s          r   r   zInterfaceTransaction.__init__#  sg    "D2=t_ht} 	3 	

 a $))- a $))-r   c                     | j                   r$| j                         \  }}|j                         }n%| j                  j                  | j                        }||v ryyrC   )r	   r'   getInterfacesr    r   )r   	interfacer)   r*   interface_lists        r   r%   z*InterfaceTransaction.get_enabled_immediate.  sP    ??#'#<#<#> G[(668N!WW22499=N&r   c                 P    | j                         \  }}||j                         v ryyrC   )r'   r   r   r   r)   r*   s       r   r+   z*InterfaceTransaction.get_enabled_permanent9  s,    #88:1133r   c                 P    | j                   j                  | j                  |       y r   )r    changeZoneOfInterfacer   r   r   s     r   r.   z*InterfaceTransaction.set_enabled_immediateA  s    %%dii;r   c                    | j                         \  }}| j                  rg }| j                  j                  j	                         D ]G  }| j                  j                  j                  |      }||j                  v s7|j                  |       I t        |      dkD  r6| j                  j                  dj                  |t        |                   nt        |      dk(  r|d   j                  | j                  k7  r|d   }| j                  j                  j                  |      }t        t!        |            }|j#                  |       | j                  j                  j%                  ||j&                         |j)                  |       | j                  j                  j%                  ||j&                         y | j                  j                         j+                  |      }	|	| j                  k7  r|	r[| j                  j                         j-                  |	      }|j/                         }|j#                  |       |j1                  |       |j)                  |       |j1                  |       y y )N   z@ERROR: interface {0} is in {1} zone XML file, can only be in onemsgr   )r'   r	   r    config	get_zonesget_zone
interfacesappendlenr   	fail_jsonformatnamer   get_zone_configr   listremoveInterfaceset_zone_configsettingsaddInterfacegetZoneOfInterfacegetZoneByNamegetSettingsupdate)
r   r   r)   r*   iface_zone_objsr   old_zone_objold_zone_configold_zone_settingsold_zone_names
             r   r1   z*InterfaceTransaction.set_enabled_permanentD  s   #88:?? O002 9#ww~~66t< 7 77#**<89
 ?#a' %%Zaa!O, &  _%*q/A/F/F$))/S.q1"&''.."@"@"N$>tO?T$U!!11)<.. %.. $$Y/GGNN**7K4H4HI GGNN,??	JM		) #'77>>#3#A#A-#PL(4(@(@(B%%55i@ ''(9:((3{+ *r   c                 P    | j                   j                  | j                  |       y r   )r    r   r   r   s     r   r4   z+InterfaceTransaction.set_disabled_immediatel  s    		95r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r   r0   r   s       r   r6   z+InterfaceTransaction.set_disabled_permanento  s3    #88:##I.5r   r7   r8   r>   s   @r   r   r     s,    	-	<&,P66r   r   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
RichRuleTransactionz
    RichRuleTransaction
    c                 8    t         t        |   ||||||       y r   )r   r   r   r   s          r   r   zRichRuleTransaction.__init__z  re   r   c                 ~    t        t        |            }|| j                  j                  | j                        v ryyN)rule_strTF)strr
   r    getRichRulesr   r   ruler$   s      r   r%   z)RichRuleTransaction.get_enabled_immediate  s4     9d+,477''		22r   c                 z    | j                         \  }}t        t        |            }||j                         v ryyr   )r'   r   r
   r   r   r   r$   r)   r*   s        r   r+   z)RichRuleTransaction.get_enabled_permanent  s=    #88: 9d+,;++--r   c                 R    | j                   j                  | j                  ||       y r   )r    addRichRuler   r   s      r   r.   z)RichRuleTransaction.set_enabled_immediate  s    DIItW5r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r   r0   r   s        r   r1   z)RichRuleTransaction.set_enabled_permanent  s3    #88:%5r   c                 P    | j                   j                  | j                  |       y r   )r    removeRichRuler   r   s      r   r4   z*RichRuleTransaction.set_disabled_immediate  s    tyy$/r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r   r0   r   s        r   r6   z*RichRuleTransaction.set_disabled_permanent  s3    #88:""4(5r   r7   r8   r>   s   @r   r   r   u  s+    

66
06r   r   c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
SourceTransactionz
    SourceTransaction
    c                     t         t        |   ||||||       d| j                  d   d| j                  | _        d| j                  d   d| j                  | _        y )Nr   zAdded r   r   r   r   )r   r   r   r   r   ru   rv   r   s          r   r   zSourceTransaction.__init__  sg    /=t_ht} 	0 	

 a $))- a $))-r   c                 T    || j                   j                  | j                        v ryyrC   )r    
getSourcesr   r   sources     r   r%   z'SourceTransaction.get_enabled_immediate  s#    TWW''		22r   c                 P    | j                         \  }}||j                         v ryyrC   )r'   r   r   r   r)   r*   s       r   r+   z'SourceTransaction.get_enabled_permanent  s,    #88:[++--r   c                 P    | j                   j                  | j                  |       y r   )r    	addSourcer   r   s     r   r.   z'SourceTransaction.set_enabled_immediate  s    $))V,r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r   r0   r   s       r   r1   z'SourceTransaction.set_enabled_permanent  3    #88:f%5r   c                 P    | j                   j                  | j                  |       y r   )r    removeSourcer   r   s     r   r4   z(SourceTransaction.set_disabled_immediate  s    TYY/r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   )r'   r   r0   r   s       r   r6   z(SourceTransaction.set_disabled_permanent  s3    #88:  (5r   r7   r8   r>   s   @r   r   r     s+    	--6
06r   r   c                   L     e Zd ZdZ	 	 d	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
ZoneTargetTransactionz
    ZoneTargetTransaction
    c	                     t         t        |   |||||||xs ddg|xs ddg       d| j                  d|d   | _        d	| j                  z  | _        d
| _        y )Npresentenabledabsentdisabledr   r   r   r   r   enabled_valuesdisabled_valuesz	Set zone z target to r   zReset zone %s target to default~Zone operations must be permanent. Make sure you didn't set the 'permanent' flag to 'false' or the 'immediate' flag to 'true'.)r   r   r   r   ru   rv   tx_not_permanent_error_msg
r   r   r   r   r   r   r   r   r   r   s
            r   r   zZoneTargetTransaction.__init__  s{    #T3=t9)Ci-C+E*/E	 	4 	G YYA( >YY+j'r   c                 P    | j                   j                  | j                         y Nr   r   r   r   r   targets     r   r%   z+ZoneTargetTransaction.get_enabled_immediate      $"A"ABr   c                 R    | j                         \  }}|j                         }||k(  S r   )r'   	getTarget)r   r  r)   r*   current_targets        r   r+   z+ZoneTargetTransaction.get_enabled_permanent  s.    #88:$..0&()r   c                 P    | j                   j                  | j                         y r  r  r  s     r   r.   z+ZoneTargetTransaction.set_enabled_immediate  r  r   c                 p    | j                         \  }}|j                  |       | j                  ||       y r   r'   	setTargetr0   r   r  r)   r*   s       r   r1   z+ZoneTargetTransaction.set_enabled_permanent  r   r   c                 P    | j                   j                  | j                         y r  r  r  s     r   r4   z,ZoneTargetTransaction.set_disabled_immediate  r  r   c                 p    | j                         \  }}|j                  d       | j                  ||       y )Ndefaultr  r  s       r   r6   z,ZoneTargetTransaction.set_disabled_permanent  s3    #88:i(5r   NNNTFNNr8   r>   s   @r   r   r     s9     KOW[j"C*
C6
C6r   r   c                   L     e Zd ZdZ	 	 d	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
ZoneTransactionz
    ZoneTransaction
    c	                     t         t        |   |||||||xs dg|xs dg       d| j                  z  | _        d| j                  z  | _        d| _        y )Nr   r   r   zAdded zone %szRemoved zone %sr   )r   r  r   r   ru   rv   r   r   s
            r   r   zZoneTransaction.__init__  sp    ot-=t9)8i[+9z	 	. 	; +YY .YY+j'r   c                 P    | j                   j                  | j                         y r  r  rE   s    r   r%   z%ZoneTransaction.get_enabled_immediate  r  r   c                    | j                   ra| j                  j                  j                         }|D cg c]1  }| j                  j                  j	                  |      j
                  3 }}nm| j                  j                         j                         }|D cg c]:  }| j                  j                         j                  |      j                  d      < }}| j                  |v S c c}w c c}w )Nr   )
r	   r    r   r   r   r   	listZonesgetZoneget_propertyr   )r   zonesz
zone_namess       r   r+   z%ZoneTransaction.get_enabled_permanent  s    ??GGNN,,.ECHIa$''..11!499IJIGGNN$..0ETYZq$''..*2215BB6JZJZyyJ&&	 J [s   6C)?C.c                 P    | j                   j                  | j                         y r  r  rE   s    r   r.   z%ZoneTransaction.set_enabled_immediate"  r  r   c                    | j                   rC| j                  j                  j                  | j                  t               j                         y | j                  j                         j                  | j                  t                      y r   )r	   r    r   new_zoner   r   r   addZonerE   s    r   r1   z%ZoneTransaction.set_enabled_permanent%  sR    ??GGNN##DII/I/K/T/TUGGNN$$TYY0J0LMr   c                 P    | j                   j                  | j                         y r  r  rE   s    r   r4   z&ZoneTransaction.set_disabled_immediate+  r  r   c                 L   | j                   rU| j                  j                  j                  | j                        }| j                  j                  j                  |       y | j                  j                         j                  | j                        }|j                          y r   )r	   r    r   r   r   remove_zoner   remove)r   r   zone_objs      r   r6   z&ZoneTransaction.set_disabled_permanent.  sd    ??77>>**4995DGGNN&&t,ww~~'55dii@HOOr   r  r8   r>   s   @r   r  r     s:     KOW[j"C'CNCr   r  c                   H     e Zd ZdZd	 fd	Zd Zd Zd Zd Zd Z	d Z
 xZS )
ForwardPortTransactionz 
    ForwardPortTransaction
    c                 8    t         t        |   ||||||       y r   )r   r'  r   r   s          r   r   zForwardPortTransaction.__init__<  s'    $d4=t_ht} 	5 	
r   c                     | j                   r(| j                         \  }}|j                  ||||      S | j                  j                  | j                  ||||      S )Nr   ri   to_portto_addr)r   r   ri   toporttoaddr)r	   r'   queryForwardPortr    r   r   r   protor-  r.  r$   r   r*   s           r   r%   z,ForwardPortTransaction.get_enabled_immediateA  s^    ??!%!:!:!<E;//TESYci/jjww''TYYTEZ`io'ppr   c                 R    | j                         \  }}|j                  ||||      S )Nr*  )r'   r/  r0  s           r   r+   z,ForwardPortTransaction.get_enabled_permanentG  s0    !668{++v_e+ffr   c                 X    | j                   j                  | j                  |||||       y r   )r    addForwardPortr   r   r   r1  r-  r.  r$   s         r   r.   z,ForwardPortTransaction.set_enabled_immediateK  s"    tyy$vvwOr   c                 v    | j                         \  }}|j                  ||||       | j                  ||       y r   )r'   r4  r0   r   r   r1  r-  r.  r$   r)   r*   s           r   r1   z,ForwardPortTransaction.set_enabled_permanentN  s9    #88:""4?5r   c                 V    | j                   j                  | j                  ||||       y r   )r    removeForwardPortr   r5  s         r   r4   z-ForwardPortTransaction.set_disabled_immediateS  s     !!$))T5&&Ir   c                 v    | j                         \  }}|j                  ||||       | j                  ||       y r   )r'   r9  r0   r7  s           r   r6   z-ForwardPortTransaction.set_disabled_permanentV  s9    #88:%%dE66B5r   r7   r8   r>   s   @r   r'  r'  7  s/    

qgP6
J6r   r'  c                     t        t        d=i dt        d      dt        d      dt        d      dt        d      dt        d      dt        d	d
      dt        d      dt        d      dt        dd      dt        d      dt        dd      dt        ddg d      dt        dd      dt        d      dt        d      dt        d      dt        dd      dt        dg d !      dt        d"d"d#$      g d%g&      } | j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }t        j                  |        |r|s| j                  d'(       t        rd}|s|sd}|rt        r| j                  d)(       d}	g }
| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }| j                  d   }d }| j                  d   Xd*| j                  d   v r0| j                  d   j                         j                  d*      \  }}nd }|s| j                  d+(       nd }d,}d }| j                  d   t        | j                  d         d-kD  r| j                  d.(       | j                  d   d   }d|vr| j                  d/(       d0|vr| j                  d1(       d2|vr| j                  d3(       d4|v r|d4   }d}t        ||||||||||||g      rd}|r|d5v r|| j                  d6(       |Ft        | ||f||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  d8|d9|       |_d}	 t        |d      }|d;k(  |k(  rd;nd<}t#        | d=||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  d>|d9|       |Ft%        | ||f||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  d?|d9|       |Ft'        | ||f||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  d@|d9|       |*t)        | |f||||7      }|j                         \  }	}|
|z   }
|Lt+        | |||f||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  dA|d*|d9|       |yt-        | t/        |d         |d0   t/        |d2         ||f||||7      }|j                         \  }	}|
|z   }
|	du r,|
j                  dBdC|d   dD|d0   dE|d2   dF|d9|       |Ft1        | ||f||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  dG|d9|       |*t3        | |f||||7      }|j                         \  }	}|
|z   }
|Dd}	 t        |d      }|d;k(  |k(  rd;nd<}t5        | d=||||7      }|j                         \  }	}|
|z   }
|Dd}	 t        |d      }|d;k(  |k(  rd;nd<}t7        | d=||||7      }|j                         \  }	}|
|z   }
|*t9        | |f||||7      }|j                         \  }	}|
|z   }
	 |sH|d5v rDt;        | d=||||7      }|j                         \  }	}|
|z   }
|	du r|
j                  dJ|d9|       t        r|
j                  dK       | j=                  |	dLj?                  |
      M       y # t        $ r | j!                  d:|z         Y w xY w# t        $ r | j!                  dH|z         Y pw xY w# t        $ r | j!                  dI|z         Y Nw xY w)NNr#   r   )typeicmp_block_inversionrY   ri   r   port_forwardr   dict)r<  elements	rich_ruler   r   boolF)r<  r  r   r   stateT)r   r   r   r   )r<  requiredchoicesr$   intr   r   forward
masqueradeoffliner  )r  ACCEPTDROPz
%%REJECT%%)r<  rE  )r   )r   )r   r  r   )r#   r=  rY   ri   r   r>  rA  r   rG  rH  r   r  )argument_specsupports_check_moderequired_bymutually_exclusivez>offline cannot be enabled unless permanent changes are allowedr   zhfirewall is not currently running, unable to perform immediate actions without a running firewall daemon/z(improper port format (missing protocol?) r   z)Only one port forward supported at a timez'port must be specified for port forwardr1  z0proto udp/tcp must be specified for port forwardr-  z)toport must be specified for port forwardr.  )r   r   zBabsent and present state can only be used in zone level operations)r   r   r   r   r   zChanged icmp-block z to zThe value of the icmp_block_inversion option is "%s". The type of the option will be changed from string to boolean in a future release. To avoid unexpected behavior, please change the value to boolean.r   r    zChanged icmp-block-inversion zChanged service zChanged protocol zChanged port zChanged port_forward zport=z:proto=z:toport=z:toaddr=zChanged rich_rule zThe value of the forward option is "%s". The type of the option will be changed from string to boolean in a future release. To avoid unexpected behavior, please change the value to boolean.zThe value of the masquerade option is "%s". The type of the option will be changed from string to boolean in a future release. To avoid unexpected behavior, please change the value to boolean.zChanged zone z6(offline operation: only on-disk configs were altered)z, )changedr   ) r   r?  paramsr   sanity_checkr   r	   stripsplitr   anyr   runr   r   	TypeErrorwarnr@   rT   rc   r   r   r'  r   r   r   rs   r   r   r  	exit_jsonjoin)r   r   r   r   r$   r   rG  rH  rI  rS  msgsr#   r=  rY   ri   rA  r   r   r  r   port_protocolport_forward_toaddrr>  modificationtransactiontransaction_msgsicmp_block_inversion_statusexpected_stateforward_statusmasquerade_statuss                                 r   mainrh  \  s	    
'
!%5!1
 e$
 u%	

 5!
 6F;
 &
 5!
 6
 U#
 6
 ED:fg
 eQ/
 &
 e$
  '!
" fe4#
$ U,WX%
( !!
G
7FB k*IMM'*Mk*ImmI&Gk*ImmI&G|,JmmI&G $$V, !ab I Y	Z  H  	I GD|,J!==)?@mmI&G}}Z(Hk*I]]8$F== D]]8$FD}}V(&--''"(--"7"="="?"E"Ec"JD- M!KLL}}^$0v}}^,-1!LM}}^4Q7%!JK,&!ST<'!LM|#".x"8L
J,gx|U^w
FF< =)>>6>T 	 	
 *#W-'
 %0OO$5!!&&d?KK]ST'&*#	t*12F*M'
 (5	'AFa&agq3(
 %0OO$5!!&&d?KKCWYfgh( '*'
 %0OO$5!!&&d?KKg}MN)!7+'
 %0OO$5!!&&d?KKxOP'	'
 %0OO$5!!&&%}g6'
 %0OO$5!!&&d?KK#]3] ,\&12L4I\(346I7T'
 %0OO$5!!&&d?KK %V,l7.C$X.0C %	 )"G,'
 %0OO$5!!&&d?KK	=QR*"'
 %0OO$5!!&&	g$We4N (5	'An&TZd((
 %0OO$5!!&& 	j '
D 9 (5	'AFW&W]g+(
 %0OO$5!!&&+	'
 %0OO$5!!&&WM-BB%'
 %0OO$5!!&&d?KK4GHLM
W$))D/:w  	tKK \^rs t	t`  	gKK \^ef g	g.  	jKK \^hi j	js6   -]? ^# _ ?^ ^ #___('_(__main__N)"
__future__r   r   r   r<  __metaclass__DOCUMENTATIONEXAMPLESansible.module_utils.basicr   )ansible.module_utils.parsing.convert_boolr   @ansible_collections.ansible.posix.plugins.module_utils.firewalldr   r	   firewall.clientr
   r   ImportErrorr   r@   rT   rc   rs   r   r   r   r   r   r   r  r'  rh  r9   rR  r   r   <module>rs     s%   A @L\`D 5 = l	):6. 6D%6$7 %6P&6, &6R&6- &6R(6, (6V(6/ (6V"6) "6JT6. T6n+6- +6\+6+ +6\,6/ ,6^4) 4n"60 "6J_;D zF {  	 		s   C CC