| Path : /usr/share/YaST2/modules/ |
| Current File : //usr/share/YaST2/modules/SuSEFirewall.ybc |
YaST bytecode 1.4.0 SuSEFirewall SuSEFirewall.ycp Mode Service NetworkInterfaces SuSEFirewallServices PortAliases Report Message Progress
PortRanges
PackageSystem FileUtils Directory
Stage susefirewall_package configuration_has_been_read special_all_interface_string max_port_number special_all_interface_zone SETTINGS modified
is_running DEFAULT_SETTINGS
verbose_level known_firewall_zones
zone_names int_zone_shortname supported_protocols service_defined_by allowed_conflict_services firewall_services firewall_services_reverse SuSEFirewall_variables ! one_line_per_record " broadcast_related_module # WriteOneRecordPerLine $ SetModified %
ResetModified & GetKnownFirewallZones ' IsServiceSupportedInZone ( GetSpecialInterfacesInZone ) AddSpecialInterfaceIntoZone * report_only_once + ReportOnlyOnce , IsAnyNetworkInterfaceSupported - GetListOfSuSEFirewallVariables . IncreaseVerbosity / DecreaseVerbosity 0 IsVerbose 1 GetDefaultValue 2 ReadSysconfigSuSEFirewall 3 ResetSysconfigSuSEFirewall 4 WriteSysconfigSuSEFirewall 5 IsSupportedProtocol 6 IsKnownZone 7 GetZoneConfigurationString 8 GetConfigurationStringZone 9 GetAllowedServicesForZoneProto : SetAllowedServicesForZoneProto ; GetBroadcastConfiguration < SetBroadcastConfiguration = GetBroadcastAllowedPorts > SetBroadcastAllowedPorts ? IsBroadcastAllowed @ RemoveAllowedBroadcast A AddAllowedBroadcast B RemoveServiceFromProtocolZone C RemoveAllowedPortsOrServices D AddAllowedPortsOrServices E % RemoveServiceDefinedByPackageFromZone F " AddServiceDefinedByPackageIntoZone G RemoveServiceSupportFromZone H AddServiceSupportIntoZone I check_and_install_package J SetInstallPackagesIfMissing K needed_packages_installed L SuSEFirewallIsInstalled M fw_service_can_be_configured N GetModified O
ResetReadFlag P GetZoneFullName Q SetProtectFromInternalZone R GetProtectFromInternalZone S SetSupportRoute T GetSupportRoute U SetTrustIPsecAs V GetTrustIPsecAs W GetStartService X SetStartService Y GetEnableService Z SetEnableService [
StartServices \ StopServices ] EnableServices ^ DisableServices _ IsEnabled ` IsStarted a Export b Import c IsInterfaceInZone d GetZoneOfInterface e GetZonesOfInterfaces f ' GetInterfacesInZoneSupportingAnyFeature g + GetZonesOfInterfacesWithAnyFeatureSupported h GetAllKnownInterfaces i GetAllNonDialUpInterfaces j GetAllDialUpInterfaces k GetListOfKnownInterfaces l RemoveInterfaceFromZone m AddInterfaceIntoZone n GetInterfacesInZone o GetFirewallInterfaces p InterfacesSupportedByAnyFeature q ArePortsOrServicesAllowed r HaveService s
AddService t
RemoveService u ( IsServiceDefinedByPackageSupportedInZone v GetServicesInZones w GetServices x SetServicesForZones y SetServices z ReadDefaultConfiguration { ReadCurrentConfiguration | converted_to_services_dbp_file } already_converted ~ " ConvertToServicesDefinedByPackages FillUpEmptyConfig Read AnyRPCServiceInConfiguration ActivateConfiguration WriteConfiguration CheckKernelModules WriteOnly Write SaveAndRestartService GetAdditionalServices SetAdditionalServices IsOtherFirewallRunning GetFirewallInterfacesMap RemoveSpecialInterfaceFromZone
GetMasquerade
SetMasquerade GetListOfForwardsIntoMasquerade RemoveForwardIntoMasqueradeRule AddForwardIntoMasqueradeRule GetLoggingSettings SetLoggingSettings GetIgnoreLoggingBroadcast SetIgnoreLoggingBroadcast
AddXenSupport GetAcceptExpertRules SetAcceptExpertRules GetFirewallKernelModules SetFirewallKernelModules protocol_translations GetProtocolTranslatedName GetServicesAcceptRelated SetServicesAcceptRelated RemoveOldAllowedServiceFromZone U - 2 7 $ $ % % & & ' ' service zone ( (
zone ) ) interface zone , , = = > > broadcast J J
new_status L L N N O O P P zone Q Q set_protect R R S S $ set_route T T 3 U U > zone V V X W W u X X
start_service Y Y Z Z enable_service [ [ \ \ ] ] ^ ^ _ _ / ` ` L a a h b b q import_settings c c interface zone d d interface e e
interfaces f f zone g g
interfaces h h i i $ j j 4 k k D l l U interface zone m m i interface zone n n zone o o p p zone r r service protocol interface s s service protocol interface t t [ service protocol interface v v , services w w ] services x x | services_ids firewall_zones
new_status y y services_ids
interfaces
new_status ~ ~ 2
|
#
;
protocol zone
protocol zone new_list_services
interface zone % . enable K p remove_item
source_net
forward_to_ip protocol req_port redirect_to_port requested_ip rule rule state zone zone bcast % A zone T zone expert_rules k ~ k_modules protocol zone zone ruleset 3 SCR Read Write Execute 0 base3 Mode normal installation autoinst testsuite 3 Service Status Enable Enabled Disable 3 NetworkInterfaces Read report_every_check GetValue List 3 SuSEFirewallServices OLD_SERVICES GetNeededTCPPorts ServiceDefinedByPackage ReadServicesDefinedByRPMPackages IsKnownService GetSupportedServices GetNeededUDPPorts GetNeededRPCPorts GetNeededIPProtocols GetModified GetNeededPortsAndProtocols 3 PortAliases GetListOfServiceAliases
GetPortNumber 3 Report Error 3 Message CannotWriteSettingsTo Finished 3 Progress New NextStage Finish 3
PortRanges max_port_number IsPortRange PortIsInPortranges DividePortsAndPortRanges RemovePortFromPortRanges FlattenServices 3
PackageSystem Installed CheckAndInstallPackages 3 FileUtils Exists 3 Directory vardir 3 Stage initial $"
SuSEfirewall2$( $- any$2
$7 EXT$:
$= $@ $C
FW_ALLOW_FW_BROADCAST_DMZ no FW_ALLOW_FW_BROADCAST_EXT no FW_ALLOW_FW_BROADCAST_INT no FW_ALLOW_FW_TRACEROUTE yes FW_ALLOW_PING_FW yes FW_IGNORE_FW_BROADCAST_DMZ no FW_IGNORE_FW_BROADCAST_EXT yes FW_IGNORE_FW_BROADCAST_INT no FW_IPSEC_TRUST no FW_LOG_ACCEPT_ALL no FW_LOG_ACCEPT_CRIT yes FW_LOG_DROP_ALL no FW_LOG_DROP_CRIT yes
FW_MASQUERADE no FW_PROTECT_FROM_INT no FW_ROUTE no$W $Z INT DMZ EXT$] EXT
External Zone base INT
Internal Zone base DMZ Demilitarized Zone base$g INT$j TCP UDP RPC IP$m tcp_ports udp_ports rpc_ports ip_protocols broadcast_ports$p
$s SuSEfirewall2_init SuSEfirewall2_setup$t SuSEfirewall2_setup SuSEfirewall2_init$v )
FW_DEV_INT
FW_DEV_DMZ
FW_DEV_EXT FW_SERVICES_INT_TCP FW_SERVICES_INT_UDP FW_SERVICES_INT_RPC FW_SERVICES_INT_IP FW_SERVICES_DMZ_TCP FW_SERVICES_DMZ_UDP FW_SERVICES_DMZ_RPC FW_SERVICES_DMZ_IP FW_SERVICES_EXT_TCP FW_SERVICES_EXT_UDP FW_SERVICES_EXT_RPC FW_SERVICES_EXT_IP FW_PROTECT_FROM_INT FW_ROUTE
FW_MASQUERADE FW_FORWARD_MASQ FW_FORWARD_ALWAYS_INOUT_DEV FW_ALLOW_FW_BROADCAST_EXT FW_ALLOW_FW_BROADCAST_INT FW_ALLOW_FW_BROADCAST_DMZ FW_IGNORE_FW_BROADCAST_EXT FW_IGNORE_FW_BROADCAST_INT FW_IGNORE_FW_BROADCAST_DMZ FW_SERVICES_ACCEPT_RELATED_EXT FW_SERVICES_ACCEPT_RELATED_INT FW_SERVICES_ACCEPT_RELATED_DMZ FW_LOG_DROP_CRIT FW_LOG_DROP_ALL FW_LOG_ACCEPT_CRIT FW_LOG_ACCEPT_ALL FW_IPSEC_TRUST FW_SERVICES_ACCEPT_EXT FW_SERVICES_ACCEPT_INT FW_SERVICES_ACCEPT_DMZ FW_LOAD_MODULES FW_CONFIGURATIONS_EXT FW_CONFIGURATIONS_INT FW_CONFIGURATIONS_DMZ$ ! FW_FORWARD_MASQ FW_SERVICES_ACCEPT_EXT FW_SERVICES_ACCEPT_INT FW_SERVICES_ACCEPT_DMZ$ " nf_conntrack_netbios_ns% # key_name ( && - - contains ! % $ & % % ,
y2milestone
% Reseting firewall-modified to 'false'& % & - $ * % + what_to_report ( contains * 4 - 4 & * add * - % , - contains ( % - - % . & + %
/ & - % 0 - %" 1 variable -# %+ 2 variables ,, foreach variable value $- SCR::Read add .sysconfig.SuSEfirewall2 (/ || &0 1 (4 regexpmatch
[ ]*\\[ ]*
44 rules $5 splitstring \
&6 filter one_rule && &9 mergestring (> regexpmatch
&? mergestring splitstring
(B regexpmatch &C mergestring splitstring 'E %N 3 variables ,O foreach variable 'Q 1 %] 4 variables write_status value $^ $_ ,a foreach variable &c 1 (e # 4e &f mergestring splitstring
&i
SCR::Write add .sysconfig.SuSEfirewall2 (n ! 4n ,o /etc/sysconfig/SuSEFirewall.p &t
SCR::Write .sysconfig.SuSEfirewall2(u ! 4u ,v /etc/sysconfig/SuSEFirewall -y % 5 protocol - contains % 6 zone is_zone $ , foreach
known_zone & ( 4 & . - % 7 zone ( 6 4 - tolower - % 8 zone_string ( 6 toupper 4 - toupper - % 9 zone protocol - splitstring + + + FW_SERVICES_ _ % : allowed_services zone protocol , $ ' + + + FW_SERVICES_ _ mergestring toset % ; zone - + FW_ALLOW_FW_BROADCAST_ no % < zone broadcast_configuration , $ ' + FW_ALLOW_FW_BROADCAST_ % =
allowed_ports $
, foreach zone & broadcast $ ; ( no4 ' ( yes4 ' 9 UDP4 ' splitstring ' filter not_space splitstring ,
y2debug
Allowed Broadcast Ports: %1 -
% > , $ , foreach zone & , < mergestring %' ? needed_ports zone allowed_ports_map allowed_ports_divided
is_allowed (( size 4( ,)
y2warning
% Unknown service with no needed ports!-* $. = $1
(6 && ports port_ranges 46 -7 &: $< ,> foreach needed_port (@ && ! contains ports !
port_ranges 4C &D .E -I %R @ needed_ports zone
allowed_ports list_ports_allowed ,S $ $U = $V ,Y foreach allow_this_port aliases_of_port $[ &\ filter just_allowed ! contains '` ,c > %k A needed_ports zone (m ! ? 4m
allowed_ports list_ports_allowed ,n $ $p = $q ,t foreach allow_this_port aliases_of_port $v &w filter just_allowed ! contains &{ add '} , > % B remove_service protocol zone key allowed , $ $ + + + FW_SERVICES_ _ $ splitstring & filter single_service && ' mergestring toset - % C remove_ports protocol zone check_for_aliases allowed_services already_removed allowed_services_all
( size 4 ,
y2warning
/ Undefined list of %1 services/ports for service - , $ $
9 ( 4 remove_ports_with_aliases $ , foreach remove_port remove_these_ports (
4 & add - $ ( 4 & & union & & toset $ , foreach remove_port ' ports filter allowed_port ports && ( port_ranges 4 ( !
4 remove_port_nr $ ( ! contains 4 & add ' port_ranges
port_ranges 4 ( ! contains 4 ' port_ranges filter one_port_range port_ranges & add $ union ports port_ranges &
, : % D add_ports protocol zone allowed_services ( size 4 ,
y2warning
/ Undefined list of %1 services/ports for service - , $ $ 9 & union &
, : % E service zone supported_services ( ! 6 4 - ( 4 ,
y2error
Service Id can't be nil!- ( regexpmatch ^service:.*4 & regexpsub
^service:(.*) \1 $ splitstring + FW_CONFIGURATIONS_ &" filter one_service '% + FW_CONFIGURATIONS_ mergestring ,' $ %3 F service zone supported_services (4 ! 6 44 -5 (8 48 ,9
y2error
Service Id can't be nil!-: (; regexpmatch ^service:.*4; &< regexpsub
^service:(.*) \1 $A splitstring + FW_CONFIGURATIONS_ &C toset add 'D + FW_CONFIGURATIONS_ mergestring ,F $ %P G service zone needed $Q (S 4S ,T
y2error
Undefined service '%1' -U (Y 4Y (Z ' ,[ E -] ,` $ ,c foreach key needed_ports $d (e -e (g tcp_ports4g ,h C TCP (i udp_ports4i ,j C UDP (k rpc_ports4k ,l C RPC (m ip_protocols4m ,n C IP (o broadcast_ports 4o ,p @ 4q ,r
y2error
Unknown key '%1' %~ H service zone needed $ ( 4 ,
y2error
Undefined service '%1' - , $ ( 4 , F - ( ' 4 , G , foreach key needed_ports $ ( - ( tcp_ports4 , D TCP ( udp_ports4 , D UDP ( rpc_ports4 , D RPC ( ip_protocols4 , D IP ( broadcast_ports 4 , A 4 ,
y2error
Unknown key '%1' $ I % J ( 4 ,
y2error
Wrong value: %1 - & I ( I 4 ,
y2milestone
0 SuSEfirewall2 packages will installed if missing4 ,
y2milestone
< SuSEfirewall2 packages will not be installed even if missing$ K % L ( K 4 ( && I 4 & K ,
y2milestone
CheckAndInstallPackages -> %1 K 4 & K ,
y2milestone
Installed -> %1 K ( K 4 ,
y2milestone
+ SuSEfirewall2 is not installed, skipping... - K $ M % N - || % O & % P - Unknown Zone base % Q ,
$ ( 4 ' FW_PROTECT_FROM_INT yes4 ' FW_PROTECT_FROM_INT no% R - FW_PROTECT_FROM_INT no yes%$ S ,% $ (' 4' '( FW_ROUTE yes4) '* FW_ROUTE no%3 T -4 FW_ROUTE no yes%> U ,? $ (B no4B 'C FW_IPSEC_TRUST no4D (F 6 4F &G 7 'H FW_IPSEC_TRUST 4J defaultv $K 1 FW_IPSEC_TRUST,L
y2warning
2 Trust IPsec as '%1' (unknown zone) changed to '%2' 'M FW_IPSEC_TRUST %X V (Z FW_IPSEC_TRUST no4Z -[ no(] FW_IPSEC_TRUST yes4] -^ INT4_ zone $` 8 FW_IPSEC_TRUST (b 6 4b -c 4e defaultv ,f $ $g 1 FW_IPSEC_TRUST,h
y2warning
2 Trust IPsec as '%1' (unknown zone) changed to '%2' FW_IPSEC_TRUST ,i U -j no%u W -v start_firewall % X ( ! L 4 ,
y2warning
Cannot set SetStartService- ( W 4 , $ ,
y2milestone
Setting start-firewall to %1 ' start_firewall 4 ,
y2milestone
) start-firewall has been already set to %1 ' start_firewall % Y - enable_firewall % Z ( ! L 4 ,
y2warning
Cannot set SetEnableService- ( Y 4 , $ ,
y2milestone
Setting enable-firewall to %1 ' enable_firewall 4 ,
y2milestone
* enable-firewall has been already set to %1 ' enable_firewall % [ all_ok tmpdir_file command cmd $ ( ! L - ( - $ SCR::Read .target.tmpdir( || & /var/lib/YaST2 & + /SuSEfirewall2_YaST_output$
sformat
7 /sbin/SuSEfirewall2 start 2>'%1'; cat '%1'; rm -rf '%1' ,
y2milestone
Starting firewall...$ SCR::Execute .target.bash_output ( exit 4 ,
y2error
# Starting firewall: >%1< returned %2 & 4 ,
y2milestone
Started- % \ all_ok tmpdir_file command cmd $ ( ! L - ( - $ SCR::Read .target.tmpdir( || & /var/lib/YaST2 & + /SuSEfirewall2_YaST_output$
sformat
6 /sbin/SuSEfirewall2 stop 2>'%1'; cat '%1'; rm -rf '%1' ,
y2milestone
Stopping firewall...$ SCR::Execute .target.bash_output ( exit 4 ,
y2error
# Stopping firewall: >%1< returned %2 & 4 ,
y2milestone
Stopped- % ] all_ok $ ( ! L - , foreach service ,
y2debug
Enabling service: %1 ( ! 4 & ,
sformat
Cannot enable service '%1'. base -
% ^ all_ok $ ( ! L - , foreach service ,
y2debug
Disabling service: %1 ( ! 4 & ,
sformat
Cannot disable service '%1'. base -$ %/ _ enabled $0 (2 ! L -2 ,5 foreach service &6 (8 ! 48 ,9
y2milestone
" Firewall service %1 is not enabled .: (? 4? ,@
y2milestone
! Firewall init scripts are enabled -C %L ` started $M (O ! L -O ,R foreach service (S 4S &T .U (Z 4Z ,[
y2milestone
Firewall services are started4\ ,]
y2milestone
Firewall services are stopped-` %h a -i %q b ,r $ &t % c
interfaces $ splitstring + FW_DEV_ - contains % d interface_zone $ , foreach zone & ( c & add ( && 0 size 4 ,
sformat
Interface '%1' is included in multiple firewall zones.
Continuing with configuration can produce errors.
It is recommended to leave the configuration and repair it manually in
the file '/etc/sysconfig/SuSEFirewall'. base - % e zones zone $ $ , foreach interface & d ( & add - toset % g zones zone interfaces_covered_by_any $ $ $ f , foreach interface ( contains & & d ( & add - toset % h known_interfaces dialup_interfaces non_dialup_interfaces $ $ dialup( & & filter one_iface ( || 4 ,
y2error
Wrong interface definition '%1' - - & filter interface && && ! issubstring lo ! issubstring sit$ ( & & filter one_iface ( || 4 ,
y2error
Wrong interface definition '%1' - - & filter interface && && && ! issubstring lo ! issubstring sit ! contains , foreach interface & add id type dialup name NAME zone d , foreach interface & add id name NAME zone d - %$ i non_dial_up_interfaces $% ,& foreach interface h (' type dial_up&( add id -+ %4 j dial_up_interfaces $5 ,6 foreach interface h (7 type dial_up&8 add id -; %D k
interfaces $E ,G foreach
interface_map h &H add id -K %U l interfaces_in_zone ,V $ ,X
y2milestone
' Removing interface '%1' from '%2' zone. $Z splitstring + FW_DEV_ &[ filter single_interface && '^ + FW_DEV_ mergestring %i m current_zone interfaces_in_zone ,j $ $l d ,n / )p && 4p (r 4r ,s l &u d ,w . ,y
y2milestone
% Adding interface '%1' into '%2' zone. $z splitstring + FW_DEV_ &{ toset add '| + FW_DEV_ mergestring % n interfaces_in_zone known_interfaces_now $ splitstring + FW_DEV_ $ k & filter interface && contains - % o firewall_configured_devices $ , foreach zone & & union n - toset % p result $ ( && , 4 known_interfaces_now configured_interfaces $ k $ o , foreach
one_interface ( ! contains 4 ,
y2milestone
< Interface '%1' supported by special string '%2' in zone '%3' & add - % f interfaces_in_zone interfaces_covered_by_any $ n $ p ( size 4 & union - % r zones ret ( ! 5 4 ,
y2error
Unknown protocol: %1 - $ ( any4 & & ( 6 4 & add 4 & d ( 4 & add ( && ! R contains 4 ,
y2milestone
I Checking for service '%1', in '%2', PROTECT_FROM_INTERNAL='no' => allowed - $ , foreach zone ( q 4 & . - % s success zones_affected $ ,
y2milestone
$ Adding service %1, protocol %2 to %3 ( ! 5 4 ,
y2error
Unknown protocol: %1 -! $$ (' all4' &( & 4+ (- ! 6 4- &/ d (1 41 ,3
sformat
W Interface '%1' is not assigned to any firewall zone.
Run YaST2 Firewall and assign it.
base ,7
y2warning
3 Interface '%1' is not assigned to any firewall zone -8 &; ,> $ ,A foreach zone (C ! q 4C ,D D 4E ,F
y2milestone
& Port %1 has been already allowed in %2 -J %[ t success zones_affected $\ ,]
y2milestone
( Removing service %1, protocol %2 from %3 (_ ! 5 4_ ,`
y2error
Unknown protocol: %1 -a $d (g all4g &h & 4k (l ! 6 4l &n d (p 4p ,r
sformat
W Interface '%1' is not assigned to any firewall zone.
Run YaST2 Firewall and assign it.
base ,v
y2warning
3 Interface '%1' is not assigned to any firewall zone -w &z ,} $ , foreach zone ( q 4 , C 4 ,
y2milestone
( Port %1 has been already removed from %2 - % q needed_ports protocol zone check_for_aliases are_allowed
allowed_ports $ ( size 4 ,
y2warning
/ Undefined list of %1 services/ports for service - $
( 4 &
9 4 ' ports 9 , foreach needed_port ( && ! contains ports !
port_ranges 4 & . - % u service zone supported_services ( ! 6 4 - ( 4 ,
y2error
Service Id can't be nil!- ( regexpmatch ^service:.*4 & regexpsub
^service:(.*) \1 $ splitstring + FW_CONFIGURATIONS_ - contains % ' needed service_is_supported ( ! 6 4 - $ ( 4 ,
y2error
Undefined service '%1' - ( && ! R 4 ,
y2milestone
I Checking for service '%1', in '%2', PROTECT_FROM_INTERNAL='no' => allowed - ( 4 supported $ u - $ , foreach key needed_ports $ ( - ( tcp_ports4 & q TCP (
udp_ports4
& q UDP ( rpc_ports4 &
q RPC ( ip_protocols4 & q IP ( broadcast_ports 4 & ? 4 ,
y2error
Unknown key '%1' ( . - %, v interface_in_zone services_status $.
,0 foreach interface k zone_used $2 d (4 || 44 -5 '7 add $;
,> foreach service '?
,A foreach zone
interfaces status $B ' ,D foreach interface 'E -J %] w services_status $_
,b foreach service 'c
,e foreach zone & 'f ' -j %| x (~ size &~ & , foreach
service_id , foreach
firewall_zone ( ! 6 4 ,
y2error
/ Zone '%1' is unknown firewall zone, skipping... - , $ ( 4 ,
y2milestone
Adding '%1' into '%2' zone , H 4 ,
y2milestone
Removing '%1' from '%2' zone , G % y firewall_zones $ g ( size 4 ,
y2error
2 Interfaces '%1' are not in any group if interfaces - , $ - x % z &
, 3 - % { &
' enable_firewall _ ' start_firewall ` , 2 - $ | +
) /yast2-firewall-already-converted-to-sdbp$ } % & & ' enable_firewall ' start_firewall & M %
have_progress & ( 4 ,
y2milestone
2 SuSEfirewall2 configuration has been read already.- M ( 4 ,
y2warning
/ Stage::initial -> firewall can't be configured., - ( ! L 4 ,
y2warning
A Package not installed, disabling SuSEfirewall2-related functions., - & M $ ( 4 read_caption $
# Initializing Firewall Configuration base, Check for network devices base Read current configuration base# Check possibly conflicting services base. Read dynamic definitions of installed services base Checking for network devices... base Reading current configuration... base) Checking possibly conflicting services... base4 Reading dynamic definitions of installed services... base ,% ,) (+ || 4+ make_parser_happy $/ (2 ,2 (6 46 ,7 z 49 ,: { (= ,= ,D
y2milestone
) Firewall configuration has been read: %1. &F (H ,H ,J (L ,L ,P ~ (R ,R -T %^ ret $_ ,a foreach fw_zone & fw_rule listed_services
services_list $b
sformat
FW_SERVICES_%1_RPC $c 1 (e || -e $h splitstring
&i filter service (l size 4l &m .n ,r
y2milestone
Some RPC service found: %1 -s %| (~ ! L -~ ( W 4 ( ! ` 4 ,
y2milestone
Starting firewall services- [ 4 ( || N 4 ,
y2milestone
Stopping firewall services, \ ,
y2milestone
Starting firewall services- [ 4 ,
y2milestone
; Configuration hasn't modified, skipping restarting services- 4 ( ` 4 ,
y2milestone
Stopping firewall services- \ 4 ,
y2milestone
! Firewall has been stopped already- %
have_progress
( ! L - $ ( 4
write_caption $ Writing Firewall Configuration base, Write firewall settings base Adjust firewall service base Writing firewall settings... base Adjusting firewall service... base , ( N 4 ,
y2milestone
5 Firewall configuration has been changed. Writing: %1. ( ! 4 - 4 , Writing settings failed base- 4 ,
y2milestone
/ Firewall settings weren't modified, skipping...( , ( N 4 ( enable_firewall 4 ,
y2milestone
Enabling firewall services( ! ] 4 - 4 ,
y2milestone
Disabling firewall services( ! ^ 4 - 4 ,
y2milestone
4 Firewall enable/disable wasn't modified, skipping...( , ( && } ! | 4 ,
y2milestone
Writing %1: %2 |
SCR::Write .target.string | ( , - %
-
%
,
(
! L -
(
! -
(
! -
-
%#
,$
y2milestone
Forced save and restart,%
$ ,'
X ()
! 4)
-*
--
%;
additional_services all_allowed_services all_used_services $<
(>
! 5 4>
,?
y2error
Unknown protocol '%1' -@
(B
! 6 4B
,C
y2error
Unknown zone '%1' -D
$H
9 $K
,N
foreach
service_id service_name (P
' 4P
needed_all $S
(T
TCP4T
&U
(V
UDP4V
&W
(X
RPC4X
&Y
(Z
IP4Z
&[
,]
foreach remove_port &_
union (h
size 4h
&i
toset &k
filter port ! contains -q
%
old_list_services $
toset &
toset (
4
add_services remove_services ,
$ $
$
,
foreach service (
! contains &
add ,
foreach service (
! contains &
add (
size 4
,
y2milestone
/ Removing additional services %1/%2 from zone %3 ,
C (
size 4
,
y2milestone
- Adding additional services %1/%2 into zone %3 ,
D %
any_firewall_running command iptables $
$
- iptables -L -n | grep -v "^\(Chain\|target\)"$
SCR::Execute .target.bash_output (
exit 4
iptables_list $
splitstring stdout
&
filter iptable_rule ,
y2milestone
Count of active iptables now: %1 size (
size 4
&
4
&
4
,
y2error
$ Services Command: %1 (Exit %2) -> %3 exit stderr -
(
&& ! ` 4
,
y2warning
Any other firewall is running...-
-
%
firewall_interfaces_now known_interfaces $
$
k ,
foreach zone & '
filter interface n contains -
%
( interfaces_in_zone known_interfaces_now $
splitstring + FW_DEV_ $
n &
filter interface && ! contains -
% interfaces_in_zone , $ ,
y2milestone
, Removing special string '%1' from '%2' zone. $
splitstring + FW_DEV_ & filter single_interface && ' + FW_DEV_ mergestring % ) interfaces_in_zone , $ ,
y2milestone
* Adding special string '%1' into '%2' zone. $ splitstring + FW_DEV_ & toset add ' + FW_DEV_ mergestring %% -& &&
FW_MASQUERADE no yes FW_ROUTE no yes%. ,/ $ '1
FW_MASQUERADE yes no(4 '4 FW_ROUTE yes %K
list_of_rules $L ,N foreach forward_rule splitstring FW_FORWARD_MASQ fw_rul (O -O $R splitstring ,(U || || || ,V
y2warning
5 Wrong definition of redirect rule: '%1', part of '%2' FW_FORWARD_MASQ &Z add
source_net
forward_to protocol tolower req_port tolower to_port tolower req_ip tolower -e %p
forward_rules row_counter ,q $ $s $u ,v foreach forward_rule splitstring FW_FORWARD_MASQ (w -w (y 4y &z add &} + ' FW_FORWARD_MASQ mergestring % masquerade_rules , $ $ FW_FORWARD_MASQ & + + + + + + + + , , , ( || 4 ( 4 & + + + + , , ( 4 & + + , ' FW_FORWARD_MASQ % ret_val $ ( ACCEPT4 ( FW_LOG_ACCEPT_ALL no yes4 & ALL( FW_LOG_ACCEPT_CRIT yes yes4 & CRIT4 & NONE( DROP4 ( FW_LOG_DROP_ALL no yes4 & ALL( FW_LOG_DROP_CRIT yes yes4 & CRIT4 & NONE4 ,
y2error
* Possible rules are only 'ACCEPT' or 'DROP'- % , $ ( ACCEPT4 ( ALL4 ' FW_LOG_ACCEPT_CRIT yes' FW_LOG_ACCEPT_ALL yes( CRIT4 ' FW_LOG_ACCEPT_CRIT yes' FW_LOG_ACCEPT_ALL no4 ' FW_LOG_ACCEPT_CRIT no' FW_LOG_ACCEPT_ALL no( DROP4 ( ALL4 ' FW_LOG_DROP_CRIT yes' FW_LOG_DROP_ALL yes( CRIT4 ' FW_LOG_DROP_CRIT yes' FW_LOG_DROP_ALL no4 ' FW_LOG_DROP_CRIT no' FW_LOG_DROP_ALL no4 ,
y2error
* Possible rules are only 'ACCEPT' or 'DROP'% ( ! 6 4 ,
y2error
Unknown zone '%1' - - + FW_IGNORE_FW_BROADCAST_ no % ( ! 6 4 ,
y2error
Unknown zone '%1' - , $ ' + FW_IGNORE_FW_BROADCAST_ %% ,4
y2milestone
D The whole functionality is currently handled by SuSEfirewall2 itself%A &B toupper (E ! contains & 4E ,F
y2error
Unknown firewall zone: %1 -G -J + FW_SERVICES_ACCEPT_ %T &U toupper (X ! contains & 4X ,Y
y2error
Unknown firewall zone: %1 -Z '] + FW_SERVICES_ACCEPT_ ,^ $ -` %k k_modules $l splitstring FW_LOAD_MODULES
&n filter
one_module -r toset %~ & filter
one_module ( 4 ,
y2error
6 List of modules %1 contains 'nil'! It will be ignored. - ( 4 ,
y2warning
@ List of modules %1 contains an empty string, it will be ignored. - ( || regexpmatch regexpmatch 4 ,
y2warning
\ Additional module '%1' contains spaces. They will be evaluated as two or more modules later. - ' FW_LOAD_MODULES mergestring , $ $ tcp TCP base udp UDP base _rpc_ RPC base ip IP base% & tolower ( 4 - ( 4 ,
y2error
Unknown protocol: %1 -
sformat
Unknown protocol (%1) base 4 - % ( ! 6 4 ,
y2error
Uknown zone '%1' - - splitstring + FW_SERVICES_ACCEPT_RELATED_
% ( ! 6 4 ,
y2error
Uknown zone '%1' - & filter one_rule , $ ' + FW_SERVICES_ACCEPT_RELATED_ mergestring
% needs_additional_module $ , foreach one_zone & ( size 4 ,
y2milestone
& Some ServicesAcceptRelated are defined& . ( 4 k_modules $ splitstring FW_LOAD_MODULES ( ! contains " 4 ,
y2warning
* FW_LOAD_MODULES doesn't contain %1, adding " & add " ' FW_LOAD_MODULES mergestring , $ %
old_service_def zone ,
y2milestone
Removing: %1 from zone %2 (
tcp_ports 4
,
foreach one_service tcp_ports ,
t TCP (
udp_ports 4
,
foreach one_service udp_ports ,
t UDP (
rpc_ports 4
,
foreach one_service rpc_ports ,
t RPC (
ip_protocols 4
,
foreach one_service ip_protocols ,
t IP ("
broadcast_ports 4"
broadcast $#
= '%
filter one_port ! contains broadcast_ports ,)
> %2
~ current_conf (3
} 43
-4
(7
| 47
,8
y2milestone
( Configuration has been already converted&9
} -:
$>
,@
foreach zone & 'A
,C
foreach protocol 'D
9 'E
broadcast splitstring ;
,I
y2milestone
Current conf: %1 ,K
foreach zone & ,L
foreach old_service_id old_service_def replaced
,M
y2milestone
Checking %1 in %2 zone (O
&& tcp_ports q tcp_ports TCP -P
(R
&& udp_ports q udp_ports UDP -S
(U
&& rpc_ports q rpc_ports RPC -V
(X
&& ip_protocols q ip_protocols IP -Y
([
&& broadcast_ports ? broadcast_ports -\
(^
convert_to 4^
,_
y2milestone
9 Service %1 supported, but it doesn't have any replacement -`
$c
,e
foreach replacement
convert_to (f
4f
,g
y2milestone
Old service %1 matches %2 ,h
,i
x &j
.k
(o
! 4o
,p
y2warning
0 Old service %1 matches %2 but none are installed
convert_to ,u
y2milestone
Converting done&v
}