Admin

name	type	size	perms	modified	actions
[parent directory]
__pycache__/	dir	-	0755	2026-08-18 11:43:02
__init__.py	file	0 B	0644	2026-06-26 00:00:00	edit
config.py	file	61,328 B	0644	2026-06-26 00:00:00	edit
config_helper.py	file	16,399 B	0644	2026-06-26 00:00:00	edit
config_icmptype.py	file	13,857 B	0644	2026-06-26 00:00:00	edit
config_ipset.py	file	17,586 B	0644	2026-06-26 00:00:00	edit
config_policy.py	file	8,437 B	0644	2026-06-26 00:00:00	edit
config_service.py	file	28,448 B	0644	2026-06-26 00:00:00	edit
config_zone.py	file	44,249 B	0644	2026-06-26 00:00:00	edit
dbus.py	file	1,198 B	0644	2026-06-26 00:00:00	edit
decorators.py	file	7,673 B	0644	2026-06-26 00:00:00	edit
firewalld.py	file	104,039 B	0644	2026-06-26 00:00:00	edit
server.py	file	2,843 B	0644	2026-06-26 00:00:00	edit

editing: config.py

# SPDX-License-Identifier: GPL-2.0-or-later
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner <twoerner@redhat.com>

import os

import dbus
import dbus.service
import collections

from firewall import config
from firewall.core.base import DEFAULT_ZONE_TARGET
from firewall.core.watcher import Watcher
from firewall.core.logger import log
from firewall.server.dbus import DbusServiceObject
from firewall.server.decorators import (
    handle_exceptions,
    dbus_handle_exceptions,
    dbus_service_method,
    dbus_service_signal,
    dbus_service_method_deprecated,
    dbus_service_signal_deprecated,
    dbus_polkit_require_auth,
)
from firewall.server.config_icmptype import FirewallDConfigIcmpType
from firewall.server.config_service import FirewallDConfigService
from firewall.server.config_zone import FirewallDConfigZone
from firewall.server.config_policy import FirewallDConfigPolicy
from firewall.server.config_ipset import FirewallDConfigIPSet
from firewall.server.config_helper import FirewallDConfigHelper
from firewall.core.io.functions import check_on_disk_config
from firewall.core.io.icmptype import IcmpType
from firewall.core.io.ipset import IPSet
from firewall.core.io.helper import Helper
from firewall.core.io.direct import Direct
from firewall.dbus_utils import (
    dbus_to_python,
    dbus_introspection_prepare_properties,
    dbus_introspection_add_properties,
    dbus_introspection_add_deprecated,
)
from firewall import errors
from firewall.errors import FirewallError

############################################################################
#
# class FirewallDConfig
#
############################################################################

ConfigPropertiesTuple = collections.namedtuple(
    "ConfigPropertiesTuple",
    [
        "mode",
        "is_deprecated",
        "ignore_set",
    ],
)

CONFIG_PROPERTIES = {
    "DefaultZone": ConfigPropertiesTuple("read", False, False),
    "MinimalMark": ConfigPropertiesTuple("readwrite", True, True),
    "CleanupOnExit": ConfigPropertiesTuple("readwrite", False, False),
    "CleanupModulesOnExit": ConfigPropertiesTuple("readwrite", False, False),
    "IPv6_rpfilter": ConfigPropertiesTuple("readwrite", True, False),
    "IPv6_rpfilter2": ConfigPropertiesTuple("readwrite", False, False),
    "Lockdown": ConfigPropertiesTuple("readwrite", True, True),
    "IndividualCalls": ConfigPropertiesTuple("readwrite", False, False),
    "LogDenied": ConfigPropertiesTuple("readwrite", False, False),
    "AutomaticHelpers": ConfigPropertiesTuple("readwrite", True, True),
    "FirewallBackend": ConfigPropertiesTuple("readwrite", False, False),
    "FlushAllOnReload": ConfigPropertiesTuple("readwrite", False, False),
    "RFC3964_IPv4": ConfigPropertiesTuple("readwrite", False, False),
    "AllowZoneDrifting": ConfigPropertiesTuple("readwrite", True, True),
    "NftablesFlowtable": ConfigPropertiesTuple("readwrite", False, False),
    "NftablesCounters": ConfigPropertiesTuple("readwrite", False, False),
    "NftablesTableOwner": ConfigPropertiesTuple("readwrite", False, False),
    "StrictForwardPorts": ConfigPropertiesTuple("readwrite", False, False),
}

class FirewallDConfig(DbusServiceObject):
    """FirewallD main class"""

persistent = True
    """ Make FirewallD persistent. """
    default_polkit_auth_required = config.dbus.PK_ACTION_CONFIG
    """ Use config.dbus.PK_ACTION_INFO as a default """

@handle_exceptions
    def __init__(self, conf, *args, **kwargs):
        super(FirewallDConfig, self).__init__(*args, **kwargs)
        self.config = conf
        self.busname = args[0]
        self.path = args[1]
        self._init_vars()

dbus_introspection_prepare_properties(
            self,
            config.dbus.DBUS_INTERFACE_CONFIG,
            {prop: d.mode for prop, d in CONFIG_PROPERTIES.items()},
        )

def _start_watcher(self):
        self.watcher.add_watch_dir(config.FIREWALLD_IPSETS)
        self.watcher.add_watch_dir(config.ETC_FIREWALLD_IPSETS)
        self.watcher.add_watch_dir(config.FIREWALLD_ICMPTYPES)
        self.watcher.add_watch_dir(config.ETC_FIREWALLD_ICMPTYPES)
        self.watcher.add_watch_dir(config.FIREWALLD_HELPERS)
        self.watcher.add_watch_dir(config.ETC_FIREWALLD_HELPERS)
        self.watcher.add_watch_dir(config.FIREWALLD_SERVICES)
        self.watcher.add_watch_dir(config.ETC_FIREWALLD_SERVICES)
        self.watcher.add_watch_dir(config.FIREWALLD_ZONES)
        self.watcher.add_watch_dir(config.ETC_FIREWALLD_ZONES)
        self.watcher.add_watch_dir(config.FIREWALLD_POLICIES)
        self.watcher.add_watch_dir(config.ETC_FIREWALLD_POLICIES)
        # Add watches for combined zone directories
        if os.path.exists(config.ETC_FIREWALLD_ZONES):
            for filename in sorted(os.listdir(config.ETC_FIREWALLD_ZONES)):
                path = "%s/%s" % (config.ETC_FIREWALLD_ZONES, filename)
                if os.path.isdir(path):
                    self.watcher.add_watch_dir(path)
        self.watcher.add_watch_file(config.FIREWALLD_DIRECT)
        self.watcher.add_watch_file(config.FIREWALLD_CONF)

def _stop_watcher(self):
        self.watcher.clear_timeouts()
        for w in list(self.watcher.get_watches()):
            self.watcher.remove_watch(w)

def _destroy_watcher(self):
        if not self.watcher:
            return

self.config.remove_pre_write_hook(self._stop_watcher)
        self.config.remove_post_write_hook(self._start_watcher)
        self._stop_watcher()
        self.watcher = None

@handle_exceptions
    def _init_vars(self):
        self.ipsets = []
        self.ipset_idx = 0
        self.icmptypes = []
        self.icmptype_idx = 0
        self.services = []
        self.service_idx = 0
        self.zones = []
        self.zone_idx = 0
        self.helpers = []
        self.helper_idx = 0
        self.policy_objects = []
        self.policy_object_idx = 0

for ipset in self.config.get_ipsets():
            self._addIPSet(self.config.get_ipset(ipset))
        for icmptype in self.config.get_icmptypes():
            self._addIcmpType(self.config.get_icmptype(icmptype))
        for service in self.config.get_services():
            self._addService(self.config.get_service(service))
        for zone in self.config.get_zones():
            self._addZone(self.config.get_zone(zone))
        for helper in self.config.get_helpers():
            self._addHelper(self.config.get_helper(helper))
        for policy in self.config.get_policy_objects():
            self._addPolicy(self.config.get_policy_object(policy))

self.watcher = Watcher(self.on_disk_config_changed, 5)
        self._start_watcher()
        self.config.add_pre_write_hook(self._stop_watcher)
        self.config.add_post_write_hook(self._start_watcher)

@handle_exceptions
    def __del__(self):
        pass

@handle_exceptions
    def reload(self):
        # A reload will trigger a full check config. As such, any pending
        # watcher checks become redundant.
        self._destroy_watcher()

while len(self.ipsets) > 0:
            item = self.ipsets.pop()
            item.unregister()
            del item
        while len(self.icmptypes) > 0:
            item = self.icmptypes.pop()
            item.unregister()
            del item
        while len(self.services) > 0:
            item = self.services.pop()
            item.unregister()
            del item
        while len(self.zones) > 0:
            item = self.zones.pop()
            item.unregister()
            del item
        while len(self.helpers) > 0:
            item = self.helpers.pop()
            item.unregister()
            del item
        while len(self.policy_objects) > 0:
            item = self.policy_objects.pop()
            item.unregister()
            del item
        self._init_vars()

def on_disk_config_changed(self, name):
        if not os.path.isfile(name):
            return
        # avoid .bak files, etc.
        (_, ext) = os.path.splitext(name)
        if not ext or ext not in (".xml", ".conf"):
            return

# log/warn only once
        self._destroy_watcher()

log.info1(
            "Detected permanent (on-disk) configuration change out-of-band of firewalld!"
        )
        try:
            check_on_disk_config(self.config._fw)
            log.info1("To load the new configuration, reload firewalld:")
            log.info1("  # firewall-cmd --reload")
        except Exception as error:
            log.warning(error)
            log.warning(
                "Unfortunately, the new configuration cannot be loaded by the running firewalld. "
                "This may occur if new configuration was installed that "
                "the running firewalld does not support. Or it may occur "
                "if the configuration is invalid."
            )
            log.warning("It is suggested to check the configuration with command:")
            log.warning("  # firewall-offline-cmd --check-config")
            log.warning("If that succeeds, then please restart the firewalld service:")
            log.warning("  # systemctl restart firewalld")
            log.warning(
                "If the configuration checks fail, then the configuration must be "
                "manually fixed by editing the configuration files."
            )

@handle_exceptions
    def _addIcmpType(self, obj):
        # TODO: check for idx overflow
        config_icmptype = FirewallDConfigIcmpType(
            self,
            self.config,
            obj,
            self.icmptype_idx,
            self.busname,
            "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ICMPTYPE, self.icmptype_idx),
        )
        self.icmptypes.append(config_icmptype)
        self.icmptype_idx += 1
        self.IcmpTypeAdded(obj.name)
        return config_icmptype

@handle_exceptions
    def _updateIcmpType(self, obj):
        for icmptype in self.icmptypes:
            if (
                icmptype.obj.name == obj.name
                and icmptype.obj.path == obj.path
                and icmptype.obj.filename == obj.filename
            ):
                icmptype.obj = obj
                icmptype.Updated(obj.name)

@handle_exceptions
    def removeIcmpType(self, obj):
        index = 7  # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object)
        for zone in self.zones:
            settings = zone.getSettings()
            # if this IcmpType is used in a zone remove it from that zone first
            if obj.name in settings[index]:
                settings[index].remove(obj.name)
                zone.obj = self.config.set_zone_config(zone.obj, settings)
                zone.Updated(zone.obj.name)

for policy in self.policy_objects:
            settings = policy.getSettings()
            # if this IcmpType is used in a policy remove it from that policy first
            if "icmp_blocks" in settings and obj.name in settings["icmp_blocks"]:
                settings["icmp_blocks"].remove(obj.name)
                policy.obj = self.config.set_policy_object_config_dict(
                    policy.obj, settings
                )
                policy.Updated(policy.obj.name)

for icmptype in self.icmptypes:
            if icmptype.obj == obj:
                icmptype.Removed(obj.name)
                icmptype.unregister()
                self.icmptypes.remove(icmptype)
                del icmptype

@handle_exceptions
    def _addService(self, obj):
        # TODO: check for idx overflow
        config_service = FirewallDConfigService(
            self,
            self.config,
            obj,
            self.service_idx,
            self.busname,
            "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_SERVICE, self.service_idx),
        )
        self.services.append(config_service)
        self.service_idx += 1
        self.ServiceAdded(obj.name)
        return config_service

@handle_exceptions
    def _updateService(self, obj):
        for service in self.services:
            if (
                service.obj.name == obj.name
                and service.obj.path == obj.path
                and service.obj.filename == obj.filename
            ):
                service.obj = obj
                service.Updated(obj.name)

@handle_exceptions
    def removeService(self, obj):
        index = 5  # see IMPORT_EXPORT_STRUCTURE in class Zone(IO_Object)
        for zone in self.zones:
            settings = zone.getSettings()
            # if this Service is used in a zone remove it from that zone first
            if obj.name in settings[index]:
                settings[index].remove(obj.name)
                zone.obj = self.config.set_zone_config(zone.obj, settings)
                zone.Updated(zone.obj.name)

for policy in self.policy_objects:
            settings = policy.getSettings()
            # if this Service is used in a policy remove it from that policy first
            if "services" in settings and obj.name in settings["services"]:
                settings["services"].remove(obj.name)
                policy.obj = self.config.set_policy_object_config_dict(
                    policy.obj, settings
                )
                policy.Updated(policy.obj.name)

for service in self.services:
            if service.obj == obj:
                service.Removed(obj.name)
                service.unregister()
                self.services.remove(service)
                del service

@handle_exceptions
    def _addZone(self, obj):
        # TODO: check for idx overflow
        config_zone = FirewallDConfigZone(
            self,
            self.config,
            obj,
            self.zone_idx,
            self.busname,
            "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_ZONE, self.zone_idx),
        )
        self.zones.append(config_zone)
        self.zone_idx += 1
        self.ZoneAdded(obj.name)
        return config_zone

@handle_exceptions
    def _updateZone(self, obj):
        for zone in self.zones:
            if (
                zone.obj.name == obj.name
                and zone.obj.path == obj.path
                and zone.obj.filename == obj.filename
            ):
                zone.obj = obj
                zone.Updated(obj.name)

@handle_exceptions
    def removeZone(self, obj):
        for zone in self.zones:
            if zone.obj == obj:
                zone.Removed(obj.name)
                zone.unregister()
                self.zones.remove(zone)
                del zone

@handle_exceptions
    def _addPolicy(self, obj):
        # TODO: check for idx overflow
        config_policy = FirewallDConfigPolicy(
            self,
            self.config,
            obj,
            self.policy_object_idx,
            self.busname,
            "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_POLICY, self.policy_object_idx),
        )
        self.policy_objects.append(config_policy)
        self.policy_object_idx += 1
        self.PolicyAdded(obj.name)
        return config_policy

@handle_exceptions
    def _updatePolicy(self, obj):
        for policy in self.policy_objects:
            if (
                policy.obj.name == obj.name
                and policy.obj.path == obj.path
                and policy.obj.filename == obj.filename
            ):
                policy.obj = obj
                policy.Updated(obj.name)

@handle_exceptions
    def removePolicy(self, obj):
        for policy in self.policy_objects:
            if policy.obj == obj:
                policy.Removed(obj.name)
                policy.unregister()
                self.policy_objects.remove(policy)
                del policy

@handle_exceptions
    def _addIPSet(self, obj):
        # TODO: check for idx overflow
        config_ipset = FirewallDConfigIPSet(
            self,
            self.config,
            obj,
            self.ipset_idx,
            self.busname,
            "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_IPSET, self.ipset_idx),
        )
        self.ipsets.append(config_ipset)
        self.ipset_idx += 1
        self.IPSetAdded(obj.name)
        return config_ipset

@handle_exceptions
    def _updateIPSet(self, obj):
        for ipset in self.ipsets:
            if (
                ipset.obj.name == obj.name
                and ipset.obj.path == obj.path
                and ipset.obj.filename == obj.filename
            ):
                ipset.obj = obj
                ipset.Updated(obj.name)

@handle_exceptions
    def removeIPSet(self, obj):
        for ipset in self.ipsets:
            if ipset.obj == obj:
                ipset.Removed(obj.name)
                ipset.unregister()
                self.ipsets.remove(ipset)
                del ipset

# access check

@handle_exceptions
    def _addHelper(self, obj):
        # TODO: check for idx overflow
        config_helper = FirewallDConfigHelper(
            self,
            self.config,
            obj,
            self.helper_idx,
            self.busname,
            "%s/%d" % (config.dbus.DBUS_PATH_CONFIG_HELPER, self.helper_idx),
        )
        self.helpers.append(config_helper)
        self.helper_idx += 1
        self.HelperAdded(obj.name)
        return config_helper

@handle_exceptions
    def _updateHelper(self, obj):
        for helper in self.helpers:
            if (
                helper.obj.name == obj.name
                and helper.obj.path == obj.path
                and helper.obj.filename == obj.filename
            ):
                helper.obj = obj
                helper.Updated(obj.name)

@handle_exceptions
    def removeHelper(self, obj):
        for helper in self.helpers:
            if helper.obj == obj:
                helper.Removed(obj.name)
                helper.unregister()
                self.helpers.remove(helper)
                del helper

# access check

@dbus_handle_exceptions
    def accessCheck(self, sender):
        if self.config._fw._state == "FAILED":
            raise FirewallError(
                errors.RUNNING_BUT_FAILED,
                "Changing permanent configuration is not allowed while "
                "firewalld is in FAILED state. The permanent "
                "configuration must be fixed and then firewalld "
                "restarted. Try `firewall-offline-cmd --check-config`.",
            )

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# P R O P E R T I E S

@dbus_handle_exceptions
    def _get_property(self, prop):
        value = self.config.get_firewalld_conf().get(prop)

if prop == "DefaultZone":
            if value is None:
                value = config.FALLBACK_ZONE
            return dbus.String(value)
        elif prop == "MinimalMark":
            if value is None:
                value = config.FALLBACK_MINIMAL_MARK
            else:
                value = int(value)
            return dbus.Int32(value)
        elif prop == "CleanupOnExit":
            if value is None:
                value = "yes" if config.FALLBACK_CLEANUP_ON_EXIT else "no"
            return dbus.String(value)
        elif prop == "CleanupModulesOnExit":
            if value is None:
                value = "yes" if config.FALLBACK_CLEANUP_MODULES_ON_EXIT else "no"
            return dbus.String(value)
        elif prop == "Lockdown":
            # Deprecated and dropped.
            return dbus.String("no")
        elif prop == "IPv6_rpfilter":
            if value is None or value != "no":
                return dbus.String("yes")
            else:
                return dbus.String("no")
        elif prop == "IPv6_rpfilter2":
            value = self.config.get_firewalld_conf().get("IPv6_rpfilter")
            if value is None:
                value = config.FALLBACK_IPV6_RPFILTER
            return dbus.String(value)
        elif prop == "IndividualCalls":
            if value is None:
                value = "yes" if config.FALLBACK_INDIVIDUAL_CALLS else "no"
            return dbus.String(value)
        elif prop == "LogDenied":
            if value is None:
                value = config.FALLBACK_LOG_DENIED
            return dbus.String(value)
        elif prop == "AutomaticHelpers":
            if value is None:
                value = config.FALLBACK_AUTOMATIC_HELPERS
            return dbus.String(value)
        elif prop == "FirewallBackend":
            if value is None:
                value = config.FALLBACK_FIREWALL_BACKEND
            return dbus.String(value)
        elif prop == "FlushAllOnReload":
            if value is None:
                value = "yes" if config.FALLBACK_FLUSH_ALL_ON_RELOAD else "no"
            return dbus.String(value)
        elif prop == "RFC3964_IPv4":
            if value is None:
                value = "yes" if config.FALLBACK_RFC3964_IPV4 else "no"
            return dbus.String(value)
        elif prop == "AllowZoneDrifting":
            if value is None:
                value = "yes" if config.FALLBACK_ALLOW_ZONE_DRIFTING else "no"
            return dbus.String(value)
        elif prop == "NftablesFlowtable":
            if value is None:
                value = config.FALLBACK_NFTABLES_FLOWTABLE
            return dbus.String(value)
        elif prop == "NftablesCounters":
            if value is None:
                value = "yes" if config.FALLBACK_NFTABLES_COUNTERS else "no"
            return dbus.String(value)
        elif prop == "NftablesTableOwner":
            if value is None:
                value = "yes" if config.FALLBACK_NFTABLES_TABLE_OWNER else "no"
            return dbus.String(value)
        elif prop == "StrictForwardPorts":
            if value is None:
                value = "yes" if config.FALLBACK_STRICT_FORWARD_PORTS else "no"
            return dbus.String(value)
        else:
            raise dbus.exceptions.DBusException(
                "org.freedesktop.DBus.Error.InvalidArgs: "
                "Property '%s' does not exist" % prop
            )

@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature="ss", out_signature="v")
    @dbus_handle_exceptions
    def Get(self, interface_name, property_name, sender=None):  # pylint: disable=W0613
        # get a property
        interface_name = dbus_to_python(interface_name, str)
        property_name = dbus_to_python(property_name, str)
        log.debug1("config.Get('%s', '%s')", interface_name, property_name)

if interface_name == config.dbus.DBUS_INTERFACE_CONFIG:
            return self._get_property(property_name)
        elif interface_name in [
            config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
            config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        ]:
            raise dbus.exceptions.DBusException(
                "org.freedesktop.DBus.Error.InvalidArgs: "
                "Property '%s' does not exist" % property_name
            )
        else:
            raise dbus.exceptions.DBusException(
                "org.freedesktop.DBus.Error.UnknownInterface: "
                "Interface '%s' does not exist" % interface_name
            )

@dbus_service_method(dbus.PROPERTIES_IFACE, in_signature="s", out_signature="a{sv}")
    @dbus_handle_exceptions
    def GetAll(self, interface_name, sender=None):  # pylint: disable=W0613
        interface_name = dbus_to_python(interface_name, str)
        log.debug1("config.GetAll('%s')", interface_name)

ret = {}
        if interface_name == config.dbus.DBUS_INTERFACE_CONFIG:
            for x in CONFIG_PROPERTIES:
                ret[x] = self._get_property(x)
        elif interface_name in [
            config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
            config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        ]:
            pass
        else:
            raise dbus.exceptions.DBusException(
                "org.freedesktop.DBus.Error.UnknownInterface: "
                "Interface '%s' does not exist" % interface_name
            )

return dbus.Dictionary(ret, signature="sv")

@dbus_polkit_require_auth(config.dbus.PK_ACTION_CONFIG)
    @dbus_service_method(dbus.PROPERTIES_IFACE, in_signature="ssv")
    @dbus_handle_exceptions
    def Set(self, interface_name, property_name, new_value, sender=None):
        interface_name = dbus_to_python(interface_name, str)
        property_name = dbus_to_python(property_name, str)
        new_value = dbus_to_python(new_value)
        log.debug1(
            "config.Set('%s', '%s', '%s')", interface_name, property_name, new_value
        )
        self.accessCheck(sender)

if interface_name == config.dbus.DBUS_INTERFACE_CONFIG:
            pdata = CONFIG_PROPERTIES.get(property_name)
            if pdata is None or pdata.mode != "readwrite":
                raise dbus.exceptions.DBusException(
                    "org.freedesktop.DBus.Error.InvalidArgs: "
                    "Property '%s' does not exist" % property_name
                )
            if pdata.ignore_set:
                # deprecated fields. Ignore setting them.
                pass
            else:
                if property_name in [
                    "CleanupOnExit",
                    "CleanupModulesOnExit",
                    "IPv6_rpfilter",
                    "IndividualCalls",
                    "FlushAllOnReload",
                    "RFC3964_IPv4",
                    "NftablesCounters",
                    "NftablesTableOwner",
                    "StrictForwardPorts",
                ]:
                    if new_value.lower() not in ["yes", "no", "true", "false"]:
                        raise FirewallError(
                            errors.INVALID_VALUE,
                            "'%s' for %s" % (new_value, property_name),
                        )
                    config_name = property_name
                elif property_name == "LogDenied":
                    if new_value not in config.LOG_DENIED_VALUES:
                        raise FirewallError(
                            errors.INVALID_VALUE,
                            "'%s' for %s" % (new_value, property_name),
                        )
                    config_name = property_name
                elif property_name == "FirewallBackend":
                    if new_value not in config.FIREWALL_BACKEND_VALUES:
                        raise FirewallError(
                            errors.INVALID_VALUE,
                            "'%s' for %s" % (new_value, property_name),
                        )
                    config_name = property_name
                elif property_name == "IPv6_rpfilter2":
                    if new_value not in config.IPV6_RPFILTER_VALUES:
                        raise FirewallError(
                            errors.INVALID_VALUE,
                            "'%s' for %s" % (new_value, property_name),
                        )
                    config_name = "IPv6_rpfilter"
                else:
                    raise errors.BugError(f'Unhandled property_name "{property_name}"')

self.config.get_firewalld_conf().set(config_name, new_value)
                self.config.call_pre_write_hooks()
                self.config.get_firewalld_conf().write()
                self.config.call_post_write_hooks()
                self.PropertiesChanged(interface_name, {property_name: new_value}, [])
        elif interface_name in [
            config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
            config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        ]:
            raise dbus.exceptions.DBusException(
                "org.freedesktop.DBus.Error.InvalidArgs: "
                "Property '%s' does not exist" % property_name
            )
        else:
            raise dbus.exceptions.DBusException(
                "org.freedesktop.DBus.Error.UnknownInterface: "
                "Interface '%s' does not exist" % interface_name
            )

@dbus_service_signal(dbus.PROPERTIES_IFACE, signature="sa{sv}as")
    def PropertiesChanged(
        self, interface_name, changed_properties, invalidated_properties
    ):
        interface_name = dbus_to_python(interface_name, str)
        changed_properties = dbus_to_python(changed_properties)
        invalidated_properties = dbus_to_python(invalidated_properties)
        log.debug1(
            "config.PropertiesChanged('%s', '%s', '%s')",
            interface_name,
            changed_properties,
            invalidated_properties,
        )

@dbus_polkit_require_auth(config.dbus.PK_ACTION_INFO)
    @dbus_service_method(dbus.INTROSPECTABLE_IFACE, out_signature="s")
    @dbus_handle_exceptions
    def Introspect(self, sender=None):  # pylint: disable=W0613
        log.debug2("config.Introspect()")

data = super(FirewallDConfig, self).Introspect(
            self.path, self.busname.get_bus()
        )
        data = dbus_introspection_add_properties(
            self, data, config.dbus.DBUS_INTERFACE_CONFIG
        )

for interface in [
            config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
            config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        ]:
            data = dbus_introspection_add_deprecated(
                self,
                data,
                interface,
                dbus_service_method_deprecated.deprecated,
                dbus_service_signal_deprecated.deprecated,
            )

return data

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# policies

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        out_signature="(asasasai)",
        is_deprecated=True,
    )
    def getLockdownWhitelist(self, sender=None):  # pylint: disable=W0613
        return ([], [], [], [0])

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="(asasasai)",
        is_deprecated=True,
    )
    def setLockdownWhitelist(self, settings, sender=None):  # pylint: disable=W0613
        pass

@dbus_service_signal(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        is_deprecated=True,
    )
    def LockdownWhitelistUpdated(self):
        pass

# command

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        is_deprecated=True,
    )
    def addLockdownWhitelistCommand(self, command, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        is_deprecated=True,
    )
    def removeLockdownWhitelistCommand(self, command, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        out_signature="b",
        is_deprecated=True,
    )
    def queryLockdownWhitelistCommand(self, command, sender=None):
        return False

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        out_signature="as",
        is_deprecated=True,
    )
    def getLockdownWhitelistCommands(self, sender=None):  # pylint: disable=W0613
        return []

# context

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        is_deprecated=True,
    )
    def addLockdownWhitelistContext(self, context, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        is_deprecated=True,
    )
    def removeLockdownWhitelistContext(self, context, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        out_signature="b",
        is_deprecated=True,
    )
    def queryLockdownWhitelistContext(
        self, context, sender=None
    ):  # pylint: disable=W0613
        return False

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        out_signature="as",
        is_deprecated=True,
    )
    def getLockdownWhitelistContexts(self, sender=None):  # pylint: disable=W0613
        return []

# user

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        is_deprecated=True,
    )
    def addLockdownWhitelistUser(self, user, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        is_deprecated=True,
    )
    def removeLockdownWhitelistUser(self, user, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="s",
        out_signature="b",
        is_deprecated=True,
    )
    def queryLockdownWhitelistUser(self, user, sender=None):  # pylint: disable=W0613
        return False

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        out_signature="as",
        is_deprecated=True,
    )
    def getLockdownWhitelistUsers(self, sender=None):  # pylint: disable=W0613
        return []

# uid

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="i",
        is_deprecated=True,
    )
    def addLockdownWhitelistUid(self, uid, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="i",
        is_deprecated=True,
    )
    def removeLockdownWhitelistUid(self, uid, sender=None):
        pass

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        in_signature="i",
        out_signature="b",
        is_deprecated=True,
    )
    def queryLockdownWhitelistUid(self, uid, sender=None):  # pylint: disable=W0613
        return False

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_POLICIES,
        out_signature="ai",
        is_deprecated=True,
    )
    def getLockdownWhitelistUids(self, sender=None):  # pylint: disable=W0613
        return []

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# I P S E T S

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="ao")
    @dbus_handle_exceptions
    def listIPSets(self, sender=None):  # pylint: disable=W0613
        """list ipsets objects paths"""
        log.debug1("config.listIPSets()")
        return self.ipsets

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="as")
    @dbus_handle_exceptions
    def getIPSetNames(self, sender=None):  # pylint: disable=W0613
        """get ipset names"""
        log.debug1("config.getIPSetNames()")
        ipsets = []
        for obj in self.ipsets:
            ipsets.append(obj.obj.name)
        return sorted(ipsets)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="o"
    )
    @dbus_handle_exceptions
    def getIPSetByName(self, ipset, sender=None):  # pylint: disable=W0613
        """object path of ipset with given name"""
        ipset = dbus_to_python(ipset, str)
        log.debug1("config.getIPSetByName('%s')", ipset)
        for obj in self.ipsets:
            if obj.obj.name == ipset:
                return obj
        raise FirewallError(errors.INVALID_IPSET, ipset)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG,
        in_signature="s" + IPSet.DBUS_SIGNATURE,
        out_signature="o",
    )
    @dbus_handle_exceptions
    def addIPSet(self, ipset, settings, sender=None):
        """add ipset with given name and settings"""
        ipset = dbus_to_python(ipset, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addIPSet('%s')", ipset)
        self.accessCheck(sender)
        obj = self.config.new_ipset(ipset, settings)
        config_ipset = self._addIPSet(obj)
        return config_ipset

@dbus_service_signal(config.dbus.DBUS_INTERFACE_CONFIG, signature="s")
    @dbus_handle_exceptions
    def IPSetAdded(self, ipset):
        ipset = dbus_to_python(ipset, str)
        log.debug1("config.IPSetAdded('%s')" % (ipset))

# I C M P T Y P E S

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="ao")
    @dbus_handle_exceptions
    def listIcmpTypes(self, sender=None):  # pylint: disable=W0613
        """list icmptypes objects paths"""
        log.debug1("config.listIcmpTypes()")
        return self.icmptypes

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="as")
    @dbus_handle_exceptions
    def getIcmpTypeNames(self, sender=None):  # pylint: disable=W0613
        """get icmptype names"""
        log.debug1("config.getIcmpTypeNames()")
        icmptypes = []
        for obj in self.icmptypes:
            icmptypes.append(obj.obj.name)
        return sorted(icmptypes)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="o"
    )
    @dbus_handle_exceptions
    def getIcmpTypeByName(self, icmptype, sender=None):  # pylint: disable=W0613
        """object path of icmptype with given name"""
        icmptype = dbus_to_python(icmptype, str)
        log.debug1("config.getIcmpTypeByName('%s')", icmptype)
        for obj in self.icmptypes:
            if obj.obj.name == icmptype:
                return obj
        raise FirewallError(errors.INVALID_ICMPTYPE, icmptype)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG,
        in_signature="s" + IcmpType.DBUS_SIGNATURE,
        out_signature="o",
    )
    @dbus_handle_exceptions
    def addIcmpType(self, icmptype, settings, sender=None):
        """add icmptype with given name and settings"""
        icmptype = dbus_to_python(icmptype, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addIcmpType('%s')", icmptype)
        self.accessCheck(sender)
        obj = self.config.new_icmptype(icmptype, settings)
        config_icmptype = self._addIcmpType(obj)
        return config_icmptype

@dbus_service_signal(config.dbus.DBUS_INTERFACE_CONFIG, signature="s")
    @dbus_handle_exceptions
    def IcmpTypeAdded(self, icmptype):
        log.debug1("config.IcmpTypeAdded('%s')" % (icmptype))

# S E R V I C E S

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="ao")
    @dbus_handle_exceptions
    def listServices(self, sender=None):  # pylint: disable=W0613
        """list services objects paths"""
        log.debug1("config.listServices()")
        return self.services

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="as")
    @dbus_handle_exceptions
    def getServiceNames(self, sender=None):  # pylint: disable=W0613
        """get service names"""
        log.debug1("config.getServiceNames()")
        services = []
        for obj in self.services:
            services.append(obj.obj.name)
        return sorted(services)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="o"
    )
    @dbus_handle_exceptions
    def getServiceByName(self, service, sender=None):  # pylint: disable=W0613
        """object path of service with given name"""
        service = dbus_to_python(service, str)
        log.debug1("config.getServiceByName('%s')", service)
        for obj in self.services:
            if obj.obj.name == service:
                return obj
        raise FirewallError(errors.INVALID_SERVICE, service)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG,
        in_signature="s(sssa(ss)asa{ss}asa(ss))",
        out_signature="o",
    )
    @dbus_handle_exceptions
    def addService(self, service, settings, sender=None):
        """add service with given name and settings"""
        service = dbus_to_python(service, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addService('%s')", service)
        self.accessCheck(sender)
        obj = self.config.new_service(service, settings)
        config_service = self._addService(obj)
        return config_service

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature="o"
    )
    @dbus_handle_exceptions
    def addService2(self, service, settings, sender=None):
        """add service with given name and settings"""
        service = dbus_to_python(service, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addService2('%s')", service)
        self.accessCheck(sender)
        obj = self.config.new_service_dict(service, settings)
        config_service = self._addService(obj)
        return config_service

@dbus_service_signal(config.dbus.DBUS_INTERFACE_CONFIG, signature="s")
    @dbus_handle_exceptions
    def ServiceAdded(self, service):
        log.debug1("config.ServiceAdded('%s')" % (service))

# Z O N E S

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="ao")
    @dbus_handle_exceptions
    def listZones(self, sender=None):  # pylint: disable=W0613
        """list zones objects paths"""
        log.debug1("config.listZones()")
        return self.zones

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="as")
    @dbus_handle_exceptions
    def getZoneNames(self, sender=None):  # pylint: disable=W0613
        """get zone names"""
        log.debug1("config.getZoneNames()")
        zones = []
        for obj in self.zones:
            zones.append(obj.obj.name)
        return sorted(zones)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="o"
    )
    @dbus_handle_exceptions
    def getZoneByName(self, zone, sender=None):  # pylint: disable=W0613
        """object path of zone with given name"""
        zone = dbus_to_python(zone, str)
        log.debug1("config.getZoneByName('%s')", zone)
        for obj in self.zones:
            if obj.obj.name == zone:
                return obj
        raise FirewallError(errors.INVALID_ZONE, zone)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="s"
    )
    @dbus_handle_exceptions
    def getZoneOfInterface(self, iface, sender=None):  # pylint: disable=W0613
        """name of zone the given interface belongs to"""
        iface = dbus_to_python(iface, str)
        log.debug1("config.getZoneOfInterface('%s')", iface)
        ret = []
        for obj in self.zones:
            if iface in obj.obj.interfaces:
                ret.append(obj.obj.name)
        if len(ret) > 1:
            # Even it shouldn't happen, it's actually possible that
            # the same interface is in several zone XML files
            return " ".join(
                ret
            ) + "  (ERROR: interface '%s' is in %s zone XML files, can be only in one)" % (
                iface,
                len(ret),
            )
        return ret[0] if ret else ""

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="s"
    )
    @dbus_handle_exceptions
    def getZoneOfSource(self, source, sender=None):  # pylint: disable=W0613
        """name of zone the given source belongs to"""
        source = dbus_to_python(source, str)
        log.debug1("config.getZoneOfSource('%s')", source)
        ret = []
        for obj in self.zones:
            if source in obj.obj.sources:
                ret.append(obj.obj.name)
        if len(ret) > 1:
            # Even it shouldn't happen, it's actually possible that
            # the same source is in several zone XML files
            return " ".join(
                ret
            ) + "  (ERROR: source '%s' is in %s zone XML files, can be only in one)" % (
                source,
                len(ret),
            )
        return ret[0] if ret else ""

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG,
        in_signature="s(sssbsasa(ss)asba(ssss)asasasasa(ss)b)",
        out_signature="o",
    )
    @dbus_handle_exceptions
    def addZone(self, zone, settings, sender=None):
        """add zone with given name and settings"""
        zone = dbus_to_python(zone, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addZone('%s')", zone)
        self.accessCheck(sender)
        if settings[4] == "default":
            # convert to list, fix target, convert back to tuple
            _settings = list(settings)
            _settings[4] = DEFAULT_ZONE_TARGET
            settings = tuple(_settings)
        obj = self.config.new_zone(zone, settings)
        config_zone = self._addZone(obj)
        return config_zone

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature="o"
    )
    @dbus_handle_exceptions
    def addZone2(self, zone, settings, sender=None):
        """add zone with given name and settings"""
        zone = dbus_to_python(zone, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addZone('%s')", zone)
        self.accessCheck(sender)
        if "target" in settings and settings["target"] == "default":
            settings["target"] = DEFAULT_ZONE_TARGET
        obj = self.config.new_zone_dict(zone, settings)
        config_zone = self._addZone(obj)
        return config_zone

@dbus_service_signal(config.dbus.DBUS_INTERFACE_CONFIG, signature="s")
    @dbus_handle_exceptions
    def ZoneAdded(self, zone):
        log.debug1("config.ZoneAdded('%s')" % (zone))

# policies

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="ao")
    @dbus_handle_exceptions
    def listPolicies(self, sender=None):
        """list policies objects paths"""
        log.debug1("config.listPolicies()")
        return self.policy_objects

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="as")
    @dbus_handle_exceptions
    def getPolicyNames(self, sender=None):
        """get policy names"""
        log.debug1("config.getPolicyNames()")
        policies = []
        for obj in self.policy_objects:
            policies.append(obj.obj.name)
        return sorted(policies)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="o"
    )
    @dbus_handle_exceptions
    def getPolicyByName(self, policy, sender=None):
        """object path of policy with given name"""
        policy = dbus_to_python(policy, str)
        log.debug1("config.getPolicyByName('%s')", policy)
        for obj in self.policy_objects:
            if obj.obj.name == policy:
                return obj
        raise FirewallError(errors.INVALID_POLICY, policy)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="sa{sv}", out_signature="o"
    )
    @dbus_handle_exceptions
    def addPolicy(self, policy, settings, sender=None):
        """add policy with given name and settings"""
        policy = dbus_to_python(policy, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addPolicy('%s')", policy)
        self.accessCheck(sender)
        obj = self.config.new_policy_object_dict(policy, settings)
        config_policy = self._addPolicy(obj)
        return config_policy

@dbus_service_signal(config.dbus.DBUS_INTERFACE_CONFIG, signature="s")
    @dbus_handle_exceptions
    def PolicyAdded(self, policy):
        log.debug1("config.PolicyAdded('%s')" % (policy))

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# H E L P E R S

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="ao")
    @dbus_handle_exceptions
    def listHelpers(self, sender=None):  # pylint: disable=W0613
        """list helpers objects paths"""
        log.debug1("config.listHelpers()")
        return self.helpers

@dbus_service_method(config.dbus.DBUS_INTERFACE_CONFIG, out_signature="as")
    @dbus_handle_exceptions
    def getHelperNames(self, sender=None):  # pylint: disable=W0613
        """get helper names"""
        log.debug1("config.getHelperNames()")
        helpers = []
        for obj in self.helpers:
            helpers.append(obj.obj.name)
        return sorted(helpers)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG, in_signature="s", out_signature="o"
    )
    @dbus_handle_exceptions
    def getHelperByName(self, helper, sender=None):  # pylint: disable=W0613
        """object path of helper with given name"""
        helper = dbus_to_python(helper, str)
        log.debug1("config.getHelperByName('%s')", helper)
        for obj in self.helpers:
            if obj.obj.name == helper:
                return obj
        raise FirewallError(errors.INVALID_HELPER, helper)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG,
        in_signature="s" + Helper.DBUS_SIGNATURE,
        out_signature="o",
    )
    @dbus_handle_exceptions
    def addHelper(self, helper, settings, sender=None):
        """add helper with given name and settings"""
        helper = dbus_to_python(helper, str)
        settings = dbus_to_python(settings)
        log.debug1("config.addHelper('%s')", helper)
        self.accessCheck(sender)
        obj = self.config.new_helper(helper, settings)
        config_helper = self._addHelper(obj)
        return config_helper

@dbus_service_signal(config.dbus.DBUS_INTERFACE_CONFIG, signature="s")
    @dbus_handle_exceptions
    def HelperAdded(self, helper):
        helper = dbus_to_python(helper, str)
        log.debug1("config.HelperAdded('%s')" % (helper))

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
    # DIRECT

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        out_signature=Direct.DBUS_SIGNATURE,
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getSettings(self, sender=None):  # pylint: disable=W0613
        # returns list ipv, table, list of chains
        log.debug1("config.direct.getSettings()")
        return self.config.get_direct().export_config()

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature=Direct.DBUS_SIGNATURE,
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def update(self, settings, sender=None):  # pylint: disable=W0613
        # returns list ipv, table, list of chains
        log.debug1("config.direct.update()")
        settings = dbus_to_python(settings)
        self.config.get_direct().import_config(settings, {})
        self.config.call_pre_write_hooks()
        self.config.get_direct().write()
        self.config.call_post_write_hooks()
        self.Updated()

@dbus_service_signal(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def Updated(self):
        log.debug1("config.direct.Updated()")

# chain

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sss",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def addChain(self, ipv, table, chain, sender=None):
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        log.debug1("config.direct.addChain('%s', '%s', '%s')" % (ipv, table, chain))
        self.accessCheck(sender)
        idx = tuple((ipv, table, chain))
        settings = list(self.getSettings())
        if idx in settings[0]:
            raise FirewallError(
                errors.ALREADY_ENABLED,
                "chain '%s' already is in '%s:%s'" % (chain, ipv, table),
            )
        settings[0].append(idx)
        self.update(settings)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sss",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def removeChain(self, ipv, table, chain, sender=None):
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        log.debug1("config.direct.removeChain('%s', '%s', '%s')" % (ipv, table, chain))
        self.accessCheck(sender)
        idx = tuple((ipv, table, chain))
        settings = list(self.getSettings())
        if idx not in settings[0]:
            raise FirewallError(
                errors.NOT_ENABLED, "chain '%s' is not in '%s:%s'" % (chain, ipv, table)
            )
        settings[0].remove(idx)
        self.update(settings)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sss",
        out_signature="b",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def queryChain(self, ipv, table, chain, sender=None):  # pylint: disable=W0613
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        log.debug1("config.direct.queryChain('%s', '%s', '%s')" % (ipv, table, chain))
        idx = tuple((ipv, table, chain))
        return idx in self.getSettings()[0]

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="ss",
        out_signature="as",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getChains(self, ipv, table, sender=None):  # pylint: disable=W0613
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        log.debug1("config.direct.getChains('%s', '%s')" % (ipv, table))
        ret = []
        for idx in self.getSettings()[0]:
            if idx[0] == ipv and idx[1] == table:
                ret.append(idx[2])
        return ret

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="",
        out_signature="a(sss)",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getAllChains(self, sender=None):  # pylint: disable=W0613
        log.debug1("config.direct.getAllChains()")
        return self.getSettings()[0]

# rule

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sssias",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def addRule(
        self, ipv, table, chain, priority, args, sender=None
    ):  # pylint: disable=R0913
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        priority = dbus_to_python(priority)
        args = dbus_to_python(args)
        log.debug1(
            "config.direct.addRule('%s', '%s', '%s', %d, '%s')"
            % (ipv, table, chain, priority, "','".join(args))
        )
        self.accessCheck(sender)
        idx = (ipv, table, chain, priority, args)
        settings = list(self.getSettings())
        if idx in settings[1]:
            raise FirewallError(
                errors.ALREADY_ENABLED,
                "rule '%s' already is in '%s:%s:%s'" % (args, ipv, table, chain),
            )
        settings[1].append(idx)
        self.update(tuple(settings))

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sssias",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def removeRule(
        self, ipv, table, chain, priority, args, sender=None
    ):  # pylint: disable=R0913
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        priority = dbus_to_python(priority)
        args = dbus_to_python(args)
        log.debug1(
            "config.direct.removeRule('%s', '%s', '%s', %d, '%s')"
            % (ipv, table, chain, priority, "','".join(args))
        )
        self.accessCheck(sender)
        idx = (ipv, table, chain, priority, args)
        settings = list(self.getSettings())
        if idx not in settings[1]:
            raise FirewallError(
                errors.NOT_ENABLED,
                "rule '%s' is not in '%s:%s:%s'" % (args, ipv, table, chain),
            )
        settings[1].remove(idx)
        self.update(tuple(settings))

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sssias",
        out_signature="b",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def queryRule(
        self, ipv, table, chain, priority, args, sender=None
    ):  # pylint: disable=W0613,R0913
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        priority = dbus_to_python(priority)
        args = dbus_to_python(args)
        log.debug1(
            "config.direct.queryRule('%s', '%s', '%s', %d, '%s')"
            % (ipv, table, chain, priority, "','".join(args))
        )
        idx = (ipv, table, chain, priority, args)
        return idx in self.getSettings()[1]

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sss",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def removeRules(self, ipv, table, chain, sender=None):
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        log.debug1(
            "config.direct.removeRules('%s', '%s', '%s')"
            % (
                ipv,
                table,
                chain,
            )
        )
        self.accessCheck(sender)
        settings = list(self.getSettings())
        for rule in settings[1][:]:
            if (ipv, table, chain) == (rule[0], rule[1], rule[2]):
                settings[1].remove(rule)
        self.update(tuple(settings))

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sss",
        out_signature="a(ias)",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getRules(self, ipv, table, chain, sender=None):  # pylint: disable=W0613
        ipv = dbus_to_python(ipv)
        table = dbus_to_python(table)
        chain = dbus_to_python(chain)
        log.debug1("config.direct.getRules('%s', '%s', '%s')" % (ipv, table, chain))
        ret = []
        for idx in self.getSettings()[1]:
            if idx[0] == ipv and idx[1] == table and idx[2] == chain:
                ret.append((idx[3], idx[4]))
        return ret

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="",
        out_signature="a(sssias)",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getAllRules(self, sender=None):  # pylint: disable=W0613
        log.debug1("config.direct.getAllRules()")
        return self.getSettings()[1]

# passthrough

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sas",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def addPassthrough(self, ipv, args, sender=None):
        ipv = dbus_to_python(ipv)
        args = dbus_to_python(args)
        log.debug1("config.direct.addPassthrough('%s', '%s')" % (ipv, "','".join(args)))
        self.accessCheck(sender)
        idx = (ipv, args)
        settings = list(self.getSettings())
        if idx in settings[2]:
            raise FirewallError(
                errors.ALREADY_ENABLED, "passthrough '%s', '%s'" % (ipv, args)
            )
        settings[2].append(idx)
        self.update(settings)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sas",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def removePassthrough(self, ipv, args, sender=None):
        ipv = dbus_to_python(ipv)
        args = dbus_to_python(args)
        log.debug1(
            "config.direct.removePassthrough('%s', '%s')" % (ipv, "','".join(args))
        )
        self.accessCheck(sender)
        idx = (ipv, args)
        settings = list(self.getSettings())
        if idx not in settings[2]:
            raise FirewallError(
                errors.NOT_ENABLED, "passthrough '%s', '%s'" % (ipv, args)
            )
        settings[2].remove(idx)
        self.update(settings)

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="sas",
        out_signature="b",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def queryPassthrough(self, ipv, args, sender=None):  # pylint: disable=W0613
        ipv = dbus_to_python(ipv)
        args = dbus_to_python(args)
        log.debug1(
            "config.direct.queryPassthrough('%s', '%s')" % (ipv, "','".join(args))
        )
        idx = (ipv, args)
        return idx in self.getSettings()[2]

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        in_signature="s",
        out_signature="aas",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getPassthroughs(self, ipv, sender=None):  # pylint: disable=W0613
        ipv = dbus_to_python(ipv)
        log.debug1("config.direct.getPassthroughs('%s')" % (ipv))
        ret = []
        for idx in self.getSettings()[2]:
            if idx[0] == ipv:
                ret.append(idx[1])
        return ret

@dbus_service_method(
        config.dbus.DBUS_INTERFACE_CONFIG_DIRECT,
        out_signature="a(sas)",
        is_deprecated=True,
    )
    @dbus_handle_exceptions
    def getAllPassthroughs(self, sender=None):  # pylint: disable=W0613
        log.debug1("config.direct.getAllPassthroughs()")
        return self.getSettings()[2]

cancel