#NEWLINE# def __init__( self , pol , src = 'any' , dst = 'any' , sport = 'any' , dport = 'any' , proto = 'any' ) : #NEWLINE# #INDENT# self . pol_obj = pol #NEWLINE# self . proto = proto #NEWLINE# if ( sport == 'any' ) : #NEWLINE# #INDENT# self . sport = sport #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# self . sport = port . Port ( sport ) #NEWLINE# #UNINDENT# if ( dport == 'any' ) : #NEWLINE# #INDENT# self . dport = dport #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# self . dport = port . Port ( dport ) #NEWLINE# #UNINDENT# if ( src == 'any' ) : #NEWLINE# #INDENT# self . src = src #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# self . src = nacaddr . IP ( src ) #NEWLINE# #UNINDENT# except ValueError : #NEWLINE# #INDENT# raise AddressError ( ( 'bad source address: %s\n' % src ) ) #NEWLINE# #UNINDENT# #UNINDENT# if ( dst == 'any' ) : #NEWLINE# #INDENT# self . dst = dst #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# try : #NEWLINE# #INDENT# self . dst = nacaddr . IP ( dst ) #NEWLINE# #UNINDENT# except ValueError : #NEWLINE# #INDENT# raise AddressError ( ( 'bad destination address: %s\n' % dst ) ) #NEWLINE# #UNINDENT# #UNINDENT# if ( type ( self . pol_obj ) is not policy . Policy ) : #NEWLINE# #INDENT# raise BadPolicy ( 'Policy object is not valid.' ) #NEWLINE# #UNINDENT# self . matches = [ ] #NEWLINE# self . exact_matches = [ ] #NEWLINE# for ( header , terms ) in self . pol_obj . filters : #NEWLINE# #INDENT# filtername = header . target [ 0 ] . options [ 0 ] #NEWLINE# for term in terms : #NEWLINE# #INDENT# possible = [ ] #NEWLINE# logging . debug ( 'checking term: %s' , term . name ) #NEWLINE# if ( not self . _AddrInside ( self . src , term . source_address ) ) : #NEWLINE# #INDENT# logging . debug ( 'srcaddr does not match' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'srcaddr matches: %s' , self . src ) #NEWLINE# if ( not self . _AddrInside ( self . dst , term . destination_address ) ) : #NEWLINE# #INDENT# logging . debug ( 'dstaddr does not match' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'dstaddr matches: %s' , self . dst ) #NEWLINE# if ( ( self . sport != 'any' ) and term . source_port and ( not self . _PortInside ( self . sport , term . source_port ) ) ) : #NEWLINE# #INDENT# logging . debug ( 'sport does not match' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'sport matches: %s' , self . sport ) #NEWLINE# if ( ( self . dport != 'any' ) and term . destination_port and ( not self . _PortInside ( self . dport , term . destination_port ) ) ) : #NEWLINE# #INDENT# logging . debug ( 'dport does not match' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'dport matches: %s' , self . dport ) #NEWLINE# if ( ( self . proto != 'any' ) and term . protocol and ( self . proto not in term . protocol ) ) : #NEWLINE# #INDENT# logging . debug ( 'proto does not match' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'proto matches: %s' , self . proto ) #NEWLINE# if ( term . protocol_except and ( self . proto in term . protocol_except ) ) : #NEWLINE# #INDENT# logging . debug ( 'protocol excepted by term, no match.' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'proto not excepted: %s' , self . proto ) #NEWLINE# if ( not term . action ) : #NEWLINE# #INDENT# logging . debug ( 'term had no action (verbatim?), no match.' ) #NEWLINE# continue #NEWLINE# #UNINDENT# logging . debug ( 'term has an action' ) #NEWLINE# possible = self . _PossibleMatch ( term ) #NEWLINE# self . matches . append ( Match ( filtername , term . name , filtername , term . action , term . qos ) ) #NEWLINE# if possible : #NEWLINE# #INDENT# logging . debug ( 'term has options: %s, not treating as exact match' , possible ) #NEWLINE# continue #NEWLINE# #UNINDENT# if ( 'next' not in term . action ) : #NEWLINE# #INDENT# self . exact_matches . append ( Match ( filtername , term . name , [ ] , term . action , term . qos ) ) #NEWLINE# break