| Dir : /lib/python3.6/site-packages/firewall/core/__pycache__/ |
| Server: Linux premium155.web-hosting.com 4.18.0-553.89.1.lve.el8.x86_64 #1 SMP Wed Dec 10 13:58:50 UTC 2025 x86_64 IP: 162.0.235.198 |
| Dir : //lib/python3.6/site-packages/firewall/core/__pycache__/ipXtables.cpython-36.pyc |
3
Y�j%� � @ s< d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZmZmZmZmZmZ d dlmZmZm Z m Z m Z m Z m Z d dl!m"Z"m#Z# d dl$Z$d Z%d
d d gd
d gd
dd
d d gd
dd gd
d d gd�Z&ddd�Z'ddd�Z(dd� Z)dd� Z*dd� Z+G dd � d e,�Z-G d d � d e-�Z.dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address�
check_address� normalizeIP6)�config)�
FirewallError�INVALID_PASSTHROUGH� INVALID_RULE�
UNKNOWN_ERROR� INVALID_ADDR�INVALID_ICMPTYPE)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)�
ICMP_TYPES� ICMPV6_TYPES� �INPUT�OUTPUT�FORWARD�
PREROUTING� POSTROUTING)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited)�ipv4�ipv6�icmpz ipv6-icmpc C s� ddddddd�}| dd� }x~|D ]v}y|j |�}W n tk
rL w$Y nX |d
kr�yt||d � W n tk
r~ Y nX |j|d � || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insert� )r* r+ )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� r6 � /usr/lib/python3.6/ipXtables.py�common_reverse_rule; s(
r8 c C s� ddddddd�}| dd� }x�|D ]x}y|j |�}W n tk
rL w$Y nX |d kr�yt||d � W n tk
r~ Y nX |j|d � || ||< |S W ttd
��dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insertr, zno '-A', '-I' or '-N' arg)r9 r: )r- �
ValueErrorr/ r0 r
r )r1 r2 r3 �xr5 r6 r6 r7 �common_reverse_passthrough` s,
r= c C s� t | �} t ddddddddd d
d d d
dddddddg�}t| |@ �dkrbttdt| |@ �d ��t dddddd g�}t| |@ �dkr�ttd ��d S ) zZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)�set�lenr
r �list)r1 Z not_allowedZneededr6 r6 r7 �common_check_passthrough� s*
rA c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdjd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdkd,d-�Zd.d/� Zdld1d2�Z d3d4� Z d5d6� Z dmd8d9�Z dnd:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dodRdS�Z,dpdTdU�Z-dqdVdW�Z.dXdY� Z/drdZd[�Z0dsd\d]�Z1dtd^d_�Z2d`da� Z3dudbdc�Z4ddde� Z5dfdg� Z6dhdi� Z7d!S )v� ip4tablesr' Tc C sd || _ tj| j | _tjd| j | _| j� | _| j� | _ | j
� g | _ i | _ i | _
g | _i | _d S )Nz
%s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�
our_chains)�self�fwr6 r6 r7 �__init__� s
zip4tables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsrE Zcommand_existsrF Zrestore_command_exists)rQ r6 r6 r7 rK � s zip4tables.fill_existsc C s� | j r(| j |kr(| j gdd� |D � }ndd� |D �}tjd| j| jdj|�� t| j|�\}}|dkr�td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr6 )�.0�itemr6 r6 r7 �
<listcomp>� s z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS )z%sr6 )rW rX r6 r6 r7 rY � s z %s: %s %s� r z'%s %s' failed: %s)rH r �debug2� __class__rE �joinr r; )rQ r1 Z_args�status�retr6 r6 r7 Z__run� s zip4tables.__runc
C s< y|j |�}W n tk
r" dS X ||||d �< dS d S )NF� T)r- r; )rQ �rule�patternZ replacement�ir6 r6 r7 �
_rule_replace� s zip4tables._rule_replacec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)rQ rD �table�chainr6 r6 r7 �is_chain_builtin� s zip4tables.is_chain_builtinc C s2 d|g}|r|j d� n
|j d� |j |� |gS )Nz-tz-Nz-X)�append)rQ �addrf rg ra r6 r6 r7 �build_chain_rules� s
zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)�str)rQ rj rf rg r- r1 ra r6 r6 r7 �
build_rule� s zip4tables.build_rulec C s t |�S )N)r8 )rQ r1 r6 r6 r7 � reverse_rule� s zip4tables.reverse_rulec C s t |� d S )N)rA )rQ r1 r6 r6 r7 �check_passthrough� s zip4tables.check_passthroughc C s t |�S )N)r= )rQ r1 r6 r6 r7 �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}y|j d�}W n tk
r& Y n X t|�|d krD||d }d }xLd
D ]D}y|j |�}W n tk
rt Y qNX t|�|d krN||d }qNW ||fS ) Nr& z-tr` �-A�--append�-I�--insert�-N� --new-chain)rq rr rs rt ru rv )r- r; r? )rQ r1 rf rc rg �optr6 r6 r7 � passthrough_parse_table_chain� s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d�}|j|� |j|�}d|d kr:||d f}n ||d f}W nF tk
r� y |j d�}|j|� d }W n tk
r� d S X Y nX d}|d dkr�d }|r�| r�||kr�|j|� nn|�r0|� r�||kr�|j|� |jd d
� d� |j |�}n| jj�r d}nt|�}d|d< |j dd|d � d S )Nz%%ZONE_SOURCE%%z-m� � � z%%ZONE_INTERFACE%%Tr �-D�--deleteFc S s | d S )Nr r6 )r< r6 r6 r7 �<lambda>( s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyz-Ir, z%dr` )r| r} )
r- r0 r; �removeri �sortrC �_allow_zone_driftingr? �insert)rQ ra rO rc �zoneZ zone_source�rule_addr- r6 r6 r7 �_run_replace_zone_source s>
z"ip4tables._run_replace_zone_sourcec C s y|j |�}W n tk
r$ Y �n�X d}d}d}|j|� |j|�}t|�tkr\ttd��d} xLdD ]D}
y|j |
�} W n tk
r� Y qfX t|�| d krf|| d } qfW xhdD ]`}
y|j |
�}W n tk
r� Y q�X t|�|d k� r�||d } |
dk�rd}|
dkr�d}q�W | | f} |�sp| |k�sP||| k�sP|| | dk�rZttd��|| | d8 < n�| |k�r�i || < ||| k�r�d|| |< d}
xHt || j
� �D ]4}||k�r�|�r�P |
|| | 7 }
||k�r�P �q�W || | d7 < d
||< |j |d d|
� dS )a
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
TFr` z%priority must be followed by a numberr& �-t�--table�-A�--append�-I�--insert�-D�--deleter z*nonexistent or underflow of priority countr, z%dN���)r� r� )r� r� r� r� r� r� )r� r� )r� r� ) r- r; r0 �typer/ r
r r? r �sorted�keysr� )rQ ra Zpriority_counts�tokenrc r� r� Zinsert_add_index�priorityrf rw �jrg r- �pr6 r6 r7 �_set_rule_replace_priority4 sj
z$ip4tables._set_rule_replace_priorityc C sP t � }i }tj| j�}tj| j�}tj| j�}�x�|D �]�}|d d � } | j| dddt| j g� | j| dt | j g� y| j
d�}
W n t k
r� Y n8X |dkr�q6|d$kr�d
d d |g| |
|
d
�< n
| j |
� | j
| |d� | j
| |d� | j| |� d} xZd%D ]R} y| j
| �}
W n t k
�r, Y n(X t| �|
d
k�r| j |
� | j |
�} �qW xhtt| ��D ]X}
xPtjD ]F}
|
| |
k�rt| |
jd��o�| |
jd� �rtd| |
| |
< �qtW �qhW |j| g �j| � q6W xR|D ]J} || }|jd| � x"|D ]} |jdj| �d � �q W |jd� �q�W |j� tj|j �}t j d| j | j d|j |j!f � g }| j"�rz|j| j"� |jd� t#| j ||j d �\}}t j$� d k�r
t%|j �}|d k �r
d
}
xH|D ]@}t j&d |
|f d
d d � |jd��s�t j&d!d
d"� |
d
7 }
�q�W tj'|j � |d k�r:t d#| j dj|�|f ��|| _|| _|| _d S )&Nz
%%REJECT%%�REJECTz
--reject-withz%%ICMP%%z %%LOGTYPE%%�off�unicast� broadcast� multicastz-m�pkttypez
--pkt-typer` z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r& �-t�--table�"z"%s"z*%s
rZ �
zCOMMIT
z %s: %s %sz%s: %dz-n)�stdinr, z%8d: %sr )�nofmt�nlr )r� z'%s %s' failed: %s)r� r� r� )r� r� )(r �copy�deepcopyrM rN rO rd �DEFAULT_REJECT_TYPErD �ICMPr- r; r0 r� r� r? �range�stringZ
whitespace�
startswith�endswith�
setdefaultri �writer] �closerT �stat�namer r[ r\ rF �st_sizerJ r ZgetDebugLogLevelr Zdebug3�unlink)rQ �rules�
log_denied� temp_fileZ table_rulesrM rN rO Z_rulera rc rf rw �cr� r1 r^ r_ �lines�liner6 r6 r7 � set_rules� s�
zip4tables.set_rulesc
C s� | j |dddt| j g� | j |dt| j g� y|jd�}W n tk
rR Y n:X |dkr`dS |dkr�d d d
|g|||d �< n
|j|� tj| j �}tj| j
�}tj| j �}| j ||d� | j ||d� | j
||� | j|�}|| _ || _
|| _ |S )Nz
%%REJECT%%r� z
--reject-withz%%ICMP%%z %%LOGTYPE%%r� r r� r� r� z-mr� z
--pkt-typer` z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r� r� r� )rd r� rD r� r- r; r0 r� r� rM rN rO r� r� �_ip4tables__run)rQ ra r� rc rM rN rO �outputr6 r6 r7 �set_rule� s.
zip4tables.set_ruleNc C s� g }|r|gnt j� }xx|D ]p}|| jkr6|j|� q y,| jd|ddg� | jj|� |j|� W q tk
r� tjd| j|f � Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) re r� rL ri r� r; r Zdebug1rD )rQ rf r_ Ztablesr6 r6 r7 �get_available_tables s
z ip4tables.get_available_tablesc C s` d}t | jdddg�}|d dkr\d}t | jdddg�}|d dkrHd}tjd| j| j|� |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rE r r[ r\ )rQ rH r_ r6 r6 r7 rG s z ip4tables._detect_wait_optionc C s� t � }|jd� |j� d}xJd D ]B}t| j|g|jd�}|d dkr"d|d kr"d |d kr"|}P q"W tjd
| j| j|� t j
|j� |S ) Nz#foor �-w�--wait=2)r� r zinvalid optionr` zunrecognized optionz %s: %s will be using %s option.)r� r� ) r r� r� r rF r� r r[ r\ rT r� )rQ r� rH Z test_optionr_ r6 r6 r7 rI $ s
z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj� D ].}| j|�s0q x dD ]}|jd||g� q6W q W |S )N�-F�-X�-Zz-t)r� r� r� )rM rN rO re r� r� ri )rQ r� rf �flagr6 r6 r7 �build_flush_rules7 s
zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j� D ]@}| j|�s.q |dkr8q x$t | D ]}|jd|d||g� qBW q W |S )NZPANIC�DROPr% z-tz-P)re r� r� ri )rQ �policyr� �_policyrf rg r6 r6 r7 �build_set_policy_rulesF s
z ip4tables.build_set_policy_rulesc C sN t � }|d ks| jdkr&|jtj� � |d ks8| jdkrF|jtj� � t|�S )Nr' r( )r> rD �updater r� r r@ )rQ rD Z supportedr6 r6 r7 �supported_icmp_typesR s z ip4tables.supported_icmp_typesc C s g S )Nr6 )rQ r6 r6 r7 �build_default_tables\ s z ip4tables.build_default_tablesr� c C s i }| j d�rpg |d< t� | jd< xLtd D ]@}|d jd| � |d jd||f � | jd jd| � q,W | j d��r\g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dkr�xt| jjr�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �qW q�W | j d��rNg |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dk�r�xv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �q�W | j d��r@g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |d9k�rxxv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �qxW g |d< t� | jd< |d jd� |d jd� |d jd� |d jd� | jd jtd�� xf| jj�r�ddd d
gndd d
gD ]B}|d jd| � |d jd| � | jd jtd| �� �q�W |dk�r |d jd� |d jd � |dk�rF|d jd � |d jd � |d jd � |d jd � |d jd!� |d jd"� | jd jtd#�� xJd:D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �q�W xzd;D ]r}xj| jj�r
dd gnd gD ]N}|d jd)||f � |d jd*||f � | jd jtd+||f �� �qW �q�W xJd<D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �qnW |dk�r�|d jd,� |d jd-� |dk�r�|d jd.� |d jd/� |d d0d1d2d3g7 < | jd jtd4�� xJd=D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q2W xJd>D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q~W g }xJ|D ]B}|| j � k�r�q�x(|| D ] }|jd8|gt |� � �q�W �q�W |S )?Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr$ r% r! r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz
-N FORWARD_%sz-A FORWARD -j FORWARD_%sz
FORWARD_%s�IN�OUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz
FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r! )r� )r� r� )r� )r� )r� )
r� r> rP re ri rj rC r� r� r ) rQ r� Z
default_rulesrg Zdispatch_suffix� directionZfinal_default_rulesrf ra r6 r6 r7 �build_default_rules` s�
$(
&*
&* &
(
"z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j � kr,dhS |dkrHd| j � krHddhS |d krbd | j � krbdhS i S )
Nr& r �
FORWARD_IN� FORWARD_OUTr$ r r% r! r# )r� )rQ rf r6 r6 r7 �get_zone_table_chains� s
z ip4tables.get_zone_table_chainsc s� | j jj|���jdk r dnd��dkr4�dkr4dnd} | j jj|�t| �� g }
g } x|D ]} |
jd| g� qZW x|D ]} | jd | g� qvW xB|D ]:}
| j jj|
�}|dkr�| j |� r�q�|
j| j
d |
�� q�W x\|D ]T}
| j jj|
�}|dk�r| j |� �rq�t |
��r�dk�rq�| j| j
d|
�� q�W � �����fdd�}g }|
�r�x�|
D ]F}| �r�x8| D ]}|j|||�� �qdW n|�r�n|j||d �� �qTW nH|�r�n@| �r�x8| D ]}|j|d |�� �q�W n|�r�n|j|d d �� |S )Nr �pre�postr% r! TFz-iz-or' r( z-sr� r z-dc sV ddd�� }d�|d��f d�j g}| r6|j| � |rD|j|� |jd� g� |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r� �extend)�ingress_fragment�egress_fragment�add_delra )r� rg � chain_suffix�enable�p_objrf r6 r7 � _generate_policy_dispatch_rule s
zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)r' r( )r' r( )r! r� r ) rC r� Z
get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXri r� Z check_source�is_ipv_supported�_rule_addr_fragmentr )rQ r� r� rf rg Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrD r� r� r� r� r6 )r� rg r� r� r� rf r7 �!build_policy_ingress_egress_rules� sR
z+ip4tables.build_policy_ingress_egress_rulesFc
C s� |dkr|dkrdnd}| j jj||t|d�} ddddddd�| }
d } |rb| rbd
d | d g} n,|rtd
d | g} ndd | g} |s�| d g7 } | d||
|| | g7 } | gS )Nr% r! TF)r� z-iz-o)r r! r r� r� r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)rC r� r� r� )
rQ r� r� r� r� rf rg ri r� r� rw �actionra r6 r6 r7 �!build_zone_source_interface_rules6 s&
z+ip4tables.build_zone_source_interface_rulesc C s� |j d�rP|dd � }|dkr$d}nd}dj|g| jjj|� �}ddd ||gS t|�rz|dkrjttd
��dd d |j� gS t d
|�r�t
|�}n,t d
|�r�|j d�}t
|d �d |d }||gS d S )Nzipset:� z-d�dst�src�,z-mr> z --match-setz Can't match a destination MAC.�macz --mac-sourcer( �/r r` )
r� r] rC �ipsetZ
get_dimensionr r
r �upperr r r
�split)rQ rw �address�invertr� �flags�
addr_splitr6 r6 r7 r� P s"
z ip4tables._rule_addr_fragmentc
C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d
d d d
d
d �| }
| j jrdd | } nd
| } t|�r�|dkr�g S || d|d|g} | j| j|
|�� | jd| g� | gS )Nz-Iz-D)TFr% r! TF)r� z-sz-d)r r! r r� r� r z%s_ZONES_SOURCEz%s_ZONESr� r z%%ZONE_SOURCE%%z-tz-g)r! r� r )rC r� r� r� r� r r� r� )
rQ r� r� r� r� rf rg r� r� r� rw Zzone_dispatch_chainra r6 r6 r7 � build_zone_source_address_rulesf s&
z)ip4tables.build_zone_source_address_rulesc C s> ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d
�}| j| jt|d | d | d
| d| d| g�� g } | j||d|g� | j|d
| d|g� | j|d | d|g� | j|d | d|g� | j|d| d|g� | j|d| d|g� | j||d|dd
| g� | j||d|dd | g� | j||d|dd | g� | j||d|dd| g� | j||d|dd| g� | j jj| j }
| j j
� dk�r|dk�r|
d k�r�| j||d|ddddd| g � |
dk�r| j||d|ddddd| g � |dk�r,|
d k�r,| j||d|d|
g� |�s:| j � | S ) Nz-Nz-X)TFz-Az-Dr% r! TF)r� z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr� r& r� �
%%REJECT%%z %%LOGTYPE%%�LOGz --log-prefixz
"%s_REJECT: "r� z "%s_DROP: "�ACCEPT)r� r� )r� r� r� r� ) rC r� r� r� rP r� r> ri Z _policies�target�get_log_denied�reverse) rQ r� r� rf rg Z
add_del_chainZ add_del_ruler� r� r� r� r6 r6 r7 �build_policy_chain_rules� sN
z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-m�limitz--limitz
--limit-burst)�valueZburst)rQ r� �sr6 r6 r7 � _rule_limit� s
zip4tables._rule_limitc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r �allowZdenyr� r� )
r� �elementr r r r� r r r r r
r r� )rQ � rich_ruler6 r6 r7 �_rich_rule_chain_suffix� s
z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr
r r� )rQ r r6 r6 r7 � _rich_rule_chain_suffix_from_log� s
z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r� )rQ r r6 r6 r7 � _rich_rule_priority_fragment� s
z&ip4tables._rich_rule_priority_fragmentc
C s� |j s
g S | jjj||t�}ddd�| }| j|�}d||d||f g} | | j|�7 } | |ddg 7 } |j jr�| dd |j j g7 } |j jr�| d
d |j j g7 } | | j |j j
�7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr� z --log-prefixz'%s'z --log-levelz%s) r rC r� r� r� r r �prefix�levelr r� )
rQ r� r r� rf �
rule_fragmentr� r� r� ra r6 r6 r7 �_rich_rule_log� s
zip4tables._rich_rule_logc C s� |j s
g S ddd�| }| jjj||t�}| j|�}d||d||f g} | | j|�7 } | |7 } t|j�t krrd}
n,t|j�t
kr�d}
nt|j�t kr�d}
nd }
| d
d d |
g7 } | | j |j j
�7 } | S )
Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdrop�unknownz-jZAUDITz--type)r rC r� r� r� r r r� r� r r r r r� ) rQ r� r r� rf r r� r� r� ra �_typer6 r6 r7 �_rich_rule_audit� s$
zip4tables._rich_rule_auditc C s2 |j s
g S ddd�| }| jjj||t�}| j|�}d||f } t|j �tkrXddg}
n�t|j �tkr�ddg}
|j jr�|
d|j jg7 }
nnt|j �t kr�dd g}
nVt|j �t
kr�d
}| jjj||t�}d||f } dd d |j j g}
nt t
d
t|j � ��d||| g} | | j|�7 } | ||
7 } | | j|j j�7 } | S )Nz-Az-D)TFz%s_%sz-jr� r� z
--reject-withr� r$ �MARKz --set-xmarkzUnknown action %sz-t)r� rC r� r� r� r r� r r r r r> r
r r r r� ) rQ r� r r� rf r r� r� r� rg Z rule_actionra r6 r6 r7 �_rich_rule_action s4
zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }q�td|j �r||j jd�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|jd� | jj j
|jd �}|d
|j|g7 }|S ) N�!r( z-dr� r r` z-mr> r� z --match-set) r� r� ri r r r
r� r� rC r� �_ipset_match_flags)rQ Z rich_destr r� r� r6 r6 r7 � _rich_rule_destination_fragment1 s&
"
z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }nHtd|j �r||j jd�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|jd� |d |jg7 }nPt|d
�o�|j �r|dd g7 }|jr�|jd� | j
j j |j d �}|d
|j |g7 }|S )Nr r( z-sr� r r` r� z-mz --mac-sourcer� r> r� z --match-set)
r� r� ri r r r
r� �hasattrr� r� rC r� r )rQ Z rich_sourcer r� r� r6 r6 r7 �_rich_rule_source_fragmentI s0
"
z$ip4tables._rich_rule_source_fragmentc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr& z-pz--dportz%sz-dz-m� conntrackz --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )rC r� r� r� r r � destinationr �sourcer� r� r ri r
r r ) rQ r� r� �proto�portr r r� rf r� r r� r6 r6 r7 �build_policy_ports_rulesf s* z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j jj||t�}d|g} |r<| d|g7 } |r`| | j|j�7 } | | j|j�7 } | stt|j �t
kr�| ddd d
g7 } g }
|r�|
j | j ||||| �� |
j | j
||||| �� |
j | j||||| �� n"|
j |d | d |g| d
dg � |
S )Nz-Az-D)TFr& z-pz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )rC r� r� r� r r r r r� r� r ri r
r r ) rQ r� r� �protocolr r r� rf r� r r� r6 r6 r7 �build_policy_protocol_rules� s& z%ip4tables.build_policy_protocol_rulesc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr& z-pz--sportz%sz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )rC r� r� r� r r r r r r� r� r ri r
r r ) rQ r� r� r r r r r� rf r� r r� r6 r6 r7 � build_policy_source_ports_rules� s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t�} ddd�| }
|
d| ddd|g} |rP| dd t|� g7 } |r`| d
|g7 } | d d d
|g7 } | gS )Nr# z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)rC r� r� r� r ) rQ r� r� r r r Z helper_nameZmodule_short_namerf r� r� ra r6 r6 r7 � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc
C s� ddd�| }| j jj||t�}g } |rH| jdd|d| d|dd g� n6t|�rTg S | jdd|d| g| jd
|� dd g � | S ) Nz-Az-D)TFz-tr& z%s_allowz-oz-jr� z-d)rC r� r� r� ri r r� )
rQ r� r� r� rf r� r r� r� r� r6 r6 r7 �build_zone_forward_rules� s z"ip4tables.build_zone_forward_rulesc
C s, d}| j jj||tdd�}ddd�| }g }|rj| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}g } | j
dd|d ||f g| d
d d d
dg � g }|r�| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}d}| j jj||t�}| j
dd|d ||f g| ddddd
dg � | S )Nr% T)r� z-Az-D)TFr z-tz%s_%sr z-o�loz-jZ
MASQUERADEr& z-mr z --ctstatez
NEW,UNTRACKEDr� ) rC r� r� r� r r r r r r ri )
rQ r� r� r rf r� r� r r� r� r6 r6 r7 � build_policy_masquerade_rules� s6
z'ip4tables.build_policy_masquerade_rulesc
C s
d}| j jj||t�} ddd�| }
d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| j|�}
| j|�} | | j |j
�7 } | | j |j �7 } nd
}
g }|r�|j
| j|||d| �� |j
d d|
d | |
f g| d
|dt|�ddd| g � |S )Nr% z-Az-D)TFr r( z[%s]z:%s�-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)rC r� r� r� r r r r r r r r r ri r
)rQ r� r� r r ZtoportZtoaddrr rf r� r� Ztor r� r� r6 r6 r7 � build_policy_forward_port_rules� s2
z)ip4tables.build_policy_forward_port_rulesc C s� | j dkrL|tkrLt| \}}}|r,t|�nt|�d t|� }ddd|gS | j dkr�|tkr�t| \}}}|rxt|�nt|�d t|� }ddd|gS ttd |� d
| j� ���d S ) Nr' r� z-mr) z --icmp-typer( Zicmp6z
--icmpv6-typez
ICMP type z not supported by )rD r rl r r
r r� )rQ Z icmp_typer �_codeZ
_omit_codeZ _type_strr6 r6 r7 �_icmp_types_fragment s z ip4tables._icmp_types_fragmentc C s� d}| j jj||t�}ddd�| }| jdkrDddg}| j|j�} nddg}| j|j�} g }
| j jj|�rxd | } d
} n d | } d } g }
|r�|
| j|j �7 }
|
| j
|j �7 }
|
|| 7 }
|�rL|
j | j
|||||
�� |
j | j|||||
�� |j�r|
j | j|||||
�� n:| j|�}|
j d
||d||f g| j|� |
dd g � n`| j j� dk�r�| d
k�r�|
j || d
|g|
ddddd| g � |
j || d
|g|
d| g � |
S )Nr& z-Az-D)TFr' z-pr) z ipv6-icmpz%s_allowr� z%s_denyz
%%REJECT%%z-tz%s_%sz-jr� z %%LOGTYPE%%r� z --log-prefixz"%s_ICMP_BLOCK: ")rC r� r� r� rD r( r� �query_icmp_block_inversionr r r r ri r
r r� r r r r� )rQ r� r� Zictr rf r� r� r �matchr� Z final_chainZ final_targetr r� r6 r6 r7 � build_policy_icmp_block_rules, sJ
z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }d}| j jj|�r�d}| j j� dkr�|rRd|t|�g}nd|g}|d|dd d
d d d
d| g }|j|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|j|� |S )Nr& r� z
%%REJECT%%r� z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr� z --log-prefixz"%s_ICMP_BLOCK: "r` r� )rC r� r� r� r) r� rl ri ) rQ r� r� rf r� r� Zrule_idxZ
ibi_targetra r6 r6 r7 �'build_policy_icmp_block_inversion_rules] s.
z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j�7 }|| j|j�7 }g }|j| j|||||�� |j| j|||||�� |j| j|||||�� |S )Nr& )r r r r ri r
r r )rQ r� r� r rf r r� r6 r6 r7 �*build_policy_rich_source_destination_rules s z4ip4tables.build_policy_rich_source_destination_rulesc C s
|| j kS )N)rD )rQ rD r6 r6 r7 r� � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)N)N)N)8�__name__�
__module__� __qualname__rD r� Zpolicies_supportedrS rK r� rd rh rk rm rn ro rp rx r� r� r� r� r� rG rI r� r� r� r� r� r� r� r� r� r� r� r r r r r
r r r r r r r r! r" r$ r& r( r+ r, r- r� r6 r6 r6 r7 rB � sj
)Pa#
zN
0 "
&
!
1"rB c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr( Fc
C s� g }|j ddddddddd d
g
� |d krL|j ddddddddd d d
dg � |j dddddddd dg � |j dddddddd dg � |S )Nz-Ir z-tr$ z-mZrpfilterz--invertz --validmarkz-jr� r� r� z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr� z"--icmpv6-type=router-advertisement)ri )rQ r� r� r6 r6 r7 �build_rpfilter_rules� s$
z ip6tables.build_rpfilter_rulesc C s� ddddddddd g }d
}| j d j|� g }|jd d d
|g� xT|D ]L}|jd d d|d|ddddg
� | jjd krF|jd d d|d|ddddg
� qFW |jd d dddd|g� |jd d dddd|g� |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r& z-tz-Nz-Iz-dz-jr� z
--reject-withz addr-unreachr� �allr� z --log-prefixz"RFC3964_IPv4_REJECT: "r �4r )r� r3 )rP rj ri rC Z _log_denied)rQ Z
daddr_listZ
chain_namer� Zdaddrr6 r6 r7 �build_rfc3964_ipv4_rules� s4
z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rD r� r2 r5 r6 r6 r6 r7 r1 � s
r1 )/Zos.pathrT r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r
r Zfirewallr Zfirewall.errorsr
r r r r r Zfirewall.core.richr r r r r r r Zfirewall.core.icmpr r r� r� re r� r� r8 r= rA �objectrB r1 r6 r6 r6 r7 �<module> sB ( $ %* o