/
proc
/
self
/
root
/
lib
/
python3.6
/
site-packages
/
firewall
/
core
/
__pycache__
/
up file
home
3 Y�j%� � @ s< d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZmZ d dlmZmZm Z m Z m Z m Z m Z d dl!m"Z"m#Z# d dl$Z$d Z%d d d gd d gd dd d d gd dd gd d d gd�Z&ddd�Z'ddd�Z(dd� Z)dd� Z*dd� Z+G dd � d e,�Z-G d d � d e-�Z.dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR�INVALID_ICMPTYPE)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)� ICMP_TYPES� ICMPV6_TYPES� �INPUT�OUTPUT�FORWARD� PREROUTING� POSTROUTING)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited)�ipv4�ipv6�icmpz ipv6-icmpc C s� ddddddd�}| dd� }x~|D ]v}y|j |�}W n tk rL w$Y nX |d kr�yt||d � W n tk r~ Y nX |j|d � || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insert� )r* r+ )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� r6 � /usr/lib/python3.6/ipXtables.py�common_reverse_rule; s( r8 c C s� ddddddd�}| dd� }x�|D ]x}y|j |�}W n tk rL w$Y nX |d kr�yt||d � W n tk r~ Y nX |j|d � || ||< |S W ttd ��dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insertr, zno '-A', '-I' or '-N' arg)r9 r: )r- � ValueErrorr/ r0 r r )r1 r2 r3 �xr5 r6 r6 r7 �common_reverse_passthrough` s, r= c C s� t | �} t ddddddddd d d d d dddddddg�}t| |@ �dkrbttdt| |@ �d ��t dddddd g�}t| |@ �dkr�ttd ��d S ) zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)�set�lenr r �list)r1 Z not_allowedZneededr6 r6 r7 �common_check_passthrough� s* rA c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdjd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdkd,d-�Zd.d/� Zdld1d2�Z d3d4� Z d5d6� Z dmd8d9�Z dnd:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dodRdS�Z,dpdTdU�Z-dqdVdW�Z.dXdY� Z/drdZd[�Z0dsd\d]�Z1dtd^d_�Z2d`da� Z3dudbdc�Z4ddde� Z5dfdg� Z6dhdi� Z7d!S )v� ip4tablesr' Tc C sd || _ tj| j | _tjd| j | _| j� | _| j� | _ | j � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwr6 r6 r7 �__init__� s zip4tables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsrE Zcommand_existsrF Zrestore_command_exists)rQ r6 r6 r7 rK � s zip4tables.fill_existsc C s� | j r(| j |kr(| j gdd� |D � }ndd� |D �}tjd| j| jdj|�� t| j|�\}}|dkr�td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr6 )�.0�itemr6 r6 r7 � <listcomp>� s z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS )z%sr6 )rW rX r6 r6 r7 rY � s z %s: %s %s� r z'%s %s' failed: %s)rH r �debug2� __class__rE �joinr r; )rQ r1 Z_args�status�retr6 r6 r7 Z__run� s zip4tables.__runc C s< y|j |�}W n tk r" dS X ||||d �< dS d S )NF� T)r- r; )rQ �rule�patternZ replacement�ir6 r6 r7 � _rule_replace� s zip4tables._rule_replacec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)rQ rD �table�chainr6 r6 r7 �is_chain_builtin� s zip4tables.is_chain_builtinc C s2 d|g}|r|j d� n |j d� |j |� |gS )Nz-tz-Nz-X)�append)rQ �addrf rg ra r6 r6 r7 �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)�str)rQ rj rf rg r- r1 ra r6 r6 r7 � build_rule� s zip4tables.build_rulec C s t |�S )N)r8 )rQ r1 r6 r6 r7 � reverse_rule� s zip4tables.reverse_rulec C s t |� d S )N)rA )rQ r1 r6 r6 r7 �check_passthrough� s zip4tables.check_passthroughc C s t |�S )N)r= )rQ r1 r6 r6 r7 �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}y|j d�}W n tk r& Y n X t|�|d krD||d }d }xLd D ]D}y|j |�}W n tk rt Y qNX t|�|d krN||d }qNW ||fS ) Nr& z-tr` �-A�--append�-I�--insert�-N� --new-chain)rq rr rs rt ru rv )r- r; r? )rQ r1 rf rc rg �optr6 r6 r7 � passthrough_parse_table_chain� s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d�}|j|� |j|�}d|d kr:||d f}n ||d f}W nF tk r� y |j d�}|j|� d }W n tk r� d S X Y nX d}|d dkr�d }|r�| r�||kr�|j|� nn|�r0|� r�||kr�|j|� |jd d � d� |j |�}n| jj�r d}nt|�}d|d< |j dd|d � d S )Nz%%ZONE_SOURCE%%z-m� � � z%%ZONE_INTERFACE%%Tr �-D�--deleteFc S s | d S )Nr r6 )r< r6 r6 r7 �<lambda>( s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyz-Ir, z%dr` )r| r} ) r- r0 r; �removeri �sortrC �_allow_zone_driftingr? �insert)rQ ra rO rc �zoneZ zone_source�rule_addr- r6 r6 r7 �_run_replace_zone_source s> z"ip4tables._run_replace_zone_sourcec C s y|j |�}W n tk r$ Y �n�X d}d}d}|j|� |j|�}t|�tkr\ttd��d} xLdD ]D} y|j | �} W n tk r� Y qfX t|�| d krf|| d } qfW xhdD ]`} y|j | �}W n tk r� Y q�X t|�|d k� r�||d } | dk�rd}| dkr�d}q�W | | f} |�sp| |k�sP||| k�sP|| | dk�rZttd��|| | d8 < n�| |k�r�i || < ||| k�r�d|| |< d} xHt || j � �D ]4}||k�r�|�r�P | || | 7 } ||k�r�P �q�W || | d7 < d ||< |j |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TFr` z%priority must be followed by a numberr& �-t�--table�-A�--append�-I�--insert�-D�--deleter z*nonexistent or underflow of priority countr, z%dN���)r� r� )r� r� r� r� r� r� )r� r� )r� r� ) r- r; r0 �typer/ r r r? r �sorted�keysr� )rQ ra Zpriority_counts�tokenrc r� r� Zinsert_add_index�priorityrf rw �jrg r- �pr6 r6 r7 �_set_rule_replace_priority4 sj z$ip4tables._set_rule_replace_priorityc C sP t � }i }tj| j�}tj| j�}tj| j�}�x�|D �]�}|d d � } | j| dddt| j g� | j| dt | j g� y| j d�} W n t k r� Y n8X |dkr�q6|d$kr�d d d |g| | | d �< n | j | � | j | |d� | j | |d� | j| |� d} xZd%D ]R} y| j | �} W n t k �r, Y n(X t| �| d k�r| j | � | j | �} �qW xhtt| ��D ]X} xPtjD ]F} | | | k�rt| | jd��o�| | jd� �rtd| | | | < �qtW �qhW |j| g �j| � q6W xR|D ]J} || }|jd| � x"|D ]} |jdj| �d � �q W |jd� �q�W |j� tj|j �}t j d| j | j d|j |j!f � g }| j"�rz|j| j"� |jd� t#| j ||j d �\}}t j$� d k�r t%|j �}|d k �r d } xH|D ]@}t j&d | |f d d d � |jd��s�t j&d!d d"� | d 7 } �q�W tj'|j � |d k�r:t d#| j dj|�|f ��|| _|| _|| _d S )&Nz %%REJECT%%�REJECTz --reject-withz%%ICMP%%z %%LOGTYPE%%�off�unicast� broadcast� multicastz-m�pkttypez --pkt-typer` z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r& �-t�--table�"z"%s"z*%s rZ � zCOMMIT z %s: %s %sz%s: %dz-n)�stdinr, z%8d: %sr )�nofmt�nlr )r� z'%s %s' failed: %s)r� r� r� )r� r� )(r �copy�deepcopyrM rN rO rd �DEFAULT_REJECT_TYPErD �ICMPr- r; r0 r� r� r? �range�stringZ whitespace� startswith�endswith� setdefaultri �writer] �closerT �stat�namer r[ r\ rF �st_sizerJ r ZgetDebugLogLevelr Zdebug3�unlink)rQ �rules� log_denied� temp_fileZ table_rulesrM rN rO Z_rulera rc rf rw �cr� r1 r^ r_ �lines�liner6 r6 r7 � set_rules� s� zip4tables.set_rulesc C s� | j |dddt| j g� | j |dt| j g� y|jd�}W n tk rR Y n:X |dkr`dS |dkr�d d d |g|||d �< n |j|� tj| j �}tj| j �}tj| j �}| j ||d� | j ||d� | j ||� | j|�}|| _ || _ || _ |S )Nz %%REJECT%%r� z --reject-withz%%ICMP%%z %%LOGTYPE%%r� r r� r� r� z-mr� z --pkt-typer` z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r� r� r� )rd r� rD r� r- r; r0 r� r� rM rN rO r� r� �_ip4tables__run)rQ ra r� rc rM rN rO �outputr6 r6 r7 �set_rule� s. zip4tables.set_ruleNc C s� g }|r|gnt j� }xx|D ]p}|| jkr6|j|� q y,| jd|ddg� | jj|� |j|� W q tk r� tjd| j|f � Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) re r� rL ri r� r; r Zdebug1rD )rQ rf r_ Ztablesr6 r6 r7 �get_available_tables s z ip4tables.get_available_tablesc C s` d}t | jdddg�}|d dkr\d}t | jdddg�}|d dkrHd}tjd| j| j|� |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rE r r[ r\ )rQ rH r_ r6 r6 r7 rG s z ip4tables._detect_wait_optionc C s� t � }|jd� |j� d}xJd D ]B}t| j|g|jd�}|d dkr"d|d kr"d |d kr"|}P q"W tjd | j| j|� t j |j� |S ) Nz#foor �-w�--wait=2)r� r zinvalid optionr` zunrecognized optionz %s: %s will be using %s option.)r� r� ) r r� r� r rF r� r r[ r\ rT r� )rQ r� rH Z test_optionr_ r6 r6 r7 rI $ s z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj� D ].}| j|�s0q x dD ]}|jd||g� q6W q W |S )N�-F�-X�-Zz-t)r� r� r� )rM rN rO re r� r� ri )rQ r� rf �flagr6 r6 r7 �build_flush_rules7 s zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j� D ]@}| j|�s.q |dkr8q x$t | D ]}|jd|d||g� qBW q W |S )NZPANIC�DROPr% z-tz-P)re r� r� ri )rQ �policyr� �_policyrf rg r6 r6 r7 �build_set_policy_rulesF s z ip4tables.build_set_policy_rulesc C sN t � }|d ks| jdkr&|jtj� � |d ks8| jdkrF|jtj� � t|�S )Nr' r( )r> rD �updater r� r r@ )rQ rD Z supportedr6 r6 r7 �supported_icmp_typesR s z ip4tables.supported_icmp_typesc C s g S )Nr6 )rQ r6 r6 r7 �build_default_tables\ s z ip4tables.build_default_tablesr� c C s i }| j d�rpg |d< t� | jd< xLtd D ]@}|d jd| � |d jd||f � | jd jd| � q,W | j d��r\g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dkr�xt| jjr�ddd d gndd d gD ]R}|d jd ||f � |d jd |||f � | jd jtd ||f g�� �qW q�W | j d��rNg |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dk�r�xv| jj�r�ddd d gndd d gD ]R}|d jd ||f � |d jd |||f � | jd jtd ||f g�� �q�W �q�W | j d��r@g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |d9k�rxxv| jj�r�ddd d gndd d gD ]R}|d jd ||f � |d jd |||f � | jd jtd ||f g�� �q�W �qxW g |d< t� | jd< |d jd� |d jd� |d jd� |d jd� | jd jtd�� xf| jj�r�ddd d gndd d gD ]B}|d jd| � |d jd| � | jd jtd| �� �q�W |dk�r |d jd� |d jd � |dk�rF|d jd � |d jd � |d jd � |d jd � |d jd!� |d jd"� | jd jtd#�� xJd:D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �q�W xzd;D ]r}xj| jj�r dd gnd gD ]N}|d jd)||f � |d jd*||f � | jd jtd+||f �� �qW �q�W xJd<D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �qnW |dk�r�|d jd,� |d jd-� |dk�r�|d jd.� |d jd/� |d d0d1d2d3g7 < | jd jtd4�� xJd=D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q2W xJd>D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q~W g }xJ|D ]B}|| j � k�r�q�x(|| D ] }|jd8|gt |� � �q�W �q�W |S )?Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r � POLICIES_preZ ZONES_SOURCEZZONES� POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr$ r% r! r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz -N FORWARD_%sz-A FORWARD -j FORWARD_%sz FORWARD_%s�IN�OUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r! )r� )r� r� )r� )r� )r� ) r� r> rP re ri rj rC r� r� r ) rQ r� Z default_rulesrg Zdispatch_suffix� directionZfinal_default_rulesrf ra r6 r6 r7 �build_default_rules` s� $( &* &* & ( "z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j � kr,dhS |dkrHd| j � krHddhS |d krbd | j � krbdhS i S ) Nr& r � FORWARD_IN� FORWARD_OUTr$ r r% r! r# )r� )rQ rf r6 r6 r7 �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j jj|���jdk r dnd��dkr4�dkr4dnd} | j jj|�t| �� g } g } x|D ]} | jd| g� qZW x|D ]} | jd | g� qvW xB|D ]:} | j jj| �}|dkr�| j |� r�q�| j| j d | �� q�W x\|D ]T} | j jj| �}|dk�r| j |� �rq�t | ��r�dk�rq�| j| j d| �� q�W � �����fdd�}g }| �r�x�| D ]F}| �r�x8| D ]}|j|||�� �qdW n|�r�n|j||d �� �qTW nH|�r�n@| �r�x8| D ]}|j|d |�� �q�W n|�r�n|j|d d �� |S )Nr �pre�postr% r! TFz-iz-or' r( z-sr� r z-dc sV ddd�� }d�|d��f d�j g}| r6|j| � |rD|j|� |jd� g� |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r� �extend)�ingress_fragment�egress_fragment�add_delra )r� rg � chain_suffix�enable�p_objrf r6 r7 � _generate_policy_dispatch_rule s zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)r' r( )r' r( )r! r� r ) rC r� Z get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXri r� Z check_source�is_ipv_supported�_rule_addr_fragmentr )rQ r� r� rf rg Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrD r� r� r� r� r6 )r� rg r� r� r� rf r7 �!build_policy_ingress_egress_rules� sR z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr|dkrdnd}| j jj||t|d�} ddddddd�| } d } |rb| rbd d | d g} n,|rtd d | g} ndd | g} |s�| d g7 } | d|| || | g7 } | gS )Nr% r! TF)r� z-iz-o)r r! r r� r� r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)rC r� r� r� ) rQ r� r� r� r� rf rg ri r� r� rw �actionra r6 r6 r7 �!build_zone_source_interface_rules6 s& z+ip4tables.build_zone_source_interface_rulesc C s� |j d�rP|dd � }|dkr$d}nd}dj|g| jjj|� �}ddd ||gS t|�rz|dkrjttd ��dd d |j� gS t d |�r�t |�}n,t d |�r�|j d�}t |d �d |d }||gS d S )Nzipset:� z-d�dst�src�,z-mr> z --match-setz Can't match a destination MAC.�macz --mac-sourcer( �/r r` ) r� r] rC �ipsetZ get_dimensionr r r �upperr r r �split)rQ rw �address�invertr� �flags� addr_splitr6 r6 r7 r� P s" z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d d d d d d �| } | j jrdd | } nd | } t|�r�|dkr�g S || d|d|g} | j| j| |�� | jd| g� | gS )Nz-Iz-D)TFr% r! TF)r� z-sz-d)r r! r r� r� r z%s_ZONES_SOURCEz%s_ZONESr� r z%%ZONE_SOURCE%%z-tz-g)r! r� r )rC r� r� r� r� r r� r� ) rQ r� r� r� r� rf rg r� r� r� rw Zzone_dispatch_chainra r6 r6 r7 � build_zone_source_address_rulesf s& z)ip4tables.build_zone_source_address_rulesc C s> ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d �}| j| jt|d | d | d | d| d| g�� g } | j||d|g� | j|d | d|g� | j|d | d|g� | j|d | d|g� | j|d| d|g� | j|d| d|g� | j||d|dd | g� | j||d|dd | g� | j||d|dd | g� | j||d|dd| g� | j||d|dd| g� | j jj| j } | j j � dk�r|dk�r| d k�r�| j||d|ddddd| g � | dk�r| j||d|ddddd| g � |dk�r,| d k�r,| j||d|d| g� |�s:| j � | S ) Nz-Nz-X)TFz-Az-Dr% r! TF)r� z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr� r& r� � %%REJECT%%z %%LOGTYPE%%�LOGz --log-prefixz "%s_REJECT: "r� z "%s_DROP: "�ACCEPT)r� r� )r� r� r� r� ) rC r� r� r� rP r� r> ri Z _policies�target�get_log_denied�reverse) rQ r� r� rf rg Z add_del_chainZ add_del_ruler� r� r� r� r6 r6 r7 �build_policy_chain_rules� sN z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-m�limitz--limitz --limit-burst)�valueZburst)rQ r� �sr6 r6 r7 � _rule_limit� s zip4tables._rule_limitc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt t dt |j� ��n t t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r �allowZdenyr� r� ) r� �elementr r r r� r r r r r r r� )rQ � rich_ruler6 r6 r7 �_rich_rule_chain_suffix� s z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� )rQ r r6 r6 r7 � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r� )rQ r r6 r6 r7 � _rich_rule_priority_fragment� s z&ip4tables._rich_rule_priority_fragmentc C s� |j s g S | jjj||t�}ddd�| }| j|�}d||d||f g} | | j|�7 } | |ddg 7 } |j jr�| dd |j j g7 } |j jr�| d d |j j g7 } | | j |j j �7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr� z --log-prefixz'%s'z --log-levelz%s) r rC r� r� r� r r �prefix�levelr r� ) rQ r� r r� rf � rule_fragmentr� r� r� ra r6 r6 r7 �_rich_rule_log� s zip4tables._rich_rule_logc C s� |j s g S ddd�| }| jjj||t�}| j|�}d||d||f g} | | j|�7 } | |7 } t|j�t krrd} n,t|j�t kr�d} nt|j�t kr�d} nd } | d d d | g7 } | | j |j j �7 } | S ) Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdrop�unknownz-jZAUDITz--type)r rC r� r� r� r r r� r� r r r r r� ) rQ r� r r� rf r r� r� r� ra �_typer6 r6 r7 �_rich_rule_audit� s$ zip4tables._rich_rule_auditc C s2 |j s g S ddd�| }| jjj||t�}| j|�}d||f } t|j �tkrXddg} n�t|j �tkr�ddg} |j jr�| d|j jg7 } nnt|j �t kr�dd g} nVt|j �t kr�d }| jjj||t�}d||f } dd d |j j g} nt t d t|j � ��d||| g} | | j|�7 } | || 7 } | | j|j j�7 } | S )Nz-Az-D)TFz%s_%sz-jr� r� z --reject-withr� r$ �MARKz --set-xmarkzUnknown action %sz-t)r� rC r� r� r� r r� r r r r r> r r r r r� ) rQ r� r r� rf r r� r� r� rg Z rule_actionra r6 r6 r7 �_rich_rule_action s4 zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }q�td|j �r||j jd�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|jd� | jj j |jd �}|d |j|g7 }|S ) N�!r( z-dr� r r` z-mr> r� z --match-set) r� r� ri r r r r� r� rC r� �_ipset_match_flags)rQ Z rich_destr r� r� r6 r6 r7 � _rich_rule_destination_fragment1 s& " z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }nHtd|j �r||j jd�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|jd� |d |jg7 }nPt|d �o�|j �r|dd g7 }|jr�|jd� | j j j |j d �}|d |j |g7 }|S )Nr r( z-sr� r r` r� z-mz --mac-sourcer� r> r� z --match-set) r� r� ri r r r r� �hasattrr� r� rC r� r )rQ Z rich_sourcer r� r� r6 r6 r7 �_rich_rule_source_fragmentI s0 " z$ip4tables._rich_rule_source_fragmentc C s ddd�| }d}| j jj||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | j|j�7 } | | j|j�7 } | s�t |j �t kr�| d d d d g7 } g } |r�| j | j ||||| �� | j | j||||| �� | j | j||||| �� n"| j |d | d|g| ddg � | S )Nz-Az-D)TFr& z-pz--dportz%sz-dz-m� conntrackz --ctstatez NEW,UNTRACKEDz%s_allowz-tz-jr� )rC r� r� r� r r � destinationr �sourcer� r� r ri r r r ) rQ r� r� �proto�portr r r� rf r� r r� r6 r6 r7 �build_policy_ports_rulesf s* z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j jj||t�}d|g} |r<| d|g7 } |r`| | j|j�7 } | | j|j�7 } | stt|j �t kr�| ddd d g7 } g } |r�| j | j ||||| �� | j | j ||||| �� | j | j||||| �� n"| j |d | d |g| d dg � | S )Nz-Az-D)TFr& z-pz-dz-mr z --ctstatez NEW,UNTRACKEDz%s_allowz-tz-jr� )rC r� r� r� r r r r r� r� r ri r r r ) rQ r� r� �protocolr r r� rf r� r r� r6 r6 r7 �build_policy_protocol_rules� s& z%ip4tables.build_policy_protocol_rulesc C s ddd�| }d}| j jj||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | j|j�7 } | | j|j�7 } | s�t |j �t kr�| d d d d g7 } g } |r�| j | j ||||| �� | j | j||||| �� | j | j||||| �� n"| j |d | d|g| ddg � | S )Nz-Az-D)TFr& z-pz--sportz%sz-dz-mr z --ctstatez NEW,UNTRACKEDz%s_allowz-tz-jr� )rC r� r� r� r r r r r r� r� r ri r r r ) rQ r� r� r r r r r� rf r� r r� r6 r6 r7 � build_policy_source_ports_rules� s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t�} ddd�| } | d| ddd|g} |rP| dd t|� g7 } |r`| d |g7 } | d d d |g7 } | gS )Nr# z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)rC r� r� r� r ) rQ r� r� r r r Z helper_nameZmodule_short_namerf r� r� ra r6 r6 r7 � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rH| jdd|d| d|dd g� n6t|�rTg S | jdd|d| g| jd |� dd g � | S ) Nz-Az-D)TFz-tr& z%s_allowz-oz-jr� z-d)rC r� r� r� ri r r� ) rQ r� r� r� rf r� r r� r� r� r6 r6 r7 �build_zone_forward_rules� s z"ip4tables.build_zone_forward_rulesc C s, d}| j jj||tdd�}ddd�| }g }|rj| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}g } | j dd|d ||f g| d d d d dg � g }|r�| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}d}| j jj||t�}| j dd|d ||f g| ddddd dg � | S )Nr% T)r� z-Az-D)TFr z-tz%s_%sr z-o�loz-jZ MASQUERADEr& z-mr z --ctstatez NEW,UNTRACKEDr� ) rC r� r� r� r r r r r r ri ) rQ r� r� r rf r� r� r r� r� r6 r6 r7 � build_policy_masquerade_rules� s6 z'ip4tables.build_policy_masquerade_rulesc C s d}| j jj||t�} ddd�| } d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| j|�} | j|�} | | j |j �7 } | | j |j �7 } nd } g }|r�|j | j|||d| �� |j d d| d | | f g| d |dt|�ddd| g � |S )Nr% z-Az-D)TFr r( z[%s]z:%s�-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)rC r� r� r� r r r r r r r r r ri r )rQ r� r� r r ZtoportZtoaddrr rf r� r� Ztor r� r� r6 r6 r7 � build_policy_forward_port_rules� s2 z)ip4tables.build_policy_forward_port_rulesc C s� | j dkrL|tkrLt| \}}}|r,t|�nt|�d t|� }ddd|gS | j dkr�|tkr�t| \}}}|rxt|�nt|�d t|� }ddd|gS ttd |� d | j� ���d S ) Nr' r� z-mr) z --icmp-typer( Zicmp6z --icmpv6-typez ICMP type z not supported by )rD r rl r r r r� )rQ Z icmp_typer �_codeZ _omit_codeZ _type_strr6 r6 r7 �_icmp_types_fragment s z ip4tables._icmp_types_fragmentc C s� d}| j jj||t�}ddd�| }| jdkrDddg}| j|j�} nddg}| j|j�} g } | j jj|�rxd | } d } n d | } d } g } |r�| | j|j �7 } | | j |j �7 } | || 7 } |�rL| j | j ||||| �� | j | j||||| �� |j�r| j | j||||| �� n:| j|�}| j d ||d||f g| j|� | dd g � n`| j j� dk�r�| d k�r�| j || d |g| ddddd| g � | j || d |g| d| g � | S )Nr& z-Az-D)TFr' z-pr) z ipv6-icmpz%s_allowr� z%s_denyz %%REJECT%%z-tz%s_%sz-jr� z %%LOGTYPE%%r� z --log-prefixz"%s_ICMP_BLOCK: ")rC r� r� r� rD r( r� �query_icmp_block_inversionr r r r ri r r r� r r r r� )rQ r� r� Zictr rf r� r� r �matchr� Z final_chainZ final_targetr r� r6 r6 r7 � build_policy_icmp_block_rules, sJ z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }d}| j jj|�r�d}| j j� dkr�|rRd|t|�g}nd|g}|d|dd d d d d d| g }|j|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|j|� |S )Nr& r� z %%REJECT%%r� z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr� z --log-prefixz"%s_ICMP_BLOCK: "r` r� )rC r� r� r� r) r� rl ri ) rQ r� r� rf r� r� Zrule_idxZ ibi_targetra r6 r6 r7 �'build_policy_icmp_block_inversion_rules] s. z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j�7 }|| j|j�7 }g }|j| j|||||�� |j| j|||||�� |j| j|||||�� |S )Nr& )r r r r ri r r r )rQ r� r� r rf r r� r6 r6 r7 �*build_policy_rich_source_destination_rules s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS )N)rD )rQ rD r6 r6 r7 r� � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)N)N)N)8�__name__� __module__� __qualname__rD r� Zpolicies_supportedrS rK r� rd rh rk rm rn ro rp rx r� r� r� r� r� rG rI r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r r! r" r$ r& r( r+ r, r- r� r6 r6 r6 r7 rB � sj )Pa# zN 0 " & ! 1"rB c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr( Fc C s� g }|j ddddddddd d g � |d krL|j ddddddddd d d dg � |j dddddddd dg � |j dddddddd dg � |S )Nz-Ir z-tr$ z-mZrpfilterz--invertz --validmarkz-jr� r� r� z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr� z"--icmpv6-type=router-advertisement)ri )rQ r� r� r6 r6 r7 �build_rpfilter_rules� s$ z ip6tables.build_rpfilter_rulesc C s� ddddddddd g }d }| j d j|� g }|jd d d |g� xT|D ]L}|jd d d|d|ddddg � | jjd krF|jd d d|d|ddddg � qFW |jd d dddd|g� |jd d dddd|g� |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r& z-tz-Nz-Iz-dz-jr� z --reject-withz addr-unreachr� �allr� z --log-prefixz"RFC3964_IPv4_REJECT: "r �4r )r� r3 )rP rj ri rC Z _log_denied)rQ Z daddr_listZ chain_namer� Zdaddrr6 r6 r7 �build_rfc3964_ipv4_rules� s4 z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rD r� r2 r5 r6 r6 r6 r7 r1 � s r1 )/Zos.pathrT r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r Zfirewallr Zfirewall.errorsr r r r r r Zfirewall.core.richr r r r r r r Zfirewall.core.icmpr r r� r� re r� r� r8 r= rA �objectrB r1 r6 r6 r6 r7 �<module> sB ( $ %* o