/
proc
/
self
/
root
/
lib
/
python3.6
/
site-packages
/
firewall
/
core
/
__pycache__
/
up file
home
3 Y�jBu � @ s6 d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z m Z m Z d dl mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z d dl m Z m Z d dl m!Z! d Z"e"d d Z#d Z$d Z%i ddde% fidd e% fdde% fd�dd e% fdd e% fdd e% fdd e% fd�d�Z&G dd� de'�Z(dS ) � )�absolute_importN)�log)� check_mac� getPortRange� normalizeIP6�check_single_address� check_address)� FirewallError� UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE� INVALID_ENTRY� INVALID_PORT)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)� ICMP_TYPES� ICMPV6_TYPES)�NftablesZ firewalld�_Z policy_dropZpolicy_� � PREROUTING� prerouting� �d Z postrouting)r � POSTROUTING�input�forward�output)r �INPUT�FORWARD�OUTPUT)�raw�mangle�nat�filterc @ sj e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Z d d � Z dd� Z d�dd�Z dd� Z dd� Zdd� Zdd� Zd�dd �Zd d � Zd�d d!�Zd"d#� Zd�d%d&�Zd�d(d)�Zd�d*d+�Zd�d,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&d�dJdK�Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+d�dTdU�Z,d�dVdW�Z-d�dXdY�Z.dZd[� Z/d�d\d]�Z0d�d^d_�Z1d�d`da�Z2d�dbdc�Z3d�ddde�Z4d�dfdg�Z5dhdi� Z6d�djdk�Z7dldm� Z8d�dndo�Z9dpdq� Z:drds� Z;dtdu� Z<dvdw� Z=d�dxdy�Z>d�dzd{�Z?d|d}� Z@d�d~d�ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�d��ZIdS )��nftablesTc C sb || _ d| _g | _i | _i | _i | _i | _i | _g g g d�| _t � | _ | j j d� | j j d� d S )NT)�inet�ip�ip6) �_fwZrestore_command_existsZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�created_tablesr r+ Zset_echo_outputZset_handle_output)�self�fw� r8 � /usr/lib/python3.6/nftables.py�__init__X s znftables.__init__c C s� xdD ]}||krP qW d|| d kr`|| d d d || d d d f}|| d d= n(d|| d kr�d }|| d d= nd S || d d }|r�|dkr�||kr�||| kr�|| j |� n�|dk�r�||kr�g ||< |�r(||| k�r|| j|� || jd d � d � || j|�}n | jj�r8d }n t|| �}|| }||= |d k�rf||d< n |d8 }||d< ||d d d< d S )N�add�insert�deletez%%ZONE_SOURCE%%�rule�zone�addressz%%ZONE_INTERFACE%%�familyc S s | d S )Nr r8 )�xr8 r8 r9 �<lambda>� s z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr � �index)r; r< r= )�remove�append�sortrF r/ �_allow_zone_drifting�len)r6 r> r4 �verbZ zone_sourcerA rF � _verb_snippetr8 r8 r9 �_run_replace_zone_sourceg sD z!nftables._run_replace_zone_sourcec C sB d|krdt j|d �iS d|kr4dt j|d �iS ttd��d S )Nr< r= r; zFailed to reverse rule)�copy�deepcopyr r )r6 �dictr8 r8 r9 � reverse_rule� s znftables.reverse_rulec C s� xd D ]}||krP qW ||| d k�r�|| d | }|| d |= t |�tkr^ttd��|| d d || d d f}|dkr�||ks�||| ks�|| | dkr�ttd ��|| | d 8 < n�||kr�i ||< ||| kr�d|| |< d}xVt|| j� �D ]B}||k�r"|dk�r"P ||| | 7 }||k�r|dk�rP �qW || | d 7 < || } ||= |dk�r�| |d< n |d 8 }| |d< ||d d d < d S ) Nr; r< r= r> z%priority must be followed by a numberrA �chainr z*nonexistent or underflow of priority countrE rF )r; r< r= )�type�intr r r �sorted�keys) r6 r> Zpriority_counts�tokenrL �priorityrS rF �prM r8 r8 r9 �_set_rule_replace_priority� sD z#nftables._set_rule_replace_priorityc C sf x`d D ]X}||krd|| krt j|| d �}xd D ]}||kr6||= q6W tj|dd �}|S qW d S ) Nr; r< r= r> rF �handle�positionT)Z sort_keys)r; r< r= )rF r\ r] )rO rP �json�dumps)r6 r> rL �rule_keyZnon_keyr8 r8 r9 � _get_rule_key� s znftables._get_rule_keyc C sL dddddg}dddg}g }g }t j| j�}t j| j�}t j| j�} | jj � } �x�|D �]�} t| �tkrvtt d| ��x|D ]} | | kr|P q|W | | kr�tt d| ��| j | �} | | k�rDt j d| j| | | � | dkr�| | d 7 < qVnX| | d k�r | | d 8 < qVn6| | d k�r,| | d 8 < ntt d | | | f ��n| �r\| dk�r\d | | < |j| � t j| �}| �rttd || d d ��|| d d < | j||d � | j||d� | j|| � | dk�rdd |d d d |d d d |d d d | j| d�ii}|j|� qVW dddd iig| i}t j� dk�rVt jd| jtj|�� | jj|�\}}}|dk�r�tdd|tj|�f ��|| _|| _| | _| | _d}x�|D ]�} |d 7 }| j | �} | �s̐q�d| k�r�| j| = | j| = �q�x"|D ]} | |d | k�r�P �q�W | |d | k�r$�q�|d | | d d | j| < �q�W d S ) Nr; r< r= �flush�replacez#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %srE z)rule ref count bug: rule_key '%s', cnt %dr> �exprz%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%rA �tablerS )rA re rS r\ r+ ZmetainfoZjson_schema_version� z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s JSON blob: %szpython-nftablesr\ ) rO rP r2 r3 r4 r1 rT rQ r r r ra r Zdebug2� __class__rH �listr* r[ rN r0 ZgetDebugLogLevelZdebug3r^ r_ r+ Zjson_cmd� ValueError)r6 �rules� log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesr2 r3 r4 r1 r> rL r` Z_ruleZ json_blobZrcr# �errorrF r8 r8 r9 � set_rules� s� & znftables.set_rulesc C s | j |g|� dS )N� )rm )r6 r> rk r8 r8 r9 �set_rule: s znftables.set_ruleNc C s |r |gS t j� S )N)�IPTABLES_TO_NFT_HOOKrW )r6 re r8 r8 r9 �get_available_tables> s z nftables.get_available_tablesc C sF g }x<dD ]4}|j dd||d�ii� |j dd||d�ii� q W |S ) Nr, r- r. r; re )rA �namer= )r, r- r. )rH )r6 re rj rA r8 r8 r9 �_build_delete_table_rulesB s z"nftables._build_delete_table_rulesc C s� i }i }xB| j d�D ]4}| j|�}|| jkr| j| ||< | j| ||< qW || _|| _i | _i | _i | _x*dD ]"}t| j| krp| j| j t� qpW | j t�S )NTr, r- r. )r, r- r. ) � _build_set_policy_rules_ct_rulesra r0 r1 r2 r3 r4 � TABLE_NAMEr5 rG rs )r6 Zsaved_rule_to_handleZsaved_rule_ref_countr> � policy_keyrA r8 r8 r9 �build_flush_rulesP s znftables.build_flush_rulesc C sl ddd�| }g }xTdD ]L}|j |ddtd d |f d d d diiddddgid�idd igd�ii� qW |S )Nr; r= )TFr! r" r# r> r, z%s_%sr* �match�ctrD �state�in�set� established�related)�left�op�right�accept)rA re rS rd )r! r" r# )rH �TABLE_NAME_POLICY)r6 �enable�add_delrj �hookr8 r8 r9 rt g s z)nftables._build_set_policy_rules_ct_rulesc C st g }|dkrt|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d dd�ii� q:W |dk� r�|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d dd�ii� q�W || jd�7 }nz|dk�rfx4| jd�D ]&}| j|�}|| jk�r |j |� �q W || jt�7 }t| jd k�rp| jd jt� n t t d� |S )NZPANICr; re r, )rA rr r r# rS z%s_%sr' r* i, rE �drop)rA re rr rT r� �prio�policy�DROPr! r" r T�ACCEPTFznot implemented)r r# i���)r! r" r# ) rH r� r5 �NFT_HOOK_OFFSETrt ra r0 rs rG r r )r6 r� rj r� r> rv r8 r8 r9 �build_set_policy_rulest sH z nftables.build_set_policy_rulesc C sJ t � }|d ks|dkr$|jtj� � |d ks4|dkrB|jtj� � t|�S )N�ipv4�ipv6)r| �updater rW r rh )r6 �ipvZ supportedr8 r8 r9 �supported_icmp_types� s z nftables.supported_icmp_typesc C s> g }x4dD ],}|j dd|td�ii� | j| j t� q W |S )Nr, r- r. r; re )rA rr )r, r- r. )rH ru r5 )r6 Zdefault_tablesrA r8 r8 r9 �build_default_tables� s z nftables.build_default_tables�offc C s� g }x�t d j� D ]�}|jdddtd| ddt d | d t d | d d �ii� xz| jjrld d d dgnd d dgD ]X}|jdddtd||f d�ii� |jdddtd| ddd||f iigd�ii� qvW qW x�d?D ]�}x�t d j� D ]�}|jdd|td| ddt d | d t d | d d �ii� x~| jj�rJd d d dgnd d dgD ]Z}|jdd|td||f d�ii� |jdd|td| ddd||f iigd�ii� �qTW q�W q�W xVt d j� D ]F}|jdddtd| ddt d | d t d | d d �ii� �q�W |jdddtdd d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd d d d d&iid d'd$�id%d igd�ii� |jdddtdd d d(d d)iid*d+d$�id%d igd�ii� x~| jj�r�d d d dgnd d dgD ]Z}|jdddtd,d|f d�ii� |jdddtdd ddd,d|f iigd�ii� �q�W |d-k�r�|jdddtdd d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd d d d d iid d!d.gid$�id2d igd�ii� |d-k�r$|jdddtdd | j|�d/d0d3iigd�ii� |jdddtdd d4d5d6d7�igd�ii� |jdddtdd8 d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd8 d d d d&iid d'd$�id%d igd�ii� |jdddtdd8 d d(d d)iid*d+d$�id%d igd�ii� xbd@D ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW x�dAD ]�}xz| jj�r�d d gnd gD ]^}|jdddtd;d8||f d�ii� |jdddtdd8 ddd;d8||f iigd�ii� �q�W �qvW xbdBD ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW |d-k�r�|jdddtdd8 d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd8 d d d d iid d!d.gid$�id2d igd�ii� |d-k�r6|jdddtdd8 | j|�d/d0d3iigd�ii� |jdddtdd8 d4d5d6d7�igd�ii� |jdddtdd< d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtd=d d(d d>iid*d+d$�id%d igd�ii� xbdCD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �q�W xbdDD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �qHW |S )ENr( r; rS r, z mangle_%sr* z%sr rE )rA re rr rT r� r� � POLICIES_preZ ZONES_SOURCEZZONES� POLICIES_postz mangle_%s_%s)rA re rr r> �jump�target)rA re rS rd r- r. r) znat_%sz nat_%s_%sz filter_%sr$ rx ry rD rz r{ r| r} r~ )r r� r� r� Zstatus�dnat�meta�iifnamez==�loz filter_%s_%sr� Zinvalidr �prefixzSTATE_INVALID_DROP: r� zFINAL_REJECT: �reject�icmpxzadmin-prohibited)rT rd r% �IN�OUTzfilter_%s_%s_%sr& � filter_OUTPUT�oifname)r- r. )r� )r� r� )r� )r� )r� )rp rW rH ru r/ rJ �_pkttype_match_fragment)r6 rk Z default_rulesrS Zdispatch_suffixrA � directionr8 r8 r9 �build_default_rules� s� $ ( & . & & & . & & &z nftables.build_default_rulesc C s4 |dkrdddgS |dkr dgS |dkr0ddgS g S ) Nr* r$ � FORWARD_IN� FORWARD_OUTr( r r) r r8 )r6 re r8 r8 r9 �get_zone_table_chains� s z nftables.get_zone_table_chainsr, c s� �dkr\�dkr\g } | j �j�|��||||dd� � | j �j�|��||||dd� � | S �jjj|���jdk rxdnd��dkr��d kr�d nd } �jjj|�t| �� g } g } |r�| jd d ddiiddt |�id�i� |�r| jd d ddiiddt |�id�i� ddd�}|�rlxT|D ]L}�dk�rT�jj j |�}||k�rT�|| k�rT�q | j�j d|�� �q W |�r�xT|D ]L}�dk�r��jj j |�}||k�r��|| k�r��qx| j�j d|�� �qxW � �������fdd�}g } | �rHx�| D ]P}| �r xB| D ]}| j|||�� �qW n"�dk�r0|�r0n| j||d �� �q�W n\�dk�rZ|�rZnJ| �r�xB| D ]}| j|d |�� �qfW n"�dk�r�|�r�n| j|d d �� | S )Nr) r, r- )rA r. r �pre�postr TFrx r� rD r� z==r| )r r� r� r� )r� r� �saddr�daddrc s� g }| r|j | � |r |j |� |j ddd�� f ii� �td���f |d�}|j�j��� �rrdd|iiS dd|iiS d S ) Nr� r� z%s_%sz%s_%s_POLICIES_%s)rA re rS rd r; r> r= )rH ru r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsr> )�_policyrS � chain_suffixr� rA �p_objr6 re r8 r9 � _generate_policy_dispatch_rule� s zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) �extend�!build_policy_ingress_egress_rulesr/ r� Z get_policyrY �policy_base_chain_name�POLICY_CHAIN_PREFIXrH rh r? Z check_source�_rule_addr_fragment)r6 r� r� re rS Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesrA rj �isSNATZingress_fragmentsZegress_fragmentsZ ipv_to_family�srcr� �dstr� r� r� r8 )r� rS r� r� rA r� r6 re r9 r� � sv z*nftables.build_policy_ingress_egress_rulesFc C s� |dkrT|dkrTg } | j | j|||||||d�� | j | j|||||||d�� | S |dkrh|dkrhdnd} | jjj||t| d�} d d d d d d d �| } |t|�d d kr�|d t|�d � d }d} |dkr�| dd|| f iig}n,ddd| iid|d�i| dd|| f iig}|�rL| �rLd}|td||f |d�}|j| j � � nP|�rnd}|td||f |d�}n.d}|td||f |d�}|�s�|j| j � � |d |iigS ) Nr) r, r- r. r TF)r� r� r� )r r r$ r� r� r& rE �+�*�gotor� z%s_%srx r� rD z==)r r� r� r< z %s_%s_ZONES)rA re rS rd r; r= r> ) r� �!build_zone_source_interface_rulesr/ r� r� r� rK ru r� �_zone_interface_fragment)r6 r� r? r� � interfacere rS rH rA rj r� r� �opt�actionr� rL r> r8 r8 r9 r� s\ z*nftables.build_zone_source_interface_rulesc C sn |dkr�|dkr�g }|j d�r6| j|td�d � �} nd } td|�sTt|�sT| dkrp|j| j||||||d�� td|�s�t|�s�| dkr�|j| j||||||d�� |S |dkr�|dkr�d nd } | jjj ||t | d �} d d d�| } ddddddd�| } | jj �rd||f }n d||f }d}|t || j | |�|dd|| f iigd�}|j| j||�� | d|iigS )Nr) r, zipset:r� r- r� r. r TF)r� r< r= )TFr� r� )r r r$ r� r� r& z%s_%s_ZONES_SOURCEz %s_%s_ZONESr� r� z%s_%s)rA re rS rd r> )� startswith�_set_get_familyrK r r r� � build_zone_source_address_rulesr/ r� r� r� rJ ru r� r� �_zone_source_fragment)r6 r� r? r� r@ re rS rA rj Z ipset_familyr� r� r� r� Zzone_dispatch_chainr� r> r8 r8 r9 r� < sB z(nftables.build_zone_source_address_rulesc C s |dkrH|dkrHg }|j | j||||d�� |j | j||||d�� |S ddd�| }|dkrj|dkrjd nd }| jjj||t|d �} g }|j|d |td || f d�ii� x0d!D ](} |j|d |td|| | f d�ii� q�W xDd"D ]<} |j|d|td || f ddd|| | f iigd�ii� q�W | jjj| j } | jj � dk�r�|dk�r�| d#k�r�| } | d k�rhd} |j|d|td || f | j | jj � �dd d | | f iigd�ii� |dk�r| d$k�r| d%k�r�| j � } n | j � d i} |j|d|td || f | gd�ii� |�s|j� |S )&Nr) r, r- r. r; r= )TFr TF)r� rS z%s_%s)rA re rr r� r �deny�allowr� z%s_%s_%sr> r� r� )rA re rS rd r� r* �REJECT� %%REJECT%%r� r� z"filter_%s_%s: "r� )r� r r� r� r� )r� r r� r� r� )r� r� r� )r� r� r� r� )r� r� )r� �build_policy_chain_rulesr/ r� r� r� rH ru Z _policiesr� �get_log_deniedr� �_reject_fragment�lower�reverse)r6 r� r� re rS rA rj r� r� r� r� r� Z log_suffix�target_fragmentr8 r8 r9 r� j sZ & z!nftables.build_policy_chain_rulesc C s< |dkr i S |d kr,ddddiid |d �iS t td |��d S ) N�all�unicast� broadcast� multicastrx r� rD �pkttypez==)r r� r� zInvalid pkttype "%s")r� r� r� )r r )r6 r� r8 r8 r9 r� � s z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd d�iddd d�idd d d�iddd d�iddd d�iddd d�iddd d�idddd�idddd�idddiidddiid�}|| S )Nr� �icmpzhost-prohibited)rT rd znet-prohibitedzadmin-prohibited�icmpv6znet-unreachablezhost-unreachablezport-unreachabler� zprot-unreachablezaddr-unreachablezno-routerT z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez proto-unreachzicmp6-addr-unreachablez addr-unreachzicmp6-no-routezno-routez tcp-resetztcp-rstr8 )r6 Z reject_typeZfragsr8 r8 r9 �_reject_types_fragment� s0 z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� zadmin-prohibited)rT rd r8 )r6 r8 r8 r9 r� � s znftables._reject_fragmentc C s ddddiiddddgid �iS ) Nrx r� rD �l4protoz==r| r� r� )r r� r� r8 )r6 r8 r8 r9 �_icmp_match_fragment� s z nftables._icmp_match_fragmentc C sP |si S ddddd�}|j � \}}||| d�}|j� }|d k rH||d< d|iS ) N�secondZminuteZhourZday)�s�m�h�d)�rateZper�burst�limit)Z value_parseZ burst_parse)r6 r� Z rich_to_nftr� Zdurationr� r� r8 r8 r9 �_rich_rule_limit_fragment� s z"nftables._rich_rule_limit_fragmentc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt t dt |j� ��n t t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r r� r� r� r� ) rT �elementr r r r� r r r r r r rY )r6 � rich_ruler8 r8 r9 �_rich_rule_chain_suffix� s z nftables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r rY )r6 r� r8 r8 r9 � _rich_rule_chain_suffix_from_log s z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nz%%ZONE_INTERFACE%%r8 )r6 r8 r8 r9 r� s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|jd�}t|d �d |d }d||d�iS )Nr� �/r rE z%%ZONE_SOURCE%%)r? r@ )r r r �split)r6 r? r@ Z addr_splitr8 r8 r9 r� s z nftables._zone_source_fragmentc C s d|j iS )Nz%%POLICY_PRIORITY%%)rY )r6 r� r8 r8 r9 r� s z"nftables._policy_priority_fragmentc C s | s|j dkri S d|j iS )Nr z%%RICH_RULE_PRIORITY%%)rY )r6 r� r8 r8 r9 � _rich_rule_priority_fragment s z%nftables._rich_rule_priority_fragmentc C s� |j s i S | jjj||t�}ddd�| }| j|�}i } |j jrPd|j j | d< |j jr|d|j jkrhdn|j j} d| | d< d td |||f || j |j j �d | ig d �} | j | j |�� |d | iiS )Nr; r= )TFz%sr� Zwarning�warn�levelr, z%s_%s_%sr )rA re rS rd r> ) r r/ r� r� r� r� r� r� ru r� r� r� r� ) r6 r� r� r� re r� r� r� r� Z log_optionsr� r> r8 r8 r9 �_rich_rule_log" s& znftables._rich_rule_logc C s� |j s i S | jjj||t�}ddd�| }| j|�}dtd|||f || j|j j�dddiig d �} | j | j |�� |d | iiS ) Nr; r= )TFr, z%s_%s_%sr r� r� )rA re rS rd r> ) r� r/ r� r� r� r� ru r� r� r� r� ) r6 r� r� r� re r� r� r� r� r> r8 r8 r9 �_rich_rule_audit< s znftables._rich_rule_auditc C s� |j s i S | jjj||t�}ddd�| }| j|�}d|||f } t|j �tkr\dd i} �n t|j �tkr�|j jr�| j |j j�} ndd i} n�t|j �t kr�dd i} n�t|j �t k�rHd}| jjj||t�}d|||f } |j j j d �} t| �d k�r,dd d d iiddd d d ii| d gi| d gid�i} ndd d d ii| d d�i} nttdt|j � ��dt| || j|j j�| g d�} | j| j|�� |d| iiS )Nr; r= )TFz%s_%s_%sr� r� r� r( r� rE r� rD �mark�^�&r )rD �valuezUnknown action %sr, )rA re rS rd r> )r� r/ r� r� r� r� rT r r r� r r r| r� rK r r ru r� r� r� r� ) r6 r� r� r� re r� r� r� r� rS Z rule_actionr� r> r8 r8 r9 �_rich_rule_actionN sB , znftables._rich_rule_actionc C s� |j d�r0| j|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j d �i}nDtd |�r�d }t |�}n,d }|j d �}d t |d �t |d �d �i}dd||d�i|r�dnd|d�iS d S )Nzipset:r� TF�etherr� r- )�strictr� )�addrrK r� r. r� r rE rx �payload)�protocol�fieldz!=z==)r r� r� )r� �_set_match_fragmentrK r r r � ipaddressZ IPv4NetworkZnetwork_addressZ compressedZ prefixlenr r� rU )r6 Z addr_fieldr@ �invertrA Znormalized_addressZaddr_lenr8 r8 r9 r� y s( & z nftables._rule_addr_fragmentc C s6 |si S |d kr t td| ��ddddiid|d �iS ) Nr� r� zInvalid familyrx r� rD �nfprotoz==)r r� r� )r� r� )r r )r6 Z rich_familyr8 r8 r9 �_rich_rule_family_fragment� s z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )Nzipset:r� )r )r� �ipsetr� r )r6 Z rich_destr@ r8 r8 r9 � _rich_rule_destination_fragment� s z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macr zipset:r� )r )r� �hasattrr r r� r )r6 Z rich_sourcer@ r8 r8 r9 �_rich_rule_source_fragment� s z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr rE �range)r � isinstancerU r r rK )r6 �portr r8 r8 r9 �_port_fragment� s znftables._port_fragmentc C sb ddd�| }d}| j jj||t�} g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j |j �� | jdd|dd �id | j |�d �i� | s�t |j�tkr�| jdd d diiddddgid �i� g } |�r0| j| j||||| �� | j| j||||| �� | j| j||||| �� n.| j|ddtd|| f | dd ig d�ii� | S )Nr; r= )TFr* r� rx r� �dport)r� r� z==)r r� r� ry rD rz r{ r| �new� untrackedr> r, z %s_%s_allowr� )rA re rS rd )r/ r� r� r� rH r rA r� r � destinationr �sourcer rT r� r r� r� r� ru ) r6 r� r� �protor r r� r� re r� r� rj r8 r8 r9 �build_policy_ports_rules� s: z!nftables.build_policy_ports_rulesc C sZ ddd�| }d}| j jj||t�}g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j |j �� | jdddd iid |d �i� | s�t |j �tkr�| jdd dd iiddddgid �i� g } |�r(| j| j||||| �� | j| j||||| �� | j| j||||| �� n.| j|ddtd||f | dd ig d�ii� | S )Nr; r= )TFr* r� rx r� rD r� z==)r r� r� ry rz r{ r| r r r> r, z %s_%s_allowr� )rA re rS rd )r/ r� r� r� rH r rA r� r r r r rT r� r r� r� r� ru ) r6 r� r� r� r r� r� re r� r� rj r8 r8 r9 �build_policy_protocol_rules� s8 z$nftables.build_policy_protocol_rulesc C sb ddd�| }d}| j jj||t�} g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j |j �� | jdd|dd �id | j |�d �i� | s�t |j�tkr�| jdd d diiddddgid �i� g } |�r0| j| j||||| �� | j| j||||| �� | j| j||||| �� n.| j|ddtd|| f | dd ig d�ii� | S )Nr; r= )TFr* r� rx r� �sport)r� r� z==)r r� r� ry rD rz r{ r| r r r> r, z %s_%s_allowr� )rA re rS rd )r/ r� r� r� rH r rA r� r r r r r rT r� r r� r� r� ru ) r6 r� r� r r r r� r� re r� r� rj r8 r8 r9 � build_policy_source_ports_rules s: z(nftables.build_policy_source_ports_rulesc C s� d}| j jj||t�} ddd�| } g } |rR| jdddtd||f ||d�ii� g } |rl| j| jd |�� | jd d |d d �id| j|�d�i� | jdd||f i� | j| ddtd| | d�ii� | S )Nr* r; r= )TFz ct helperr, z helper-%s-%s)rA re rr rT r� r� rx r� r )r� r� z==)r r� r� r> zfilter_%s_allow)rA re rS rd )r/ r� r� r� rH ru r� r ) r6 r� r� r r r Z helper_nameZmodule_short_namere r� r� rj r� r8 r8 r9 � build_policy_helper_ports_rules) s. z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d iid |d �id d ig} n| jd|�d d ig} dtd| | d�} | j|d| ii� | S )Nr; r= )TFrE r� r� rx r� rD r� z==)r r� r� r� r� r, zfilter_%s_allow)rA re rS rd r> )r/ r� r� r� rK r� ru rH ) r6 r� r? r� re r� r r� r� rj rd r> r8 r8 r9 �build_zone_forward_rulesF s" z!nftables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|r`|j| j|j�� |j| j|j�� | j |�} nd} |t d|| f |d d d d iid dd�idd ig d�} | j | j |�� |d| iigS )Nr) T)r� r; r= )TFr� z nat_%s_%srx r� rD r� z!=r� )r r� r� Z masquerade)rA re rS rd r> ) r/ r� r� r� rH r r r r r� ru r� r� ) r6 r� r� rA r� re r� r� r� r� r> r8 r8 r9 �"_build_policy_masquerade_nat_rules_ s& z+nftables._build_policy_masquerade_nat_rulesc C s^ g }|rD|j r|j dks,|jrDtd|jj�rD|j| j||d|�� nV|r�|j rX|j dksl|jr�td|jj�r�|j| j||d|�� n|j| j||d|�� d}| jjj||t �}ddd�| }g }|r�|j | j |j �� |j | j |j�� | j|�} nd } d td || f |d d ddiiddddgid�idd ig d�} | j| j|�� |j |d| ii� |S )Nr� r. r� r- r* r; r= )TFr� r, z filter_%s_%srx ry rD rz r{ r| r r )r r� r� r� )rA re rS rd r> )rA r r r� r� r r/ r� r� r� rH r r r r� ru r� r� ) r6 r� r� r� rj re r� r� r� r� r> r8 r8 r9 � build_policy_masquerade_rulesx s8 z&nftables.build_policy_masquerade_rulesc C s$ d} | j jj|| t�} ddd�| } g } |r\| j| j|j�� | j| j|j�� | j |�} nd} | jdd|dd �id | j |�d �i� |r�t d |�r�t |�}|r�|d kr�| jd|| j |�d�i� q�| jdd|ii� n| jdd| j |�ii� |t d| | f | d�}|j| j|�� | d|iigS )Nr) r; r= )TFr� rx r� r )r� r� z==)r r� r� r� rn r� )r� r r� Zredirectr z nat_%s_%s)rA re rS rd r> )r/ r� r� r� rH r r r r r� r r r ru r� r� )r6 r� r� r r� �toaddr�toportrA r� re r� r� r� r� r> r8 r8 r9 �$_build_policy_forward_port_nat_rules� s4 z-nftables._build_policy_forward_port_nat_rulesc C s� g }|rF|j r|j dks&|rFtd|�rF|j| j||||||d|�� n�|r�|j rZ|j dksh|r�td|�r�|j| j||||||d|�� nL|r�td|�r�|j| j||||||d|�� n |j| j||||||d|�� |S )Nr� r. r� r- )rA r r� r ) r6 r� r� r r� r r r� rj r8 r8 r9 � build_policy_forward_port_rules� s z(nftables.build_policy_forward_port_rulesc C sH dd|dd�id|d�ig}|d k rD|j dd|dd�id|d�i� |S )Nrx r� rT )r� r� z==)r r� r� �code)rH )r6 r� rT r � fragmentsr8 r8 r9 �_icmp_types_fragments� s z nftables._icmp_types_fragmentsc C s� |dkr4|t kr4t | \}}}| jd||r.d n|�S |dkrh|tkrht| \}}}| jd||rbd n|�S ttd|| j|f ��d S )Nr� r� r� r� z)ICMP type '%s' not supported by %s for %s)r r r r r rr )r6 r� Z icmp_typeZ_type�_codeZ _omit_coder8 r8 r9 � _icmp_types_to_nft_fragments� s z%nftables._icmp_types_to_nft_fragmentsc C sB d}| j jj||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jkrT|jd� d|jkrr|jd� nddg}g } �x�|D �]�} | j jj|�r�d||f } dd i} nd ||f } | j� } g } |r�| j| j |j �� | j| j |j�� | j| j |j �� | j| j| |j�� |�r�| j| j||||| �� | j| j||||| �� |j�rf| j| j||||| �� nN| j|�}d td |||f | | j� g d �}|j| j|�� | j|d |ii� q~| j j� dk�r| j jj|� �r| j|d d t| | | j| j j� �ddd||f iig d �ii� | j|d d t| | | g d �ii� q~W | S )Nr* r; r= )TFr� r� z %s_%s_allowr� z %s_%s_denyr, z%s_%s_%s)rA re rS rd r> r� r r� z"%s_%s_ICMP_BLOCK: ")r/ r� r� r� �ipvsr rH �query_icmp_block_inversionr� r rA r r r r� r" rr r� r� r� r� r� ru r� r� r� r� )r6 r� r� Zictr� re r� r� r# rj r� Z final_chainr� r� r� r> r8 r8 r9 � build_policy_icmp_block_rules� sb " " z&nftables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }ddd�| }| j jj|�r@| j� }ndd i}|j|ddtd||f d | j� |gd �ii� | j j � d kr�| j jj|�r�|j|ddtd||f d | j� | j | j j � �d d d||f iigd �ii� |S )Nr* r; r= )TFr� r> r, z%s_%s� )rA re rS rF rd r� r r� z%s_%s_ICMP_BLOCK: ) r/ r� r� r� r$ r� rH ru r� r� r� )r6 r� r� re r� rj r� r� r8 r8 r9 �'build_policy_icmp_block_inversion_rules( s, z0nftables.build_policy_icmp_block_inversion_rulesc C s� g }ddddiiddd�iddd d d gd d �iddd�ig}|dkrV|j dddii� |j dd i� |j dddtd|d�ii� |j dddtdddddd �idd d d gid�id d igd�ii� |S )!Nrx r� rD r z==r� )r r� r� Zfibr� Ziifr� Zoif)�flags�resultFr� r r� zrpfilter_DROP: r� r< r> r, Zfilter_PREROUTING)rA re rS rd r� r� rT )r� r� r| znd-router-advertznd-neighbor-solicitr� )rH ru )r6 rk rj r� r8 r8 r9 �build_rpfilter_rulesG s0 z nftables.build_rpfilter_rulesc C s� ddddddddd g }d d � |D �}d d ddd�idd|id�ig}| j jd"krb|jdddii� |j| jd�� g }|jddd td d |d �ii� |jddd td d!|d �ii� |S )#Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |j d�d t|j d�d �d�i�qS )r� r� r rE )r� rK )r� rU )�.0rB r8 r8 r9 � <listcomp>n s z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>rx r� r. r� )r� r� z==r| )r r� r� r� r� r r� zRFC3964_IPv4_REJECT: z addr-unreachr; r> r, r� rE )rA re rS rF rd Zfilter_FORWARD� )r� r� )r/ Z _log_deniedrH r� ru )r6 Z daddr_setr� rj r8 r8 r9 �build_rfc3964_ipv4_rulesc s: z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|j | j|j�� |j | j|j�� |j | j|j�� g }|j | j|||||�� |j | j|||||�� |j | j |||||�� |S )Nr* ) rH r rA r r r r r� r� r� )r6 r� r� r� re r� rj r8 r8 r9 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dkr dS dS )Nr� r� �ebTF)r� r� r0 r8 )r6 r� r8 r8 r9 �is_ipv_supported� s znftables.is_ipv_supportedc C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||kr�|| S t td | ��d S ) NZ ipv4_addrZ ipv6_addr)r� r� Z inet_protoZ inet_servicer� ZifnameZ ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz!ipset type name '%s' is not valid)r r )r6 r� rT Zipv_addr�typesr8 r8 r9 �_set_type_list� s" znftables._set_type_listc C s� |r d|kr |d dkr d}nd}t || j||�d�}x0|jd�d jd�D ]}|dkrLd g|d < P qLW |r�d|kr�|d |d< d|kr�|d |d< g }x0dD ](}d|i} | j|� |jdd| ii� q�W |S )NrA �inet6r� r� )re rr rT �:rE �,r- �netr Zintervalr( ZtimeoutZmaxelem�sizer, r. r; r| )r- r7 r )r, r- r. )ru r3 r� r� rH ) r6 rr rT �optionsr� Zset_dict�trj rA Z rule_dictr8 r8 r9 �build_set_create_rules� s* z nftables.build_set_create_rulesc C s$ | j |||�}| j|| jj� � d S )N)r; rm r/ r� )r6 rr rT r9 rj r8 r8 r9 � set_create� s znftables.set_createc C s8 x2dD ]*}dd|t |d�ii}| j|| jj� � qW d S )Nr, r- r. r= r| )rA re rr )r, r- r. )ru ro r/ r� )r6 rr rA r> r8 r8 r9 � set_destroy� s znftables.set_destroyc C s6 | j jj|�jjd�d jd�}g }x�tt|��D ]�}|| dkrr|jdddii� |jdd |rdd nd d �i� q2|| d kr�|jd| j|�|r�dndd �i� q2|| dkr�|jdd|r�dndii� q2|| dkr�|jdddii� q2t d|| ��q2W dt|�dk�rd|in|d |�r&dndd | d �iS ) Nr5 rE r6 r r� rD r� r� Zthr r )r� r� r- r7 r r� r� Zifacer� r� r� z-Unsupported ipset type for match fragment: %srx �concatr z!=z==�@)r r� r� )r- r7 r ) r/ r � get_ipsetrT r� r rK rH r� r )r6 rr Z match_destr � type_formatr �ir8 r8 r9 r� � s$ z nftables._set_match_fragmentc C sN | j jj|�}|jjd�d jd�}|jd�}t|�t|�krHttd��g }�x�tt|��D �]�}|| dk�r,y|| j d�}W n& t k r� |j d� || } Y n,X |j || d |� � || |d d � } y| j d�}W n t k �r |j | � Y n(X |j d| d |� | |d d � gi� q\|| dk�r d|| k�rb|j d|| jd�i� n�y|| j d �}W nL t k �r� || } d |j k�r�|j d d k�r�t | �} |j | � Y n^X || d |� } d |j k�r�|j d d k�r�t | �} |j d| t|| |d d � �d�i� q\|j || � q\W t|�dk�rJd|igS |S )Nr5 rE r6 z+Number of values does not match ipset type.r Ztcp�-r r- r7 r� rA r4 r� )r� rK r> )r- r7 )r/ r r@ rT r� rK r r r rF ri rH r9 r rU ) r6 rr �entry�objrA Z entry_tokensZfragmentrB rF Zport_strr� r8 r8 r9 �_set_entry_fragment� sL ( "z nftables._set_entry_fragmentc C sj g }g }t |ttf�s |g}x |D ]}|j| j||�� q"W x(dD ] }|jdd|t||d�ii� qBW |S )Nr, r- r. r; r� )rA re rr �elem)r, r- r. )r rh �tupler� rF rH ru )r6 rr �entriesrj �elementsr� rA r8 r8 r9 �build_set_add_rules( s z nftables.build_set_add_rulesc C s" | j ||�}| j|| jj� � d S )N)rK rm r/ r� )r6 rr rD rj r8 r8 r9 �set_add7 s znftables.set_addc C sF | j ||�}x4dD ],}dd|t||d�ii}| j|| jj� � qW d S )Nr, r- r. r= r� )rA re rr rG )r, r- r. )rF ru ro r/ r� )r6 rr rD r� rA r> r8 r8 r9 � set_delete; s znftables.set_deletec C s4 g }x*dD ]"}dd|t |d�ii}|j|� q W |S )Nr, r- r. rb r| )rA re rr )r, r- r. )ru rH )r6 rr rj rA r> r8 r8 r9 �build_set_flush_rulesD s z nftables.build_set_flush_rulesc C s | j |�}| j|| jj� � d S )N)rN rm r/ r� )r6 rr rj r8 r8 r9 � set_flushM s znftables.set_flushc C sJ | j jj|�}|jdkr d}n(|jrBd|jkrB|jd dkrBd}nd}|S )Nzhash:macr� rA r4 r. r- )r/ r r@ rT r9 )r6 rr r rA r8 r8 r9 r� Q s znftables._set_get_familyc C s� g }|j | j|||�� |j | j|�� xbtdt|�d�D ]<}|j | j||||d � �� | j|| jj� � |j � q:W | j|| jj� � d S )Nr i� ) r� r; rN r rK rK rm r/ r� �clear)r6 Zset_nameZ type_namerI Zcreate_optionsZ entry_optionsrj rB r8 r8 r9 � set_restore^ s znftables.set_restore)N)N)r� )r, )Fr, )r, )r, )F)NN)NN)NN)NN)N)N)N)N)N)N)F)N)N)F)NN)J�__name__� __module__� __qualname__rr Zpolicies_supportedr: rN rR r[ ra rm ro rq rs rw rt r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r r r r" r% r' r* r. r/ r1 r3 r; r< r= r� rF rK rL rM rN rO r� rQ r8 r8 r8 r9 r+ T s� /.` 4 R i ; - 9 + $ $ $ ' $ < # 4 r+ ij���i����))Z __future__r rO r^ r� Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r r r r r r Zfirewall.core.richr r r r r r r Zfirewall.core.icmpr r Znftables.nftablesr ru r� r� r� rp �objectr+ r8 r8 r8 r9 �<module> s, $$