/
lib
/
python3.9
/
site-packages
/
firewall
/
core
/
__pycache__
/
Upload File
HOME
a ��i� � @ sD d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZmZ d dlmZmZm Z m Z m Z m Z m Z m!Z!m"Z" d dl#m$Z$ d d l%m&Z&m'Z' d dl(Z(d Z)g d �d d gg d�g d�g d �d�Z*ddd�Z+ddd�Z,dd� Z-dd� Z.dd� Z/G d d � d e0�Z1G d d � d e1�Z2dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR�INVALID_ICMPTYPE) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_NFLog�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp)�DEFAULT_ZONE_TARGET)� ICMP_TYPES� ICMPV6_TYPES� )�INPUT�OUTPUT�FORWARD� PREROUTINGr! )r# � POSTROUTINGr r! r" )r# r$ r! )�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited��ipv4�ipv6�icmp� ipv6-icmpc C s� ddddddd�}| dd� }|D ]t}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< q"|S ) z Inverse valid rule �-D�--delete�-X�--delete-chain��-A�--append�-I�--insert�-Nz --new-chainN�r6 r7 � )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� rD �;/usr/lib/python3.9/site-packages/firewall/core/ipXtables.py�common_reverse_rule< s* � rF c C s� ddddddd�}| dd� }|D ]z}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< | S ttd ��dS ) z Reverse valid passthough rule r/ r0 r1 r2 r3 Nr9 r: �no '-A', '-I' or '-N' arg)r; � ValueErrorr= r> r r )r? r@ rA �xrC rD rD rE �common_reverse_passthrougha s0 � �rJ c C sh t | �} t g d��}t| |@ �dkr>ttdt| |@ �d ��t g d��}t| |@ �dkrdttd��dS )zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) )z-Cz--checkr/ r0 z-Rz --replace�-Lz--listz-Sz --list-rules�-Fz--flush�-Zz--zeror1 r2 �-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedr3 rG N)�set�lenr r �list)r? Z not_allowedZneededrD rD rE �common_check_passthrough� s �� �rR c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdld"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdmd,d-�Zd.d/� Zdnd1d2�Z d3d4� Z d5d6� Z dod8d9�Z dpd:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dqdRdS�Z,drdTdU�Z-dsdVdW�Z.dtdXdY�Z/dZd[� Z0dud\d]�Z1dvd^d_�Z2dwd`da�Z3dbdc� Z4dxddde�Z5dfdg� Z6dhdi� Z7djdk� Z8d!S )y� ip4tablesr+ Tc C sd || _ tj| j | _tjd| j | _| �� | _| �� | _ | � � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwrD rD rE �__init__� s zip4tables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsrV Zcommand_existsrW Zrestore_command_exists�rb rD rD rE r\ � s zip4tables.fill_existsc C s� | j r(| j |vr(| j gdd� |D � }ndd� |D �}t�d| j| jd�|�� t| j|�\}}|dkr�td| jd�|�|f ��|S )Nc S s g | ] }d | �qS ��%srD ��.0�itemrD rD rE � <listcomp>� � z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS rj rD rl rD rD rE ro � rp � %s: %s %s� r �'%s %s' failed: %s)rY r �debug2� __class__rV �joinr rH )rb r? �_args�status�retrD rD rE Z__run� s �zip4tables.__runc C s< z|� |�}W n ty" Y dS 0 ||||d �< dS d S )NF� T)r; rH )rb �rule�patternZ replacement�irD rD rE � _rule_replace� s zip4tables._rule_replacec C s |t v o|t | v S re )�BUILT_IN_CHAINS)rb rU �table�chainrD rD rE �is_chain_builtin� s �zip4tables.is_chain_builtinc C s2 d|g}|r|� d� n |� d� |� |� |gS )N�-tr8 r1 )�append)rb �addr� r� r{ rD rD rE �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nr� r6 r/ )�str)rb r� r� r� r; r? r{ rD rD rE � build_rule� s zip4tables.build_rulec C s t |�S re )rF �rb r? rD rD rE � reverse_rule� s zip4tables.reverse_rulec C s t |� d S re )rR r� rD rD rE �check_passthrough� s zip4tables.check_passthroughc C s t |�S re )rJ r� rD rD rE �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}z|� d�}W n ty$ Y n 0 t|�|d krB||d }d }dD ]B}z|� |�}W n tyn Y qJ0 t|�|d krJ||d }qJ||fS )Nr) r� rz r3 )r; rH rP )rb r? r� r} r� �optrD rD rE � passthrough_parse_table_chain� s z'ip4tables.passthrough_parse_table_chainc C s zH|� d�}|�|� |�|�}d|d kr:||d f}n ||d f}W nF ty� z |� d�}|�|� d }W n ty� Y Y d S 0 Y n0 d}|d d v r�d }|r�|s�||v r�|�|� n\|�r |r�||vr�|�|� |jd d � d � |� |�}nt|�}d|d< |�dd|d � d S )N�%%ZONE_SOURCE%%�-m� � � �%%ZONE_INTERFACE%%Tr �r/ r0 Fc S s | d S )Nr rD )rI rD rD rE �<lambda>) rp z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyr6 r: �%drz )r; r> rH �remover� �sortrP �insert)rb r{ r` r} �zoneZ zone_source�rule_addr; rD rD rE �_run_replace_zone_source s: z"ip4tables._run_replace_zone_sourcec C s z|� |�}W n ty" Y �n�0 d}d}d}|�|� |�|�}t|�tkrZttd��d} dD ]B} z|� | �} W n ty� Y qb0 t|�| d krb|| d } qbdD ]Z} z|� | �}W n ty� Y q�0 t|�|d kr�||d } | d v r�d}| d v r�d}q�| | f} |�s^| |v�s>||| v�s>|| | d k�rHttd ��|| | d8 < n�| |v�rpi || < ||| v�r�d || |< d} t || � � �D ]<}||k�r�|�r� �q�| || | 7 } ||k�r� �qܐq�|| | d7 < d ||< |� |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TF���z%priority must be followed by a numberr) �r� z--tablerz )r4 r5 r6 r7 r/ r0 r9 r� r z*nonexistent or underflow of priority countr6 r: r� N) r; rH r> �typer= r r rP r �sorted�keysr� )rb r{ Zpriority_counts�tokenr} r� r� Zinsert_add_index�priorityr� r� �jr� r; �prD rD rE �_set_rule_replace_priority2 sj �� z$ip4tables._set_rule_replace_priorityc C s t � }i }t�| j�}t�| j�}t�| j�}|D �]x}|d d � } | �| dddt| j g� | �| dt | j g� z| � d�} W n t y� Y n80 |dkr�q2|dv r�dd d |g| | | d �< n | � | � | � | |d � | � | |d � | �| |� d} dD ]L} z| � | �} W n t �y" Y q�0 t| �| d kr�| � | � | � | �} q�t| �D ]F\} } tjD ]4}|| v �r`| �d��r�| �d��s`d| | | < �q`�qR|�| g ��| � q2|D ]F} || }|�d| � |D ]} |�d�| �d � �q�|�d� �q�|�� t�|j �}t � d| j | j d|j |j!f � g }| j"�rF|�| j"� |�d� t#| j ||j d�\}}t �$� dk�r�t%|j �}|d u�r�d } |D ]@}t j&d| |f d d d � |�d��s�t j&d d d � | d 7 } �q�t�'|j � |d k�rt d | j d�|�|f ��|| _|| _|| _d S )!N� %%REJECT%%�REJECT� --reject-with�%%ICMP%%� %%LOGTYPE%%�off��unicast� broadcastZ multicastr� �pkttype� --pkt-typerz �%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%r) r� �"z"%s"z*%s rr � zCOMMIT rq z%s: %d�-n��stdinr: z%8d: %sr )�nofmt�nlr )r� rs )(r �copy�deepcopyr^ r_ r` r~ �DEFAULT_REJECT_TYPErU �ICMPr; rH r> r� r� rP � enumerate�stringZ whitespace� startswith�endswith� setdefaultr� �writerv �closerf �stat�namer rt ru rW �st_sizer[ r ZgetDebugLogLevelr �debug3�unlink)rb �rules� log_denied� temp_fileZ table_rulesr^ r_ r` Z_ruler{ r} r� r� �element�cr� r? rx ry �lines�linerD rD rE � set_rules� s� � � � � �zip4tables.set_rulesc C s� | � |dddt| j g� | � |dt| j g� z|�d�}W n tyP Y n:0 |dkr^dS |dv r�d d d |g|||d �< n |�|� t�| j �}t�| j �}t�| j �}| � ||d � | � ||d� | � ||� | �|�}|| _ || _ || _ |S )Nr� r� r� r� r� r� r r� r� r� r� rz r� r� )r~ r� rU r� r; rH r> r� r� r^ r_ r` r� r� �_ip4tables__run)rb r{ r� r} r^ r_ r` �outputrD rD rE �set_rule� s0 � zip4tables.set_ruleNc C s� g }|r|gnt �� }|D ]n}|| jv r4|�|� qz,| �d|ddg� | j�|� |�|� W q ty� t�d| j|f � Y q0 q|S )Nr� rK r� zA%s table '%s' does not exist (or not enough permission to check).) r r� r] r� r� rH r Zdebug1rU )rb r� ry ZtablesrD rD rE �get_available_tables s z ip4tables.get_available_tablesc C s� d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t�d | j| j|� |S ) Nr )�-wrK r� �7%s: %s: probe for wait option (%s): ret=%u, output="%s"r� r rz )�-w10rK r� r� � %s: %s will be using %s option.)r rV r r� ru rt )rb rY ry rD rD rE rX s z ip4tables._detect_wait_optionc C s� t � }|�d� |�� d}dD ]d}t| j|g|jd�}t�d| j| j ||d |d � |d dkr d|d vr d |d vr |} q�q t� d | j| j|� t � |j� |S ) Nz#foor )r� z--wait=2r� r� r rz zinvalid optionzunrecognized optionr� ) r r� r� r rW r� r r� ru rV rt rf r� )rb r� rY Z test_optionry rD rD rE rZ $ s � z%ip4tables._detect_restore_wait_optionc C sN i | _ i | _g | _g }t�� D ]*}| �|�s.q dD ]}|�d||g� q2q |S )N)rL r1 rM r� )r^ r_ r` r r� r� r� )rb r� r� �flagrD rD rE �build_flush_rules8 s zip4tables.build_flush_rulesc C s� g }|dkrdn|}t �� D ]t}| �|�s,q |dkr6q t | D ]P}|dkrv|| }|dkrz|�d|d|ddg� d}n|}|�d|d ||g� q>q |S ) NZPANIC�DROPr( r) r� r� r4 �-jrN )r r� r� r� )rb �policyZpolicy_detailsr� �_policyr� r� r� rD rD rE �build_set_policy_rulesG s z ip4tables.build_set_policy_rulesc C sN t � }|d u s| jdkr&|�t�� � |d u s8| jdkrF|�t�� � t|�S )Nr+ r, )rO rU �updater r� r rQ )rb rU Z supportedrD rD rE �supported_icmp_typesZ s z ip4tables.supported_icmp_typesc C s g S re rD ri rD rD rE �build_default_tablesd s z ip4tables.build_default_tablesr� c C s� i }| � d�rlg |d< t� | jd< td D ]@}|d �d| � |d �d||f � | jd �d| � q*| � d��r@g |d< t� | jd< td D ]�}|d �d| � |d �d||f � | jd �d| � |dkr�dD ]8}|d �d||f � | jd �td ||f g�� q�d D ] }|d �d |||f � �q q�| � d ��rg |d < t� | jd < td D ]�}|d �d| � |d �d||f � | jd �d| � |dk�rhdD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q��qh| � d ��rPg |d < t� | jd < td D �] }|d �d| � |d �d||f � | jd �d| � |dv �r�dD ]R}|d �d||f � | jd �td ||f g�� |d �d |||f � �q�nddD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q,�qBg |d< t� | jd< |d �d� |d �d� |dk�r�|d �d� |d �d� |d �d� |d �d� | jd �td�� dD ]0}|d �d| � | jd �td| �� �q�d D ]}|d �d| � �q|dk�rB|d �d � |d �d � |d �d � |d �d � |dk�r�|d �d � |d �d!� |d �d"� |d �d#� | jd �td$�� d%D ]0}|d �d&| � | jd �td'| �� �q�d D ]B}|d �d&| � |d �d(| � | jd �td'| �� �q�d)D ]0}|d �d&| � | jd �td'| �� �qD|dk�r�|d �d*� |d �d+� |d g d,�7 < | jd �td-�� d%D ]B}|d �d.| � |d �d/| � | jd �td0| �� �q�d)D ]B}|d �d.| � |d �d/| � | jd �td0| �� �qg }|D ]>}|| � � v�rr�q\|| D ] }|�d1|gt|� � �qz�q\|S )2Nr% z -N %s_directz-A %s -j %s_directz %s_directr& r# )� POLICIES_pre�ZONES� POLICIES_postz-N %s_%s�%s_%s)r� z-A %s -j %s_%sr' r( )r! )r� r� r) zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_direct)r� z -N FORWARD_%sz FORWARD_%sz-A FORWARD -j FORWARD_%s)r� z;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sr� )r� rO ra r r� r� r� r )rb r� Z default_rulesr� Zdispatch_suffixZfinal_default_rulesr� r{ rD rD rE �build_default_rulesh s� " " z ip4tables.build_default_rulesc C sd |dkrddhS |dkr*d| � � v r*dhS |dkrFd| � � v rFddhS |dkr`d| � � v r`dhS i S ) Nr) r r" r' r# r( r$ r& )r� )rb r� rD rD rE �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j j�|���jdk r dnd��dkr4�dkr4dnd} | j j�|�t| �� g } g } |D ]} | �d| g� qX|D ]} | �d | g� qp|D ]8} | j j�| �}|d v r�| � |�s�q�| �| � d | �� q�|D ]J} | j j�| �}|d v r�| � |�s�q�t | �r��d v r�q�| �| � d | �� qƇ �����fdd�}g }| �r|| D ]B}| �r^| D ]}|�|||�� �qDn|�rfn|�||d �� �q6nD|�r�n<| �r�| D ]}|�|d |�� �q�n|�r�n|�|d d �� |S )Nr �pre�postr( r$ TF�-i�-or* �-s�r$ r" r! �-dc sV ddd�� }d�|d��f d�j g}| r6|�| � |rD|�|� |�d� g� |S )Nr4 r/ �TFr� z%s_POLICIES_%sr� r� )r� �extend)�ingress_fragment�egress_fragment�add_delr{ �r� r� � chain_suffix�enable�p_objr� rD rE � _generate_policy_dispatch_rule s � zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rT r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r� � check_source�is_ipv_supported�_rule_addr_fragmentr )rb r� r� r� r� Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrU r� r� r� r� rD r� rE �!build_policy_ingress_egress_rules� sR z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr|dkrdnd}| j jj||t|d�} dddddd�| } d } |r^|s^d d | d g} n,|rpd d | g} ndd | g} |s�| d g7 } | d|| || | g7 } | gS )Nr( r$ TF�r r� r� �r# r$ r r" r! �-gr6 �%s_ZONESr� r4 r/ r� )rT r� r� r ) rb r� r� r� r r� r� r� r r� r� �actionr{ rD rD rE �!build_zone_source_interface_rulesE s( �� z+ip4tables.build_zone_source_interface_rulesc C s� |� d�rP|dd � }|dkr$d}nd}d�|g| jj�|� �}ddd ||gS t|�rz|dkrjttd ��dd d |�� gS t d |�r�t |�}n,t d |�r�|� d�}t |d �d |d }||gS d S )Nzipset:� r� �dst�src�,r� rO � --match-setz Can't match a destination MAC.�mac� --mac-sourcer, �/r rz ) r� rv rT �ipsetZ get_dimensionr r r �upperr r r �split)rb r� �address�invertr� �flags� addr_splitrD rD rE r ^ s" z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d d d d d �| } t|�rd|d v rdg S |d | d|d|g} | �| �| |�� | �d| g� | gS )Nr6 r/ r� r( r$ TFr r� r� r r� r r� r� r )rT r� r� r r r� r ) rb r� r� r� r r� r� r� r r� r� r{ rD rD rE � build_zone_source_address_rulest s" �� z)ip4tables.build_zone_source_address_rulesc C s� ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d �}| j j�|�} | j| �t|d | d | d | d| d| g�� g } | �||d|g� | �|d | d|g� | �|d | d|g� | �|d | d|g� | �|d| d|g� | �|d| d|g� | j �r6| �||d|dd|df g� | �||d|dd | g� | �||d|dd | g� | �||d|dd | g� | �||d|dd| g� | �||d|dd| g� | j �r�| �||d|dd|df g� | j jj | j } | j � � dk�rb|dk�rb| t ddfv �r8| �||d|ddddd | g � | d k�rb| �||d|ddddd | g � |dk�r�| t d ddd fv �r�| t fv �r�d} n| } | �||d|d| g� |�s�| �� | S ) Nr8 r1 r� r4 r/ r( r$ TFr z%s_log�%s_denyz%s_prez%s_post�%s_allowr� r� r� r� r� r� r) r� r� r� �LOG� --log-prefixz %s_REJECT: r� z %s_DROP: �ACCEPT)rT r� r� r r� ra r� rO r� Zderived_from_zoneZ _policies�target�get_log_deniedr �reverse) rb r� r� r� r� Z add_del_chainZ add_del_ruler r� r� r� r# �_targetrD rD rE �build_policy_chain_rules� sf � � � � z"ip4tables.build_policy_chain_rulesc C s |rddd|j gS g S )Nr� �limitz--limit)�value)rb r( rD rD rE � _rule_limit� s zip4tables._rule_limitc C s� t |j�ttttfv rn<|jrJt |j�ttt t fvrTt t dt |j� ��n t t d��|j dkr�t |j�tttfv s�t |j�tt fv r�dS t |j�tfv s�t |j�tt fv r�dS n|j dk r�dS dS d S )N�Unknown action %szNo rule action specified.r �allowZdenyr� r� )r� r� r r r r r r r r r r r r� �rb � rich_rulerD rD rE �_rich_rule_chain_suffix� s$ �� z!ip4tables._rich_rule_chain_suffixc C s: |j s|jsttd��|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� r- rD rD rE � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr r� )r� r- rD rD rE � _rich_rule_priority_fragment� s z&ip4tables._rich_rule_priority_fragmentc C s" |j s g S | jj�||t�}ddd�| }| �|�}d||d||f g} | | �|�7 } t|j �tkr�| |ddg 7 } |j j r�| d|j j g7 } |j j r�| d d |j j g7 } |j j r�| d |j j g7 } nJ| |dd g 7 } |j j r�| d d |j j g7 } |j j �r | dd |j j g7 } | | � |j j�7 } | S )Nr4 r/ r� r� r� r� ZNFLOGz --nflog-groupz--nflog-prefixrk z--nflog-thresholdr r! z --log-level)r rT r� r� r r1 r2 r� r �group�prefixZ threshold�levelr* r( ) rb r� r. r� r� � rule_fragmentr� r� r� r{ rD rD rE �_rich_rule_log� s, zip4tables._rich_rule_logc C s� |j s g S ddd�| }| jj�||t�}| �|�}d||d||f g} | | �|�7 } | |7 } t|j�t krrd} n,t|j�t kr�d} nt|j�t kr�d} nd } | d d d | g7 } | | � |j j �7 } | S ) Nr4 r/ r� r� r� ZacceptZrejectZdrop�unknownr� ZAUDITz--type)r0 rT r� r� r r1 r2 r� r r r r r* r( ) rb r� r. r� r� r6 r� r� r� r{ �_typerD rD rE �_rich_rule_audit s$ zip4tables._rich_rule_auditc C s2 |j s g S ddd�| }| jj�||t�}| �|�}d||f } t|j �tkrXddg} n�t|j �tkr�ddg} |j jr�| d|j jg7 } nnt|j �t kr�dd g} nVt|j �t kr�d }| jj�||t�}d||f } dd d |j j g} nt t d t|j � ��d||| g} | | �|�7 } | || 7 } | | �|j j�7 } | S )Nr4 r/ r� r� r� r" r� r� r� r' �MARKz --set-xmarkr+ r� )r rT r� r� r r/ r� r r r r rO r r r2 r* r( ) rb r� r. r� r� r6 r� r� r� r� Z rule_actionr{ rD rD rE �_rich_rule_action& s6 � zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }q�td|j �r||j �d�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|�d� | jj � |jd �}|d |j|g7 }|S ) N�!r, r� r r rz r� rO r r ) r r r� r r r r r rT r� �_ipset_match_flags)rb Z rich_destr6 r r rD rD rE � _rich_rule_destination_fragmentH s& " z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }nHtd|j �r||j �d�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|�d� |d |jg7 }nRt|d ��r|j �r|dd g7 }|jr�|�d� | j j � |j d �}|d |j |g7 }|S )Nr= r, r� r r rz r r� r r rO r r ) r r r� r r r r �hasattrr r rT r� r> )rb Z rich_sourcer6 r r rD rD rE �_rich_rule_source_fragment` s0 " z$ip4tables._rich_rule_source_fragmentc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr4 r/ r� r) �-p�--dportrk r� r r� r� r" � rT r� r� r r r? � destinationrA �sourcer� r7 r: r< � rb r� r� �proto�portrE r. r� r� r� r6 r� rD rD rE �build_policy_ports_rules} s, ��z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j j�||t�}d|g} |r<| d|g7 } |r`| | �|j�7 } | | �|j�7 } g } |r�| �| � ||||| �� | �| � ||||| �� | �| � ||||| �� n"| �|d| d|g| d d g � | S ) Nr4 r/ r� r) rB r� r r� r� r" ) rT r� r� r r? rE rA rF r� r7 r: r< ) rb r� r� �protocolrE r. r� r� r� r6 r� rD rD rE �build_policy_protocol_rules� s( ��z%ip4tables.build_policy_protocol_rulesc C s� d}d}| j j�||t�}ddd�| } g d�} |rl| �|�}| | �|�7 } | | �|j�7 } | | �|j �7 } |dks||d u r�| g d�7 } n| d d d |g7 } d d| d ||f g| gS )Nr, r) r4 r/ r� )rB Ztcpz --tcp-flagszSYN,RSTZSYNZpmtu)r� �TCPMSSz--clamp-mss-to-pmtur� rM z --set-mssr� r� ) rT r� r� r r/ r2 r? rE rA rF ) rb r� r� Ztcp_mss_clamp_valuerE r. r� r� r� r� r6 rD rD rE � build_policy_tcp_mss_clamp_rules� s z*ip4tables.build_policy_tcp_mss_clamp_rulesc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr4 r/ r� r) rB z--sportrk r� r r� r� r" rD rG rD rD rE � build_policy_source_ports_rules� s, ��z)ip4tables.build_policy_source_ports_rulesc C sv d}| j j�||t�} ddd�| } | d| ddd|g} |rP| dd t|� g7 } |r`| d |g7 } | d d d |g7 } | gS )Nr& r4 r/ r� r r� rB rC rk r� r� ZCTz--helper)rT r� r� r r ) rb r� r� rH rI rE Z helper_nameZmodule_short_namer� r� r� r{ rD rD rE � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |rH| �dd|d| d|dd g� n6t|�rTg S | �dd|d| g| �d |� dd g � | S ) Nr4 r/ r� r� r) r r� r� r" r� )rT r� r� r r� r r ) rb r� r� r� r� r rF r� r� r� rD rD rE �build_zone_forward_rules� s � ��z"ip4tables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|rj| �|�}|| �|�7 }|| �|j�7 }|| �|j �7 }nd}g } | � dd|d ||f g| g d � � | S ) Nr( Tr r4 r/ r� r, r� r� )r= r� �lor� Z MASQUERADE) rT r� r� r r/ r2 r? rE rA rF r� ) rb r� r� r. r� r� r� r6 r� r� rD rD rE � build_policy_masquerade_rules� s" ��z'ip4tables.build_policy_masquerade_rulesc C s d}| j j�||t�} ddd�| } d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| �|�} | �|�} | | � |j �7 } | | � |j �7 } nd } g }|r�|� | �|||d| �� |� d d| d | | f g| d |dt|�ddd| g � |S )Nr( r4 r/ r� r r, z[%s]z:%s�-r, r� r� rB rC r� ZDNATz--to-destination)rT r� r� r r r r r/ r2 r? rE rA rF r� r7 )rb r� r� rI rK ZtoportZtoaddrr. r� r� r� �tor6 r� r� rD rD rE � build_policy_forward_port_rules s8 � ��z)ip4tables.build_policy_forward_port_rulesc C s� | j dkrL|tv rLt| \}}}|r,t|�nt|�d t|� }ddd|gS | j dkr�|tv r�t| \}}}|rxt|�nt|�d t|� }ddd|gS ttd |� d | j� ���d S ) Nr+ r r� r- z --icmp-typer, Zicmp6z --icmpv6-typez ICMP type z not supported by )rU r r� r r r r� )rb Z icmp_typer9 �_codeZ _omit_codeZ _type_strrD rD rE �_icmp_types_fragment4 s �z ip4tables._icmp_types_fragmentc C s� d}| j j�||t�}ddd�| }| jdkrDddg}| �|j�} nddg}| �|j�} g } | j j�|�rxd | } d } n d | } d } g } |r�| | �|j �7 } | | � |j �7 } | || 7 } |�rL| � | � ||||| �� | � | �||||| �� |j�r| � | �||||| �� n:| �|�}| � d ||d||f g| �|� | dd g � n`| j �� dk�r�| d k�r�| � || d |g| ddddd| g � | � || d |g| d| g � | S )Nr) r4 r/ r� r+ rB r- r. r r" r r� r� r� r� r� r� r r! �%s_ICMP_BLOCK: )rT r� r� r rU rX r� �query_icmp_block_inversionr? rE rA rF r� r7 r: r r< r/ r2 r$ )rb r� r� Zictr. r� r� r� rH �matchr� Z final_chainZ final_targetr6 r� rD rD rE � build_policy_icmp_block_rulesB s\ ��������z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }d}| j j�|�r�d}| j �� dkr�|rRd|t|�g}nd|g}|d|dd d d d d d| g }|�|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|�|� |S )Nr) � r� r� r6 r/ r� rB r� r� r� r r! rY rz r" )rT r� r� r rZ r$ r� r� ) rb r� r� r� r� r� Zrule_idxZ ibi_targetr{ rD rD rE �'build_policy_icmp_block_inversion_ruless s0 � z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| � |j�7 }|| �|j�7 }g }|�| �|||||�� |�| �|||||�� |�| �|||||�� |S )Nr) )r? rE rA rF r� r7 r: r< )rb r� r� r. r� r6 r� rD rD rE �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS re )rU )rb rU rD rD rE r � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)NN)N)N)N)9�__name__� __module__� __qualname__rU r� Zpolicies_supportedrd r\ r� r~ r� r� r� r� r� r� r� r� r� r� r� r� rX rZ r� r� r� r� r� r� r r r r r' r* r/ r1 r2 r7 r: r< r? rA rJ rL rN rO rP rQ rS rV rX r\ r^ r_ r rD rD rD rE rS � st &Pa# N � 9 " � � " 1"rS c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr, Fc C s~ g }g d�}| j jdkr"|dg7 }|�g d�| ddg � |dkr^|�g d�| g d� � |�g d �� |�g d �� |S ) N)r� Zrpfilterz--invertz --validmarkZloosez--loose)r6 r# r� r' r� r� r� )r� r r! zrpfilter_DROP: ) r6 r# r� r' rB r. z$--icmpv6-type=neighbour-solicitationr� r" ) r6 r# r� r' rB r. z"--icmpv6-type=router-advertisementr� r" )rT Z_ipv6_rpfilterr� )rb r� r� Zrpfilter_fragmentrD rD rE �build_rpfilter_rules� s$ �� ��z ip6tables.build_rpfilter_rulesc C s� g d�}d}| j d �|� g }|�ddd|g� |D ]L}|�ddd|d|dd d d g � | jjd v r6|�ddd|d|dd ddg � q6|�dddddd|g� |�dddd| j�� dkr�dndd|g� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r) r� r8 r6 r� r� r� r� z addr-unreach)r� �allr r! zRFC3964_IPv4_REJECT: r! �4r" r� �6�5)ra r� r� rT Z _log_deniedr$ )rb Z daddr_listZ chain_namer� ZdaddrrD rD rE �build_rfc3964_ipv4_rules� s. � �� �z"ip6tables.build_rfc3964_ipv4_rulesN)F)r` ra rb rU r� rd ri rD rD rD rE rc � s rc )3Zos.pathrf r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r Zfirewallr Zfirewall.errorsr r r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser Zfirewall.core.icmpr r r� r r r� r� rF rJ rR �objectrS rc rD rD rD rE �<module> sL ( , � ��%*