/
lib
/
python3.9
/
site-packages
/
firewall
/
core
/
__pycache__
/
Upload File
HOME
a ��is � @ s` d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z mZmZ d dl mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZmZmZmZ d dlm Z d dl!m"Z"m#Z# d d l$m%Z% d Z&e&d d Z'e&d d Z(dZ)dZ*i ddde* fidde* fdde* fdde* fd�dd e* fdd e* fdd e* fdd e* fd�d�Z+G dd� de,�Z-dS )� )�GLibN)�log)� check_mac�getPortRange�normalizeIP6�check_single_address� check_address)� FirewallError� UNKNOWN_ERROR�INVALID_RULE�INVALID_ICMPTYPE�INVALID_TYPE� INVALID_ENTRY�INVALID_PORT) �Rich_Accept�Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp� Rich_NFLog)�DEFAULT_ZONE_TARGET)� ICMP_TYPES�ICMPV6_TYPES)�NftablesZ firewalld�_Zpolicy_dropZprobeZpolicy_� � PREROUTING� preroutingij���i����Zpostrouting�d �output)r �POSTROUTING�OUTPUT�inputZforward)r �INPUT�FORWARDr$ )�raw�mangle�nat�filterc @ sr e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd d� Z dd � Z dd� Zdd� Zdd� Z d�dd�Zdd� Zdd� Zdd� Zdd� Zdd � Zd�d!d"�Zd#d$� Zd�d&d'�Zd(d)� Zd*d+� Zd�d-d.�Zd/d0� Zd1d2� Zd3d4� Zd5d6� Zd7d8� Zd9d:� Zd;d<� Z d=d>� Z!d?d@� Z"dAdB� Z#dCdD� Z$dEdF� Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)d�dOdP�Z*dQdR� Z+dSdT� Z,dUdV� Z-dWdX� Z.d�dYdZ�Z/d�d[d\�Z0d�d]d^�Z1d�d_d`�Z2dadb� Z3d�dcdd�Z4d�dedf�Z5d�dgdh�Z6d�didj�Z7dkdl� Z8d�dmdn�Z9dodp� Z:d�dqdr�Z;dsdt� Z<dudv� Z=dwdx� Z>dydz� Z?d�d{d|�Z@d�d}d~�ZAdd�� ZBd�d�d��ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKdS )��nftablesTc C sZ || _ d| _d| _g | _i | _i | _i | _i | _i | _t � | _ | j �d� | j �d� d S )NTF) �_fwZrestore_command_exists�supports_table_ownerZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cacher r, �set_echo_outputZset_handle_output)�self�fw� r7 �:/usr/lib/python3.9/site-packages/firewall/core/nftables.py�__init__\ s znftables.__init__c C s z�ddddiidddt dd gd �iigi}| j�|�\}}}|rHtd��ddddiidddt d �iigi}| j�d� | j�|�\}}}| j�d� |d d d d }| �dddt d �ii| j�� � d|vs�d |vr�td��t� d� d| _ W n t� d� d| _ Y n0 d S )Nr, �metainfo�json_schema_version� �add�table�inet�owner�persist)�family�name�flagsz!nftables probe table owner failed�list�rB rC FTrD �deletez3nftables: probe_support(): owner flag is supported.z7nftables: probe_support(): owner flag is NOT supported.)�TABLE_NAME_PROBEr, �json_cmd� ValueErrorr4 �set_ruler- �get_log_deniedr �debug2r. )r5 �rules�rcr"