????
Your IP : 216.73.216.152
�
`q^c @ sr d d l Z d d l m Z m Z d d l m Z d d l m Z d d l m
Z
m Z m Z m
Z
m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z m Z d Z d
Z i i d d e f d
6d 6i d d e f d
6d 6i d d e f d
6d d e f d 6d 6i d d e f d 6d d e f d 6d 6Z i i d 6i d 6i d 6Z i i" d d d! d d" d# g d$ 6d d d! g d! 6d d d% g d% 6d d d& g d& 6d d d! d d" d' g d( 6d d d! d d" d) g d* 6d d d! d d" d+ g d, 6d d d- d d" d. g d/ 6d d d! d d" d0 g d1 6d d d! d d" d. g d2 6d d d3 d d" d. g d4 6d d d! d d" d5 g d6 6d d d- d d" d7 g d8 6d d d! d d" d9 g d: 6d d d! d d" d7 g d; 6d d d3 g d3 6d d d! d d" d< g d= 6d d d! d d" d> g d? 6d d d! d d" d@ g dA 6d d d- g d- 6d d d3 d d" d. g dB 6d d dC g dC 6d d dD g dD 6d d dE g dE 6d d d! d d" dF g dG 6d d dH g dH 6d d dI g dI 6d d dJ g dJ 6d d d- d d" d< g dK 6d d d! d d" dL g dM 6d d d- d d" d@ g dN 6d d d! d d" dO g dP 6d d dH d d" d. g dQ 6d d dH d d" d7 g dR 6dS 6i dT d d! dT d" d< g dU 6dT d d3 dT d" d7 g dV 6dT d d! dT d" d@ g dW 6dT d d! dT d" d. g d$ 6dT d d! g d! 6dT d d% g d% 6dT d d& g d& 6dT d d! dT d" dF g dX 6dT d dY g dZ 6dT d d[ g d\ 6dT d d! dT d" d7 g d] 6dT d d^ g d^ 6dT d d3 g d3 6dT d d! dT d" d' g d= 6dT d d_ g d- 6dT d d! dT d" d9 g d` 6dT d da g dC 6dT d db g dD 6dT d dH g dH 6dT d dH dT d" d. g dQ 6dT d dH dT d" d7 g dR 6dT d d3 dT d" d. g dc 6dT d d3 dT d" d@ g dd 6de 6Z! df e" f dg � � YZ# d S(h i����N( t SHORTCUTSt DEFAULT_ZONE_TARGET( t runProg( t log( t splitArgst check_mact portStrt check_single_addresst
check_address( t config( t
FirewallErrort
UNKNOWN_ERRORt INVALID_RULEt INVALID_ICMPTYPEt INVALID_TYPEt
INVALID_ENTRY( t Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_Markt firewalldi
t
preroutingi���t
PREROUTINGt rawij���t manglei����t postroutingid t POSTROUTINGt natt inputi t INPUTt forwardt FORWARDt filtert inett ipt ip6t icmpt types destination-unreachablet codet 13s communication-prohibiteds
echo-replys echo-requestt 4s fragmentation-neededt 14s host-precedence-violationt 10s host-prohibitedt redirectt 1s
host-redirectt 7s host-unknowns host-unreachables parameter-problems
ip-header-badt 8s network-prohibitedt 0s network-redirectt 6s network-unknowns network-unreachablet 3s port-unreachablet 15s precedence-cutofft 2s protocol-unreachables required-option-missings router-advertisements router-solicitations
source-quencht 5s source-route-faileds
time-exceededs timestamp-replys timestamp-requests tos-host-redirectt 12s tos-host-unreachables tos-network-redirectt 11s tos-network-unreachables ttl-zero-during-reassemblys ttl-zero-during-transitt ipv4t icmpv6s address-unreachables
bad-headers beyond-scopes
failed-policys nd-neighbor-adverts neighbour-advertisements nd-neighbor-solicits neighbour-solicitations no-routes packet-too-bigs nd-redirects reject-routes nd-router-adverts nd-router-solicits unknown-header-types unknown-optiont ipv6t nftablesc B s� e Z d Z e Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d2 d � Z
d � Z d
� Z d � Z d � Z d
d � Z d � Z e d d � Z d d � Z d d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d2 d2 d � Z d2 d2 d � Z! d2 d2 d � Z" d � Z# d2 d � Z$ d2 d! � Z% d" � Z& d2 d# � Z' d$ � Z( d2 d% � Z) d& � Z* e d' � Z+ d( � Z, d) � Z- d* � Z. d2 d+ � Z/ d, � Z0 d- � Z1 d. � Z2 d/ � Z3 d0 � Z4 d1 � Z5 RS(3 R: c C sB | | _ t j d | _ | j � g | _ i | _ i | _ d S( Nt nft( t _fwR t COMMANDSt _commandt fill_existst available_tablest rule_to_handlet rule_ref_count( t selft fw( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __init__� s
c C s% t j j | j � | _ t | _ d S( N( t ost patht existsR> t command_existst Falset restore_command_exists( RC ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR? � s c
C sn d d g } | } | d d k rs | d d k rs | } d | d <t | j | | � \ } } | d k rs d Sn d } | d d k r | d d k r t } | d } | d
d k r y t | d � Wn t k
r� t t d � � q X| j d
� | j d
� n d j | � } nj | d d k r�| d d k r�t
} | d } d j | � } d d g | d d !d | j | g } n d j | � } | | j k re| r�| j | c d 7<d S| r�| j | d k r�| j | c d 8<d S| j | d k r | j | c d 8<n t t
d | | j | f � � t j d | j | j | | j | � n | s�| r�| j | d k s�| rj| | j k rjt j d | j | j | � t | j | | � \ } } | d k r�t d | j | | f � � n | rj| rPd }
| j |
� t |
� } | | j � | j | <d | j | <qg| j | =| j | =qjn | S( Ns --echos --handlei t deletei t tablet listt t addt insertt rulei i t positioni s position without a numbert i t handles) rule ref count bug: rule_key '%s', cnt %ds %s: rule ref cnt %d, %s %ss %s: %s %ss '%s %s' failed: %ss # handle ( s adds insert( RL ( R R> t Nonet Truet intt ExceptionR
R t popt joinRJ RA RB R R t debug2t __class__t
ValueErrort indext lent strip( RC t argst nft_optst _argst
_args_testt statust outputt rule_keyt rule_addt _args_strt strt offset( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __run� sp
!
c C sA y | j | � } Wn t k
r' t SX| | | | d +t Sd S( Ni ( R_ R^ RJ RW ( RC RR t patternt replacementt i( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
_rule_replace� s
c C s | } d | d <| S( NRL i ( ( RC Rb t ret_args( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt reverse_rule� s
c C s t t d � � d S( Ns not implemented( R
R ( RC t rulest
log_denied( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_rules s c C s d } d | k s* d | k s* d | k r3 d } n- d | k sW d | k sW d | k r` d } n | j | d d d
| d d g � | j | d
d d d g � y | j d � } Wn t k
r� nD X| d k r� d S| d k r� d | g | | | d +n
| j | � | j | � S( Nt icmpxR7 R" R$ R9 R# R8 s
%%REJECT%%t rejectt withR% s admin-prohibiteds %%ICMP%%t metat l4protos {icmp, icmpv6}s %%LOGTYPE%%t offRO t unicastt broadcastt multicastt pkttypei ( R} R~ R ( Rq R_ R^ RZ t _nftables__run( RC RR Ru t icmp_keywordRp ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_rule s$ $ $
c C s | r
| g St j � S( N( t IPTABLES_TO_NFT_HOOKt keys( RC RM ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_available_tables+ s c C sP i | _ i | _ g } x1 t j � D]# } | j d d | d t g � q% W| S( NRL RM s %s( RA RB t
OUR_CHAINSR� t appendt
TABLE_NAME( RC Rt t family( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_flush_rules/ s !c C s� t d d } g } | d k r� | j d d d | g � x� d d g D]: } d | d
| | d t d f } | j t | � � qF Wn5 | d
k r� | j d d d | g � n
t t d � | S( Nt _t policy_dropt DROPRP RM R! R Rg sM add chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'R i���i t ACCEPTRL s not implemented( R� R� t NFT_HOOK_OFFSETR R
R ( RC t policyt
table_nameRt t hookt
_add_chain( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_set_policy_rules8 s
c C sA t � } x+ t j � D] } | j t | j � � q Wt | � S( N( t sett ICMP_TYPES_FRAGMENTR� t updateRN ( RC t supportedt ipv( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt supported_icmp_typesP s c C sA g } x+ t j � D] } | j d | t f � q Wt t | � S( Ns add table %s %s( R� R� R� R� t mapR ( RC t default_tablesR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_tablesZ s R| c
C s g } t � t d d <x� t d j � D]� } | j d t | t d | d t d | d f � | j d t | f � | j d t | f � | j d t | | f � | j d t | | f � t d d j t d
| d | g � � q( Wt � t d d <x� t d j � D]� } | j d
t | t d | d t d | d f � | j d t | f � | j d t | f � | j d t | | f � | j d t | | f � t d d j t d
| d | g � � qWt � t d d <t � t d d <x� d d g D]� } x� t d j � D]� } | j d | t | t d | d t d | d f � | j d | t | f � | j d | t | f � | j d | t | | f � | j d | t | | f � t | d j t d
| d | g � � q$Wq
Wt � t d d <xM t d j � D]; } | j d t | t d | d t d | d f � q#W| j d t d f � | j d t d f � | j d t d f � | j d t d f � | j d! t d d f � | j d" t d d f � | d# k r| j d$ t d f � n | j d% t d f � | d# k rU| j d& t d f � n | j d' t d f � | j d( t d) f � | j d* t d) f � | j d+ t d) f � | j d, t d) f � | j d t d) f � | j d t d) f � | j d- t d) d) f � | j d. t d) d) f � | j d/ t d) d) f � | j d0 t d) d) f � | d# k r�| j d$ t d) f � n | j d% t d) f � | d# k r�| j d& t d) f � n | j d' t d) f � t d1 d2 d3 d4 d5 d6 g � t d d <t t | � S(7 NR! R s@ add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'i i s% add chain inet %s raw_%s_ZONES_SOURCEs add chain inet %s raw_%s_ZONESs0 add rule inet %s raw_%s jump raw_%s_ZONES_SOURCEs) add rule inet %s raw_%s jump raw_%s_ZONESs %s_ZONES_SOURCEs %s_ZONESR sC add chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'s( add chain inet %s mangle_%s_ZONES_SOURCEs! add chain inet %s mangle_%s_ZONESs6 add rule inet %s mangle_%s jump mangle_%s_ZONES_SOURCEs/ add rule inet %s mangle_%s jump mangle_%s_ZONESR" R R# s; add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'s# add chain %s %s nat_%s_ZONES_SOURCEs add chain %s %s nat_%s_ZONESs. add rule %s %s nat_%s jump nat_%s_ZONES_SOURCEs' add rule %s %s nat_%s jump nat_%s_ZONESR sC add chain inet %s filter_%s '{ type filter hook %s priority %d ; }'s( add chain inet %s filter_%s_ZONES_SOURCER s! add chain inet %s filter_%s_ZONESs> add rule inet %s filter_%s ct state established,related accepts, add rule inet %s filter_%s iifname lo accepts6 add rule inet %s filter_%s jump filter_%s_ZONES_SOURCEs/ add rule inet %s filter_%s jump filter_%s_ZONESR| s_ add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '"STATE_INVALID_DROP: "'s0 add rule inet %s filter_%s ct state invalid dropsH add rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '"FINAL_REJECT: "'sB add rule inet %s filter_%s reject with icmpx type admin-prohibiteds+ add chain inet %s filter_%s_IN_ZONES_SOURCER s$ add chain inet %s filter_%s_IN_ZONESs, add chain inet %s filter_%s_OUT_ZONES_SOURCEs% add chain inet %s filter_%s_OUT_ZONESs9 add rule inet %s filter_%s jump filter_%s_IN_ZONES_SOURCEs2 add rule inet %s filter_%s jump filter_%s_IN_ZONESs: add rule inet %s filter_%s jump filter_%s_OUT_ZONES_SOURCEs3 add rule inet %s filter_%s jump filter_%s_OUT_ZONESt INPUT_ZONES_SOURCEt INPUT_ZONESt FORWARD_IN_ZONES_SOURCEt FORWARD_IN_ZONESt FORWARD_OUT_ZONES_SOURCEt FORWARD_OUT_ZONES( R� R� R� R� R� R� R� R� R ( RC Ru t
default_rulest chainR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_rules` s� - - 1 c C sY | d k r d d d g S| d k r, d g S| d k rB d d g S| d k rU d g Si S(
NR R t
FORWARD_INt FORWARD_OUTR R R R R ( ( RC RM ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_zone_table_chains� s
R! c C s� | d k rx | d k rx g } | j | j | | | | | | | d � � | j | j | | | | | | | d � � | Si d d 6d d 6d d 6d d
6d d 6d d 6| }
| t | � d
d k r� | t | � d
d } n t j d t | d | � } | t k rd } n d } | rK| rKd d | d t d | | f g }
nO | rwd d | d t d | | f g }
n# d d | d t d | | f g }
| d k r�|
| d | | f g 7}
n( |
|
d | d | d | | f g 7}
|
g S( NR R! R" R# t iifnameR t oifnameR R R� R� t OUTPUTi t +t *R� t zonet gotot jumpRQ RR s %ss %s_%s_ZONESRP RL s %s_%ss "( t extendt! build_zone_source_interface_rulesR` R t formatR R� ( RC t enableR� t zone_targett interfaceRM R� R� R� Rt t optt targett actionRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� � s<
&&# (c C s� | d k r� | d k r� g } t d | � s9 t | � rd | j | j | | | | | | d � � n t d | � s t | � r� | j | j | | | | | | d � � n | Si d t 6d t 6| } i d d
6d d 6d d
6d d 6d d 6d d 6| }
t j d t | d | � } | t k r+d } n d } | j d � rl| t
d � }
| j |
� } d |
} nC t | � r�|
d k r�d Sd } n t d | � r�d } n d } | d | d t d | | f | |
| | d | | f g
} | g S( NR R! R7 R" R9 R# RP RL t saddrR t daddrR R R� R� R� R� R� R� R� s ipset:t @RO t etherRR s %ss %s_%s_ZONES_SOURCEs %s_%s(
R R R� t build_zone_source_address_rulesRW RJ R R� R t
startswithR` t _set_get_familyR� ( RC R� R� R� t addressRM R� R� Rt t add_delR� R� R� t ipsett rule_familyRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� � sJ
c C s. | d k r` | d k r` g } | j | j | | | d � � | j | j | | | d � � | St j d t | d | � } t | | j t | d | d | d | g � � g } | j d
d | d t d | | f g � | j d
d | d t d
| | f g � | j d
d | d t d | | f g � | j d
d | d t d | | f g � | j d
d | d t d | | f d d
| | f g � | j d
d | d t d | | f d d | | f g � | j d
d | d t d | | f d d | | f g � | j
j j | j
} | j
j � d k r�| d k r�| d k r�| d! k r�| } | d k rud } n | j d
d | d t d | | f d d d d | | f g � q�q�n | d k r*| d" k r*| d# k r*| j d
d | d t d | | f | d k r | j � n d g � n | S($ NR R! R" R# R� R� s %s_logs %s_denys %s_allowRP s %ss %s_%ss %s_%s_logs
%s_%s_denys %s_%s_allowRR R� R| R R R� R� R� t REJECTs
%%REJECT%%R� s %%LOGTYPE%%R t prefixs "filter_%s_%s: "R� ( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R� s
%%REJECT%%s DROP( s ACCEPTR� s
%%REJECT%%s DROP( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R� t build_zone_chain_rulesR R� R R� R� R� R� R� R< R� t _zonesR� t get_log_deniedt lower( RC R� RM R� R� Rt t _zoneR� t
log_suffix( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� $ s^
%c C s� i d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d
g d 6d d d d
g d 6d d
d d
g d 6d d
d d
g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d
d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d
d d g d 6d d
d d g d 6d d
d d! g d" 6d d
d d! g d! 6d d# d$ g d% 6d d# d$ g d& 6} | | S(' NRy R$ R% s host-prohibiteds icmp-host-prohibiteds host-prohibs net-prohibiteds icmp-net-prohibiteds
net-prohibs admin-prohibiteds icmp-admin-prohibiteds admin-prohibR8 s icmp6-adm-prohibiteds adm-prohibiteds net-unreachables icmp-net-unreachables net-unreachs host-unreachables icmp-host-unreachables host-unreachs port-unreachables icmp-port-unreachables icmp6-port-unreachableRw s port-unreachs prot-unreachables icmp-proto-unreachables
proto-unreachs addr-unreachables icmp6-addr-unreachables addr-unreachs no-routes icmp6-no-routet tcpt resets tcp-resets tcp-rst( ( RC t reject_typet frags( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _reject_types_fragmentd s2 c C s� | s
g Si d d 6d d 6d d 6d d 6} y | j j d � } Wn t k
rd t t d
� � n Xd d | j d
| !d | | j | d g S( Nt secondt st minutet mt hourt ht dayt dt /s Expected '/' in limitt limitt ratei i ( t valueR_ R^ R
R ( RC R� t rich_to_nftRp ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_limit_fragment� s
c C s� | j s
g Si d t 6d t 6| } | d d d t d | | f g } | | d g 7} | j j r� | d d | j j g 7} n | j j r� | d
d | j j g 7} n | | j | j j � 7} | S( NRP RL RR R! s %ss %s_%s_logR R� s "%s"t level( R RW RJ R� R� R� R� R� ( RC t rich_ruleR� RM R� t
rule_fragmentR� RR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_log� s c C s| | j s
g Si d t 6d t 6| } | d d d t d | | f g } | | d d d g 7} | | j | j j � 7} | S(
NRP RL RR R! s %ss %s_%s_logR R� t audit( R� RW RJ R� R� R� ( RC R� R� RM R� R� R� RR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_audit� s c C s� | j s
g Si d t 6d t 6| } t | j � t k rV d | | f } d g } nt | j � t k r� d | | f } d g } | j j r^| | j | j j � 7} q^n� t | j � t k r� d | | f } d g } n~ t | j � t k rBt j
d t d d
| � } d } d | | f } d d
d | j j g } n t
t d t | j � � � | d d d t | g }
|
| 7}
|
| j | j j � 7}
|
| 7}
|
S( NRP RL s %s_%s_allowt accepts
%s_%s_denyRx t dropR� R R� R Rz t markR� s Unknown action %sRR R! s %s( R� RW RJ R% R R R� R R R R� R R� R
R R� R� R� ( RC R� R� R� RM R� R� R� R� t rule_actionRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_action� s6
c C sS | s
g S| d k r# d d d g S| d k r< d d d g St t d | � � d S( NR7 Rz t nfprotoR9 s Invalid family( R
R ( RC t rich_family( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_family_fragment� s
c C sx | s
g Sg } t d | j � r2 | d g 7} n
| d g 7} | j ra | d d | j g 7} n | d | j g 7} | S( NR7 R" R# R� s !=( R t addrt invert( RC t rich_destR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_destination_fragment� s
c C sJ | s
g Sg } | j r� t d | j � r; | d g 7} n
| d g 7} | j rj | d d | j g 7} qF| d | j g 7} n� t | d � r� | j r� | j r� | d d d | j g 7} qF| d d | j g 7} np t | d � rF| j rF| j | j � } | j r)| | d d d | j g 7} qF| | d d | j g 7} n | S(
NR7 R" R# R� s !=t macR� R� R� ( R� R R� t hasattrR� R� R� ( RC t rich_sourceR� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_source_fragment� s(
c C s� i d t 6d t 6| } d } t j d t d d | � } g }
| r_ |
| j | j � 7}
n | r� t d | � r� |
d g 7}
n
|
d g 7}
|
d
| g 7}
n | r� |
| j | j � 7}
|
| j
| j � 7}
n |
| d d t | d
� g 7}
|
d d d g 7}
g } | r�| j
| j | | | | |
� � | j
| j | | | | |
� � | j
| j | | | | | |
� � n5 | j
| d d d t d | | f g |
d g � | S( NRP RL R R� R R� R7 R" R# R� t dports %st -t ctt states
new,untrackedRR R! s %s_%s_allowR� ( RW RJ R R� R R� R� R R� t destinationR� t sourceR R� R� R� R� R� ( RC R� R� t protot portR� R� R� RM R� R� Rt ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_ports_rules s0
""(/c C s� i d t 6d t 6| } d } t j d t d d | � } g } | r_ | | j | j � 7} n | r� t d | � r� | d g 7} n
| d g 7} | d
| g 7} n | r� | | j | j � 7} | | j | j � 7} | | j
| j � 7} n d d | g } | d
d d g 7} g }
| r�|
j | j
| | | | | � � |
j | j | | | | | � � |
j | j | | | | | | � � n/ |
j | d d d t d | g | d g � |
S( NRP RL R R� R R� R7 R" R# R� Rz R{ R� R� s
new,untrackedRR R! s %ss filter_%s_allowR� ( RW RJ R R� R R� R� R R� R� R� R� R� R� R� R� R� ( RC R� R� t protocolR� R� R� RM R� R� Rt ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_protocol_rules/ s2
""()c C s� i d t 6d t 6| } d } t j d t d d | � } g }
| r_ |
| j | j � 7}
n | r� t d | � r� |
d g 7}
n
|
d g 7}
|
d
| g 7}
n | r� |
| j | j � 7}
|
| j
| j � 7}
n |
| d d t | d
� g 7}
|
d d d g 7}
g } | r�| j
| j | | | | |
� � | j
| j | | | | |
� � | j
| j | | | | | |
� � n5 | j
| d d d t d | | f g |
d g � | S( NRP RL R R� R R� R7 R" R# R� t sports %sR� R� R� s
new,untrackedRR R! s %s_%s_allowR� ( RW RJ R R� R R� R� R R� R� R� R� R R� R� R� R� R� ( RC R� R� R� R� R� R� R� RM R� R� Rt ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_source_ports_rulesP s0
""(/c
C s� i d t 6d t 6| } t j d t d d | � } | d d d t d | | g } | r� t d
| � ry | d g 7} n
| d g 7} | d
| g 7} n | d d t | d � g 7} | d d | g 7} | g S( NRP RL R� R R� RR R! s %ss raw_%s_allowR7 R" R# R� R� R� R� t helper( RW RJ R R� R R� R R (
RC R� R� R� R� R� t helper_nameR� R� RR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_helper_ports_rulesq s
c C s� i d t 6d t 6| } t j d t d d | � } g } | ro | | j | j � 7} | | j | j � 7} n | d | d t d | g | d d
d d g g S(
NRP RL R� R R� RR s %ss nat_%s_allowR� s !=t lot
masquerade(
RW RJ R R� R R� R� R� R� R� ( RC R� R� R� R� R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _build_zone_masquerade_nat_rules� s c C s� g } | rd | j r$ | j d k sB | j rd t d | j j � rd | j | j | | d | � � n� | r� | j r� | j d k s� | j r� t d | j j � r� | j | j | | d | � � n> | j | j | | d | � � | j | j | | d | � � i d t 6d t 6| } t j d t
d d | � } g } | ro| | j | j � 7} | | j
| j � 7} n | j | d
d d t d
| g | d d d d g � | S( NR9 R# R7 R" RP RL R� R� R� RR R! s %ss filter_%s_allowR� R� s
new,untrackedR� ( R� R� R R� R� R
RW RJ R R� R R� R� R� R� R� ( RC R� R� R� Rt R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_masquerade_rules� s& " " 2c C s� i d t 6d t 6| } t j d t d d | � } g }
| rV |
d d | g 7}
n |
d d g 7}
| r� | d k r� |
d
t | d � g 7}
n | d | d
t d | d d | g | |
g S( NRP RL R� R R� t dnatt toR+ RO s :%sR� RR s %ss nat_%s_allowRz R{ ( RW RJ R R� R R R� ( RC R� R� R t
mark_fragmentt toaddrt toportR� R� R� t
dnat_fragment( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt" _build_zone_forward_port_nat_rules� s c
C s{ i d t 6d t 6| }
d | } d d | g } t j d t d d | � }
g } | r� | | j | j � 7} | | j | j � 7} | | j | j
� 7} n g } | j |
d d
d t d |
g | | d
| d d d | g � | rC| j r| j d k s| rCt
d | � rC| j | j | | | | | | d � � n� | r�| j ra| j d k sv| r�t
d | � r�| j | j | | | | | | d � � n� | s�t
d | � r�| j | j | | | | | | d � � n | s�t
d | � r#| j | j | | | | | | d � � n t j d t | d | � }
| j |
d d
d t d |
d d d g | d g � | S( NRP RL s 0x%xRz R� R� R R� RR R! s %ss mangle_%s_allowR� R� R9 R# R7 R" s filter_%s_allowR� R� s
new,untrackedR� ( RW RJ R R� R R� R� R� R� R� R� R� R� R R� R ( RC R� R� t filter_chainR� R R R t mark_idR� R� t mark_strR R� R� Rt ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_forward_port_rules� sB
2c C s< | t | k r t | | St t d | | j f � � d S( Ns" ICMP type '%s' not supported by %s( R� R
R
t name( RC R� t icmp_type( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _icmp_types_to_nft_fragment� s c C s� d } i d t 6d t 6| } | r9 | j r9 | j } n\ | j r� g } d | j k rg | j d � n d | j k r� | j d � q� n d d g } g } x/| D]'} x d d g D]}
t j d t |
d | � } | j j j
| � rd
| | f } d }
n d | | f } d
}
g } | rl| | j | j � 7} | | j
| j � 7} | | j | j � 7} n | | j | | j � 7} | r8| j | j | | | | | � � | j | j | | | | | � � | j r | j | j | | | | | | � � q�| j | d d d t d | | f g | d
g � q� | j j � d k r�|
d k r�| j | d d d t | g | d d d d | | f g � n | j | d d d t | g | |
g � q� Wq� W| S( NR RP RL R7 R9 R R� R� R� s %s_%s_allowR� s
%s_%s_denys
%%REJECT%%RR R! s %sR| s %%LOGTYPE%%R R� s "%s_%s_ICMP_BLOCK: "( RW RJ t ipvsR� R� R R� R R< R� t query_icmp_block_inversionR� R� R� R� R� R R R� R� R� R� R� R� ( RC R� R� t ictR� RM R� R Rt R� R� R� t final_chaint final_targetR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_icmp_block_rules� sT
"" (2! -c C s� d } g } x�d d g D]�} t j d t | d | � } d j d d t d | | f d
d | | f g � } | j | } | j j j | � r� d } n d
} | r� d d d d t d | | f d | g }
n# d d d d t d | | f g }
|
d | g 7}
| j |
� | j j j | � r | j j
� d k r�| rpd d d d t d | | f d | g }
n# d d d d t d | | f g }
|
d d d d d | | f g 7}
| j |
� q�q q W| S( NR R R� R� R� RT R! s %ss %s_%sR� s %s_%s_allows
%%REJECT%%R� RP RR RS RL s %%ICMP%%R| s %%LOGTYPE%%R R� s "%s_%s_ICMP_BLOCK: "( R R� R R[ R� RA R< R� R R� R� ( RC R� R� RM Rt R� R� Rh t rule_handlet
ibi_targetRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt% build_zone_icmp_block_inversion_rules+ s<
c C s� g } | j d d d d t d d d d d
d d d
d d d g � | d k r� | j d d d d t d d d d d
d d d
d d d d d g � n | j d d d d t d d d d d g � | S( NRQ RR R! s %ss raw_%sR Rz R� R9 t fibR� t .t iift oift missingR� R| R R� s "rpfilter_DROP: "R8 R% s) { nd-router-advert, nd-neighbor-solicit }R� t raw_PREROUTINGR( R( ( R� R� ( RC Ru Rt ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_rpfilter_rules] s
c C s� d } t j d t d d | � } g } | | j | j � 7} | | j | j � 7} | | j | j � 7} g } | j | j
| | | | | � � | j | j | | | | | � � | j | j | | | | | | � � | S( NR R� R R� (
R R� R R� R� R� R� R� R� R� R� R� R� ( RC R� R� R� RM R� R� Rt ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt( build_zone_rich_source_destination_rulesn s ""%c C s | d k r t St S( NR7 R9 t eb( s ipv4s ipv6R+ ( RW RJ ( RC R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt is_ipv_supported s c C s; i d d 6d d 6} i | | g d 6| | d d g d 6| | d d | | g d
6| | d d | | g d 6| | d g d
6| | g d 6| | d d g d 6| | d d | | g d 6| | d d | | g d 6| | d g d 6d g d 6} y d g | | d g SWn$ t k
r6t t d | � � n Xd S( Nt ipv4_addrR7 t ipv6_addrR9 s hash:ips . inet_protos . inet_services hash:ip,ports . inet_service .s hash:ip,port,ips hash:ip,port,nets . marks hash:ip,marks hash:nets
hash:net,ports hash:net,port,ips hash:net,port,nets . ifnames hash:net,ifacet
ether_addrs hash:macR% t ;s! ipset type name '%s' is not valid( t KeyErrorR
R ( RC R� R% t ipv_addrt types( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_type_fragment� s(
c
C s) | r+ d | k r+ | d d k r+ d } n d } | d g } | | j | | � 7} | r� d | k r� | d | d d d g 7} n d | k r� | d
| d d g 7} q� n | s� d | k r� d | k r� | d d
d g 7} n | d g 7} x4 d d d g D]# } | j d d | t g | � q� Wd S( NR� t inet6R9 R7 t {t timeoutR� R0 t maxelemt sizet ,t flagst intervalt }R! R" R# RP R� ( R4 R� R� ( RC R R% t optionsR� t cmdR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_create� s "
c C s: x3 d d d g D]" } | j d d | t | g � q Wd S( NR! R" R# RL R� ( R� R� ( RC R R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_destroy� s c C s) | j j j | � j d � d j d � } | j d � } t | � t | � k rd t t d � � n g } x� t t | � � D]� } | | d k r� y | | j d � } Wn( t k
r� | d d | | g 7} qX| | | | d | | | d g 7} n | j
| | � | j
d � q} W| d S( Nt :i R: s+ Number of values does not match ipset type.R� R� R$ i����( R< R� t get_typet splitR` R
R t rangeR_ R^ R� ( RC R t entryt type_formatt entry_tokenst fragmentRp R_ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_entry_fragment� s +
*c C sT xM d d d g D]< } | j d d | t | d g | j | | � d g � q Wd S( NR! R" R# RP t elementR6 R= ( R� R� RJ ( RC R RF R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_add� s c C sT xM d d d g D]< } | j d d | t | d g | j | | � d g � q Wd S( NR! R" R# RL RK R6 R= ( R� R� RJ ( RC R RF R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_delete� s c C s: x3 d d d g D]" } | j d d | t | g � q Wd S( NR! R" R# t flushR� ( R� R� ( RC R R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_flush� s c C sk | j j j | � } | j d k r- d } n: | j ra d | j k ra | j d d k ra d } n d } | S( Ns hash:macR� R� R5 R# R" ( R< R� t get_ipsetR% R> ( RC R R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� � s N(6 t __name__t
__module__R RW t zones_supportedRE R? R� Rq Rs Rv R� RV R� R� R� R� R� R� R� RJ R� R� R� R� R� R� R� R� R� R� R� R R R R R
R R R R R R" R) R* R, R4 R@ RA RJ RL RM RO R� ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR: � sb M
[ * 1 @
"
" , 6 2 ($ t os.pathRF t firewall.core.baseR R t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R R R t firewallR t firewall.errorsR
R R R
R R t firewall.core.richR R R R R� R� R� R� R� t objectR: ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <module> s� (."