a
«°i×õ ã @ sD d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZmZmZmZmZmZ d dlmZmZm Z m Z m Z m Z m Z m!Z!m"Z" d dl#m$Z$ d d l%m&Z&m'Z' d dl(Z(d
Z)g d ¢d d
gg d¢g d¢g d ¢dœZ*dddœZ+dddœZ,dd„ Z-dd„ Z.dd„ Z/G d d „ d e0ƒZ1G d d „ d e1ƒZ2dS ) é N)ÚrunProg)Úlog)ÚtempFileÚreadfileÚ splitArgsÚ check_macÚportStrÚcheck_single_addressÚ
check_addressÚ normalizeIP6)Úconfig)Ú
FirewallErrorÚINVALID_PASSTHROUGHÚ INVALID_RULEÚ
UNKNOWN_ERRORÚ INVALID_ADDRÚINVALID_ICMPTYPE) Ú Rich_AcceptÚ Rich_RejectÚ Rich_DropÚ Rich_MarkÚ
Rich_NFLogÚRich_MasqueradeÚRich_ForwardPortÚRich_IcmpBlockÚRich_Tcp_Mss_Clamp)ÚDEFAULT_ZONE_TARGET)Ú
ICMP_TYPESÚ ICMPV6_TYPESÚ )ÚINPUTÚOUTPUTÚFORWARDÚ
PREROUTINGr! )r# Ú POSTROUTINGr r! r" )r# r$ r! )ÚsecurityÚrawÚmangleÚnatÚfilterzicmp-host-prohibitedzicmp6-adm-prohibited©Úipv4Úipv6Úicmpú ipv6-icmpc C sœ dddddddœ}| dd… }|D ]t}z| |¡}W n tyJ Y q"Y n0 |dv rŠzt||d ƒ W n tyz Y n0 | |d ¡ || ||< q"|S ) z Inverse valid rule ú-Dú--deleteú-Xú--delete-chain©ú-Aú--appendú-Iú--insertú-Nz --new-chainN©r6 r7 é )ÚindexÚ ExceptionÚintÚpop)ÚargsÚ replace_argsÚret_argsÚargÚidx© rD ú;/usr/lib/python3.9/site-packages/firewall/core/ipXtables.pyÚcommon_reverse_rule< s* ÷
rF c C s¬ dddddddœ}| dd… }|D ]z}z| |¡}W n tyJ Y q"Y n0 |dv rŠzt||d ƒ W n tyz Y n0 | |d ¡ || ||< | S ttd ƒ‚dS )
z Reverse valid passthough rule r/ r0 r1 r2 r3 Nr9 r: úno '-A', '-I' or '-N' arg)r; Ú
ValueErrorr= r> r
r )r? r@ rA ÚxrC rD rD rE Úcommon_reverse_passthrougha s0 ÷
ÿrJ c C sh t | ƒ} t g d¢ƒ}t| |@ ƒdkr>ttdt| |@ ƒd ƒ‚t g d¢ƒ}t| |@ ƒdkrdttdƒ‚dS )zZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) )z-Cz--checkr/ r0 z-Rz --replaceú-Lz--listz-Sz --list-rulesú-Fz--flushú-Zz--zeror1 r2 ú-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedr3 rG N)ÚsetÚlenr
r Úlist)r? Z not_allowedZneededrD rD rE Úcommon_check_passthrough‹ s ÿÿ ÿrR c @ sÊ e Zd ZdZd ZdZdd„ Zdd„ Zdd„ Zd d
„ Z d d „ Z
d
d„ Z dd„ Z dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd d „ Zd d „ Zdld"d#„Zd$d%„ Zd&d'„ Zd(d)„ Zd*d+„ Zdmd,d-„Zd.d/„ Zdnd1d2„Z d3d4„ Z d5d6„ Z dod8d9„Z dpd:d;„Z dd?„ Z"d@dA„ Z#dBdC„ Z$dDdE„ Z%dFdG„ Z&dHdI„ Z'dJdK„ Z(dLdM„ Z)dNdO„ Z*dPdQ„ Z+dqdRdS„Z,drdTdU„Z-dsdVdW„Z.dtdXdY„Z/dZd[„ Z0dud\d]„Z1dvd^d_„Z2dwd`da„Z3dbdc„ Z4dxddde„Z5dfdg„ Z6dhdi„ Z7djdk„ Z8d!S )yÚ ip4tablesr+ Tc C sd || _ tj| j | _tjd| j | _| ¡ | _| ¡ | _ |
¡ g | _ i | _ i | _
g | _i | _d S )Nz
%s-restore)Ú_fwr ZCOMMANDSÚipvÚ_commandÚ_restore_commandÚ_detect_wait_optionÚ wait_optionÚ_detect_restore_wait_optionÚrestore_wait_optionÚ fill_existsÚavailable_tablesÚrich_rule_priority_countsÚpolicy_priority_countsÚzone_source_index_cacheÚ
our_chains)ÚselfÚfwrD rD rE Ú__init__° s
zip4tables.__init__c C s$ t j | j¡| _t j | j¡| _d S ©N)ÚosÚpathÚexistsrV Zcommand_existsrW Zrestore_command_exists©rb rD rD rE r\ ½ s zip4tables.fill_existsc C s† | j r(| j |vr(| j gdd„ |D ƒ }ndd„ |D ƒ}t d| j| jd |¡¡ t| j|ƒ\}}|dkr‚td| jd |¡|f ƒ‚|S )Nc S s g | ] }d | ‘qS ©ú%srD ©Ú.0ÚitemrD rD rE Ú
Ä ó z#ip4tables.__run..c S s g | ] }d | ‘qS rj rD rl rD rD rE ro Æ rp ú %s: %s %sú r ú'%s %s' failed: %s)rY r Údebug2Ú __class__rV Újoinr rH )rb r? Ú_argsÚstatusÚretrD rD rE Z__runÁ s
ÿzip4tables.__runc C s< z| |¡}W n ty" Y dS 0 ||||d …< dS d S )NFé T)r; rH )rb ÚruleÚpatternZ replacementÚirD rD rE Ú
_rule_replaceÎ s zip4tables._rule_replacec C s |t v o|t | v S re )ÚBUILT_IN_CHAINS)rb rU ÚtableÚchainrD rD rE Úis_chain_builtin× s
ÿzip4tables.is_chain_builtinc C s2 d|g}|r| d¡ n
| d¡ | |¡ |gS )Nú-tr8 r1 )Úappend)rb Úaddr€ r r{ rD rD rE Úbuild_chain_rulesÛ s
zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |ƒg7 }n |d|g7 }||7 }|S )Nrƒ r6 r/ )Ústr)rb r… r€ r r; r? r{ rD rD rE Ú
build_ruleä s zip4tables.build_rulec C s t |ƒS re )rF ©rb r? rD rD rE Ú reverse_ruleí s zip4tables.reverse_rulec C s t |ƒ d S re )rR r‰ rD rD rE Úcheck_passthroughð s zip4tables.check_passthroughc C s t |ƒS re )rJ r‰ rD rD rE Úreverse_passthroughó s z ip4tables.reverse_passthroughc C s– d}z| d¡}W n ty$ Y n 0 t|ƒ|d krB||d }d }dD ]B}z| |¡}W n tyn Y qJ0 t|ƒ|d krJ||d }qJ||fS )Nr) rƒ rz r3 )r; rH rP )rb r? r€ r} r ÚoptrD rD rE Ú passthrough_parse_table_chainö s z'ip4tables.passthrough_parse_table_chainc C s zH| d¡}| |¡ | |¡}d|d kr:||d f}n ||d f}W nF tyŽ z | d¡}| |¡ d }W n tyˆ Y Y d S 0 Y n0 d}|d d v r¤d
}|rÀ|sÀ||v r¾| |¡ n\|r |rø||vrì| |¡ |jd d „ d
| |¡}nt|ƒ}d|d< | dd|d ¡ d S )Nú%%ZONE_SOURCE%%ú-mé é é ú%%ZONE_INTERFACE%%Tr ©r/ r0 Fc S s | d S )Nr rD )rI rD rD rE Ú) rp z4ip4tables._run_replace_zone_source..)Úkeyr6 r: ú%drz )r; r> rH Úremover„ ÚsortrP Úinsert)rb r{ r` r} ÚzoneZ zone_sourceÚrule_addr; rD rD rE Ú_run_replace_zone_source s:
z"ip4tables._run_replace_zone_sourcec C s z| |¡}W n ty" Y nê0 d}d}d}| |¡ | |¡}t|ƒtkrZttdƒ‚d} dD ]B}
z| |
¡} W n ty† Y qb0 t|ƒ| d krb|| d } qbdD ]Z}
z| |
¡}W n tyÎ Y qª0 t|ƒ|d krì||d } |
d v rød}|
d
v rªd}qª| | f} |s^| |vs>||| vs>|| | d krHttd ƒ‚|| | d8 < n®| |vrpi || < ||| vrŠd || |< d}
t ||
¡ ƒD ]<}||kr¸|r¸ qÜ|
|| | 7 }
||krž qÜqž|| | d7 < d
||< | |d d|
¡ dS )a
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
TFéÿÿÿÿz%priority must be followed by a numberr) ©rƒ z--tablerz )r4 r5 r6 r7 r/ r0 r9 r• r z*nonexistent or underflow of priority countr6 r: r˜ N) r; rH r> Útyper= r
r rP r ÚsortedÚkeysr› )rb r{ Zpriority_countsÚtokenr} r r› Zinsert_add_indexÚpriorityr€ r Újr r; ÚprD rD rE Ú_set_rule_replace_priority2 sj
ÿþ
z$ip4tables._set_rule_replace_priorityc
C s t ƒ }i }t | j¡}t | j¡}t | j¡}|D ]x}|d d … } | | dddt| j g¡ | | dt | j g¡ z|
d¡}
W n t y” Y n80 |dkr q2|dv rÂdd d
|g| |
|
d …< n
| |
¡ |
| |d ¡ |
| |d
¡ | | |¡ d} dD ]L} z|
| ¡}
W n t y" Y qü0 t| ƒ|
d krü| |
¡ | |
¡} qüt| ƒD ]F\}
}
tjD ]4}||
v r`|
d¡r†|
d¡s`d|
| |
< q`qR| | g ¡ | ¡ q2|D ]F} || }| d| ¡ |D ]} | d | ¡d ¡ qÐ| d¡ q²| ¡ t |j ¡}t d| j | j d|j |j!f ¡ g }| j"rF| | j"¡ | d¡ t#| j ||j d\}}t $¡ dkrÒt%|j ƒ}|d urÒd }
|D ]@}t j&d|
|f d d d | d¡sÆt j&d d d |
d 7 }
qt '|j ¡ |d krt d | j d |¡|f ƒ‚|| _|| _|| _d S )!Nú
%%REJECT%%ÚREJECTú
--reject-withú%%ICMP%%ú %%LOGTYPE%%Úoff©ÚunicastÚ broadcastZ multicastr Úpkttypeú
--pkt-typerz ú%%RICH_RULE_PRIORITY%%ú%%POLICY_PRIORITY%%r) r ú"z"%s"z*%s
rr Ú
zCOMMIT
rq z%s: %dú-n©Ústdinr: z%8d: %sr )ÚnofmtÚnlr )r» rs )(r ÚcopyÚdeepcopyr^ r_ r` r~ ÚDEFAULT_REJECT_TYPErU ÚICMPr; rH r> r¨ rž rP Ú enumerateÚstringZ
whitespaceÚ
startswithÚendswithÚ
setdefaultr„ Úwriterv Úcloserf ÚstatÚnamer rt ru rW Úst_sizer[ r ZgetDebugLogLevelr Údebug3Úunlink)rb ÚrulesÚ
log_deniedÚ temp_fileZ table_rulesr^ r_ r` Z_ruler{ r} r€ r ÚelementÚcrÈ r? rx ry ÚlinesÚlinerD rD rE Ú set_rules‚ s”
ÿ
ÿ ÿ
ÿ
ÿzip4tables.set_rulesc C sö | |dddt| j g¡ | |dt| j g¡ z| d¡}W n tyP Y n:0 |dkr^dS |dv r€d d
d |g|||d …< n
| |¡ t | j ¡}t | j
¡}t | j ¡}| ||d
¡ | ||d¡ |
||¡ | |¡}|| _ || _
|| _ |S )Nr© rª r« r¬ r r® r r¯ r r² r³ rz r´ rµ )r~ r¿ rU rÀ r; rH r> r½ r¾ r^ r_ r` r¨ rž Ú_ip4tables__run)rb r{ rÎ r} r^ r_ r` ÚoutputrD rD rE Úset_ruleã s0 ÿ
zip4tables.set_ruleNc C sŽ g }|r|gnt ¡ }|D ]n}|| jv r4| |¡ qz,| d|ddg¡ | j |¡ | |¡ W q ty† t d| j|f ¡ Y q0 q|S )Nrƒ rK r¸ zA%s table '%s' does not exist (or not enough permission to check).) r r£ r] r„ rÕ rH r Zdebug1rU )rb r€ ry ZtablesrD rD rE Úget_available_tables s
z ip4tables.get_available_tablesc C sœ d}t | jg d¢ƒ}t d| j| jd|d |d ¡ |d dkr˜d}t | jg d¢ƒ}t d| j| jd|d |d ¡ |d dkr„d}t d | j| j|¡ |S )
Nr )ú-wrK r¸ ú7%s: %s: probe for wait option (%s): ret=%u, output="%s"rÙ r rz )ú-w10rK r¸ rÛ ú %s: %s will be using %s option.)r rV r rË ru rt )rb rY ry rD rD rE rX s z ip4tables._detect_wait_optionc
C sª t ƒ }| d¡ | ¡ d}dD ]d}t| j|g|jd}t d| j| j ||d |d ¡ |d dkr d|d vr d |d vr |} q†q t
d
| j| j|¡ t |j¡ |S ) Nz#foor )rÙ z--wait=2r¹ rÚ r rz zinvalid optionzunrecognized optionrÜ )
r rÆ rÇ r rW rÉ r rË ru rV rt rf rÌ )rb rÏ rY Z test_optionry rD rD rE rZ $ s
ÿ z%ip4tables._detect_restore_wait_optionc C sN i | _ i | _g | _g }t ¡ D ]*}| |¡s.q dD ]}| d||g¡ q2q |S )N)rL r1 rM rƒ )r^ r_ r` r r£ rØ r„ )rb rÍ r€ ÚflagrD rD rE Úbuild_flush_rules8 s
zip4tables.build_flush_rulesc
C s– g }|dkrdn|}t ¡ D ]t}| |¡s,q |dkr6q t | D ]P}|dkrv|| }|dkrz| d|d|ddg¡ d}n|}| d|d ||g¡ q>q |S )
NZPANICÚDROPr( r) rª rƒ r4 ú-jrN )r r£ rØ r„ )rb ÚpolicyZpolicy_detailsrÍ Ú_policyr€ r r§ rD rD rE Úbuild_set_policy_rulesG s
z ip4tables.build_set_policy_rulesc C sN t ƒ }|d u s| jdkr&| t ¡ ¡ |d u s8| jdkrF| t ¡ ¡ t|ƒS )Nr+ r, )rO rU Úupdater r£ r rQ )rb rU Z supportedrD rD rE Úsupported_icmp_typesZ s z ip4tables.supported_icmp_typesc C s g S re rD ri rD rD rE Úbuild_default_tablesd s z ip4tables.build_default_tablesr® c C s i }| d¡rlg |d< tƒ | jd< td D ]@}|d d| ¡ |d d||f ¡ | jd d| ¡ q*| d¡r@g |d< tƒ | jd< td D ]ª}|d d| ¡ |d d||f ¡ | jd d| ¡ |dkr”dD ]8}|d d||f ¡ | jd td ||f gƒ¡ qàd
D ] }|d d |||f ¡ q q”| d ¡rg |d < tƒ | jd < td D ]°}|d d| ¡ |d d||f ¡ | jd d| ¡ |dkrhdD ]:}|d d||f ¡ | jd td ||f gƒ¡ q¶d
D ] }|d d |||f ¡ qöqh| d
¡rPg |d
< tƒ | jd
< td
D ]
}|d
d| ¡ |d
d||f ¡ | jd
d| ¡ |dv rèdD ]R}|d
d||f ¡ | jd
td ||f gƒ¡ |d
d |||f ¡ q’nddD ]:}|d
d||f ¡ | jd
td ||f gƒ¡ qìd
D ] }|d
d |||f ¡ q,qBg |d< tƒ | jd< |d d¡ |d d¡ |dkr˜|d d¡ |d d¡ |d d¡ |d d¡ | jd tdƒ¡ dD ]0}|d d| ¡ | jd td| ƒ¡ qÚd
D ]}|d d| ¡ q|dkrB|d d ¡ |d d ¡ |d d ¡ |d d ¡ |dkr„|d d ¡ |d d!¡ |d d"¡ |d d#¡ | jd td$ƒ¡ d%D ]0}|d d&| ¡ | jd td'| ƒ¡ qÆd
D ]B}|d d&| ¡ |d d(| ¡ | jd td'| ƒ¡ qüd)D ]0}|d d&| ¡ | jd td'| ƒ¡ qD|dkrŽ|d d*¡ |d d+¡ |d g d,¢7 < | jd td-ƒ¡ d%D ]B}|d d.| ¡ |d d/| ¡ | jd td0| ƒ¡ qÈd)D ]B}|d d.| ¡ |d d/| ¡ | jd td0| ƒ¡ qg }|D ]>}|| ¡ vrrq\|| D ] }| d1|gt|ƒ ¡ qzq\|S )2Nr% z -N %s_directz-A %s -j %s_directz %s_directr& r# )Ú POLICIES_preÚZONESÚ
POLICIES_postz-N %s_%sú%s_%s)rè z-A %s -j %s_%sr' r( )r! )rç ré r) zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTr® z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_direct)rç z
-N FORWARD_%sz
FORWARD_%sz-A FORWARD -j FORWARD_%s)ré z;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%srƒ )rØ rO ra r r„ r… rä r )rb rÎ Z
default_rulesr Zdispatch_suffixZfinal_default_rulesr€ r{ rD rD rE Úbuild_default_rulesh sÖ
"
"
z ip4tables.build_default_rulesc C sd |dkrddhS |dkr*d| ¡ v r*dhS |dkrFd| ¡ v rFddhS |dkr`d| ¡ v r`dhS i S ) Nr) r r" r' r# r( r$ r& )rØ )rb r€ rD rD rE Úget_zone_table_chainsé s z ip4tables.get_zone_table_chainsc sÄ | j j |¡‰ˆjdk r dnd‰ˆdkr4ˆdkr4dnd} | j j |ˆt| ¡‰ g }
g } |D ]} |
d| g¡ qX|D ]} | d | g¡ qp|D ]8}
| j j |
¡}|d
v r®| |¡s®qˆ|
|
d |
¡¡ qˆ|D ]J}
| j j |
¡}|d
v rì| |¡sìqÆt |
ƒrþˆd v rþqÆ| |
d
|
¡¡ qƇ ‡‡‡‡‡fdd„}g }|
r||
D ]B}| r^| D ]}| |||ƒ¡ qDn|rfn| ||d ƒ¡ q6nD|r„n<| r¨| D ]}| |d |ƒ¡ qŽn|r°n| |d d ƒ¡ |S )Nr ÚpreÚpostr( r$ TFú-iú-or* ú-s©r$ r" r! ú-dc sV dddœˆ }dˆ|dˆˆf dˆj g}| r6| | ¡ |rD| |¡ | dˆ g¡ |S )Nr4 r/ ©TFrƒ z%s_POLICIES_%srµ rà )r¥ Úextend)Úingress_fragmentÚegress_fragmentÚadd_delr{ ©râ r Ú chain_suffixÚenableÚp_objr€ rD rE Ú _generate_policy_dispatch_rule s ÿ
zSip4tables.build_policy_ingress_egress_rules.._generate_policy_dispatch_rule) rT rá Ú
get_policyr¥ Úpolicy_base_chain_nameÚPOLICY_CHAIN_PREFIXr„ rœ Ú check_sourceÚis_ipv_supportedÚ_rule_addr_fragmentr )rb rû rá r€ r Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesÚisSNATZingress_fragmentsZegress_fragmentsÚ interfaceÚaddrrU rý rÍ rö r÷ rD rù rE Ú!build_policy_ingress_egress_rulesø sR z+ip4tables.build_policy_ingress_egress_rulesFc
C s¤ |dkr|dkrdnd}| j jj||t|d} ddddddœ| }
d } |r^|s^d
d | d g} n,|rpd
d | g} ndd | g} |sŠ| d g7 } | d||
|| | g7 } | gS )Nr( r$ TF©r rï rð ©r# r$ r r" r! ú-gr6 ú%s_ZONESr” r4 r/ rƒ )rT rá rÿ r )
rb rû rœ rá r r€ r r„ r râ r Úactionr{ rD rD rE Ú!build_zone_source_interface_rulesE s( ûú
z+ip4tables.build_zone_source_interface_rulesc C sÆ | d¡rP|dd … }|dkr$d}nd}d |g| jj |¡ ¡}ddd ||gS t|ƒrz|dkrjttd
ƒ‚dd d | ¡ gS t d
|ƒrŽt
|ƒ}n,t d
|ƒrº| d¡}t
|d ƒd |d }||gS d S )Nzipset:é ró ÚdstÚsrcú,r rO ú --match-setz Can't match a destination MAC.Úmacú --mac-sourcer, ú/r rz )
rà rv rT ÚipsetZ
get_dimensionr r
r Úupperr r r
Úsplit)rb r ÚaddressÚinvertrÉ ÚflagsÚ
addr_splitrD rD rE r ^ s"
z ip4tables._rule_addr_fragmentc C sž dddœ| }|dkr"|dkr"dnd}| j jj||t|d} d d
d d d
d œ| }
t|ƒrd|d v rdg S |d
| d|d|g} | | |
|¡¡ | d| g¡ | gS )Nr6 r/ rô r( r$ TFr rñ ró r rò r r rƒ r
)rT rá rÿ r r rõ r ) rb rû rœ rá r r€ r rø r râ r r{ rD rD rE Ú build_zone_source_address_rulest s" ûú z)ip4tables.build_zone_source_address_rulesc
C s¾ dddœ| }dddœ| }|dkr0|dkr0dnd }| j jj||t|d
}| j j |¡} | j| t|d | d | d
| d| d| gƒ¡ g }
|
||d|g¡ |
|d
| d|g¡ |
|d | d|g¡ |
|d | d|g¡ |
|d| d|g¡ |
|d| d|g¡ | j r6|
||d|dd|df g¡ |
||d|dd
| g¡ |
||d|dd | g¡ |
||d|dd | g¡ |
||d|dd| g¡ |
||d|dd| g¡ | j rÞ|
||d|dd|df g¡ | j jj
| j } | j ¡ dkrb|dkrb| t
ddfv r8|
||d|ddddd | g ¡ | d krb|
||d|ddddd | g ¡ |dkr¬| t
d ddd fv r¬| t
fv r’d} n| } |
||d|d| g¡ |sº|
¡ |
S ) Nr8 r1 rô r4 r/ r( r$ TFr z%s_logú%s_denyz%s_prez%s_postú%s_allowrƒ rà rê rç ré r® r) rª r© r ÚLOGú --log-prefixz %s_REJECT: rß z %s_DROP: ÚACCEPT)rT rá rÿ r rþ ra rä rO r„ Zderived_from_zoneZ _policiesÚtargetÚget_log_deniedr Úreverse)
rb rû rá r€ r Z
add_del_chainZ add_del_ruler râ rü rÍ r# Ú_targetrD rD rE Úbuild_policy_chain_rulesŒ sf û
þ
þ
ÿ z"ip4tables.build_policy_chain_rulesc C s |rddd|j gS g S )Nr Úlimitz--limit)Úvalue)rb r( rD rD rE Ú _rule_limitÅ s zip4tables._rule_limitc C sÆ t |jƒttttfv rn<|jrJt |jƒttt t
fvrTt t dt |jƒ ƒ‚n
t t dƒ‚|j
dkr°t |jƒtttfv s„t |jƒtt
fv rˆdS t |jƒtfv sªt |jƒtt fv rÂdS n|j
dk r¾dS dS d S )NúUnknown action %szNo rule action specified.r ÚallowZdenyrí rî )r¡ rÐ r r r r r r r r r r
r r¥ ©rb Ú rich_rulerD rD rE Ú_rich_rule_chain_suffixÊ s$
ÿÿ
z!ip4tables._rich_rule_chain_suffixc C s: |j s|jsttdƒ‚|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r rí rî )r Úauditr
r r¥ r- rD rD rE Ú _rich_rule_chain_suffix_from_logà s
z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr r´ )r¥ r- rD rD rE Ú _rich_rule_priority_fragmentë s
z&ip4tables._rich_rule_priority_fragmentc
C s" |j s
g S | jj ||t¡}dddœ| }| |¡}d||d||f g} | | |¡7 } t|j ƒtkrÂ| |ddg 7 } |j j rŒ| d|j j g7 } |j j
r¨| d d
|j j
g7 } |j j rÀ| d |j j g7 } nJ| |dd g 7 } |j j
rî| d
d
|j j
g7 } |j j r | dd
|j j g7 } | |
|j j¡7 } | S )Nr4 r/ rô rƒ rê rà ZNFLOGz
--nflog-groupz--nflog-prefixrk z--nflog-thresholdr r! z --log-level)r rT rá rÿ r r1 r2 r¡ r ÚgroupÚprefixZ thresholdÚlevelr* r( )
rb rá r. rû r€ Ú
rule_fragmentrâ rø rú r{ rD rD rE Ú_rich_rule_logð s,
zip4tables._rich_rule_logc C sÄ |j s
g S dddœ| }| jj ||t¡}| |¡}d||d||f g} | | |¡7 } | |7 } t|jƒt krrd}
n,t|jƒt
kr†d}
nt|jƒt kršd}
nd }
| d
d d |
g7 } | | |j j
¡7 } | S )
Nr4 r/ rô rƒ rê ZacceptZrejectZdropÚunknownrà ZAUDITz--type)r0 rT rá rÿ r r1 r2 r¡ r r r r r* r( ) rb rá r. rû r€ r6 rø râ rú r{ Ú_typerD rD rE Ú_rich_rule_audit
s$
zip4tables._rich_rule_auditc C s2 |j s
g S dddœ| }| jj ||t¡}| |¡}d||f } t|j ƒtkrXddg}
nžt|j ƒtkrˆddg}
|j jrö|
d|j jg7 }
nnt|j ƒt kr dd g}
nVt|j ƒt
krâd
}| jj ||t¡}d||f } dd d |j j g}
nt t
d
t|j ƒ ƒ‚d||| g} | | |¡7 } | ||
7 } | | |j j¡7 } | S )Nr4 r/ rô rê rà r" rª r« rß r' ÚMARKz --set-xmarkr+ rƒ )r rT rá rÿ r r/ r¡ r r r r rO r
r r2 r* r( ) rb rá r. rû r€ r6 rø râ rú r Z rule_actionr{ rD rD rE Ú_rich_rule_action& s6
ÿ zip4tables._rich_rule_actionc C sÔ |sg S g }|j rŒ|jr"| d¡ td|j ƒrB|dt|j ƒg7 }qÐtd|j ƒr||j d¡}|dt|d ƒd |d g7 }qÐ|d|j g7 }nD|jrÐ|ddg7 }|jr®| d¡ | jj
|jd ¡}|d
|j|g7 }|S ) Nú!r, ró r r rz r rO r r ) r r r„ r r r
r r rT rœ Ú_ipset_match_flags)rb Z rich_destr6 r r rD rD rE Ú _rich_rule_destination_fragmentH s&
"
z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j rŒ|jr"| d¡ td|j ƒrB|dt|j ƒg7 }nHtd|j ƒr||j d¡}|dt|d ƒd |d g7 }n|d|j g7 }nŽt|dƒrÈ|jrÈ|ddg7 }|jr¸| d¡ |d |jg7 }nRt|d
ƒr|j r|dd g7 }|jrø| d¡ | j
j |j d ¡}|d
|j |g7 }|S )Nr= r, rñ r r rz r r r r rO r r )
r r r„ r r r
r Úhasattrr r rT rœ r> )rb Z rich_sourcer6 r r rD rD rE Ú_rich_rule_source_fragment` s0
"
z$ip4tables._rich_rule_source_fragmentc C sð dddœ| }d}| j j ||t¡} d|g}
|rD|
ddt|ƒ g7 }
|rT|
d|g7 }
|rx|
| |j¡7 }
|
| |j¡7 }
g } |rÊ| |
|||||
¡¡ | | |||||
¡¡ | | |||||
¡¡ n"| |d | d
|g|
d d g ¡ | S )
Nr4 r/ rô r) ú-pú--dportrk ró r rƒ rà r" ©
rT rá rÿ r r r? Ú destinationrA Úsourcer„ r7 r: r< © rb rû rá ÚprotoÚportrE r. rø r€ râ r6 rÍ rD rD rE Úbuild_policy_ports_rules} s, ÿÿz"ip4tables.build_policy_ports_rulesc C sØ dddœ| }d}| j j ||t¡}d|g} |r<| d|g7 } |r`| | |j¡7 } | | |j¡7 } g }
|r²|
| ||||| ¡¡ |
|
||||| ¡¡ |
| ||||| ¡¡ n"|
|d| d|g| d d
g ¡ |
S ) Nr4 r/ rô r) rB ró r rƒ rà r" ) rT rá rÿ r r? rE rA rF r„ r7 r: r< ) rb rû rá ÚprotocolrE r. rø r€ râ r6 rÍ rD rD rE Úbuild_policy_protocol_rules– s( ÿÿz%ip4tables.build_policy_protocol_rulesc C s´ d}d}| j j ||t¡}dddœ| } g d¢}
|rl| |¡}|
| |¡7 }
|
| |j¡7 }
|
| |j ¡7 }
|dks||d u rŠ|
g d¢7 }
n|
d d
d |g7 }
d d| d
||f g|
gS )Nr, r) r4 r/ rô )rB Ztcpz --tcp-flagszSYN,RSTZSYNZpmtu)rà ÚTCPMSSz--clamp-mss-to-pmturà rM z --set-mssrƒ rê )
rT rá rÿ r r/ r2 r? rE rA rF ) rb rû rá Ztcp_mss_clamp_valuerE r. rú r€ râ rø r6 rD rD rE Ú build_policy_tcp_mss_clamp_rules s
z*ip4tables.build_policy_tcp_mss_clamp_rulesc C sð dddœ| }d}| j j ||t¡} d|g}
|rD|
ddt|ƒ g7 }
|rT|
d|g7 }
|rx|
| |j¡7 }
|
| |j¡7 }
g } |rÊ| |
|||||
¡¡ | | |||||
¡¡ | | |||||
¡¡ n"| |d | d
|g|
d d g ¡ | S )
Nr4 r/ rô r) rB z--sportrk ró r rƒ rà r" rD rG rD rD rE Ú build_policy_source_ports_rulesÁ s, ÿÿz)ip4tables.build_policy_source_ports_rulesc C sv d}| j j ||t¡} dddœ| }
|
d| ddd|g} |rP| dd t|ƒ g7 } |r`| d
|g7 } | d d d
|g7 } | gS )Nr& r4 r/ rô r rƒ rB rC rk ró rà ZCTz--helper)rT rá rÿ r r ) rb rû rá rH rI rE Z helper_nameZmodule_short_namer€ râ rø r{ rD rD rE Ú build_policy_helper_ports_rulesÛ s z)ip4tables.build_policy_helper_ports_rulesc
C s‚ dddœ| }| j j ||t¡}g } |rH| dd|d| d|dd g¡ n6t|ƒrTg S | dd|d| g| d
|¡ dd g ¡ | S ) Nr4 r/ rô rƒ r) r rð rà r" ró )rT rá rÿ r r„ r r )
rb rû rœ rá r€ r rF rø râ rÍ rD rD rE Úbuild_zone_forward_rulesê s ÿ
ÿþz"ip4tables.build_zone_forward_rulesc
C sœ d}| j jj||tdd}dddœ| }g }|rj| |¡}|| |¡7 }|| |j¡7 }|| |j ¡7 }nd}g } |
dd|d ||f g| g d
¢ ¡ | S ) Nr( Tr r4 r/ rô r, rƒ rê )r= rð Úlorà Z
MASQUERADE) rT rá rÿ r r/ r2 r? rE rA rF r„ )
rb rû rá r. r€ râ rø r6 rú rÍ rD rD rE Ú build_policy_masquerade_rulesü s"
ÿþz'ip4tables.build_policy_masquerade_rulesc C s
d}| j j ||t¡} dddœ| }
d} |rPtd|ƒrH| dt|ƒ 7 } n| |7 } |rn|dkrn| dt|d ƒ 7 } g } |r¬| |¡}
| |¡} | | |j
¡7 } | | |j ¡7 } nd
}
g }|rÐ|
| |||d| ¡¡ |
d d|
d | |
f g| d
|dt|ƒddd| g ¡ |S )Nr( r4 r/ rô r r, z[%s]z:%sú-r, rƒ rê rB rC rà ZDNATz--to-destination)rT rá rÿ r r r r r/ r2 r? rE rA rF r„ r7 )rb rû rá rI rK ZtoportZtoaddrr. r€ râ rø Útor6 rú rÍ rD rD rE Ú build_policy_forward_port_rules s8
ÿ ÿþz)ip4tables.build_policy_forward_port_rulesc C s´ | j dkrL|tv rLt| \}}}|r,t|ƒnt|ƒd t|ƒ }ddd|gS | j dkr˜|tv r˜t| \}}}|rxt|ƒnt|ƒd t|ƒ }ddd|gS ttd |› d
| j› ƒ‚d S ) Nr+ r r r- z --icmp-typer, Zicmp6z
--icmpv6-typez
ICMP type z not supported by )rU r r‡ r r
r rÉ )rb Z icmp_typer9 Ú_codeZ
_omit_codeZ _type_strrD rD rE Ú_icmp_types_fragment4 s ÿz ip4tables._icmp_types_fragmentc C s° d}| j j ||t¡}dddœ| }| jdkrDddg}| |j¡} nddg}| |j¡} g }
| j j |¡rxd | } d
} n d | } d } g }
|r¬|
| |j ¡7 }
|
|
|j ¡7 }
|
|| 7 }
|rL|
|
|||||
¡¡ |
| |||||
¡¡ |jr|
| |||||
¡¡ n:| |¡}|
d
||d||f g| |¡ |
dd g ¡ n`| j ¡ dkrŽ| d
krŽ|
|| d
|g|
ddddd| g ¡ |
|| d
|g|
d| g ¡ |
S )Nr) r4 r/ rô r+ rB r- r. r r" r r© rƒ rê rà r® r r r! ú%s_ICMP_BLOCK: )rT rá rÿ r rU rX rÉ Úquery_icmp_block_inversionr? rE rA rF r„ r7 r: r r< r/ r2 r$ )rb rû rá Zictr. r€ râ rø rH ÚmatchrÍ Z final_chainZ final_targetr6 rú rD rD rE Ú build_policy_icmp_block_rulesB s\
ÿþýÿÿþÿþz'ip4tables.build_policy_icmp_block_rulesc C sÎ d}| j j ||t¡}g }d}| j j |¡rŒd}| j ¡ dkr|rRd|t|ƒg}nd|g}|d|dd d
d d d
d| g }| |¡ |d7 }nd}|r¤d|t|ƒg}nd|g}|d|dd d |g }| |¡ |S )Nr) é r© r® r6 r/ rƒ rB r¬ r rà r r! rY rz r" )rT rá rÿ r rZ r$ r‡ r„ ) rb rû rá r€ râ rÍ Zrule_idxZ
ibi_targetr{ rD rD rE Ú'build_policy_icmp_block_inversion_ruless s0
ý
z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| |j¡7 }|| |j¡7 }g }| | |||||¡¡ | | |||||¡¡ | | |||||¡¡ |S )Nr) )r? rE rA rF r„ r7 r: r< )rb rû rá r. r€ r6 rÍ rD rD rE Ú*build_policy_rich_source_destination_rules• s z4ip4tables.build_policy_rich_source_destination_rulesc C s
|| j kS re )rU )rb rU rD rD rE r £ s zip4tables.is_ipv_supported)N)N)r® )F)F)NN)NN)NN)NN)NN)N)N)N)9Ú__name__Ú
__module__Ú __qualname__rU rÉ Zpolicies_supportedrd r\ rÕ r~ r‚ r† rˆ rŠ r‹ rŒ rŽ rž r¨ rÔ r× rØ rX rZ rÞ rã rå ræ rë rì r r
r r r' r* r/ r1 r2 r7 r: r< r? rA rJ rL rN rO rP rQ rS rV rX r\ r^ r_ r rD rD rD rE rS « st
&Pa#
N ÿ
9 "
ÿ
ÿ
"
1"rS c @ s& e Zd ZdZd Zddd„Zdd„ ZdS ) Ú ip6tablesr, Fc C s~ g }g d¢}| j jdkr"|dg7 }| g d¢| ddg ¡ |dkr^| g d¢| g d¢ ¡ | g d ¢¡ | g d
¢¡ |S ) N)r Zrpfilterz--invertz --validmarkZloosez--loose)r6 r# rƒ r' rà rß r® )rà r r! zrpfilter_DROP: ) r6 r# rƒ r' rB r. z$--icmpv6-type=neighbour-solicitationrà r" ) r6 r# rƒ r' rB r. z"--icmpv6-type=router-advertisementrà r" )rT Z_ipv6_rpfilterr„ )rb rÎ rÍ Zrpfilter_fragmentrD rD rE Úbuild_rpfilter_rulesª s$
ÿþ
ÿþz ip6tables.build_rpfilter_rulesc
C sÊ g d¢}d}| j d |¡ g }| ddd|g¡ |D ]L}| ddd|d|dd d
d g
¡ | jjd v r6| ddd|d|dd
ddg
¡ q6| dddddd|g¡ | dddd| j ¡ dkrºdndd|g¡ |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r) rƒ r8 r6 ró rà rª r« z addr-unreach)r° Úallr r! zRFC3964_IPv4_REJECT: r! Ú4r" r® Ú6Ú5)ra r… r„ rT Z _log_deniedr$ )rb Z
daddr_listZ
chain_namerÍ ZdaddrrD rD rE Úbuild_rfc3964_ipv4_rules s.
þ þÿ þz"ip6tables.build_rfc3964_ipv4_rulesN)F)r` ra rb rU rÉ rd ri rD rD rD rE rc ¦ s
rc )3Zos.pathrf r½ Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r
r Zfirewallr Zfirewall.errorsr
r r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser Zfirewall.core.icmpr r r r r r¿ rÀ rF rJ rR ÚobjectrS rc rD rD rD rE Ú sL ( , û þþ%*