a
is @ s` d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z m Z d dl
mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z m Z m Z d dl m Z d dl!m"Z"m#Z# d d l$m%Z% d
Z&e&d d Z'e&d d
Z(dZ)dZ*i ddde* fidde* fdde* fdde* fddd e* fdd e* fdd e* fdd e* fddZ+G d d d e,Z-dS ) )GLibN)log) check_mac getPortRange normalizeIP6check_single_address
check_address)
FirewallError
UNKNOWN_ERROR INVALID_RULEINVALID_ICMPTYPE INVALID_TYPE
INVALID_ENTRY INVALID_PORT) Rich_Accept Rich_Reject Rich_Drop Rich_MarkRich_MasqueradeRich_ForwardPortRich_IcmpBlockRich_Tcp_Mss_Clamp
Rich_NFLog)DEFAULT_ZONE_TARGET)
ICMP_TYPES ICMPV6_TYPES)NftablesZ firewalld_Z policy_dropZprobeZpolicy_
PREROUTING
preroutingijiZ postroutingd output)r POSTROUTINGOUTPUTinputZforward)r INPUTFORWARDr$ )rawmanglenatfilterc @ sr e Zd Zd ZdZdd Zdd Zdd Zdd Zd
d Z d d
Z
dd Z dd Z dd Z
dddZdd Zdd Zdd Zd d Zd d Zdd!d"Zd#d$ Zdd&d'Zd(d) Zd*d+ Zdd-d.Zd/d0 Zd1d2 Zd3d4 Z d5d6 Z d7d8 Z d9d: Z d;d< Z d=d> Z!d?d@ Z"dAdB Z#dCdD Z$dEdF Z%dGdH Z&dIdJ Z'dKdL Z(dMdN Z)ddOdPZ*dQdR Z+dSdT Z,dUdV Z-dWdX Z.ddYdZZ/dd[d\Z0dd]d^Z1dd_d`Z2dadb Z3ddcddZ4ddedfZ5ddgdhZ6ddidjZ7dkdl Z8ddmdnZ9dodp Z:ddqdrZ;dsdt Zdydz Z?dd{d|Z@dd}d~ZAdd ZBdddZCdd ZDdd ZEdd ZFdd ZGdd ZHdd ZIdd ZJdddZKdS )nftablesTc C sZ || _ d| _d| _g | _i | _i | _i | _i | _i | _t | _
| j
d | j
d d S )NTF)
_fwZrestore_command_existssupports_table_ownerZavailable_tablesrule_to_handlerule_ref_countrich_rule_priority_countspolicy_priority_countszone_source_index_cacher r, set_echo_outputZset_handle_output)selffw r7 :/usr/lib/python3.9/site-packages/firewall/core/nftables.py__init__\ s znftables.__init__c C s zddddiidddt dd gd
iigi}| j|\}}}|rHtd ddddiid ddt d
iigi}| jd | j|\}}}| jd |d d d d }| dddt d
ii| j d|vsd |vrtd t d d| _
W n t d d| _
Y n0 d S )Nr, metainfojson_schema_version addtableinetownerpersist)familynameflagsz!nftables probe table owner failedlistrB rC FTrD deletez3nftables: probe_support(): owner flag is supported.z7nftables: probe_support(): owner flag is NOT supported.) TABLE_NAME_PROBEr, json_cmd
ValueErrorr4 set_ruler- get_log_deniedr debug2r. )r5 rulesrcr" r rD r7 r7 r8 _probe_support_table_ownerk sH
z#nftables._probe_support_table_ownerc C s | d S N)rP r5 r7 r7 r8
probe_support s znftables.probe_supportc C sx dD ]}||v r qqd|| d v r^|| d d d || d d d f}|| d d= n(d|| d v rd }|| d d= nd S || d d }|r|dkr||v r||| v r|| | n|dkrt||vrg ||< |r&||| vr|| | || jd d
d || |}n t|| }|| }||= |d krT||d
< n |d8 }||d< ||d d d< d S )Nr= insertrG %%ZONE_SOURCE%%rulezoneaddress%%ZONE_INTERFACE%%rB rG c S s | d S )Nr r7 xr7 r7 r8 z3nftables._run_replace_zone_source..)keyr rU r< r= index)removeappendsortr` len)r5 rW r3 verbZ zone_sourcerB r`
_verb_snippetr7 r7 r8 _run_replace_zone_source sD
z!nftables._run_replace_zone_sourcec C sB d|v rdt |d iS d|v r4dt |d iS ttdd S )NrU rG r= zFailed to reverse rule)copydeepcopyr r
)r5 dictr7 r7 r8 reverse_rule s
znftables.reverse_rulec
C s dD ]}||v r qq||| d v r|| d | }|| d |= t |tkr\ttd|| d d || d d f}|dkr||vs||| vs|| | dkrttd|| | d 8 < n||vri ||< ||| vrd|| |< d}t|| D ]J}||kr"|d
kr" qP||| | 7 }||kr|d kr qPq|| | d 7 < || } ||= |dkr| |d
< n |d 8 }| |d < ||d d d < d S )
NrT rW z%priority must be followed by a numberrB chainrG r z*nonexistent or underflow of priority countr< rU r= r` )typeintr r r
sortedkeys)
r5 rW Zpriority_countstokenre priorityrl r` prf r7 r7 r8 _set_rule_replace_priority sH
z#nftables._set_rule_replace_priorityc C sb dD ]X}||v rd|| v rt || d }dD ]}||v r2||= q2tj|dd}| S qd S )NrT rW )r` handleZpositionT)Z sort_keys)rh ri jsondumps)r5 rW re rule_keyZnon_keyr7 r7 r8
_get_rule_key s
znftables._get_rule_keyc C sX g d}g d}g }g }t | j}t | j}t | j} | j }
|D ]} t| tkrjtt d| |D ]} | | v rn qqn| | vrtt
d| | | }
|
|
v r4t
d| j|
|
|
| dkr|
|
d7 < qJnV|
|
dkr|
|
d8 < qJn6|
|
dkr |
|
d8 < ntt d|
|
|
f n|
rL| dkrLd|
|
< || t | }|
rttd || d d
|| d d
< | ||d | ||d | || | dkrdd |d d d
|d d d |d d d | j|
dii}|| qJddddiig| i}t dkrDt d| jt| | j|\}}}|dkrxtdd|t|f || _|| _| | _|
| _d}|D ]} |d7 }| | }
|
sqd| v r| j|
= | j|
= q|D ] } | |d | v r qq| |d | vrqt |d | | d d kr2q|d | | d d | j|
< qd S )N)r= rU rG flushreplace)r= rU r{ z#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %srG r< z)rule ref count bug: rule_key '%s', cnt %drW expr%%RICH_RULE_PRIORITY%%%%POLICY_PRIORITY%%rB r> rl )rB r> rl ru r, r: r; z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s
JSON blob:
%szpython-nftablesru ) rh ri r1 r2 r3 r0 rm rj r r
r ry r rM __class__rb rE r+ rt rg r/ ZgetDebugLogLevelZdebug3rv rw r, rI rJ TABLE_NAME_POLICY)r5 rN
log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesr1 r2 r3 r0 rW re rx Z_ruleZ json_blobrO r" errorr` r7 r7 r8 set_rules s
&
znftables.set_rulesc C s | |g| dS )N )r )r5 rW r r7 r7 r8 rK s s znftables.set_ruleNc C s |r
|gS t S rQ )IPTABLES_TO_NFT_HOOKrp r5 r> r7 r7 r8 get_available_tablesw s z nftables.get_available_tablesc C sB ddd|dii}|t kr<| jjr<| jr r? rF r@ rA rD )
TABLE_NAMEr- Z_nftables_table_ownerr. )r5 r> rW r7 r7 r8 _build_add_table_rules{ s z nftables._build_add_table_rulesc C s | |ddd|diig S )NrG r> r? rF )r r r7 r7 r8 _build_delete_table_rules s z"nftables._build_delete_table_rulesc C s( i | _ i | _i | _i | _i | _| tS rQ )r/ r0 r1 r2 r3 r r rR r7 r7 r8 build_flush_rules s znftables.build_flush_rulesc C sP ddd| }|ddt dd|f dd d
d iid d
ddgididd igdiiS )Nr= rG TFrW r? %s_%sr+ matchctr_ stateinset establishedrelatedleftoprightacceptrB r> rl r| )r )r5 enablehookadd_delr7 r7 r8 _build_set_policy_rules_ct_rule s
z(nftables._build_set_policy_rules_ct_rulec
C sN g }|dkrZ| | t dD ]6}|dddtdd|f d|d t d
d d ii q n|d
kr&| | t dD ]}|| }| }d| }|dddt|d|dt d
d d ii || d| |dkrdd i}n |d
krd d i}nddddi}|dddt||gdii qxn$|dkr@|| t7 }n
tt d|S )NZPANIC)r r" r= rl r? r r( r+ ir< drop)rB r> rC rm r priopolicyDROP)r& r' r$ Zfilter_r TACCEPTr rejecticmpxadmin-prohibitedrm r| rW r znot implemented)
extendr r rb NFT_HOOK_OFFSETlowerr r r r
)r5 r Zpolicy_detailsrN r Zd_policyZ
chain_nameZ
expr_fragmentr7 r7 r8 build_set_policy_rules s`
z nftables.build_set_policy_rulesc C sJ t }|d u s|dkr$|t |d u s4|dkrB|t t|S )Nipv4ipv6)r updater rp r rE )r5 ipvZ supportedr7 r7 r8 supported_icmp_types s z nftables.supported_icmp_typesc C s
| tS rQ )r r rR r7 r7 r8 build_default_tables s z nftables.build_default_tablesoffc C s" g }t d D ]}|dddtd| ddt d | d t d | d d
ii d D ]&}|dddtd ||f d
ii qXdD ]6}|dddtd| ddd ||f iigdii qqt d D ] }|dddtd| ddt d | d t d | d d
ii |dv r|dD ]Z}|dddtd||f d
ii |dddtd| ddd||f iigdii q qd D ](}|dddtd||f d
ii qdD ]8}|dddtd| ddd||f iigdii qqt d D ]F}|dddtd| ddt d | d t d | d d
ii q|dddtdd ddd d iid d d d!gid"id#d igdii |dddtdd ddd d$iid d%d"id#d igdii |dddtdd dd&d d'iid(d)d"id#d igdii |d*krR|dddtdd ddd d iid d d+gid"i| |d,d-d.iigdii |dddtdd ddd d iid d d+gid"id/d igdii d D ](}|dddtd0d|f d
ii qdD ]8}|dddtdd ddd0d|f iigdii q|d*kr<|dddtdd | |d,d-d1iigdii |dddtdd d2d3d4d5igdii |dddtdd6 ddd d iid d d d!gid"id#d igdii |dddtdd6 ddd d$iid d%d"id#d igdii |dddtdd6 dd&d d'iid(d)d"id#d igdii |d*kr||dddtdd6 ddd d iid d d+gid"i| |d,d-d.iigdii |dddtdd6 ddd d iid d d+gid"id/d igdii d7D ](}|dddtd0d6|f d
ii qdD ]Z}|dddtd0d6|f d
ii |dddtdd6 ddd0d6|f iigdii qd8D ](}|dddtd0d6|f d
ii qP|d*kr|dddtdd6 | |d,d-d1iigdii |dddtdd6 d2d3d4d5igdii |dddtdd9 ddd d iid d d d!gid"id#d igdii |dddtd:dd&d d;iid(d)d"id#d igdii d7D ]Z}|dddtd0d9|f d
ii |dddtdd9 ddd0d9|f iigdii qbd8D ]Z}|dddtd0d9|f d
ii |dddtdd9 ddd0d9|f iigdii q|S ) rC rm r r ) POLICIES_preZONES
POLICIES_postz mangle_%s_%srB r> rC )r rW jumptargetr r* znat_%s)r$ )r r nat_%s_%sz filter_%sr& r r r_ r r r r r r r statusdnatmetaiifname==lor Zinvalidr prefixzSTATE_INVALID_DROP: r filter_%s_%szFINAL_REJECT: r r r r r' )r )r r$
filter_OUTPUToifname)r rp rb r _pkttype_match_fragment)r5 r Z
default_rulesrl Zdispatch_suffixr7 r7 r8 build_default_rules s
z nftables.build_default_rulesc C s2 |dkrddgS |dkr dgS |dkr.ddgS g S )Nr+ r& r' r) r r* r# r7 r r7 r7 r8 get_zone_table_chains s z nftables.get_zone_table_chainsc
sJ j j|jdk r dnddkr4dkr4dnd} j j|t| g }
g } g } g }
|D ]V}|t|d d kr|
d
d d d
iid|d t|d d di q`| | q`|D ]X}|t|d d kr
| d
d d diid|d t|d d di q|
| q| r>|
d
d d d
iidd| idi |
rf| d
d d diidd|
idi |r|D ]}|
d| qp|r|D ]}| d| q fdd}g }|
r|
D ]:}| r| D ]}|||| qn|||d qn4| r6| D ]}||d | q n||d d |S )Nr prepostr* r# TFr< +r r r_ r r *r r r saddrdaddrc s | rT|rTd| d d v rTd|d d v rT| d d d d |d d d d krTd S g }| rf| | |rt| | | ddd f ii dtd f |d
}| rd d |iiS d
d |iiS d S )Npayloadr r protocolr r r r? z%s_%s_POLICIES_%sr r= rW rG )rb r r _policy_priority_fragment)ingress_fragmentegress_fragmentexpr_fragmentsrW _policyrl chain_suffixr p_objr5 r> r7 r8 _generate_policy_dispatch_rule s0
zRnftables.build_policy_ingress_egress_rules.._generate_policy_dispatch_rule) r- r
get_policyrr policy_base_chain_namePOLICY_CHAIN_PREFIXrd rb _rule_addr_fragment)r5 r r r> rl Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesisSNATZingress_fragmentsZegress_fragmentsZ$ingress_interfaces_without_wildcardsZ#egress_interfaces_without_wildcardsZingress_interfaceZegress_interfacesrcdstr rN r r r7 r r8 !build_policy_ingress_egress_rules sf
z*nftables.build_policy_ingress_egress_rulesFc C sN |dkr|dkrdnd}| j jj||t|d} dddddd| }
|t|d d
krn|d t|d d }d } |d kr| d
d|| f iig} n,ddd|
iid|di| d
d|| f iig} |r|sd}
dtd||f | d}|| nP|rd}
dtd||f | d}n.d}
dtd||f | d}|s@|| |
d|iigS )Nr* r# TFr r r r r# r& r' r$ r< r r gotor r r r r_ r r rU r? %s_%s_ZONESr r= rG rW )r- r r r rd r r _zone_interface_fragment)r5 r rX r interfacer> rl rb r r optactionr re rW r7 r7 r8 !build_zone_source_interface_rules5 sZ
z*nftables.build_zone_source_interface_rulesc
C s |dkr|dkrdnd}| j jj||t|d}ddd| } d d
d d d
d | }
d } d
td||f | |
|| dd||f iigd} | | || | d| iigS )Nr* r# TFr rU rG r r r r r r? r r r r rW )r- r r r r r r _zone_source_fragment)
r5 r rX r rY r> rl r r r r r rW r7 r7 r8 build_zone_source_address_rulesg s*
z(nftables.build_zone_source_address_rulesc C sp ddd| }|dkr"|dkr"dnd}| j jj||t|d}| j j|}g } | |d d
td ||f d ii d
D ](}
| |d d
td|||
f d ii qt|jr| ddd
td ||f ddd||df iigdii d
D ]<}
| |dd
td ||f ddd|||
f iigdii q|jr^| ddd
td ||f ddd||df iigdii | j jj| j } | j
dkr|dkr| t dddfv r| } | t dfv rd} | |dd
td ||f | | j
ddd || f iigdii |dkr^| t d dddfv r^| t ddfv r,|
}
n | d i}
| |dd
td ||f |
gdii |sl| | S ) Nr= rG r r* r# TFr rl r? r r )r r denyallowr %s_%s_%srW r r r r r r r+ ZREJECTz
%%REJECT%%r r r zfilter_%s_%s: r )r- r r r r rb r Zderived_from_zoneZ _policiesr rL r r _reject_fragmentr reverse)r5 r r r> rl r r r r rN r r Z
log_suffixtarget_fragmentr7 r7 r8 build_policy_chain_rules sx
z!nftables.build_policy_chain_rulesc C s< |dkr i S |dv r,ddddiid|diS t td |d S )
Nall)unicast broadcastZ multicastr r r_ pkttyper r zInvalid pkttype "%s"r r )r5 r r7 r7 r8 r s z nftables._pkttype_match_fragmentc C s ddddiddddiddddiddddiddddiddddiddddiddddiddddiddddiddd diddd diddd
diddd
didd d
diddd diddd diddd
diddd
diddddiddddidddiidddiid}|| S )Nr icmpzhost-prohibitedr znet-prohibitedr icmpv6znet-unreachablezhost-unreachablezport-unreachabler zprot-unreachablezaddr-unreachableno-routerm z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz
net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp6-addr-unreachable addr-unreachzicmp6-no-router z tcp-resetztcp-rstr7 )r5 Z reject_typeZfragsr7 r7 r8 _reject_types_fragment s2
z nftables._reject_types_fragmentc C s ddddiS )Nr r r r r7 rR r7 r7 r8 r s znftables._reject_fragmentc C s ddddiiddddgid iS )
Nr r r_ l4protor r r r r r7 rR r7 r7 r8 _icmp_match_fragment s
z nftables._icmp_match_fragmentc C sn |si S ddddd}z|j d}W n tyB ttdY n0 dt|j d | ||j |d
d iS ) NsecondZminuteZhourZday)smhd/zExpected '/' in limitlimitr r< )ZrateZper)valuer` rJ r r rn )r5 r Z rich_to_nftir7 r7 r8 _rich_rule_limit_fragment s z"nftables._rich_rule_limit_fragmentc C s t |jttttfv rn<|jrJt |jttt t
fvrTt t dt |j n
t t d|j
dkrt |jtttfv st |jtt
fv rdS t |jtfv st |jtt fv rdS n|j
dk rdS dS d S )NUnknown action %szNo rule action specified.r r r r r )rm elementr r r r r r r r r r r rr r5 rich_ruler7 r7 r8 _rich_rule_chain_suffix s$
z nftables._rich_rule_chain_suffixc C s: |j s|jsttd|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r r )r auditr r rr r r7 r7 r8 _rich_rule_chain_suffix_from_log s
z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )NrZ r7 rR r7 r7 r8 r ( s z!nftables._zone_interface_fragmentc C sN t d|rt|}n,td|r@|d}t|d d |d }d||diS )Nr r r r< rV )rX rY )r r r split)r5 rX rY Z
addr_splitr7 r7 r8 r + s
z nftables._zone_source_fragmentc C s
d|j iS )Nr~ rr )r5 r r7 r7 r8 r 3 s z"nftables._policy_priority_fragmentc C s |r|j dkri S d|j iS )Nr r} r r r7 r7 r8 _rich_rule_priority_fragment6 s z%nftables._rich_rule_priority_fragmentc C s
|j s
i S | jj||t}ddd| }| |}i } t|j tkr||j jrZt |j jnd| d< |j j
rt |j j
| d< n,|j j rd|j j krdn|j j }
d |
| d
< |j j rd |j j | d < d t
d
|||f || |j jd| ig d} | | | |d| iiS )Nr= rG r r groupzqueue-thresholdZwarningwarnr levelr r? r r r rW )r r- r r r r rm r r rn Z thresholdr r r r r r r ) r5 r r
r r> r r r r Z log_optionsr rW r7 r7 r8 _rich_rule_log; s4
znftables._rich_rule_logc
C s |j s
i S | jj||t}ddd| }| |}dtd|||f || |j jdddiig d } | |
| |d
| iiS ) Nr= rG r r? r r r r r rW ) r r- r r r r r r r r r )
r5 r r
r r> r r r r rW r7 r7 r8 _rich_rule_audit[ s
znftables._rich_rule_auditc
C s |j s
i S | jj||t}ddd| }| |}d|||f } t|j tkr\dd i}
n t|j tkr|j jr| |j j}
ndd i}
nt|j t
krdd i}
nt|j t krHd}| jj||t}d|||f } |j j
d } t| d
kr,dd d d
iiddd d d
ii| d
gi| d gidi}
ndd d d
ii| d di}
nttdt|j dt| || |j j|
g d} | | | |d| iiS )Nr= rG r r r r r r) r r< r r_ mark^&r r_ r r
r? r rW )r r- r r r r rm r r r r r r r rd r r r r r r r )
r5 r r
r r> r r r r rl Z rule_actionr rW r7 r7 r8 _rich_rule_actionm sL
"
znftables._rich_rule_actionc C s | dr0| |tdd d|kr(dnd|S t|r>d}ntd|rNd}nvtd|rd}tj|dd}d |jj |j
d
i}nDtd |rd }t |}n,d }| d
}d t |d t
|d d
i}dd||di|rdnd|diS d S )Nipset:r TFetherr ip)strictr addrrd r ip6r r r< r r r field!=r r )
startswith_set_match_fragmentrd r r r ipaddress IPv4Networknetwork_address
compressed prefixlenr r rn )r5 Z
addr_fieldrY invertrB Znormalized_addressZaddr_lenr7 r7 r8 r s,
&
z nftables._rule_addr_fragmentc C s6 |si S |dvr t td| ddddiid|diS ) Nr r zInvalid familyr r r_ nfprotor r r )r5 Z rich_familyr7 r7 r8 _rich_rule_family_fragment s z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jdS )Nr r r/ )r# ipsetr r/ )r5 Z rich_destrY r7 r7 r8 _rich_rule_destination_fragment s
z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|dr.|jr.|j}nt|drH|jrHd|j }| jd||jdS )Nmacr4 r r r3 )r# hasattrr6 r4 r r/ )r5 Z rich_sourcerY r7 r7 r8 _rich_rule_source_fragment s
z#nftables._rich_rule_source_fragmentc C sP t |}t|tr$|dk r$ttn(t|dkr8|d S d|d |d giS d S )Nr r< range)r
isinstancern r r rd )r5 portr9 r7 r7 r8 _port_fragment s
znftables._port_fragmentc
C s& ddd| }d}| j j||t} g }
|r>|
| |j |rT|
| d| |r||
| |j |
|
|j |
dd|dd id
| |d i g } |r| |
|||||
| | |||||
| | |||||
n.| |d d
td|| f |
dd ig dii | S )Nr= rG r r+ r r r dportr% r r rW r? %s_%s_allowr r r- r r r rb r2 rB r r5 destinationr8 sourcer< r r r r r5 r r protor; r@ r
r r> r r rN r7 r7 r8 build_policy_ports_rules s8
z!nftables.build_policy_ports_rulesc
C s ddd| }d}| j j||t}g } |r>| | |j |rT| | d| |r|| | |j | |
|j | dddd iid
|d i g }
|r|
| ||||| |
|
||||| |
| ||||| n.|
|d d
td||f | dd ig dii |
S )Nr= rG r r+ r r r r_ r r r rW r? r> r r )r- r r r rb r2 rB r r5 r@ r8 rA r r r r ) r5 r r r r@ r
r r> r r rN r7 r7 r8 build_policy_protocol_rules s4
z$nftables.build_policy_protocol_rulesc C s d}d}| j j||t}ddd| } g }
|r^|
| |j |
| |j | |}|
dddd d
d id d
i |dks|d u r|
dddddidddiidi n |
dddddi|di | ddt
d||f |
diigS ) Nr r+ r= rG r r r r tcprD r% Zsyn)r r r Zpmtur) z
tcp optionZmaxsegsize)rC r& Zrtr_ Zmtur rW r? r r ) r- r r r rb r5 r@ r8 rA r r ) r5 r r Ztcp_mss_clamp_valuer@ r
r r> r r r r7 r7 r8 build_policy_tcp_mss_clamp_rules s2
z)nftables.build_policy_tcp_mss_clamp_rulesc
C s& ddd| }d}| j j||t} g }
|r>|
| |j |rT|
| d| |r||
| |j |
|
|j |
dd|dd id
| |d i g } |r| |
|||||
| | |||||
| | |||||
n.| |d d
td|| f |
dd ig dii | S )Nr= rG r r+ r r r sportr% r r rW r? r> r r r? rB r7 r7 r8 build_policy_source_ports_rules8 s8
z(nftables.build_policy_source_ports_rulesc
C s d}| j j||t} ddd| }
g } |rR| dddtd||f ||dii g } |rl| | d | | d
d |d d
id| |di | dd||f i | |
ddtd| | dii | S )Nr+ r= rG r z ct helperr? z helper-%s-%s)rB r> rC rm r r r r r= r% r r rW filter_%s_allowr )r- r r r rb r r r< )
r5 r r rC r; r@ Z helper_nameZmodule_short_namer> r r rN r r7 r7 r8 build_policy_helper_ports_rulesY s6
z(nftables.build_policy_helper_ports_rulesc C s ddd| }| j j||t}g } |rv|t|d dkrT|d t|d d }ddd d
iid |d id
d ig}
n| d|d
d ig}
dtd| |
d} | |d| ii | S )Nr= rG r r< r r r r r_ r r r r r r? rK r rW )r- r r r rd r r rb ) r5 r rX r r> r rA r r rN r| rW r7 r7 r8 build_zone_forward_rulesv s( z!nftables.build_zone_forward_rulesc C s ddd| }g }g }|r\| | |j | | |j | | |j | |}n"| ddddiidd d
i d }d }| jj j
||t d
d} dt d| |f |ddddiiddd
idd ig d}
|
| | | |d|
ii |S )Nr= rG r r r r_ r1 r r r r r* Tr r? r r r' r Z
masquerader rW )rb r2 rB r5 r@ r8 rA r r- r r r r r r ) r5 r r r
r rN r r r> r rW r7 r7 r8 build_policy_masquerade_rules s<
z&nftables.build_policy_masquerade_rulesc C sp d}| j j||t} ddd| }
g } |rn| | |j | | |j | | |j
| |} n8d}
|rt d|rd}
| ddd d
iid |
d i d
} | dd|ddid |
|d i |r$t d|rt|}|r|dkr| d||
|di n| dd|ii n| dd|
|ii dtd| | f | d}|| | |
d|iigS )Nr* r= rG r r r r r r_ r1 r r r r r= r% r r )r# r; r# Zredirectr; r? r r rW )r- r r r rb r2 rB r5 r@ r8 rA r r r< r r r r )r5 r r r; r ZtoportZtoaddrr
r> r r r r r1 rW r7 r7 r8 build_policy_forward_port_rules sJ
z(nftables.build_policy_forward_port_rulesc C sH dd|ddid|dig}|d urD| dd|ddid|di |S )Nr r rm r% r r code)rb )r5 r rm rP fragmentsr7 r7 r8 _icmp_types_fragments s
z nftables._icmp_types_fragmentsc C s |dkr4|t v r4t | \}}}| d||r.d n|S |dkrh|tv rht| \}}}| d||rbd n|S ttd|| j|f d S )Nr r r r z)ICMP type '%s' not supported by %s for %s)r rR r r r rC )r5 r Z icmp_typeZ_type_codeZ
_omit_coder7 r7 r8 _icmp_types_to_nft_fragments s z%nftables._icmp_types_to_nft_fragmentsc C s: d}| j j||t}ddd| }|r6|jr6|j}n<|jrjg }d|jv rT|d d|jv rr|d nddg}g } |D ]}
| j j|rd||f } dd i} nd ||f } | } g }
|r|
| |j
|
| |j |
| |j
|
| |
|j |r| | |||||
| | |||||
|jrb| | |||||
nN| |}d
td |||f |
| g d }|| | | |d
|ii qz| j dkr| j j|s| |d
d
t| |
| | j ddd||f iig d ii | |d
d
t| |
| g d ii qz| S )Nr+ r= rG r r r r> r z
%s_%s_denyr? r r rW r r r %s_%s_ICMP_BLOCK: )r- r r r ipvsr@ rb query_icmp_block_inversionr r2 rB r5 r8 rA r rT rC r r r r r r r r rL r )r5 r r Zictr
r> r r rV rN r Z final_chainr r r rW r7 r7 r8 build_policy_icmp_block_rules sl
z&nftables.build_policy_icmp_block_rulesc C s d}| j j||t}g }ddd| }| j j|r@| }ndd i}||ddtd||f d | |gd
ii | j d kr| j j|r||ddtd||f d | |
| j d d
d||f iigd
ii |S )Nr+ r= rG r r rW r? r rB r> rl r` r| r r r rU ) r- r r r rW r rb r r rL r )r5 r r r> r rN r r r7 r7 r8 'build_policy_icmp_block_inversion_rules/ s4
z0nftables.build_policy_icmp_block_inversion_rulesc
C s$ g }d}| j jdkr ddg}n<| j jdkr8ddg}d}n"| j jdkrRg d}d}ng d}d d
d d iid
ddid d|ddid
ddig}|dkr|dddii |dd i |dddt||d ii | j jd vr |dddt|d d d d d!id
d"d#d$gidid%d igd ii |S )&NZfilter_PREROUTINGZlooser r
loose-forwardfilter_FORWARDstrict-forward)r r Ziifr r r_ r1 r r r ZfibZoif)rD resultFr r r zrpfilter_DROP: r rU rW r? r r\ r^ r r rm r% r znd-router-advertznd-neighbor-solicitr )r- _ipv6_rpfilterrb r )r5 r rN Zrpfilter_chainZ fib_flagsr r7 r7 r8 build_rpfilter_rulesN sX
z nftables.build_rpfilter_rulesc
C s g d}dd |D }dddddid d
|id ig}| j jd v rT|d
ddii || d g }|dddtdd|dii d}| j dkr|d7 }| j jdv r|d7 }|dddtd||dii |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d | dd t| dd diqS )r r r r< r" )r rn ).0r\ r7 r7 r8
r^ z5nftables.build_rfc3964_ipv4_rules..r r r$ r r% r r r )r r r r zRFC3964_IPv4_REJECT: r r= rW r? r r< rZ r r r` r] )r- Z _log_deniedrb r r rL ra )r5 Z daddr_setr rN Z
forward_indexr7 r7 r8 build_rfc3964_ipv4_rulesy s<
z!nftables.build_rfc3964_ipv4_rulesc C s d}g }| | |j | | |j | | |j g }| | ||||| | | ||||| | | ||||| |S )Nr+ )
rb r2 rB r5 r@ r8 rA r r r )r5 r r r
r> r rN r7 r7 r8 *build_policy_rich_source_destination_rules s z3nftables.build_policy_rich_source_destination_rulesc C s |dv r dS dS )N)r r ZebTFr7 )r5 r r7 r7 r8 is_ipv_supported s znftables.is_ipv_supportedc
C s ddd}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd }||v r|| S t td
| d S ) NZ ipv4_addrZ ipv6_addrr0 Z
inet_protoZ inet_servicer ZifnameZ
ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacehash:macz!ipset type name '%s' is not valid)r r
)r5 r rm Zipv_addrtypesr7 r7 r8 _set_type_list s(
znftables._set_type_listc C s |r d|v r |d dkr d}nd}dt || ||d}|dd d D ]}|d
v rLd g|d < qhqL|rd
|v rt|d
|d
< d|v rt|d |d< dd|iigS )NrB inet6r r r? )rB r> rC rm :r< ,)r netr; intervalrD timeoutZmaxelemrG r= r )r rj r rn )r5 rC rm optionsr Zset_dicttr7 r7 r8 build_set_create_rules s$
z nftables.build_set_create_rulesc C s$ | |||}| || j d S rQ )rs r r- rL )r5 rC rm rq rN r7 r7 r8
set_create s znftables.set_createc C s* dddt |dii}| || j d S )NrG r r? r )r rK r- rL )r5 rC rW r7 r7 r8 set_destroy s
znftables.set_destroyc C s | j j|jdd d}g }|D ]}|dkrd|dddii |dd |rVd
nd d i q(|d
v r|d| ||rdndd i q(|dkr|dd|rdndii q(|dkr|dddii q(ttd| q(dt |dkrd|in|d |rdndd| diS ) Nrl r< rm r; r r_ r r thr= rI r% )r rn r6 r r Zifacer r r z-Unsupported ipset type for match fragment: %sr concatr r' r @r )
r- r4 get_ipsetrm r rb _set_get_familyr r
rd )r5 rC Z
match_destr/ type_formatrQ formatr7 r7 r8 r) s*
z nftables._set_match_fragmentc C s8 | j j|}|jdd d}|d}t|t|krHttdg }t|D ]\}}|dkr z|| d} W n$ t
y | d || }
Y n,0 | || d | || | d d }
z|
d} W n t
y | |
Y n(0 | d|
d | |
| d d gi qT|d v r d|| v rP| d|| di nz|| d
} W nJ t
y || } d |j v r|j d d krt
| } | | Y n^0 || d | } d |j v r|j d d krt
| } | d
| t|| | d d di qT| || qTt|dkr4d|igS |S )Nrl r< rm z+Number of values does not match ipset type.r; rF -r9 )r rn r rB rk r r" rw )r- r4 ry rm r rd r r enumerater` rJ rb rq r rn ) r5 rC entryobjr{ Z entry_tokensfragmentr r| r` Zport_strr# r7 r7 r8 _set_entry_fragment sP
(
z nftables._set_entry_fragmentc C s0 g }| ||}|dddt||dii |S )Nr= r r? rB r> rC elem)r rb r )r5 rC r rN r r7 r7 r8 build_set_add_rules= s
z nftables.build_set_add_rulesc C s" | ||}| || j d S rQ )r r r- rL )r5 rC r rN r7 r7 r8 set_addF s znftables.set_addc C s8 | ||}dddt||dii}| || j d S )NrG r r? r )r r rK r- rL )r5 rC r r rW r7 r7 r8
set_deleteJ s
znftables.set_deletec C s dddt |diigS )Nrz r r? r )r )r5 rC r7 r7 r8 build_set_flush_rulesR s z nftables.build_set_flush_rulesc C s | |}| || j d S rQ )r r r- rL )r5 rC rN r7 r7 r8 set_flushW s
znftables.set_flushc C sJ | j j|}|jdkr d}n(|jrBd|jv rB|jd dkrBd}nd}|S )Nrh r rB rk r$ r )r- r4 ry rm rq )r5 rC r4 rB r7 r7 r8 rz [ s
znftables._set_get_familyc s g }| ||| | | |j fdd d}g }|D ]B}| || |d7 }|dkrRt fdd| g }d}qRt fdd| d S ) Nc
sT z | j W n8 tyN } z td t| W Y d }~n
d }~0 0 d S )Nz;While restoring ipset entries the following Error occurred:)r r- rL Exceptionr r )rN erR r7 r8 _idle_set_add_entrieso s
z3nftables.set_restore.._idle_set_add_entriesr r< i c s | S rQ r7 r[ r r7 r8 r] r^ z&nftables.set_restore..c s | S rQ r7 r[ r r7 r8 r] r^ ) r rs r r r- rL r r Zidle_add) r5 Zset_name type_nameentriesZcreate_optionsZ
entry_optionsrN chunkr r7 )r r5 r8 set_restoreh s znftables.set_restore)N)N)r )F)F)NN)NN)NN)NN)NN)N)N)N)N)F)N)N)F)NN)L__name__
__module__ __qualname__rC Zpolicies_supportedr9 rP rS rg rk rt ry r rK r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r2 r5 r8 r< rD rE rH rJ rL rM rN rO rR rT rX r[ rb re rf rg rj rs rt ru r) r r r r r r rz r r7 r7 r7 r8 r, X s 0,.e
C
V
c
2B
+
!
!
+
<
+(
4 r, ).Z
gi.repositoryr rh rv r* Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r
r r r
r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser Zfirewall.core.icmpr r Znftables.nftablesr r r rH r r r objectr, r7 r7 r7 r8 s: $,