3
Yj% @ s< d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZmZmZmZmZmZ d dlmZmZm Z m Z m Z m Z m Z d dl!m"Z"m#Z# d dl$Z$d Z%d
d d gd
d gd
dd
d d gd
dd gd
d d gdZ&dddZ'dddZ(dd Z)dd Z*dd Z+G dd d e,Z-G d d d e-Z.dS ) N)runProg)log)tempFilereadfile splitArgs check_macportStrcheck_single_address
check_address normalizeIP6)config)
FirewallErrorINVALID_PASSTHROUGH INVALID_RULE
UNKNOWN_ERROR INVALID_ADDRINVALID_ICMPTYPE) Rich_Accept Rich_Reject Rich_Drop Rich_MarkRich_MasqueradeRich_ForwardPortRich_IcmpBlock)
ICMP_TYPES ICMPV6_TYPES INPUTOUTPUTFORWARD
PREROUTING POSTROUTING)securityrawmanglenatfilterzicmp-host-prohibitedzicmp6-adm-prohibited)ipv4ipv6icmpz ipv6-icmpc C s ddddddd}| dd }x~|D ]v}y|j |}W n tk
rL w$Y nX |d
kryt||d W n tk
r~ Y nX |j|d || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN-I--insert )r* r+ )index Exceptionintpop)args replace_argsret_argsargidx r6 /usr/lib/python3.6/ipXtables.pycommon_reverse_rule; s(
r8 c C s ddddddd}| dd }x|D ]x}y|j |}W n tk
rL w$Y nX |d kryt||d W n tk
r~ Y nX |j|d || ||< |S W ttd
dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN-I--insertr, zno '-A', '-I' or '-N' arg)r9 r: )r-
ValueErrorr/ r0 r
r )r1 r2 r3 xr5 r6 r6 r7 common_reverse_passthrough` s,
r= c C s t | } t ddddddddd d
d d d
dddddddg}t| |@ dkrbttdt| |@ d t dddddd g}t| |@ dkrttd d S ) zZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)setlenr
r list)r1 Z not_allowedZneededr6 r6 r7 common_check_passthrough s*
rA c @ s e Zd ZdZd ZdZdd Zdd Zdd Zd d
Z d d Z
d
d Z dd Z dd Z
dd Zdd Zdd Zdd Zdd Zd d Zd d Zdjd"d#Zd$d% Zd&d' Zd(d) Zd*d+ Zdkd,d-Zd.d/ Zdld1d2Z d3d4 Z d5d6 Z dmd8d9Z dnd:d;Z dd? Z"d@dA Z#dBdC Z$dDdE Z%dFdG Z&dHdI Z'dJdK Z(dLdM Z)dNdO Z*dPdQ Z+dodRdSZ,dpdTdUZ-dqdVdWZ.dXdY Z/drdZd[Z0dsd\d]Z1dtd^d_Z2d`da Z3dudbdcZ4ddde Z5dfdg Z6dhdi Z7d!S )v ip4tablesr' Tc C sd || _ tj| j | _tjd| j | _| j | _| j | _ | j
g | _ i | _ i | _
g | _i | _d S )Nz
%s-restore)_fwr ZCOMMANDSipv_command_restore_command_detect_wait_option wait_option_detect_restore_wait_optionrestore_wait_option fill_existsavailable_tablesrich_rule_priority_countspolicy_priority_countszone_source_index_cache
our_chains)selffwr6 r6 r7 __init__ s
zip4tables.__init__c C s$ t jj| j| _t jj| j| _d S )N)ospathexistsrE Zcommand_existsrF Zrestore_command_exists)rQ r6 r6 r7 rK s zip4tables.fill_existsc C s | j r(| j |kr(| j gdd |D }ndd |D }tjd| j| jdj| t| j|\}}|dkrtd| jdj||f |S )Nc S s g | ] }d | qS )z%sr6 ).0itemr6 r6 r7
s z#ip4tables.__run..c S s g | ] }d | qS )z%sr6 )rW rX r6 r6 r7 rY s z %s: %s %s r z'%s %s' failed: %s)rH r debug2 __class__rE joinr r; )rQ r1 Z_argsstatusretr6 r6 r7 Z__run s zip4tables.__runc
C s< y|j |}W n tk
r" dS X ||||d < dS d S )NF T)r- r; )rQ rulepatternZ replacementir6 r6 r7
_rule_replace s zip4tables._rule_replacec C s |t ko|t | kS )N)BUILT_IN_CHAINS)rQ rD tablechainr6 r6 r7 is_chain_builtin s zip4tables.is_chain_builtinc C s2 d|g}|r|j d n
|j d |j | |gS )Nz-tz-Nz-X)append)rQ addrf rg ra r6 r6 r7 build_chain_rules s
zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)str)rQ rj rf rg r- r1 ra r6 r6 r7
build_rule s zip4tables.build_rulec C s t |S )N)r8 )rQ r1 r6 r6 r7 reverse_rule s zip4tables.reverse_rulec C s t | d S )N)rA )rQ r1 r6 r6 r7 check_passthrough s zip4tables.check_passthroughc C s t |S )N)r= )rQ r1 r6 r6 r7 reverse_passthrough s z ip4tables.reverse_passthroughc C s d}y|j d}W n tk
r& Y n X t||d krD||d }d }xLd
D ]D}y|j |}W n tk
rt Y qNX t||d krN||d }qNW ||fS ) Nr& z-tr` -A--append-I--insert-N --new-chain)rq rr rs rt ru rv )r- r; r? )rQ r1 rf rc rg optr6 r6 r7 passthrough_parse_table_chain s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d}|j| |j|}d|d kr:||d f}n ||d f}W nF tk
r y |j d}|j| d }W n tk
r d S X Y nX d}|d dkrd }|r| r||kr|j| nn|r0| r||kr|j| |jd d
d |j |}n| jjr d}nt|}d|d< |j dd|d d S )Nz%%ZONE_SOURCE%%z-m z%%ZONE_INTERFACE%%Tr -D--deleteFc S s | d S )Nr r6 )r< r6 r6 r7 ( s z4ip4tables._run_replace_zone_source..)keyz-Ir, z%dr` )r| r} )
r- r0 r; removeri sortrC _allow_zone_driftingr? insert)rQ ra rO rc zoneZ zone_sourcerule_addr- r6 r6 r7 _run_replace_zone_source s>
z"ip4tables._run_replace_zone_sourcec C s y|j |}W n tk
r$ Y nX d}d}d}|j| |j|}t|tkr\ttdd} xLdD ]D}
y|j |
} W n tk
r Y qfX t|| d krf|| d } qfW xhdD ]`}
y|j |
}W n tk
r Y qX t||d k r||d } |
dkrd}|
dkrd}qW | | f} |sp| |ksP||| ksP|| | dkrZttd|| | d8 < n| |kri || < ||| krd|| |< d}
xHt || j
D ]4}||kr|rP |
|| | 7 }
||krP qW || | d7 < d
||< |j |d d|
dS )a
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
TFr` z%priority must be followed by a numberr& -t--table-A--append-I--insert-D--deleter z*nonexistent or underflow of priority countr, z%dN)r r )r r r r r r )r r )r r ) r- r; r0 typer/ r
r r? r sortedkeysr )rQ ra Zpriority_countstokenrc r r Zinsert_add_indexpriorityrf rw jrg r- pr6 r6 r7 _set_rule_replace_priority4 sj
z$ip4tables._set_rule_replace_priorityc C sP t }i }tj| j}tj| j}tj| j}x|D ]}|d d } | j| dddt| j g | j| dt | j g y| j
d}
W n t k
r Y n8X |dkrq6|d$krd
d d |g| |
|
d
< n
| j |
| j
| |d | j
| |d | j| | d} xZd%D ]R} y| j
| }
W n t k
r, Y n(X t| |
d
kr| j |
| j |
} qW xhtt| D ]X}
xPtjD ]F}
|
| |
krt| |
jdo| |
jd rtd| |
| |
< qtW qhW |j| g j| q6W xR|D ]J} || }|jd| x"|D ]} |jdj| d q W |jd qW |j tj|j }t j d| j | j d|j |j!f g }| j"rz|j| j" |jd t#| j ||j d \}}t j$ d kr
t%|j }|d k r
d
}
xH|D ]@}t j&d |
|f d
d d |jdst j&d!d
d" |
d
7 }
qW tj'|j |d kr:t d#| j dj||f || _|| _|| _d S )&Nz
%%REJECT%%REJECTz
--reject-withz%%ICMP%%z %%LOGTYPE%%offunicast broadcast multicastz-mpkttypez
--pkt-typer` z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r& -t--table"z"%s"z*%s
rZ
zCOMMIT
z %s: %s %sz%s: %dz-n)stdinr, z%8d: %sr )nofmtnlr )r z'%s %s' failed: %s)r r r )r r )(r copydeepcopyrM rN rO rd DEFAULT_REJECT_TYPErD ICMPr- r; r0 r r r? rangestringZ
whitespace
startswithendswith
setdefaultri writer] closerT statnamer r[ r\ rF st_sizerJ r ZgetDebugLogLevelr Zdebug3unlink)rQ rules
log_denied temp_fileZ table_rulesrM rN rO Z_rulera rc rf rw cr r1 r^ r_ linesliner6 r6 r7 set_rules s
zip4tables.set_rulesc
C s | j |dddt| j g | j |dt| j g y|jd}W n tk
rR Y n:X |dkr`dS |dkrd d d
|g|||d < n
|j| tj| j }tj| j
}tj| j }| j ||d | j ||d | j
|| | j|}|| _ || _
|| _ |S )Nz
%%REJECT%%r z
--reject-withz%%ICMP%%z %%LOGTYPE%%r r r r r z-mr z
--pkt-typer` z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r r r )rd r rD r r- r; r0 r r rM rN rO r r _ip4tables__run)rQ ra r rc rM rN rO outputr6 r6 r7 set_rule s.
zip4tables.set_ruleNc C s g }|r|gnt j }xx|D ]p}|| jkr6|j| q y,| jd|ddg | jj| |j| W q tk
r tjd| j|f Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) re r rL ri r r; r Zdebug1rD )rQ rf r_ Ztablesr6 r6 r7 get_available_tables s
z ip4tables.get_available_tablesc C s` d}t | jdddg}|d dkr\d}t | jdddg}|d dkrHd}tjd| j| j| |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rE r r[ r\ )rQ rH r_ r6 r6 r7 rG s z ip4tables._detect_wait_optionc C s t }|jd |j d}xJd D ]B}t| j|g|jd}|d dkr"d|d kr"d |d kr"|}P q"W tjd
| j| j| t j
|j |S ) Nz#foor -w--wait=2)r r zinvalid optionr` zunrecognized optionz %s: %s will be using %s option.)r r ) r r r r rF r r r[ r\ rT r )rQ r rH Z test_optionr_ r6 r6 r7 rI $ s
z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj D ].}| j|s0q x dD ]}|jd||g q6W q W |S )N-F-X-Zz-t)r r r )rM rN rO re r r ri )rQ r rf flagr6 r6 r7 build_flush_rules7 s
zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j D ]@}| j|s.q |dkr8q x$t | D ]}|jd|d||g qBW q W |S )NZPANICDROPr% z-tz-P)re r r ri )rQ policyr _policyrf rg r6 r6 r7 build_set_policy_rulesF s
z ip4tables.build_set_policy_rulesc C sN t }|d ks| jdkr&|jtj |d ks8| jdkrF|jtj t|S )Nr' r( )r> rD updater r r r@ )rQ rD Z supportedr6 r6 r7 supported_icmp_typesR s z ip4tables.supported_icmp_typesc C s g S )Nr6 )rQ r6 r6 r7 build_default_tables\ s z ip4tables.build_default_tablesr c C s i }| j drpg |d< t | jd< xLtd D ]@}|d jd| |d jd||f | jd jd| q,W | j dr\g |d< t | jd< xtd D ]}|d jd| |d jd||f | jd jd| |dkrxt| jjrddd d
gndd d
gD ]R}|d jd ||f |d jd |||f | jd jtd
||f g qW qW | j drNg |d< t | jd< xtd D ]}|d jd| |d jd||f | jd jd| |dkrxv| jjrddd d
gndd d
gD ]R}|d jd ||f |d jd |||f | jd jtd
||f g qW qW | j dr@g |d< t | jd< xtd D ]}|d jd| |d jd||f | jd jd| |d9krxxv| jjrddd d
gndd d
gD ]R}|d jd ||f |d jd |||f | jd jtd
||f g qW qxW g |d< t | jd< |d jd |d jd |d jd |d jd | jd jtd xf| jjrddd d
gndd d
gD ]B}|d jd| |d jd| | jd jtd| qW |dkr |d jd |d jd |dkrF|d jd |d jd |d jd |d jd |d jd! |d jd" | jd jtd# xJd:D ]B}|d jd$| |d jd%| | jd jtd&| qW xzd;D ]r}xj| jjr
dd gnd gD ]N}|d jd)||f |d jd*||f | jd jtd+||f qW qW xJdD ]B}|d jd5| |d jd6| | jd jtd7| q~W g }xJ|D ]B}|| j krqx(|| D ] }|jd8|gt | qW qW |S )?Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r POLICIES_preZ ZONES_SOURCEZZONES
POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr$ r% r! r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz
-N FORWARD_%sz-A FORWARD -j FORWARD_%sz
FORWARD_%sINOUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz
FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r! )r )r r )r )r )r )
r r> rP re ri rj rC r r r ) rQ r Z
default_rulesrg Zdispatch_suffix directionZfinal_default_rulesrf ra r6 r6 r7 build_default_rules` s
$(
&*
&* &
(
"z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j kr,dhS |dkrHd| j krHddhS |d krbd | j krbdhS i S )
Nr& r
FORWARD_IN FORWARD_OUTr$ r r% r! r# )r )rQ rf r6 r6 r7 get_zone_table_chains s
z ip4tables.get_zone_table_chainsc s | j jj|jdk r dnddkr4dkr4dnd} | j jj|t| g }
g } x|D ]} |
jd| g qZW x|D ]} | jd | g qvW xB|D ]:}
| j jj|
}|dkr| j | rq|
j| j
d |
qW x\|D ]T}
| j jj|
}|dkr| j | rqt |
rdkrq| j| j
d|
qW fdd}g }|
rx|
D ]F}| rx8| D ]}|j||| qdW n|rn|j||d qTW nH|rn@| rx8| D ]}|j|d | qW n|rn|j|d d |S )Nr prepostr% r! TFz-iz-or' r( z-sr r z-dc sV ddd }d|df dj g}| r6|j| |rD|j| |jd g |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r extend)ingress_fragmentegress_fragmentadd_delra )r rg chain_suffixenablep_objrf r6 r7 _generate_policy_dispatch_rule s
zSip4tables.build_policy_ingress_egress_rules.._generate_policy_dispatch_rule)r' r( )r' r( )r! r r ) rC r Z
get_policyr policy_base_chain_namePOLICY_CHAIN_PREFIXri r Z check_sourceis_ipv_supported_rule_addr_fragmentr )rQ r r rf rg Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesisSNATZingress_fragmentsZegress_fragments interfaceaddrrD r r r r r6 )r rg r r r rf r7 !build_policy_ingress_egress_rules sR
z+ip4tables.build_policy_ingress_egress_rulesFc
C s |dkr|dkrdnd}| j jj||t|d} ddddddd| }
d } |rb| rbd
d | d g} n,|rtd
d | g} ndd | g} |s| d g7 } | d||
|| | g7 } | gS )Nr% r! TF)r z-iz-o)r r! r r r r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)rC r r r )
rQ r r r r rf rg ri r r rw actionra r6 r6 r7 !build_zone_source_interface_rules6 s&
z+ip4tables.build_zone_source_interface_rulesc C s |j drP|dd }|dkr$d}nd}dj|g| jjj| }ddd ||gS t|rz|dkrjttd
dd d |j gS t d
|rt
|}n,t d
|r|j d}t
|d d |d }||gS d S )Nzipset: z-ddstsrc,z-mr> z --match-setz Can't match a destination MAC.macz --mac-sourcer( /r r` )
r r] rC ipsetZ
get_dimensionr r
r upperr r r
split)rQ rw addressinvertr flags
addr_splitr6 r6 r7 r P s"
z ip4tables._rule_addr_fragmentc
C s ddd| }|dkr"|dkr"dnd}| j jj||t|d} d d
d d d
d
d | }
| j jrdd | } nd
| } t|r|dkrg S || d|d|g} | j| j|
| | jd| g | gS )Nz-Iz-D)TFr% r! TF)r z-sz-d)r r! r r r r z%s_ZONES_SOURCEz%s_ZONESr r z%%ZONE_SOURCE%%z-tz-g)r! r r )rC r r r r r r r )
rQ r r r r rf rg r r r rw Zzone_dispatch_chainra r6 r6 r7 build_zone_source_address_rulesf s&
z)ip4tables.build_zone_source_address_rulesc C s> ddd| }ddd| }|dkr0|dkr0dnd }| j jj||t|d
}| j| jt|d | d | d
| d| d| g g } | j||d|g | j|d
| d|g | j|d | d|g | j|d | d|g | j|d| d|g | j|d| d|g | j||d|dd
| g | j||d|dd | g | j||d|dd | g | j||d|dd| g | j||d|dd| g | j jj| j }
| j j
dkr|dkr|
d kr| j||d|ddddd| g |
dkr| j||d|ddddd| g |dkr,|
d kr,| j||d|d|
g |s:| j | S ) Nz-Nz-X)TFz-Az-Dr% r! TF)r z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr r& r
%%REJECT%%z %%LOGTYPE%%LOGz --log-prefixz
"%s_REJECT: "r z "%s_DROP: "ACCEPT)r r )r r r r ) rC r r r rP r r> ri Z _policiestargetget_log_deniedreverse) rQ r r rf rg Z
add_del_chainZ add_del_ruler r r r r6 r6 r7 build_policy_chain_rules sN
z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-mlimitz--limitz
--limit-burst)valueZburst)rQ r sr6 r6 r7 _rule_limit s
zip4tables._rule_limitc C s t |jtttgkrn<|jrHt |jtttt gkrRt
t dt |j n
t
t d|j dkrt |jttgkst |jtt gkrdS t |jtgkst |jttgkrdS n|j dk rdS dS d S )NzUnknown action %szNo rule action specified.r allowZdenyr r )
r elementr r r r r r r r r
r r )rQ rich_ruler6 r6 r7 _rich_rule_chain_suffix s
z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r r )r auditr
r r )rQ r r6 r6 r7 _rich_rule_chain_suffix_from_log s
z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r )rQ r r6 r6 r7 _rich_rule_priority_fragment s
z&ip4tables._rich_rule_priority_fragmentc
C s |j s
g S | jjj||t}ddd| }| j|}d||d||f g} | | j|7 } | |ddg 7 } |j jr| dd |j j g7 } |j jr| d
d |j j g7 } | | j |j j
7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr z --log-prefixz'%s'z --log-levelz%s) r rC r r r r r prefixlevelr r )
rQ r r r rf
rule_fragmentr r r ra r6 r6 r7 _rich_rule_log s
zip4tables._rich_rule_logc C s |j s
g S ddd| }| jjj||t}| j|}d||d||f g} | | j|7 } | |7 } t|jt krrd}
n,t|jt
krd}
nt|jt krd}
nd }
| d
d d |
g7 } | | j |j j
7 } | S )
Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdropunknownz-jZAUDITz--type)r rC r r r r r r r r r r r r ) rQ r r r rf r r r r ra _typer6 r6 r7 _rich_rule_audit s$
zip4tables._rich_rule_auditc C s2 |j s
g S ddd| }| jjj||t}| j|}d||f } t|j tkrXddg}
nt|j tkrddg}
|j jr|
d|j jg7 }
nnt|j t krdd g}
nVt|j t
krd
}| jjj||t}d||f } dd d |j j g}
nt t
d
t|j d||| g} | | j|7 } | ||
7 } | | j|j j7 } | S )Nz-Az-D)TFz%s_%sz-jr r z
--reject-withr r$ MARKz --set-xmarkzUnknown action %sz-t)r rC r r r r r r r r r r> r
r r r r ) rQ r r r rf r r r r rg Z rule_actionra r6 r6 r7 _rich_rule_action s4
zip4tables._rich_rule_actionc C s |sg S g }|j r|jr"|jd td|j rB|dt|j g7 }qtd|j r||j jd}|dt|d d |d g7 }q|d|j g7 }nD|jr|ddg7 }|jr|jd | jj j
|jd }|d
|j|g7 }|S ) N!r( z-dr r r` z-mr> r z --match-set) r r ri r r r
r r rC r _ipset_match_flags)rQ Z rich_destr r r r6 r6 r7 _rich_rule_destination_fragment1 s&
"
z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r|jr"|jd td|j rB|dt|j g7 }nHtd|j r||j jd}|dt|d d |d g7 }n|d|j g7 }nt|dr|jr|ddg7 }|jr|jd |d |jg7 }nPt|d
o|j r|dd g7 }|jr|jd | j
j j |j d }|d
|j |g7 }|S )Nr r( z-sr r r` r z-mz --mac-sourcer r> r z --match-set)
r r ri r r r
r hasattrr r rC r r )rQ Z rich_sourcer r r r6 r6 r7 _rich_rule_source_fragmentI s0
"
z$ip4tables._rich_rule_source_fragmentc C s ddd| }d}| j jj||t} d|g}
|rD|
ddt| g7 }
|rT|
d|g7 }
|rx|
| j|j7 }
|
| j|j7 }
| st |j
t kr|
d d
d d g7 }
g } |r| j | j
|||||
| j | j|||||
| j | j|||||
n"| j |d
| d|g|
ddg | S )Nz-Az-D)TFr& z-pz--dportz%sz-dz-m conntrackz --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr )rC r r r r r destinationr sourcer r r ri r
r r ) rQ r r protoportr r r rf r r r r6 r6 r7 build_policy_ports_rulesf s* z"ip4tables.build_policy_ports_rulesc C s ddd| }d}| j jj||t}d|g} |r<| d|g7 } |r`| | j|j7 } | | j|j7 } | stt|j t
kr| ddd d
g7 } g }
|r|
j | j ||||| |
j | j
||||| |
j | j||||| n"|
j |d | d |g| d
dg |
S )Nz-Az-D)TFr& z-pz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr )rC r r r r r r r r r r ri r
r r ) rQ r r protocolr r r rf r r r r6 r6 r7 build_policy_protocol_rules s& z%ip4tables.build_policy_protocol_rulesc C s ddd| }d}| j jj||t} d|g}
|rD|
ddt| g7 }
|rT|
d|g7 }
|rx|
| j|j7 }
|
| j|j7 }
| st |j
t kr|
d d
d d g7 }
g } |r| j | j
|||||
| j | j|||||
| j | j|||||
n"| j |d
| d|g|
ddg | S )Nz-Az-D)TFr& z-pz--sportz%sz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr )rC r r r r r r r r r r r ri r
r r ) rQ r r r r r r r rf r r r r6 r6 r7 build_policy_source_ports_rules s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t} ddd| }
|
d| ddd|g} |rP| dd t| g7 } |r`| d
|g7 } | d d d
|g7 } | gS )Nr# z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)rC r r r r ) rQ r r r r r Z helper_nameZmodule_short_namerf r r ra r6 r6 r7 build_policy_helper_ports_rules s z)ip4tables.build_policy_helper_ports_rulesc
C s ddd| }| j jj||t}g } |rH| jdd|d| d|dd g n6t|rTg S | jdd|d| g| jd
| dd g | S ) Nz-Az-D)TFz-tr& z%s_allowz-oz-jr z-d)rC r r r ri r r )
rQ r r r rf r r r r r r6 r6 r7 build_zone_forward_rules s z"ip4tables.build_zone_forward_rulesc
C s, d}| j jj||tdd}ddd| }g }|rj| j|}|| j|7 }|| j|j7 }|| j|j 7 }nd}g } | j
dd|d ||f g| d
d d d
dg g }|r| j|}|| j|7 }|| j|j7 }|| j|j 7 }nd}d}| j jj||t}| j
dd|d ||f g| ddddd
dg | S )Nr% T)r z-Az-D)TFr z-tz%s_%sr z-oloz-jZ
MASQUERADEr& z-mr z --ctstatez
NEW,UNTRACKEDr ) rC r r r r r r r r r ri )
rQ r r r rf r r r r r r6 r6 r7 build_policy_masquerade_rules s6
z'ip4tables.build_policy_masquerade_rulesc
C s
d}| j jj||t} ddd| }
d} |rPtd|rH| dt| 7 } n| |7 } |rn|dkrn| dt|d 7 } g } |r| j|}
| j|} | | j |j
7 } | | j |j 7 } nd
}
g }|r|j
| j|||d| |j
d d|
d | |
f g| d
|dt|ddd| g |S )Nr% z-Az-D)TFr r( z[%s]z:%s-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)rC r r r r r r r r r r r r ri r
)rQ r r r r ZtoportZtoaddrr rf r r Ztor r r r6 r6 r7 build_policy_forward_port_rules s2
z)ip4tables.build_policy_forward_port_rulesc C s | j dkrL|tkrLt| \}}}|r,t|nt|d t| }ddd|gS | j dkr|tkrt| \}}}|rxt|nt|d t| }ddd|gS ttd | d
| j d S ) Nr' r z-mr) z --icmp-typer( Zicmp6z
--icmpv6-typez
ICMP type z not supported by )rD r rl r r
r r )rQ Z icmp_typer _codeZ
_omit_codeZ _type_strr6 r6 r7 _icmp_types_fragment s z ip4tables._icmp_types_fragmentc C s d}| j jj||t}ddd| }| jdkrDddg}| j|j} nddg}| j|j} g }
| j jj|rxd | } d
} n d | } d } g }
|r|
| j|j 7 }
|
| j
|j 7 }
|
|| 7 }
|rL|
j | j
|||||
|
j | j|||||
|jr|
j | j|||||
n:| j|}|
j d
||d||f g| j| |
dd g n`| j j dkr| d
kr|
j || d
|g|
ddddd| g |
j || d
|g|
d| g |
S )Nr& z-Az-D)TFr' z-pr) z ipv6-icmpz%s_allowr z%s_denyz
%%REJECT%%z-tz%s_%sz-jr z %%LOGTYPE%%r z --log-prefixz"%s_ICMP_BLOCK: ")rC r r r rD r( r query_icmp_block_inversionr r r r ri r
r r r r r r )rQ r r Zictr rf r r r matchr Z final_chainZ final_targetr r r6 r6 r7 build_policy_icmp_block_rules, sJ
z'ip4tables.build_policy_icmp_block_rulesc C s d}| j jj||t}g }d}| j jj|rd}| j j dkr|rRd|t|g}nd|g}|d|dd d
d d d
d| g }|j| |d7 }nd}|rd|t|g}nd|g}|d|dd d |g }|j| |S )Nr& r z
%%REJECT%%r z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr z --log-prefixz"%s_ICMP_BLOCK: "r` r )rC r r r r) r rl ri ) rQ r r rf r r Zrule_idxZ
ibi_targetra r6 r6 r7 'build_policy_icmp_block_inversion_rules] s.
z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j7 }|| j|j7 }g }|j| j||||| |j| j||||| |j| j||||| |S )Nr& )r r r r ri r
r r )rQ r r r rf r r r6 r6 r7 *build_policy_rich_source_destination_rules s z4ip4tables.build_policy_rich_source_destination_rulesc C s
|| j kS )N)rD )rQ rD r6 r6 r7 r s zip4tables.is_ipv_supported)N)N)r )F)F)NN)NN)NN)NN)N)N)N)8__name__
__module__ __qualname__rD r Zpolicies_supportedrS rK r rd rh rk rm rn ro rp rx r r r r r rG rI r r r r r r r r r r r r r r r r
r r r r r r r r! r" r$ r& r( r+ r, r- r r6 r6 r6 r7 rB sj
)Pa#
zN
0 "
&
!
1"rB c @ s& e Zd ZdZd ZdddZdd ZdS ) ip6tablesr( Fc
C s g }|j ddddddddd d
g
|d krL|j ddddddddd d d
dg |j dddddddd dg |j dddddddd dg |S )Nz-Ir z-tr$ z-mZrpfilterz--invertz --validmarkz-jr r r z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr z"--icmpv6-type=router-advertisement)ri )rQ r r r6 r6 r7 build_rpfilter_rules s$
z ip6tables.build_rpfilter_rulesc C s ddddddddd g }d
}| j d j| g }|jd d d
|g xT|D ]L}|jd d d|d|ddddg
| jjd krF|jd d d|d|ddddg
qFW |jd d dddd|g |jd d dddd|g |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r& z-tz-Nz-Iz-dz-jr z
--reject-withz addr-unreachr allr z --log-prefixz"RFC3964_IPv4_REJECT: "r 4r )r r3 )rP rj ri rC Z _log_denied)rQ Z
daddr_listZ
chain_namer Zdaddrr6 r6 r7 build_rfc3964_ipv4_rules s4
z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rD r r2 r5 r6 r6 r6 r7 r1 s
r1 )/Zos.pathrT r Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r
r Zfirewallr Zfirewall.errorsr
r r r r r Zfirewall.core.richr r r r r r r Zfirewall.core.icmpr r r r re r r r8 r= rA objectrB r1 r6 r6 r6 r7 sB ( $ %* o