3
YjBu @ s6 d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z m Z d dl
mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z d dl m Z m Z d dl m!Z! d Z"e"d
d Z#d Z$d
Z%i ddde% fidd e% fdde% fddd e% fdd e% fdd e% fdd e% fddZ&G dd de'Z(dS ) )absolute_importN)log) check_mac getPortRange normalizeIP6check_single_address
check_address)
FirewallError
UNKNOWN_ERROR INVALID_RULEINVALID_ICMPTYPE INVALID_TYPE
INVALID_ENTRY INVALID_PORT) Rich_Accept Rich_Reject Rich_Drop Rich_MarkRich_MasqueradeRich_ForwardPortRich_IcmpBlock)
ICMP_TYPES ICMPV6_TYPES)NftablesZ firewalld_Z policy_dropZpolicy_
PREROUTING
prerouting d Z postrouting)r POSTROUTINGinputforwardoutput)r INPUTFORWARDOUTPUT)rawmanglenatfilterc @ sj e Zd Zd ZdZdd Zdd Zdd Zdd Zd
d Z d d
Z
dd Z dddZ dd Z
dd Zdd Zdd Zddd Zd d Zdd d!Zd"d# Zdd%d&Zdd(d)Zdd*d+Zdd,d-Zd.d/ Zd0d1 Zd2d3 Zd4d5 Z d6d7 Z d8d9 Z d:d; Z dd? Z!d@dA Z"dBdC Z#dDdE Z$dFdG Z%dHdI Z&ddJdKZ'dLdM Z(dNdO Z)dPdQ Z*dRdS Z+ddTdUZ,ddVdWZ-ddXdYZ.dZd[ Z/dd\d]Z0dd^d_Z1dd`daZ2ddbdcZ3ddddeZ4ddfdgZ5dhdi Z6ddjdkZ7dldm Z8ddndoZ9dpdq Z:drds Z;dtdu Zddzd{Z?d|d} Z@dd~dZAdd ZBdd ZCdd ZDdd ZEdd ZFdd ZGdd ZHdddZIdS )nftablesTc C sb || _ d| _g | _i | _i | _i | _i | _i | _g g g d| _t | _
| j
j d | j
j d d S )NT)inetipip6)
_fwZrestore_command_existsZavailable_tablesrule_to_handlerule_ref_countrich_rule_priority_countspolicy_priority_countszone_source_index_cachecreated_tablesr r+ Zset_echo_outputZset_handle_output)selffw r8 /usr/lib/python3.6/nftables.py__init__X s znftables.__init__c C s xdD ]}||krP qW d|| d kr`|| d d d || d d d f}|| d d= n(d|| d krd }|| d d= nd S || d d }|r|dkr||kr||| kr|| j | n|dkr||krg ||< |r(||| kr|| j| || jd
d d || j|}n | jjr8d
}n t|| }|| }||= |d
krf||d< n |d8 }||d< ||d d d< d S )Naddinsertdeletez%%ZONE_SOURCE%%rulezoneaddressz%%ZONE_INTERFACE%%familyc S s | d S )Nr r8 )xr8 r8 r9 s z3nftables._run_replace_zone_source..)keyr index)r; r< r= )removeappendsortrF r/ _allow_zone_driftinglen)r6 r> r4 verbZ zone_sourcerA rF
_verb_snippetr8 r8 r9 _run_replace_zone_sourceg sD
z!nftables._run_replace_zone_sourcec C sB d|krdt j|d iS d|kr4dt j|d iS ttdd S )Nr< r= r; zFailed to reverse rule)copydeepcopyr r
)r6 dictr8 r8 r9 reverse_rule s
znftables.reverse_rulec
C s xd D ]}||krP qW ||| d kr|| d | }|| d |= t |tkr^ttd|| d d || d d f}|dkr||ks||| ks|| | dkrttd || | d
8 < n||kri ||< ||| krd|| |< d}xVt|| j D ]B}||kr"|dkr"P ||| | 7 }||kr|dkrP qW || | d
7 < || } ||= |dkr| |d< n |d
8 }| |d< ||d d d < d S )
Nr; r< r= r> z%priority must be followed by a numberrA chainr z*nonexistent or underflow of priority countrE rF )r; r< r= )typeintr r r
sortedkeys)
r6 r> Zpriority_countstokenrL priorityrS rF prM r8 r8 r9 _set_rule_replace_priority sD
z#nftables._set_rule_replace_priorityc C sf x`d
D ]X}||krd|| krt j|| d }xd D ]}||kr6||= q6W tj|dd }|S qW d S ) Nr; r< r= r> rF handlepositionT)Z sort_keys)r; r< r= )rF r\ r] )rO rP jsondumps)r6 r> rL rule_keyZnon_keyr8 r8 r9
_get_rule_key s
znftables._get_rule_keyc C sL dddddg}dddg}g }g }t j| j}t j| j}t j| j} | jj }
x|D ]} t| tkrvtt d| x|D ]} | | kr|P q|W | | krtt
d| | j | }
|
|
krDt j
d| j|
|
|
| dkr|
|
d 7 < qVnX|
|
d kr |
|
d 8 < qVn6|
|
d kr,|
|
d 8 < ntt d
|
|
|
f n|
r\| dkr\d |
|
< |j| t j| }|
rttd || d d || d d < | j||d
| j||d | j|| | dkrdd |d d d |d d d |d d d | j|
dii}|j| qVW dddd iig| i}t j dkrVt jd| jtj| | jj|\}}}|dkrtdd|tj|f || _|| _| | _|
| _d}x|D ]} |d 7 }| j | }
|
s̐qd| kr| j|
= | j|
= qx"|D ]} | |d | krP qW | |d | kr$q|d | | d d | j|
< qW d S ) Nr; r< r= flushreplacez#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %srE z)rule ref count bug: rule_key '%s', cnt %dr> exprz%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%rA tablerS )rA re rS r\ r+ ZmetainfoZjson_schema_version z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s
JSON blob:
%szpython-nftablesr\ ) rO rP r2 r3 r4 r1 rT rQ r r
r ra r Zdebug2 __class__rH listr* r[ rN r0 ZgetDebugLogLevelZdebug3r^ r_ r+ Zjson_cmd
ValueError)r6 rules
log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesr2 r3 r4 r1 r> rL r` Z_ruleZ json_blobZrcr# errorrF r8 r8 r9 set_rules s
&
znftables.set_rulesc C s | j |g| dS )N )rm )r6 r> rk r8 r8 r9 set_rule: s znftables.set_ruleNc C s |r
|gS t j S )N)IPTABLES_TO_NFT_HOOKrW )r6 re r8 r8 r9 get_available_tables> s z nftables.get_available_tablesc C sF g }x
policy_keyrA r8 r8 r9 build_flush_rulesP s
znftables.build_flush_rulesc
C sl ddd| }g }xTdD ]L}|j |ddtd d
|f d d d
diiddddgididd igdii qW |S )Nr; r= )TFr! r" r# r> r, z%s_%sr* matchctrD stateinset establishedrelated)leftoprightaccept)rA re rS rd )r! r" r# )rH TABLE_NAME_POLICY)r6 enableadd_delrj hookr8 r8 r9 rt g s
z)nftables._build_set_policy_rules_ct_rulesc C st g }|dkrt|j dddtdii | jd j t x>dD ]6}|j dddtd d
|f d |dt d
ddii q:W |dk r|j dddtdii | jd j t x>dD ]6}|j dddtd d |f d |dt d
ddii qW || jd7 }nz|dkrfx4| jdD ]&}| j|}|| jkr |j | q W || jt7 }t| jd krp| jd jt n
t t
d |S )NZPANICr; re r, )rA rr r r# rS z%s_%sr' r* i, rE drop)rA re rr rT r priopolicyDROPr! r" r TACCEPTFznot implemented)r r# i)r! r" r# ) rH r r5 NFT_HOOK_OFFSETrt ra r0 rs rG r r
)r6 r rj r r> rv r8 r8 r9 build_set_policy_rulest sH
z nftables.build_set_policy_rulesc C sJ t }|d ks|dkr$|jtj |d ks4|dkrB|jtj t|S )Nipv4ipv6)r| updater rW r rh )r6 ipvZ supportedr8 r8 r9 supported_icmp_types s z nftables.supported_icmp_typesc C s> g }x4dD ],}|j dd|tdii | j| j t q
W |S )Nr, r- r. r; re )rA rr )r, r- r. )rH ru r5 )r6 Zdefault_tablesrA r8 r8 r9 build_default_tables s
z nftables.build_default_tablesoffc C s g }xt d j D ]}|jdddtd| ddt d | d t d | d d
ii xz| jjrld d d
dgnd d
dgD ]X}|jdddtd||f dii |jdddtd| ddd||f iigdii qvW qW xd?D ]}xt d j D ]}|jdd|td| ddt d | d t d | d d
ii x~| jjrJd d d
dgnd d
dgD ]Z}|jdd|td||f dii |jdd|td| ddd||f iigdii qTW qW qW xVt d j D ]F}|jdddtd| ddt d | d t d | d d
ii qW |jdddtdd d d d d iid d!d"d#gid$id%d igdii |jdddtdd d d d d&iid d'd$id%d igdii |jdddtdd d d(d d)iid*d+d$id%d igdii x~| jjrd d d
dgnd d
dgD ]Z}|jdddtd,d|f dii |jdddtdd ddd,d|f iigdii qW |d-kr|jdddtdd d d d d iid d!d.gid$i| j|d/d0d1iigdii |jdddtdd d d d d iid d!d.gid$id2d igdii |d-kr$|jdddtdd | j|d/d0d3iigdii |jdddtdd d4d5d6d7igdii |jdddtdd8 d d d d iid d!d"d#gid$id%d igdii |jdddtdd8 d d d d&iid d'd$id%d igdii |jdddtdd8 d d(d d)iid*d+d$id%d igdii xbd@D ]Z}|jdddtd,d8|f dii |jdddtdd8 ddd,d8|f iigdii qW xdAD ]}xz| jjrd d
gnd
gD ]^}|jdddtd;d8||f dii |jdddtdd8 ddd;d8||f iigdii qW qvW xbdBD ]Z}|jdddtd,d8|f dii |jdddtdd8 ddd,d8|f iigdii qW |d-kr|jdddtdd8 d d d d iid d!d.gid$i| j|d/d0d1iigdii |jdddtdd8 d d d d iid d!d.gid$id2d igdii |d-kr6|jdddtdd8 | j|d/d0d3iigdii |jdddtdd8 d4d5d6d7igdii |jdddtdd< d d d d iid d!d"d#gid$id%d igdii |jdddtd=d d(d d>iid*d+d$id%d igdii xbdCD ]Z}|jdddtd,d<|f dii |jdddtdd< ddd,d<|f iigdii qW xbdDD ]Z}|jdddtd,d<|f dii |jdddtdd< ddd,d<|f iigdii qHW |S )ENr( r; rS r, z mangle_%sr* z%sr rE )rA re rr rT r r POLICIES_preZ ZONES_SOURCEZZONES
POLICIES_postz mangle_%s_%s)rA re rr r> jumptarget)rA re rS rd r- r. r) znat_%sz nat_%s_%sz filter_%sr$ rx ry rD rz r{ r| r} r~ )r r r r Zstatusdnatmetaiifnamez==loz filter_%s_%sr Zinvalidr prefixzSTATE_INVALID_DROP: r zFINAL_REJECT: rejecticmpxzadmin-prohibited)rT rd r% INOUTzfilter_%s_%s_%sr&
filter_OUTPUToifname)r- r. )r )r r )r )r )r )rp rW rH ru r/ rJ _pkttype_match_fragment)r6 rk Z
default_rulesrS Zdispatch_suffixrA directionr8 r8 r9 build_default_rules s
$
(
&
.
&
&
&
.
&
&
&z nftables.build_default_rulesc C s4 |dkrdddgS |dkr dgS |dkr0ddgS g S ) Nr* r$
FORWARD_IN FORWARD_OUTr( r r) r r8 )r6 re r8 r8 r9 get_zone_table_chains s
z nftables.get_zone_table_chainsr, c
s dkr\dkr\g }
|
j j|||||dd |
j j|||||dd |
S jjj|jdk rxdnddkrd krd
nd } jjj|t| g } g }
|r| jd d
ddiiddt |idi |r|
jd d
ddiiddt |idi ddd}|rlxT|D ]L}dkrTjj
j |}||krT|| krTq | jj d| q W |rxT|D ]L}dkrjj
j |}||kr|| krqx|
jj d| qxW fdd}g }
| rHx| D ]P}|
r xB|
D ]}|
j||| qW n"dkr0|r0n|
j||d qW n\dkrZ|rZnJ|
rxB|
D ]}|
j|d | qfW n"dkr|rn|
j|d d |
S )Nr) r, r- )rA r. r prepostr TFrx r rD r z==r| )r r r r )r r saddrdaddrc s g }| r|j | |r |j | |j ddd f ii tdf |d}|jj rrdd|iiS dd|iiS d S ) Nr r z%s_%sz%s_%s_POLICIES_%s)rA re rS rd r; r> r= )rH ru r _policy_priority_fragment)ingress_fragmentegress_fragmentexpr_fragmentsr> )_policyrS chain_suffixr rA p_objr6 re r8 r9 _generate_policy_dispatch_rule s
zRnftables.build_policy_ingress_egress_rules.._generate_policy_dispatch_rule)
extend!build_policy_ingress_egress_rulesr/ r Z
get_policyrY policy_base_chain_namePOLICY_CHAIN_PREFIXrH rh r? Z check_source_rule_addr_fragment)r6 r r re rS Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesrA rj isSNATZingress_fragmentsZegress_fragmentsZ
ipv_to_familysrcr dstr r r r8 )r rS r r rA r r6 re r9 r sv
z*nftables.build_policy_ingress_egress_rulesFc
C s |dkrT|dkrTg } | j | j|||||||d | j | j|||||||d | S |dkrh|dkrhdnd}
| jjj||t|
d} d d
d d d
d
d | } |t|d d
kr|d t|d d }d}
|dkr|
dd|| f iig}n,ddd| iid|di|
dd|| f iig}|rL| rLd}|td||f |d}|j| j nP|rnd}|td||f |d}n.d}|td||f |d}|s|j| j |d |iigS ) Nr) r, r- r. r TF)r r r )r r r$ r r r& rE +*gotor z%s_%srx r rD z==)r r r r< z %s_%s_ZONES)rA re rS rd r; r= r> )
r !build_zone_source_interface_rulesr/ r r r rK ru r _zone_interface_fragment)r6 r r? r interfacere rS rH rA rj r r optactionr rL r> r8 r8 r9 r s\
z*nftables.build_zone_source_interface_rulesc C sn |dkr|dkrg }|j dr6| j|tdd } nd } td|sTt|sT| dkrp|j| j||||||d td|st|s| dkr|j| j||||||d |S |dkr|dkrd nd
}
| jjj ||t
|
d } d d
d| } ddddddd| }
| jj rd||f }n d||f }d}|t || j
|
||dd|| f iigd}|j| j|| | d|iigS )Nr) r, zipset:r r- r r. r TF)r r< r= )TFr r )r r r$ r r r& z%s_%s_ZONES_SOURCEz %s_%s_ZONESr r z%s_%s)rA re rS rd r> )
startswith_set_get_familyrK r r r build_zone_source_address_rulesr/ r r r rJ ru r r _zone_source_fragment)r6 r r? r r@ re rS rA rj Z ipset_familyr r r r Zzone_dispatch_chainr r> r8 r8 r9 r < sB
z(nftables.build_zone_source_address_rulesc
C s |dkrH|dkrHg }|j | j||||d |j | j||||d |S ddd| }|dkrj|dkrjd nd
}| jjj||t|d } g }|j|d |td
|| f dii x0d!D ](}
|j|d |td|| |
f dii qW xDd"D ]<}
|j|d|td
|| f ddd|| |
f iigdii qW | jjj| j } | jj
dkr|dkr| d#kr| } | d krhd} |j|d|td
|| f | j | jj
dd d | | f iigdii |dkr| d$kr| d%kr| j }
n | j
d i}
|j|d|td
|| f |
gdii |s|j |S )&Nr) r, r- r. r; r= )TFr TF)r rS z%s_%s)rA re rr r r denyallowr z%s_%s_%sr> r r )rA re rS rd r r* REJECT
%%REJECT%%r r z"filter_%s_%s: "r )r r r r r )r r r r r )r r r )r r r r )r r )r build_policy_chain_rulesr/ r r r rH ru Z _policiesr get_log_deniedr _reject_fragmentlowerreverse)r6 r r re rS rA rj r r r r r Z
log_suffixtarget_fragmentr8 r8 r9 r j sZ
&
z!nftables.build_policy_chain_rulesc C s< |dkr i S |d kr,ddddiid |d
iS t td |d S )
Nallunicast broadcast multicastrx r rD pkttypez==)r r r zInvalid pkttype "%s")r r r )r r )r6 r r8 r8 r9 r s
z nftables._pkttype_match_fragmentc C s ddddiddddiddddiddddiddddiddddiddddiddddiddddiddddiddd diddd diddd
diddd
didd d
diddd diddd diddd
diddd
diddddiddddidddiidddiid}|| S )Nr icmpzhost-prohibited)rT rd znet-prohibitedzadmin-prohibitedicmpv6znet-unreachablezhost-unreachablezport-unreachabler zprot-unreachablezaddr-unreachablezno-routerT z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz
net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp6-addr-unreachablez addr-unreachzicmp6-no-routezno-routez tcp-resetztcp-rstr8 )r6 Z reject_typeZfragsr8 r8 r9 _reject_types_fragment s0
z nftables._reject_types_fragmentc C s ddddiS )Nr r zadmin-prohibited)rT rd r8 )r6 r8 r8 r9 r s znftables._reject_fragmentc C s ddddiiddddgid iS )
Nrx r rD l4protoz==r| r r )r r r r8 )r6 r8 r8 r9 _icmp_match_fragment s z nftables._icmp_match_fragmentc C sP |si S ddddd}|j \}}||| d}|j }|d k rH||d< d|iS ) NsecondZminuteZhourZday)smhd)rateZperburstlimit)Z value_parseZ burst_parse)r6 r Z rich_to_nftr Zdurationr r r8 r8 r9 _rich_rule_limit_fragment s z"nftables._rich_rule_limit_fragmentc C s t |jtttgkrn<|jrHt |jtttt gkrRt
t dt |j n
t
t d|j dkrt |jttgkst |jtt gkrdS t |jtgkst |jttgkrdS n|j dk rdS dS d S )NzUnknown action %szNo rule action specified.r r r r r )
rT elementr r r r r r r r r r rY )r6 rich_ruler8 r8 r9 _rich_rule_chain_suffix s
z nftables._rich_rule_chain_suffixc C s> |j r|j rttd|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r r )r auditr r rY )r6 r r8 r8 r9 _rich_rule_chain_suffix_from_log s
z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nz%%ZONE_INTERFACE%%r8 )r6 r8 r8 r9 r s z!nftables._zone_interface_fragmentc C sN t d|rt|}n,td|r@|jd}t|d d |d }d||diS )Nr /r rE z%%ZONE_SOURCE%%)r? r@ )r r r split)r6 r? r@ Z
addr_splitr8 r8 r9 r s
z nftables._zone_source_fragmentc C s
d|j iS )Nz%%POLICY_PRIORITY%%)rY )r6 r r8 r8 r9 r s z"nftables._policy_priority_fragmentc C s | s|j dkri S d|j iS )Nr z%%RICH_RULE_PRIORITY%%)rY )r6 r r8 r8 r9 _rich_rule_priority_fragment s z%nftables._rich_rule_priority_fragmentc C s |j s
i S | jjj||t}ddd| }| j|}i } |j jrPd|j j | d< |j jr|d|j jkrhdn|j j}
d|
| d< d td
|||f || j |j j
d | ig d } | j | j | |d
| iiS )Nr; r= )TFz%sr Zwarningwarnlevelr, z%s_%s_%sr )rA re rS rd r> )
r r/ r r r r r r ru r r r r ) r6 r r r re r r r r Z log_optionsr r> r8 r8 r9 _rich_rule_log" s&
znftables._rich_rule_logc
C s |j s
i S | jjj||t}ddd| }| j|}dtd|||f || j|j jdddiig d } | j | j
| |d
| iiS ) Nr; r= )TFr, z%s_%s_%sr r r )rA re rS rd r> ) r r/ r r r r ru r r r r )
r6 r r r re r r r r r> r8 r8 r9 _rich_rule_audit< s
znftables._rich_rule_auditc
C s |j s
i S | jjj||t}ddd| }| j|}d|||f } t|j tkr\dd i}
n t|j tkr|j jr| j |j j}
ndd i}
nt|j t
krdd i}
nt|j t krHd}| jjj||t}d|||f } |j j j
d } t| d
kr,dd d d
iiddd d d
ii| d
gi| d gidi}
ndd d d
ii| d di}
nttdt|j dt| || j|j j|
g d} | j| j| |d| iiS )Nr; r= )TFz%s_%s_%sr r r r( r rE r rD mark^&r )rD valuezUnknown action %sr, )rA re rS rd r> )r r/ r r r r rT r r r r r r| r rK r r ru r r r r )
r6 r r r re r r r r rS Z rule_actionr r> r8 r8 r9 _rich_rule_actionN sB
, znftables._rich_rule_actionc C s |j dr0| j|tdd d|kr(dnd|S t|r>d}ntd|rNd}nvtd|rd}tj|dd}d |jj |j
d
i}nDtd |rd }t |}n,d }|j d
}d t |d t
|d d
i}dd||di|rdnd|diS d S )Nzipset:r TFetherr r- )strictr )addrrK r r. r r rE rx payload)protocolfieldz!=z==)r r r )r _set_match_fragmentrK r r r ipaddressZ IPv4NetworkZnetwork_addressZ
compressedZ prefixlenr r rU )r6 Z
addr_fieldr@ invertrA Znormalized_addressZaddr_lenr8 r8 r9 r y s(
&
z nftables._rule_addr_fragmentc C s6 |si S |d
kr t td| ddddiid|d iS ) Nr r zInvalid familyrx r rD nfprotoz==)r r r )r r )r r )r6 Z rich_familyr8 r8 r9 _rich_rule_family_fragment s
z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jdS )Nzipset:r )r )r ipsetr r )r6 Z rich_destr@ r8 r8 r9 _rich_rule_destination_fragment s
z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|dr.|jr.|j}nt|drH|jrHd|j }| jd||jdS )Nmacr zipset:r )r )r hasattrr r r r )r6 Z rich_sourcer@ r8 r8 r9 _rich_rule_source_fragment s
z#nftables._rich_rule_source_fragmentc C sP t |}t|tr$|dk r$ttn(t|dkr8|d S d|d |d giS d S )Nr rE range)r
isinstancerU r r rK )r6 portr r8 r8 r9 _port_fragment s
znftables._port_fragmentc C sb ddd| }d}| j jj||t} g }
|r>|
j| j|j |rT|
j| jd| |r||
j| j|j |
j| j
|j |
jdd|dd id
| j |d i | st
|jtkr|
jdd d
diiddddgid i g } |r0| j| j|||||
| j| j|||||
| j| j|||||
n.| j|ddtd|| f |
dd ig dii | S )Nr; r= )TFr* r rx r dport)r r z==)r r r ry rD rz r{ r| new untrackedr> r, z %s_%s_allowr )rA re rS rd )r/ r r r rH r rA r r destinationr sourcer rT r r r r r ru ) r6 r r protor
r r r re r r rj r8 r8 r9 build_policy_ports_rules s:
z!nftables.build_policy_ports_rulesc C sZ ddd| }d}| j jj||t}g } |r>| j| j|j |rT| j| jd| |r|| j| j|j | j| j
|j | jdddd iid
|d i | st |j
tkr| jdd dd
iiddddgid i g }
|r(|
j| j||||| |
j| j||||| |
j| j||||| n.|
j|ddtd||f | dd ig dii |
S )Nr; r= )TFr* r rx r rD r z==)r r r ry rz r{ r| r
r r> r, z %s_%s_allowr )rA re rS rd )r/ r r r rH r rA r r r r r rT r r r r r ru ) r6 r r r r r r re r r rj r8 r8 r9 build_policy_protocol_rules s8
z$nftables.build_policy_protocol_rulesc C sb ddd| }d}| j jj||t} g }
|r>|
j| j|j |rT|
j| jd| |r||
j| j|j |
j| j
|j |
jdd|dd id
| j |d i | st
|jtkr|
jdd d
diiddddgid i g } |r0| j| j|||||
| j| j|||||
| j| j|||||
n.| j|ddtd|| f |
dd ig dii | S )Nr; r= )TFr* r rx r sport)r r z==)r r r ry rD rz r{ r| r
r r> r, z %s_%s_allowr )rA re rS rd )r/ r r r rH r rA r r r r r r rT r r r r r ru ) r6 r r r r
r r r re r r rj r8 r8 r9 build_policy_source_ports_rules s:
z(nftables.build_policy_source_ports_rulesc
C s d}| j jj||t} ddd| }
g } |rR| jdddtd||f ||dii g } |rl| j| jd | | jd
d |d d
id| j|di | jdd||f i | j|
ddtd| | dii | S )Nr* r; r= )TFz ct helperr, z helper-%s-%s)rA re rr rT r r rx r r )r r z==)r r r r> zfilter_%s_allow)rA re rS rd )r/ r r r rH ru r r )
r6 r r r r
r Z helper_nameZmodule_short_namere r r rj r r8 r8 r9 build_policy_helper_ports_rules) s.
z(nftables.build_policy_helper_ports_rulesc C s ddd| }| j jj||t}g } |rv|t|d dkrT|d t|d d }ddd d
iid |d id
d ig}
n| jd|d
d ig}
dtd| |
d} | j|d| ii | S )Nr; r= )TFrE r r rx r rD r z==)r r r r r r, zfilter_%s_allow)rA re rS rd r> )r/ r r r rK r ru rH ) r6 r r? r re r r r r rj rd r> r8 r8 r9 build_zone_forward_rulesF s" z!nftables.build_zone_forward_rulesc C s d}| j jj||tdd}ddd| }g }|r`|j| j|j |j| j|j | j |} nd} |t
d|| f |d d
d d iid
ddidd ig d}
|
j | j | |d|
iigS )Nr) T)r r; r= )TFr z nat_%s_%srx r rD r z!=r )r r r Z
masquerade)rA re rS rd r> )
r/ r r r rH r r r r r ru r r ) r6 r r rA r re r r r r r> r8 r8 r9 "_build_policy_masquerade_nat_rules_ s&
z+nftables._build_policy_masquerade_nat_rulesc
C s^ g }|rD|j r|j dks,|jrDtd|jjrD|j| j||d| nV|r|j rX|j dksl|jrtd|jjr|j| j||d| n|j| j||d| d}| jjj||t }ddd| }g }|r|j
| j |j |j
| j
|j | j|} nd } d
td || f |d d
ddiiddddgididd ig d}
|
j| j| |j
|d|
ii |S )Nr r. r r- r* r; r= )TFr r, z filter_%s_%srx ry rD rz r{ r| r
r )r r r r )rA re rS rd r> )rA r r r r r r/ r r r rH r r r r ru r r ) r6 r r r rj re r r r r r> r8 r8 r9 build_policy_masquerade_rulesx s8
z&nftables.build_policy_masquerade_rulesc C s$ d} | j jj|| t}
ddd| } g } |r\| j| j|j | j| j|j | j |}
nd}
| jdd|dd id
| j
|d i |rt d |rt |}|r|d
kr| jd|| j
|di q| jdd|ii n| jdd| j
|ii |t
d|
|
f | d}|j| j| | d|iigS )Nr) r; r= )TFr rx r r )r r z==)r r r r rn r )r r
r Zredirectr
z nat_%s_%s)rA re rS rd r> )r/ r r r rH r r r r r r r r ru r r )r6 r r r
r toaddrtoportrA r re r r r r r> r8 r8 r9 $_build_policy_forward_port_nat_rules s4
z-nftables._build_policy_forward_port_nat_rulesc
C s g }|rF|j r|j dks&|rFtd|rF|j| j||||||d| n|r|j rZ|j dksh|rtd|r|j| j||||||d| nL|rtd|r|j| j||||||d| n |j| j||||||d| |S )Nr r. r r- )rA r r r ) r6 r r r
r r r r rj r8 r8 r9 build_policy_forward_port_rules s z(nftables.build_policy_forward_port_rulesc C sH dd|ddid|dig}|d k rD|j dd|ddid|di |S )Nrx r rT )r r z==)r r r code)rH )r6 r rT r fragmentsr8 r8 r9 _icmp_types_fragments s z nftables._icmp_types_fragmentsc C s |dkr4|t kr4t | \}}}| jd||r.d n|S |dkrh|tkrht| \}}}| jd||rbd n|S ttd|| j|f d S )Nr r r r z)ICMP type '%s' not supported by %s for %s)r r r r r rr )r6 r Z icmp_typeZ_type_codeZ
_omit_coder8 r8 r9 _icmp_types_to_nft_fragments s z%nftables._icmp_types_to_nft_fragmentsc C sB d}| j jj||t}ddd| }|r6|jr6|j}n<|jrjg }d|jkrT|jd d|jkrr|jd nddg}g } x|D ]}
| j jj|rd||f } dd i} nd ||f } | j } g }
|r|
j| j |j
|
j| j |j |
j| j |j
|
j| j|
|j |r| j| j|||||
| j| j|||||
|jrf| j| j|||||
nN| j|}d
td |||f |
| j g d }|j| j| | j|d
|ii q~| j j dkr| j jj| r| j|d
d
t| |
| j| j j ddd||f iig d ii | j|d
d
t| |
| g d ii q~W | S )Nr* r; r= )TFr r z %s_%s_allowr z
%s_%s_denyr, z%s_%s_%s)rA re rS rd r> r r r z"%s_%s_ICMP_BLOCK: ")r/ r r r ipvsr rH query_icmp_block_inversionr r rA r r r r r" rr r r r r r ru r r r r )r6 r r Zictr re r r r# rj r Z final_chainr r r r> r8 r8 r9 build_policy_icmp_block_rules sb
"
"
z&nftables.build_policy_icmp_block_rulesc C s d}| j jj||t}g }ddd| }| j jj|r@| j }ndd i}|j|ddtd||f d | j |gd
ii | j j d kr| j jj|r|j|ddtd||f d | j | j
| j j d d
d||f iigd
ii |S )Nr* r; r= )TFr r> r, z%s_%s )rA re rS rF rd r r r z%s_%s_ICMP_BLOCK: ) r/ r r r r$ r rH ru r r r )r6 r r re r rj r r r8 r8 r9 'build_policy_icmp_block_inversion_rules( s,
z0nftables.build_policy_icmp_block_inversion_rulesc C s g }ddddiidddiddd d
d gd d
idddig}|dkrV|j dddii |j dd i |j dddtd|dii |j dddtdddddd idd d d gidid d igdii |S )!Nrx r rD r z==r )r r r Zfibr Ziifr Zoif)flagsresultFr r r zrpfilter_DROP: r r< r> r, Zfilter_PREROUTING)rA re rS rd r r rT )r r r| znd-router-advertznd-neighbor-solicitr )rH ru )r6 rk rj r r8 r8 r9 build_rpfilter_rulesG s0
z nftables.build_rpfilter_rulesc C s ddddddddd g }d
d |D }d d
dddidd|idig}| j jd"krb|jdddii |j| jd g }|jddd td d |d ii |jddd td d!|d ii |S )#Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |j dd t|j dd diqS )r r r rE )r rK )r rU ).0rB r8 r8 r9
n s z5nftables.build_rfc3964_ipv4_rules..rx r r. r )r r z==r| )r r r r r r r zRFC3964_IPv4_REJECT: z addr-unreachr; r> r, r rE )rA re rS rF rd Zfilter_FORWARD )r r )r/ Z _log_deniedrH r ru )r6 Z daddr_setr rj r8 r8 r9 build_rfc3964_ipv4_rulesc s:
z!nftables.build_rfc3964_ipv4_rulesc C s d}g }|j | j|j |j | j|j |j | j|j g }|j | j||||| |j | j||||| |j | j ||||| |S )Nr* )
rH r rA r r r r r r r )r6 r r r re r rj r8 r8 r9 *build_policy_rich_source_destination_rules s z3nftables.build_policy_rich_source_destination_rulesc C s |dkr dS dS )Nr r ebTF)r r r0 r8 )r6 r r8 r8 r9 is_ipv_supported s znftables.is_ipv_supportedc
C s ddd}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd }||kr|| S t td
| d S ) NZ ipv4_addrZ ipv6_addr)r r Z
inet_protoZ inet_servicer ZifnameZ
ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz!ipset type name '%s' is not valid)r r
)r6 r rT Zipv_addrtypesr8 r8 r9 _set_type_list s"
znftables._set_type_listc
C s |r d|kr |d dkr d}nd}t || j||d}x0|jdd jdD ]}|dkrLd g|d
< P qLW |rd|kr|d |d< d|kr|d |d< g }x0dD ](}d|i} | j| |jdd| ii qW |S )NrA inet6r r )re rr rT :rE ,r- netr
Zintervalr( ZtimeoutZmaxelemsizer, r. r; r| )r- r7 r
)r, r- r. )ru r3 r r rH )
r6 rr rT optionsr Zset_dicttrj rA Z rule_dictr8 r8 r9 build_set_create_rules s*
z nftables.build_set_create_rulesc C s$ | j |||}| j|| jj d S )N)r; rm r/ r )r6 rr rT r9 rj r8 r8 r9
set_create s znftables.set_createc C s8 x2dD ]*}dd|t |dii}| j|| jj qW d S )Nr, r- r. r= r| )rA re rr )r, r- r. )ru ro r/ r )r6 rr rA r> r8 r8 r9 set_destroy s
znftables.set_destroyc C s6 | j jj|jjdd jd}g }xtt|D ]}|| dkrr|jdddii |jdd |rdd
nd d i q2|| d kr|jd| j||rdndd i q2|| dkr|jdd|rdndii q2|| dkr|jdddii q2t d|| q2W dt|dkrd|in|d |r&dndd | d iS ) Nr5 rE r6 r
r rD r r Zthr r )r r r- r7 r r r Zifacer r r z-Unsupported ipset type for match fragment: %srx concatr z!=z==@)r r r )r- r7 r )
r/ r get_ipsetrT r r rK rH r r )r6 rr Z
match_destr type_formatr ir8 r8 r9 r s$ z nftables._set_match_fragmentc C sN | j jj|}|jjdd jd}|jd}t|t|krHttdg }xtt|D ]}|| dkr,y|| j d}W n& t
k
r |j d || } Y n,X |j || d | || |d d } y| j d}W n t
k
r |j | Y n(X |j d| d | | |d d gi q\|| dkr d|| krb|j d|| jdi ny|| j d }W nL t
k
r || }
d |j kr|j d d
krt
|
}
|j |
Y n^X || d | }
d |j kr|j d d
krt
|
}
|j d|
t|| |d d di q\|j || q\W t|dkrJd|igS |S )Nr5 rE r6 z+Number of values does not match ipset type.r
Ztcp-r r- r7 r rA r4 r )r rK r> )r- r7 )r/ r r@ rT r rK r r r rF ri rH r9 r rU ) r6 rr entryobjrA Z entry_tokensZfragmentrB rF Zport_strr r8 r8 r9 _set_entry_fragment sL
( "z nftables._set_entry_fragmentc C sj g }g }t |ttfs |g}x |D ]}|j| j|| q"W x(dD ] }|jdd|t||dii qBW |S )Nr, r- r. r; r )rA re rr elem)r, r- r. )r rh tupler rF rH ru )r6 rr entriesrj elementsr rA r8 r8 r9 build_set_add_rules( s
z nftables.build_set_add_rulesc C s" | j ||}| j|| jj d S )N)rK rm r/ r )r6 rr rD rj r8 r8 r9 set_add7 s znftables.set_addc C sF | j ||}x4dD ],}dd|t||dii}| j|| jj qW d S )Nr, r- r. r= r )rA re rr rG )r, r- r. )rF ru ro r/ r )r6 rr rD r rA r> r8 r8 r9
set_delete; s
znftables.set_deletec C s4 g }x*dD ]"}dd|t |dii}|j| q
W |S )Nr, r- r. rb r| )rA re rr )r, r- r. )ru rH )r6 rr rj rA r> r8 r8 r9 build_set_flush_rulesD s
z nftables.build_set_flush_rulesc C s | j |}| j|| jj d S )N)rN rm r/ r )r6 rr rj r8 r8 r9 set_flushM s
znftables.set_flushc C sJ | j jj|}|jdkr d}n(|jrBd|jkrB|jd dkrBd}nd}|S )Nzhash:macr rA r4 r. r- )r/ r r@ rT r9 )r6 rr r rA r8 r8 r9 r Q s
znftables._set_get_familyc C s g }|j | j||| |j | j| xbtdt|dD ]<}|j | j||||d | j|| jj |j q:W | j|| jj d S )Nr i )
r r; rN r rK rK rm r/ r clear)r6 Zset_nameZ type_namerI Zcreate_optionsZ
entry_optionsrj rB r8 r8 r9 set_restore^ s znftables.set_restore)N)N)r )r, )Fr, )r, )r, )F)NN)NN)NN)NN)N)N)N)N)N)N)F)N)N)F)NN)J__name__
__module__ __qualname__rr Zpolicies_supportedr: rN rR r[ ra rm ro rq rs rw rt r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r" r% r' r* r. r/ r1 r3 r; r< r= r rF rK rL rM rN rO r rQ r8 r8 r8 r9 r+ T s /.`
4
R
i
;
-
9
+
$
$
$
'
$
<
#
4 r+ iji))Z
__future__r rO r^ r Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r
r r r
r r Zfirewall.core.richr r r r r r r Zfirewall.core.icmpr r Znftables.nftablesr ru r r r rp objectr+ r8 r8 r8 r9 s, $$