Viewing File: /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyc


c`c@sddlZddlZddlmZmZddlmZddlm	Z	ddl
mZmZm
Z
mZmZmZmZmZddlmZddlmZmZmZddlmZmZmZmZddlZid	d
dgd6d
d
gd6d
dd	d
dgd6d
dd
gd6d	d
dgd6Zidd6dd6Z idd6dd6Z!dZ"dZ#dZ$de%fdYZ&de&fdYZ'dS( iN(t	SHORTCUTStDEFAULT_ZONE_TARGET(trunProg(tlog(ttempFiletreadfilet	splitArgst	check_mactportStrtcheck_single_addresst
check_addresstnormalizeIP6(tconfig(t
FirewallErrortINVALID_PASSTHROUGHtINVALID_RULE(tRich_AccepttRich_Rejectt	Rich_Dropt	Rich_MarktINPUTtOUTPUTtFORWARDtsecurityt
PREROUTINGtrawtPOSTROUTINGtmangletnattfiltersicmp-host-prohibitedtipv4sicmp6-adm-prohibitedtipv6ticmps	ipv6-icmpcCsidd6dd6dd6dd6dd6d	d
6}|}x|D]}y|j|}Wntk
rmq>nX|dkryt||dWntk
rqX|j|dn||||<q>W|S(
s Inverse valid rule s-Ds-As--deletes--appends-Is--inserts-Xs-Ns--delete-chains--new-chaini(s-Is--insert(tindext	Exceptiontinttpop(targstreplace_argstret_argstargtidx((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcommon_reverse_rule7s*



cCsidd6dd6dd6dd6dd6d	d
6}|}x|D]}y|j|}Wntk
rmq>nX|dkryt||dWntk
rqX|j|dn||||<|SWttdd
S(s Reverse valid passthough rule s-Ds-As--deletes--appends-Is--inserts-Xs-Ns--delete-chains--new-chainisno '-A', '-I' or '-N' argN(s-Is--insert(R!t
ValueErrorR#R$R
R(R%R&R'txR)((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcommon_reverse_passthrough\s.



cCst|}tddddddddd	d
ddd
dddddddg}t||@dkrttdt||@dntddddddg}t||@dkrttdndS(sZ Check if passthough rule is valid (only add, insert and new chain
    rules are allowed) s-Cs--checks-Ds--deletes-Rs	--replaces-Ls--lists-Ss--list-ruless-Fs--flushs-Zs--zeros-Xs--delete-chains-Ps--policys-Es--rename-chainisarg '%s' is not alloweds-As--appends-Is--inserts-Ns--new-chainsno '-A', '-I' or '-N' argN(tsettlenR
Rtlist(R%tnot_allowedtneeded((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcommon_check_passthroughs*		t	ip4tablescBseZdZdZeZdZdZdZd.dZ
dZdZdZ
d	Zd
ZdZdZd
ZdZdZdZd.dZdZdZdZdZdZdZddZdZedZ dZ!dZ"dZ#dZ$d Z%d!Z&d"Z'd#Z(d.d.d$Z)d.d.d%Z*d.d.d&Z+d'Z,d.d(Z-d.d)Z.d.d*Z/d+Z0d,Z1d-Z2RS(/RR4cCsz||_tj|j|_tjd|j|_|j|_|j|_	|j
g|_g|_i|_
dS(Ns
%s-restore(t_fwRtCOMMANDStipvt_commandt_restore_commandt_detect_wait_optiontwait_optiont_detect_restore_wait_optiontrestore_wait_optiontfill_existstavailable_tablestzone_source_index_cachet
our_chains(tselftfw((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt__init__s	
		cCs4tjj|j|_tjj|j|_dS(N(tostpathtexistsR8tcommand_existsR9trestore_command_exists(RB((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR>scCs|jrB|j|krB|jgg|D]}d|^q(}ng|D]}d|^qI}tjd|j|jdj|t|j|\}}|dkrtd|jdj||fn|S(Ns%ss	%s: %s %st is'%s %s' failed: %s(R;Rtdebug2t	__class__R8tjoinRR+(RBR%titemt_argststatustret((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt__runs*%cCs|dkr|Sg}x|D]}t}x|D]}y|j|}Wntk
r\q0Xt||kr0d||dkr0t}||djd}x3|D](}	|}
|	|
|d<|j|
qWq0q0W|s|j|qqW|S(s5Split values combined with commas for options in optst,iN(tNonetFalseR!R+R/tTruetsplittappend(RBtrulestoptst	out_rulestrulet	processedtopttititemsRNt_rule((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytsplit_values(


&
cCsAy|j|}Wntk
r'tSX||||d+tSdS(Ni(R!R+RURV(RBR\tpatterntreplacementR_((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
_rule_replaces
cCs|tko|t|kS(N(tBUILT_IN_CHAINS(RBR7ttabletchain((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytis_chain_builtinscCsCd|g}|r"|jdn
|jd|j||gS(Ns-ts-Ns-X(RX(RBtaddRgRhR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_chain_ruless

cCsLd|g}|r.|d|t|g7}n|d|g7}||7}|S(Ns-ts-Is-D(tstr(RBRjRgRhR!R%R\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
build_rules
cCs
t|S(N(R*(RBR%((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytreverse_rulescCst|dS(N(R3(RBR%((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcheck_passthroughscCs
t|S(N(R-(RBR%((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytreverse_passthrough
scCsd}y|jd}Wntk
r,n(Xt||dkrT||d}nd}xndddddd	gD]T}y|j|}Wntk
rqsXt||dkrs||d}qsqsW||fS(
NRs-tis-As--appends-Is--inserts-Ns--new-chain(R!R+R/RT(RBR%RgR_RhR^((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytpassthrough_parse_table_chain
s$
	
cCsyb|jd}|j||j|}d|dkrQ||df}n||df}WnLtk
ry&|jd}|j|d}Wqtk
rdSXnXt}|ddkrt}n|r|r||kr|j|qn|r|rI||kr7|j||jd
dn|j|}n!|j	j
r^d}nt|}d|d<|jd
d|dndS(Ns%%ZONE_SOURCE%%s-miiis%%ZONE_INTERFACE%%is-Ds--deletetkeycSs|dS(Ni((R,((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt<lambda>@ss-Iis%di(s-Ds--delete(
R!R$R+RTRVRUtremoveRXtsortR5t_allow_zone_driftingR/tinsert(RBR\R@R_tzonetzone_sourcetrule_addR!((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_run_replace_zone_source#s>




		

	
cCs#t}i}tj|j}x|D]}|}|j|dddt|jg|j|dt|jgy|jd}Wnt	k
rnLX|dkrq(n|d&krd
dd|g|||d
+n
|j
||j||d}	xpddgD]b}
y|j|
}Wnt	k
r6q
Xt||d
kr
|j
||j
|}	q
q
Wxzt
t|D]f}x]tjD]R}|||kr||jdo||jdrd||||<qqWqW|j|	gj|q(Wx|D]}	||	}|j|ddg}|j|ddg}|jd|	x(|D] }|jdj|dqiW|jdqW|jtj|j}tjd|j|jd|j|jfg}
|j r|
j|j n|
jdt!|j|
d|j\}}tj"dkrt#|j}|dk	rd
}xc|D]X}tj%d ||fd!d
d"d#|jdstj%d$d!d
n|d
7}qpWqntj&|j|d#krt	d%|jdj|
|fn||_|S('Ns
%%REJECT%%tREJECTs
--reject-withs%%ICMP%%s%%LOGTYPE%%tofftunicastt	broadcastt	multicasts-mtpkttypes
--pkt-typeiRs-ts--tablet"s"%s"s-ss--sources-ds
--destinations*%s
RJs
sCOMMIT
s	%s: %s %ss%s: %ds-ntstdinis%8d: %stnofmttnlits'%s %s' failed: %s(R~RR('RtcopytdeepcopyR@RetDEFAULT_REJECT_TYPER7tICMPR!R+R$R{R/trangetstringt
whitespacet
startswithtendswitht
setdefaultRXRbtwriteRMtcloseREtstattnameRRKRLR9tst_sizeR=RtgetDebugLogLevelRRTtdebug3tunlink(RBRYt
log_deniedt	temp_filettable_rulesR@RaR\R_RgR^tcRR%RPRQtlinestline((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt	set_rulesLs	

 


#



	

#	cCs|j|dddt|jg|j|dt|jgy|jd}Wntk
rfnJX|dkrwdS|dkrddd
|g|||d+n
|j|tj|j	}|j
|||j|}||_	|S(Ns
%%REJECT%%R|s
--reject-withs%%ICMP%%s%%LOGTYPE%%R}RR~RRs-mRs
--pkt-typei(sunicasts	broadcasts	multicast(ReRR7RR!R+R$RRR@R{t_ip4tables__run(RBR\RR_R@toutput((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytset_rules"
 
	cCsg}|r|gn	tj}x|D]}||jkrM|j|q(y:|jd|ddg|jj||j|Wq(tk
rtjd|j|fq(Xq(W|S(Ns-ts-Ls-nsA%s table '%s' does not exist (or not enough permission to check).(	RftkeysR?RXRR+Rtdebug1R7(RBRgRQttables((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytget_available_tabless

"cCsd}t|jdddg}|ddkrd}t|jdddg}|ddkrkd}ntjd|j|j|n|S(NRs-ws-Ls-nis-w10s%s: %s will be using %s option.(RR8RRKRL(RBR;RQ((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR:s	cCst}|jd|jd}xlddgD]^}t|j|gd|j}|ddkr3d|dkr3d	|dkr3|}Pq3q3Wtjd
|j|j|t	j
|j|S(Ns#fooRs-ws--wait=2Risinvalid optionisunrecognized options%s: %s will be using %s option.(RRRRR9RRRKRLRER(RBRR;ttest_optionRQ((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR<s	

 cCsog|_g}xYtjD]K}|j|s7qnx-dddgD]}|jd||gqGWqW|S(Ns-Fs-Xs-Zs-t(R@RfRRRX(RBRYRgtflag((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_flush_ruless	cCsyg}xltjD]^}|j|s.qn|dkr@qnx.t|D]"}|jd|d||gqKWqW|S(NRs-ts-P(RfRRRX(RBtpolicyRYRgRh((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_set_policy_ruless$c
Cs{g}d}y1|jd|jdkr-dnddg}WnGtk
r}|jdkrrtjd|qtjd|nX|j}t}x|D]}|r.|jj}|j	}xa|D]V}|j
d	r|jd
r|dd!}	n|}	|	|kr|j|	qqWn|jdkrL|j
d
sj|jdkr|j
drt
}qqW|S(sQReturn ICMP types that are supported by the iptables/ip6tables command and kernelRs-pRR s	ipv6-icmps--helpsiptables error: %ssip6tables error: %st(t)iisValid ICMP Types:RsValid ICMPv6 Types:(RR7R+RRt
splitlinesRUtstriptlowerRWRRRXRV(
RBRQRtexRtin_typesRtsplitsRWR,((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytsupported_icmp_typess4	


cCsgS(N((RB((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_default_tables/sR}c	Cs>i}|jdrg|d<t|jd<x]tdD]N}|djd||djd||f|jdjd|q:Wn|jdrg|d<t|jd<xtdD]}|djd||djd||f|jdjd||dkrx|jjr8ddgndgD]f}|djd	||f|djd
|||f|jdjtd||fgq?WqqWn|jdrg|d<t|jd<xtdD]}|djd||djd||f|jdjd||dkrx|jjr\ddgndgD]f}|djd	||f|djd
|||f|jdjtd||fgqcWqqWn|jd
rg|d
<t|jd
<xtd
D]}|d
jd||d
jd||f|jd
jd||d0krx|jjrddgndgD]f}|d
jd	||f|d
jd
|||f|jd
jtd||fgqWqqWng|d<t|jd<|djd|djd|djd|djd|jdjtdxq|jjrddgndgD]N}|djd||djd||jdjtd|qW|dkr|djdn|djd|dkr8|djdn|djd|djd|djd|djd|djd |jdjtd!xd"d#gD]}x|jjrddgndgD]`}|djd$||f|djd%||f|jdjtd&||fqWqW|dkrd|djd'n|djd(|dkr|djd)n|djd*|dcd+d,d-g7<|jdjtd.g}xX|D]P}||jkrqnx/||D]#}|jd/|gt	|qWqW|S(1NRs-N %s_directs-A %s -j %s_directs	%s_directRRtZONES_SOURCEtZONESs-N %s_%ss-A %s -j %s_%ss%s_%sRRRRs=-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs-A INPUT -i lo -j ACCEPTs-N INPUT_directs-A INPUT -j INPUT_directtINPUT_directs-N INPUT_%ss-A INPUT -j INPUT_%ssINPUT_%sR}s^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's/-A INPUT -m conntrack --ctstate INVALID -j DROPs9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's-A INPUT -j %%REJECT%%s?-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs-A FORWARD -i lo -j ACCEPTs-N FORWARD_directs-A FORWARD -j FORWARD_directtFORWARD_directtINtOUTs-N FORWARD_%s_%ss-A FORWARD -j FORWARD_%s_%ss
FORWARD_%s_%ss`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's1-A FORWARD -m conntrack --ctstate INVALID -j DROPs;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's-A FORWARD -j %%REJECT%%s-N OUTPUT_directs-A OUTPUT -o lo -j ACCEPTs-A OUTPUT -j OUTPUT_directt
OUTPUT_directs-t(RR(
RR.RARfRXRjR5RvtupdateR(	RBRt
default_rulesRhtdispatch_suffixt	directiontfinal_default_rulesRgR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_default_rules3s

(5
(5
(5
("(,
	
%cCs|dkrdddhS|dkrSd|jkrSd|jkrSdhSn|dkr~d|jkr~ddhSn|d	krd	|jkrdhSniS(
NRRt
FORWARD_INtFORWARD_OUTRRRRR(R(RBRg((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytget_zone_table_chainss



cCsidd6dd6dd6dd6dd6dd6|}tjd	t|d
|}d}	|ry|rydd
|dg}
n?|rdd
|g}
n&dd
|g}
|s|
dg7}
n|
d||||	|g7}
|
gS(Ns-iRs-oRRRRRRhRxs-gs-Is%s_ZONESs%%ZONE_INTERFACE%%s-As-Ds-t(RtformatR(RBtenableRxt	interfaceRgRhRXR^ttargettactionR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt!build_zone_source_interface_ruless&
c
Csidt6dt6|}idd6dd6dd6dd6dd	6dd
6|}|jjred|}n
d|}tjd
t|d|}	d}
|jdr|d}|dkrd}nd}dj|g|jj	j
|}||d|d|ddd|||
|	g
}
nt|ri|dkr6dS||d|d|ddd|j|
|	g}
nt
d|rt|}n=td|r|jd}t|dd|d }n||d|d||||
|	g
}
|
gS(!Ns-Is-Ds-sRs-dRRRRRs%s_ZONES_SOURCEs%s_ZONESRhRxs-gsipset:itdsttsrcRSs%%ZONE_SOURCE%%s-ts-mR.s--match-setRtmacs--mac-sourceRt/ii(RVRUR5RvRRRRRMtipsett
get_dimensionRtupperR	RR
RW(RBRRxtaddressRgRhtadd_delR^tzone_dispatch_chainRRRtflagsR\t
addr_split((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_source_address_rulessV


	%cCs6tjdt|d|}|j|jt|d|d|d|gg}|jd|d|g|jdd|d|g|jdd|d|g|jdd|d|g|jd|d|d	d|g|jd|d|d	d|g|jd|d|d	d|g|jjj	|j
}|jjd
kr|dkr|dkr|dkr|jd|d|dd	ddd|g	n|dkr|jd|d|dd	ddd|g	qqn|dkr2|dkr2|dkr2|jd|d|d	|gn|S(NRhRxs%s_logs%s_denys%s_allows-Ns-ts-As-jR}RRRRRR|s
%%REJECT%%s%%LOGTYPE%%tLOGs--log-prefixs
"%s_REJECT: "tDROPs"%s_DROP: "tACCEPT(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(sREJECTs
%%REJECT%%(RsREJECTs
%%REJECT%%R(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(RRRRARR.RXR5Rxt_zonesRtget_log_denied(RBRxRgRht_zoneRYR((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_chain_ruless<###		"cCs|rddd|jgSgS(Ns-mtlimits--limit(tvalue(RBR((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rule_limit*scCs|js
gSidt6dt6|}|d|d|g}||ddg7}|jjrx|dd|jjg7}n|jjr|d	d
|jjg7}n||j|jj7}|S(Ns-As-Ds%s_logs-ts-jRs--log-prefixs'%s's--log-levels%s(RRVRUtprefixtlevelRR(RBt	rich_ruleRRgRt
rule_fragmentRR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_log/s	c	Cs|js
gSidt6dt6|}|d|d|g|}t|jtkr]d}nBt|jtkr{d}n$t|jtkrd}nd}|d	d
d|g7}||j|jj	7}|S(Ns-As-Ds%s_logs-ttaccepttrejecttdroptunknowns-jtAUDITs--type(
tauditRVRUttypeRRRRRR(	RBRRRgRRRR\t_type((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_audit?s				cCs|js
gSidt6dt6|}t|jtkrSd|}ddg}	nt|jtkrd|}ddg}	|jjrL|	d|jjg7}	qLnt|jtkrd|}dd	g}	nxt|jtkr0tj	d
t
dd|}d
}d|}ddd|jjg}	ntt
dt|j||d|g}
|
||	7}
|
|j|jj7}
|
S(Ns-As-Ds%s_allows-jRs%s_denyR|s
--reject-withRRhRRxRtMARKs--set-xmarksUnknown action %ss-t(RRVRURRRRRRRRR.R
RRR(RBRxRRRgRRRRhtrule_actionR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_actionSs4	


	
cCs|s
gSg}|jr)|jdntd|jrW|dt|jg7}n`td|jr|jjd}|dt|dd|dg7}n|d|jg7}|S(Nt!Rs-dRii(tinvertRXR	taddrRR
RW(RBt	rich_destRR((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_destination_fragmentts	)cCs|s
gSg}|jr|jr2|jdntd|jr`|dt|jg7}qtd|jr|jjd}|dt|dd|dg7}q|d|jg7}nt|dr|jr|ddg7}|jr|jdn|d	|jg7}nut|d
r|j	r|ddg7}|jr[|jdn|j
jj|j	d}|d
|j	|g7}n|S(NRRs-sRiiRs-ms--mac-sourceRR.Rs--match-set(
RRRXR	RR
RWthasattrRRR5Rxt_ipset_match_flags(RBtrich_sourceRRR((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_source_fragments0		)		c	Csidt6dt6|}d}tjdtdd|}	d|g}
|ri|
dd	t|g7}
n|r|
d
|g7}
n|r|
|j|j7}
|
|j|j	7}
n|st
|jtkr|
ddd
dg7}
ng}|rd|j
|j||||	|
|j
|j||||	|
|j
|j|||||	|
n+|j
|d|	d|g|
ddg|S(Ns-As-DRRhRRxs-ps--dports%ss-ds-mt	conntracks	--ctstates
NEW,UNTRACKEDs%s_allows-ts-jR(RVRURRRRRtdestinationRtsourceRRRRXRRR(RBRRxtprototportRRRRgRRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_ports_ruless,	""(%c	Cspidt6dt6|}d}tjdtdd|}d|g}	|r_|	d|g7}	n|r|	|j|j7}	|	|j|j7}	n|st	|j
tkr|	d	d
ddg7}	ng}
|rA|
j|j
|||||	|
j|j|||||	|
j|j||||||	n+|
j|d
|d|g|	ddg|
S(Ns-As-DRRhRRxs-ps-ds-mRs	--ctstates
NEW,UNTRACKEDs%s_allows-ts-jR(RVRURRRRRRRRRRRXRRR(RBRRxtprotocolRRRRgRRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_protocol_ruless&""(%c	Csidt6dt6|}d}tjdtdd|}	d|g}
|ri|
dd	t|g7}
n|r|
d
|g7}
n|r|
|j|j7}
|
|j|j	7}
n|st
|jtkr|
ddd
dg7}
ng}|rd|j
|j||||	|
|j
|j||||	|
|j
|j|||||	|
n+|j
|d|	d|g|
ddg|S(Ns-As-DRRhRRxs-ps--sports%ss-ds-mRs	--ctstates
NEW,UNTRACKEDs%s_allows-ts-jR(RVRURRRRRRRRRRRRXRRR(RBRRxRRRRRRgRRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_source_ports_ruless*""(%cCsidt6dt6|}tjdtdd|}	|d|	ddd	|g}
|rs|
d
dt|g7}
n|r|
d|g7}
n|
d
dd|g7}
|
gS(Ns-As-DRhRRxs%s_allows-tRs-ps--dports%ss-ds-jtCTs--helper(RVRURRRR(RBRRxRRRthelper_nametmodule_short_nameRRR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_helper_ports_ruless	cCs;idt6dt6|}tjdtdd|}g}|ro||j|j7}||j|j7}ng}|j	|d|ddg|d	d
ddd
gtjdtdd|}g}|r||j|j7}||j|j7}n|j	|d|ddg|ddddddg|S(Ns-As-DRhRRxs%s_allows-tRRs-otlos-jt
MASQUERADERRs-mRs	--ctstates
NEW,UNTRACKEDR(
RVRURRRRRRRRX(RBRRxRRRRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_masquerade_ruless*		c

Csidt6dt6|}
d|}ddd|g}d}
|rstd|rf|
d	t|7}
qs|
|7}
n|r|dkr|
d
t|d7}
ntjdtd
d|}d|dt|g}|	r||j|	j	7}||j
|	j7}ng}|	r9|j|j
|	|d||n|j|
d|ddg|ddd|g|j|
d|ddd|g|ddd|
gtjdt|d|}|j|
d|ddddddg|ddg|S(Ns-As-Ds0x%xs-mtmarks--markRRs[%s]s:%st-RhRRxs-ps--dportRs%s_allows-ts-jRs
--set-markRtDNATs--to-destinationRRs	--ctstates
NEW,UNTRACKEDR(RVRUR	RRRRRRRRRRXR(RBRRxtfilter_chainRRttoportttoaddrtmark_idRRtmark_strR
ttoRRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_forward_port_ruless<

	%	1c
CsXd}idt6dt6|}|jdkrQddg}ddd|jg}n!dd	g}dd
d|jg}g}	xdd
gD]}
tjdt|
d|}|jjj	|rd|}d}
nd|}d}
g}|r||j
|j7}||j|j
7}n|||7}|r|	j|j||||||	j|j||||||jr|	j|j||||||qP|	j|d|d|g|ddgq|jjdkr)|
dkr)|	j||d|g|ddddd|gn|	j||d|g|d|
gqW|	S(NRs-As-DRs-pR s-ms--icmp-types	ipv6-icmpticmp6s
--icmpv6-typeRRRhRxs%s_allowRs%s_denys
%%REJECT%%s-ts-jR}s%%LOGTYPE%%Rs--log-prefixs"%s_ICMP_BLOCK: "(RVRUR7RRRRR5Rxtquery_icmp_block_inversionRRRRRXRRRRR(RBRRxtictRRgRRtmatchRYRhRtfinal_chaintfinal_targetR((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_icmp_block_rulesIsL	
	
""	(!	c
CsBd}g}x/ddgD]!}d}tjdt|d|}|jjj|rd}|jjdkr|rd	|t|g}	nd
|g}	|	d|dd
ddddd|g	}	|j|	|d7}qnd}|rd	|t|g}	nd
|g}	|	d|dd
d|g}	|j|	qW|S(NRRRiRhRxs
%%REJECT%%R}s-Is-Ds-ts-ps%%ICMP%%s%%LOGTYPE%%s-jRs--log-prefixs"%s_ICMP_BLOCK: "iR(	RRRR5RxRRRlRX(
RBRRxRgRYRhtrule_idxRt
ibi_targetR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt%build_zone_icmp_block_inversion_ruleszs2		
cCsd}tjdtdd|}g}||j|j7}||j|j7}g}|j|j||||||j|j	||||||j|j
|||||||S(NRRhRRx(RRRRRRRRXRRR(RBRRxRRgRRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt(build_zone_rich_source_destination_ruless	""%cCs
||jkS(N(R7(RBR7((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytis_ipv_supportedsN(3t__name__t
__module__R7RRVtzones_supportedRDR>RRTRbReRiRkRmRnRoRpRqR{RRRR:R<RRRRRRRURRRRRRRRRRRRR	RRRR R!R"(((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR4s\			
												)	^				
		!	i		7	,				!			,1	#	t	ip6tablescBs eZdZdZedZRS(RR&cCsg}|jddddddddd	g	|d
krk|jddddddddddd
gn|jdddddddddg	|jdddddddddg	|S(Ns-IRs-tRs-mtrpfilters--inverts-jRR}Rs--log-prefixsrpfilter_DROP: s-ps	ipv6-icmps$--icmpv6-type=neighbour-solicitationRs"--icmpv6-type=router-advertisement(RX(RBRRY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_rpfilter_ruless"	

(R#R$R7RRUR((((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR&s((tos.pathRERtfirewall.core.baseRRtfirewall.core.progRtfirewall.core.loggerRtfirewall.functionsRRRRRR	R
RtfirewallRtfirewall.errorsR
RRtfirewall.core.richRRRRRRfRRR*R-R3tobjectR4R&(((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt<module>s<:"


	%	*	 
Back to Directory File Manager