c`c @ s~ d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z d d l
m Z m Z m
Z
m Z m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z m Z d Z d
Z i i d d e f d
6d 6i d d e f d
6d 6i d d e f d
6d d e f d 6d 6i d d e f d 6d d e f d 6d 6Z i i d 6i d 6i d 6Z! i i" d d d! d d" d# g d$ 6d d d! g d! 6d d d% g d% 6d d d& g d& 6d d d! d d" d' g d( 6d d d! d d" d) g d* 6d d d! d d" d+ g d, 6d d d- d d" d. g d/ 6d d d! d d" d0 g d1 6d d d! d d" d. g d2 6d d d3 d d" d. g d4 6d d d! d d" d5 g d6 6d d d- d d" d7 g d8 6d d d! d d" d9 g d: 6d d d! d d" d7 g d; 6d d d3 g d3 6d d d! d d" d< g d= 6d d d! d d" d> g d? 6d d d! d d" d@ g dA 6d d d- g d- 6d d d3 d d" d. g dB 6d d dC g dC 6d d dD g dD 6d d dE g dE 6d d d! d d" dF g dG 6d d dH g dH 6d d dI g dI 6d d dJ g dJ 6d d d- d d" d< g dK 6d d d! d d" dL g dM 6d d d- d d" d@ g dN 6d d d! d d" dO g dP 6d d dH d d" d. g dQ 6d d dH d d" d7 g dR 6dS 6i dT d d! dT d" d< g dU 6dT d d3 dT d" d7 g dV 6dT d d! dT d" d@ g dW 6dT d d! dT d" d. g d$ 6dT d d! g d! 6dT d d% g d% 6dT d d& g d& 6dT d d! dT d" dF g dX 6dT d dY g dZ 6dT d d[ g d\ 6dT d d! dT d" d7 g d] 6dT d d^ g d^ 6dT d d3 g d3 6dT d d! dT d" d' g d= 6dT d d_ g d- 6dT d d! dT d" d9 g d` 6dT d da g dC 6dT d db g dD 6dT d dH g dH 6dT d dH dT d" d. g dQ 6dT d dH dT d" d7 g dR 6dT d d3 dT d" d. g dc 6dT d d3 dT d" d@ g dd 6de 6Z" df e# f dg YZ$ d S(h iN( t SHORTCUTSt DEFAULT_ZONE_TARGET( t runProg( t log( t splitArgst check_mact portStrt check_single_addresst
check_address( t config( t
FirewallErrort
UNKNOWN_ERRORt INVALID_RULEt INVALID_ICMPTYPEt INVALID_TYPEt
INVALID_ENTRY( t Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_Markt firewalldi
t
preroutingit
PREROUTINGt rawijt mangleit postroutingid t POSTROUTINGt natt inputi t INPUTt forwardt FORWARDt filtert inett ipt ip6t icmpt types destination-unreachablet codet 13s communication-prohibiteds
echo-replys echo-requestt 4s fragmentation-neededt 14s host-precedence-violationt 10s host-prohibitedt redirectt 1s
host-redirectt 7s host-unknowns host-unreachables parameter-problems
ip-header-badt 8s network-prohibitedt 0s network-redirectt 6s network-unknowns network-unreachablet 3s port-unreachablet 15s precedence-cutofft 2s protocol-unreachables required-option-missings router-advertisements router-solicitations
source-quencht 5s source-route-faileds
time-exceededs timestamp-replys timestamp-requests tos-host-redirectt 12s tos-host-unreachables tos-network-redirectt 11s tos-network-unreachables ttl-zero-during-reassemblys ttl-zero-during-transitt ipv4t icmpv6s address-unreachables
bad-headers beyond-scopes
failed-policys nd-neighbor-adverts neighbour-advertisements nd-neighbor-solicits neighbour-solicitations no-routes packet-too-bigs nd-redirects reject-routes nd-router-adverts nd-router-solicits unknown-header-types unknown-optiont ipv6t nftablesc B s e Z d Z e Z d Z d Z d Z d Z d Z d Z
d Z d Z d3 d Z d
Z d Z d Z d
Z d d Z d Z e d d Z d d Z d d Z d Z d Z d Z d Z d Z d Z d Z d Z d3 d3 d Z! d3 d3 d Z" d3 d3 d Z# d Z$ d3 d! Z% d3 d" Z& d# Z' d3 d$ Z( d% Z) d3 d& Z* d' Z+ e d( Z, d) Z- d* Z. d+ Z/ d3 d, Z0 d- Z1 d. Z2 d/ Z3 d0 Z4 d1 Z5 d2 Z6 RS(4 R: c C sK | | _ t j d | _ | j g | _ i | _ i | _ i | _ d S( Nt nft( t _fwR t COMMANDSt _commandt fill_existst available_tablest rule_to_handlet rule_ref_countt zone_source_index_cache( t selft fw( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __init__ s
c C s% t j j | j | _ t | _ d S( N( t ost patht existsR> t command_existst Falset restore_command_exists( RD ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR? s c C s y? | j d } | j | | j | } | | d f } WnL t k
r y& | j d } | j | d } Wq t k
r d SXn X| d } | r | r | | k r| | | k r| | j | qn | r| | k r g | | <n | rN| | | k r8| | j | | | j d d n | | j | } n% | j j rcd } n t | | } | d k rd | d <q| d 8} d
| d <| j
| d | j
| d d | n d S(
Ns %%ZONE_SOURCE%%i s %%ZONE_INTERFACE%%i t keyc S s | d S( Ni ( ( t x( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <lambda> s i t inserti t addt indexs %d( RR t popt
ValueErrort Nonet removet appendt sortR< t _allow_zone_driftingt lenRP ( RD t rule_addt ruleRC t it zonet zone_sourcet familyRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _run_replace_zone_source sD
c
C s d d g } | } | d d k rs | d d k rs | } d | d <t | j | | \ } } | d k rs d Sn d } | d d k r | d d k r t } | d } | d
d k r y t | d Wn t k
r t t d q X| j d
| j d
n d j | } nB | d d k r_| d d k r_t
} | d } d j | } n | | j k r7| r| j | c d 7<d S| r| j | d k r| j | c d 8<d S| j | d k r| j | c d 8<n t t d | | j | f t
j d | j | j | | j d j | n | ret j | j } | j | | | n | s| r| j | d k s| r| | j k r| r| rd d g | d d !d | j | g } n d j | }
t
j d | j | j |
t | j | | \ } } | d k rEt d | j |
| f n | rW| | _ n | r| rd } | j | t | } | | j | j | <d | j | <q| j | =| j | =qn | S( Ns --echos --handlei t deletei t tablet listt RQ RP R\ i i t positioni s position without a numbert s) rule ref count bug: rule_key '%s', cnt %ds %s: rule ref cnt %d, %s %si t handles %s: %s %ss '%s %s' failed: %ss # handle ( s adds insert( Rb ( R R> RU t Truet intt ExceptionR
R RS t joinRK RB R R t debug2t __class__t copyt deepcopyRC Ra RA RT RR RZ t strip(
RD t argst nft_optst _argst
_args_testt statust outputt rule_keyR[ RC t _args_strt strt offset( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __run s|
#!
c C sA y | j | } Wn t k
r' t SX| | | | d +t Sd S( Ni ( RR RT RK Ri ( RD R\ t patternt replacementR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
_rule_replace, s
c C s | } d | d <| S( NRb i ( ( RD Rr t ret_args( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt reverse_rule5 s
c C s t t d d S( Ns not implemented( R
R ( RD t rulest
log_denied( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_rules: s c C s d } d | k s* d | k s* d | k r3 d } n- d | k sW d | k sW d | k r` d } n | j | d d d
| d d g | j | d
d d d g y | j d } Wn t k
r nD X| d k r d S| d k r d | g | | | d +n
| j | | j | S( Nt icmpxR7 R" R$ R9 R# R8 s
%%REJECT%%t rejectt withR% s admin-prohibiteds %%ICMP%%t metat l4protos {icmp, icmpv6}s %%LOGTYPE%%t offRe t unicastt broadcastt multicastt pkttypei ( R R R ( R RR RT RS t _nftables__run( RD R\ R t icmp_keywordR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_ruleC s$ $ $
c C s | r
| g St j S( N( t IPTABLES_TO_NFT_HOOKt keys( RD Rc ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_available_tablesb s c C sY i | _ i | _ i | _ g } x1 t j D]# } | j d d | d t g q. W| S( NRb Rc s %s( RA RB RC t
OUR_CHAINSR RW t
TABLE_NAME( RD R R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_flush_rulesf s !c C s t d d } g } | d k r | j d d d | g x d d g D]: } d | d
| | d t d f } | j t | qF Wn5 | d
k r | j d d d | g n
t t d | S( Nt _t policy_dropt DROPRQ Rc R! R Rw sM add chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'R ii t ACCEPTRb s not implemented( R RW t NFT_HOOK_OFFSETR R
R ( RD t policyt
table_nameR t hookt
_add_chain( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_set_policy_rulesp s
c C sA t } x+ t j D] } | j t | j q Wt | S( N( t sett ICMP_TYPES_FRAGMENTR t updateRd ( RD t supportedt ipv( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt supported_icmp_types s c C sA g } x+ t j D] } | j d | t f q Wt t | S( Ns add table %s %s( R R RW R t mapR ( RD t default_tablesR` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_tables s R c
C s g } t t d d <x t d j D] } | j d t | t d | d t d | d f x | j j r~ d d g n d g D]e } | j d t | | f | j d t | | | f t d d j t d
| | f g q Wq( Wt t d d <x t d j D] } | j d t | t d | d t d | d f x | j j rjd d g n d g D]e } | j d
t | | f | j d t | | | f t d d j t d
| | f g qqWqWt t d d <t t d d <x d d g D] } x t d j D] } | j d | t | t d | d t d | d f x | j j r}d d g n d g D]k } | j d | t | | f | j d | t | | | f t | d j t d
| | f g qWq$Wq
Wt t d d <xM t d j D]; } | j d t | t d | d t d | d f q W| j d t d f | j d t d f x` | j j rd d g n d g D]= } | j d t d | f | j d t d d | f qW| d k r| j d t d f n | j d t d f | d k rP| j d t d f n | j d t d f | j d! t d" f | j d t d" f | j d t d" f x} d# d$ g D]o } xf | j j rd d g n d g D]C } | j d% t d" | | f | j d& t d" d" | | f qWqW| d k rR| j d t d" f n | j d t d" f | d k r| j d t d" f n | j d t d" f t d' d( d) d* d+ d, g t d d <t t
| S(- NR! R s@ add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'i i t ZONES_SOURCEt ZONESs add chain inet %s raw_%s_%ss& add rule inet %s raw_%s jump raw_%s_%ss %s_%sR sC add chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'s add chain inet %s mangle_%s_%ss, add rule inet %s mangle_%s jump mangle_%s_%sR" R R# s; add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'s add chain %s %s nat_%s_%ss$ add rule %s %s nat_%s jump nat_%s_%sR sC add chain inet %s filter_%s '{ type filter hook %s priority %d ; }'s> add rule inet %s filter_%s ct state established,related acceptR s, add rule inet %s filter_%s iifname lo accepts add chain inet %s filter_%s_%ss, add rule inet %s filter_%s jump filter_%s_%sR s_ add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '"STATE_INVALID_DROP: "'s0 add rule inet %s filter_%s ct state invalid dropsH add rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '"FINAL_REJECT: "'sB add rule inet %s filter_%s reject with icmpx type admin-prohibiteds$ add chain inet %s filter_%s_IN_ZONESR t INt OUTs! add chain inet %s filter_%s_%s_%ss/ add rule inet %s filter_%s jump filter_%s_%s_%st INPUT_ZONES_SOURCEt INPUT_ZONESt FORWARD_IN_ZONES_SOURCEt FORWARD_IN_ZONESt FORWARD_OUT_ZONES_SOURCEt FORWARD_OUT_ZONES( R R R R RW R R< RY R R R ( RD R t
default_rulest chaint dispatch_suffixR` t direction( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_rules s ( 0 ( 0 ( 4 (! ( ( c C sY | d k r d d d g S| d k r, d g S| d k rB d d g S| d k rU d g Si S(
NR R t
FORWARD_INt FORWARD_OUTR R R R R ( ( RD Rc ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_zone_table_chains s
R! c
C s | d k rr | d k rr g } | j | j | | | | | | d | j | j | | | | | | d | Si d d 6d d 6d d 6d d
6d d 6d d 6| } | t | d
d k r | t | d
d } n t j d t | d | }
d } | r3| r3d d | d t d | | f d g } ne | r_d d | d t d | | f g } n9 d d | d t d | | f g } | s| d g 7} n | d k r| | d | |
f g 7} n( | | d | d | d | |
f g 7} | g S( NR R! R" R# t iifnameR t oifnameR R R R t OUTPUTi t +t *R R^ t gotoRP R\ s %ss %s_%s_ZONESs %%ZONE_INTERFACE%%RQ Rb s %s_%ss "( t extendt! build_zone_source_interface_rulesRZ R t formatR R (
RD t enableR^ t interfaceRc R RW R` R t optt targett actionR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR s>
&# (c C sK | d k r | d k r g } | j d rI | j | t d } n d } t d | sv t | sv | d k r | j | j | | | | | d n t d | s t | s | d k r | j | j | | | | | d n | Si d t 6d t 6| } i d
d 6d d
6d
d 6d
d 6d d 6d d 6| }
| j
j r\d | | f } n d | | f } t j
d t | d | } d }
| j d r| t d } | j | } d | } nC t | r|
d k rd Sd } n t d | rd } n d } | d | d t | d | | |
| |
d | | f g } | g S( NR R! s ipset:R7 R" R9 R# RP Rb t saddrR t daddrR R R R R s %s_%s_ZONES_SOURCEs %s_%s_ZONESR R^ R t @Re t etherR\ s %ss %%ZONE_SOURCE%%s %s_%s( t
startswitht _set_get_familyRZ RU R R R t build_zone_source_address_rulesRi RK R< RY R R R R ( RD R R^ t addressRc R R` R t ipset_familyt add_delR t zone_dispatch_chainR R t ipsett rule_familyR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR $ sT ''
c C s. | d k r` | d k r` g } | j | j | | | d | j | j | | | d | St j d t | d | } t | | j t | d | d | d | g g } | j d
d | d t d | | f g | j d
d | d t d
| | f g | j d
d | d t d | | f g | j d
d | d t d | | f g | j d
d | d t d | | f d d
| | f g | j d
d | d t d | | f d d | | f g | j d
d | d t d | | f d d | | f g | j
j j | j
} | j
j d k r| d k r| d k r| d! k r| } | d k rud } n | j d
d | d t d | | f d d d d | | f g qqn | d k r*| d" k r*| d# k r*| j d
d | d t d | | f | d k r | j n d g n | S($ NR R! R" R# R R^ s %s_logs %s_denys %s_allowRQ s %ss %s_%ss %s_%s_logs
%s_%s_denys %s_%s_allowR\ t jumpR R R R R R t REJECTs
%%REJECT%%R s %%LOGTYPE%%R t prefixs "filter_%s_%s: "R ( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R s
%%REJECT%%s DROP( s ACCEPTR s
%%REJECT%%s DROP( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R t build_zone_chain_rulesR R R R R R RW R R< R^ t _zonesR t get_log_deniedt lower( RD R^ Rc R R` R t _zoneR t
log_suffix( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR ^ s^
%c C s i d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d
g d 6d d d d
g d 6d d
d d
g d 6d d
d d
g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d
d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d
d d g d 6d d
d d g d 6d d
d d! g d" 6d d
d d! g d! 6d d# d$ g d% 6d d# d$ g d& 6} | | S(' NR R$ R% s host-prohibiteds icmp-host-prohibiteds host-prohibs net-prohibiteds icmp-net-prohibiteds
net-prohibs admin-prohibiteds icmp-admin-prohibiteds admin-prohibR8 s icmp6-adm-prohibiteds adm-prohibiteds net-unreachables icmp-net-unreachables net-unreachs host-unreachables icmp-host-unreachables host-unreachs port-unreachables icmp-port-unreachables icmp6-port-unreachableR s port-unreachs prot-unreachables icmp-proto-unreachables
proto-unreachs addr-unreachables icmp6-addr-unreachables addr-unreachs no-routes icmp6-no-routet tcpt resets tcp-resets tcp-rst( ( RD t reject_typet frags( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _reject_types_fragment s2 c C s | s
g Si d d 6d d 6d d 6d d 6} y | j j d } Wn t k
rd t t d
n Xd d | j d
| !d | | j | d g S( Nt secondt st minutet mt hourt ht dayt dt /s Expected '/' in limitt limitt ratei i ( t valueRR RT R
R ( RD R t rich_to_nftR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_limit_fragment s
c C s | j s
g Si d t 6d t 6| } | d d d t d | | f g } | | d g 7} | j j r | d d | j j g 7} n | j j r | d
d | j j g 7} n | | j | j j 7} | S( NRQ Rb R\ R! s %ss %s_%s_logR R s "%s"t level( R Ri RK R R R R R ( RD t rich_ruleR Rc R t
rule_fragmentR R\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_log s c C s| | j s
g Si d t 6d t 6| } | d d d t d | | f g } | | d d d g 7} | | j | j j 7} | S(
NRQ Rb R\ R! s %ss %s_%s_logR R t audit( R Ri RK R R R ( RD R R Rc R R R R\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_audit s c C s | j s
g Si d t 6d t 6| } t | j t k rV d | | f } d g } nt | j t k r d | | f } d g } | j j r^| | j | j j 7} q^n t | j t k r d | | f } d g } n~ t | j t k rBt j
d t d d
| } d } d | | f } d d
d | j j g } n t
t d t | j | d d d t | g }
|
| 7}
|
| j | j j 7}
|
| 7}
|
S( NRQ Rb s %s_%s_allowt accepts
%s_%s_denyR t dropR R R^ R R t markR s Unknown action %sR\ R! s %s( R Ri RK R% R R R R R R R R R R
R R R R ( RD R^ R R Rc R R R R t rule_actionR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_action s6
c C sS | s
g S| d k r# d d d g S| d k r< d d d g St t d | d S( NR7 R t nfprotoR9 s Invalid family( R
R ( RD t rich_family( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_family_fragment s
c C sx | s
g Sg } t d | j r2 | d g 7} n
| d g 7} | j ra | d d | j g 7} n | d | j g 7} | S( NR7 R" R# R s !=( R t addrt invert( RD t rich_destR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_destination_fragment s
c C sJ | s
g Sg } | j r t d | j r; | d g 7} n
| d g 7} | j rj | d d | j g 7} qF| d | j g 7} n t | d r | j r | j r | d d d | j g 7} qF| d d | j g 7} np t | d rF| j rF| j | j } | j r)| | d d d | j g 7} qF| | d d | j g 7} n | S(
NR7 R" R# R s !=t macR R R ( R R R t hasattrR R R ( RD t rich_sourceR R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_source_fragment, s(
c C s i d t 6d t 6| } d } t j d t d d | } g }
| r_ |
| j | j 7}
n | r t d | r |
d g 7}
n
|
d g 7}
|
d
| g 7}
n | r |
| j | j 7}
|
| j
| j 7}
n |
| d d t | d
g 7}
| st
| j t k r+|
d d d g 7}
n g } | r| j | j | | | | |
| j | j | | | | |
| j | j | | | | | |
n5 | j | d d d t d | | f g |
d g | S( NRQ Rb R R R R^ R7 R" R# R t dports %st -t ctt states
new,untrackedR\ R! s %s_%s_allowR ( Ri RK R R R R R` R R t destinationR t sourceR R% R R RW R R R R ( RD R R^ t protot portR R R Rc R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_ports_rulesI s2
""(/c C s i d t 6d t 6| } d } t j d t d d | } g } | r_ | | j | j 7} n | r t d | r | d g 7} n
| d g 7} | d
| g 7} n | r | | j | j 7} | | j | j 7} | | j
| j 7} n d d | g } | st | j
t k r0| d
d d g 7} n g }
| r|
j | j | | | | | |
j | j | | | | | |
j | j | | | | | | n/ |
j | d d d t d | g | d g |
S( NRQ Rb R R R R^ R7 R" R# R R R R R
s
new,untrackedR\ R! s %ss filter_%s_allowR ( Ri RK R R R R R` R R R R R R% R R RW R R R R ( RD R R^ t protocolR R R Rc R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_protocol_rulesj s4
""()c C s i d t 6d t 6| } d } t j d t d d | } g }
| r_ |
| j | j 7}
n | r t d | r |
d g 7}
n
|
d g 7}
|
d
| g 7}
n | r |
| j | j 7}
|
| j
| j 7}
n |
| d d t | d
g 7}
| st
| j t k r+|
d d d g 7}
n g } | r| j | j | | | | |
| j | j | | | | |
| j | j | | | | | |
n5 | j | d d d t d | | f g |
d g | S( NRQ Rb R R R R^ R7 R" R# R t sports %sR R R
s
new,untrackedR\ R! s %s_%s_allowR ( Ri RK R R R R R` R R R R R R R% R R RW R R R R ( RD R R^ R R R R R Rc R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_source_ports_rules s2
""(/c C s i d t 6d t 6| } t j d t d d | } | d d d t d | g }
| r t d
| rv |
d g 7}
n
|
d g 7}
|
d
| g 7}
n |
| d d t | d g 7}
|
d d d d | | f g 7}
d d d t d | | f d d d | d | d d g } | |
g S( NRQ Rb R R R^ R\ R! s %ss filter_%s_allowR7 R" R# R R
R R t helperR s "helper-%s-%s"s helper-%s-%st {R% s "%s"R t ;t }( Ri RK R R R R R R ( RD R R^ R R R t helper_namet module_short_nameR R R\ t
helper_object( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_helper_ports_rules s"
c C s i d t 6d t 6| } t j d t d d | } g } | ro | | j | j 7} | | j | j 7} n | d | d t d | g | d d
d d g g S(
NRQ Rb R R R^ R\ s %ss nat_%s_allowR s !=t lot
masquerade(
Ri RK R R R R R R R R ( RD R R^ R` R R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _build_zone_masquerade_nat_rules s c C s g } | rd | j r$ | j d k sB | j rd t d | j j rd | j | j | | d | n} | r | j r | j d k s | j r t d | j j r | j | j | | d | n | j | j | | d | i d t 6d t 6| } t j d t
d d | } g } | rP| | j | j 7} | | j
| j 7} n | j | d
d d t d
| g | d d d d g | S( NR9 R# R7 R" RQ Rb R R R^ R\ R! s %ss filter_%s_allowR R
s
new,untrackedR ( R` R R R R R! Ri RK R R R R R R RW R ( RD R R^ R R R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_masquerade_rules s$ " " 2c C s i d t 6d t 6| } t j d t d d | } g }
| rV |
d d | g 7}
n |
d d g 7}
| r | d k r |
d
t | d g 7}
n | d | d
t d | d d | g | |
g S( NRQ Rb R R R^ t dnatt toR+ Re s :%sR R\ s %ss nat_%s_allowR R ( Ri RK R R R R R ( RD R R^ R t
mark_fragmentt toaddrt toportR` R R t
dnat_fragment( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt" _build_zone_forward_port_nat_rules s c
C sa i d t 6d t 6| }
d | } d d | g } t j d t d d | }
g } | r | | j | j 7} | | j | j 7} | | j | j
7} n g } | j |
d d
d t d |
g | | d
| d d d | g | rC| j r| j d k s| rCt
d | rC| j | j | | | | | | d n | r| j ra| j d k sv| rt
d | r| j | j | | | | | | d nh | rt
d | r| j | j | | | | | | d n( | j | j | | | | | | d t j d t | d | }
| j |
d d
d t d |
d d d g | d g | S( NRQ Rb s 0x%xR R R R R^ R\ R! s %ss mangle_%s_allowR
R R9 R# R7 R" s filter_%s_allowR R
s
new,untrackedR ( Ri RK R R R R R` R R R R RW R R R R) ( RD R R^ t filter_chainR R R' R& t mark_idR R t mark_strR% R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_forward_port_rules s@
2c C s< | t | k r t | | St t d | | j f d S( Ns" ICMP type '%s' not supported by %s( R R
R
t name( RD R t icmp_type( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _icmp_types_to_nft_fragment/ s c C s d } i d t 6d t 6| } | r9 | j r9 | j } n\ | j r g } d | j k rg | j d n d | j k r | j d q n d d g } g } x/| D]'} x d d g D]}
t j d t |
d | } | j j j
| rd
| | f } d }
n d | | f } d
}
g } | rl| | j | j 7} | | j
| j 7} | | j | j 7} n | | j | | j 7} | r8| j | j | | | | | | j | j | | | | | | j r | j | j | | | | | | q| j | d d d t d | | f g | d
g q | j j d k r|
d k r| j | d d d t | g | d d d d | | f g n | j | d d d t | g | |
g q Wq W| S( NR RQ Rb R7 R9 R R R R^ s %s_%s_allowR s
%s_%s_denys
%%REJECT%%R\ R! s %sR s %%LOGTYPE%%R R s "%s_%s_ICMP_BLOCK: "( Ri RK t ipvsR RW R R R R< R^ t query_icmp_block_inversionR R` R R R R0 R. R R R R R R ( RD R R^ t ictR Rc R R1 R R R R t final_chaint final_targetR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_icmp_block_rules6 sT
"" (2! -c C s d } g } xd d g D]} t j d t | d | } d j d d t d | | f d
d | | f g } | j | } | j j j | r d } n d
} | r d d d d t d | | f d | g }
n# d d d d t d | | f g }
|
d | g 7}
| j |
| j j j | r | j j
d k r| rpd d d d t d | | f d | g }
n# d d d d t d | | f g }
|
d d d d d | | f g 7}
| j |
qq q W| S( NR R R R R^ Rg R! s %ss %s_%sR s %s_%s_allows
%%REJECT%%R RQ R\ Rf Rb s %%ICMP%%R s %%LOGTYPE%%R R s "%s_%s_ICMP_BLOCK: "( R R R Rl R RA R< R^ R2 RW R ( RD R R^ Rc R R R Rx t rule_handlet
ibi_targetR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt% build_zone_icmp_block_inversion_rulesl s<
c C s g } | j d d d d t d d d d d
d d d
d d d g | d k r | j d d d d t d d d d d
d d d
d d d d d g n | j d d d d t d d d d d g | S( NRP R\ R! s %ss raw_%sR R R R9 t fibR t .t iift oift missingR R R R s "rpfilter_DROP: "R8 R% s) { nd-router-advert, nd-neighbor-solicit }R t raw_PREROUTINGR? R? ( RW R ( RD R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_rpfilter_rules s
c C s d } t j d t d d | } g } | | j | j 7} | | j | j 7} | | j | j 7} g } | j | j
| | | | | | j | j | | | | | | j | j | | | | | | | S( NR R R R^ (
R R R R R` R R R R RW R R R ( RD R R^ R Rc R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt( build_zone_rich_source_destination_rules s ""%c C s | d k r t St S( NR7 R9 t eb( s ipv4s ipv6RB ( Ri RK ( RD R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt is_ipv_supported s c C s; i d d 6d d 6} i | | g d 6| | d d g d 6| | d d | | g d
6| | d d | | g d 6| | d g d
6| | g d 6| | d d g d 6| | d d | | g d 6| | d d | | g d 6| | d g d 6d g d 6} y d g | | d g SWn$ t k
r6t t d | n Xd S( Nt ipv4_addrR7 t ipv6_addrR9 s hash:ips . inet_protos . inet_services hash:ip,ports . inet_service .s hash:ip,port,ips hash:ip,port,nets . marks hash:ip,marks hash:nets
hash:net,ports hash:net,port,ips hash:net,port,nets . ifnames hash:net,ifacet
ether_addrs hash:macR% R s! ipset type name '%s' is not valid( t KeyErrorR
R ( RD R R% t ipv_addrt types( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_type_fragment s(
c
C s) | r+ d | k r+ | d d k r+ d } n d } | d g } | | j | | 7} | r d | k r | d | d d d g 7} n d | k r | d
| d d g 7} q n | s d | k r d | k r | d d
d g 7} n | d g 7} x4 d d d g D]# } | j d d | t g | q Wd S( NR` t inet6R9 R7 R t timeoutR R t maxelemt sizet ,t flagst intervalR R! R" R# RQ R ( RJ R R ( RD R. R% t optionsR t cmdR` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_create s "
c C s: x3 d d d g D]" } | j d d | t | g q Wd S( NR! R" R# Rb R ( R R ( RD R. R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_destroy s c C s) | j j j | j d d j d } | j d } t | t | k rd t t d n g } x t t | D] } | | d k r y | | j d } Wn( t k
r | d d | | g 7} qX| | | | d | | | d g 7} n | j
| | | j
d q} W| d S( Nt :i RO s+ Number of values does not match ipset type.R R R; i( R< R t get_typet splitRZ R
R t rangeRR RT RW ( RD R. t entryt type_formatt entry_tokenst fragmentR] RR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_entry_fragment s +
*c C sT xM d d d g D]< } | j d d | t | d g | j | | d g q Wd S( NR! R" R# RQ t elementR R ( R R R^ ( RD R. RZ R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_add s c C sT xM d d d g D]< } | j d d | t | d g | j | | d g q Wd S( NR! R" R# Rb R_ R R ( R R R^ ( RD R. RZ R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_delete s c C s: x3 d d d g D]" } | j d d | t | g q Wd S( NR! R" R# t flushR ( R R ( RD R. R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_flush s c C sk | j j j | } | j d k r- d } n: | j ra d | j k ra | j d d k ra d } n d } | S( Ns hash:macR R` RK R# R" ( R< R t get_ipsetR% RR ( RD R. R R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR ! s N(7 t __name__t
__module__R. Ri t zones_supportedRF R? Ra R R R R R RU R R R R R R R RK R R R R R R R R R R R R R R R R! R" R) R- R0 R6 R9 R@ RA RC RJ RT RU R^ R` Ra Rc R ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR: sf - U
T
+ 9 @
"
!#! , 6 2 (% t os.pathRG Ro t firewall.core.baseR R t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R R R t firewallR t firewall.errorsR
R R R
R R t firewall.core.richR R R R R R R R R t objectR: ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <module> s (."