D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python2.7
/
site-packages
/
firewall
/
core
/
Filename :
ipXtables.pyo
back
Copy
� �c�`c @ s� d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z d d l Z i d d d g d 6d d g d 6d d d d d g d 6d d d g d 6d d d g d 6Z i d d 6d d 6Z i d d 6d d 6Z! d � Z" d � Z# d � Z$ d e% f d � � YZ& d e& f d � � YZ' d S( i����N( t SHORTCUTSt DEFAULT_ZONE_TARGET( t runProg( t log( t tempFilet readfilet splitArgst check_mact portStrt check_single_addresst check_addresst normalizeIP6( t config( t FirewallErrort INVALID_PASSTHROUGHt INVALID_RULE( t Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_Markt INPUTt OUTPUTt FORWARDt securityt PREROUTINGt rawt POSTROUTINGt manglet natt filters icmp-host-prohibitedt ipv4s icmp6-adm-prohibitedt ipv6t icmps ipv6-icmpc C s� i d d 6d d 6d d 6d d 6d d 6d d 6} | } x� | D]� } y | j | � } Wn t k rm q> n X| d k r� y t | | d � Wn t k r� q� X| j | d � n | | | | <q> W| S( s Inverse valid rule s -Ds -As --deletes --appends -Is --inserts -Xs -Ns --delete-chains --new-chaini ( s -Is --insert( t indext Exceptiont intt pop( t argst replace_argst ret_argst argt idx( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt common_reverse_rule7 s* c C s� i d d 6d d 6d d 6d d 6d d 6d d 6} | } x� | D]� } y | j | � } Wn t k rm q> n X| d k r� y t | | d � Wn t k r� q� X| j | d � n | | | | <| SWt t d � � d S( s Reverse valid passthough rule s -Ds -As --deletes --appends -Is --inserts -Xs -Ns --delete-chains --new-chaini s no '-A', '-I' or '-N' argN( s -Is --insert( R! t ValueErrorR# R$ R R ( R% R& R' t xR) ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt common_reverse_passthrough\ s. c C s� t | � } t d d d d d d d d d d d d d d d d d d d d g � } t | | @� d k r� t t d t | | @� d � � n t d d d d d d g � } t | | @� d k r� t t d � � n d S( sZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) s -Cs --checks -Ds --deletes -Rs --replaces -Ls --lists -Ss --list-ruless -Fs --flushs -Zs --zeros -Xs --delete-chains -Ps --policys -Es --rename-chaini s arg '%s' is not alloweds -As --appends -Is --inserts -Ns --new-chains no '-A', '-I' or '-N' argN( t sett lenR R t list( R% t not_allowedt needed( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt common_check_passthrough� s* t ip4tablesc B s� e Z d Z d Z e Z d � Z d � Z d � Z d. d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d. d � Z d � Z d � Z d � Z d � Z d � Z d � Z d d � Z d � Z e d � Z d � Z! d � Z" d � Z# d � Z$ d � Z% d! � Z& d" � Z' d# � Z( d. d. d$ � Z) d. d. d% � Z* d. d. d& � Z+ d' � Z, d. d( � Z- d. d) � Z. d. d* � Z/ d+ � Z0 d, � Z1 d- � Z2 RS(/ R R4 c C sz | | _ t j | j | _ t j d | j | _ | j � | _ | j � | _ | j � g | _ g | _ i | _ d S( Ns %s-restore( t _fwR t COMMANDSt ipvt _commandt _restore_commandt _detect_wait_optiont wait_optiont _detect_restore_wait_optiont restore_wait_optiont fill_existst available_tablest zone_source_index_cachet our_chains( t selft fw( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt __init__� s c C s4 t j j | j � | _ t j j | j � | _ d S( N( t ost patht existsR8 t command_existsR9 t restore_command_exists( RB ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR> � s c C s� | j rB | j | k rB | j g g | D] } d | ^ q( } n g | D] } d | ^ qI } t j d | j | j d j | � � t | j | � \ } } | d k r� t d | j d j | � | f � � n | S( Ns %ss %s: %s %st i s '%s %s' failed: %s( R; R t debug2t __class__R8 t joinR R+ ( RB R% t itemt _argst statust ret( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt __run� s * % c C s� | d k r | Sg } x� | D]� } t } x� | D]� } y | j | � } Wn t k r\ q0 Xt | � | k r0 d | | d k r0 t } | | d j d � } x3 | D]( } | } | | | d <| j | � q� Wq0 q0 W| s | j | � q q W| S( s5 Split values combined with commas for options in optst ,i N( t Nonet FalseR! R+ R/ t Truet splitt append( RB t rulest optst out_rulest rulet processedt optt it itemsRN t _rule( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt split_value� s( & c C sA y | j | � } Wn t k r' t SX| | | | d +t Sd S( Ni ( R! R+ RU RV ( RB R\ t patternt replacementR_ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rule_replace� s c C s | t k o | t | k S( N( t BUILT_IN_CHAINS( RB R7 t tablet chain( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt is_chain_builtin� s c C sC d | g } | r" | j d � n | j d � | j | � | g S( Ns -ts -Ns -X( RX ( RB t addRg Rh R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_chain_rules� s c C sL d | g } | r. | d | t | � g 7} n | d | g 7} | | 7} | S( Ns -ts -Is -D( t str( RB Rj Rg Rh R! R% R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_rule� s c C s t | � S( N( R* ( RB R% ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt reverse_rule s c C s t | � d S( N( R3 ( RB R% ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt check_passthrough s c C s t | � S( N( R- ( RB R% ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt reverse_passthrough s c C s� d } y | j d � } Wn t k r, n( Xt | � | d k rT | | d } n d } xn d d d d d d g D]T } y | j | � } Wn t k r� qs Xt | � | d k rs | | d } qs qs W| | f S( NR s -ti s -As --appends -Is --inserts -Ns --new-chain( R! R+ R/ RT ( RB R% Rg R_ Rh R^ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt passthrough_parse_table_chain s$ c C s� yb | j d � } | j | � | j | � } d | d k rQ | | d f } n | | d f } WnL t k r� y& | j d � } | j | � d } Wq� t k r� d SXn Xt } | d d k r� t } n | r� | r� | | k r�| j | � q�n� | r�| rI| | k r7| j | � | j d d � � n | j | � } n! | j j r^d } n t | � } d | d <| j d d | d � n d S( Ns %%ZONE_SOURCE%%s -mi i i s %%ZONE_INTERFACE%%i s -Ds --deletet keyc S s | d S( Ni ( ( R, ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt <lambda>@ s s -Ii s %di ( s -Ds --delete( R! R$ R+ RT RV RU t removeRX t sortR5 t _allow_zone_driftingR/ t insert( RB R\ R@ R_ t zonet zone_sourcet rule_addR! ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _run_replace_zone_source# s> c C s# t � } i } t j | j � } x�| D]�} | } | j | d d d t | j g � | j | d t | j g � y | j d � } Wn t k r� nL X| d k r� q( n | d& k r� d d d | g | | | d +n | j | � | j | | � d } xp d d g D]b } y | j | � } Wn t k r6q Xt | � | d k r | j | � | j | � } q q Wxz t t | � � D]f } x] t j D]R } | | | k r�| | j d � o�| | j d � r�d | | | | <q�q�Wq�W| j | g � j | � q( Wx� | D]� } | | } | j | d d g � } | j | d d g � } | j d | � x( | D] } | j d j | � d � qiW| j d � qW| j � t j | j � } t j d | j | j d | j | j f � g } | j r| j | j � n | j d � t! | j | d | j �\ } } t j" � d k r�t# | j � } | d k r�d } xc | D]X } t j% d | | f d! d d" d# �| j d � s�t j% d$ d! d �n | d 7} qpWq�n t j& | j � | d# k rt d% | j d j | � | f � � n | | _ | S(' Ns %%REJECT%%t REJECTs --reject-withs %%ICMP%%s %%LOGTYPE%%t offt unicastt broadcastt multicasts -mt pkttypes --pkt-typei R s -ts --tablet "s "%s"s -ss --sources -ds --destinations *%s RJ s s COMMIT s %s: %s %ss %s: %ds -nt stdini s %8d: %st nofmtt nli t s '%s %s' failed: %s( R~ R R� (' R t copyt deepcopyR@ Re t DEFAULT_REJECT_TYPER7 t ICMPR! R+ R$ R{ R/ t ranget stringt whitespacet startswitht endswitht setdefaultRX Rb t writeRM t closeRE t statt nameR RK RL R9 t st_sizeR= R t getDebugLogLevelR RT t debug3t unlink( RB RY t log_deniedt temp_filet table_rulesR@ Ra R\ R_ Rg R^ t cR� R% RP RQ t linest line( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt set_rulesL s� # # c C s� | j | d d d t | j g � | j | d t | j g � y | j d � } Wn t k rf nJ X| d k rw d S| d k r� d d d | g | | | d +n | j | � t j | j � } | j | | � | j | � } | | _ | S( Ns %%REJECT%%R| s --reject-withs %%ICMP%%s %%LOGTYPE%%R} R� R~ R R� s -mR� s --pkt-typei ( s unicasts broadcasts multicast( Re R� R7 R� R! R+ R$ R� R� R@ R{ t _ip4tables__run( RB R\ R� R_ R@ t output( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt set_rule� s" c C s� g } | r | g n t j � } x� | D]� } | | j k rM | j | � q( y: | j d | d d g � | j j | � | j | � Wq( t k r� t j d | j | f � q( Xq( W| S( Ns -ts -Ls -nsA %s table '%s' does not exist (or not enough permission to check).( Rf t keysR? RX R� R+ R t debug1R7 ( RB Rg RQ t tables( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt get_available_tables� s "c C s� d } t | j d d d g � } | d d k r� d } t | j d d d g � } | d d k rk d } n t j d | j | j | � n | S( NR� s -ws -Ls -ni s -w10s %s: %s will be using %s option.( R R8 R RK RL ( RB R; RQ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR: � s c C s� t � } | j d � | j � d } xl d d g D]^ } t | j | g d | j �} | d d k r3 d | d k r3 d | d k r3 | } Pq3 q3 Wt j d | j | j | � t j | j � | S( Ns #fooR� s -ws --wait=2R� i s invalid optioni s unrecognized options %s: %s will be using %s option.( R R� R� R R9 R� R RK RL RE R� ( RB R� R; t test_optionRQ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR< � s c C so g | _ g } xY t j � D]K } | j | � s7 q n x- d d d g D] } | j d | | g � qG Wq W| S( Ns -Fs -Xs -Zs -t( R@ Rf R� R� RX ( RB RY Rg t flag( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_flush_rules� s c C sy g } xl t j � D]^ } | j | � s. q n | d k r@ q n x. t | D]" } | j d | d | | g � qK Wq W| S( NR s -ts -P( Rf R� R� RX ( RB t policyRY Rg Rh ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_set_policy_rules s $c C s{ g } d } y1 | j d | j d k r- d n d d g � } WnG t k r� } | j d k rr t j d | � q� t j d | � n X| j � } t } x� | D]� } | r.| j � j � } | j � } xa | D]V } | j d � r| j d � r| d d !} n | } | | k r� | j | � q� q� Wn | j d k rL| j d � sj| j d k r� | j d � r� t } q� q� W| S( sQ Return ICMP types that are supported by the iptables/ip6tables command and kernelR� s -pR R s ipv6-icmps --helps iptables error: %ss ip6tables error: %st (t )i i����s Valid ICMP Types:R s Valid ICMPv6 Types:( R� R7 R+ R R� t splitlinesRU t stript lowerRW R� R� RX RV ( RB RQ R� t exR� t in_typesR� t splitsRW R, ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt supported_icmp_types s4 c C s g S( N( ( RB ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_default_tables/ s R} c C s> i } | j d � r� g | d <t � | j d <x] t d D]N } | d j d | � | d j d | | f � | j d j d | � q: Wn | j d � r�g | d <t � | j d <x� t d D]� } | d j d | � | d j d | | f � | j d j d | � | d k r� x� | j j r8d d g n d g D]f } | d j d | | f � | d j d | | | f � | j d j t d | | f g � � q?Wq� q� Wn | j d � r�g | d <t � | j d <x� t d D]� } | d j d | � | d j d | | f � | j d j d | � | d k r�x� | j j r\d d g n d g D]f } | d j d | | f � | d j d | | | f � | j d j t d | | f g � � qcWq�q�Wn | j d � r�g | d <t � | j d <x� t d D]� } | d j d | � | d j d | | f � | j d j d | � | d0 k r x� | j j r�d d g n d g D]f } | d j d | | f � | d j d | | | f � | j d j t d | | f g � � q�Wq q Wn g | d <t � | j d <| d j d � | d j d � | d j d � | d j d � | j d j t d � � xq | j j r�d d g n d g D]N } | d j d | � | d j d | � | j d j t d | � � q�W| d k r| d j d � n | d j d � | d k r8| d j d � n | d j d � | d j d � | d j d � | d j d � | d j d � | j d j t d! � � x� d" d# g D]� } x� | j j r�d d g n d g D]` } | d j d$ | | f � | d j d% | | f � | j d j t d& | | f � � q�Wq�W| d k rd| d j d' � n | d j d( � | d k r�| d j d) � n | d j d* � | d c d+ d, d- g 7<| j d j t d. � � g } xX | D]P } | | j � k rq�n x/ | | D]# } | j d/ | g t | � � qWq�W| S(1 NR s -N %s_directs -A %s -j %s_directs %s_directR R t ZONES_SOURCEt ZONESs -N %s_%ss -A %s -j %s_%ss %s_%sR R R R s= -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs -A INPUT -i lo -j ACCEPTs -N INPUT_directs -A INPUT -j INPUT_directt INPUT_directs -N INPUT_%ss -A INPUT -j INPUT_%ss INPUT_%sR} s^ -A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's/ -A INPUT -m conntrack --ctstate INVALID -j DROPs9 -A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's -A INPUT -j %%REJECT%%s? -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs -A FORWARD -i lo -j ACCEPTs -N FORWARD_directs -A FORWARD -j FORWARD_directt FORWARD_directt INt OUTs -N FORWARD_%s_%ss -A FORWARD -j FORWARD_%s_%ss FORWARD_%s_%ss` -A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's1 -A FORWARD -m conntrack --ctstate INVALID -j DROPs; -A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's -A FORWARD -j %%REJECT%%s -N OUTPUT_directs -A OUTPUT -o lo -j ACCEPTs -A OUTPUT -j OUTPUT_directt OUTPUT_directs -t( R R ( R� R. RA Rf RX Rj R5 Rv t updateR ( RB R� t default_rulesRh t dispatch_suffixt directiont final_default_rulesRg R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_default_rules3 s� ( 5 ( 5 ( 5 (" (, %c C s� | d k r d d d h S| d k rS d | j � k rS d | j � k rS d h Sn | d k r~ d | j � k r~ d d h Sn | d k r� d | j � k r� d h Sn i S( NR R t FORWARD_INt FORWARD_OUTR R R R R ( R� ( RB Rg ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt get_zone_table_chains� s c C s� i d d 6d d 6d d 6d d 6d d 6d d 6| } t j d t | d | � } d } | ry | ry d d | d g } n? | r� d d | g } n& d d | g } | s� | d g 7} n | d | | | | | g 7} | g S( Ns -iR s -oR R R� R� R Rh Rx s -gs -Is %s_ZONESs %%ZONE_INTERFACE%%s -As -Ds -t( R t formatR ( RB t enableRx t interfaceRg Rh RX R^ t targett actionR\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt! build_zone_source_interface_rules� s& c C s� i d t 6d t 6| } i d d 6d d 6d d 6d d 6d d 6d d 6| } | j j re d | } n d | } t j d t | d | � } d } | j d � r| d } | d k r� d } n d } d j | g | j j j | � � } | | d | d | d d d | | | | g } n� t | � ri| d k r6d S| | d | d | d d d | j � | | g } n t d | � r�t | � } n= t d | � r�| j d � } t | d � d | d } n | | d | d | | | | | g } | g S(! Ns -Is -Ds -sR s -dR R R� R� R s %s_ZONES_SOURCEs %s_ZONESRh Rx s -gs ipset:i t dstt srcRS s %%ZONE_SOURCE%%s -ts -mR. s --match-setR� t macs --mac-sourceR t /i i ( RV RU R5 Rv R R� R R� RM t ipsett get_dimensionR t upperR R R RW ( RB R� Rx t addressRg Rh t add_delR^ t zone_dispatch_chainR� R� R� t flagsR\ t addr_split( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_source_address_rules� sV % c C s6 t j d t | d | � } | j | j t | d | d | d | g � � g } | j d | d | g � | j d d | d | g � | j d d | d | g � | j d d | d | g � | j d | d | d d | g � | j d | d | d d | g � | j d | d | d d | g � | j j j | j } | j j � d k r�| d k r�| d k r�| d k r�| j d | d | d d d d d | g � n | d k r�| j d | d | d d d d d | g � q�q�n | d k r2| d k r2| d k r2| j d | d | d | g � n | S( NRh Rx s %s_logs %s_denys %s_allows -Ns -ts -As -jR} R R R� R� R R| s %%REJECT%%s %%LOGTYPE%%t LOGs --log-prefixs "%s_REJECT: "t DROPs "%s_DROP: "t ACCEPT( s INPUTs FORWARD_INs FORWARD_OUTs OUTPUT( s REJECTs %%REJECT%%( R� s REJECTs %%REJECT%%R� ( s INPUTs FORWARD_INs FORWARD_OUTs OUTPUT( R R� R RA R� R. RX R5 Rx t _zonesR� t get_log_denied( RB Rx Rg Rh t _zoneRY R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_chain_rules� s< ### "c C s | r d d d | j g Sg S( Ns -mt limits --limit( t value( RB R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rule_limit* s c C s� | j s g Si d t 6d t 6| } | d | d | g } | | d d g 7} | j j rx | d d | j j g 7} n | j j r� | d d | j j g 7} n | | j | j j � 7} | S( Ns -As -Ds %s_logs -ts -jR� s --log-prefixs '%s's --log-levels %s( R RV RU t prefixt levelR� R� ( RB t rich_ruleR� Rg R� t rule_fragmentR� R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_log/ s c C s� | j s g Si d t 6d t 6| } | d | d | g | } t | j � t k r] d } nB t | j � t k r{ d } n$ t | j � t k r� d } n d } | d d d | g 7} | | j | j j � 7} | S( Ns -As -Ds %s_logs -tt acceptt rejectt dropt unknowns -jt AUDITs --type( t auditRV RU t typeR� R R R R� R� ( RB R� R� Rg R� R� R� R\ t _type( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_audit? s c C s� | j s g Si d t 6d t 6| } t | j � t k rS d | } d d g } n� t | j � t k r� d | } d d g } | j j rL| d | j j g 7} qLn� t | j � t k r� d | } d d g } nx t | j � t k r0t j d t d d | � } d } d | } d d d | j j g } n t t d t | j � � � | | d | g } | | | 7} | | j | j j � 7} | S( Ns -As -Ds %s_allows -jR� s %s_denyR| s --reject-withR� Rh R Rx R t MARKs --set-xmarks Unknown action %ss -t( R� RV RU R� R R R R R R� R R. R R R� R� ( RB Rx R� R� Rg R� R� R� Rh t rule_actionR\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_actionS s4 c C s� | s g Sg } | j r) | j d � n t d | j � rW | d t | j � g 7} n` t d | j � r� | j j d � } | d t | d � d | d g 7} n | d | j g 7} | S( Nt !R s -dR� i i ( t invertRX R t addrR R RW ( RB t rich_destR� R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_destination_fragmentt s )c C s� | s g Sg } | j r� | j r2 | j d � n t d | j � r` | d t | j � g 7} q�t d | j � r� | j j d � } | d t | d � d | d g 7} q�| d | j g 7} n� t | d � r| j r| d d g 7} | j r| j d � n | d | j g 7} nu t | d � r�| j r�| d d g 7} | j r[| j d � n | j j j | j d � } | d | j | g 7} n | S( NR� R s -sR� i i R� s -ms --mac-sourceR� R. R� s --match-set( R� R� RX R R R RW t hasattrR� R� R5 Rx t _ipset_match_flags( RB t rich_sourceR� R� R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_source_fragment� s0 ) c C s� i d t 6d t 6| } d } t j d t d d | � } d | g } | ri | d d t | � g 7} n | r� | d | g 7} n | r� | | j | j � 7} | | j | j � 7} n | s� t | j � t k r� | d d d d g 7} n g } | rd| j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � n+ | j | d | d | g | d d g � | S( Ns -As -DR Rh R Rx s -ps --dports %ss -ds -mt conntracks --ctstates NEW,UNTRACKEDs %s_allows -ts -jR� ( RV RU R R� R R R� t destinationR� t sourceR� R� R RX R� R� R� ( RB R� Rx t protot portR� R� R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_ports_rules� s, ""(%c C sp i d t 6d t 6| } d } t j d t d d | � } d | g } | r_ | d | g 7} n | r� | | j | j � 7} | | j | j � 7} n | s� t | j � t k r� | d d d d g 7} n g } | rA| j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � n+ | j | d | d | g | d d g � | S( Ns -As -DR Rh R Rx s -ps -ds -mR� s --ctstates NEW,UNTRACKEDs %s_allows -ts -jR� ( RV RU R R� R R� R� R� R� R� R� R RX R� R� R� ( RB R� Rx t protocolR� R� R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_protocol_rules� s& ""(%c C s� i d t 6d t 6| } d } t j d t d d | � } d | g } | ri | d d t | � g 7} n | r� | d | g 7} n | r� | | j | j � 7} | | j | j � 7} n | s� t | j � t k r� | d d d d g 7} n g } | rd| j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � n+ | j | d | d | g | d d g � | S( Ns -As -DR Rh R Rx s -ps --sports %ss -ds -mR� s --ctstates NEW,UNTRACKEDs %s_allows -ts -jR� ( RV RU R R� R R R� R� R� R� R� R� R RX R� R� R� ( RB R� Rx R R R� R� R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_source_ports_rules� s* ""(%c C s� i d t 6d t 6| } t j d t d d | � } | d | d d d | g } | rs | d d t | � g 7} n | r� | d | g 7} n | d d d | g 7} | g S( Ns -As -DRh R Rx s %s_allows -tR s -ps --dports %ss -ds -jt CTs --helper( RV RU R R� R R ( RB R� Rx R R R� t helper_namet module_short_nameR� R� R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_helper_ports_rules� s c C s; i d t 6d t 6| } t j d t d d | � } g } | ro | | j | j � 7} | | j | j � 7} n g } | j | d | d d g | d d d d d g � t j d t d d | � } g } | r | | j | j � 7} | | j | j � 7} n | j | d | d d g | d d d d d d g � | S( Ns -As -DRh R Rx s %s_allows -tR R� s -ot los -jt MASQUERADER� R s -mR� s --ctstates NEW,UNTRACKEDR� ( RV RU R R� R R� R� R� R� RX ( RB R� Rx R� R� R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_masquerade_rules s* c C s� i d t 6d t 6| } d | } d d d | g } d } | rs t d | � rf | d t | � 7} qs | | 7} n | r� | d k r� | d t | d � 7} n t j d t d d | � } d | d t | � g } | r| | j | j � 7} | | j | j � 7} n g } | r9| j | j | | d | | � � n | j | d | d d g | d d d | g � | j | d | d d d | g | d d d | g � t j d t | d | � } | j | d | d d d d d d g | d d g � | S( Ns -As -Ds 0x%xs -mt marks --markR� R s [%s]s :%st -Rh R Rx s -ps --dportR s %s_allows -ts -jR� s --set-markR t DNATs --to-destinationR R� s --ctstates NEW,UNTRACKEDR� ( RV RU R R R R R� R R� R� R� R� RX R� ( RB R� Rx t filter_chainR R t toportt toaddrt mark_idR� R� t mark_strR t toR� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_forward_port_rules s< % 1c C sX d } i d t 6d t 6| } | j d k rQ d d g } d d d | j g } n! d d g } d d d | j g } g } x�d d g D]�} t j d t | d | � } | j j j | � r� d | } d } n d | } d } g } | r| | j | j � 7} | | j | j � 7} n | | | 7} | r�| j | j | | | | | � � | j | j | | | | | � � | j r�| j | j | | | | | | � � qP| j | d | d | g | d d g � q� | j j � d k r)| d k r)| j | | d | g | d d d d d | g � n | j | | d | g | d | g � q� W| S( NR s -As -DR s -pR s -ms --icmp-types ipv6-icmpt icmp6s --icmpv6-typeR R� Rh Rx s %s_allowR� s %s_denys %%REJECT%%s -ts -jR} s %%LOGTYPE%%R� s --log-prefixs "%s_ICMP_BLOCK: "( RV RU R7 R� R R� R R5 Rx t query_icmp_block_inversionR� R� R� R� RX R� R� R� R� R� ( RB R� Rx t ictR� Rg R� R t matchRY Rh R� t final_chaint final_targetR� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_icmp_block_rulesI sL "" (! c C sB d } g } x/d d g D]!} d } t j d t | d | � } | j j j | � r� d } | j j � d k r� | r� d | t | � g } n d | g } | d | d d d d d d d | g } | j | � | d 7} q� n d } | rd | t | � g } n d | g } | d | d d d | g } | j | � q W| S( NR R R� i Rh Rx s %%REJECT%%R} s -Is -Ds -ts -ps %%ICMP%%s %%LOGTYPE%%s -jR� s --log-prefixs "%s_ICMP_BLOCK: "i R� ( R R� R R5 Rx R R� Rl RX ( RB R� Rx Rg RY Rh t rule_idxR� t ibi_targetR\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt% build_zone_icmp_block_inversion_rulesz s2 c C s� d } t j d t d d | � } g } | | j | j � 7} | | j | j � 7} g } | j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � | S( NR Rh R Rx ( R R� R R� R� R� R� RX R� R� R� ( RB R� Rx R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt( build_zone_rich_source_destination_rules� s ""%c C s | | j k S( N( R7 ( RB R7 ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt is_ipv_supported� s N(3 t __name__t __module__R7 R� RV t zones_supportedRD R> R� RT Rb Re Ri Rk Rm Rn Ro Rp Rq R{ R� R� R� R: R< R� R� R� R� R� R� RU R� R� R� R� R� R� R� R� R� R R R R R R R R R! R" ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR4 � s\ ) ^ ! i 7 , ! , 1 # t ip6tablesc B s e Z d Z d Z e d � Z RS( R R& c C s� g } | j d d d d d d d d d g � | d k rk | j d d d d d d d d d d d g � n | j d d d d d d d d d g � | j d d d d d d d d d g � | S( Ns -IR s -tR s -mt rpfilters --inverts -jR� R} R� s --log-prefixs rpfilter_DROP: s -ps ipv6-icmps$ --icmpv6-type=neighbour-solicitationR� s" --icmpv6-type=router-advertisement( RX ( RB R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_rpfilter_rules� s" ( R# R$ R7 R� RU R( ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR& � s (( t os.pathRE R� t firewall.core.baseR R t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R R R R R R t firewallR t firewall.errorsR R R t firewall.core.richR R R R R� Rf R� R� R* R- R3 t objectR4 R& ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt <module> s< : " % * � � � �