D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python2.7
/
site-packages
/
firewall
/
core
/
Filename :
nftables.pyc
back
Copy
� �c�`c @ s~ d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z d d l m Z m Z m Z m Z m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z m Z d Z d Z i i d d e f d 6d 6i d d e f d 6d 6i d d e f d 6d d e f d 6d 6i d d e f d 6d d e f d 6d 6Z i i d 6i d 6i d 6Z! i i" d d d! d d" d# g d$ 6d d d! g d! 6d d d% g d% 6d d d& g d& 6d d d! d d" d' g d( 6d d d! d d" d) g d* 6d d d! d d" d+ g d, 6d d d- d d" d. g d/ 6d d d! d d" d0 g d1 6d d d! d d" d. g d2 6d d d3 d d" d. g d4 6d d d! d d" d5 g d6 6d d d- d d" d7 g d8 6d d d! d d" d9 g d: 6d d d! d d" d7 g d; 6d d d3 g d3 6d d d! d d" d< g d= 6d d d! d d" d> g d? 6d d d! d d" d@ g dA 6d d d- g d- 6d d d3 d d" d. g dB 6d d dC g dC 6d d dD g dD 6d d dE g dE 6d d d! d d" dF g dG 6d d dH g dH 6d d dI g dI 6d d dJ g dJ 6d d d- d d" d< g dK 6d d d! d d" dL g dM 6d d d- d d" d@ g dN 6d d d! d d" dO g dP 6d d dH d d" d. g dQ 6d d dH d d" d7 g dR 6dS 6i dT d d! dT d" d< g dU 6dT d d3 dT d" d7 g dV 6dT d d! dT d" d@ g dW 6dT d d! dT d" d. g d$ 6dT d d! g d! 6dT d d% g d% 6dT d d& g d& 6dT d d! dT d" dF g dX 6dT d dY g dZ 6dT d d[ g d\ 6dT d d! dT d" d7 g d] 6dT d d^ g d^ 6dT d d3 g d3 6dT d d! dT d" d' g d= 6dT d d_ g d- 6dT d d! dT d" d9 g d` 6dT d da g dC 6dT d db g dD 6dT d dH g dH 6dT d dH dT d" d. g dQ 6dT d dH dT d" d7 g dR 6dT d d3 dT d" d. g dc 6dT d d3 dT d" d@ g dd 6de 6Z" df e# f dg � � YZ$ d S(h i����N( t SHORTCUTSt DEFAULT_ZONE_TARGET( t runProg( t log( t splitArgst check_mact portStrt check_single_addresst check_address( t config( t FirewallErrort UNKNOWN_ERRORt INVALID_RULEt INVALID_ICMPTYPEt INVALID_TYPEt INVALID_ENTRY( t Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_Markt firewalldi t preroutingi���t PREROUTINGt rawij���t manglei����t postroutingid t POSTROUTINGt natt inputi t INPUTt forwardt FORWARDt filtert inett ipt ip6t icmpt types destination-unreachablet codet 13s communication-prohibiteds echo-replys echo-requestt 4s fragmentation-neededt 14s host-precedence-violationt 10s host-prohibitedt redirectt 1s host-redirectt 7s host-unknowns host-unreachables parameter-problems ip-header-badt 8s network-prohibitedt 0s network-redirectt 6s network-unknowns network-unreachablet 3s port-unreachablet 15s precedence-cutofft 2s protocol-unreachables required-option-missings router-advertisements router-solicitations source-quencht 5s source-route-faileds time-exceededs timestamp-replys timestamp-requests tos-host-redirectt 12s tos-host-unreachables tos-network-redirectt 11s tos-network-unreachables ttl-zero-during-reassemblys ttl-zero-during-transitt ipv4t icmpv6s address-unreachables bad-headers beyond-scopes failed-policys nd-neighbor-adverts neighbour-advertisements nd-neighbor-solicits neighbour-solicitations no-routes packet-too-bigs nd-redirects reject-routes nd-router-adverts nd-router-solicits unknown-header-types unknown-optiont ipv6t nftablesc B s� e Z d Z e Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d3 d � Z d � Z d � Z d � Z d � Z d d � Z d � Z e d d � Z d d � Z d d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d3 d3 d � Z! d3 d3 d � Z" d3 d3 d � Z# d � Z$ d3 d! � Z% d3 d" � Z& d# � Z' d3 d$ � Z( d% � Z) d3 d& � Z* d' � Z+ e d( � Z, d) � Z- d* � Z. d+ � Z/ d3 d, � Z0 d- � Z1 d. � Z2 d/ � Z3 d0 � Z4 d1 � Z5 d2 � Z6 RS(4 R: c C sK | | _ t j d | _ | j � g | _ i | _ i | _ i | _ d S( Nt nft( t _fwR t COMMANDSt _commandt fill_existst available_tablest rule_to_handlet rule_ref_countt zone_source_index_cache( t selft fw( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __init__� s c C s% t j j | j � | _ t | _ d S( N( t ost patht existsR> t command_existst Falset restore_command_exists( RD ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR? � s c C s� y? | j d � } | j | � | j | � } | | d f } WnL t k r� y& | j d � } | j | � d } Wq� t k r� d SXn X| d } | r� | r� | | k r�| | | k r�| | j | � q�n� | r�| | k r� g | | <n | rN| | | k r8| | j | � | | j d d � � n | | j | � } n% | j j rcd } n t | | � } | d k r�d | d <q�| d 8} d | d <| j | d � | j | d d | � n d S( Ns %%ZONE_SOURCE%%i s %%ZONE_INTERFACE%%i t keyc S s | d S( Ni ( ( t x( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <lambda>� s i t inserti t addt indexs %d( RR t popt ValueErrort Nonet removet appendt sortR< t _allow_zone_driftingt lenRP ( RD t rule_addt ruleRC t it zonet zone_sourcet familyRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _run_replace_zone_source� sD c C s� d d g } | } | d d k rs | d d k rs | } d | d <t | j | | � \ } } | d k rs d Sn d } | d d k r | d d k r t } | d } | d d k r y t | d � Wn t k r� t t d � � q X| j d � | j d � n d j | � } nB | d d k r_| d d k r_t } | d } d j | � } n | | j k r7| r�| j | c d 7<d S| r�| j | d k r�| j | c d 8<d S| j | d k r�| j | c d 8<n t t d | | j | f � � t j d | j | j | | j d j | � � n | ret j | j � } | j | | | � n | s�| r�| j | d k s�| r�| | j k r�| r�| r�d d g | d d !d | j | g } n d j | � } t j d | j | j | � t | j | | � \ } } | d k rEt d | j | | f � � n | rW| | _ n | r�| r�d } | j | � t | � } | | j � | j | <d | j | <q�| j | =| j | =q�n | S( Ns --echos --handlei t deletei t tablet listt RQ RP R\ i i t positioni s position without a numbert s) rule ref count bug: rule_key '%s', cnt %ds %s: rule ref cnt %d, %s %si t handles %s: %s %ss '%s %s' failed: %ss # handle ( s adds insert( Rb ( R R> RU t Truet intt ExceptionR R RS t joinRK RB R R t debug2t __class__t copyt deepcopyRC Ra RA RT RR RZ t strip( RD t argst nft_optst _argst _args_testt statust outputt rule_keyR[ RC t _args_strt strt offset( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __run� s| #! c C sA y | j | � } Wn t k r' t SX| | | | d +t Sd S( Ni ( RR RT RK Ri ( RD R\ t patternt replacementR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rule_replace, s c C s | } d | d <| S( NRb i ( ( RD Rr t ret_args( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt reverse_rule5 s c C s t t d � � d S( Ns not implemented( R R ( RD t rulest log_denied( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_rules: s c C s d } d | k s* d | k s* d | k r3 d } n- d | k sW d | k sW d | k r` d } n | j | d d d | d d g � | j | d d d d g � y | j d � } Wn t k r� nD X| d k r� d S| d k r� d | g | | | d +n | j | � | j | � S( Nt icmpxR7 R" R$ R9 R# R8 s %%REJECT%%t rejectt withR% s admin-prohibiteds %%ICMP%%t metat l4protos {icmp, icmpv6}s %%LOGTYPE%%t offRe t unicastt broadcastt multicastt pkttypei ( R� R� R� ( R RR RT RS t _nftables__run( RD R\ R� t icmp_keywordR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_ruleC s$ $ $ c C s | r | g St j � S( N( t IPTABLES_TO_NFT_HOOKt keys( RD Rc ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_available_tablesb s c C sY i | _ i | _ i | _ g } x1 t j � D]# } | j d d | d t g � q. W| S( NRb Rc s %s( RA RB RC t OUR_CHAINSR� RW t TABLE_NAME( RD R� R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_flush_rulesf s !c C s� t d d } g } | d k r� | j d d d | g � x� d d g D]: } d | d | | d t d f } | j t | � � qF Wn5 | d k r� | j d d d | g � n t t d � | S( Nt _t policy_dropt DROPRQ Rc R! R Rw sM add chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'R i���i t ACCEPTRb s not implemented( R� RW t NFT_HOOK_OFFSETR R R ( RD t policyt table_nameR� t hookt _add_chain( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_set_policy_rulesp s c C sA t � } x+ t j � D] } | j t | j � � q Wt | � S( N( t sett ICMP_TYPES_FRAGMENTR� t updateRd ( RD t supportedt ipv( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt supported_icmp_types� s c C sA g } x+ t j � D] } | j d | t f � q Wt t | � S( Ns add table %s %s( R� R� RW R� t mapR ( RD t default_tablesR` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_tables� s R� c C s� g } t � t d d <x� t d j � D]� } | j d t | t d | d t d | d f � x� | j j r~ d d g n d g D]e } | j d t | | f � | j d t | | | f � t d d j t d | | f g � � q� Wq( Wt � t d d <x� t d j � D]� } | j d t | t d | d t d | d f � x� | j j rjd d g n d g D]e } | j d t | | f � | j d t | | | f � t d d j t d | | f g � � qqWqWt � t d d <t � t d d <x� d d g D]� } x� t d j � D]� } | j d | t | t d | d t d | d f � x� | j j r}d d g n d g D]k } | j d | t | | f � | j d | t | | | f � t | d j t d | | f g � � q�Wq$Wq Wt � t d d <xM t d j � D]; } | j d t | t d | d t d | d f � q W| j d t d f � | j d t d f � x` | j j r�d d g n d g D]= } | j d t d | f � | j d t d d | f � q�W| d k r| j d t d f � n | j d t d f � | d k rP| j d t d f � n | j d t d f � | j d! t d" f � | j d t d" f � | j d t d" f � x} d# d$ g D]o } xf | j j r�d d g n d g D]C } | j d% t d" | | f � | j d& t d" d" | | f � q�Wq�W| d k rR| j d t d" f � n | j d t d" f � | d k r�| j d t d" f � n | j d t d" f � t d' d( d) d* d+ d, g � t d d <t t | � S(- NR! R s@ add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'i i t ZONES_SOURCEt ZONESs add chain inet %s raw_%s_%ss& add rule inet %s raw_%s jump raw_%s_%ss %s_%sR sC add chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'s add chain inet %s mangle_%s_%ss, add rule inet %s mangle_%s jump mangle_%s_%sR" R R# s; add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'s add chain %s %s nat_%s_%ss$ add rule %s %s nat_%s jump nat_%s_%sR sC add chain inet %s filter_%s '{ type filter hook %s priority %d ; }'s> add rule inet %s filter_%s ct state established,related acceptR s, add rule inet %s filter_%s iifname lo accepts add chain inet %s filter_%s_%ss, add rule inet %s filter_%s jump filter_%s_%sR� s_ add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '"STATE_INVALID_DROP: "'s0 add rule inet %s filter_%s ct state invalid dropsH add rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '"FINAL_REJECT: "'sB add rule inet %s filter_%s reject with icmpx type admin-prohibiteds$ add chain inet %s filter_%s_IN_ZONESR t INt OUTs! add chain inet %s filter_%s_%s_%ss/ add rule inet %s filter_%s jump filter_%s_%s_%st INPUT_ZONES_SOURCEt INPUT_ZONESt FORWARD_IN_ZONES_SOURCEt FORWARD_IN_ZONESt FORWARD_OUT_ZONES_SOURCEt FORWARD_OUT_ZONES( R� R� R� R� RW R� R< RY R� R� R ( RD R� t default_rulest chaint dispatch_suffixR` t direction( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_rules� s� ( 0 ( 0 ( 4 (! ( ( c C sY | d k r d d d g S| d k r, d g S| d k rB d d g S| d k rU d g Si S( NR R t FORWARD_INt FORWARD_OUTR R R R R ( ( RD Rc ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_zone_table_chains� s R! c C s� | d k rr | d k rr g } | j | j | | | | | | d � � | j | j | | | | | | d � � | Si d d 6d d 6d d 6d d 6d d 6d d 6| } | t | � d d k r� | t | � d d } n t j d t | d | � } d } | r3| r3d d | d t d | | f d g } ne | r_d d | d t d | | f g } n9 d d | d t d | | f g } | s�| d g 7} n | d k r�| | d | | f g 7} n( | | d | d | d | | f g 7} | g S( NR R! R" R# t iifnameR t oifnameR R R� R� t OUTPUTi t +t *R� R^ t gotoRP R\ s %ss %s_%s_ZONESs %%ZONE_INTERFACE%%RQ Rb s %s_%ss "( t extendt! build_zone_source_interface_rulesRZ R t formatR R� ( RD t enableR^ t interfaceRc R� RW R` R� t optt targett actionR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� � s> &# (c C sK | d k r� | d k r� g } | j d � rI | j | t d � � } n d } t d | � sv t | � sv | d k r� | j | j | | | | | d � � n t d | � s� t | � s� | d k r� | j | j | | | | | d � � n | Si d t 6d t 6| } i d d 6d d 6d d 6d d 6d d 6d d 6| } | j j r\d | | f } n d | | f } t j d t | d | � } d } | j d � r�| t d � } | j | � } d | } nC t | � r�| d k r�d Sd } n t d | � rd } n d } | d | d t | d | | | | | d | | f g } | g S( NR R! s ipset:R7 R" R9 R# RP Rb t saddrR t daddrR R R� R� R� s %s_%s_ZONES_SOURCEs %s_%s_ZONESR� R^ R� t @Re t etherR\ s %ss %%ZONE_SOURCE%%s %s_%s( t startswitht _set_get_familyRZ RU R R R� t build_zone_source_address_rulesRi RK R< RY R R� R R� ( RD R� R^ t addressRc R� R` R� t ipset_familyt add_delR� t zone_dispatch_chainR� R� t ipsett rule_familyR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� $ sT '' c C s. | d k r` | d k r` g } | j | j | | | d � � | j | j | | | d � � | St j d t | d | � } t | | j t | d | d | d | g � � g } | j d d | d t d | | f g � | j d d | d t d | | f g � | j d d | d t d | | f g � | j d d | d t d | | f g � | j d d | d t d | | f d d | | f g � | j d d | d t d | | f d d | | f g � | j d d | d t d | | f d d | | f g � | j j j | j } | j j � d k r�| d k r�| d k r�| d! k r�| } | d k rud } n | j d d | d t d | | f d d d d | | f g � q�q�n | d k r*| d" k r*| d# k r*| j d d | d t d | | f | d k r | j � n d g � n | S($ NR R! R" R# R� R^ s %s_logs %s_denys %s_allowRQ s %ss %s_%ss %s_%s_logs %s_%s_denys %s_%s_allowR\ t jumpR� R R R� R� R� t REJECTs %%REJECT%%R� s %%LOGTYPE%%R t prefixs "filter_%s_%s: "R� ( s INPUTs FORWARD_INs FORWARD_OUTs OUTPUT( R� s %%REJECT%%s DROP( s ACCEPTR� s %%REJECT%%s DROP( s INPUTs FORWARD_INs FORWARD_OUTs OUTPUT( R� t build_zone_chain_rulesR R� R R� R� R� RW R� R< R^ t _zonesR� t get_log_deniedt lower( RD R^ Rc R� R` R� t _zoneR� t log_suffix( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� ^ s^ %c C s� i d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d! g d" 6d d d d! g d! 6d d# d$ g d% 6d d# d$ g d& 6} | | S(' NR� R$ R% s host-prohibiteds icmp-host-prohibiteds host-prohibs net-prohibiteds icmp-net-prohibiteds net-prohibs admin-prohibiteds icmp-admin-prohibiteds admin-prohibR8 s icmp6-adm-prohibiteds adm-prohibiteds net-unreachables icmp-net-unreachables net-unreachs host-unreachables icmp-host-unreachables host-unreachs port-unreachables icmp-port-unreachables icmp6-port-unreachableR� s port-unreachs prot-unreachables icmp-proto-unreachables proto-unreachs addr-unreachables icmp6-addr-unreachables addr-unreachs no-routes icmp6-no-routet tcpt resets tcp-resets tcp-rst( ( RD t reject_typet frags( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _reject_types_fragment� s2 c C s� | s g Si d d 6d d 6d d 6d d 6} y | j j d � } Wn t k rd t t d � � n Xd d | j d | !d | | j | d g S( Nt secondt st minutet mt hourt ht dayt dt /s Expected '/' in limitt limitt ratei i ( t valueRR RT R R ( RD R� t rich_to_nftR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_limit_fragment� s c C s� | j s g Si d t 6d t 6| } | d d d t d | | f g } | | d g 7} | j j r� | d d | j j g 7} n | j j r� | d d | j j g 7} n | | j | j j � 7} | S( NRQ Rb R\ R! s %ss %s_%s_logR R� s "%s"t level( R Ri RK R� R� R� R� R� ( RD t rich_ruleR� Rc R� t rule_fragmentR� R\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_log� s c C s| | j s g Si d t 6d t 6| } | d d d t d | | f g } | | d d d g 7} | | j | j j � 7} | S( NRQ Rb R\ R! s %ss %s_%s_logR R� t audit( R� Ri RK R� R� R� ( RD R� R� Rc R� R� R� R\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_audit� s c C s� | j s g Si d t 6d t 6| } t | j � t k rV d | | f } d g } nt | j � t k r� d | | f } d g } | j j r^| | j | j j � 7} q^n� t | j � t k r� d | | f } d g } n~ t | j � t k rBt j d t d d | � } d } d | | f } d d d | j j g } n t t d t | j � � � | d d d t | g } | | 7} | | j | j j � 7} | | 7} | S( NRQ Rb s %s_%s_allowt accepts %s_%s_denyR� t dropR� R R^ R R� t markR� s Unknown action %sR\ R! s %s( R� Ri RK R% R R R� R R R R� R R� R R R� R� R� ( RD R^ R� R� Rc R� R� R� R� t rule_actionR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_action� s6 c C sS | s g S| d k r# d d d g S| d k r< d d d g St t d | � � d S( NR7 R� t nfprotoR9 s Invalid family( R R ( RD t rich_family( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_family_fragment s c C sx | s g Sg } t d | j � r2 | d g 7} n | d g 7} | j ra | d d | j g 7} n | d | j g 7} | S( NR7 R" R# R� s !=( R t addrt invert( RD t rich_destR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_destination_fragment s c C sJ | s g Sg } | j r� t d | j � r; | d g 7} n | d g 7} | j rj | d d | j g 7} qF| d | j g 7} n� t | d � r� | j r� | j r� | d d d | j g 7} qF| d d | j g 7} np t | d � rF| j rF| j | j � } | j r)| | d d d | j g 7} qF| | d d | j g 7} n | S( NR7 R" R# R� s !=t macR� R� R� ( R R R t hasattrR R� R� ( RD t rich_sourceR� R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_source_fragment, s( c C s� i d t 6d t 6| } d } t j d t d d | � } g } | r_ | | j | j � 7} n | r� t d | � r� | d g 7} n | d g 7} | d | g 7} n | r� | | j | j � 7} | | j | j � 7} n | | d d t | d � g 7} | st | j � t k r+| d d d g 7} n g } | r�| j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � n5 | j | d d d t d | | f g | d g � | S( NRQ Rb R R� R R^ R7 R" R# R� t dports %st -t ctt states new,untrackedR\ R! s %s_%s_allowR� ( Ri RK R R� R R R` R R t destinationR t sourceR R% R� R RW R� R� R� R� ( RD R� R^ t protot portR R� R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_ports_rulesI s2 ""(/c C s� i d t 6d t 6| } d } t j d t d d | � } g } | r_ | | j | j � 7} n | r� t d | � r� | d g 7} n | d g 7} | d | g 7} n | r� | | j | j � 7} | | j | j � 7} | | j | j � 7} n d d | g } | st | j � t k r0| d d d g 7} n g } | r�| j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � n/ | j | d d d t d | g | d g � | S( NRQ Rb R R� R R^ R7 R" R# R� R� R� R R s new,untrackedR\ R! s %ss filter_%s_allowR� ( Ri RK R R� R R R` R R R R R R% R� R RW R� R� R� R� ( RD R� R^ t protocolR R� R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_protocol_rulesj s4 ""()c C s� i d t 6d t 6| } d } t j d t d d | � } g } | r_ | | j | j � 7} n | r� t d | � r� | d g 7} n | d g 7} | d | g 7} n | r� | | j | j � 7} | | j | j � 7} n | | d d t | d � g 7} | st | j � t k r+| d d d g 7} n g } | r�| j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � n5 | j | d d d t d | | f g | d g � | S( NRQ Rb R R� R R^ R7 R" R# R� t sports %sR R R s new,untrackedR\ R! s %s_%s_allowR� ( Ri RK R R� R R R` R R R R R R R% R� R RW R� R� R� R� ( RD R� R^ R R R R� R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_source_ports_rules� s2 ""(/c C s i d t 6d t 6| } t j d t d d | � } | d d d t d | g } | r� t d | � rv | d g 7} n | d g 7} | d | g 7} n | | d d t | d � g 7} | d d d d | | f g 7} d d d t d | | f d d d | d | d d g } | | g S( NRQ Rb R� R R^ R\ R! s %ss filter_%s_allowR7 R" R# R� R R R t helperR� s "helper-%s-%s"s helper-%s-%st {R% s "%s"R t ;t }( Ri RK R R� R R� R R ( RD R� R^ R R R t helper_namet module_short_nameR� R� R\ t helper_object( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_helper_ports_rules� s" c C s� i d t 6d t 6| } t j d t d d | � } g } | ro | | j | j � 7} | | j | j � 7} n | d | d t d | g | d d d d g g S( NRQ Rb R� R R^ R\ s %ss nat_%s_allowR� s !=t lot masquerade( Ri RK R R� R R R R R R� ( RD R� R^ R` R� R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _build_zone_masquerade_nat_rules� s c C s� g } | rd | j r$ | j d k sB | j rd t d | j j � rd | j | j | | d | � � n} | r� | j r� | j d k s� | j r� t d | j j � r� | j | j | | d | � � n | j | j | | d | � � i d t 6d t 6| } t j d t d d | � } g } | rP| | j | j � 7} | | j | j � 7} n | j | d d d t d | g | d d d d g � | S( NR9 R# R7 R" RQ Rb R� R� R^ R\ R! s %ss filter_%s_allowR R s new,untrackedR� ( R` R R R R� R! Ri RK R R� R R R R RW R� ( RD R� R^ R� R� R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_masquerade_rules� s$ " " 2c C s� i d t 6d t 6| } t j d t d d | � } g } | rV | d d | g 7} n | d d g 7} | r� | d k r� | d t | d � g 7} n | d | d t d | d d | g | | g S( NRQ Rb R� R R^ t dnatt toR+ Re s :%sR R\ s %ss nat_%s_allowR� R� ( Ri RK R R� R R R� ( RD R� R^ R t mark_fragmentt toaddrt toportR` R� R� t dnat_fragment( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt" _build_zone_forward_port_nat_rules� s c C sa i d t 6d t 6| } d | } d d | g } t j d t d d | � } g } | r� | | j | j � 7} | | j | j � 7} | | j | j � 7} n g } | j | d d d t d | g | | d | d d d | g � | rC| j r| j d k s| rCt d | � rC| j | j | | | | | | d � � n� | r�| j ra| j d k sv| r�t d | � r�| j | j | | | | | | d � � nh | r�t d | � r�| j | j | | | | | | d � � n( | j | j | | | | | | d � � t j d t | d | � } | j | d d d t d | d d d g | d g � | S( NRQ Rb s 0x%xR� R� R� R R^ R\ R! s %ss mangle_%s_allowR R� R9 R# R7 R" s filter_%s_allowR R s new,untrackedR� ( Ri RK R R� R R R` R R R R RW R� R R� R) ( RD R� R^ t filter_chainR R R' R& t mark_idR� R� t mark_strR% R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_forward_port_rules s@ 2c C s< | t | k r t | | St t d | | j f � � d S( Ns" ICMP type '%s' not supported by %s( R� R R t name( RD R� t icmp_type( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _icmp_types_to_nft_fragment/ s c C s� d } i d t 6d t 6| } | r9 | j r9 | j } n\ | j r� g } d | j k rg | j d � n d | j k r� | j d � q� n d d g } g } x/| D]'} x d d g D]} t j d t | d | � } | j j j | � rd | | f } d } n d | | f } d } g } | rl| | j | j � 7} | | j | j � 7} | | j | j � 7} n | | j | | j � 7} | r8| j | j | | | | | � � | j | j | | | | | � � | j r | j | j | | | | | | � � q�| j | d d d t d | | f g | d g � q� | j j � d k r�| d k r�| j | d d d t | g | d d d d | | f g � n | j | d d d t | g | | g � q� Wq� W| S( NR RQ Rb R7 R9 R R� R� R^ s %s_%s_allowR� s %s_%s_denys %%REJECT%%R\ R! s %sR� s %%LOGTYPE%%R R� s "%s_%s_ICMP_BLOCK: "( Ri RK t ipvsR RW R R� R R< R^ t query_icmp_block_inversionR R` R R R R0 R. R� R� R� R� R� R� ( RD R� R^ t ictR� Rc R� R1 R� R� R� R� t final_chaint final_targetR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_icmp_block_rules6 sT "" (2! -c C s� d } g } x�d d g D]�} t j d t | d | � } d j d d t d | | f d d | | f g � } | j | } | j j j | � r� d } n d } | r� d d d d t d | | f d | g } n# d d d d t d | | f g } | d | g 7} | j | � | j j j | � r | j j � d k r�| rpd d d d t d | | f d | g } n# d d d d t d | | f g } | d d d d d | | f g 7} | j | � q�q q W| S( NR R R� R� R^ Rg R! s %ss %s_%sR� s %s_%s_allows %%REJECT%%R� RQ R\ Rf Rb s %%ICMP%%R� s %%LOGTYPE%%R R� s "%s_%s_ICMP_BLOCK: "( R R� R Rl R� RA R< R^ R2 RW R� ( RD R� R^ Rc R� R� R� Rx t rule_handlet ibi_targetR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt% build_zone_icmp_block_inversion_rulesl s< c C s� g } | j d d d d t d d d d d d d d d d d g � | d k r� | j d d d d t d d d d d d d d d d d d d g � n | j d d d d t d d d d d g � | S( NRP R\ R! s %ss raw_%sR R� R� R9 t fibR� t .t iift oift missingR� R� R R� s "rpfilter_DROP: "R8 R% s) { nd-router-advert, nd-neighbor-solicit }R� t raw_PREROUTINGR? R? ( RW R� ( RD R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_rpfilter_rules� s c C s� d } t j d t d d | � } g } | | j | j � 7} | | j | j � 7} | | j | j � 7} g } | j | j | | | | | � � | j | j | | | | | � � | j | j | | | | | | � � | S( NR R� R R^ ( R R� R R R` R R R R RW R� R� R� ( RD R� R^ R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt( build_zone_rich_source_destination_rules� s ""%c C s | d k r t St S( NR7 R9 t eb( s ipv4s ipv6RB ( Ri RK ( RD R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt is_ipv_supported� s c C s; i d d 6d d 6} i | | g d 6| | d d g d 6| | d d | | g d 6| | d d | | g d 6| | d g d 6| | g d 6| | d d g d 6| | d d | | g d 6| | d d | | g d 6| | d g d 6d g d 6} y d g | | d g SWn$ t k r6t t d | � � n Xd S( Nt ipv4_addrR7 t ipv6_addrR9 s hash:ips . inet_protos . inet_services hash:ip,ports . inet_service .s hash:ip,port,ips hash:ip,port,nets . marks hash:ip,marks hash:nets hash:net,ports hash:net,port,ips hash:net,port,nets . ifnames hash:net,ifacet ether_addrs hash:macR% R s! ipset type name '%s' is not valid( t KeyErrorR R ( RD R� R% t ipv_addrt types( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_type_fragment� s( c C s) | r+ d | k r+ | d d k r+ d } n d } | d g } | | j | | � 7} | r� d | k r� | d | d d d g 7} n d | k r� | d | d d g 7} q� n | s� d | k r� d | k r� | d d d g 7} n | d g 7} x4 d d d g D]# } | j d d | t g | � q� Wd S( NR` t inet6R9 R7 R t timeoutR� R t maxelemt sizet ,t flagst intervalR R! R" R# RQ R� ( RJ R� R� ( RD R. R% t optionsR� t cmdR` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_create� s " c C s: x3 d d d g D]" } | j d d | t | g � q Wd S( NR! R" R# Rb R� ( R� R� ( RD R. R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_destroy� s c C s) | j j j | � j d � d j d � } | j d � } t | � t | � k rd t t d � � n g } x� t t | � � D]� } | | d k r� y | | j d � } Wn( t k r� | d d | | g 7} qX| | | | d | | | d g 7} n | j | | � | j d � q} W| d S( Nt :i RO s+ Number of values does not match ipset type.R R� R; i����( R< R� t get_typet splitRZ R R t rangeRR RT RW ( RD R. t entryt type_formatt entry_tokenst fragmentR] RR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_entry_fragment� s + *c C sT xM d d d g D]< } | j d d | t | d g | j | | � d g � q Wd S( NR! R" R# RQ t elementR R ( R� R� R^ ( RD R. RZ R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_add s c C sT xM d d d g D]< } | j d d | t | d g | j | | � d g � q Wd S( NR! R" R# Rb R_ R R ( R� R� R^ ( RD R. RZ R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_delete s c C s: x3 d d d g D]" } | j d d | t | g � q Wd S( NR! R" R# t flushR� ( R� R� ( RD R. R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_flush s c C sk | j j j | � } | j d k r- d } n: | j ra d | j k ra | j d d k ra d } n d } | S( Ns hash:macR� R` RK R# R" ( R< R� t get_ipsetR% RR ( RD R. R� R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� ! s N(7 t __name__t __module__R. Ri t zones_supportedRF R? Ra R� R R� R� R� RU R� R� R� R� R� R� R� RK R� R� R� R� R� R� R� R� R R R R R R R R! R" R) R- R0 R6 R9 R@ RA RC RJ RT RU R^ R` Ra Rc R� ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR: � sf - U T + 9 @ " !#! , 6 2 (% t os.pathRG Ro t firewall.core.baseR R t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R R R t firewallR t firewall.errorsR R R R R R t firewall.core.richR R R R R� R� R� R� R� t objectR: ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <module> s� (."