SHELL BYPASS 403 |
Modern UI.
Responsive.
Powerful.
�
�c�`c @ s~ d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z d d l
m Z m Z m
Z
m Z m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z m Z d Z d
Z i i d d e f d
6d 6i d d e f d
6d 6i d d e f d
6d d e f d 6d 6i d d e f d 6d d e f d 6d 6Z i i d 6i d 6i d 6Z! i i" d d d! d d" d# g d$ 6d d d! g d! 6d d d% g d% 6d d d& g d& 6d d d! d d" d' g d( 6d d d! d d" d) g d* 6d d d! d d" d+ g d, 6d d d- d d" d. g d/ 6d d d! d d" d0 g d1 6d d d! d d" d. g d2 6d d d3 d d" d. g d4 6d d d! d d" d5 g d6 6d d d- d d" d7 g d8 6d d d! d d" d9 g d: 6d d d! d d" d7 g d; 6d d d3 g d3 6d d d! d d" d< g d= 6d d d! d d" d> g d? 6d d d! d d" d@ g dA 6d d d- g d- 6d d d3 d d" d. g dB 6d d dC g dC 6d d dD g dD 6d d dE g dE 6d d d! d d" dF g dG 6d d dH g dH 6d d dI g dI 6d d dJ g dJ 6d d d- d d" d< g dK 6d d d! d d" dL g dM 6d d d- d d" d@ g dN 6d d d! d d" dO g dP 6d d dH d d" d. g dQ 6d d dH d d" d7 g dR 6dS 6i dT d d! dT d" d< g dU 6dT d d3 dT d" d7 g dV 6dT d d! dT d" d@ g dW 6dT d d! dT d" d. g d$ 6dT d d! g d! 6dT d d% g d% 6dT d d& g d& 6dT d d! dT d" dF g dX 6dT d dY g dZ 6dT d d[ g d\ 6dT d d! dT d" d7 g d] 6dT d d^ g d^ 6dT d d3 g d3 6dT d d! dT d" d' g d= 6dT d d_ g d- 6dT d d! dT d" d9 g d` 6dT d da g dC 6dT d db g dD 6dT d dH g dH 6dT d dH dT d" d. g dQ 6dT d dH dT d" d7 g dR 6dT d d3 dT d" d. g dc 6dT d d3 dT d" d@ g dd 6de 6Z" df e# f dg � � YZ$ d S(h i����N( t SHORTCUTSt DEFAULT_ZONE_TARGET( t runProg( t log( t splitArgst check_mact portStrt check_single_addresst
check_address( t config( t
FirewallErrort
UNKNOWN_ERRORt INVALID_RULEt INVALID_ICMPTYPEt INVALID_TYPEt
INVALID_ENTRY( t Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_Markt firewalldi
t
preroutingi���t
PREROUTINGt rawij���t manglei����t postroutingid t POSTROUTINGt natt inputi t INPUTt forwardt FORWARDt filtert inett ipt ip6t icmpt types destination-unreachablet codet 13s communication-prohibiteds
echo-replys echo-requestt 4s fragmentation-neededt 14s host-precedence-violationt 10s host-prohibitedt redirectt 1s
host-redirectt 7s host-unknowns host-unreachables parameter-problems
ip-header-badt 8s network-prohibitedt 0s network-redirectt 6s network-unknowns network-unreachablet 3s port-unreachablet 15s precedence-cutofft 2s protocol-unreachables required-option-missings router-advertisements router-solicitations
source-quencht 5s source-route-faileds
time-exceededs timestamp-replys timestamp-requests tos-host-redirectt 12s tos-host-unreachables tos-network-redirectt 11s tos-network-unreachables ttl-zero-during-reassemblys ttl-zero-during-transitt ipv4t icmpv6s address-unreachables
bad-headers beyond-scopes
failed-policys nd-neighbor-adverts neighbour-advertisements nd-neighbor-solicits neighbour-solicitations no-routes packet-too-bigs nd-redirects reject-routes nd-router-adverts nd-router-solicits unknown-header-types unknown-optiont ipv6t nftablesc B s� e Z d Z e Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d � Z d3 d � Z d
� Z d � Z d � Z d
� Z d d � Z d � Z e d d � Z d d � Z d d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d3 d3 d � Z! d3 d3 d � Z" d3 d3 d � Z# d � Z$ d3 d! � Z% d3 d" � Z& d# � Z' d3 d$ � Z( d% � Z) d3 d& � Z* d' � Z+ e d( � Z, d) � Z- d* � Z. d+ � Z/ d3 d, � Z0 d- � Z1 d. � Z2 d/ � Z3 d0 � Z4 d1 � Z5 d2 � Z6 RS(4 R: c C sK | | _ t j d | _ | j � g | _ i | _ i | _ i | _ d S( Nt nft( t _fwR t COMMANDSt _commandt fill_existst available_tablest rule_to_handlet rule_ref_countt zone_source_index_cache( t selft fw( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __init__� s
c C s% t j j | j � | _ t | _ d S( N( t ost patht existsR> t command_existst Falset restore_command_exists( RD ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR? � s c C s� y? | j d � } | j | � | j | � } | | d f } WnL t k
r� y& | j d � } | j | � d } Wq� t k
r� d SXn X| d } | r� | r� | | k r�| | | k r�| | j | � q�n� | r�| | k r� g | | <n | rN| | | k r8| | j | � | | j d d � � n | | j | � } n% | j j rcd } n t | | � } | d k r�d | d <q�| d 8} d
| d <| j
| d � | j
| d d | � n d S(
Ns %%ZONE_SOURCE%%i s %%ZONE_INTERFACE%%i t keyc S s | d S( Ni ( ( t x( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <lambda>� s i t inserti t addt indexs %d( RR t popt
ValueErrort Nonet removet appendt sortR< t _allow_zone_driftingt lenRP ( RD t rule_addt ruleRC t it zonet zone_sourcet familyRR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _run_replace_zone_source� sD
c
C s� d d g } | } | d d k rs | d d k rs | } d | d <t | j | | � \ } } | d k rs d Sn d } | d d k r | d d k r t } | d } | d
d k r y t | d � Wn t k
r� t t d � � q X| j d
� | j d
� n d j | � } nB | d d k r_| d d k r_t
} | d } d j | � } n | | j k r7| r�| j | c d 7<d S| r�| j | d k r�| j | c d 8<d S| j | d k r�| j | c d 8<n t t d | | j | f � � t
j d | j | j | | j d j | � � n | ret j | j � } | j | | | � n | s�| r�| j | d k s�| r�| | j k r�| r�| r�d d g | d d !d | j | g } n d j | � }
t
j d | j | j |
� t | j | | � \ } } | d k rEt d | j |
| f � � n | rW| | _ n | r�| r�d } | j | � t | � } | | j � | j | <d | j | <q�| j | =| j | =q�n | S( Ns --echos --handlei t deletei t tablet listt RQ RP R\ i i t positioni s position without a numbert s) rule ref count bug: rule_key '%s', cnt %ds %s: rule ref cnt %d, %s %si t handles %s: %s %ss '%s %s' failed: %ss # handle ( s adds insert( Rb ( R R> RU t Truet intt ExceptionR
R RS t joinRK RB R R t debug2t __class__t copyt deepcopyRC Ra RA RT RR RZ t strip(
RD t argst nft_optst _argst
_args_testt statust outputt rule_keyR[ RC t _args_strt strt offset( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt __run� s|
#!
c C sA y | j | � } Wn t k
r' t SX| | | | d +t Sd S( Ni ( RR RT RK Ri ( RD R\ t patternt replacementR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
_rule_replace, s
c C s | } d | d <| S( NRb i ( ( RD Rr t ret_args( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt reverse_rule5 s
c C s t t d � � d S( Ns not implemented( R
R ( RD t rulest
log_denied( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_rules: s c C s d } d | k s* d | k s* d | k r3 d } n- d | k sW d | k sW d | k r` d } n | j | d d d
| d d g � | j | d
d d d g � y | j d � } Wn t k
r� nD X| d k r� d S| d k r� d | g | | | d +n
| j | � | j | � S( Nt icmpxR7 R" R$ R9 R# R8 s
%%REJECT%%t rejectt withR% s admin-prohibiteds %%ICMP%%t metat l4protos {icmp, icmpv6}s %%LOGTYPE%%t offRe t unicastt broadcastt multicastt pkttypei ( R� R� R� ( R RR RT RS t _nftables__run( RD R\ R� t icmp_keywordR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_ruleC s$ $ $
c C s | r
| g St j � S( N( t IPTABLES_TO_NFT_HOOKt keys( RD Rc ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_available_tablesb s c C sY i | _ i | _ i | _ g } x1 t j � D]# } | j d d | d t g � q. W| S( NRb Rc s %s( RA RB RC t
OUR_CHAINSR� RW t
TABLE_NAME( RD R� R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_flush_rulesf s !c C s� t d d } g } | d k r� | j d d d | g � x� d d g D]: } d | d
| | d t d f } | j t | � � qF Wn5 | d
k r� | j d d d | g � n
t t d � | S( Nt _t policy_dropt DROPRQ Rc R! R Rw sM add chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'R i���i t ACCEPTRb s not implemented( R� RW t NFT_HOOK_OFFSETR R
R ( RD t policyt
table_nameR� t hookt
_add_chain( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_set_policy_rulesp s
c C sA t � } x+ t j � D] } | j t | j � � q Wt | � S( N( t sett ICMP_TYPES_FRAGMENTR� t updateRd ( RD t supportedt ipv( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt supported_icmp_types� s c C sA g } x+ t j � D] } | j d | t f � q Wt t | � S( Ns add table %s %s( R� R� RW R� t mapR ( RD t default_tablesR` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_tables� s R� c
C s� g } t � t d d <x� t d j � D]� } | j d t | t d | d t d | d f � x� | j j r~ d d g n d g D]e } | j d t | | f � | j d t | | | f � t d d j t d
| | f g � � q� Wq( Wt � t d d <x� t d j � D]� } | j d t | t d | d t d | d f � x� | j j rjd d g n d g D]e } | j d
t | | f � | j d t | | | f � t d d j t d
| | f g � � qqWqWt � t d d <t � t d d <x� d d g D]� } x� t d j � D]� } | j d | t | t d | d t d | d f � x� | j j r}d d g n d g D]k } | j d | t | | f � | j d | t | | | f � t | d j t d
| | f g � � q�Wq$Wq
Wt � t d d <xM t d j � D]; } | j d t | t d | d t d | d f � q W| j d t d f � | j d t d f � x` | j j r�d d g n d g D]= } | j d t d | f � | j d t d d | f � q�W| d k r| j d t d f � n | j d t d f � | d k rP| j d t d f � n | j d t d f � | j d! t d" f � | j d t d" f � | j d t d" f � x} d# d$ g D]o } xf | j j r�d d g n d g D]C } | j d% t d" | | f � | j d& t d" d" | | f � q�Wq�W| d k rR| j d t d" f � n | j d t d" f � | d k r�| j d t d" f � n | j d t d" f � t d' d( d) d* d+ d, g � t d d <t t
| � S(- NR! R s@ add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'i i t ZONES_SOURCEt ZONESs add chain inet %s raw_%s_%ss& add rule inet %s raw_%s jump raw_%s_%ss %s_%sR sC add chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'s add chain inet %s mangle_%s_%ss, add rule inet %s mangle_%s jump mangle_%s_%sR" R R# s; add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'s add chain %s %s nat_%s_%ss$ add rule %s %s nat_%s jump nat_%s_%sR sC add chain inet %s filter_%s '{ type filter hook %s priority %d ; }'s> add rule inet %s filter_%s ct state established,related acceptR s, add rule inet %s filter_%s iifname lo accepts add chain inet %s filter_%s_%ss, add rule inet %s filter_%s jump filter_%s_%sR� s_ add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '"STATE_INVALID_DROP: "'s0 add rule inet %s filter_%s ct state invalid dropsH add rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '"FINAL_REJECT: "'sB add rule inet %s filter_%s reject with icmpx type admin-prohibiteds$ add chain inet %s filter_%s_IN_ZONESR t INt OUTs! add chain inet %s filter_%s_%s_%ss/ add rule inet %s filter_%s jump filter_%s_%s_%st INPUT_ZONES_SOURCEt INPUT_ZONESt FORWARD_IN_ZONES_SOURCEt FORWARD_IN_ZONESt FORWARD_OUT_ZONES_SOURCEt FORWARD_OUT_ZONES( R� R� R� R� RW R� R< RY R� R� R ( RD R� t
default_rulest chaint dispatch_suffixR` t direction( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_default_rules� s� ( 0 ( 0 ( 4 (! ( ( c C sY | d k r d d d g S| d k r, d g S| d k rB d d g S| d k rU d g Si S(
NR R t
FORWARD_INt FORWARD_OUTR R R R R ( ( RD Rc ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt get_zone_table_chains� s
R! c
C s� | d k rr | d k rr g } | j | j | | | | | | d � � | j | j | | | | | | d � � | Si d d 6d d 6d d 6d d
6d d 6d d 6| } | t | � d
d k r� | t | � d
d } n t j d t | d | � }
d } | r3| r3d d | d t d | | f d g } ne | r_d d | d t d | | f g } n9 d d | d t d | | f g } | s�| d g 7} n | d k r�| | d | |
f g 7} n( | | d | d | d | |
f g 7} | g S( NR R! R" R# t iifnameR t oifnameR R R� R� t OUTPUTi t +t *R� R^ t gotoRP R\ s %ss %s_%s_ZONESs %%ZONE_INTERFACE%%RQ Rb s %s_%ss "( t extendt! build_zone_source_interface_rulesRZ R t formatR R� (
RD t enableR^ t interfaceRc R� RW R` R� t optt targett actionR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� � s>
&# (c C sK | d k r� | d k r� g } | j d � rI | j | t d � � } n d } t d | � sv t | � sv | d k r� | j | j | | | | | d � � n t d | � s� t | � s� | d k r� | j | j | | | | | d � � n | Si d t 6d t 6| } i d
d 6d d
6d
d 6d
d 6d d 6d d 6| }
| j
j r\d | | f } n d | | f } t j
d t | d | � } d }
| j d � r�| t d � } | j | � } d | } nC t | � r�|
d k r�d Sd } n t d | � rd } n d } | d | d t | d | | |
| |
d | | f g } | g S( NR R! s ipset:R7 R" R9 R# RP Rb t saddrR t daddrR R R� R� R� s %s_%s_ZONES_SOURCEs %s_%s_ZONESR� R^ R� t @Re t etherR\ s %ss %%ZONE_SOURCE%%s %s_%s( t
startswitht _set_get_familyRZ RU R R R� t build_zone_source_address_rulesRi RK R< RY R R� R R� ( RD R� R^ t addressRc R� R` R� t ipset_familyt add_delR� t zone_dispatch_chainR� R� t ipsett rule_familyR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� $ sT ''
c C s. | d k r` | d k r` g } | j | j | | | d � � | j | j | | | d � � | St j d t | d | � } t | | j t | d | d | d | g � � g } | j d
d | d t d | | f g � | j d
d | d t d
| | f g � | j d
d | d t d | | f g � | j d
d | d t d | | f g � | j d
d | d t d | | f d d
| | f g � | j d
d | d t d | | f d d | | f g � | j d
d | d t d | | f d d | | f g � | j
j j | j
} | j
j � d k r�| d k r�| d k r�| d! k r�| } | d k rud } n | j d
d | d t d | | f d d d d | | f g � q�q�n | d k r*| d" k r*| d# k r*| j d
d | d t d | | f | d k r | j � n d g � n | S($ NR R! R" R# R� R^ s %s_logs %s_denys %s_allowRQ s %ss %s_%ss %s_%s_logs
%s_%s_denys %s_%s_allowR\ t jumpR� R R R� R� R� t REJECTs
%%REJECT%%R� s %%LOGTYPE%%R t prefixs "filter_%s_%s: "R� ( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R� s
%%REJECT%%s DROP( s ACCEPTR� s
%%REJECT%%s DROP( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R� t build_zone_chain_rulesR R� R R� R� R� RW R� R< R^ t _zonesR� t get_log_deniedt lower( RD R^ Rc R� R` R� t _zoneR� t
log_suffix( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� ^ s^
%c C s� i d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d
g d 6d d d d
g d 6d d
d d
g d 6d d
d d
g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d
d d g d 6d d d d g d 6d d d d g d 6d d d d g d 6d d
d d g d 6d d
d d g d 6d d
d d! g d" 6d d
d d! g d! 6d d# d$ g d% 6d d# d$ g d& 6} | | S(' NR� R$ R% s host-prohibiteds icmp-host-prohibiteds host-prohibs net-prohibiteds icmp-net-prohibiteds
net-prohibs admin-prohibiteds icmp-admin-prohibiteds admin-prohibR8 s icmp6-adm-prohibiteds adm-prohibiteds net-unreachables icmp-net-unreachables net-unreachs host-unreachables icmp-host-unreachables host-unreachs port-unreachables icmp-port-unreachables icmp6-port-unreachableR� s port-unreachs prot-unreachables icmp-proto-unreachables
proto-unreachs addr-unreachables icmp6-addr-unreachables addr-unreachs no-routes icmp6-no-routet tcpt resets tcp-resets tcp-rst( ( RD t reject_typet frags( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _reject_types_fragment� s2 c C s� | s
g Si d d 6d d 6d d 6d d 6} y | j j d � } Wn t k
rd t t d
� � n Xd d | j d
| !d | | j | d g S( Nt secondt st minutet mt hourt ht dayt dt /s Expected '/' in limitt limitt ratei i ( t valueRR RT R
R ( RD R� t rich_to_nftR] ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_limit_fragment� s
c C s� | j s
g Si d t 6d t 6| } | d d d t d | | f g } | | d g 7} | j j r� | d d | j j g 7} n | j j r� | d
d | j j g 7} n | | j | j j � 7} | S( NRQ Rb R\ R! s %ss %s_%s_logR R� s "%s"t level( R Ri RK R� R� R� R� R� ( RD t rich_ruleR� Rc R� t
rule_fragmentR� R\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_log� s c C s| | j s
g Si d t 6d t 6| } | d d d t d | | f g } | | d d d g 7} | | j | j j � 7} | S(
NRQ Rb R\ R! s %ss %s_%s_logR R� t audit( R� Ri RK R� R� R� ( RD R� R� Rc R� R� R� R\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_audit� s c C s� | j s
g Si d t 6d t 6| } t | j � t k rV d | | f } d g } nt | j � t k r� d | | f } d g } | j j r^| | j | j j � 7} q^n� t | j � t k r� d | | f } d g } n~ t | j � t k rBt j
d t d d
| � } d } d | | f } d d
d | j j g } n t
t d t | j � � � | d d d t | g }
|
| 7}
|
| j | j j � 7}
|
| 7}
|
S( NRQ Rb s %s_%s_allowt accepts
%s_%s_denyR� t dropR� R R^ R R� t markR� s Unknown action %sR\ R! s %s( R� Ri RK R% R R R� R R R R� R R� R
R R� R� R� ( RD R^ R� R� Rc R� R� R� R� t rule_actionR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_action� s6
c C sS | s
g S| d k r# d d d g S| d k r< d d d g St t d | � � d S( NR7 R� t nfprotoR9 s Invalid family( R
R ( RD t rich_family( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_family_fragment s
c C sx | s
g Sg } t d | j � r2 | d g 7} n
| d g 7} | j ra | d d | j g 7} n | d | j g 7} | S( NR7 R" R# R� s !=( R t addrt invert( RD t rich_destR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_destination_fragment s
c C sJ | s
g Sg } | j r� t d | j � r; | d g 7} n
| d g 7} | j rj | d d | j g 7} qF| d | j g 7} n� t | d � r� | j r� | j r� | d d d | j g 7} qF| d d | j g 7} np t | d � rF| j rF| j | j � } | j r)| | d d d | j g 7} qF| | d d | j g 7} n | S(
NR7 R" R# R� s !=t macR� R� R� ( R R R t hasattrR R� R� ( RD t rich_sourceR� R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _rich_rule_source_fragment, s(
c C s� i d t 6d t 6| } d } t j d t d d | � } g }
| r_ |
| j | j � 7}
n | r� t d | � r� |
d g 7}
n
|
d g 7}
|
d
| g 7}
n | r� |
| j | j � 7}
|
| j
| j � 7}
n |
| d d t | d
� g 7}
| st
| j � t k r+|
d d d g 7}
n g } | r�| j | j | | | | |
� � | j | j | | | | |
� � | j | j | | | | | |
� � n5 | j | d d d t d | | f g |
d g � | S( NRQ Rb R R� R R^ R7 R" R# R� t dports %st -t ctt states
new,untrackedR\ R! s %s_%s_allowR� ( Ri RK R R� R R R` R R t destinationR t sourceR R% R� R RW R� R� R� R� ( RD R� R^ t protot portR R� R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_ports_rulesI s2
""(/c C s� i d t 6d t 6| } d } t j d t d d | � } g } | r_ | | j | j � 7} n | r� t d | � r� | d g 7} n
| d g 7} | d
| g 7} n | r� | | j | j � 7} | | j | j � 7} | | j
| j � 7} n d d | g } | st | j
� t k r0| d
d d g 7} n g }
| r�|
j | j | | | | | � � |
j | j | | | | | � � |
j | j | | | | | | � � n/ |
j | d d d t d | g | d g � |
S( NRQ Rb R R� R R^ R7 R" R# R� R� R� R R
s
new,untrackedR\ R! s %ss filter_%s_allowR� ( Ri RK R R� R R R` R R R R R R% R� R RW R� R� R� R� ( RD R� R^ t protocolR R� R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_protocol_rulesj s4
""()c C s� i d t 6d t 6| } d } t j d t d d | � } g }
| r_ |
| j | j � 7}
n | r� t d | � r� |
d g 7}
n
|
d g 7}
|
d
| g 7}
n | r� |
| j | j � 7}
|
| j
| j � 7}
n |
| d d t | d
� g 7}
| st
| j � t k r+|
d d d g 7}
n g } | r�| j | j | | | | |
� � | j | j | | | | |
� � | j | j | | | | | |
� � n5 | j | d d d t d | | f g |
d g � | S( NRQ Rb R R� R R^ R7 R" R# R� t sports %sR R R
s
new,untrackedR\ R! s %s_%s_allowR� ( Ri RK R R� R R R` R R R R R R R% R� R RW R� R� R� R� ( RD R� R^ R R R R� R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_source_ports_rules� s2
""(/c C s i d t 6d t 6| } t j d t d d | � } | d d d t d | g }
| r� t d
| � rv |
d g 7}
n
|
d g 7}
|
d
| g 7}
n |
| d d t | d � g 7}
|
d d d d | | f g 7}
d d d t d | | f d d d | d | d d g } | |
g S( NRQ Rb R� R R^ R\ R! s %ss filter_%s_allowR7 R" R# R� R
R R t helperR� s "helper-%s-%s"s helper-%s-%st {R% s "%s"R t ;t }( Ri RK R R� R R� R R ( RD R� R^ R R R t helper_namet module_short_nameR� R� R\ t
helper_object( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_helper_ports_rules� s"
c C s� i d t 6d t 6| } t j d t d d | � } g } | ro | | j | j � 7} | | j | j � 7} n | d | d t d | g | d d
d d g g S(
NRQ Rb R� R R^ R\ s %ss nat_%s_allowR� s !=t lot
masquerade(
Ri RK R R� R R R R R R� ( RD R� R^ R` R� R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _build_zone_masquerade_nat_rules� s c C s� g } | rd | j r$ | j d k sB | j rd t d | j j � rd | j | j | | d | � � n} | r� | j r� | j d k s� | j r� t d | j j � r� | j | j | | d | � � n | j | j | | d | � � i d t 6d t 6| } t j d t
d d | � } g } | rP| | j | j � 7} | | j
| j � 7} n | j | d
d d t d
| g | d d d d g � | S( NR9 R# R7 R" RQ Rb R� R� R^ R\ R! s %ss filter_%s_allowR R
s
new,untrackedR� ( R` R R R R� R! Ri RK R R� R R R R RW R� ( RD R� R^ R� R� R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_masquerade_rules� s$ " " 2c C s� i d t 6d t 6| } t j d t d d | � } g }
| rV |
d d | g 7}
n |
d d g 7}
| r� | d k r� |
d
t | d � g 7}
n | d | d
t d | d d | g | |
g S( NRQ Rb R� R R^ t dnatt toR+ Re s :%sR R\ s %ss nat_%s_allowR� R� ( Ri RK R R� R R R� ( RD R� R^ R t
mark_fragmentt toaddrt toportR` R� R� t
dnat_fragment( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt" _build_zone_forward_port_nat_rules� s c
C sa i d t 6d t 6| }
d | } d d | g } t j d t d d | � }
g } | r� | | j | j � 7} | | j | j � 7} | | j | j
� 7} n g } | j |
d d
d t d |
g | | d
| d d d | g � | rC| j r| j d k s| rCt
d | � rC| j | j | | | | | | d � � n� | r�| j ra| j d k sv| r�t
d | � r�| j | j | | | | | | d � � nh | r�t
d | � r�| j | j | | | | | | d � � n( | j | j | | | | | | d � � t j d t | d | � }
| j |
d d
d t d |
d d d g | d g � | S( NRQ Rb s 0x%xR� R� R� R R^ R\ R! s %ss mangle_%s_allowR
R� R9 R# R7 R" s filter_%s_allowR R
s
new,untrackedR� ( Ri RK R R� R R R` R R R R RW R� R R� R) ( RD R� R^ t filter_chainR R R' R& t mark_idR� R� t mark_strR% R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_forward_port_rules s@
2c C s< | t | k r t | | St t d | | j f � � d S( Ns" ICMP type '%s' not supported by %s( R� R
R
t name( RD R� t icmp_type( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _icmp_types_to_nft_fragment/ s c C s� d } i d t 6d t 6| } | r9 | j r9 | j } n\ | j r� g } d | j k rg | j d � n d | j k r� | j d � q� n d d g } g } x/| D]'} x d d g D]}
t j d t |
d | � } | j j j
| � rd
| | f } d }
n d | | f } d
}
g } | rl| | j | j � 7} | | j
| j � 7} | | j | j � 7} n | | j | | j � 7} | r8| j | j | | | | | � � | j | j | | | | | � � | j r | j | j | | | | | | � � q�| j | d d d t d | | f g | d
g � q� | j j � d k r�|
d k r�| j | d d d t | g | d d d d | | f g � n | j | d d d t | g | |
g � q� Wq� W| S( NR RQ Rb R7 R9 R R� R� R^ s %s_%s_allowR� s
%s_%s_denys
%%REJECT%%R\ R! s %sR� s %%LOGTYPE%%R R� s "%s_%s_ICMP_BLOCK: "( Ri RK t ipvsR RW R R� R R< R^ t query_icmp_block_inversionR R` R R R R0 R. R� R� R� R� R� R� ( RD R� R^ t ictR� Rc R� R1 R� R� R� R� t final_chaint final_targetR� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_zone_icmp_block_rules6 sT
"" (2! -c C s� d } g } x�d d g D]�} t j d t | d | � } d j d d t d | | f d
d | | f g � } | j | } | j j j | � r� d } n d
} | r� d d d d t d | | f d | g }
n# d d d d t d | | f g }
|
d | g 7}
| j |
� | j j j | � r | j j
� d k r�| rpd d d d t d | | f d | g }
n# d d d d t d | | f g }
|
d d d d d | | f g 7}
| j |
� q�q q W| S( NR R R� R� R^ Rg R! s %ss %s_%sR� s %s_%s_allows
%%REJECT%%R� RQ R\ Rf Rb s %%ICMP%%R� s %%LOGTYPE%%R R� s "%s_%s_ICMP_BLOCK: "( R R� R Rl R� RA R< R^ R2 RW R� ( RD R� R^ Rc R� R� R� Rx t rule_handlet
ibi_targetR\ ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt% build_zone_icmp_block_inversion_rulesl s<
c C s� g } | j d d d d t d d d d d
d d d
d d d g � | d k r� | j d d d d t d d d d d
d d d
d d d d d g � n | j d d d d t d d d d d g � | S( NRP R\ R! s %ss raw_%sR R� R� R9 t fibR� t .t iift oift missingR� R� R R� s "rpfilter_DROP: "R8 R% s) { nd-router-advert, nd-neighbor-solicit }R� t raw_PREROUTINGR? R? ( RW R� ( RD R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt build_rpfilter_rules� s
c C s� d } t j d t d d | � } g } | | j | j � 7} | | j | j � 7} | | j | j � 7} g } | j | j
| | | | | � � | j | j | | | | | � � | j | j | | | | | | � � | S( NR R� R R^ (
R R� R R R` R R R R RW R� R� R� ( RD R� R^ R� Rc R� R� R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt( build_zone_rich_source_destination_rules� s ""%c C s | d k r t St S( NR7 R9 t eb( s ipv4s ipv6RB ( Ri RK ( RD R� ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt is_ipv_supported� s c C s; i d d 6d d 6} i | | g d 6| | d d g d 6| | d d | | g d
6| | d d | | g d 6| | d g d
6| | g d 6| | d d g d 6| | d d | | g d 6| | d d | | g d 6| | d g d 6d g d 6} y d g | | d g SWn$ t k
r6t t d | � � n Xd S( Nt ipv4_addrR7 t ipv6_addrR9 s hash:ips . inet_protos . inet_services hash:ip,ports . inet_service .s hash:ip,port,ips hash:ip,port,nets . marks hash:ip,marks hash:nets
hash:net,ports hash:net,port,ips hash:net,port,nets . ifnames hash:net,ifacet
ether_addrs hash:macR% R s! ipset type name '%s' is not valid( t KeyErrorR
R ( RD R� R% t ipv_addrt types( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_type_fragment� s(
c
C s) | r+ d | k r+ | d d k r+ d } n d } | d g } | | j | | � 7} | r� d | k r� | d | d d d g 7} n d | k r� | d
| d d g 7} q� n | s� d | k r� d | k r� | d d
d g 7} n | d g 7} x4 d d d g D]# } | j d d | t g | � q� Wd S( NR` t inet6R9 R7 R t timeoutR� R t maxelemt sizet ,t flagst intervalR R! R" R# RQ R� ( RJ R� R� ( RD R. R% t optionsR� t cmdR` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_create� s "
c C s: x3 d d d g D]" } | j d d | t | g � q Wd S( NR! R" R# Rb R� ( R� R� ( RD R. R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_destroy� s c C s) | j j j | � j d � d j d � } | j d � } t | � t | � k rd t t d � � n g } x� t t | � � D]� } | | d k r� y | | j d � } Wn( t k
r� | d d | | g 7} qX| | | | d | | | d g 7} n | j
| | � | j
d � q} W| d S( Nt :i RO s+ Number of values does not match ipset type.R R� R; i����( R< R� t get_typet splitRZ R
R t rangeRR RT RW ( RD R. t entryt type_formatt entry_tokenst fragmentR] RR ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _set_entry_fragment� s +
*c C sT xM d d d g D]< } | j d d | t | d g | j | | � d g � q Wd S( NR! R" R# RQ t elementR R ( R� R� R^ ( RD R. RZ R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_add s c C sT xM d d d g D]< } | j d d | t | d g | j | | � d g � q Wd S( NR! R" R# Rb R_ R R ( R� R� R^ ( RD R. RZ R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_delete s c C s: x3 d d d g D]" } | j d d | t | g � q Wd S( NR! R" R# t flushR� ( R� R� ( RD R. R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_flush s c C sk | j j j | � } | j d k r- d } n: | j ra d | j k ra | j d d k ra d } n d } | S( Ns hash:macR� R` RK R# R" ( R< R� t get_ipsetR% RR ( RD R. R� R` ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR� ! s N(7 t __name__t
__module__R. Ri t zones_supportedRF R? Ra R� R R� R� R� RU R� R� R� R� R� R� R� RK R� R� R� R� R� R� R� R� R R R R R R R R! R" R) R- R0 R6 R9 R@ RA RC RJ RT RU R^ R` Ra Rc R� ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyR: � sf - U
T
+ 9 @
"
!#! , 6 2 (% t os.pathRG Ro t firewall.core.baseR R t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R R R t firewallR t firewall.errorsR
R R R
R R t firewall.core.richR R R R R� R� R� R� R� t objectR: ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/nftables.pyt <module> s� (."