Mini Shell

�
�c�`c@s�
dd
lZ
dd
lZddlmZmZ
ddlmZ
ddlm	Z	
ddl
mZmZm
Z
mZmZmZmZmZ
ddlmZ
ddlmZmZmZ
ddlmZmZmZmZ
dd
lZid	d
dgd6d
d
gd6d
dd	d
dgd6d
dd
gd6d	d
dgd6Zidd6dd6Z idd6dd6Z!d�Z"d�Z#d�Z$de%f
d��YZ&de&f
d��YZ'd
S( i����N(t	SHORTCUTStDEFAULT_ZONE_TARGET(
trunProg(
tlog(ttempFiletreadfilet	splitArgst	check_mactportStrtcheck_single_addresst
check_addresstnormalizeIP6(
tconfig(t
FirewallErrortINVALID_PASSTHROUGHtINVALID_RULE(tRich_AccepttRich_Rejectt	Rich_Dropt	Rich_MarktINPUTtOUTPUTtFORWARDtsecurityt
PREROUTINGtrawtPOSTROUTINGtmangletnattfiltersicmp-host-prohibitedtipv4sicmp6-adm-prohibitedtipv6ticmps	ipv6-icmpc
Cs�id
d6dd6d
d6dd6dd6d	d
6}
|}x�|
D]�}y|j|�
}Wnt
k
rm


q>n
X|dkr�yt||d�

Wnt
k
r�


q�X|j|d�

n|
|||<q>W|S(
s Inverse valid rule s-Ds-As--deletes--appends-Is--inserts-Xs-Ns--delete-chains--new-chaini(s-Is--insert(tindext	Exceptiontinttpop(targstreplace_argstret_argstargtidx((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcommon_reverse_rule7s*














c
Cs�id
d6dd6d
d6dd6dd6d	d
6}
|}x�|
D]�}y|j|�
}Wnt
k
rm


q>n
X|dkr�yt||d�

Wnt
k
r�


q�X|j|d�

n|
|||<|SWttd��
d
S(s Reverse valid passthough rule s-Ds-As--deletes--appends-Is--inserts-Xs-Ns--delete-chains--new-chainisno '-A', '-I' or '-N' argN(s-Is--insert(R!t
ValueErrorR#R$R
R(R%R&R't
xR)((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcommon_reverse_passthrough\s.















c
Cs�t|�
}td
dddddddd	d
ddd
dddddddg�
}
t
||
@�
dkr�ttdt||
@�
d��
ntddddddg�
}t
||@�
dkr�ttd��
ndS(sZ Check if passthough rule is valid (only add, insert and new chain
    rules are allowed) s-Cs--checks-Ds--deletes-Rs	--replaces-Ls--lists-Ss--list-ruless-Fs--flushs-Zs--zeros-Xs--delete-chains-Ps--policys-Es--rename-chainisarg '%s' is not alloweds-As--appends-Is--inserts-Ns--new-chainsno '-A', '-I' or '-N' argN(tsettlenR
Rtlist(R%tnot_allowedtneeded((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcommon_check_passthrough�s*
	











	



t	ip4tablescBs�
eZ
dZd
ZeZd�Zd�Zd�Zd.d�
Z
d�Zd�Zd�Z
d	�Zd
�Zd�Zd�Zd
�Zd�Zd�Zd�Zd.d�
Zd�Zd�Zd�Zd�Zd�Zd�Zdd�
Zd�Zed�
Z d�Z!d�Z"d�Z#d�Z$d �Z%d!�Z&d"�Z'd#�Z(d.d.d$�Z)d.d.d%�Z*d.d.d&�Z+d'�Z,d.d(�
Z-d.d)�
Z.d.d*�
Z/d+�Z0d,�Z1d-�Z2RS(/RR4cCsz|
|_t
j|j|_t
jd
|j|_|j�|_|j�|_	|j
�
g|_g|_i|_
dS(Ns
%s-restore(t_fwRtCOMMANDStipvt_commandt_restore_commandt_detect_wait_optiontwait_optiont_detect_restore_wait_optiontrestore_wait_optiontfill_existstavailable_tablestzone_source_index_cachet
our_chains(tselftfw((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt__init__�s
	






	
	
c

Cs4tj
j|j�
|_tj
j|j�
|_dS(
N(tostpathtexistsR8tcommand_existsR9trestore_command_exists(
RB((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR>�s

cCs�|jrB|j|
krB|jg
g|
D]}d
|^q(}ng|
D]}d
|^qI}t
jd|j|jdj|�
�
t|j|�\}}|dkr�td|jdj|�
|f�
�
n|S(Ns%ss	%s: %s %st
 is'%s %s' failed: %s(R;Rtdebug2t	__class__R8tjoinRR+(RBR%titemt_argststatustret((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt__run�s
*
%




cCs�|dkr|
Sg}x�|
D]�}t
}x�|D]�}y|j|�
}Wntk
r\


q0Xt|�
|kr0d
||dkr0t}||djd
�
}x3|D](}	|}
|	|
|d<|j|
�

q�Wq0q0W|s|j|�

qqW|S(s5Split values combined with commas for options in optst
,i
N(tNonetFalseR!R+R/tTruetsplittappend(RBtrulestoptst	out_rulestrulet	processedtoptt
ititemsRNt_rule((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytsplit_value�s(










&







cCsAy|
j|�
}Wnt
k
r'


tSX||
||d
+tSdS(Ni
(R!R+RURV(RBR\tpatterntreplacementR_((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
_rule_replace�s





cCs|tko|t|kS(
N(
tBUILT_IN_CHAINS(RBR7ttabletchain((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytis_chain_builtin�s

cCsCd
|g}|
r"|jd�

n
|jd�

|j|�

|g
S(Ns-ts-Ns-X(
RX(RBtaddRgRhR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_chain_rules�s






cCsLd
|g}|
r.|d|t|�
g7}n|d|g7}||7}|S(Ns-ts-Is-D(
tstr(RBRjRgRhR!R%R\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
build_rule�s





cCs
t|
�
S(
N(
R*(RBR%((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytreverse_rule
s
cCst|
�

dS(
N(
R3(RBR%((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytcheck_passthrough
s
cCs
t|
�
S(
N(
R-(RBR%((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytreverse_passthrough

s
cCs�d
}y|
jd�
}Wnt
k
r,


n(Xt|
�
|dkrT|
|d}nd}xndddddd	gD]T}y|
j|�
}Wnt
k
r�


qsXt|
�
|dkrs|
|d}qsqsW||fS(
NRs-ti
s-As--appends-Is--inserts-Ns--new-chain(R!R+R/RT(RBR%RgR_RhR^((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytpassthrough_parse_table_chain

s$








	








cCs�
yb|
jd
�
}|
j
|�

|
j
|�
}d|
dkrQ||
df}n||
df}WnLtk
r�


y&|
jd�
}|
j
|�

d}Wq�tk
r�


dSXn
Xt}|
ddkr�t}n|r�|r�||kr�
|j|�

q�
n�|r�
|rI
||kr7
|j|�

|jd
d��

n|j|�
}n!|j	j
r^
d}nt|�
}d|
d<|
jd
d|d�
ndS(Ns%%ZONE_SOURCE%%s-miiis%%ZONE_INTERFACE%%is-Ds--deletetkeyc

Ss|d
S(Ni((
R,((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt<lambda>@
ss-Iis%di
(s-Ds--delete(
R!R$R+RTRVRUtremoveRXtsortR5t_allow_zone_driftingR/tinsert(RBR\R@R_tzonetzone_sourcetrule_addR!((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_run_replace_zone_source#
s>

















	

	








	

cCs#t�}i}t
j|j�
}x�
|
D]�
}|}|j|d
ddt|jg�
|j|dt|jg
�
y|jd�
}Wnt	k
r�


nLX|dkr�q(n|d&kr�d
dd|g|||d
+n
|j
|�

|j||�
d}	xpddgD]b}
y|j|
�
}Wnt	k
r6



q

Xt|�
|d
kr

|j
|�

|j
|�
}	q

q

Wxzt
t|�
�
D]f}x]tjD]R}|||kr�
||jd�
o�
||jd�
r�
d||||<q�
q�
Wq�
W|j|	g�j|�

q(Wx�|D]�}	||	}
|j|
ddg�}
|j|
ddg�}
|jd|	�

x(|
D] }|jdj|�
d�

qiW|jd�

qW|j�
tj|j�
}tjd|j|jd|j|jf�
g}
|j r|
j|j �

n|
jd�

t!|j|
d|j�
\}}tj"�dkr�t#|j�
}|dk	r�d
}xc|D]X}tj%d ||fd!d
d"d#�

|jd�
s�tj%d$d!d
�


n|d
7}qpWq�ntj&|j�

|d#krt	d%|jdj|
�
|f�
�
n||_|S('Ns
%%REJECT%%tREJECTs
--reject-withs%%ICMP%%s%%LOGTYPE%%tofftunicastt	broadcastt	multicasts-mtpkttypes
--pkt-typei
Rs-ts--tablet
"s"%s"s-ss--sources-ds
--destinations*%s
RJs

sCOMMIT
s	%s: %s %ss%s: %ds-ntstdinis%8d: %stnofmttnlits'%s %s' failed: %s(R~RR�('RtcopytdeepcopyR@RetDEFAULT_REJECT_TYPER7tICMPR!R+R$R{R/trangetstringt
whitespacet
startswithtendswitht
setdefaultRXRbtwriteRMtcloseREtstattnameRRKRLR9tst_sizeR=RtgetDebugLogLevelRRTtdebug3tunlink(RBRYt
log_deniedt	temp_filettable_rulesR@RaR\R_RgR^t
cR�R%RPRQtlinestline((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt	set_rulesL
s�
	











 










#















	









#





	
cCs�|j|
d
ddt
|jg�
|j|
dt|jg
�
y|
jd�
}Wntk
rf


nJX|dkrwdS|dkr�ddd
|g|
||d+n
|
j|�

tj|j	�
}|j
|
|�
|j|
�
}||_	|S(Ns
%%REJECT%%R|s
--reject-withs%%ICMP%%s%%LOGTYPE%%R}R�R~RR�s-mR�s
--pkt-typei
(sunicasts	broadcasts	multicast(ReR�R7R�R!R+R$R�R�R@R{t_ip4tables__run(RBR\R�R_R@toutput((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytset_rule�
s"







 

	
cCs�g}|
r|
g
n	tj
�}x�|D]�}
|
|jkrM|j|
�

q(y:|jd
|
ddg�

|jj|
�

|j|
�

Wq(tk
r�


tjd|j|
f�

q(Xq(W|S(Ns-ts-Ls-nsA%s table '%s' does not exist (or not enough permission to check).(	RftkeysR?RXR�R+Rtdebug1R7(RBRgRQttables((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytget_available_tables�
s











"c
Cs�d
}
t|j
dddg�}|ddkr�d}
t|j
dddg�}|ddkrkd}
ntjd|j|j
|
�
n|
S(NR�s-ws-Ls-nis-w10s%s: %s will be using %s option.(RR8RRKRL(RBR;RQ((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR:�
s






	
c
Cs�t�}
|
j
d
�

|
j�
d}xlddgD]^}t|j|g
d|
j�
}|ddkr3d|dkr3d	|dkr3|}Pq3q3Wtjd
|j|j|�
t	j
|
j�

|S(Ns#fooR�s-ws--wait=2R�isinvalid optioni
sunrecognized options%s: %s will be using %s option.(RR�R�RR9R�RRKRLRER�(RBR�R;ttest_optionRQ((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR<�
s
	






 


c
Csog|_g}
xYt
j�D]K}|j|�
s7qnx-d
ddgD]}|
jd||g�

qGWqW|
S(Ns-Fs-Xs-Zs-t(R@RfR�R�RX(RBRYRgtflag((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_flush_rules�
s
	





cCsyg}xltj
�D]^}|j|�
s.qn|d
kr@qnx.t|D]"}|jd|d||
g�

qKWqW|S(NRs-ts-P(RfR�R�RX(RBtpolicyRYRgRh((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_set_policy_ruless







$
c

Cs{
g}
d
}y1|jd|j
dkr-dnddg�
}WnGtk
r�
}
|j
dkrrtjd|�

q�tjd|�

n
X|j�}t}x�|D]�}|r.
|j�j�}|j	�}xa|D]V}|j
d	�
r
|jd
�
r
|dd!}	n|}	|	|
kr�|
j|	�

q�q�Wn|j
dkrL
|j
d
�
sj
|j
dkr�|j
d�
r�t
}q�q�W|
S(sQReturn ICMP types that are supported by the iptables/ip6tables command and kernelR�s-pRR s	ipv6-icmps--helpsiptables error: %ssip6tables error: %st
(t
)i
i����sValid ICMP Types:RsValid ICMPv6 Types:(R�R7R+RR�t
splitlinesRUtstriptlowerRWR�R�RXRV(
RBRQR�texR�tin_typesR�tsplitsRWR,((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytsupported_icmp_typess4


	




















c


CsgS(
N((
RB((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_default_tables/sR}c	Cs>i}|jd
�
r�g|d
<t
�|jd
<x]td
D]N}|d
jd|�

|d
jd||f�

|jd
jd|�

q:Wn|jd�
r�
g|d<t
�|jd<x�tdD]�}|djd|�

|djd||f�

|jdjd|�

|dkr�x�|jjr8
ddgndg
D]f}|djd	||f�

|djd
|||f�

|jdjt
d||fg
�
�

q?
Wq�q�Wn|jd�
r�g|d<t
�|jd<x�tdD]�}|djd|�

|djd||f�

|jdjd|�

|dkr�
x�|jjr\ddgndg
D]f}|djd	||f�

|djd
|||f�

|jdjt
d||fg
�
�

qcWq�
q�
Wn|jd
�
r�g|d
<t
�|jd
<x�td
D]�}|d
jd|�

|d
jd||f�

|jd
jd|�

|d0krx�|jjr�ddgndg
D]f}|d
jd	||f�

|d
jd
|||f�

|jd
jt
d||fg
�
�

q�WqqWng|d<t
�|jd<|djd�

|djd�

|djd�

|djd�

|jdjt
d�
�

xq|jjr�ddgndg
D]N}|djd|�

|djd|�

|jdjt
d|�
�

q�W|
dkr|djd�

n|djd�

|
dkr8|djd�

n|djd�

|djd�

|djd�

|djd�

|djd �

|jdjt
d!�
�

x�d"d#gD]�}x�|jjr�ddgndg
D]`}|djd$||f�

|djd%||f�

|jdjt
d&||f�
�

q�Wq�W|
dkrd|djd'�

n|djd(�

|
dkr�|djd)�

n|djd*�

|dcd+d,d-g7<|jdjt
d.�
�

g}xX|D]P}||j�krq�nx/||D]#}|jd/|gt	|�
�

qWq�W|S(1NRs-N %s_directs-A %s -j %s_directs	%s_directRRtZONES_SOURCEtZONESs-N %s_%ss-A %s -j %s_%ss%s_%sRRRRs=-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs-A INPUT -i lo -j ACCEPTs-N INPUT_directs-A INPUT -j INPUT_directtINPUT_directs-N INPUT_%ss-A INPUT -j INPUT_%ssINPUT_%sR}s^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's/-A INPUT -m conntrack --ctstate INVALID -j DROPs9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's-A INPUT -j %%REJECT%%s?-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs-A FORWARD -i lo -j ACCEPTs-N FORWARD_directs-A FORWARD -j FORWARD_directtFORWARD_directtINtOUTs-N FORWARD_%s_%ss-A FORWARD -j FORWARD_%s_%ss
FORWARD_%s_%ss`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's1-A FORWARD -m conntrack --ctstate INVALID -j DROPs;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's-A FORWARD -j %%REJECT%%s-N OUTPUT_directs-A OUTPUT -o lo -j ACCEPTs-A OUTPUT -j OUTPUT_directt
OUTPUT_directs-t(RR(
R�R.RARfRXRjR5RvtupdateR(	RBR�t
default_rulesRhtdispatch_suffixt	directiontfinal_default_rulesRgR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_default_rules3s�















(


5







(


5







(


5







(


"











(


,








	





%cCs�|
d
krdddhS|
dkrSd|j�krSd|j�krSdh
Sn|
dkr~d|j�kr~ddhSn|
d	kr�d	|j�kr�dh
SniS(
NRRt
FORWARD_INtFORWARD_OUTRRRRR(
R�(RBRg((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytget_zone_table_chains�s















cCs�id
d6dd6d
d6d
d6dd6dd6|}tj
d	t|d
|�}d}	|
ry|rydd
|dg}
n?|
r�dd
|g}
n&dd
|g}
|s�|
dg
7}
n|
d||||	|g7}
|
g
S(Ns-iRs-oRRR�R�RRhRxs-gs-Is%s_ZONESs%%ZONE_INTERFACE%%s-As-Ds-t(R
tformatR(RBtenableRxt	interfaceRgRhRXR^ttargettactionR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt!build_zone_source_interface_rules�s&















c
Cs�
id
t6dt
6|
}idd6dd6dd6dd6dd	6dd
6|}|jjred|}n
d|}tjd
t|d|�}	d}
|jd�
r
|d}|dkr�d}nd}dj|g
|jj	j
|�
�
}||d|d|ddd|||
|	g
}
n�t|�
ri
|dkr6
dS||d|d|ddd|j�|
|	g}
nt
d|�r�
t|�
}n=td|�r�
|jd�
}t|d�
d|d }n||d|d||||
|	g
}
|
g
S(!Ns-Is-Ds-sRs-dRRR�R�Rs%s_ZONES_SOURCEs%s_ZONESRhRxs-gsipset:itdsttsrcRSs%%ZONE_SOURCE%%s-ts-mR.s--match-setR�tmacs--mac-sourceRt
/ii
(RVRUR5RvR
R�RR�RMtipsett
get_dimensionRtupperR	RR
RW(RBR�RxtaddressRgRhtadd_delR^tzone_dispatch_chainR�R�R�tflagsR\t
addr_split((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_source_address_rules�sV














	
%



















cCs6tj
d
t|d|
�}|j|jt|d|d|d|g�
�

g}|jd|d|g�

|jdd|d|g�

|jdd|d|g�

|jdd|d|g�

|jd|d|d	d|g�

|jd|d|d	d|g�

|jd|d|d	d|g�

|jjj	|
j
}|jj�d
kr�
|dkr�
|dkr�
|dkr�
|jd|d|dd	ddd|g	�

n|dkr�
|jd|d|dd	ddd|g	�

q�
q�
n|dkr2|dkr2|dkr2|jd|d|d	|g�

n|S(NRhRxs%s_logs%s_denys%s_allows-Ns-ts-As-jR}RRR�R�RR|s
%%REJECT%%s%%LOGTYPE%%tLOGs--log-prefixs
"%s_REJECT: "tDROPs"%s_DROP: "tACCEPT(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(sREJECTs
%%REJECT%%(R�sREJECTs
%%REJECT%%R�(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(R
R�RRAR�R.RXR5Rxt_zonesR�tget_log_denied(RBRxRgRht_zoneRYR�((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_chain_rules�s<








#
#
#




	



	



"cCs|
rd
dd|
jgSgS(Ns-mtlimits--limit(
tvalue(RBR�((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rule_limit*s


cCs�|
js
gSid
t
6dt6|}|d|d|g}||ddg7}|
jjrx|dd|
jjg7}n|
jjr�|d	d
|
jjg7}n||j|
jj�
7}|S(Ns-As-Ds%s_logs-ts-jR�s--log-prefixs'%s's--log-levels%s(RRVRUtprefixtlevelR�R�(RBt	rich_ruleR�RgR�t
rule_fragmentR�R\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_log/s
	






c	Cs�|
js
gSid
t
6dt6|}|d|d|g|}t|
j�
tkr]d}nBt|
j�
tkr{d}n$t|
j�
tkr�d}nd}|d	d
d|g7}||j|
jj	�
7}|S(Ns-As-Ds%s_logs-ttaccepttrejecttdroptunknowns-jtAUDITs--type(
tauditRVRUttypeR�RRRR�R�(	RBR�R�RgR�R�R�R\t_type((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_audit?s
	


	

	

	

cCs�
|js
gSid
t
6dt6|}t|j�
tkrSd|}ddg}	n�t|j�
tkr�d|}ddg}	|jjrL
|	d|jjg7}	qL
n�t|j�
tkr�d|}dd	g}	nxt|j�
tkr0
tj	d
t
dd|
�}d
}d|}ddd|jjg}	ntt
dt|j�
��
||d|g}
|
||	7}
|
|j|jj�
7}
|
S(Ns-As-Ds%s_allows-jR�s%s_denyR|s
--reject-withR�RhRRxRtMARKs--set-xmarksUnknown action %ss-t(R�RVRUR�RRRRR
R�RR.R
RR�R�(RBRxR�R�RgR�R�R�Rhtrule_actionR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_actionSs4
	
















	






cCs�|
s
gSg}|
jr)|j
d
�

ntd|
j�rW|dt|
j�
g7}n`td|
j�r�|
jjd�
}|dt|d�
d|dg7}n|d|
jg7}|S(Nt
!Rs-dR�ii
(tinvertRXR	taddrRR
RW(RBt	rich_destR�R�((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_destination_fragmentts


	





)cCs�
|
s
gSg}|
jr�|
j
r2|jd
�

ntd|
j�r`|dt|
j�
g7}q�
td|
j�r�|
jjd�
}|dt|d�
d|dg7}q�
|d|
jg7}n�t|
d�r
|
jr
|ddg7}|
j
r
|jd
�

n|d	|
jg7}nut|
d
�r�
|
j	r�
|ddg7}|
j
r[
|jd
�

n|j
jj|
j	d�}|d
|
j	|g7}n|S(NR�Rs-sR�ii
R�s-ms--mac-sourceR�R.R�s--match-set(
R�R�RXR	RR
RWthasattrR�R�R5Rxt_ipset_match_flags(RBtrich_sourceR�R�R�((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt_rich_rule_source_fragment�s0


	
	





)


	




	


c	Cs�
id
t6dt
6|
}d}tjdtdd|�}	d|g}
|ri|
dd	t|�
g7}
n|r�|
d
|g7}
n|r�|
|j|j�
7}
|
|j|j	�
7}
n|s�t
|j�
tkr�|
ddd
dg7}
ng}|rd
|j
|j||
||	|
��

|j
|j||
||	|
��

|j
|j|||
||	|
��

n+|j
|d|	d|g|
ddg�

|S(Ns-As-DRRhRRxs-ps--dports%ss-ds-mt	conntracks	--ctstates
NEW,UNTRACKEDs%s_allows-ts-jR�(RVRUR
R�RRR�tdestinationR�tsourceR�R�RRXR�R�R�(RBR�RxtprototportR�R�R�RgR�R�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_ports_rules�s,



	










"
"
(
%c	Csp
id
t6dt
6|
}d}tjdtdd|�}d|g}	|r_|	d|g7}	n|r�|	|j|j�
7}	|	|j|j�
7}	n|s�t	|j
�
tkr�|	d	d
ddg7}	ng}
|rA
|
j|j
||
|||	��

|
j|j||
|||	��

|
j|j|||
|||	��

n+|
j|d
|d|g|	ddg�

|
S(Ns-As-DRRhRRxs-ps-ds-mR�s	--ctstates
NEW,UNTRACKEDs%s_allows-ts-jR�(RVRUR
R�RR�R�R�R�R�R�RRXR�R�R�(RBR�RxtprotocolR�R�R�RgR�R�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_protocol_rules�s&











"
"
(
%c	Cs�
id
t6dt
6|
}d}tjdtdd|�}	d|g}
|ri|
dd	t|�
g7}
n|r�|
d
|g7}
n|r�|
|j|j�
7}
|
|j|j	�
7}
n|s�t
|j�
tkr�|
ddd
dg7}
ng}|rd
|j
|j||
||	|
��

|j
|j||
||	|
��

|j
|j|||
||	|
��

n+|j
|d|	d|g|
ddg�

|S(Ns-As-DRRhRRxs-ps--sports%ss-ds-mR�s	--ctstates
NEW,UNTRACKEDs%s_allows-ts-jR�(RVRUR
R�RRR�R�R�R�R�R�RRXR�R�R�(RBR�RxR
R

R�R�R�RgR�R�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_source_ports_rules�s*












"
"
(
%cCs�id
t6dt
6|
}tjdtdd|�}	|d|	ddd	|g}
|rs|
d
dt|�
g7}
n|r�|
d|g7}
n|
d
dd|g7}
|
g
S(Ns-As-DRhRRxs%s_allows-tRs-ps--dports%ss-ds-jtCTs--helper(RVRUR
R�RR(RBR�RxR
R

R�thelper_nametmodule_short_nameR�R�R\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_helper_ports_rules�s

	





cCs;
id
t6dt
6|
}tjdtdd|�}g}|ro||j|j�
7}||j|j�
7}ng}|j	|d|ddg|d	d
ddd
g�

tjdtdd|�}g}|r
||j|j�
7}||j|j�
7}n|j	|d|ddg|ddddddg�

|S(Ns-As-DRhRRxs%s_allows-tRR�s-otlos-jt
MASQUERADER�Rs-mR�s	--ctstates
NEW,UNTRACKEDR�(
RVRUR
R�RR�R�R�R�RX(RBR�RxR�R�R�R�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_masquerade_rules
s*


	







	





c

Cs�
id
t6dt
6|
}
d|}ddd|g}d}
|rstd|�rf|
d	t|�
7}
qs|
|7}
n|r�|dkr�|
d
t|d�7}
ntjdtd
d|�}d|dt|�
g}|	r
||j|	j	�
7}||j
|	j�
7}ng}|	r9
|j|j
|	|
d||��

n|j|
d|ddg|ddd|g�

|j|
d|ddd|g|ddd|
g�

tjdt|d|�}|j|
d|ddddddg|ddg�

|S(Ns-As-Ds0x%xs-mtmarks--markR�Rs[%s]s:%st
-RhRRxs-ps--dportRs%s_allows-ts-jR�s
--set-markRtDNATs--to-destinationRR�s	--ctstates
NEW,UNTRACKEDR�(RVRUR	RRR
R�RR�R�R�R�RXR�(RBR�Rxtfilter_chainR

R
ttoportttoaddrtmark_idR�R�tmark_strR

ttoR�R�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_forward_port_ruless<








	




%





	
1c
CsXd
}idt6dt
6|
}|jdkrQddg}ddd|jg}n!dd	g}dd
d|jg}g}	x�
dd
gD]�
}
tjdt|
d|�}|jjj	|�
r�d|}d}
nd|}d}
g}|r
||j
|j�
7}||j|j
�
7}n|||7}|r�
|	j|j||
|||��

|	j|j||
|||��

|jr�
|	j|j|||
|||��

qP|	j|d|d|g|ddg�

q�|jj�dkr)|
dkr)|	j||d|g|ddddd|g�

n|	j||d|g|d|
g�

q�W|	S(NRs-As-DRs-pR s-ms--icmp-types	ipv6-icmpticmp6s
--icmpv6-typeRR�RhRxs%s_allowR�s%s_denys
%%REJECT%%s-ts-jR}s%%LOGTYPE%%R�s--log-prefixs"%s_ICMP_BLOCK: "(RVRUR7R�R
R�RR5Rxtquery_icmp_block_inversionR�R�R�R�RXR�R�R�R�R�(RBR�RxtictR�RgR�R
tmatchRYRhR�tfinal_chaintfinal_targetR�((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_zone_icmp_block_rulesIsL







	



	






"
"
	
(

!


	



c
CsB
d
}g}x/
ddgD]!
}d}tj
dt|d|�}|jjj|�
r�d}|jj�dkr�|
r�d	|t|�
g}	nd
|g}	|	d|dd
ddddd|g	}	|j|	�

|d7}q�nd}|
r
d	|t|�
g}	nd
|g}	|	d|dd
d|g}	|j|	�

qW|S(NRRR�iRhRxs
%%REJECT%%R}s-Is-Ds-ts-ps%%ICMP%%s%%LOGTYPE%%s-jR�s--log-prefixs"%s_ICMP_BLOCK: "i
R�(	R
R�RR5RxR
R�RlRX(
RBR�RxRgRYRhtrule_idxR�t
ibi_targetR\((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt%build_zone_icmp_block_inversion_ruleszs2





	




	






cCs�d
}tj
dtdd|�}g}||j|j�
7}||j|j�
7}g}|j|j||
|||��

|j|j	||
|||��

|j|j
|||
|||��

|S(NRRhRRx(R
R�RR�R�R�R�RXR�R�R�(RBR�RxR�RgR�R�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt(build_zone_rich_source_destination_rules�s


	


"
"
%cCs
|
|jkS(
N(
R7(RBR7((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytis_ipv_supported�s
N(3t__name__t
__module__R7R�RVtzones_supportedRDR>R�RTRbReRiRkRmRnRoRpRqR{R�R�R�R:R<R�R�R�R�R�R�RUR�R�R�R�R�R�R�R�R�R
R
R
R	
R
R
R
R 
R!
R"
(((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR4�s\


			
												)	^				
		!	i		7	,				!			,1	#	t	ip6tablescBs eZ
dZd
Zed�
ZRS(RR&
cCs�g}|jd
dddddddd	g	�

|
d
krk|jd
dddddddddd
g�

n|jd
ddddddddg	�

|jd
ddddddddg	�

|S(Ns-IRs-tRs-mtrpfilters--inverts-jR�R}R�s--log-prefixsrpfilter_DROP: s-ps	ipv6-icmps$--icmpv6-type=neighbour-solicitationR�s"--icmpv6-type=router-advertisement(
RX(RBR�RY((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pytbuild_rpfilter_rules�s"





	












(R#
R$
R7R�RUR(
(((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR&
�s

((tos.pathRER�tfirewall.core.baseRR
tfirewall.core.progRtfirewall.core.loggerRtfirewall.functionsRRRRRR	R
RtfirewallRtfirewall.errorsR
RRtfirewall.core.richRRRRR�RfR�R�R*R-R3tobjectR4R&
(((s;/usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt<module>s<



:

"












	%	*	 ����