%PDF-
%PDF-
Mini Shell
Mini Shell
�
�c�`c@s~ddlZddlZddlmZmZddlmZddlm Z ddl
mZmZm
Z
mZmZddlmZddlmZmZmZmZmZmZddlmZmZmZmZd Zd
Ziiddefd
6d6iddefd
6d6iddefd
6ddefd6d6iddefd6ddefd6d6Z iid6id6id6Z!ii"dd d!dd"d#gd$6dd d!gd!6dd d%gd%6dd d&gd&6dd d!dd"d'gd(6dd d!dd"d)gd*6dd d!dd"d+gd,6dd d-dd"d.gd/6dd d!dd"d0gd16dd d!dd"d.gd26dd d3dd"d.gd46dd d!dd"d5gd66dd d-dd"d7gd86dd d!dd"d9gd:6dd d!dd"d7gd;6dd d3gd36dd d!dd"d<gd=6dd d!dd"d>gd?6dd d!dd"d@gdA6dd d-gd-6dd d3dd"d.gdB6dd dCgdC6dd dDgdD6dd dEgdE6dd d!dd"dFgdG6dd dHgdH6dd dIgdI6dd dJgdJ6dd d-dd"d<gdK6dd d!dd"dLgdM6dd d-dd"d@gdN6dd d!dd"dOgdP6dd dHdd"d.gdQ6dd dHdd"d7gdR6dS6idTd d!dTd"d<gdU6dTd d3dTd"d7gdV6dTd d!dTd"d@gdW6dTd d!dTd"d.gd$6dTd d!gd!6dTd d%gd%6dTd d&gd&6dTd d!dTd"dFgdX6dTd dYgdZ6dTd d[gd\6dTd d!dTd"d7gd]6dTd d^gd^6dTd d3gd36dTd d!dTd"d'gd=6dTd d_gd-6dTd d!dTd"d9gd`6dTd dagdC6dTd dbgdD6dTd dHgdH6dTd dHdTd"d.gdQ6dTd dHdTd"d7gdR6dTd d3dTd"d.gdc6dTd d3dTd"d@gdd6de6Z"dfe#fdg��YZ$dS(hi����N(t SHORTCUTStDEFAULT_ZONE_TARGET(trunProg(tlog(t splitArgst check_mactportStrtcheck_single_addresst
check_address(tconfig(t
FirewallErrort
UNKNOWN_ERRORtINVALID_RULEtINVALID_ICMPTYPEtINVALID_TYPEt
INVALID_ENTRY(tRich_AccepttRich_Rejectt Rich_Dropt Rich_Markt firewalldi
t
preroutingi���t
PREROUTINGtrawij���tmanglei����tpostroutingidtPOSTROUTINGtnattinputitINPUTtforwardtFORWARDtfiltertinettiptip6ticmpttypesdestination-unreachabletcodet13scommunication-prohibiteds
echo-replysecho-requestt4sfragmentation-neededt14shost-precedence-violationt10shost-prohibitedtredirectt1s
host-redirectt7shost-unknownshost-unreachablesparameter-problems
ip-header-badt8snetwork-prohibitedt0snetwork-redirectt6snetwork-unknownsnetwork-unreachablet3sport-unreachablet15sprecedence-cutofft2sprotocol-unreachablesrequired-option-missingsrouter-advertisementsrouter-solicitations
source-quencht5ssource-route-faileds
time-exceededstimestamp-replystimestamp-requeststos-host-redirectt12stos-host-unreachablestos-network-redirectt11stos-network-unreachablesttl-zero-during-reassemblysttl-zero-during-transittipv4ticmpv6saddress-unreachables
bad-headersbeyond-scopes
failed-policysnd-neighbor-advertsneighbour-advertisementsnd-neighbor-solicitsneighbour-solicitationsno-routespacket-too-bigsnd-redirectsreject-routesnd-router-advertsnd-router-solicitsunknown-header-typesunknown-optiontipv6tnftablescBs�eZdZeZd�Zd�Zd�Zd�Zd�Z d�Z
d�Zd�Zd3d �Zd
�Zd�Zd�Zd
�Zdd�Zd�Zedd�Zdd�Zdd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Z d3d3d�Z!d3d3d�Z"d3d3d�Z#d �Z$d3d!�Z%d3d"�Z&d#�Z'd3d$�Z(d%�Z)d3d&�Z*d'�Z+ed(�Z,d)�Z-d*�Z.d+�Z/d3d,�Z0d-�Z1d.�Z2d/�Z3d0�Z4d1�Z5d2�Z6RS(4R:cCsK||_tjd|_|j�g|_i|_i|_i|_dS(Ntnft( t_fwR tCOMMANDSt_commandtfill_existstavailable_tablestrule_to_handletrule_ref_counttzone_source_index_cache(tselftfw((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt__init__�s
cCs%tjj|j�|_t|_dS(N(tostpathtexistsR>tcommand_existstFalsetrestore_command_exists(RD((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR?�sc Cs�y?|jd�}|j|�|j|�}||df}WnLtk
r�y&|jd�}|j|�d}Wq�tk
r�dSXnX|d}|r�|r�||kr�|||kr�||j|�q�n�|r�||kr�g||<n|rN|||kr8||j|�||jdd��n||j|�}n%|jjrcd}nt ||�}|dkr�d|d<q�|d 8}d
|d<|j
|d�|j
|d d|�ndS(
Ns%%ZONE_SOURCE%%is%%ZONE_INTERFACE%%itkeycSs|dS(Ni((tx((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt<lambda>�sitinsertitaddtindexs%d(RRtpopt
ValueErrortNonetremovetappendtsortR<t_allow_zone_driftingtlenRP( RDtrule_addtruleRCtitzonetzone_sourcetfamilyRR((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_run_replace_zone_source�sD
c
Cs�ddg}|}|ddkrs|ddkrs|}d|d<t|j||�\}}|dkrsdSnd}|ddkr|ddkrt}|d}|d
dkryt|d�Wn tk
r�ttd��qX|jd
�|jd
�ndj |�}nB|ddkr_|ddkr_t
}|d}dj |�}n||jkr7|r�|j|cd7<dS|r�|j|dkr�|j|cd8<dS|j|dkr�|j|cd8<n ttd||j|f��t
jd|j|j||jdj |��n|retj|j�} |j||| �n|s�|r�|j|dks�|r�||jkr�|r�|r�ddg|dd!d|j|g}ndj |�}
t
jd|j|j|
�t|j||�\}}|dkrEtd|j|
|f��n|rW| |_n|r�|r�d}|j|�t|�}||j�|j|<d|j|<q�|j|=|j|=q�n|S(Ns--echos--handleitdeleteittabletlisttRQRPR\iitpositionisposition without a numbert s)rule ref count bug: rule_key '%s', cnt %ds%s: rule ref cnt %d, %s %sithandles %s: %s %ss'%s %s' failed: %ss # handle (saddsinsert(Rb(RR>RUtTruetintt ExceptionR
RRStjoinRKRBRRtdebug2t __class__tcopytdeepcopyRCRaRARTRRRZtstrip(
RDtargstnft_optst_argst
_args_testtstatustoutputtrule_keyR[RCt _args_strtstrtoffset((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt__run�s|
#!
cCsAy|j|�}Wntk
r'tSX||||d+tSdS(Ni(RRRTRKRi(RDR\tpatterntreplacementR]((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
_rule_replace,s
cCs|}d|d<|S(NRbi((RDRrtret_args((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytreverse_rule5s
cCsttd��dS(Nsnot implemented(R
R(RDtrulest
log_denied((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_rules:scCsd}d|ks*d|ks*d|kr3d}n-d|ksWd|ksWd|kr`d}n|j|dd d
|ddg�|j|d
dddg�y|jd�}Wntk
r�nDX|dkr�dS|dkr�d|g|||d+n
|j|�|j|�S(NticmpxR7R"R$R9R#R8s
%%REJECT%%trejecttwithR%sadmin-prohibiteds%%ICMP%%tmetatl4protos{icmp, icmpv6}s%%LOGTYPE%%toffRetunicastt broadcastt multicasttpkttypei(R�R�R�(RRRRTRSt_nftables__run(RDR\R�ticmp_keywordR]((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytset_ruleCs$$ $
cCs|r
|gStj�S(N(tIPTABLES_TO_NFT_HOOKtkeys(RDRc((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytget_available_tablesbscCsYi|_i|_i|_g}x1tj�D]#}|jdd|dtg�q.W|S(NRbRcs%s(RARBRCt
OUR_CHAINSR�RWt
TABLE_NAME(RDR�R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_flush_rulesfs !cCs�tdd}g}|dkr�|jddd|g�x�ddgD]:}d |d
||dtdf}|jt|��qFWn5|d
kr�|jddd|g�n
ttd�|S(Nt_tpolicy_droptDROPRQRcR!RRwsMadd chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'Ri���itACCEPTRbsnot implemented(R�RWtNFT_HOOK_OFFSETRR
R(RDtpolicyt
table_nameR�thookt
_add_chain((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_set_policy_rulesps
cCsAt�}x+tj�D]}|jt|j��qWt|�S(N(tsettICMP_TYPES_FRAGMENTR�tupdateRd(RDt supportedtipv((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytsupported_icmp_types�s cCsAg}x+tj�D]}|jd|tf�qWtt|�S(Nsadd table %s %s(R�R�RWR�tmapR(RDtdefault_tablesR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_default_tables�sR�c
Cs�g}t�tdd<x�tdj�D]�}|jdt|td|dtd|df�x�|jjr~ddgndgD]e}|jdt||f�|jd t|||f�tddjtd
||fg��q�Wq(Wt�tdd<x�tdj�D]�}|jdt|td|dtd|df�x�|jjrjddgndgD]e}|jd
t||f�|jdt|||f�tddjtd
||fg��qqWqWt�tdd<t�tdd<x�ddgD]�}x�tdj�D]�}|jd|t|td|dtd|df�x�|jjr}ddgndgD]k}|jd|t||f�|jd|t|||f�t|djtd
||fg��q�Wq$Wq
Wt�tdd<xMtdj�D];}|jdt|td|dtd|df�qW|jdtdf�|jdtdf�x`|jjr�ddgndgD]=}|jdtd|f�|jdtdd|f�q�W|dkr|jdtdf�n|jdtdf�|dkrP|jdtdf�n|jd tdf�|jd!td"f�|jdtd"f�|jdtd"f�x}d#d$gD]o}xf|jjr�ddgndgD]C}|jd%td"||f�|jd&td"d"||f�q�Wq�W|dkrR|jdtd"f�n|jdtd"f�|dkr�|jdtd"f�n|jd td"f�td'd(d)d*d+d,g�tdd<t t
|�S(-NR!Rs@add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'iitZONES_SOURCEtZONESsadd chain inet %s raw_%s_%ss&add rule inet %s raw_%s jump raw_%s_%ss%s_%sRsCadd chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'sadd chain inet %s mangle_%s_%ss,add rule inet %s mangle_%s jump mangle_%s_%sR"RR#s;add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'sadd chain %s %s nat_%s_%ss$add rule %s %s nat_%s jump nat_%s_%sR sCadd chain inet %s filter_%s '{ type filter hook %s priority %d ; }'s>add rule inet %s filter_%s ct state established,related acceptRs,add rule inet %s filter_%s iifname lo acceptsadd chain inet %s filter_%s_%ss,add rule inet %s filter_%s jump filter_%s_%sR�s_add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '"STATE_INVALID_DROP: "'s0add rule inet %s filter_%s ct state invalid dropsHadd rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '"FINAL_REJECT: "'sBadd rule inet %s filter_%s reject with icmpx type admin-prohibiteds$add chain inet %s filter_%s_IN_ZONESRtINtOUTs!add chain inet %s filter_%s_%s_%ss/add rule inet %s filter_%s jump filter_%s_%s_%stINPUT_ZONES_SOURCEtINPUT_ZONEStFORWARD_IN_ZONES_SOURCEtFORWARD_IN_ZONEStFORWARD_OUT_ZONES_SOURCEtFORWARD_OUT_ZONES(R�R�R�R�RWR�R<RYR�R�R(RDR�t
default_rulestchaintdispatch_suffixR`t direction((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_default_rules�s� (0 (0 ( 4 (!((cCsY|dkrdddgS|dkr,dgS|dkrBddgS|d krUdgSiS(
NR Rt
FORWARD_INtFORWARD_OUTRRRRR((RDRc((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytget_zone_table_chains�s
R!c
Cs�|dkrr|dkrrg}|j|j||||||d��|j|j||||||d��|Sidd6dd6dd 6dd
6dd6dd6|} |t|�d
dkr�|t|�d
d}ntjdt|d|�}
d}|r3|r3dd|dtd||fdg}ne|r_dd|dtd||fg}n9dd|dtd||fg}|s�|dg7}n|dkr�||d||
fg7}n(|| d|d|d||
fg7}|gS(NRR!R"R#tiifnameRtoifnameRRR�R�tOUTPUTit+t*R�R^tgotoRPR\s%ss%s_%s_ZONESs%%ZONE_INTERFACE%%RQRbs%s_%ss"(textendt!build_zone_source_interface_rulesRZRtformatRR�(
RDtenableR^t interfaceRcR�RWR`R�toptttargettactionR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR��s>
&#(cCsK|dkr�|dkr�g}|jd�rI|j|td��}nd}td|�svt|�sv|dkr�|j|j|||||d��ntd|�s�t|�s�|dkr�|j|j|||||d��n|Sidt6d t 6|} id
d6dd
6d
d6d
d6dd6dd6|}
|j
jr\d||f}nd||f}tj
dt|d|�}d}
|jd�r�|td�}|j|�}d|}nCt|�r�|
dkr�dSd}ntd|�rd}nd}| d|dt|d|||
||
d||fg}|gS(NRR!sipset:R7R"R9R#RPRbtsaddrRtdaddrRRR�R�R�s%s_%s_ZONES_SOURCEs%s_%s_ZONESR�R^R�t@RetetherR\s%ss%%ZONE_SOURCE%%s%s_%s(t
startswitht_set_get_familyRZRURRR�tbuild_zone_source_address_rulesRiRKR<RYRR�RR�(RDR�R^taddressRcR�R`R�tipset_familytadd_delR�tzone_dispatch_chainR�R�tipsettrule_familyR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR�$sT''
c Cs.|dkr`|dkr`g}|j|j|||d��|j|j|||d��|Stjdt|d|�}t||jt|d|d|d |g��g}|jd
d|dt d||fg�|jd
d|dt d
||fg�|jd
d|dt d||fg�|jd
d|dt d||fg�|jd
d|dt d||fdd
||fg�|jd
d|dt d||fdd||fg�|jd
d|dt d||fdd||fg�|j
jj|j
}|j
j�dkr�|dkr�|d kr�|d!kr�|}|dkrud}n|jd
d|dt d||fdddd||fg �q�q�n|dkr*|d"kr*|d#kr*|jd
d|dt d||f|dkr|j�ndg�n|S($NRR!R"R#R�R^s%s_logs%s_denys%s_allowRQs%ss%s_%ss %s_%s_logs
%s_%s_denys%s_%s_allowR\tjumpR�R RR�R�R�tREJECTs
%%REJECT%%R�s%%LOGTYPE%%Rtprefixs"filter_%s_%s: "R�(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(R�s
%%REJECT%%sDROP(sACCEPTR�s
%%REJECT%%sDROP(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(R�tbuild_zone_chain_rulesRR�RR�R�R�RWR�R<R^t_zonesR�tget_log_deniedtlower( RDR^RcR�R`R�t_zoneR�t
log_suffix((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR�^s^
%cCs�iddddgd6ddddgd6ddddgd6ddddgd 6dddd
gd6dddd
gd6dd
dd
gd6dd
dd
gd6ddddgd6ddddgd6ddddgd6ddddgd6ddddgd6dd
ddgd6ddddgd6ddddgd6ddddgd6dd
ddgd6dd
ddgd 6dd
dd!gd"6dd
dd!gd!6dd#d$gd%6dd#d$gd&6}||S('NR�R$R%shost-prohibitedsicmp-host-prohibitedshost-prohibsnet-prohibitedsicmp-net-prohibiteds
net-prohibsadmin-prohibitedsicmp-admin-prohibitedsadmin-prohibR8sicmp6-adm-prohibitedsadm-prohibitedsnet-unreachablesicmp-net-unreachablesnet-unreachshost-unreachablesicmp-host-unreachableshost-unreachsport-unreachablesicmp-port-unreachablesicmp6-port-unreachableR�sport-unreachsprot-unreachablesicmp-proto-unreachables
proto-unreachsaddr-unreachablesicmp6-addr-unreachablesaddr-unreachsno-routesicmp6-no-routettcptresets tcp-resetstcp-rst((RDtreject_typetfrags((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_reject_types_fragment�s2cCs�|s
gSidd6dd6dd6dd6}y|jjd �}Wn tk
rdttd
��nXdd|jd
|!d ||j|dgS(Ntsecondtstminutetmthourthtdaytdt/sExpected '/' in limittlimittrateii(tvalueRRRTR
R(RDR�trich_to_nftR]((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_limit_fragment�s
cCs�|js
gSidt6dt6|}|dddtd||fg}||dg7}|jjr�|dd |jjg7}n|jjr�|d
d |jjg7}n||j|jj�7}|S(NRQRbR\R!s%ss %s_%s_logRR�s"%s"tlevel(RRiRKR�R�R�R�R�(RDt rich_ruleR�RcR�t
rule_fragmentR�R\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_log�s cCs||js
gSidt6dt6|}|dddtd||fg}||ddd g7}||j|jj�7}|S(
NRQRbR\R!s%ss %s_%s_logRR�taudit(R�RiRKR�R�R�(RDR�R�RcR�R�R�R\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_audit�s cCs�|js
gSidt6dt6|}t|j�tkrVd||f}dg} nt|j�tkr�d||f}dg} |jjr^| |j|jj�7} q^n�t|j�tkr�d||f}dg} n~t|j�tkrBt j
dtd d
|�}d}d||f}dd
d|jjg} nt
tdt|j���|dddt|g}
|
|7}
|
|j|jj�7}
|
| 7}
|
S(NRQRbs%s_%s_allowtaccepts
%s_%s_denyR�tdropR�RR^RR�tmarkR�sUnknown action %sR\R!s%s(R�RiRKR%RRR�RRRR�RR�R
RR�R�R�(RDR^R�R�RcR�R�R�R�trule_actionR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_action�s6
cCsS|s
gS|dkr#dddgS|dkr<dddgSttd|��dS(NR7R�tnfprotoR9sInvalid family(R
R(RDtrich_family((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_family_fragments
cCsx|s
gSg}td|j�r2|dg7}n
|dg7}|jra|dd|jg7}n|d|jg7}|S(NR7R"R#R�s!=(Rtaddrtinvert(RDt rich_destR�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_destination_fragments
cCsJ|s
gSg}|jr�td|j�r;|dg7}n
|dg7}|jrj|dd|jg7}qF|d|jg7}n�t|d�r�|jr�|jr�|ddd|jg7}qF|dd|jg7}npt|d�rF|jrF|j|j�}|jr)||ddd |jg7}qF||dd |jg7}n|S(
NR7R"R#R�s!=tmacR�R�R�(RRRthasattrRR�R�(RDtrich_sourceR�R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_source_fragment,s(
c Cs�idt6dt6|}d}tjdtdd|�} g}
|r_|
|j|j�7}
n|r�td|�r�|
dg7}
n
|
d g7}
|
d
|g7}
n|r�|
|j|j �7}
|
|j
|j�7}
n|
|ddt|d
�g7}
|st
|j�tkr+|
dddg7}
ng}|r�|j|j|||| |
��|j|j|||| |
��|j|j||||| |
��n5|j|dddtd|| fg|
dg�|S(NRQRbR R�RR^R7R"R#R�tdports%st-tcttstates
new,untrackedR\R!s%s_%s_allowR�(RiRKRR�RRR`RRtdestinationR tsourceRR%R�RRWR�R�R�R�(RDR�R^tprototportRR�R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_ports_rulesIs2
""(/c Cs�idt6dt6|}d}tjdtdd|�}g} |r_| |j|j�7} n|r�td|�r�| dg7} n
| d g7} | d
|g7} n|r�| |j|j�7} | |j|j �7} | |j
|j�7} ndd|g} |st|j
�tkr0| d
ddg7} ng}
|r�|
j|j||||| ��|
j|j||||| ��|
j|j|||||| ��n/|
j|dddtd|g| dg�|
S(NRQRbR R�RR^R7R"R#R�R�R�RR
s
new,untrackedR\R!s%ssfilter_%s_allowR�(RiRKRR�RRR`RRRR RR%R�RRWR�R�R�R�(RDR�R^tprotocolRR�R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_protocol_rulesjs4
""()c Cs�idt6dt6|}d}tjdtdd|�} g}
|r_|
|j|j�7}
n|r�td|�r�|
dg7}
n
|
d g7}
|
d
|g7}
n|r�|
|j|j �7}
|
|j
|j�7}
n|
|ddt|d
�g7}
|st
|j�tkr+|
dddg7}
ng}|r�|j|j|||| |
��|j|j|||| |
��|j|j||||| |
��n5|j|dddtd|| fg|
dg�|S(NRQRbR R�RR^R7R"R#R�tsports%sRRR
s
new,untrackedR\R!s%s_%s_allowR�(RiRKRR�RRR`RRRR RRR%R�RRWR�R�R�R�(RDR�R^RRRR�R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_source_ports_rules�s2
""(/cCsidt6dt6|}tjdtdd|�} |dddtd | g}
|r�td
|�rv|
dg7}
n
|
dg7}
|
d
|g7}
n|
|ddt|d�g7}
|
dddd||fg7}
dddtd||fddd|d|ddg}||
gS(NRQRbR�RR^R\R!s%ssfilter_%s_allowR7R"R#R�R
RRthelperR�s"helper-%s-%s"shelper-%s-%st{R%s"%s"Rt;t}(RiRKRR�RR�RR(RDR�R^RRRthelper_nametmodule_short_nameR�R�R\t
helper_object((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_helper_ports_rules�s"
cCs�idt6dt6|}tjdtdd|�}g}|ro||j|j�7}||j|j�7}n|d|dt d|g|d d
ddggS(
NRQRbR�RR^R\s%ssnat_%s_allowR�s!=tlot
masquerade(
RiRKRR�RRRR RR�(RDR�R^R`R�R�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _build_zone_masquerade_nat_rules�s cCs�g}|rd|jr$|jdksB|jrdtd|jj�rd|j|j||d|��n}|r�|jr�|jdks�|jr�td|jj�r�|j|j||d|��n|j|j||d|��idt6dt6|}tj dt
dd |�}g}|rP||j|j�7}||j
|j�7}n|j|d
ddtd
|g|ddddg�|S(NR9R#R7R"RQRbR�R�R^R\R!s%ssfilter_%s_allowRR
s
new,untrackedR�(R`RRRR�R!RiRKRR�RRRR RWR�(RDR�R^R�R�R�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_masquerade_rules�s$"" 2c Cs�idt6dt6|}tjdtdd|�} g}
|rV|
dd|g7}
n|
ddg7}
|r�|d kr�|
d
t|d�g7}
n|d|d
td| dd|g||
gS(NRQRbR�RR^tdnatttoR+Res:%sRR\s%ssnat_%s_allowR�R�(RiRKRR�RRR�(RDR�R^Rt
mark_fragmentttoaddrttoportR`R�R�t
dnat_fragment((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt"_build_zone_forward_port_nat_rules�s c
Csaidt6dt6|}
d|}dd|g}tjdtdd|�}
g}| r�||j| j�7}||j| j�7}||j | j
�7}ng}|j|
d d
dtd|
g||d
|ddd|g�| rC| jr| jdks|rCt
d|�rC|j|j||||||d��n�| r�| jra| jdksv|r�t
d|�r�|j|j||||||d��nh|r�t
d|�r�|j|j||||||d��n(|j|j||||||d��tjdt|d|�}
|j|
d d
dtd|
dddg|dg�|S(NRQRbs0x%xR�R�R�RR^R\R!s%ssmangle_%s_allowR
R�R9R#R7R"sfilter_%s_allowRR
s
new,untrackedR�(RiRKRR�RRR`RRR RRWR�RR�R)(RDR�R^tfilter_chainRRR'R&tmark_idR�R�tmark_strR%R�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_forward_port_ruless@
2cCs<|t|krt||Sttd||jf��dS(Ns"ICMP type '%s' not supported by %s(R�R
R
tname(RDR�t icmp_type((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_icmp_types_to_nft_fragment/scCs�d}idt6dt6|}|r9|jr9|j}n\|jr�g}d|jkrg|jd�nd|jkr�|jd�q�nddg}g}x/|D]'} xddgD]}
tjdt|
d |�}|jj j
|�rd
||f}d}
nd||f}d
}
g}|rl||j|j�7}||j
|j�7}||j|j�7}n||j| |j�7}|r8|j|j|||||��|j|j|||||��|jr|j|j||||||��q�|j|dddtd||fg|d
g�q�|jj�dkr�|
dkr�|j|dddt|g|dddd||fg�n|j|dddt|g||
g�q�Wq�W|S(NR RQRbR7R9RR�R�R^s%s_%s_allowR�s
%s_%s_denys
%%REJECT%%R\R!s%sR�s%%LOGTYPE%%RR�s"%s_%s_ICMP_BLOCK: "(RiRKtipvsRRWRR�RR<R^tquery_icmp_block_inversionRR`RR RR0R.R�R�R�R�R�R�(RDR�R^tictR�RcR�R1R�R�R�R�tfinal_chaintfinal_targetR�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_icmp_block_rules6sT
"" (2! -c Cs�d}g}x�ddgD]�}tjdt|d|�}djddtd ||fd
d||fg�}|j|}|jjj|�r�d} nd
} |r�ddddtd ||fd|g}
n#ddddtd ||fg}
|
d| g7}
|j |
�|jjj|�r|jj
�dkr�|rpddddtd ||fd|g}
n#ddddtd ||fg}
|
ddddd||fg7}
|j |
�q�qqW|S(NR RR�R�R^RgR!s%ss%s_%sR�s%s_%s_allows
%%REJECT%%R�RQR\RfRbs%%ICMP%%R�s%%LOGTYPE%%RR�s"%s_%s_ICMP_BLOCK: "(RR�RRlR�RAR<R^R2RWR�(RDR�R^RcR�R�R�Rxtrule_handlet
ibi_targetR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt%build_zone_icmp_block_inversion_rulesls<
cCs�g}|jddddtdddd d
ddd
dddg�|dkr�|jddddtdddd d
ddd
dddddg�n|jddddtdddddg �|S(NRPR\R!s%ssraw_%sRR�R�R9tfibR�t.tiiftoiftmissingR�R�RR�s"rpfilter_DROP: "R8R%s){ nd-router-advert, nd-neighbor-solicit }R�traw_PREROUTINGR?R?(RWR�(RDR�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_rpfilter_rules�s
cCs�d}tjdtdd|�}g}||j|j�7}||j|j�7}||j|j�7}g}|j |j
|||||��|j |j|||||��|j |j||||||��|S(NR R�RR^(
RR�RRR`RRR RRWR�R�R�(RDR�R^R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt(build_zone_rich_source_destination_rules�s ""%cCs|dkrtStS(NR7R9teb(sipv4sipv6RB(RiRK(RDR�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytis_ipv_supported�scCs;idd6dd6}i||gd6||ddgd6||dd ||gd
6||dd ||gd6||dgd
6||gd6||ddgd6||dd ||gd6||dd ||gd6||dgd6dgd6}ydg||dgSWn$tk
r6ttd|��nXdS(Nt ipv4_addrR7t ipv6_addrR9shash:ips. inet_protos. inet_serviceshash:ip,ports. inet_service .shash:ip,port,ipshash:ip,port,nets. markshash:ip,markshash:nets
hash:net,portshash:net,port,ipshash:net,port,nets. ifnameshash:net,ifacet
ether_addrshash:macR%Rs!ipset type name '%s' is not valid(tKeyErrorR
R(RDR�R%tipv_addrttypes((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_set_type_fragment�s(
c
Cs)|r+d|kr+|ddkr+d}nd}|dg}||j||�7}|r�d|kr�|d|dddg7}nd |kr�|d
|d dg7}q�n|s�d|kr�d|kr�|dd
dg7}n|dg7}x4dddgD]#}|jdd|tg|�q�WdS(NR`tinet6R9R7RttimeoutR�Rtmaxelemtsizet,tflagstintervalRR!R"R#RQR�(RJR�R�(RDR.R%toptionsR�tcmdR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_create�s "
cCs:x3dddgD]"}|jdd|t|g�qWdS(NR!R"R#RbR�(R�R�(RDR.R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytset_destroy�scCs)|jjj|�jd�djd�}|jd�}t|�t|�krdttd��ng}x�tt|��D]�}||dkr�y||jd�}Wn(t k
r�|dd||g7}qX|||| d|||dg7}n|j
||�|j
d�q}W|d S( Nt:iROs+Number of values does not match ipset type.RR�R;i����(R<R�tget_typetsplitRZR
RtrangeRRRTRW(RDR.tentryttype_formattentry_tokenstfragmentR]RR((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_set_entry_fragment�s +
*cCsTxMdddgD]<}|jdd|t|dg|j||�dg�qWdS(NR!R"R#RQtelementRR(R�R�R^(RDR.RZR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytset_addscCsTxMdddgD]<}|jdd|t|dg|j||�dg�qWdS(NR!R"R#RbR_RR(R�R�R^(RDR.RZR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_deletescCs:x3dddgD]"}|jdd|t|g�qWdS(NR!R"R#tflushR�(R�R�(RDR.R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt set_flushscCsk|jjj|�}|jdkr-d}n:|jrad|jkra|jddkrad}nd}|S(Nshash:macR�R`RKR#R"(R<R�t get_ipsetR%RR(RDR.R�R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR�!s N(7t__name__t
__module__R.Ritzones_supportedRFR?RaR�RR�R�R�RUR�R�R�R�R�R�R�RKR�R�R�R�R�R�R�R�RRR RRRRR!R"R)R-R0R6R9R@RARCRJRTRUR^R`RaRcR�(((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR:�sf - U
T
+9@
"
!#! , 6 2 (%tos.pathRGRotfirewall.core.baseRRtfirewall.core.progRtfirewall.core.loggerRtfirewall.functionsRRRRRtfirewallR tfirewall.errorsR
RRR
RRtfirewall.core.richRRRRR�R�R�R�R�tobjectR:(((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt<module>s�(."
Zerion Mini Shell 1.0