관리-도구
편집 파일: ipXtables.cpython-39.pyc
a ���gh� � @ s0 d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z m Z m!Z! d dl"m#Z# d dl$Z$d Z%g d �d d gg d �g d�g d �d�Z&ddd�Z'ddd�Z(dd� Z)dd� Z*dd� Z+G dd � d e,�Z-G d d � d e-�Z.dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR) � Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark� Rich_NFLog�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp)�DEFAULT_ZONE_TARGET� )�INPUT�OUTPUT�FORWARD� PREROUTINGr )r � POSTROUTINGr r r )r r! r )�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited��ipv4�ipv6�icmp� ipv6-icmpc C s� ddddddd�}| dd� }|D ]t}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< q"|S ) z Inverse valid rule �-D�--delete�-X�--delete-chain��-A�--append�-I�--insert�-Nz --new-chainN�r3 r4 � )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� rA �;/usr/lib/python3.9/site-packages/firewall/core/ipXtables.py�common_reverse_rule: s* � rC c C s� ddddddd�}| dd� }|D ]z}z|� |�}W n tyJ Y q"Y n0 |dv r�zt||d � W n tyz Y n0 |�|d � || ||< | S ttd ��dS ) z Reverse valid passthough rule r, r- r. r/ r0 Nr6 r7 �no '-A', '-I' or '-N' arg)r8 � ValueErrorr: r; r r )r< r= r> �xr@ rA rA rB �common_reverse_passthrough_ s0 � �rG c C sh t | �} t g d��}t| |@ �dkr>ttdt| |@ �d ��t g d��}t| |@ �dkrdttd��dS )zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) )z-Cz--checkr, r- z-Rz --replace�-Lz--listz-Sz --list-rules�-Fz--flush�-Zz--zeror. r/ �-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedr0 rD N)�set�lenr r �list)r< Z not_allowedZneededrA rA rB �common_check_passthrough� s �� �rO c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdjd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdkd,d-�Zd.d/� Zdld1d2�Z d3d4� Z d5d6� Z dmd8d9�Z dnd:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dodRdS�Z,dpdTdU�Z-dqdVdW�Z.drdXdY�Z/dZd[� Z0dsd\d]�Z1dtd^d_�Z2dud`da�Z3dvdbdc�Z4ddde� Z5dfdg� Z6dhdi� Z7d!S )w� ip4tablesr( Tc C sd || _ tj| j | _tjd| j | _| �� | _| �� | _ | � � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwrA rA rB �__init__� s zip4tables.__init__c C s$ t j�| j�| _t j�| j�| _d S �N)�os�path�existsrS Zcommand_existsrT Zrestore_command_exists�r_ rA rA rB rY � s zip4tables.fill_existsc C s� | j r(| j |vr(| j gdd� |D � }ndd� |D �}t�d| j| jd�|�� t| j|�\}}|dkr�td| jd�|�|f ��|S )Nc S s g | ] }d | �qS ��%srA ��.0�itemrA rA rB � <listcomp>� � z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS rg rA ri rA rA rB rl � rm � %s: %s %s� r �'%s %s' failed: %s)rV r �debug2� __class__rS �joinr rE )r_ r< �_args�status�retrA rA rB Z__run� s �zip4tables.__runc C s< z|� |�}W n ty" Y dS 0 ||||d �< dS d S )NF� T)r8 rE )r_ �rule�patternZ replacement�irA rA rB � _rule_replace� s zip4tables._rule_replacec C s |t v o|t | v S rb )�BUILT_IN_CHAINS)r_ rR �table�chainrA rA rB �is_chain_builtin� s �zip4tables.is_chain_builtinc C s2 d|g}|r|� d� n |� d� |� |� |gS )N�-tr5 r. )�append)r_ �addr} r~ rx rA rA rB �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nr� r3 r, )�str)r_ r� r} r~ r8 r< rx rA rA rB � build_rule� s zip4tables.build_rulec C s t |�S rb )rC �r_ r< rA rA rB � reverse_rule� s zip4tables.reverse_rulec C s t |� d S rb )rO r� rA rA rB �check_passthrough� s zip4tables.check_passthroughc C s t |�S rb )rG r� rA rA rB �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}z|� d�}W n ty$ Y n 0 t|�|d krB||d }d }dD ]B}z|� |�}W n tyn Y qJ0 t|�|d krJ||d }qJ||fS )Nr& r� rw r0 )r8 rE rM )r_ r< r} rz r~ �optrA rA rB � passthrough_parse_table_chain� s z'ip4tables.passthrough_parse_table_chainc C s zH|� d�}|�|� |�|�}d|d kr:||d f}n ||d f}W nF ty� z |� d�}|�|� d }W n ty� Y Y d S 0 Y n0 d}|d d v r�d }|r�|s�||v r�|�|� n\|�r |r�||vr�|�|� |jd d � d � |� |�}nt|�}d|d< |�dd|d � d S )N�%%ZONE_SOURCE%%�-m� � � �%%ZONE_INTERFACE%%Tr �r, r- Fc S s | d S )Nr rA )rF rA rA rB �<lambda>' rm z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyr3 r7 �%drw )r8 r; rE �remover� �sortrM �insert)r_ rx r] rz �zoneZ zone_source�rule_addr8 rA rA rB �_run_replace_zone_source s: z"ip4tables._run_replace_zone_sourcec C s z|� |�}W n ty" Y �n�0 d}d}d}|�|� |�|�}t|�tkrZttd��d} dD ]B} z|� | �} W n ty� Y qb0 t|�| d krb|| d } qbdD ]Z} z|� | �}W n ty� Y q�0 t|�|d kr�||d } | d v r�d}| d v r�d}q�| | f} |�s^| |v�s>||| v�s>|| | d k�rHttd ��|| | d8 < n�| |v�rpi || < ||| v�r�d || |< d} t || � � �D ]<}||k�r�|�r� �q�| || | 7 } ||k�r� �qܐq�|| | d7 < d ||< |� |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TF���z%priority must be followed by a numberr& �r� z--tablerw )r1 r2 r3 r4 r, r- r6 r� r z*nonexistent or underflow of priority countr3 r7 r� N) r8 rE r; �typer: r r rM r �sorted�keysr� )r_ rx Zpriority_counts�tokenrz r� r� Zinsert_add_index�priorityr} r� �jr~ r8 �prA rA rB �_set_rule_replace_priority0 sj �� z$ip4tables._set_rule_replace_priorityc C s t � }i }t�| j�}t�| j�}t�| j�}|D �]x}|d d � } | �| dddt| j g� | �| dt | j g� z| � d�} W n t y� Y n80 |dkr�q2|dv r�dd d |g| | | d �< n | � | � | � | |d � | � | |d � | �| |� d} dD ]L} z| � | �} W n t �y" Y q�0 t| �| d kr�| � | � | � | �} q�t| �D ]F\} } tjD ]4}|| v �r`| �d��r�| �d��s`d| | | < �q`�qR|�| g ��| � q2|D ]F} || }|�d| � |D ]} |�d�| �d � �q�|�d� �q�|�� t�|j �}t � d| j | j d|j |j!f � g }| j"�rF|�| j"� |�d� t#| j ||j d�\}}t �$� dk�r�t%|j �}|d u�r�d } |D ]@}t j&d| |f d d d � |�d��s�t j&d d d � | d 7 } �q�t�'|j � |d k�rt d | j d�|�|f ��|| _|| _|| _d S )!N� %%REJECT%%�REJECT� --reject-with�%%ICMP%%� %%LOGTYPE%%�off��unicast� broadcastZ multicastr� �pkttype� --pkt-typerw �%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%r& r� �"z"%s"z*%s ro � zCOMMIT rn z%s: %d�-n��stdinr7 z%8d: %sr )�nofmt�nlr )r� rp )(r �copy�deepcopyr[ r\ r] r{ �DEFAULT_REJECT_TYPErR �ICMPr8 rE r; r� r� rM � enumerate�stringZ whitespace� startswith�endswith� setdefaultr� �writers �closerc �stat�namer rq rr rT �st_sizerX r ZgetDebugLogLevelr �debug3�unlink)r_ �rules� log_denied� temp_fileZ table_rulesr[ r\ r] Z_rulerx rz r} r� �element�cr� r< ru rv �lines�linerA rA rB � set_rules� s� � � � � �zip4tables.set_rulesc C s� | � |dddt| j g� | � |dt| j g� z|�d�}W n tyP Y n:0 |dkr^dS |dv r�d d d |g|||d �< n |�|� t�| j �}t�| j �}t�| j �}| � ||d � | � ||d� | � ||� | �|�}|| _ || _ || _ |S )Nr� r� r� r� r� r� r r� r� r� r� rw r� r� )r{ r� rR r� r8 rE r; r� r� r[ r\ r] r� r� �_ip4tables__run)r_ rx r� rz r[ r\ r] �outputrA rA rB �set_rule� s0 � zip4tables.set_ruleNc C s� g }|r|gnt �� }|D ]n}|| jv r4|�|� qz,| �d|ddg� | j�|� |�|� W q ty� t�d| j|f � Y q0 q|S )Nr� rH r� zA%s table '%s' does not exist (or not enough permission to check).) r| r� rZ r� r� rE r �debug1rR )r_ r} rv ZtablesrA rA rB �get_available_tables s z ip4tables.get_available_tablesc C s� d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t | jg d��}t�d| j| jd|d |d � |d dkr�d}t�d | j| j|� |S ) Nr )�-wrH r� �7%s: %s: probe for wait option (%s): ret=%u, output="%s"r� r rw )�-w10rH r� r� � %s: %s will be using %s option.)r rS r r� rr rq )r_ rV rv rA rA rB rU s z ip4tables._detect_wait_optionc C s� t � }|�d� |�� d}dD ]d}t| j|g|jd�}t�d| j| j ||d |d � |d dkr d|d vr d |d vr |} q�q t� d | j| j|� t � |j� |S ) Nz#foor )r� z--wait=2r� r� r rw zinvalid optionzunrecognized optionr� ) r r� r� r rT r� r r� rr rS rq rc r� )r_ r� rV Z test_optionrv rA rA rB rW " s � z%ip4tables._detect_restore_wait_optionc C sN i | _ i | _g | _g }t�� D ]*}| �|�s.q dD ]}|�d||g� q2q |S )N)rI r. rJ r� )r[ r\ r] r| r� r� r� )r_ r� r} �flagrA rA rB �build_flush_rules6 s zip4tables.build_flush_rulesc C s� g }|dkrdn|}t �� D ]t}| �|�s,q |dkr6q t | D ]P}|dkrv|| }|dkrz|�d|d|ddg� d}n|}|�d|d ||g� q>q |S ) NZPANIC�DROPr% r& r� r� r1 �-jrK )r| r� r� r� )r_ �policyZpolicy_detailsr� �_policyr} r~ r� rA rA rB �build_set_policy_rulesE s z ip4tables.build_set_policy_rulesc C s g }d}z"| � d| jdkr dnddg�}W nL tyv } z4| jdkrTt�d| � nt�d| � W Y d }~n d }~0 0 |�� }d }|D ]�}|r�|�� �� }|�� }|D ]<} | � d �r�| � d �r�| d d� } n| } | |vr�|� | � q�| jdkr�|� d��s| jdkr�|� d�r�d}q�|S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr �-pr( r* r+ z--helpziptables error: %szip6tables error: %sNF�(�)rw r� zValid ICMP Types:r) zValid ICMPv6 Types:T) r� rR rE r r� � splitlines�strip�lower�splitr� r� r� ) r_ rR rv r� �exr� Zin_typesr� Zsplitsr� rF rA rA rB �supported_icmp_typesX s< � $ ��z ip4tables.supported_icmp_typesc C s g S rb rA rf rA rA rB �build_default_tablesy s z ip4tables.build_default_tablesr� c C s� i }| � d�rlg |d< t� | jd< td D ]@}|d �d| � |d �d||f � | jd �d| � q*| � d��r@g |d< t� | jd< td D ]�}|d �d| � |d �d||f � | jd �d| � |dkr�dD ]8}|d �d||f � | jd �td ||f g�� q�d D ] }|d �d |||f � �q q�| � d ��rg |d < t� | jd < td D ]�}|d �d| � |d �d||f � | jd �d| � |dk�rhdD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q��qh| � d ��rPg |d < t� | jd < td D �] }|d �d| � |d �d||f � | jd �d| � |dv �r�dD ]R}|d �d||f � | jd �td ||f g�� |d �d |||f � �q�nddD ]:}|d �d||f � | jd �td ||f g�� �q�d D ] }|d �d |||f � �q,�qBg |d< t� | jd< |d �d� |d �d� |dk�r�|d �d� |d �d� |d �d� |d �d� | jd �td�� dD ]0}|d �d| � | jd �td| �� �q�d D ]}|d �d| � �q|dk�rB|d �d � |d �d � |d �d � |d �d � |dk�r�|d �d � |d �d!� |d �d"� |d �d#� | jd �td$�� d%D ]0}|d �d&| � | jd �td'| �� �q�d D ]B}|d �d&| � |d �d(| � | jd �td'| �� �q�d)D ]0}|d �d&| � | jd �td'| �� �qD|dk�r�|d �d*� |d �d+� |d g d,�7 < | jd �td-�� d%D ]B}|d �d.| � |d �d/| � | jd �td0| �� �q�d)D ]B}|d �d.| � |d �d/| � | jd �td0| �� �qg }|D ]>}|| � � v�rr�q\|| D ] }|�d1|gt|� � �qz�q\|S )2Nr" z -N %s_directz-A %s -j %s_directz %s_directr# r )� POLICIES_pre�ZONES� POLICIES_postz-N %s_%s�%s_%s)r� z-A %s -j %s_%sr$ r% )r )r� r� r& zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_direct)r� z -N FORWARD_%sz FORWARD_%sz-A FORWARD -j FORWARD_%s)r� z;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sr� )r� rL r^ r| r� r� �updater )r_ r� Z default_rulesr~ Zdispatch_suffixZfinal_default_rulesr} rx rA rA rB �build_default_rules} s� " " z ip4tables.build_default_rulesc C sd |dkrddhS |dkr*d| � � v r*dhS |dkrFd| � � v rFddhS |dkr`d| � � v r`dhS i S ) Nr& r r r$ r r% r! r# )r� )r_ r} rA rA rB �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j j�|���jdk r dnd��dkr4�dkr4dnd} | j j�|�t| �� g } g } |D ]} | �d| g� qX|D ]} | �d | g� qp|D ]8} | j j�| �}|d v r�| � |�s�q�| �| � d | �� q�|D ]J} | j j�| �}|d v r�| � |�s�q�t | �r��d v r�q�| �| � d | �� qƇ �����fdd�}g }| �r|| D ]B}| �r^| D ]}|�|||�� �qDn|�rfn|�||d �� �q6nD|�r�n<| �r�| D ]}|�|d |�� �q�n|�r�n|�|d d �� |S )Nr �pre�postr% r! TF�-i�-or' �-s�r! r r �-dc sV ddd�� }d�|d��f d�j g}| r6|�| � |rD|�|� |�d� g� |S )Nr1 r, �TFr� z%s_POLICIES_%sr� r� )r� �extend)�ingress_fragment�egress_fragment�add_delrx �r� r~ � chain_suffix�enable�p_objr} rA rB � _generate_policy_dispatch_rule* s � zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) rQ r� � get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXr� r� � check_source�is_ipv_supported�_rule_addr_fragmentr )r_ r r� r} r~ Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrR r r� r� r� rA r� rB �!build_policy_ingress_egress_rules sR z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr|dkrdnd}| j jj||t|d�} dddddd�| } d } |r^|s^d d | d g} n,|rpd d | g} ndd | g} |s�| d g7 } | d|| || | g7 } | gS )Nr% r! TF�r r� r� �r r! r r r �-gr3 �%s_ZONESr� r1 r, r� )rQ r� r r ) r_ r r� r� r r} r~ r� r r� r� �actionrx rA rA rB �!build_zone_source_interface_rulesZ s( �� z+ip4tables.build_zone_source_interface_rulesc C s� |� d�rP|dd � }|dkr$d}nd}d�|g| jj�|� �}ddd ||gS t|�rz|dkrjttd ��dd d |�� gS t d |�r�t |�}n,t d |�r�|� d�}t |d �d |d }||gS d S )Nzipset:� r� �dst�src�,r� rL � --match-setz Can't match a destination MAC.�mac� --mac-sourcer) �/r rw ) r� rs rQ �ipsetZ get_dimensionr r r �upperr r r r� )r_ r� �address�invertr� �flags� addr_splitrA rA rB r s s" z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d d d d d �| } t|�rd|d v rdg S |d | d|d|g} | �| �| |�� | �d| g� | gS )Nr3 r, r� r% r! TFr r� r� r r� r r� r� r )rQ r� r r r r� r ) r_ r r� r� r r} r~ r� r r� r� rx rA rA rB � build_zone_source_address_rules� s" �� z)ip4tables.build_zone_source_address_rulesc C s� ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d �}| j j�|�} | j| �t|d | d | d | d| d| g�� g } | �||d|g� | �|d | d|g� | �|d | d|g� | �|d | d|g� | �|d| d|g� | �|d| d|g� | j �r6| �||d|dd|df g� | �||d|dd | g� | �||d|dd | g� | �||d|dd | g� | �||d|dd| g� | �||d|dd| g� | j �r�| �||d|dd|df g� | j jj | j } | j � � dk�rb|dk�rb| t ddfv �r8| �||d|ddddd | g � | d k�rb| �||d|ddddd | g � |dk�r�| t d ddd fv �r�| t fv �r�d} n| } | �||d|d| g� |�s�| �� | S ) Nr5 r. r� r1 r, r% r! TFr z%s_log�%s_denyz%s_prez%s_post�%s_allowr� r� r� r� r� r� r& r� r� r� �LOG� --log-prefixz %s_REJECT: r� z %s_DROP: �ACCEPT)rQ r� r r r r^ r� rL r� Zderived_from_zoneZ _policies�target�get_log_deniedr �reverse) r_ r r� r} r~ Z add_del_chainZ add_del_ruler r� r r� r( �_targetrA rA rB �build_policy_chain_rules� sf � � � � z"ip4tables.build_policy_chain_rulesc C s |rddd|j gS g S )Nr� �limitz--limit)�value)r_ r- rA rA rB � _rule_limit� s zip4tables._rule_limitc C s� t |j�ttttfv rn<|jrJt |j�ttt t fvrTt t dt |j� ��n t t d��|j dkr�t |j�tttfv s�t |j�tt fv r�dS t |j�tfv s�t |j�tt fv r�dS n|j dk r�dS dS d S )N�Unknown action %szNo rule action specified.r �allowZdenyr� r� )r� r� r r r r r r r r r r r r� �r_ � rich_rulerA rA rB �_rich_rule_chain_suffix� s$ �� z!ip4tables._rich_rule_chain_suffixc C s: |j s|jsttd��|jdkr$dS |jdk r2dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� r2 rA rA rB � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr r� )r� r2 rA rA rB � _rich_rule_priority_fragment s z&ip4tables._rich_rule_priority_fragmentc C s" |j s g S | jj�||t�}ddd�| }| �|�}d||d||f g} | | �|�7 } t|j �tkr�| |ddg 7 } |j j r�| d|j j g7 } |j j r�| d d |j j g7 } |j j r�| d |j j g7 } nJ| |dd g 7 } |j j r�| d d |j j g7 } |j j �r | dd |j j g7 } | | � |j j�7 } | S )Nr1 r, r� r� r� r� ZNFLOGz --nflog-groupz--nflog-prefixrh z--nflog-thresholdr% r& z --log-level)r rQ r� r r r6 r7 r� r �group�prefixZ threshold�levelr/ r- ) r_ r� r3 r r} � rule_fragmentr� r� r rx rA rA rB �_rich_rule_log s, zip4tables._rich_rule_logc C s� |j s g S ddd�| }| jj�||t�}| �|�}d||d||f g} | | �|�7 } | |7 } t|j�t krrd} n,t|j�t kr�d} nt|j�t kr�d} nd } | d d d | g7 } | | � |j j �7 } | S ) Nr1 r, r� r� r� ZacceptZrejectZdrop�unknownr� ZAUDITz--type)r5 rQ r� r r r6 r7 r� r r r r r/ r- ) r_ r� r3 r r} r; r� r� r rx Z_typerA rA rB �_rich_rule_audit" s$ zip4tables._rich_rule_auditc C s2 |j s g S ddd�| }| jj�||t�}| �|�}d||f } t|j �tkrXddg} n�t|j �tkr�ddg} |j jr�| d|j jg7 } nnt|j �t kr�dd g} nVt|j �t kr�d }| jj�||t�}d||f } dd d |j j g} nt t d t|j � ��d||| g} | | �|�7 } | || 7 } | | �|j j�7 } | S )Nr1 r, r� r� r� r' r� r� r� r$ �MARKz --set-xmarkr0 r� )r rQ r� r r r4 r� r r r r rL r r r7 r/ r- ) r_ r� r3 r r} r; r� r� r r~ Z rule_actionrx rA rA rB �_rich_rule_action; s6 � zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }q�td|j �r||j �d�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|�d� | jj � |jd �}|d |j|g7 }|S ) N�!r) r� r r rw r� rL r r ) r r r� r r r r� r rQ r� �_ipset_match_flags)r_ Z rich_destr; r! r rA rA rB � _rich_rule_destination_fragment] s& " z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|�d� td|j �rB|dt|j �g7 }nHtd|j �r||j �d�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|�d� |d |jg7 }nRt|d ��r|j �r|dd g7 }|jr�|�d� | j j � |j d �}|d |j |g7 }|S )NrA r) r� r r rw r r� r r rL r r ) r r r� r r r r� �hasattrr r rQ r� rB )r_ Z rich_sourcer; r! r rA rA rB �_rich_rule_source_fragmentu s0 " z$ip4tables._rich_rule_source_fragmentc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr1 r, r� r& r� �--dportrh r� r$ r� r� r' � rQ r� r r r rC � destinationrE �sourcer� r< r> r@ � r_ r r� �proto�portrH r3 r� r} r� r; r� rA rA rB �build_policy_ports_rules� s, ��z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j j�||t�}d|g} |r<| d|g7 } |r`| | �|j�7 } | | �|j�7 } g } |r�| �| � ||||| �� | �| � ||||| �� | �| � ||||| �� n"| �|d| d|g| d d g � | S ) Nr1 r, r� r& r� r� r$ r� r� r' ) rQ r� r r rC rH rE rI r� r< r> r@ ) r_ r r� �protocolrH r3 r� r} r� r; r� rA rA rB �build_policy_protocol_rules� s( ��z%ip4tables.build_policy_protocol_rulesc C s� d}d}| j j�||t�}ddd�| } g d�} |rl| �|�}| | �|�7 } | | �|j�7 } | | �|j �7 } |dks||d u r�| g d�7 } n| d d d |g7 } d d| d ||f g| gS )Nr1 r& r1 r, r� )r� Ztcpz --tcp-flagszSYN,RSTZSYNZpmtu)r� �TCPMSSz--clamp-mss-to-pmtur� rP z --set-mssr� r� ) rQ r� r r r4 r7 rC rH rE rI ) r_ r r� Ztcp_mss_clamp_valuerH r3 r r} r� r� r; rA rA rB � build_policy_tcp_mss_clamp_rules� s z*ip4tables.build_policy_tcp_mss_clamp_rulesc C s� ddd�| }d}| j j�||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | �|j�7 } | | �|j�7 } g } |r�| � | � ||||| �� | � | � ||||| �� | � | � ||||| �� n"| � |d | d |g| d d g � | S ) Nr1 r, r� r& r� z--sportrh r� r$ r� r� r' rG rJ rA rA rB � build_policy_source_ports_rules� s, ��z)ip4tables.build_policy_source_ports_rulesc C sv d}| j j�||t�} ddd�| } | d| ddd|g} |rP| dd t|� g7 } |r`| d |g7 } | d d d |g7 } | gS )Nr# r1 r, r� r$ r� r� rF rh r� r� ZCTz--helper)rQ r� r r r ) r_ r r� rK rL rH Z helper_nameZmodule_short_namer} r� r� rx rA rA rB � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j j�||t�}g } |rH| �dd|d| d|dd g� n6t|�rTg S | �dd|d| g| �d |� dd g � | S ) Nr1 r, r� r� r& r$ r� r� r' r� )rQ r� r r r� r r ) r_ r r� r� r} r rI r� r� r� rA rA rB �build_zone_forward_rules� s � ��z"ip4tables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|rj| �|�}|| �|�7 }|| �|j�7 }|| �|j �7 }nd}g } | � dd|d ||f g| g d � � | S ) Nr% Tr r1 r, r� r1 r� r� )rA r� �lor� Z MASQUERADE) rQ r� r r r4 r7 rC rH rE rI r� ) r_ r r� r3 r} r� r� r; r r� rA rA rB � build_policy_masquerade_rules s" ��z'ip4tables.build_policy_masquerade_rulesc C s d}| j j�||t�} ddd�| } d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| �|�} | �|�} | | � |j �7 } | | � |j �7 } nd } g }|r�|� | �|||d| �� |� d d| d | | f g| d |dt|�ddd| g � |S )Nr% r1 r, r� r r) z[%s]z:%s�-r1 r� r� r� rF r� ZDNATz--to-destination)rQ r� r r r r r r4 r7 rC rH rE rI r� r< )r_ r r� rL rN ZtoportZtoaddrr3 r} r� r� �tor; r r� rA rA rB � build_policy_forward_port_rules' s8 � ��z)ip4tables.build_policy_forward_port_rulesc C s� d}| j j�||t�}ddd�| }| jdkrFddg}ddd |jg} ndd g}dd d |jg} g } | j j�|�r|d | } d} n d| } d} g } |r�| | �|j�7 } | | � |j �7 } | || 7 } |�rP| � | � ||||| �� | � | � ||||| �� |j�r| � | �||||| �� n:| �|�}| � d||d||f g| �|� | ddg � n`| j �� dk�r�| dk�r�| � || d|g| ddddd| g � | � || d|g| d| g � | S )Nr& r1 r, r� r( r� r* r� z --icmp-typer+ Zicmp6z --icmpv6-typer$ r' r# r� r� r� r� r� r� r% r& �%s_ICMP_BLOCK: )rQ r� r r rR r� �query_icmp_block_inversionrC rH rE rI r� r< r> r r@ r4 r7 r) )r_ r r� Zictr3 r} r� r� rK �matchr� Z final_chainZ final_targetr; r rA rA rB � build_policy_icmp_block_rulesI s\ ��������z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j j�||t�}g }d}| j j�|�r�d}| j �� dkr�|rRd|t|�g}nd|g}|d|dd d d d d d| g }|�|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|�|� |S )Nr& � r� r� r3 r, r� r� r� r� r� r% r& rZ rw r' )rQ r� r r r[ r) r� r� ) r_ r r� r} r� r� Zrule_idxZ ibi_targetrx rA rA rB �'build_policy_icmp_block_inversion_rulesz s0 � z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| � |j�7 }|| �|j�7 }g }|�| �|||||�� |�| �|||||�� |�| �|||||�� |S )Nr& )rC rH rE rI r� r< r> r@ )r_ r r� r3 r} r; r� rA rA rB �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS rb )rR )r_ rR rA rA rB r � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)NN)N)N)N)8�__name__� __module__� __qualname__rR r� Zpolicies_supportedra rY r� r{ r r� r� r� r� r� r� r� r� r� r� r� rU rW r� r� r� r� r� r� r r r r" r, r/ r4 r6 r7 r< r> r@ rC rE rM rO rQ rR rS rT rV rY r] r_ r` r rA rA rA rB rP � sr &Pa# ! N � 9 " � � " 1"rP c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr) Fc C s~ g }g d�}| j jdkr"|dg7 }|�g d�| ddg � |dkr^|�g d�| g d� � |�g d �� |�g d �� |S ) N)r� Zrpfilterz--invertz --validmarkZloosez--loose)r3 r r� r$ r� r� r� )r� r% r& zrpfilter_DROP: ) r3 r r� r$ r� r+ z$--icmpv6-type=neighbour-solicitationr� r' ) r3 r r� r$ r� r+ z"--icmpv6-type=router-advertisementr� r' )rQ Z_ipv6_rpfilterr� )r_ r� r� Zrpfilter_fragmentrA rA rB �build_rpfilter_rules� s$ �� ��z ip6tables.build_rpfilter_rulesc C s� g d�}d}| j d �|� g }|�ddd|g� |D ]L}|�ddd|d|dd d d g � | jjd v r6|�ddd|d|dd ddg � q6|�dddddd|g� |�dddd| j�� dkr�dndd|g� |S )N) z ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r& r� r5 r3 r� r� r� r� z addr-unreach)r� �allr% r& zRFC3964_IPv4_REJECT: r �4r r� �6�5)r^ r� r� rQ Z _log_deniedr) )r_ Z daddr_listZ chain_namer� ZdaddrrA rA rB �build_rfc3964_ipv4_rules� s. � �� �z"ip6tables.build_rfc3964_ipv4_rulesN)F)ra rb rc rR r� re rj rA rA rA rB rd � s rd )/Zos.pathrc r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r Zfirewallr Zfirewall.errorsr r r r r Zfirewall.core.richr r r r r r r r r Zfirewall.core.baser r� r r| r� r� rC rG rO �objectrP rd rA rA rA rB �<module> sJ ( , � ��%*