| Disable Functions: Path : /lib/python2.7/site-packages/firewall/core/ |
| Current File : //lib/python2.7/site-packages/firewall/core/ipXtables.pyc |
�
�c�`c @ s� d d l Z d d l Z d d l m Z m Z d d l m Z d d l m Z d d l
m Z m Z m
Z
m Z m Z m Z m Z m Z d d l m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z d d l Z i d d
d g d 6d
d
g d 6d
d d d
d g d 6d
d d
g d 6d d
d g d 6Z i d d 6d d 6Z i d d 6d d 6Z! d � Z" d � Z# d � Z$ d e% f d � � YZ& d e& f d � � YZ' d S( i����N( t SHORTCUTSt DEFAULT_ZONE_TARGET( t runProg( t log( t tempFilet readfilet splitArgst check_mact portStrt check_single_addresst
check_addresst normalizeIP6( t config( t
FirewallErrort INVALID_PASSTHROUGHt INVALID_RULE( t Rich_Acceptt Rich_Rejectt Rich_Dropt Rich_Markt INPUTt OUTPUTt FORWARDt securityt
PREROUTINGt rawt POSTROUTINGt manglet natt filters icmp-host-prohibitedt ipv4s icmp6-adm-prohibitedt ipv6t icmps ipv6-icmpc C s� i d d 6d d 6d d 6d d 6d d 6d d
6} | } x� | D]� } y | j | � } Wn t k
rm q> n X| d k r� y t | | d � Wn t k
r� q� X| j | d � n | | | | <q> W| S(
s Inverse valid rule s -Ds -As --deletes --appends -Is --inserts -Xs -Ns --delete-chains --new-chaini ( s -Is --insert( t indext Exceptiont intt pop( t argst replace_argst ret_argst argt idx( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt common_reverse_rule7 s*
c C s� i d d 6d d 6d d 6d d 6d d 6d d
6} | } x� | D]� } y | j | � } Wn t k
rm q> n X| d k r� y t | | d � Wn t k
r� q� X| j | d � n | | | | <| SWt t d � � d
S( s Reverse valid passthough rule s -Ds -As --deletes --appends -Is --inserts -Xs -Ns --delete-chains --new-chaini s no '-A', '-I' or '-N' argN( s -Is --insert( R! t
ValueErrorR# R$ R
R ( R% R& R' t xR) ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt common_reverse_passthrough\ s.
c C s� t | � } t d d d d d d d d d d
d d d
d d d d d d d g � } t | | @� d k r� t t d t | | @� d � � n t d d d d d d g � } t | | @� d k r� t t d � � n d S( sZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) s -Cs --checks -Ds --deletes -Rs --replaces -Ls --lists -Ss --list-ruless -Fs --flushs -Zs --zeros -Xs --delete-chains -Ps --policys -Es --rename-chaini s arg '%s' is not alloweds -As --appends -Is --inserts -Ns --new-chains no '-A', '-I' or '-N' argN( t sett lenR
R t list( R% t not_allowedt needed( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt common_check_passthrough� s* t ip4tablesc B s� e Z d Z d Z e Z d � Z d � Z d � Z d. d � Z
d � Z d � Z d � Z
d � Z d
� Z d � Z d � Z d
� Z d � Z d � Z d � Z d. d � Z d � Z d � Z d � Z d � Z d � Z d � Z d d � Z d � Z e d � Z d � Z! d � Z" d � Z# d � Z$ d � Z% d! � Z& d" � Z' d# � Z( d. d. d$ � Z) d. d. d% � Z* d. d. d& � Z+ d' � Z, d. d( � Z- d. d) � Z. d. d* � Z/ d+ � Z0 d, � Z1 d- � Z2 RS(/ R R4 c C sz | | _ t j | j | _ t j d | j | _ | j � | _ | j � | _ | j
� g | _ g | _ i | _
d S( Ns
%s-restore( t _fwR t COMMANDSt ipvt _commandt _restore_commandt _detect_wait_optiont wait_optiont _detect_restore_wait_optiont restore_wait_optiont fill_existst available_tablest zone_source_index_cachet
our_chains( t selft fw( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt __init__� s
c C s4 t j j | j � | _ t j j | j � | _ d S( N( t ost patht existsR8 t command_existsR9 t restore_command_exists( RB ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR> � s c C s� | j rB | j | k rB | j g g | D] } d | ^ q( } n g | D] } d | ^ qI } t j d | j | j d j | � � t | j | � \ } } | d k r� t d | j d j | � | f � � n | S( Ns %ss %s: %s %st i s '%s %s' failed: %s( R; R t debug2t __class__R8 t joinR R+ ( RB R% t itemt _argst statust ret( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt __run� s * % c C s� | d k r | Sg } x� | D]� } t } x� | D]� } y | j | � } Wn t k
r\ q0 Xt | � | k r0 d | | d k r0 t } | | d j d � } x3 | D]( } | }
| |
| d <| j |
� q� Wq0 q0 W| s | j | � q q W| S( s5 Split values combined with commas for options in optst ,i N( t Nonet FalseR! R+ R/ t Truet splitt append( RB t rulest optst out_rulest rulet processedt optt it itemsRN t _rule( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt split_value� s(
&
c C sA y | j | � } Wn t k
r' t SX| | | | d +t Sd S( Ni ( R! R+ RU RV ( RB R\ t patternt replacementR_ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
_rule_replace� s
c C s | t k o | t | k S( N( t BUILT_IN_CHAINS( RB R7 t tablet chain( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt is_chain_builtin� s c C sC d | g } | r" | j d � n
| j d � | j | � | g S( Ns -ts -Ns -X( RX ( RB t addRg Rh R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_chain_rules� s
c C sL d | g } | r. | d | t | � g 7} n | d | g 7} | | 7} | S( Ns -ts -Is -D( t str( RB Rj Rg Rh R! R% R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
build_rule� s
c C s
t | � S( N( R* ( RB R% ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt reverse_rule s c C s t | � d S( N( R3 ( RB R% ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt check_passthrough s c C s
t | � S( N( R- ( RB R% ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt reverse_passthrough
s c C s� d } y | j d � } Wn t k
r, n( Xt | � | d k rT | | d } n d } xn d d d d d d g D]T } y | j | � } Wn t k
r� qs Xt | � | d k rs | | d } qs qs W| | f S(
NR s -ti s -As --appends -Is --inserts -Ns --new-chain( R! R+ R/ RT ( RB R% Rg R_ Rh R^ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt passthrough_parse_table_chain
s$
c C s� yb | j d � } | j | � | j | � } d | d k rQ | | d f } n | | d f } WnL t k
r� y& | j d � } | j | � d } Wq� t k
r� d SXn Xt } | d d k r� t } n | r� | r� | | k r�| j | � q�n� | r�| rI| | k r7| j | � | j d
d � � n | j | � } n! | j j
r^d } n t | � } d | d <| j d
d | d � n d S( Ns %%ZONE_SOURCE%%s -mi i i s %%ZONE_INTERFACE%%i s -Ds --deletet keyc S s | d S( Ni ( ( R, ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt <lambda>@ s s -Ii s %di ( s -Ds --delete(
R! R$ R+ RT RV RU t removeRX t sortR5 t _allow_zone_driftingR/ t insert( RB R\ R@ R_ t zonet zone_sourcet rule_addR! ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _run_replace_zone_source# s>
c C s# t � } i } t j | j � } x�| D]�} | } | j | d d d t | j g � | j | d t | j g � y | j d � } Wn t k
r� nL X| d k r� q( n | d& k r� d
d d | g | | | d
+n
| j
| � | j | | � d } xp d d g D]b }
y | j |
� } Wn t k
r6q
Xt | � | d
k r
| j
| � | j
| � } q
q
Wxz t
t | � � D]f } x] t j D]R } | | | k r�| | j d � o�| | j d � r�d | | | | <q�q�Wq�W| j | g � j | � q( Wx� | D]� } | | } | j | d d g � } | j | d d g � } | j d | � x( | D] } | j d j | � d � qiW| j d � qW| j � t j | j � } t j d | j | j d | j | j f � g }
| j r|
j | j � n |
j d � t! | j |
d | j �\ } } t j" � d k r�t# | j � } | d k r�d
} xc | D]X } t j% d | | f d! d
d" d# �| j d � s�t j% d$ d! d
�n | d
7} qpWq�n t j& | j � | d# k rt d% | j d j |
� | f � � n | | _ | S(' Ns
%%REJECT%%t REJECTs
--reject-withs %%ICMP%%s %%LOGTYPE%%t offt unicastt broadcastt multicasts -mt pkttypes
--pkt-typei R s -ts --tablet "s "%s"s -ss --sources -ds
--destinations *%s
RJ s
s COMMIT
s %s: %s %ss %s: %ds -nt stdini s %8d: %st nofmtt nli t s '%s %s' failed: %s( R~ R R� (' R t copyt deepcopyR@ Re t DEFAULT_REJECT_TYPER7 t ICMPR! R+ R$ R{ R/ t ranget stringt
whitespacet
startswitht endswitht
setdefaultRX Rb t writeRM t closeRE t statt nameR RK RL R9 t st_sizeR= R t getDebugLogLevelR RT t debug3t unlink( RB RY t
log_deniedt temp_filet table_rulesR@ Ra R\ R_ Rg R^ t cR� R% RP RQ t linest line( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt set_rulesL s�
#
# c C s� | j | d d d t | j g � | j | d t | j g � y | j d � } Wn t k
rf nJ X| d k rw d S| d k r� d d d
| g | | | d +n
| j | � t j | j � } | j
| | � | j | � } | | _ | S( Ns
%%REJECT%%R| s
--reject-withs %%ICMP%%s %%LOGTYPE%%R} R� R~ R R� s -mR� s
--pkt-typei ( s unicasts broadcasts multicast( Re R� R7 R� R! R+ R$ R� R� R@ R{ t _ip4tables__run( RB R\ R� R_ R@ t output( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt set_rule� s"
c C s� g } | r | g n t j � } x� | D]� } | | j k rM | j | � q( y: | j d | d d g � | j j | � | j | � Wq( t k
r� t j d | j | f � q( Xq( W| S( Ns -ts -Ls -nsA %s table '%s' does not exist (or not enough permission to check).( Rf t keysR? RX R� R+ R t debug1R7 ( RB Rg RQ t tables( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt get_available_tables� s
"c C s� d } t | j d d d g � } | d d k r� d } t | j d d d g � } | d d k rk d } n t j d | j | j | � n | S( NR� s -ws -Ls -ni s -w10s %s: %s will be using %s option.( R R8 R RK RL ( RB R; RQ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR: � s c C s� t � } | j d � | j � d } xl d d g D]^ } t | j | g d | j �} | d d k r3 d | d k r3 d | d k r3 | } Pq3 q3 Wt j d
| j | j | � t j
| j � | S( Ns #fooR� s -ws --wait=2R� i s invalid optioni s unrecognized options %s: %s will be using %s option.( R R� R� R R9 R� R RK RL RE R� ( RB R� R; t test_optionRQ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR< � s
c C so g | _ g } xY t j � D]K } | j | � s7 q n x- d d d g D] } | j d | | g � qG Wq W| S( Ns -Fs -Xs -Zs -t( R@ Rf R� R� RX ( RB RY Rg t flag( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_flush_rules� s c C sy g } xl t j � D]^ } | j | � s. q n | d k r@ q n x. t | D]" } | j d | d | | g � qK Wq W| S( NR s -ts -P( Rf R� R� RX ( RB t policyRY Rg Rh ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_set_policy_rules s $c
C s{ g } d } y1 | j d | j d k r- d n d d g � } WnG t k
r� } | j d k rr t j d | � q� t j d | � n X| j � } t } x� | D]� } | r.| j � j � } | j � } xa | D]V } | j
d � r| j d
� r| d d !} n | } | | k r� | j | � q� q� Wn | j d k rL| j
d
� sj| j d k r� | j
d � r� t
} q� q� W| S( sQ Return ICMP types that are supported by the iptables/ip6tables command and kernelR� s -pR R s ipv6-icmps --helps iptables error: %ss ip6tables error: %st (t )i i����s Valid ICMP Types:R s Valid ICMPv6 Types:( R� R7 R+ R R� t
splitlinesRU t stript lowerRW R� R� RX RV (
RB RQ R� t exR� t in_typesR� t splitsRW R, ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt supported_icmp_types s4
c C s g S( N( ( RB ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_default_tables/ s R} c C s> i } | j d � r� g | d <t � | j d <x] t d D]N } | d j d | � | d j d | | f � | j d j d | � q: Wn | j d � r�g | d <t � | j d <x� t d D]� } | d j d | � | d j d | | f � | j d j d | � | d k r� x� | j j r8d d g n d g D]f } | d j d | | f � | d j d
| | | f � | j d j t d | | f g � � q?Wq� q� Wn | j d � r�g | d <t � | j d <x� t d D]� } | d j d | � | d j d | | f � | j d j d | � | d k r�x� | j j r\d d g n d g D]f } | d j d | | f � | d j d
| | | f � | j d j t d | | f g � � qcWq�q�Wn | j d
� r�g | d
<t � | j d
<x� t d
D]� } | d
j d | � | d
j d | | f � | j d
j d | � | d0 k r x� | j j r�d d g n d g D]f } | d
j d | | f � | d
j d
| | | f � | j d
j t d | | f g � � q�Wq q Wn g | d <t � | j d <| d j d � | d j d � | d j d � | d j d � | j d j t d � � xq | j j r�d d g n d g D]N } | d j d | � | d j d | � | j d j t d | � � q�W| d k r| d j d � n | d j d � | d k r8| d j d � n | d j d � | d j d � | d j d � | d j d � | d j d � | j d j t d! � � x� d" d# g D]� } x� | j j r�d d g n d g D]` } | d j d$ | | f � | d j d% | | f � | j d j t d& | | f � � q�Wq�W| d k rd| d j d' � n | d j d( � | d k r�| d j d) � n | d j d* � | d c d+ d, d- g 7<| j d j t d. � � g } xX | D]P } | | j � k rq�n x/ | | D]# } | j d/ | g t | � � qWq�W| S(1 NR s -N %s_directs -A %s -j %s_directs %s_directR R t ZONES_SOURCEt ZONESs -N %s_%ss -A %s -j %s_%ss %s_%sR R R R s= -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs -A INPUT -i lo -j ACCEPTs -N INPUT_directs -A INPUT -j INPUT_directt INPUT_directs -N INPUT_%ss -A INPUT -j INPUT_%ss INPUT_%sR} s^ -A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's/ -A INPUT -m conntrack --ctstate INVALID -j DROPs9 -A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's -A INPUT -j %%REJECT%%s? -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs -A FORWARD -i lo -j ACCEPTs -N FORWARD_directs -A FORWARD -j FORWARD_directt FORWARD_directt INt OUTs -N FORWARD_%s_%ss -A FORWARD -j FORWARD_%s_%ss
FORWARD_%s_%ss` -A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's1 -A FORWARD -m conntrack --ctstate INVALID -j DROPs; -A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 's -A FORWARD -j %%REJECT%%s -N OUTPUT_directs -A OUTPUT -o lo -j ACCEPTs -A OUTPUT -j OUTPUT_directt
OUTPUT_directs -t( R R (
R� R. RA Rf RX Rj R5 Rv t updateR ( RB R� t
default_rulesRh t dispatch_suffixt directiont final_default_rulesRg R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_default_rules3 s�
( 5
( 5
( 5
(" (,
%c C s� | d k r d d d h S| d k rS d | j � k rS d | j � k rS d h Sn | d k r~ d | j � k r~ d d h Sn | d k r� d | j � k r� d h Sn i S(
NR R t
FORWARD_INt FORWARD_OUTR R R R R ( R� ( RB Rg ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt get_zone_table_chains� s
c C s� i d d 6d d 6d d 6d d 6d d 6d d 6| } t j d t | d
| � } d } | ry | ry d d
| d g }
n? | r� d d
| g }
n& d d
| g }
| s� |
d g 7}
n |
d | | | | | g 7}
|
g S( Ns -iR s -oR R R� R� R Rh Rx s -gs -Is %s_ZONESs %%ZONE_INTERFACE%%s -As -Ds -t( R t formatR ( RB t enableRx t interfaceRg Rh RX R^ t targett actionR\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt! build_zone_source_interface_rules� s&
c
C s� i d t 6d t 6| } i d d 6d d 6d d 6d d 6d d 6d d
6| } | j j re d | } n
d | } t j d
t | d | � } d }
| j d � r| d } | d k r� d } n d } d j | g | j j j
| � � } | | d | d | d d d | | |
| g
}
n� t | � ri| d k r6d S| | d | d | d d d | j � |
| g }
n t
d | � r�t | � } n= t d | � r�| j d � } t | d � d | d } n | | d | d | | | |
| g
}
|
g S(! Ns -Is -Ds -sR s -dR R R� R� R s %s_ZONES_SOURCEs %s_ZONESRh Rx s -gs ipset:i t dstt srcRS s %%ZONE_SOURCE%%s -ts -mR. s --match-setR� t macs --mac-sourceR t /i i ( RV RU R5 Rv R R� R R� RM t ipsett
get_dimensionR t upperR R R
RW ( RB R� Rx t addressRg Rh t add_delR^ t zone_dispatch_chainR� R� R� t flagsR\ t
addr_split( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_source_address_rules� sV
% c C s6 t j d t | d | � } | j | j t | d | d | d | g � � g } | j d | d | g � | j d d | d | g � | j d d | d | g � | j d d | d | g � | j d | d | d d | g � | j d | d | d d | g � | j d | d | d d | g � | j j j | j
} | j j � d
k r�| d k r�| d k r�| d k r�| j d | d | d d d d d | g � n | d k r�| j d | d | d d d d d | g � q�q�n | d k r2| d k r2| d k r2| j d | d | d | g � n | S( NRh Rx s %s_logs %s_denys %s_allows -Ns -ts -As -jR} R R R� R� R R| s
%%REJECT%%s %%LOGTYPE%%t LOGs --log-prefixs
"%s_REJECT: "t DROPs "%s_DROP: "t ACCEPT( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( s REJECTs
%%REJECT%%( R� s REJECTs
%%REJECT%%R� ( s INPUTs
FORWARD_INs FORWARD_OUTs OUTPUT( R R� R RA R� R. RX R5 Rx t _zonesR� t get_log_denied( RB Rx Rg Rh t _zoneRY R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_chain_rules� s< ### "c C s | r d d d | j g Sg S( Ns -mt limits --limit( t value( RB R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rule_limit* s c C s� | j s
g Si d t 6d t 6| } | d | d | g } | | d d g 7} | j j rx | d d | j j g 7} n | j j r� | d d
| j j g 7} n | | j | j j � 7} | S( Ns -As -Ds %s_logs -ts -jR� s --log-prefixs '%s's --log-levels %s( R RV RU t prefixt levelR� R� ( RB t rich_ruleR� Rg R� t
rule_fragmentR� R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_log/ s c C s� | j s
g Si d t 6d t 6| } | d | d | g | } t | j � t k r] d } nB t | j � t k r{ d } n$ t | j � t k r� d } n d } | d d
d | g 7} | | j | j j � 7} | S( Ns -As -Ds %s_logs -tt acceptt rejectt dropt unknowns -jt AUDITs --type(
t auditRV RU t typeR� R R R R� R� ( RB R� R� Rg R� R� R� R\ t _type( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_audit? s c C s� | j s
g Si d t 6d t 6| } t | j � t k rS d | } d d g } n� t | j � t k r� d | } d d g } | j j rL| d | j j g 7} qLn� t | j � t k r� d | } d d g } nx t | j � t k r0t j d
t
d d | � } d
} d | } d d d | j j g } n t t
d t | j � � � | | d | g }
|
| | 7}
|
| j | j j � 7}
|
S( Ns -As -Ds %s_allows -jR� s %s_denyR| s
--reject-withR� Rh R Rx R t MARKs --set-xmarks Unknown action %ss -t( R� RV RU R� R R R R R R� R R. R
R R� R� ( RB Rx R� R� Rg R� R� R� Rh t rule_actionR\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_actionS s4
c C s� | s
g Sg } | j r) | j d � n t d | j � rW | d t | j � g 7} n` t d | j � r� | j j d � } | d t | d � d | d g 7} n | d | j g 7} | S( Nt !R s -dR� i i ( t invertRX R t addrR R
RW ( RB t rich_destR� R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_destination_fragmentt s )c C s� | s
g Sg } | j r� | j r2 | j d � n t d | j � r` | d t | j � g 7} q�t d | j � r� | j j d � } | d t | d � d | d g 7} q�| d | j g 7} n� t | d � r| j r| d d g 7} | j r| j d � n | d | j g 7} nu t | d
� r�| j r�| d d g 7} | j r[| j d � n | j
j j | j d � } | d
| j | g 7} n | S( NR� R s -sR� i i R� s -ms --mac-sourceR� R. R� s --match-set(
R� R� RX R R R
RW t hasattrR� R� R5 Rx t _ipset_match_flags( RB t rich_sourceR� R� R� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt _rich_rule_source_fragment� s0 ) c C s� i d t 6d t 6| } d } t j d t d d | � } d | g }
| ri |
d d t | � g 7}
n | r� |
d
| g 7}
n | r� |
| j | j � 7}
|
| j | j � 7}
n | s� t
| j � t k r� |
d d d
d g 7}
n g } | rd| j
| j | | | | |
� � | j
| j | | | | |
� � | j
| j | | | | | |
� � n+ | j
| d | d | g |
d d g � | S( Ns -As -DR Rh R Rx s -ps --dports %ss -ds -mt conntracks --ctstates
NEW,UNTRACKEDs %s_allows -ts -jR� ( RV RU R R� R R R� t destinationR� t sourceR� R� R RX R� R� R� ( RB R� Rx t protot portR� R� R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_ports_rules� s, ""(%c C sp i d t 6d t 6| } d } t j d t d d | � } d | g } | r_ | d | g 7} n | r� | | j | j � 7} | | j | j � 7} n | s� t | j
� t k r� | d d
d d g 7} n g }
| rA|
j | j
| | | | | � � |
j | j | | | | | � � |
j | j | | | | | | � � n+ |
j | d
| d | g | d d g � |
S( Ns -As -DR Rh R Rx s -ps -ds -mR� s --ctstates
NEW,UNTRACKEDs %s_allows -ts -jR� ( RV RU R R� R R� R� R� R� R� R� R RX R� R� R� ( RB R� Rx t protocolR� R� R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_protocol_rules� s& ""(%c C s� i d t 6d t 6| } d } t j d t d d | � } d | g }
| ri |
d d t | � g 7}
n | r� |
d
| g 7}
n | r� |
| j | j � 7}
|
| j | j � 7}
n | s� t
| j � t k r� |
d d d
d g 7}
n g } | rd| j
| j | | | | |
� � | j
| j | | | | |
� � | j
| j | | | | | |
� � n+ | j
| d | d | g |
d d g � | S( Ns -As -DR Rh R Rx s -ps --sports %ss -ds -mR� s --ctstates
NEW,UNTRACKEDs %s_allows -ts -jR� ( RV RU R R� R R R� R� R� R� R� R� R RX R� R� R� ( RB R� Rx R R R� R� R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_source_ports_rules� s* ""(%c C s� i d t 6d t 6| } t j d t d d | � } | d | d d d | g }
| rs |
d
d t | � g 7}
n | r� |
d | g 7}
n |
d
d d | g 7}
|
g S( Ns -As -DRh R Rx s %s_allows -tR s -ps --dports %ss -ds -jt CTs --helper( RV RU R R� R R ( RB R� Rx R R R� t helper_namet module_short_nameR� R� R\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_helper_ports_rules� s c C s; i d t 6d t 6| } t j d t d d | � } g } | ro | | j | j � 7} | | j | j � 7} n g } | j | d | d d g | d d
d d d
g � t j d t d d | � } g } | r | | j | j � 7} | | j | j � 7} n | j | d | d d g | d d d d d d g � | S( Ns -As -DRh R Rx s %s_allows -tR R� s -ot los -jt
MASQUERADER� R s -mR� s --ctstates
NEW,UNTRACKEDR� (
RV RU R R� R R� R� R� R� RX ( RB R� Rx R� R� R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_masquerade_rules s* c
C s� i d t 6d t 6| }
d | } d d d | g } d }
| rs t d | � rf |
d t | � 7}
qs |
| 7}
n | r� | d k r� |
d
t | d � 7}
n t j d t d
d | � } d | d t | � g } | r| | j | j � 7} | | j
| j � 7} n g } | r9| j | j
| | d | | � � n | j |
d | d d g | d d d | g � | j |
d | d d d | g | d d d |
g � t j d t | d | � } | j |
d | d d d d d d g | d d g � | S( Ns -As -Ds 0x%xs -mt marks --markR� R s [%s]s :%st -Rh R Rx s -ps --dportR s %s_allows -ts -jR� s
--set-markR t DNATs --to-destinationR R� s --ctstates
NEW,UNTRACKEDR� ( RV RU R R R R R� R R� R� R� R� RX R� ( RB R� Rx t filter_chainR R t toportt toaddrt mark_idR� R� t mark_strR
t toR� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_forward_port_rules s<
% 1c
C sX d } i d t 6d t 6| } | j d k rQ d d g } d d d | j g } n! d d g } d d
d | j g } g } x�d d
g D]�}
t j d t |
d | � } | j j j | � r� d | } d }
n d | } d }
g } | r| | j
| j � 7} | | j | j
� 7} n | | | 7} | r�| j | j | | | | | � � | j | j | | | | | � � | j r�| j | j | | | | | | � � qP| j | d | d | g | d d g � q� | j j � d k r)|
d k r)| j | | d | g | d d d d d | g � n | j | | d | g | d |
g � q� W| S( NR s -As -DR s -pR s -ms --icmp-types ipv6-icmpt icmp6s
--icmpv6-typeR R� Rh Rx s %s_allowR� s %s_denys
%%REJECT%%s -ts -jR} s %%LOGTYPE%%R� s --log-prefixs "%s_ICMP_BLOCK: "( RV RU R7 R� R R� R R5 Rx t query_icmp_block_inversionR� R� R� R� RX R� R� R� R� R� ( RB R� Rx t ictR� Rg R� R t matchRY Rh R� t final_chaint final_targetR� ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_zone_icmp_block_rulesI sL
"" (! c
C sB d } g } x/d d g D]!} d } t j d t | d | � } | j j j | � r� d } | j j � d k r� | r� d | t | � g } n d
| g } | d | d d
d d d d d | g } | j | � | d 7} q� n d } | rd | t | � g } n d
| g } | d | d d
d | g } | j | � q W| S( NR R R� i Rh Rx s
%%REJECT%%R} s -Is -Ds -ts -ps %%ICMP%%s %%LOGTYPE%%s -jR� s --log-prefixs "%s_ICMP_BLOCK: "i R� ( R R� R R5 Rx R R� Rl RX (
RB R� Rx Rg RY Rh t rule_idxR� t
ibi_targetR\ ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt% build_zone_icmp_block_inversion_rulesz s2
c C s� d } t j d t d d | � } g } | | j | j � 7} | | j | j � 7} g } | j | j | | | | | � � | j | j | | | | | � � | j | j
| | | | | | � � | S( NR Rh R Rx ( R R� R R� R� R� R� RX R� R� R� ( RB R� Rx R� Rg R� R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt( build_zone_rich_source_destination_rules� s ""%c C s
| | j k S( N( R7 ( RB R7 ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt is_ipv_supported� s N(3 t __name__t
__module__R7 R� RV t zones_supportedRD R> R� RT Rb Re Ri Rk Rm Rn Ro Rp Rq R{ R� R� R� R: R< R� R� R� R� R� R� RU R� R� R� R� R� R� R� R� R� R R R R R R R R R! R" ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR4 � s\
) ^
! i 7 , ! , 1 # t ip6tablesc B s e Z d Z d Z e d � Z RS( R R& c C s� g } | j d d d d d d d d d g � | d
k rk | j d d d d d d d d d d d
g � n | j d d d d d d d d d g � | j d d d d d d d d d g � | S( Ns -IR s -tR s -mt rpfilters --inverts -jR� R} R� s --log-prefixs rpfilter_DROP: s -ps ipv6-icmps$ --icmpv6-type=neighbour-solicitationR� s" --icmpv6-type=router-advertisement( RX ( RB R� RY ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt build_rpfilter_rules� s"
( R# R$ R7 R� RU R( ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR& � s (( t os.pathRE R� t firewall.core.baseR R t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R R R R R
R t firewallR t firewall.errorsR
R R t firewall.core.richR R R R R� Rf R� R� R* R- R3 t objectR4 R& ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt <module> s< : "
% * � � � �