HOME

Mini Shell 1.0
DIR:/lib/python2.7/site-packages/firewall/core/
Current File : //lib/python2.7/site-packages/firewall/core/nftables.pyc
�
�c�`c@s~ddlZddlZddlmZmZddlmZddlm	Z	ddl
mZmZm
Z
mZmZddlmZddlmZmZmZmZmZmZddlmZmZmZmZd	Zd
Ziiddefd
6d6iddefd
6d6iddefd
6ddefd6d6iddefd6ddefd6d6Z iid6id6id6Z!ii"dd d!dd"d#gd$6dd d!gd!6dd d%gd%6dd d&gd&6dd d!dd"d'gd(6dd d!dd"d)gd*6dd d!dd"d+gd,6dd d-dd"d.gd/6dd d!dd"d0gd16dd d!dd"d.gd26dd d3dd"d.gd46dd d!dd"d5gd66dd d-dd"d7gd86dd d!dd"d9gd:6dd d!dd"d7gd;6dd d3gd36dd d!dd"d<gd=6dd d!dd"d>gd?6dd d!dd"d@gdA6dd d-gd-6dd d3dd"d.gdB6dd dCgdC6dd dDgdD6dd dEgdE6dd d!dd"dFgdG6dd dHgdH6dd dIgdI6dd dJgdJ6dd d-dd"d<gdK6dd d!dd"dLgdM6dd d-dd"d@gdN6dd d!dd"dOgdP6dd dHdd"d.gdQ6dd dHdd"d7gdR6dS6idTd d!dTd"d<gdU6dTd d3dTd"d7gdV6dTd d!dTd"d@gdW6dTd d!dTd"d.gd$6dTd d!gd!6dTd d%gd%6dTd d&gd&6dTd d!dTd"dFgdX6dTd dYgdZ6dTd d[gd\6dTd d!dTd"d7gd]6dTd d^gd^6dTd d3gd36dTd d!dTd"d'gd=6dTd d_gd-6dTd d!dTd"d9gd`6dTd dagdC6dTd dbgdD6dTd dHgdH6dTd dHdTd"d.gdQ6dTd dHdTd"d7gdR6dTd d3dTd"d.gdc6dTd d3dTd"d@gdd6de6Z"dfe#fdg��YZ$dS(hi����N(t	SHORTCUTStDEFAULT_ZONE_TARGET(trunProg(tlog(t	splitArgst	check_mactportStrtcheck_single_addresst
check_address(tconfig(t
FirewallErrort
UNKNOWN_ERRORtINVALID_RULEtINVALID_ICMPTYPEtINVALID_TYPEt
INVALID_ENTRY(tRich_AccepttRich_Rejectt	Rich_Dropt	Rich_Markt	firewalldi
t
preroutingi���t
PREROUTINGtrawij���tmanglei����tpostroutingidtPOSTROUTINGtnattinputitINPUTtforwardtFORWARDtfiltertinettiptip6ticmpttypesdestination-unreachabletcodet13scommunication-prohibiteds
echo-replysecho-requestt4sfragmentation-neededt14shost-precedence-violationt10shost-prohibitedtredirectt1s
host-redirectt7shost-unknownshost-unreachablesparameter-problems
ip-header-badt8snetwork-prohibitedt0snetwork-redirectt6snetwork-unknownsnetwork-unreachablet3sport-unreachablet15sprecedence-cutofft2sprotocol-unreachablesrequired-option-missingsrouter-advertisementsrouter-solicitations
source-quencht5ssource-route-faileds
time-exceededstimestamp-replystimestamp-requeststos-host-redirectt12stos-host-unreachablestos-network-redirectt11stos-network-unreachablesttl-zero-during-reassemblysttl-zero-during-transittipv4ticmpv6saddress-unreachables
bad-headersbeyond-scopes
failed-policysnd-neighbor-advertsneighbour-advertisementsnd-neighbor-solicitsneighbour-solicitationsno-routespacket-too-bigsnd-redirectsreject-routesnd-router-advertsnd-router-solicitsunknown-header-typesunknown-optiontipv6tnftablescBs�eZdZeZd�Zd�Zd�Zd�Zd�Z	d�Z
d�Zd�Zd3d	�Zd
�Zd�Zd�Zd
�Zdd�Zd�Zedd�Zdd�Zdd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Z d3d3d�Z!d3d3d�Z"d3d3d�Z#d �Z$d3d!�Z%d3d"�Z&d#�Z'd3d$�Z(d%�Z)d3d&�Z*d'�Z+ed(�Z,d)�Z-d*�Z.d+�Z/d3d,�Z0d-�Z1d.�Z2d/�Z3d0�Z4d1�Z5d2�Z6RS(4R:cCsK||_tjd|_|j�g|_i|_i|_i|_dS(Ntnft(	t_fwR	tCOMMANDSt_commandtfill_existstavailable_tablestrule_to_handletrule_ref_counttzone_source_index_cache(tselftfw((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt__init__�s	
			cCs%tjj|j�|_t|_dS(N(tostpathtexistsR>tcommand_existstFalsetrestore_command_exists(RD((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR?�sc	Cs�y?|jd�}|j|�|j|�}||df}WnLtk
r�y&|jd�}|j|�d}Wq�tk
r�dSXnX|d}|r�|r�||kr�|||kr�||j|�q�n�|r�||kr�g||<n|rN|||kr8||j|�||jdd��n||j|�}n%|jjrcd}nt	||�}|dkr�d|d<q�|d	8}d
|d<|j
|d�|j
|d	d|�ndS(
Ns%%ZONE_SOURCE%%is%%ZONE_INTERFACE%%itkeycSs|dS(Ni((tx((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt<lambda>�sitinsertitaddtindexs%d(RRtpopt
ValueErrortNonetremovetappendtsortR<t_allow_zone_driftingtlenRP(	RDtrule_addtruleRCtitzonetzone_sourcetfamilyRR((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_run_replace_zone_source�sD



	


	

c
Cs�ddg}|}|ddkrs|ddkrs|}d|d<t|j||�\}}|dkrsdSnd}|ddkr|ddkrt}|d}|d
dkryt|d�Wn tk
r�ttd��qX|jd
�|jd
�ndj	|�}nB|ddkr_|ddkr_t
}|d}dj	|�}n||jkr7|r�|j|cd7<dS|r�|j|dkr�|j|cd8<dS|j|dkr�|j|cd8<n ttd||j|f��t
jd|j|j||jdj	|��n|retj|j�}	|j|||	�n|s�|r�|j|dks�|r�||jkr�|r�|r�ddg|dd!d|j|g}ndj	|�}
t
jd|j|j|
�t|j||�\}}|dkrEtd|j|
|f��n|rW|	|_n|r�|r�d}|j|�t|�}||j�|j|<d|j|<q�|j|=|j|=q�n|S(Ns--echos--handleitdeleteittabletlisttRQRPR\iitpositionisposition without a numbert s)rule ref count bug: rule_key '%s', cnt %ds%s: rule ref cnt %d, %s %sithandles	%s: %s %ss'%s %s' failed: %ss	# handle (saddsinsert(Rb(RR>RUtTruetintt	ExceptionR
RRStjoinRKRBRRtdebug2t	__class__tcopytdeepcopyRCRaRARTRRRZtstrip(
RDtargstnft_optst_argst
_args_testtstatustoutputtrule_keyR[RCt	_args_strtstrtoffset((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt__run�s| 
 


 
	#!

cCsAy|j|�}Wntk
r'tSX||||d+tSdS(Ni(RRRTRKRi(RDR\tpatterntreplacementR]((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
_rule_replace,s
cCs|}d|d<|S(NRbi((RDRrtret_args((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytreverse_rule5s
cCsttd��dS(Nsnot implemented(R
R(RDtrulest
log_denied((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt	set_rules:scCsd}d|ks*d|ks*d|kr3d}n-d|ksWd|ksWd|kr`d}n|j|dd	d
|ddg�|j|d
dddg�y|jd�}Wntk
r�nDX|dkr�dS|dkr�d|g|||d+n
|j|�|j|�S(NticmpxR7R"R$R9R#R8s
%%REJECT%%trejecttwithR%sadmin-prohibiteds%%ICMP%%tmetatl4protos{icmp, icmpv6}s%%LOGTYPE%%toffRetunicastt	broadcastt	multicasttpkttypei(R�R�R�(RRRRTRSt_nftables__run(RDR\R�ticmp_keywordR]((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytset_ruleCs$$	$	

cCs|r
|gStj�S(N(tIPTABLES_TO_NFT_HOOKtkeys(RDRc((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytget_available_tablesbscCsYi|_i|_i|_g}x1tj�D]#}|jdd|dtg�q.W|S(NRbRcs%s(RARBRCt
OUR_CHAINSR�RWt
TABLE_NAME(RDR�R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_flush_rulesfs			!cCs�tdd}g}|dkr�|jddd|g�x�ddgD]:}d	|d
||dtdf}|jt|��qFWn5|d
kr�|jddd|g�n
ttd�|S(Nt_tpolicy_droptDROPRQRcR!RRwsMadd chain inet %s %s_%s '{ type filter hook %s priority %d ; policy drop ; }'Ri���itACCEPTRbsnot implemented(R�RWtNFT_HOOK_OFFSETRR
R(RDtpolicyt
table_nameR�thookt
_add_chain((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_set_policy_rulesps
cCsAt�}x+tj�D]}|jt|j��qWt|�S(N(tsettICMP_TYPES_FRAGMENTR�tupdateRd(RDt	supportedtipv((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytsupported_icmp_types�s	cCsAg}x+tj�D]}|jd|tf�qWtt|�S(Nsadd table %s %s(R�R�RWR�tmapR(RDtdefault_tablesR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_default_tables�sR�c
Cs�g}t�tdd<x�tdj�D]�}|jdt|td|dtd|df�x�|jjr~ddgndgD]e}|jdt||f�|jd	t|||f�tddjtd
||fg��q�Wq(Wt�tdd<x�tdj�D]�}|jdt|td|dtd|df�x�|jjrjddgndgD]e}|jd
t||f�|jdt|||f�tddjtd
||fg��qqWqWt�tdd<t�tdd<x�ddgD]�}x�tdj�D]�}|jd|t|td|dtd|df�x�|jjr}ddgndgD]k}|jd|t||f�|jd|t|||f�t|djtd
||fg��q�Wq$Wq
Wt�tdd<xMtdj�D];}|jdt|td|dtd|df�qW|jdtdf�|jdtdf�x`|jjr�ddgndgD]=}|jdtd|f�|jdtdd|f�q�W|dkr|jdtdf�n|jdtdf�|dkrP|jdtdf�n|jd tdf�|jd!td"f�|jdtd"f�|jdtd"f�x}d#d$gD]o}xf|jjr�ddgndgD]C}|jd%td"||f�|jd&td"d"||f�q�Wq�W|dkrR|jdtd"f�n|jdtd"f�|dkr�|jdtd"f�n|jd td"f�td'd(d)d*d+d,g�tdd<t	t
|�S(-NR!Rs@add chain inet %s raw_%s '{ type filter hook %s priority %d ; }'iitZONES_SOURCEtZONESsadd chain inet %s raw_%s_%ss&add rule inet %s raw_%s jump raw_%s_%ss%s_%sRsCadd chain inet %s mangle_%s '{ type filter hook %s priority %d ; }'sadd chain inet %s mangle_%s_%ss,add rule inet %s mangle_%s jump mangle_%s_%sR"RR#s;add chain %s %s nat_%s '{ type nat hook %s priority %d ; }'sadd chain %s %s nat_%s_%ss$add rule %s %s nat_%s jump nat_%s_%sR sCadd chain inet %s filter_%s '{ type filter hook %s priority %d ; }'s>add rule inet %s filter_%s ct state established,related acceptRs,add rule inet %s filter_%s iifname lo acceptsadd chain inet %s filter_%s_%ss,add rule inet %s filter_%s jump filter_%s_%sR�s_add rule inet %s filter_%s ct state invalid %%%%LOGTYPE%%%% log prefix '"STATE_INVALID_DROP: "'s0add rule inet %s filter_%s ct state invalid dropsHadd rule inet %s filter_%s %%%%LOGTYPE%%%% log prefix '"FINAL_REJECT: "'sBadd rule inet %s filter_%s reject with icmpx type admin-prohibiteds$add chain inet %s filter_%s_IN_ZONESRtINtOUTs!add chain inet %s filter_%s_%s_%ss/add rule inet %s filter_%s jump filter_%s_%s_%stINPUT_ZONES_SOURCEtINPUT_ZONEStFORWARD_IN_ZONES_SOURCEtFORWARD_IN_ZONEStFORWARD_OUT_ZONES_SOURCEtFORWARD_OUT_ZONES(R�R�R�R�RWR�R<RYR�R�R(RDR�t
default_rulestchaintdispatch_suffixR`t	direction((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_default_rules�s�	(0	(0		( 4	(!((cCsY|dkrdddgS|dkr,dgS|dkrBddgS|d	krUdgSiS(
NR Rt
FORWARD_INtFORWARD_OUTRRRRR((RDRc((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytget_zone_table_chains�s

R!c

Cs�|dkrr|dkrrg}|j|j||||||d��|j|j||||||d��|Sidd6dd6dd	6dd
6dd6dd6|}	|t|�d
dkr�|t|�d
 d}ntjdt|d|�}
d}|r3|r3dd|dtd||fdg}ne|r_dd|dtd||fg}n9dd|dtd||fg}|s�|dg7}n|dkr�||d||
fg7}n(||	d|d|d||
fg7}|gS(NRR!R"R#tiifnameRtoifnameRRR�R�tOUTPUTit+t*R�R^tgotoRPR\s%ss%s_%s_ZONESs%%ZONE_INTERFACE%%RQRbs%s_%ss"(textendt!build_zone_source_interface_rulesRZRtformatRR�(
RDtenableR^t	interfaceRcR�RWR`R�toptttargettactionR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR��s>
&#(cCsK|dkr�|dkr�g}|jd�rI|j|td��}nd}td|�svt|�sv|dkr�|j|j|||||d��ntd|�s�t|�s�|dkr�|j|j|||||d��n|Sidt6d	t	6|}	id
d6dd
6d
d6d
d6dd6dd6|}
|j
jr\d||f}nd||f}tj
dt|d|�}d}
|jd�r�|td�}|j|�}d|}nCt|�r�|
dkr�dSd}ntd|�rd}nd}|	d|dt|d|||
||
d||fg}|gS(NRR!sipset:R7R"R9R#RPRbtsaddrRtdaddrRRR�R�R�s%s_%s_ZONES_SOURCEs%s_%s_ZONESR�R^R�t@RetetherR\s%ss%%ZONE_SOURCE%%s%s_%s(t
startswitht_set_get_familyRZRURRR�tbuild_zone_source_address_rulesRiRKR<RYRR�RR�(RDR�R^taddressRcR�R`R�tipset_familytadd_delR�tzone_dispatch_chainR�R�tipsettrule_familyR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR�$sT''
		c	Cs.|dkr`|dkr`g}|j|j|||d��|j|j|||d��|Stjdt|d|�}t||jt|d|d|d	|g��g}|jd
d|dt	d||fg�|jd
d|dt	d
||fg�|jd
d|dt	d||fg�|jd
d|dt	d||fg�|jd
d|dt	d||fdd
||fg�|jd
d|dt	d||fdd||fg�|jd
d|dt	d||fdd||fg�|j
jj|j
}|j
j�dkr�|dkr�|d kr�|d!kr�|}|dkrud}n|jd
d|dt	d||fdddd||fg	�q�q�n|dkr*|d"kr*|d#kr*|jd
d|dt	d||f|dkr|j�ndg�n|S($NRR!R"R#R�R^s%s_logs%s_denys%s_allowRQs%ss%s_%ss	%s_%s_logs
%s_%s_denys%s_%s_allowR\tjumpR�R RR�R�R�tREJECTs
%%REJECT%%R�s%%LOGTYPE%%Rtprefixs"filter_%s_%s: "R�(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(R�s
%%REJECT%%sDROP(sACCEPTR�s
%%REJECT%%sDROP(sINPUTs
FORWARD_INsFORWARD_OUTsOUTPUT(R�tbuild_zone_chain_rulesRR�RR�R�R�RWR�R<R^t_zonesR�tget_log_deniedtlower(	RDR^RcR�R`R�t_zoneR�t
log_suffix((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR�^s^


	
%cCs�iddddgd6ddddgd6ddddgd6ddddgd	6dddd
gd6dddd
gd6dd
dd
gd6dd
dd
gd6ddddgd6ddddgd6ddddgd6ddddgd6ddddgd6dd
ddgd6ddddgd6ddddgd6ddddgd6dd
ddgd6dd
ddgd 6dd
dd!gd"6dd
dd!gd!6dd#d$gd%6dd#d$gd&6}||S('NR�R$R%shost-prohibitedsicmp-host-prohibitedshost-prohibsnet-prohibitedsicmp-net-prohibiteds
net-prohibsadmin-prohibitedsicmp-admin-prohibitedsadmin-prohibR8sicmp6-adm-prohibitedsadm-prohibitedsnet-unreachablesicmp-net-unreachablesnet-unreachshost-unreachablesicmp-host-unreachableshost-unreachsport-unreachablesicmp-port-unreachablesicmp6-port-unreachableR�sport-unreachsprot-unreachablesicmp-proto-unreachables
proto-unreachsaddr-unreachablesicmp6-addr-unreachablesaddr-unreachsno-routesicmp6-no-routettcptresets	tcp-resetstcp-rst((RDtreject_typetfrags((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_reject_types_fragment�s2cCs�|s
gSidd6dd6dd6dd6}y|jjd	�}Wn tk
rdttd
��nXdd|jd
|!d	||j|dgS(Ntsecondtstminutetmthourthtdaytdt/sExpected '/' in limittlimittrateii(tvalueRRRTR
R(RDR�trich_to_nftR]((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_limit_fragment�s

cCs�|js
gSidt6dt6|}|dddtd||fg}||dg7}|jjr�|dd	|jjg7}n|jjr�|d
d	|jjg7}n||j|jj�7}|S(NRQRbR\R!s%ss	%s_%s_logRR�s"%s"tlevel(RRiRKR�R�R�R�R�(RDt	rich_ruleR�RcR�t
rule_fragmentR�R\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_log�s	cCs||js
gSidt6dt6|}|dddtd||fg}||ddd	g7}||j|jj�7}|S(
NRQRbR\R!s%ss	%s_%s_logRR�taudit(R�RiRKR�R�R�(RDR�R�RcR�R�R�R\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_audit�s	cCs�|js
gSidt6dt6|}t|j�tkrVd||f}dg}	nt|j�tkr�d||f}dg}	|jjr^|	|j|jj�7}	q^n�t|j�tkr�d||f}dg}	n~t|j�tkrBt	j
dtd	d
|�}d}d||f}dd
d|jjg}	nt
tdt|j���|dddt|g}
|
|7}
|
|j|jj�7}
|
|	7}
|
S(NRQRbs%s_%s_allowtaccepts
%s_%s_denyR�tdropR�RR^RR�tmarkR�sUnknown action %sR\R!s%s(R�RiRKR%RRR�RRRR�RR�R
RR�R�R�(RDR^R�R�RcR�R�R�R�trule_actionR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_action�s6			

cCsS|s
gS|dkr#dddgS|dkr<dddgSttd|��dS(NR7R�tnfprotoR9sInvalid family(R
R(RDtrich_family((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_family_fragments

cCsx|s
gSg}td|j�r2|dg7}n
|dg7}|jra|dd|jg7}n|d|jg7}|S(NR7R"R#R�s!=(Rtaddrtinvert(RDt	rich_destR�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_destination_fragments
	cCsJ|s
gSg}|jr�td|j�r;|dg7}n
|dg7}|jrj|dd|jg7}qF|d|jg7}n�t|d�r�|jr�|jr�|ddd|jg7}qF|dd|jg7}npt|d�rF|jrF|j|j�}|jr)||ddd	|jg7}qF||dd	|jg7}n|S(
NR7R"R#R�s!=tmacR�R�R�(RRRthasattrRR�R�(RDtrich_sourceR�R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_rich_rule_source_fragment,s(	
			 c	Cs�idt6dt6|}d}tjdtdd|�}	g}
|r_|
|j|j�7}
n|r�td|�r�|
dg7}
n
|
d	g7}
|
d
|g7}
n|r�|
|j|j	�7}
|
|j
|j�7}
n|
|ddt|d
�g7}
|st
|j�tkr+|
dddg7}
ng}|r�|j|j||||	|
��|j|j||||	|
��|j|j|||||	|
��n5|j|dddtd||	fg|
dg�|S(NRQRbR R�RR^R7R"R#R�tdports%st-tcttstates
new,untrackedR\R!s%s_%s_allowR�(RiRKRR�RRR`RRtdestinationR	tsourceRR%R�RRWR�R�R�R�(RDR�R^tprototportRR�R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_ports_rulesIs2
 ""(/c	Cs�idt6dt6|}d}tjdtdd|�}g}	|r_|	|j|j�7}	n|r�td|�r�|	dg7}	n
|	d	g7}	|	d
|g7}	n|r�|	|j|j�7}	|	|j|j	�7}	|	|j
|j�7}	ndd|g}	|st|j
�tkr0|	d
ddg7}	ng}
|r�|
j|j|||||	��|
j|j|||||	��|
j|j||||||	��n/|
j|dddtd|g|	dg�|
S(NRQRbR R�RR^R7R"R#R�R�R�RR
s
new,untrackedR\R!s%ssfilter_%s_allowR�(RiRKRR�RRR`RRRR	RR%R�RRWR�R�R�R�(RDR�R^tprotocolRR�R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_protocol_rulesjs4
""()c	Cs�idt6dt6|}d}tjdtdd|�}	g}
|r_|
|j|j�7}
n|r�td|�r�|
dg7}
n
|
d	g7}
|
d
|g7}
n|r�|
|j|j	�7}
|
|j
|j�7}
n|
|ddt|d
�g7}
|st
|j�tkr+|
dddg7}
ng}|r�|j|j||||	|
��|j|j||||	|
��|j|j|||||	|
��n5|j|dddtd||	fg|
dg�|S(NRQRbR R�RR^R7R"R#R�tsports%sRRR
s
new,untrackedR\R!s%s_%s_allowR�(RiRKRR�RRR`RRRR	RRR%R�RRWR�R�R�R�(RDR�R^RRRR�R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_source_ports_rules�s2
 ""(/cCsidt6dt6|}tjdtdd|�}	|dddtd	|	g}
|r�td
|�rv|
dg7}
n
|
dg7}
|
d
|g7}
n|
|ddt|d�g7}
|
dddd||fg7}
dddtd||fddd|d|ddg}||
gS(NRQRbR�RR^R\R!s%ssfilter_%s_allowR7R"R#R�R
RRthelperR�s"helper-%s-%s"shelper-%s-%st{R%s"%s"Rt;t}(RiRKRR�RR�RR(RDR�R^RRRthelper_nametmodule_short_nameR�R�R\t
helper_object((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_helper_ports_rules�s"	

  
cCs�idt6dt6|}tjdtdd|�}g}|ro||j|j�7}||j|j�7}n|d|dt	d|g|d	d
ddggS(
NRQRbR�RR^R\s%ssnat_%s_allowR�s!=tlot
masquerade(
RiRKRR�RRRR	RR�(RDR�R^R`R�R�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt _build_zone_masquerade_nat_rules�s	cCs�g}|rd|jr$|jdksB|jrdtd|jj�rd|j|j||d|��n}|r�|jr�|jdks�|jr�td|jj�r�|j|j||d|��n|j|j||d|��idt6dt6|}tj	dt
dd	|�}g}|rP||j|j�7}||j
|j�7}n|j|d
ddtd
|g|ddddg�|S(NR9R#R7R"RQRbR�R�R^R\R!s%ssfilter_%s_allowRR
s
new,untrackedR�(R`RRRR�R!RiRKRR�RRRR	RWR�(RDR�R^R�R�R�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_masquerade_rules�s$""	2c	Cs�idt6dt6|}tjdtdd|�}	g}
|rV|
dd|g7}
n|
ddg7}
|r�|d	kr�|
d
t|d�g7}
n|d|d
td|	dd|g||
gS(NRQRbR�RR^tdnatttoR+Res:%sRR\s%ssnat_%s_allowR�R�(RiRKRR�RRR�(RDR�R^Rt
mark_fragmentttoaddrttoportR`R�R�t
dnat_fragment((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt"_build_zone_forward_port_nat_rules�s	c
Csaidt6dt6|}
d|}dd|g}tjdtdd|�}
g}|	r�||j|	j�7}||j|	j�7}||j	|	j
�7}ng}|j|
d	d
dtd|
g||d
|ddd|g�|	rC|	jr|	jdks|rCt
d|�rC|j|j||||||d��n�|	r�|	jra|	jdksv|r�t
d|�r�|j|j||||||d��nh|r�t
d|�r�|j|j||||||d��n(|j|j||||||d��tjdt|d|�}
|j|
d	d
dtd|
dddg|dg�|S(NRQRbs0x%xR�R�R�RR^R\R!s%ssmangle_%s_allowR
R�R9R#R7R"sfilter_%s_allowRR
s
new,untrackedR�(RiRKRR�RRR`RRR	RRWR�RR�R)(RDR�R^tfilter_chainRRR'R&tmark_idR�R�tmark_strR%R�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_forward_port_ruless@
		2cCs<|t|krt||Sttd||jf��dS(Ns"ICMP type '%s' not supported by %s(R�R
R
tname(RDR�t	icmp_type((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_icmp_types_to_nft_fragment/scCs�d}idt6dt6|}|r9|jr9|j}n\|jr�g}d|jkrg|jd�nd|jkr�|jd�q�nddg}g}x/|D]'}	xddgD]}
tjdt|
d	|�}|jj	j
|�rd
||f}d}
nd||f}d
}
g}|rl||j|j�7}||j
|j�7}||j|j�7}n||j|	|j�7}|r8|j|j|||||��|j|j|||||��|jr|j|j||||||��q�|j|dddtd||fg|d
g�q�|jj�dkr�|
dkr�|j|dddt|g|dddd||fg�n|j|dddt|g||
g�q�Wq�W|S(NR RQRbR7R9RR�R�R^s%s_%s_allowR�s
%s_%s_denys
%%REJECT%%R\R!s%sR�s%%LOGTYPE%%RR�s"%s_%s_ICMP_BLOCK: "(RiRKtipvsRRWRR�RR<R^tquery_icmp_block_inversionRR`RR	RR0R.R�R�R�R�R�R�(RDR�R^tictR�RcR�R1R�R�R�R�tfinal_chaintfinal_targetR�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_zone_icmp_block_rules6sT	
		""	(2!	-c	Cs�d}g}x�ddgD]�}tjdt|d|�}djddtd	||fd
d||fg�}|j|}|jjj|�r�d}	nd
}	|r�ddddtd	||fd|g}
n#ddddtd	||fg}
|
d|	g7}
|j	|
�|jjj|�r|jj
�dkr�|rpddddtd	||fd|g}
n#ddddtd	||fg}
|
ddddd||fg7}
|j	|
�q�qqW|S(NR RR�R�R^RgR!s%ss%s_%sR�s%s_%s_allows
%%REJECT%%R�RQR\RfRbs%%ICMP%%R�s%%LOGTYPE%%RR�s"%s_%s_ICMP_BLOCK: "(RR�RRlR�RAR<R^R2RWR�(RDR�R^RcR�R�R�Rxtrule_handlet
ibi_targetR\((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt%build_zone_icmp_block_inversion_rulesls<	


	
cCs�g}|jddddtdddd	d
ddd
dddg�|dkr�|jddddtdddd	d
ddd
dddddg�n|jddddtdddddg	�|S(NRPR\R!s%ssraw_%sRR�R�R9tfibR�t.tiiftoiftmissingR�R�RR�s"rpfilter_DROP: "R8R%s){ nd-router-advert, nd-neighbor-solicit }R�traw_PREROUTINGR?R?(RWR�(RDR�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytbuild_rpfilter_rules�s	
cCs�d}tjdtdd|�}g}||j|j�7}||j|j�7}||j|j�7}g}|j	|j
|||||��|j	|j|||||��|j	|j||||||��|S(NR R�RR^(
RR�RRR`RRR	RRWR�R�R�(RDR�R^R�RcR�R�R�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt(build_zone_rich_source_destination_rules�s	""%cCs|dkrtStS(NR7R9teb(sipv4sipv6RB(RiRK(RDR�((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytis_ipv_supported�scCs;idd6dd6}i||gd6||ddgd6||dd	||gd
6||dd	||gd6||dgd
6||gd6||ddgd6||dd	||gd6||dd	||gd6||dgd6dgd6}ydg||dgSWn$tk
r6ttd|��nXdS(Nt	ipv4_addrR7t	ipv6_addrR9shash:ips. inet_protos. inet_serviceshash:ip,ports. inet_service .shash:ip,port,ipshash:ip,port,nets. markshash:ip,markshash:nets
hash:net,portshash:net,port,ipshash:net,port,nets. ifnameshash:net,ifacet
ether_addrshash:macR%Rs!ipset type name '%s' is not valid(tKeyErrorR
R(RDR�R%tipv_addrttypes((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_set_type_fragment�s(


c
Cs)|r+d|kr+|ddkr+d}nd}|dg}||j||�7}|r�d|kr�|d|dddg7}nd	|kr�|d
|d	dg7}q�n|s�d|kr�d|kr�|dd
dg7}n|dg7}x4dddgD]#}|jdd|tg|�q�WdS(NR`tinet6R9R7RttimeoutR�Rtmaxelemtsizet,tflagstintervalRR!R"R#RQR�(RJR�R�(RDR.R%toptionsR�tcmdR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_create�s "	
cCs:x3dddgD]"}|jdd|t|g�qWdS(NR!R"R#RbR�(R�R�(RDR.R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytset_destroy�scCs)|jjj|�jd�djd�}|jd�}t|�t|�krdttd��ng}x�tt|��D]�}||dkr�y||jd�}Wn(t	k
r�|dd||g7}qX|||| d|||dg7}n|j
||�|j
d�q}W|d S(	Nt:iROs+Number of values does not match ipset type.RR�R;i����(R<R�tget_typetsplitRZR
RtrangeRRRTRW(RDR.tentryttype_formattentry_tokenstfragmentR]RR((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt_set_entry_fragment�s +
*cCsTxMdddgD]<}|jdd|t|dg|j||�dg�qWdS(NR!R"R#RQtelementRR(R�R�R^(RDR.RZR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pytset_addscCsTxMdddgD]<}|jdd|t|dg|j||�dg�qWdS(NR!R"R#RbR_RR(R�R�R^(RDR.RZR`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt
set_deletescCs:x3dddgD]"}|jdd|t|g�qWdS(NR!R"R#tflushR�(R�R�(RDR.R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt	set_flushscCsk|jjj|�}|jdkr-d}n:|jrad|jkra|jddkrad}nd}|S(Nshash:macR�R`RKR#R"(R<R�t	get_ipsetR%RR(RDR.R�R`((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR�!s		N(7t__name__t
__module__R.Ritzones_supportedRFR?RaR�RR�R�R�RUR�R�R�R�R�R�R�RKR�R�R�R�R�R�R�R�RRR	RRRRR!R"R)R-R0R6R9R@RARCRJRTRUR^R`RaRcR�(((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyR:�sf				-	U							
		
	T	
+9@	 			
	"	
		!#!		,	6	2								(%tos.pathRGRotfirewall.core.baseRRtfirewall.core.progRtfirewall.core.loggerRtfirewall.functionsRRRRRtfirewallR	tfirewall.errorsR
RRR
RRtfirewall.core.richRRRRR�R�R�R�R�tobjectR:(((s:/usr/lib/python2.7/site-packages/firewall/core/nftables.pyt<module>s�(."