관리-도구
편집 파일: nftables.cpython-36.pyc
3 @)�f� � % @ sl d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m Z m Z m Z d dl mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z d dl m Z dZ e d d Z d Z!d Z"i d ddCe" fiddDe" fdde" fd�dd e" fdd e" fdd e" fdd e" fd�d�Z#dEdd�Z$e$ddd �e$dd�e$dd �e$dd �e$ddd �e$ddd �e$ddd �e$dd!d"�e$ddd#�e$ddd"�e$dd$d"�e$ddd%�e$dd!d �e$ddd&�e$ddd �e$dd$�e$ddd'�e$ddd(�e$ddd)�e$dd!�e$dd$d"�e$dd*�e$dd+�e$dd,�e$ddd-�e$dd.�e$dd/�e$dd0�e$dd!d'�e$ddd1�e$dd!d)�e$ddd2�e$dd.d"�e$dd.d �d3�"e$d4dd'�e$d4d$d �e$d4dd)�e$d4dd"�e$d4d�e$d4d �e$d4d �e$d4dd-�e$d4d5�e$d4d6�e$d4d7�e$d4d8�e$d4d9�e$d4d:�e$d4dd �e$d4d;�e$d4d$�e$d4dd �e$d4d<�e$d4dd&�e$d4d=�e$d4d>�e$d4d.�e$d4d.d"�e$d4d.d �e$d4d$d"�e$d4d$d)�d?�d@�Z%G dAdB� dBe&�Z'dS )F� )�absolute_importN)�log)� check_mac� getPortRange� normalizeIP6�check_single_address� check_address)� FirewallError� UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE� INVALID_ENTRY� INVALID_PORT)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)�NftablesZ firewalld�_Z policy_dropZpolicy_� � PREROUTING� prerouting� �d Z postrouting)r � POSTROUTING�input�forward�output)r �INPUT�FORWARD�OUTPUT)�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d k rD|j dd| dd�id|d�i� |S )N�match�payload�type)�protocol�fieldz==)�left�op�right�code)�append)r, r+ r1 � fragments� r4 � /usr/lib/python3.6/nftables.py�_icmp_types_fragmentsS s r6 �icmpzdestination-unreachable� z echo-replyz echo-request� � �redirect� � zparameter-problem� � � � � zrouter-advertisementzrouter-solicitationz source-quench� z time-exceededztimestamp-replyztimestamp-request� � )"zcommunication-prohibitedzdestination-unreachablez echo-replyz echo-requestzfragmentation-neededzhost-precedence-violationzhost-prohibitedz host-redirectz host-unknownzhost-unreachablez ip-header-badznetwork-prohibitedznetwork-redirectznetwork-unknownznetwork-unreachablezparameter-problemzport-unreachablezprecedence-cutoffzprotocol-unreachabler; zrequired-option-missingzrouter-advertisementzrouter-solicitationz source-quenchzsource-route-failedz time-exceededztimestamp-replyztimestamp-requestztos-host-redirectztos-host-unreachableztos-network-redirectztos-network-unreachablezttl-zero-during-reassemblyzttl-zero-during-transit�icmpv6zmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportznd-neighbor-advertznd-neighbor-solicitzpacket-too-bigz nd-redirectznd-router-advertznd-router-solicit)zaddress-unreachablez bad-headerz beyond-scopezcommunication-prohibitedzdestination-unreachablez echo-replyz echo-requestz failed-policyzmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportzneighbour-advertisementzneighbour-solicitationzno-routezpacket-too-bigzparameter-problemzport-unreachabler; z reject-routezrouter-advertisementzrouter-solicitationz time-exceededzttl-zero-during-reassemblyzttl-zero-during-transitzunknown-header-typezunknown-option)�ipv4�ipv6c @ s` e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Z d d � Z dd� Z d�dd�Z dd� Z dd� Zdd� Zdd� Zd�dd �Zd d � Zd�d d!�Zd"d#� Zd�d%d&�Zd�d(d)�Zd�d*d+�Zd�d,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&d�dJdK�Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+d�dTdU�Z,d�dVdW�Z-d�dXdY�Z.dZd[� Z/d�d\d]�Z0d�d^d_�Z1d�d`da�Z2d�dbdc�Z3d�ddde�Z4dfdg� Z5d�dhdi�Z6djdk� Z7d�dldm�Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<d�dvdw�Z=d�dxdy�Z>dzd{� Z?d�d|d}�Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�d��ZHdS )��nftablesTc C sb || _ d| _g | _i | _i | _i | _i | _i | _g g g d�| _t � | _ | j j d� | j j d� d S )NT)�inet�ip�ip6) �_fwZrestore_command_existsZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�created_tablesr rI Zset_echo_outputZset_handle_output)�self�fwr4 r4 r5 �__init__� s znftables.__init__c C s� xdD ]}||krP qW d|| d kr`|| d d d || d d d f}|| d d= n(d|| d kr�d }|| d d= nd S || d d }|r�|dkr�||kr�||| kr�|| j |� n�|dk�r�||kr�g ||< |�r(||| k�r|| j|� || jd d � d � || j|�}n | jj�r8d }n t|| �}|| }||= |d k�rf||d< n |d8 }||d< ||d d d< d S )N�add�insert�deletez%%ZONE_SOURCE%%�rule�zone�addressz%%ZONE_INTERFACE%%�familyc S s | d S )Nr r4 )�xr4 r4 r5 �<lambda>� s z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr r< �index)rW rX rY )�remover2 �sortra rM �_allow_zone_drifting�len)rT rZ rR �verbZ zone_sourcer] ra � _verb_snippetr4 r4 r5 �_run_replace_zone_source� sD z!nftables._run_replace_zone_sourcec C sB d|krdt j|d �iS d|kr4dt j|d �iS ttd��d S )NrX rY rW zFailed to reverse rule)�copy�deepcopyr r )rT �dictr4 r4 r5 � reverse_rule� s znftables.reverse_rulec C s� xd D ]}||krP qW ||| d k�r�|| d | }|| d |= t |�tkr^ttd��|| d d || d d f}|dkr�||ks�||| ks�|| | dkr�ttd ��|| | d 8 < n�||kr�i ||< ||| kr�d|| |< d}xVt|| j� �D ]B}||k�r"|dk�r"P ||| | 7 }||k�r|dk�rP �qW || | d 7 < || } ||= |dk�r�| |d< n |d 8 }| |d< ||d d d < d S ) NrW rX rY rZ z%priority must be followed by a numberr] �chainr z*nonexistent or underflow of priority countr< ra )rW rX rY )r+ �intr r r �sorted�keys) rT rZ Zpriority_counts�tokenrf �priorityrm ra �prg r4 r4 r5 �_set_rule_replace_priority� sD z#nftables._set_rule_replace_priorityc C sf x`d D ]X}||krd|| krt j|| d �}xd D ]}||kr6||= q6W tj|dd �}|S qW d S ) NrW rX rY rZ ra �handle�positionT)Z sort_keys)rW rX rY )ra ru rv )ri rj �json�dumps)rT rZ rf �rule_keyZnon_keyr4 r4 r5 � _get_rule_key s znftables._get_rule_keyc C sL dddddg}dddg}g }g }t j| j�}t j| j�}t j| j�} | jj � } �x�|D �]�} t| �tkrvtt d| ��x|D ]} | | kr|P q|W | | kr�tt d| ��| j | �} | | k�rDt j d| j| | | � | dkr�| | d 7 < qVnX| | d k�r | | d 8 < qVn6| | d k�r,| | d 8 < ntt d | | | f ��n| �r\| dk�r\d | | < |j| � t j| �}| �rttd || d d ��|| d d < | j||d � | j||d� | j|| � | dk�rdd |d d d |d d d |d d d | j| d�ii}|j|� qVW dddd iig| i}t j� dk�rVt jd| jtj|�� | jj|�\}}}|dk�r�tdd|tj|�f ��|| _|| _| | _| | _d}x�|D ]�} |d 7 }| j | �} | �s̐q�d| k�r�| j| = | j| = �q�x"|D ]} | |d | k�r�P �q�W | |d | k�r$�q�|d | | d d | j| < �q�W d S ) NrW rX rY �flush�replacez#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sr< z)rule ref count bug: rule_key '%s', cnt %drZ �exprz%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r] �tablerm )r] r~ rm ru rI ZmetainfoZjson_schema_versionr@ z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s JSON blob: %szpython-nftablesru ) ri rj rP rQ rR rO r+ rk r r r rz r Zdebug2� __class__r2 �listr( rt rh rN ZgetDebugLogLevelZdebug3rw rx rI Zjson_cmd� ValueError)rT �rules� log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesrP rQ rR rO rZ rf ry Z_ruleZ json_blobZrcr! �errorra r4 r4 r5 � set_rules+ s� & znftables.set_rulesc C s | j |g|� dS )N� )r� )rT rZ r� r4 r4 r5 �set_rule� s znftables.set_ruleNc C s |r |gS t j� S )N)�IPTABLES_TO_NFT_HOOKrp )rT r~ r4 r4 r5 �get_available_tables� s z nftables.get_available_tablesc C sF g }x<dD ]4}|j dd||d�ii� |j dd||d�ii� q W |S ) NrJ rK rL rW r~ )r] �namerY )rJ rK rL )r2 )rT r~ r� r] r4 r4 r5 �_build_delete_table_rules� s z"nftables._build_delete_table_rulesc C s� i }i }xB| j d�D ]4}| j|�}|| jkr| j| ||< | j| ||< qW || _|| _i | _i | _i | _x*dD ]"}t| j| krp| j| j t� qpW | j t�S )NTrJ rK rL )rJ rK rL ) � _build_set_policy_rules_ct_rulesrz rN rO rP rQ rR � TABLE_NAMErS rb r� )rT Zsaved_rule_to_handleZsaved_rule_ref_countrZ � policy_keyr] r4 r4 r5 �build_flush_rules� s znftables.build_flush_rulesc C sl ddd�| }g }xTdD ]L}|j |ddtd d |f d d d diiddddgid�idd igd�ii� qW |S )NrW rY )TFr r r! rZ rJ z%s_%sr( r) �ctr` �state�in�set� established�related)r. r/ r0 �accept)r] r~ rm r} )r r r! )r2 �TABLE_NAME_POLICY)rT �enable�add_delr� �hookr4 r4 r5 r� � s z)nftables._build_set_policy_rules_ct_rulesc C st g }|dkrt|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d dd�ii� q:W |dk� r�|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d dd�ii� q�W || jd�7 }nz|dk�rfx4| jd�D ]&}| j|�}|| jk�r |j |� �q W || jt�7 }t| jd k�rp| jd jt� n t t d� |S )NZPANICrW r~ rJ )r] r� r r! rm z%s_%sr% r( i, r< �drop)r] r~ r� r+ r� �prio�policy�DROPr r r T�ACCEPTFznot implemented)r r! i���)r r r! ) r2 r� rS �NFT_HOOK_OFFSETr� rz rN r� rb r r )rT r� r� r� rZ r� r4 r4 r5 �build_set_policy_rules� sH z nftables.build_set_policy_rulesc C s< t � }x,|r|gntj� D ]}|jt| j� � qW t|�S )N)r� �ICMP_TYPES_FRAGMENTSrp �updater� )rT �ipvZ supportedZ_ipvr4 r4 r5 �supported_icmp_types� s z nftables.supported_icmp_typesc C s> g }x4dD ],}|j dd|td�ii� | j| j t� q W |S )NrJ rK rL rW r~ )r] r� )rJ rK rL )r2 r� rS )rT Zdefault_tablesr] r4 r4 r5 �build_default_tables s z nftables.build_default_tables�offc C s� g }x�t d j� D ]�}|jdddtd| ddt d | d t d | d d �ii� xz| jjrld d d dgnd d dgD ]X}|jdddtd||f d�ii� |jdddtd| ddd||f iigd�ii� qvW qW x�d?D ]�}x�t d j� D ]�}|jdd|td| ddt d | d t d | d d �ii� x~| jj�rJd d d dgnd d dgD ]Z}|jdd|td||f d�ii� |jdd|td| ddd||f iigd�ii� �qTW q�W q�W xVt d j� D ]F}|jdddtd| ddt d | d t d | d d �ii� �q�W |jdddtdd d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd d d d d&iid d'd$�id%d igd�ii� |jdddtdd d d(d d)iid*d+d$�id%d igd�ii� x~| jj�r�d d d dgnd d dgD ]Z}|jdddtd,d|f d�ii� |jdddtdd ddd,d|f iigd�ii� �q�W |d-k�r�|jdddtdd d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd d d d d iid d!d.gid$�id2d igd�ii� |d-k�r$|jdddtdd | j|�d/d0d3iigd�ii� |jdddtdd d4d5d6d7�igd�ii� |jdddtdd8 d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd8 d d d d&iid d'd$�id%d igd�ii� |jdddtdd8 d d(d d)iid*d+d$�id%d igd�ii� xbd@D ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW x�dAD ]�}xz| jj�r�d d gnd gD ]^}|jdddtd;d8||f d�ii� |jdddtdd8 ddd;d8||f iigd�ii� �q�W �qvW xbdBD ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW |d-k�r�|jdddtdd8 d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd8 d d d d iid d!d.gid$�id2d igd�ii� |d-k�r6|jdddtdd8 | j|�d/d0d3iigd�ii� |jdddtdd8 d4d5d6d7�igd�ii� |jdddtdd< d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtd=d d(d d>iid*d+d$�id%d igd�ii� xbdCD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �q�W xbdDD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �qHW |S )ENr& rW rm rJ z mangle_%sr( z%sr r< )r] r~ r� r+ r� r� � POLICIES_preZ ZONES_SOURCEZZONES� POLICIES_postz mangle_%s_%s)r] r~ r� rZ �jump�target)r] r~ rm r} rK rL r' znat_%sz nat_%s_%sz filter_%sr" r) r� r` r� r� r� r� r� )r. r/ r0 r� Zstatus�dnat�meta�iifnamez==�loz filter_%s_%sr� Zinvalidr �prefixzSTATE_INVALID_DROP: r� zFINAL_REJECT: �reject�icmpxzadmin-prohibited)r+ r} r# �IN�OUTzfilter_%s_%s_%sr$ � filter_OUTPUT�oifname)rK rL )r� )r� r� )r� )r� )r� )r� rp r2 r� rM rd �_pkttype_match_fragment)rT r� Z default_rulesrm Zdispatch_suffixr] � directionr4 r4 r5 �build_default_rules s� $ ( & . & & & . & & &z nftables.build_default_rulesc C s4 |dkrdddgS |dkr dgS |dkr0ddgS g S ) Nr( r" � FORWARD_IN� FORWARD_OUTr& r r' r r4 )rT r~ r4 r4 r5 �get_zone_table_chains� s z nftables.get_zone_table_chainsrJ c s� �dkr\�dkr\g } | j �j�|��||||dd� � | j �j�|��||||dd� � | S �jjj|���jdk rxdnd��dkr��d kr�d nd } �jjj|�t| �� g } g } |r�| jd d ddiiddt |�id�i� |�r| jd d ddiiddt |�id�i� ddd�}|�rlxT|D ]L}�dk�rT�jj j |�}||k�rT�|| k�rT�q | j�j d|�� �q W |�r�xT|D ]L}�dk�r��jj j |�}||k�r��|| k�r��qx| j�j d|�� �qxW � �������fdd�}g } | �rHx�| D ]P}| �r xB| D ]}| j|||�� �qW n"�dk�r0|�r0n| j||d �� �q�W n\�dk�rZ|�rZnJ| �r�xB| D ]}| j|d |�� �qfW n"�dk�r�|�r�n| j|d d �� | S )Nr' rJ rK )r] rL r �pre�postr TFr) r� r` r� z==r� )r. r/ r0 r� )rG rH �saddr�daddrc s� g }| r|j | � |r |j |� |j ddd�� f ii� �td���f |d�}|j�j��� �rrdd|iiS dd|iiS d S ) Nr� r� z%s_%sz%s_%s_POLICIES_%s)r] r~ rm r} rW rZ rY )r2 r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsrZ )�_policyrm � chain_suffixr� r] �p_objrT r~ r4 r5 � _generate_policy_dispatch_rule s zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule) �extend�!build_policy_ingress_egress_rulesrM r� Z get_policyrr �policy_base_chain_name�POLICY_CHAIN_PREFIXr2 r� r[ Z check_source�_rule_addr_fragment)rT r� r� r~ rm Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr] r� �isSNATZingress_fragmentsZegress_fragmentsZ ipv_to_family�srcr� �dstr� r� r� r4 )r� rm r� r� r] r� rT r~ r5 r� � sv z*nftables.build_policy_ingress_egress_rulesFc C s� |dkrT|dkrTg } | j | j|||||||d�� | j | j|||||||d�� | S |dkrh|dkrhdnd} | jjj||t| d�} d d d d d d d �| } |t|�d d kr�|d t|�d � d }d} |dkr�| dd|| f iig}n,ddd| iid|d�i| dd|| f iig}|�rL| �rLd}|td||f |d�}|j| j � � nP|�rnd}|td||f |d�}n.d}|td||f |d�}|�s�|j| j � � |d |iigS ) Nr' rJ rK rL r TF)r� r� r� )r r r" r� r� r$ r< �+�*�gotor� z%s_%sr) r� r` z==)r. r/ r0 rX z %s_%s_ZONES)r] r~ rm r} rW rY rZ ) r� �!build_zone_source_interface_rulesrM r� r� r� re r� r� �_zone_interface_fragment)rT r� r[ r� � interfacer~ rm r2 r] r� r� r� �opt�actionr� rf rZ r4 r4 r5 r� Q s\ z*nftables.build_zone_source_interface_rulesc C sn |dkr�|dkr�g }|j d�r6| j|td�d � �} nd } td|�sTt|�sT| dkrp|j| j||||||d�� td|�s�t|�s�| dkr�|j| j||||||d�� |S |dkr�|dkr�d nd } | jjj ||t | d �} d d d�| } ddddddd�| } | jj �rd||f }n d||f }d}|t || j | |�|dd|| f iigd�}|j| j||�� | d|iigS )Nr' rJ zipset:rG rK rH rL r TF)r� rX rY )TFr� r� )r r r" r� r� r$ z%s_%s_ZONES_SOURCEz %s_%s_ZONESr� r� z%s_%s)r] r~ rm r} rZ )� startswith�_set_get_familyre r r r� � build_zone_source_address_rulesrM r� r� r� rd r� r� r� �_zone_source_fragment)rT r� r[ r� r\ r~ rm r] r� Z ipset_familyr� r� r� r� Zzone_dispatch_chainr� rZ r4 r4 r5 r� � sB z(nftables.build_zone_source_address_rulesc C s |dkrH|dkrHg }|j | j||||d�� |j | j||||d�� |S ddd�| }|dkrj|dkrjd nd }| jjj||t|d �} g }|j|d |td || f d�ii� x0d!D ](} |j|d |td|| | f d�ii� q�W xDd"D ]<} |j|d|td || f ddd|| | f iigd�ii� q�W | jjj| j } | jj � dk�r�|dk�r�| d#k�r�| } | d k�rhd} |j|d|td || f | j | jj � �dd d | | f iigd�ii� |dk�r| d$k�r| d%k�r�| j � } n | j � d i} |j|d|td || f | gd�ii� |�s|j� |S )&Nr' rJ rK rL rW rY )TFr TF)r� rm z%s_%s)r] r~ r� r� r �deny�allowr� z%s_%s_%srZ r� r� )r] r~ rm r} r� r( �REJECT� %%REJECT%%r� r� z"filter_%s_%s: "r� )r� r r� r� r� )r� r r� r� r� )r� r� r� )r� r� r� r� )r� r� )r� �build_policy_chain_rulesrM r� r� r� r2 r� Z _policiesr� �get_log_deniedr� �_reject_fragment�lower�reverse)rT r� r� r~ rm r] r� r� r� r� r� r� Z log_suffix�target_fragmentr4 r4 r5 r� � sZ & z!nftables.build_policy_chain_rulesc C s< |dkr i S |d kr,ddddiid |d �iS t td |��d S ) N�all�unicast� broadcast� multicastr) r� r` �pkttypez==)r. r/ r0 zInvalid pkttype "%s")r� r� r� )r r )rT r� r4 r4 r5 r� � s z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd d�iddd d�idd d d�iddd d�iddd d�iddd d�iddd d�idddd�idddd�idddiidddiid�}|| S )Nr� r7 zhost-prohibited)r+ r} znet-prohibitedzadmin-prohibitedrF znet-unreachablezhost-unreachablezport-unreachabler� zprot-unreachablezaddr-unreachablezno-router+ z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez proto-unreachzicmp6-addr-unreachablez addr-unreachzicmp6-no-routezno-routez tcp-resetztcp-rstr4 )rT Z reject_typeZfragsr4 r4 r5 �_reject_types_fragment� s0 z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� zadmin-prohibited)r+ r} r4 )rT r4 r4 r5 r� s znftables._reject_fragmentc C s ddddiiddddgid �iS ) Nr) r� r` �l4protoz==r� r7 rF )r. r/ r0 r4 )rT r4 r4 r5 �_icmp_match_fragment" s z nftables._icmp_match_fragmentc C sP |si S ddddd�}|j � \}}||| d�}|j� }|d k rH||d< d|iS ) N�secondZminuteZhourZday)�s�m�h�d)�rateZper�burst�limit)Z value_parseZ burst_parse)rT r� Z rich_to_nftr� Zdurationr� r� r4 r4 r5 �_rich_rule_limit_fragment' s z"nftables._rich_rule_limit_fragmentc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt t dt |j� ��n t t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r r� r� r� r� ) r+ �elementr r r r� r r r r r r rr )rT � rich_ruler4 r4 r5 �_rich_rule_chain_suffix? s z nftables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r rr )rT r� r4 r4 r5 � _rich_rule_chain_suffix_from_logU s z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nz%%ZONE_INTERFACE%%r4 )rT r4 r4 r5 r� ` s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|jd�}t|d �d |d }d||d�iS )NrH �/r r< z%%ZONE_SOURCE%%)r[ r\ )r r r �split)rT r[ r\ Z addr_splitr4 r4 r5 r� c s z nftables._zone_source_fragmentc C s d|j iS )Nz%%POLICY_PRIORITY%%)rr )rT r� r4 r4 r5 r� k s z"nftables._policy_priority_fragmentc C s | s|j dkri S d|j iS )Nr z%%RICH_RULE_PRIORITY%%)rr )rT r� r4 r4 r5 � _rich_rule_priority_fragmentn s z%nftables._rich_rule_priority_fragmentc C s� |j s i S | jjj||t�}ddd�| }| j|�}i } |j jrPd|j j | d< |j jr|d|j jkrhdn|j j} d| | d< d td |||f || j |j j �d | ig d �} | j | j |�� |d | iiS )NrW rY )TFz%sr� Zwarning�warn�levelrJ z%s_%s_%sr )r] r~ rm r} rZ ) r rM r� r� r� r� r� r r� r� r� r� r� ) rT r� r� r� r~ r� r� r� r� Z log_optionsr rZ r4 r4 r5 �_rich_rule_logs s& znftables._rich_rule_logc C s� |j s i S | jjj||t�}ddd�| }| j|�}dtd|||f || j|j j�dddiig d �} | j | j |�� |d | iiS ) NrW rY )TFrJ z%s_%s_%sr r r� )r] r~ rm r} rZ ) r� rM r� r� r� r� r� r� r� r� r� ) rT r� r� r� r~ r� r� r� r� rZ r4 r4 r5 �_rich_rule_audit� s znftables._rich_rule_auditc C s� |j s i S | jjj||t�}ddd�| }| j|�}d|||f } t|j �tkr\dd i} �n t|j �tkr�|j jr�| j |j j�} ndd i} n�t|j �t kr�dd i} n�t|j �t k�rHd}| jjj||t�}d|||f } |j j j d �} t| �d k�r,dd d d iiddd d d ii| d gi| d gid�i} ndd d d ii| d d�i} nttdt|j � ��dt| || j|j j�| g d�} | j| j|�� |d| iiS )NrW rY )TFz%s_%s_%sr� r� r� r& r� r< r� r` �mark�^�&r )r` �valuezUnknown action %srJ )r] r~ rm r} rZ )r� rM r� r� r� r� r+ r r r� r r r� r� re r r r� r� r� r� r� ) rT r� r� r� r~ r� r� r� r� rm Z rule_actionr rZ r4 r4 r5 �_rich_rule_action� sB , znftables._rich_rule_actionc C s� |j d�r0| j|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j d �i}nDtd |�r�d }t |�}n,d }|j d �}d t |d �t |d �d �i}dd||d�i|r�dnd|d�iS d S )Nzipset:r� TF�etherrG rK )�strictr� )�addrre rH rL r� r r< r) r* )r, r- z!=z==)r. r/ r0 )r� �_set_match_fragmentre r r r � ipaddressZ IPv4NetworkZnetwork_addressZ compressedZ prefixlenr r� rn )rT Z addr_fieldr\ �invertr] Znormalized_addressZaddr_lenr4 r4 r5 r� � s( & z nftables._rule_addr_fragmentc C s6 |si S |d kr t td| ��ddddiid|d �iS ) NrG rH zInvalid familyr) r� r` �nfprotoz==)r. r/ r0 )rG rH )r r )rT Z rich_familyr4 r4 r5 �_rich_rule_family_fragment� s z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )Nzipset:r� )r )r �ipsetr� r )rT Z rich_destr\ r4 r4 r5 � _rich_rule_destination_fragment� s z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macr zipset:r� )r )r �hasattrr r r� r )rT Z rich_sourcer\ r4 r4 r5 �_rich_rule_source_fragment� s z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr r< �range)r � isinstancern r r re )rT �portr r4 r4 r5 �_port_fragment s znftables._port_fragmentc C sb ddd�| }d}| j jj||t�} g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j |j �� | jdd|dd �id | j |�d �i� | s�t |j�tkr�| jdd d diiddddgid �i� g } |�r0| j| j||||| �� | j| j||||| �� | j| j||||| �� n.| j|ddtd|| f | dd ig d�ii� | S )NrW rY )TFr( r� r) r* �dport)r, r- z==)r. r/ r0 r� r` r� r� r� �new� untrackedrZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r � destinationr �sourcer r+ r� r r r r r� ) rT r� r� �protor r r� r� r~ r� r� r� r4 r4 r5 �build_policy_ports_rules s: z!nftables.build_policy_ports_rulesc C sZ ddd�| }d}| j jj||t�}g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j |j �� | jdddd iid |d �i� | s�t |j �tkr�| jdd dd iiddddgid �i� g } |�r(| j| j||||| �� | j| j||||| �� | j| j||||| �� n.| j|ddtd||f | dd ig d�ii� | S )NrW rY )TFr( r� r) r� r` r� z==)r. r/ r0 r� r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r+ r� r r r r r� ) rT r� r� r, r r� r� r~ r� r� r� r4 r4 r5 �build_policy_protocol_rules2 s8 z$nftables.build_policy_protocol_rulesc C sb ddd�| }d}| j jj||t�} g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j |j �� | jdd|dd �id | j |�d �i� | s�t |j�tkr�| jdd d diiddddgid �i� g } |�r0| j| j||||| �� | j| j||||| �� | j| j||||| �� n.| j|ddtd|| f | dd ig d�ii� | S )NrW rY )TFr( r� r) r* �sport)r, r- z==)r. r/ r0 r� r` r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r r+ r� r r r r r� ) rT r� r� r r r r� r� r~ r� r� r� r4 r4 r5 � build_policy_source_ports_rulesU s: z(nftables.build_policy_source_ports_rulesc C s� d}| j jj||t�} ddd�| } g } |rR| jdddtd||f ||d�ii� g } |rl| j| jd |�� | jd d |d d �id| j|�d�i� | jdd||f i� | j| ddtd| | d�ii� | S )Nr( rW rY )TFz ct helperrJ z helper-%s-%s)r] r~ r� r+ r, r� r) r* r )r, r- z==)r. r/ r0 rZ zfilter_%s_allow)r] r~ rm r} )rM r� r� r� r2 r� r� r ) rT r� r� r r r Z helper_nameZmodule_short_namer~ r� r� r� r� r4 r4 r5 � build_policy_helper_ports_rulesz s. z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d iid |d �id d ig} n| jd|�d d ig} dtd| | d�} | j|d| ii� | S )NrW rY )TFr< r� r� r) r� r` r� z==)r. r/ r0 r� r� rJ zfilter_%s_allow)r] r~ rm r} rZ )rM r� r� r� re r� r� r2 ) rT r� r[ r� r~ r� r r� r� r� r} rZ r4 r4 r5 �build_zone_forward_rules� s" z!nftables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|r`|j| j|j�� |j| j|j�� | j |�} nd} |t d|| f |d d d d iid dd�idd ig d�} | j | j |�� |d| iigS )Nr' T)r� rW rY )TFr� z nat_%s_%sr) r� r` r� z!=r� )r. r/ r0 Z masquerade)r] r~ rm r} rZ ) rM r� r� r� r2 r r r r r� r� r� r� ) rT r� r� r] r� r~ r� r� r� r� rZ r4 r4 r5 �"_build_policy_masquerade_nat_rules� s& z+nftables._build_policy_masquerade_nat_rulesc C s^ g }|rD|j r|j dks,|jrDtd|jj�rD|j| j||d|�� nV|r�|j rX|j dksl|jr�td|jj�r�|j| j||d|�� n|j| j||d|�� d}| jjj||t �}ddd�| }g }|r�|j | j |j �� |j | j |j�� | j|�} nd } d td || f |d d ddiiddddgid�idd ig d�} | j| j|�� |j |d| ii� |S )NrH rL rG rK r( rW rY )TFr� rJ z filter_%s_%sr) r� r` r� r� r� r r )r. r/ r0 r� )r] r~ rm r} rZ )r] r r r r� r& rM r� r� r� r2 r r r r� r� r� r� ) rT r� r� r� r� r~ r� r� r� r� rZ r4 r4 r5 � build_policy_masquerade_rules� s8 z&nftables.build_policy_masquerade_rulesc C s$ d} | j jj|| t�} ddd�| } g } |r\| j| j|j�� | j| j|j�� | j |�} nd} | jdd|dd �id | j |�d �i� |r�t d |�r�t |�}|r�|d kr�| jd|| j |�d�i� q�| jdd|ii� n| jdd| j |�ii� |t d| | f | d�}|j| j|�� | d|iigS )Nr' rW rY )TFr� r) r* r )r, r- z==)r. r/ r0 rH r� r� )r r r r; r z nat_%s_%s)r] r~ rm r} rZ )rM r� r� r� r2 r r r r r� r r r r� r� r� )rT r� r� r r, �toaddr�toportr] r� r~ r� r� r� r� rZ r4 r4 r5 �$_build_policy_forward_port_nat_rules� s4 z-nftables._build_policy_forward_port_nat_rulesc C s� g }|rF|j r|j dks&|rFtd|�rF|j| j||||||d|�� n�|r�|j rZ|j dksh|r�td|�r�|j| j||||||d|�� nL|r�td|�r�|j| j||||||d|�� n |j| j||||||d|�� |S )NrH rL rG rK )r] r r� r* ) rT r� r� r r, r) r( r� r� r4 r4 r5 � build_policy_forward_port_rules s z(nftables.build_policy_forward_port_rulesc C s2 |t | krt | | S ttd|| j|f ��d S )Nz)ICMP type '%s' not supported by %s for %s)r� r r r� )rT r� Z icmp_typer4 r4 r5 � _icmp_types_to_nft_fragments( s z%nftables._icmp_types_to_nft_fragmentsc C sB d}| j jj||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jkrT|jd� d|jkrr|jd� nddg}g } �x�|D �]�} | j jj|�r�d||f } dd i} nd ||f } | j� } g } |r�| j| j |j �� | j| j |j�� | j| j |j �� | j| j| |j�� |�r�| j| j||||| �� | j| j||||| �� |j�rf| j| j||||| �� nN| j|�}d td |||f | | j� g d �}|j| j|�� | j|d |ii� q~| j j� dk�r| j jj|� �r| j|d d t| | | j| j j� �ddd||f iig d �ii� | j|d d t| | | g d �ii� q~W | S )Nr( rW rY )TFrG rH z %s_%s_allowr� z %s_%s_denyrJ z%s_%s_%s)r] r~ rm r} rZ r� r r� z"%s_%s_ICMP_BLOCK: ")rM r� r� r� �ipvsr r2 �query_icmp_block_inversionr� r r] r r r r� r, r� r r r� r r� r� r� r� r� r� )rT r� r� Zictr� r~ r� r� r- r� r� Z final_chainr� r� r� rZ r4 r4 r5 � build_policy_icmp_block_rules/ sb " " z&nftables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }ddd�| }| j jj|�r@| j� }ndd i}|j|ddtd||f d | j� |gd �ii� | j j � d kr�| j jj|�r�|j|ddtd||f d | j� | j | j j � �d d d||f iigd �ii� |S )Nr( rW rY )TFr� rZ rJ z%s_%sr9 )r] r~ rm ra r} r� r r� z%s_%s_ICMP_BLOCK: ) rM r� r� r� r. r� r2 r� r� r� r� )rT r� r� r~ r� r� r� r� r4 r4 r5 �'build_policy_icmp_block_inversion_rulesk s, z0nftables.build_policy_icmp_block_inversion_rulesc C s� g }ddddiiddd�iddd d d gd d �iddd�ig}|dkrV|j dddii� |j dd i� |j dddtd|d�ii� |j dddtdddddd �idd d d gid�id d igd�ii� |S )!Nr) r� r` r z==rH )r. r/ r0 Zfibr� Ziifr Zoif)�flags�resultFr� r r� zrpfilter_DROP: r� rX rZ rJ Zfilter_PREROUTING)r] r~ rm r} r* rF r+ )r, r- r� znd-router-advertznd-neighbor-solicitr� )r2 r� )rT r� r� r� r4 r4 r5 �build_rpfilter_rules� s0 z nftables.build_rpfilter_rulesc C s� ddddddddd g }d d � |D �}d d ddd�idd|id�ig}| j jd"krb|jdddii� |j| jd�� g }|jddd td d |d �ii� |jddd td d!|d �ii� |S )#Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |j d�d t|j d�d �d�i�qS )r� r� r r< )r re )r� rn )�.0r^ r4 r4 r5 � <listcomp>� s z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r) r* rL r� )r, r- z==r� )r. r/ r0 r� r� r r� zRFC3964_IPv4_REJECT: z addr-unreachrW rZ rJ r� r< )r] r~ rm ra r} Zfilter_FORWARDrB )r� r� )rM Z _log_deniedr2 r� r� )rT Z daddr_setr� r� r4 r4 r5 �build_rfc3964_ipv4_rules� s: z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|j | j|j�� |j | j|j�� |j | j|j�� g }|j | j|||||�� |j | j|||||�� |j | j |||||�� |S )Nr( ) r2 r r] r r r r r r r )rT r� r� r� r~ r� r� r4 r4 r5 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dkr dS dS )NrG rH �ebTF)rG rH r8 r4 )rT r� r4 r4 r5 �is_ipv_supported� s znftables.is_ipv_supportedc C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||kr�|| S t td | ��d S ) NZ ipv4_addrZ ipv6_addr)rG rH Z inet_protoZ inet_servicer ZifnameZ ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz!ipset type name '%s' is not valid)r r )rT r� r+ Zipv_addr�typesr4 r4 r5 �_set_type_list� s" znftables._set_type_listc C s� |r d|kr |d dkr d}nd}t || j||�d�}x0|jd�d jd�D ]}|dkrLd g|d < P qLW |r�d|kr�|d |d< d|kr�|d |d< g }x0dD ](}d|i} | j|� |jdd| ii� q�W |S )Nr] �inet6rH rG )r~ r� r+ �:r< �,rK �netr Zintervalr1 ZtimeoutZmaxelem�sizerJ rL rW r� )rK r? r )rJ rK rL )r� r; r� r� r2 ) rT r� r+ �optionsr� Zset_dict�tr� r] Z rule_dictr4 r4 r5 �build_set_create_rules� s* z nftables.build_set_create_rulesc C s$ | j |||�}| j|| jj� � d S )N)rC r� rM r� )rT r� r+ rA r� r4 r4 r5 � set_create s znftables.set_createc C s8 x2dD ]*}dd|t |d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� )rJ rK rL )r� r� rM r� )rT r� r] rZ r4 r4 r5 � set_destroy s znftables.set_destroyc C s6 | j jj|�jjd�d jd�}g }x�tt|��D ]�}|| dkrr|jdddii� |jdd |rdd nd d �i� q2|| d kr�|jd| j|�|r�dndd �i� q2|| dkr�|jdd|r�dndii� q2|| dkr�|jdddii� q2t d|| ��q2W dt|�dk�rd|in|d |�r&dndd | d �iS ) Nr= r< r> r r� r` r� r* Zthr r" )r, r- rK r? r r� r� Zifacer� r� r z-Unsupported ipset type for match fragment: %sr) �concatr z!=z==�@)r. r/ r0 )rK r? r ) rM r � get_ipsetr+ r� r re r2 r� r )rT r� Z match_destr � type_formatr3 �ir4 r4 r5 r s$ z nftables._set_match_fragmentc C sN | j jj|�}|jjd�d jd�}|jd�}t|�t|�krHttd��g }�x�tt|��D �]�}|| dk�r,y|| j d�}W n& t k r� |j d� || } Y n,X |j || d |� � || |d d � } y| j d�}W n t k �r |j | � Y n(X |j d| d |� | |d d � gi� q\|| dk�r d|| k�rb|j d|| jd�i� n�y|| j d �}W nL t k �r� || } d |j k�r�|j d d k�r�t | �} |j | � Y n^X || d |� } d |j k�r�|j d d k�r�t | �} |j d| t|| |d d � �d�i� q\|j || � q\W t|�dk�rJd|igS |S )Nr= r< r> z+Number of values does not match ipset type.r Ztcp�-r rK r? r� r] r< r� )r re rF )rK r? )rM r rH r+ r� re r r r ra r� r2 rA r rn ) rT r� �entry�objrI Z entry_tokensZfragmentrJ ra Zport_strr r4 r4 r5 �_set_entry_fragment7 sL ( "z nftables._set_entry_fragmentc C s> g }| j ||�}x(dD ] }|jdd|t||d�ii� qW |S )NrJ rK rL rW r� )r] r~ r� �elem)rJ rK rL )rN r2 r� )rT r� rL r� r� r] r4 r4 r5 �build_set_add_rulesk s z nftables.build_set_add_rulesc C s" | j ||�}| j|| jj� � d S )N)rP r� rM r� )rT r� rL r� r4 r4 r5 �set_addu s znftables.set_addc C sF | j ||�}x4dD ],}dd|t||d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� rO )rJ rK rL )rN r� r� rM r� )rT r� rL r� r] rZ r4 r4 r5 � set_deletey s znftables.set_deletec C s4 g }x*dD ]"}dd|t |d�ii}|j|� q W |S )NrJ rK rL r{ r� )r] r~ r� )rJ rK rL )r� r2 )rT r� r� r] rZ r4 r4 r5 �build_set_flush_rules� s z nftables.build_set_flush_rulesc C s | j |�}| j|| jj� � d S )N)rS r� rM r� )rT r� r� r4 r4 r5 � set_flush� s znftables.set_flushc C sJ | j jj|�}|jdkr d}n(|jrBd|jkrB|jd dkrBd}nd}|S )Nzhash:macr r] r< rL rK )rM r rH r+ rA )rT r� r r] r4 r4 r5 r� � s znftables._set_get_familyc C s� g }|j | j|||�� |j | j|�� d}x^|D ]D}|j | j||�� |d7 }|dkr2| j|| jj� � |j� d}q2W | j|| jj� � d S )Nr r< i� )r� rC rS rP r� rM r� �clear) rT Zset_nameZ type_nameZentriesZcreate_optionsZ entry_optionsr� �chunkrL r4 r4 r5 � set_restore� s znftables.set_restore)N)N)r� )rJ )FrJ )rJ )rJ )F)NN)NN)NN)NN)N)N)N)N)N)F)N)N)F)NN)I�__name__� __module__� __qualname__r� Zpolicies_supportedrV rh rl rt rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r r r r r r! r# r$ r% r& r' r* r+ r, r/ r0 r3 r6 r7 r9 r; rC rD rE r rN rP rQ rR rS rT r� rW r4 r4 r4 r5 rI � s� /.` 4 R i ; - 9 + $ $ $ ' $ < # 4 rI ij���i����)N)(Z __future__r ri rw r Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r r r r r r Zfirewall.core.richr r r r r r r Znftables.nftablesr r� r� r� r� r� r6 r� �objectrI r4 r4 r4 r5 �<module> s� $$