관리-도구
편집 파일: ipXtables.cpython-36.pyc
3 @)�f�� � @ s( d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m Z m Z m Z m Z mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z d dl Z dZ!d d d gd d gd d d d d gd d d gd d d gd�Z"ddd�Z#ddd�Z$dd� Z%dd� Z&dd� Z'G dd� de(�Z)G d d � d e)�Z*dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address� check_address� normalizeIP6)�config)� FirewallError�INVALID_PASSTHROUGH� INVALID_RULE� UNKNOWN_ERROR� INVALID_ADDR)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock� �INPUT�OUTPUT�FORWARD� PREROUTING� POSTROUTING)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited)�ipv4�ipv6�icmpz ipv6-icmpc C s� ddddddd�}| dd� }x~|D ]v}y|j |�}W n tk rL w$Y nX |d kr�yt||d � W n tk r~ Y nX |j|d � || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insert� )r' r( )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� r3 � /usr/lib/python3.6/ipXtables.py�common_reverse_rule9 s( r5 c C s� ddddddd�}| dd� }x�|D ]x}y|j |�}W n tk rL w$Y nX |d kr�yt||d � W n tk r~ Y nX |j|d � || ||< |S W ttd ��dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insertr) zno '-A', '-I' or '-N' arg)r6 r7 )r* � ValueErrorr, r- r r )r. r/ r0 �xr2 r3 r3 r4 �common_reverse_passthrough^ s, r: c C s� t | �} t ddddddddd d d d d dddddddg�}t| |@ �dkrbttdt| |@ �d ��t dddddd g�}t| |@ �dkr�ttd ��d S ) zZ Check if passthough rule is valid (only add, insert and new chain rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)�set�lenr r �list)r. Z not_allowedZneededr3 r3 r4 �common_check_passthrough� s* r> c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d � Z d d � Z d d� Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdhd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdid,d-�Zd.d/� Zdjd1d2�Z d3d4� Z d5d6� Z dkd8d9�Z dld:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dmdRdS�Z,dndTdU�Z-dodVdW�Z.dXdY� Z/dpdZd[�Z0dqd\d]�Z1drd^d_�Z2dsd`da�Z3dbdc� Z4ddde� Z5dfdg� Z6d!S )t� ip4tablesr$ Tc C sd || _ tj| j | _tjd| j | _| j� | _| j� | _ | j � g | _ i | _ i | _ g | _i | _d S )Nz %s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache� our_chains)�self�fwr3 r3 r4 �__init__� s zip4tables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsrB Zcommand_existsrC Zrestore_command_exists)rN r3 r3 r4 rH � s zip4tables.fill_existsc C s� | j r(| j |kr(| j gdd� |D � }ndd� |D �}tjd| j| jdj|�� t| j|�\}}|dkr�td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr3 )�.0�itemr3 r3 r4 � <listcomp>� s z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS )z%sr3 )rT rU r3 r3 r4 rV � s z %s: %s %s� r z'%s %s' failed: %s)rE r �debug2� __class__rB �joinr r8 )rN r. Z_args�status�retr3 r3 r4 Z__run� s zip4tables.__runc C s< y|j |�}W n tk r" dS X ||||d �< dS d S )NF� T)r* r8 )rN �rule�patternZ replacement�ir3 r3 r4 � _rule_replace� s zip4tables._rule_replacec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)rN rA �table�chainr3 r3 r4 �is_chain_builtin� s zip4tables.is_chain_builtinc C s2 d|g}|r|j d� n |j d� |j |� |gS )Nz-tz-Nz-X)�append)rN �addrc rd r^ r3 r3 r4 �build_chain_rules� s zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)�str)rN rg rc rd r* r. r^ r3 r3 r4 � build_rule� s zip4tables.build_rulec C s t |�S )N)r5 )rN r. r3 r3 r4 � reverse_rule� s zip4tables.reverse_rulec C s t |� d S )N)r> )rN r. r3 r3 r4 �check_passthrough� s zip4tables.check_passthroughc C s t |�S )N)r: )rN r. r3 r3 r4 �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}y|j d�}W n tk r& Y n X t|�|d krD||d }d }xLd D ]D}y|j |�}W n tk rt Y qNX t|�|d krN||d }qNW ||fS ) Nr# z-tr] �-A�--append�-I�--insert�-N� --new-chain)rn ro rp rq rr rs )r* r8 r< )rN r. rc r` rd �optr3 r3 r4 � passthrough_parse_table_chain� s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d�}|j|� |j|�}d|d kr:||d f}n ||d f}W nF tk r� y |j d�}|j|� d }W n tk r� d S X Y nX d}|d dkr�d }|r�| r�||kr�|j|� nn|�r0|� r�||kr�|j|� |jd d � d� |j |�}n| jj�r d}nt|�}d|d< |j dd|d � d S )Nz%%ZONE_SOURCE%%z-m� � � z%%ZONE_INTERFACE%%Tr �-D�--deleteFc S s | d S )Nr r3 )r9 r3 r3 r4 �<lambda>& s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyz-Ir) z%dr] )ry rz ) r* r- r8 �removerf �sortr@ �_allow_zone_driftingr< �insert)rN r^ rL r` �zoneZ zone_source�rule_addr* r3 r3 r4 �_run_replace_zone_source s> z"ip4tables._run_replace_zone_sourcec C s y|j |�}W n tk r$ Y �n�X d}d}d}|j|� |j|�}t|�tkr\ttd��d} xLdD ]D} y|j | �} W n tk r� Y qfX t|�| d krf|| d } qfW xhdD ]`} y|j | �}W n tk r� Y q�X t|�|d k� r�||d } | dk�rd}| dkr�d}q�W | | f} |�sp| |k�sP||| k�sP|| | dk�rZttd��|| | d8 < n�| |k�r�i || < ||| k�r�d|| |< d} xHt || j � �D ]4}||k�r�|�r�P | || | 7 } ||k�r�P �q�W || | d7 < d ||< |j |d d| � dS )a Change something like -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123 or -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321 into -t filter -I public_IN 4 or -t filter -I public_IN TFr] z%priority must be followed by a numberr# �-t�--table�-A�--append�-I�--insert�-D�--deleter z*nonexistent or underflow of priority countr) z%dN���)r� r� )r� r� r� r� r� r� )r� r� )r� r� ) r* r8 r- �typer, r r r< r �sorted�keysr� )rN r^ Zpriority_counts�tokenr` r� r� Zinsert_add_index�priorityrc rt �jrd r* �pr3 r3 r4 �_set_rule_replace_priority2 sj z$ip4tables._set_rule_replace_priorityc C sP t � }i }tj| j�}tj| j�}tj| j�}�x�|D �]�}|d d � } | j| dddt| j g� | j| dt | j g� y| j d�} W n t k r� Y n8X |dkr�q6|d$kr�d d d |g| | | d �< n | j | � | j | |d� | j | |d� | j| |� d} xZd%D ]R} y| j | �} W n t k �r, Y n(X t| �| d k�r| j | � | j | �} �qW xhtt| ��D ]X} xPtjD ]F} | | | k�rt| | jd��o�| | jd� �rtd| | | | < �qtW �qhW |j| g �j| � q6W xR|D ]J} || }|jd| � x"|D ]} |jdj| �d � �q W |jd� �q�W |j� tj|j �}t j d| j | j d|j |j!f � g }| j"�rz|j| j"� |jd� t#| j ||j d �\}}t j$� d k�r t%|j �}|d k �r d } xH|D ]@}t j&d | |f d d d � |jd��s�t j&d!d d"� | d 7 } �q�W tj'|j � |d k�r:t d#| j dj|�|f ��|| _|| _|| _d S )&Nz %%REJECT%%�REJECTz --reject-withz%%ICMP%%z %%LOGTYPE%%�off�unicast� broadcast� multicastz-m�pkttypez --pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r# �-t�--table�"z"%s"z*%s rW � zCOMMIT z %s: %s %sz%s: %dz-n)�stdinr) z%8d: %sr )�nofmt�nlr )r� z'%s %s' failed: %s)r� r� r� )r� r� )(r �copy�deepcopyrJ rK rL ra �DEFAULT_REJECT_TYPErA �ICMPr* r8 r- r� r� r< �range�stringZ whitespace� startswith�endswith� setdefaultrf �writerZ �closerQ �stat�namer rX rY rC �st_sizerG r ZgetDebugLogLevelr Zdebug3�unlink)rN �rules� log_denied� temp_fileZ table_rulesrJ rK rL Z_ruler^ r` rc rt �cr� r. r[ r\ �lines�liner3 r3 r4 � set_rules� s� zip4tables.set_rulesc C s� | j |dddt| j g� | j |dt| j g� y|jd�}W n tk rR Y n:X |dkr`dS |dkr�d d d |g|||d �< n |j|� tj| j �}tj| j �}tj| j �}| j ||d� | j ||d� | j ||� | j|�}|| _ || _ || _ |S )Nz %%REJECT%%r� z --reject-withz%%ICMP%%z %%LOGTYPE%%r� r r� r� r� z-mr� z --pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r� r� r� )ra r� rA r� r* r8 r- r� r� rJ rK rL r� r� �_ip4tables__run)rN r^ r� r` rJ rK rL �outputr3 r3 r4 �set_rule� s. zip4tables.set_ruleNc C s� g }|r|gnt j� }xx|D ]p}|| jkr6|j|� q y,| jd|ddg� | jj|� |j|� W q tk r� tjd| j|f � Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) rb r� rI rf r� r8 r �debug1rA )rN rc r\ Ztablesr3 r3 r4 �get_available_tables s z ip4tables.get_available_tablesc C s` d}t | jdddg�}|d dkr\d}t | jdddg�}|d dkrHd}tjd| j| j|� |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rB r rX rY )rN rE r\ r3 r3 r4 rD s z ip4tables._detect_wait_optionc C s� t � }|jd� |j� d}xJd D ]B}t| j|g|jd�}|d dkr"d|d kr"d |d kr"|}P q"W tjd | j| j|� t j |j� |S ) Nz#foor �-w�--wait=2)r� r zinvalid optionr] zunrecognized optionz %s: %s will be using %s option.)r� r� ) r r� r� r rC r� r rX rY rQ r� )rN r� rE Z test_optionr\ r3 r3 r4 rF " s z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj� D ].}| j|�s0q x dD ]}|jd||g� q6W q W |S )N�-F�-X�-Zz-t)r� r� r� )rJ rK rL rb r� r� rf )rN r� rc �flagr3 r3 r4 �build_flush_rules5 s zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j� D ]@}| j|�s.q |dkr8q x$t | D ]}|jd|d||g� qBW q W |S )NZPANIC�DROPr" z-tz-P)rb r� r� rf )rN �policyr� �_policyrc rd r3 r3 r4 �build_set_policy_rulesD s z ip4tables.build_set_policy_rulesc C s g }d}y"| j d| jdkr dnddg�}W nJ tk rt } z.| jdkrVtjd| � ntjd| � W Y d d }~X nX |j� }d }x�|D ]�}|r�|j� j� }|j� }xD|D ]<} | j d �r�| j d �r�| d d� } n| } | |kr�|j | � q�W | jdko�|j d��s| jdkr�|j d�r�d}q�W |S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr z-pr$ r& z ipv6-icmpz--helpziptables error: %szip6tables error: %sNF�(�)r] zValid ICMP Types:r% zValid ICMPv6 Types:Tr� ) r� rA r8 r r� � splitlines�strip�lower�splitr� r� rf ) rN rA r\ r� Zexr� Zin_typesr� Zsplitsr� r9 r3 r3 r4 �supported_icmp_typesP s4 z ip4tables.supported_icmp_typesc C s g S )Nr3 )rN r3 r3 r4 �build_default_tablesq s z ip4tables.build_default_tablesr� c C s i }| j d�rpg |d< t� | jd< xLtd D ]@}|d jd| � |d jd||f � | jd jd| � q,W | j d��r\g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dkr�xt| jjr�ddd d gndd d gD ]R}|d jd ||f � |d jd |||f � | jd jtd ||f g�� �qW q�W | j d��rNg |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dk�r�xv| jj�r�ddd d gndd d gD ]R}|d jd ||f � |d jd |||f � | jd jtd ||f g�� �q�W �q�W | j d��r@g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |d9k�rxxv| jj�r�ddd d gndd d gD ]R}|d jd ||f � |d jd |||f � | jd jtd ||f g�� �q�W �qxW g |d< t� | jd< |d jd� |d jd� |d jd� |d jd� | jd jtd�� xf| jj�r�ddd d gndd d gD ]B}|d jd| � |d jd| � | jd jtd| �� �q�W |dk�r |d jd� |d jd � |dk�rF|d jd � |d jd � |d jd � |d jd � |d jd!� |d jd"� | jd jtd#�� xJd:D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �q�W xzd;D ]r}xj| jj�r dd gnd gD ]N}|d jd)||f � |d jd*||f � | jd jtd+||f �� �qW �q�W xJd<D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �qnW |dk�r�|d jd,� |d jd-� |dk�r�|d jd.� |d jd/� |d d0d1d2d3g7 < | jd jtd4�� xJd=D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q2W xJd>D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q~W g }xJ|D ]B}|| j � k�r�q�x(|| D ] }|jd8|gt |� � �q�W �q�W |S )?Nr z -N %s_directz-A %s -j %s_directz %s_directr r � POLICIES_preZ ZONES_SOURCEZZONES� POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr! r" r r# zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz -N FORWARD_%sz-A FORWARD -j FORWARD_%sz FORWARD_%s�IN�OUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r )r� )r� r� )r� )r� )r� ) r� r; rM rb rf rg r@ r �updater ) rN r� Z default_rulesrd Zdispatch_suffix� directionZfinal_default_rulesrc r^ r3 r3 r4 �build_default_rulesu s� $( &* &* & ( "z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j � kr,dhS |dkrHd| j � krHddhS |d krbd | j � krbdhS i S ) Nr# r � FORWARD_IN� FORWARD_OUTr! r r" r r )r� )rN rc r3 r3 r4 �get_zone_table_chains� s z ip4tables.get_zone_table_chainsc s� | j jj|���jdk r dnd��dkr4�dkr4dnd} | j jj|�t| �� g } g } x|D ]} | jd| g� qZW x|D ]} | jd | g� qvW xB|D ]:} | j jj| �}|dkr�| j |� r�q�| j| j d | �� q�W x\|D ]T} | j jj| �}|dk�r| j |� �rq�t | ��r�dk�rq�| j| j d| �� q�W � �����fdd�}g }| �r�x�| D ]F}| �r�x8| D ]}|j|||�� �qdW n|�r�n|j||d �� �qTW nH|�r�n@| �r�x8| D ]}|j|d |�� �q�W n|�r�n|j|d d �� |S )Nr �pre�postr" r TFz-iz-or$ r% z-sr� r z-dc sV ddd�� }d�|d��f d�j g}| r6|j| � |rD|j|� |jd� g� |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r� �extend)�ingress_fragment�egress_fragment�add_delr^ )r� rd � chain_suffix�enable�p_objrc r3 r4 � _generate_policy_dispatch_rule s zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)r$ r% )r$ r% )r r� r ) r@ r� Z get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXrf r� Z check_source�is_ipv_supported�_rule_addr_fragmentr )rN r� r� rc rd Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrA r� r� r� r� r3 )r� rd r� r� r� rc r4 �!build_policy_ingress_egress_rules� sR z+ip4tables.build_policy_ingress_egress_rulesFc C s� |dkr|dkrdnd}| j jj||t|d�} ddddddd�| } d } |rb| rbd d | d g} n,|rtd d | g} ndd | g} |s�| d g7 } | d|| || | g7 } | gS )Nr" r TF)r� z-iz-o)r r r r� r� r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)r@ r� r� r� ) rN r� r� r� r� rc rd rf r� r� rt �actionr^ r3 r3 r4 �!build_zone_source_interface_rulesK s& z+ip4tables.build_zone_source_interface_rulesc C s� |j d�rP|dd � }|dkr$d}nd}dj|g| jjj|� �}ddd ||gS t|�rz|dkrjttd ��dd d |j� gS t d |�r�t |�}n,t d |�r�|j d�}t |d �d |d }||gS d S )Nzipset:� z-d�dst�src�,z-mr; z --match-setz Can't match a destination MAC.�macz --mac-sourcer% �/r r] ) r� rZ r@ �ipsetZ get_dimensionr r r �upperr r r r� )rN rt �address�invertr� �flags� addr_splitr3 r3 r4 r� e s" z ip4tables._rule_addr_fragmentc C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d d d d d d �| } | j jrdd | } nd | } t|�r�|dkr�g S || d|d|g} | j| j| |�� | jd| g� | gS )Nz-Iz-D)TFr" r TF)r� z-sz-d)r r r r� r� r z%s_ZONES_SOURCEz%s_ZONESr� r z%%ZONE_SOURCE%%z-tz-g)r r� r )r@ r� r� r� r r r� r� ) rN r� r� r� r� rc rd r� r� r� rt Zzone_dispatch_chainr^ r3 r3 r4 � build_zone_source_address_rules{ s& z)ip4tables.build_zone_source_address_rulesc C s> ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d �}| j| jt|d | d | d | d| d| g�� g } | j||d|g� | j|d | d|g� | j|d | d|g� | j|d | d|g� | j|d| d|g� | j|d| d|g� | j||d|dd | g� | j||d|dd | g� | j||d|dd | g� | j||d|dd| g� | j||d|dd| g� | j jj| j } | j j � dk�r|dk�r| d k�r�| j||d|ddddd| g � | dk�r| j||d|ddddd| g � |dk�r,| d k�r,| j||d|d| g� |�s:| j � | S ) Nz-Nz-X)TFz-Az-Dr" r TF)r� z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr� r# r� � %%REJECT%%z %%LOGTYPE%%�LOGz --log-prefixz "%s_REJECT: "r� z "%s_DROP: "�ACCEPT)r� r� )r� r� r� r� ) r@ r� r� r� rM r� r; rf Z _policies�target�get_log_denied�reverse) rN r� r� rc rd Z add_del_chainZ add_del_ruler� r� r� r� r3 r3 r4 �build_policy_chain_rules� sN z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-m�limitz--limitz --limit-burst)�valueZburst)rN r �sr3 r3 r4 � _rule_limit� s zip4tables._rule_limitc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt t dt |j� ��n t t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r �allowZdenyr� r� ) r� �elementr r r r� r r r r r r r� )rN � rich_ruler3 r3 r4 �_rich_rule_chain_suffix� s z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r r� )rN r r3 r3 r4 � _rich_rule_chain_suffix_from_log� s z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r� )rN r r3 r3 r4 � _rich_rule_priority_fragment� s z&ip4tables._rich_rule_priority_fragmentc C s� |j s g S | jjj||t�}ddd�| }| j|�}d||d||f g} | | j|�7 } | |ddg 7 } |j jr�| dd |j j g7 } |j jr�| d d |j j g7 } | | j |j j �7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr� z --log-prefixz'%s'z --log-levelz%s) r r@ r� r� r� r r �prefix�levelr r ) rN r� r r� rc � rule_fragmentr� r� r� r^ r3 r3 r4 �_rich_rule_log� s zip4tables._rich_rule_logc C s� |j s g S ddd�| }| jjj||t�}| j|�}d||d||f g} | | j|�7 } | |7 } t|j�t krrd} n,t|j�t kr�d} nt|j�t kr�d} nd } | d d d | g7 } | | j |j j �7 } | S ) Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdrop�unknownz-jZAUDITz--type)r r@ r� r� r� r r r� r� r r r r r ) rN r� r r� rc r r� r� r� r^ Z_typer3 r3 r4 �_rich_rule_audit s$ zip4tables._rich_rule_auditc C s2 |j s g S ddd�| }| jjj||t�}| j|�}d||f } t|j �tkrXddg} n�t|j �tkr�ddg} |j jr�| d|j jg7 } nnt|j �t kr�dd g} nVt|j �t kr�d }| jjj||t�}d||f } dd d |j j g} nt t d t|j � ��d||| g} | | j|�7 } | || 7 } | | j|j j�7 } | S )Nz-Az-D)TFz%s_%sz-jr� r� z --reject-withr� r! �MARKz --set-xmarkzUnknown action %sz-t)r� r@ r� r� r� r r� r r r r r; r r r r r ) rN r� r r� rc r r� r� r� rd Z rule_actionr^ r3 r3 r4 �_rich_rule_action$ s4 zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }q�td|j �r||j jd�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|jd� | jj j |jd �}|d |j|g7 }|S ) N�!r% z-dr� r r] z-mr; r� z --match-set) r� r� rf r r r r� r� r@ r� �_ipset_match_flags)rN Z rich_destr r� r� r3 r3 r4 � _rich_rule_destination_fragmentF s& " z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }nHtd|j �r||j jd�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|jd� |d |jg7 }nPt|d �o�|j �r|dd g7 }|jr�|jd� | j j j |j d �}|d |j |g7 }|S )Nr r% z-sr� r r] r� z-mz --mac-sourcer� r; r� z --match-set) r� r� rf r r r r� �hasattrr� r� r@ r� r )rN Z rich_sourcer r� r� r3 r3 r4 �_rich_rule_source_fragment^ s0 " z$ip4tables._rich_rule_source_fragmentc C s ddd�| }d}| j jj||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | j|j�7 } | | j|j�7 } | s�t |j �t kr�| d d d d g7 } g } |r�| j | j ||||| �� | j | j||||| �� | j | j||||| �� n"| j |d | d|g| ddg � | S )Nz-Az-D)TFr# z-pz--dportz%sz-dz-m� conntrackz --ctstatez NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r � destinationr �sourcer� r� r rf r r r ) rN r� r� �proto�portr r r� rc r� r r� r3 r3 r4 �build_policy_ports_rules{ s* z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j jj||t�}d|g} |r<| d|g7 } |r`| | j|j�7 } | | j|j�7 } | stt|j �t kr�| ddd d g7 } g } |r�| j | j ||||| �� | j | j ||||| �� | j | j||||| �� n"| j |d | d |g| d dg � | S )Nz-Az-D)TFr# z-pz-dz-mr z --ctstatez NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r� r� r rf r r r ) rN r� r� �protocolr r r� rc r� r r� r3 r3 r4 �build_policy_protocol_rules� s& z%ip4tables.build_policy_protocol_rulesc C s ddd�| }d}| j jj||t�} d|g} |rD| ddt|� g7 } |rT| d|g7 } |rx| | j|j�7 } | | j|j�7 } | s�t |j �t kr�| d d d d g7 } g } |r�| j | j ||||| �� | j | j||||| �� | j | j||||| �� n"| j |d | d|g| ddg � | S )Nz-Az-D)TFr# z-pz--sportz%sz-dz-mr z --ctstatez NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r r� r� r rf r r r ) rN r� r� r r r r r� rc r� r r� r3 r3 r4 � build_policy_source_ports_rules� s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t�} ddd�| } | d| ddd|g} |rP| dd t|� g7 } |r`| d |g7 } | d d d |g7 } | gS )Nr z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)r@ r� r� r� r ) rN r� r� r r r Z helper_nameZmodule_short_namerc r� r� r^ r3 r3 r4 � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rH| jdd|d| d|dd g� n6t|�rTg S | jdd|d| g| jd |� dd g � | S ) Nz-Az-D)TFz-tr# z%s_allowz-oz-jr� z-d)r@ r� r� r� rf r r� ) rN r� r� r� rc r� r r� r� r� r3 r3 r4 �build_zone_forward_rules� s z"ip4tables.build_zone_forward_rulesc C s, d}| j jj||tdd�}ddd�| }g }|rj| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}g } | j dd|d ||f g| d d d d dg � g }|r�| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}d}| j jj||t�}| j dd|d ||f g| ddddd dg � | S )Nr" T)r� z-Az-D)TFr z-tz%s_%sr z-o�loz-jZ MASQUERADEr# z-mr z --ctstatez NEW,UNTRACKEDr� ) r@ r� r� r� r r r r r r rf ) rN r� r� r rc r� r� r r� r� r3 r3 r4 � build_policy_masquerade_rules� s6 z'ip4tables.build_policy_masquerade_rulesc C s d}| j jj||t�} ddd�| } d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| j|�} | j|�} | | j |j �7 } | | j |j �7 } nd } g }|r�|j | j|||d| �� |j d d| d | | f g| d |dt|�ddd| g � |S )Nr" z-Az-D)TFr r% z[%s]z:%s�-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)r@ r� r� r� r r r r r r r r r rf r )rN r� r� r r ZtoportZtoaddrr rc r� r� Ztor r� r� r3 r3 r4 � build_policy_forward_port_rules s2 z)ip4tables.build_policy_forward_port_rulesc C s� d}| j jj||t�}ddd�| }| jdkrFddg}ddd |jg} ndd g}dd d |jg} g } | j jj|�r|d | } d} n d| } d} g } |r�| | j|j�7 } | | j |j �7 } | || 7 } |�rP| j | j ||||| �� | j | j ||||| �� |j�r| j | j||||| �� n:| j|�}| j d||d||f g| j|� | ddg � n`| j j� dk�r�| dk�r�| j || d|g| ddddd| g � | j || d|g| d| g � | S )Nr# z-Az-D)TFr$ z-pr& z-mz --icmp-typez ipv6-icmpZicmp6z --icmpv6-typez%s_allowr� z%s_denyz %%REJECT%%z-tz%s_%sz-jr� z %%LOGTYPE%%r� z --log-prefixz"%s_ICMP_BLOCK: ")r@ r� r� r� rA r� �query_icmp_block_inversionr r r r rf r r r� r r r r� )rN r� r� Zictr rc r� r� r �matchr� Z final_chainZ final_targetr r� r3 r3 r4 � build_policy_icmp_block_rules3 sJ z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }d}| j jj|�r�d}| j j� dkr�|rRd|t|�g}nd|g}|d|dd d d d d d| g }|j|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|j|� |S )Nr# r� z %%REJECT%%r� z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr� z --log-prefixz"%s_ICMP_BLOCK: "r] r� )r@ r� r� r� r) r� ri rf ) rN r� r� rc r� r� Zrule_idxZ ibi_targetr^ r3 r3 r4 �'build_policy_icmp_block_inversion_rulesd s. z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j�7 }|| j|j�7 }g }|j| j|||||�� |j| j|||||�� |j| j|||||�� |S )Nr# )r r r r rf r r r )rN r� r� r rc r r� r3 r3 r4 �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s || j kS )N)rA )rN rA r3 r3 r4 r� � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)N)N)N)7�__name__� __module__� __qualname__rA r� Zpolicies_supportedrP rH r� ra re rh rj rk rl rm ru r� r� r� r� r� rD rF r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r! r" r# r$ r& r( r+ r, r- r� r3 r3 r3 r4 r? � sh )Pa# ! zN 0 " & ! 1"r? c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr% Fc C s� g }|j ddddddddd d g � |d krL|j ddddddddd d d dg � |j dddddddd dg � |j dddddddd dg � |S )Nz-Ir z-tr! z-mZrpfilterz--invertz --validmarkz-jr� r� r� z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr� z"--icmpv6-type=router-advertisement)rf )rN r� r� r3 r3 r4 �build_rpfilter_rules� s$ z ip6tables.build_rpfilter_rulesc C s� ddddddddd g }d }| j d j|� g }|jd d d |g� xT|D ]L}|jd d d|d|ddddg � | jjd krF|jd d d|d|ddddg � qFW |jd d dddd|g� |jd d dddd|g� |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r# z-tz-Nz-Iz-dz-jr� z --reject-withz addr-unreachr� �allr� z --log-prefixz"RFC3964_IPv4_REJECT: "r �4r )r� r3 )rM rg rf r@ Z _log_denied)rN Z daddr_listZ chain_namer� Zdaddrr3 r3 r4 �build_rfc3964_ipv4_rules� s4 z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rA r� r2 r5 r3 r3 r3 r4 r1 � s r1 )+Zos.pathrQ r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r r Zfirewallr Zfirewall.errorsr r r r r Zfirewall.core.richr r r r r r r r� r� rb r� r� r5 r: r> �objectr? r1 r3 r3 r3 r4 �<module> s@ ( $ %* x