shell bypass 403
3
]ûf�$ � @ s& d gZ ddlZddlmZ ddlmZ ddlmZm Z m
Z
ddl m Z ddl
mZ ddlmZmZ ddlZd gd
d d gd
d dgd�Zi Zi Zi Zx�ej� D ]tZg ee< e� ee< x\ee D ]PZee jde � ee jdeef � ee jde � ee j de � q�W q�W G dd � d e �Z dS )�ebtables� N)�runProg)�log)�tempFile�readfile� splitArgs)�COMMANDS)� ipXtables)�
FirewallError� INVALID_IPVZBROUTINGZ
PREROUTINGZ POSTROUTINGZOUTPUTZINPUTZFORWARD)ZbrouteZnat�filterz -N %s_directz-I %s 1 -j %s_directz-I %s_direct 1 -j RETURNz %s_directc @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd/d d!�Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd0d+d,�Zd-d.� Zd S )1r ZebFc C sB t | j | _t d| j | _| j� | _| j� | _| j� g | _ d S )Nz
%s-restore)
r �ipv�_command�_restore_command� _detect_restore_noflush_optionZrestore_noflush_option�_detect_concurrent_option�concurrent_option� fill_exists�available_tables)�self� r � /usr/lib/python3.6/ebtables.py�__init__9 s
zebtables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsr Zcommand_existsr Zrestore_command_exists)r r r r r A s zebtables.fill_existsc C s( d}t | jddg�}|d dkr$d}|S )N� z --concurrentz-Lr )r r )r r �retr r r r E s
z"ebtables._detect_concurrent_optionc C s. g }y| j |d� W n tk
r( dS X dS )N�offFT)� set_rules�
ValueError)r �rulesr r r r O s z'ebtables._detect_restore_noflush_optionc C s� g }| j r | j |kr |j| j � |dd� |D �7 }tjd| j| jdj|�� t| j|�\}}|dkr~td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr )�.0�itemr r r �
<listcomp>^ s z"ebtables.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s) r �appendr �debug2� __class__r �joinr r )r �argsZ_args�statusr r r r Z__runY s zebtables.__runc C s( x"dD ]}||krt td| ��qW d S )N�
%%REJECT%%�%%ICMP%%� %%LOGTYPE%%z'%s' invalid for ebtables)r, r- r. )r
r )r �rule�strr r r �_rule_validatef s
zebtables._rule_validatec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)r r
�table�chainr r r �is_chain_builtinl s zebtables.is_chain_builtinc C sJ g }|r4|j d|d|g� |j d|d|dddg� n|j d|d|g� |S )Nz-tz-Nz-I�1z-jZRETURNz-X)r& )r �addr3 r4 r! r r r �build_chain_rulesp s zebtables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)r0 )r r7 r3 r4 �indexr* r/ r r r �
build_rule{ s zebtables.build_rulec C s
t j|�S )N)r Zcommon_reverse_rule)r r* r r r � reverse_rule� s zebtables.reverse_rulec C s t j|� d S )N)r Zcommon_check_passthrough)r r* r r r �check_passthrough� s zebtables.check_passthroughc C s
t j|�S )N)r Zcommon_reverse_passthrough)r r* r r r �reverse_passthrough� s z ebtables.reverse_passthroughc
C s< t � }d}i }x�|D ]�}|d d � }| j|� xTdD ]L}y|j|�} W n tk
rZ Y q4X t|�| d kr4|j| � |j| �}q4W x^tt|��D ]N} xHtjD ]>}
|
|| kr�|| j d�o�|| j
d� r�d|| || < q�W q�W |j |g �j |� qW xD|D ]<}|j
d| � x&|| D ]}|j
dj|�d � �q W �q W |j� tj|j�} tjd
| j| jd |j| jf � g } | j d � t| j| |jd
�\}
}tj� dk�rt|j�}|d k �rd} xH|D ]@}tjd| |f ddd� |j
d ��s�tjddd� | d7 } �q�W tj |j� |
dk�r8td| jdj| �|f ��d S )Nr �-t�--table� �"z"%s"z*%s
r% �
z %s: %s %sz%s: %dz --noflush)�stdin� z%8d: %sr )�nofmt�nlr )rE z'%s %s' failed: %s)r> r? ) r r1 r9 r �len�pop�range�stringZ
whitespace�
startswith�endswith�
setdefaultr& �writer) �closer �stat�namer r' r( r �st_sizer ZgetDebugLogLevelr Zdebug3�unlink)r r! �
log_deniedZ temp_filer3 Z table_rulesZ_ruler/ �opt�i�crP r* r+ r �lines�liner r r r � sZ
zebtables.set_rulesc C s | j |� | j|�S )N)r1 �_ebtables__run)r r/ rT r r r �set_rule� s
zebtables.set_ruleNc C s� g }|r|gnt j� }xp|D ]h}|| jkr6|j|� q y*| jd|dg� | jj|� |j|� W q tk
r� tjd| � Y q X q W |S )Nz-tz-Lz#ebtables table '%s' does not exist.)r2 �keysr r& rZ r r Zdebug1)r r3 r Ztablesr r r �get_available_tables� s
z ebtables.get_available_tablesc C s i S )Nr )r r3 r r r �get_zone_table_chains� s z ebtables.get_zone_table_chainsc C sF g }x<t j� D ]0}|| j� kr qx dD ]}|jd||g� q&W qW |S )N�-F�-X�-Zz-t)r_ r` ra )r2 r\ r] r& )r r! r3 �flagr r r �build_flush_rules� s
zebtables.build_flush_rulesc C s^ g }|dkrdn|}xDt j� D ]8}|| j� kr0q x$t | D ]}|jd|d||g� q:W q W |S )NZPANICZDROPz-tz-P)r2 r\ r] r& )r Zpolicyr! Z_policyr3 r4 r r r �build_set_policy_rules� s z ebtables.build_set_policy_rulesc C s g S )Nr )r r r r �build_default_tables� s z ebtables.build_default_tablesr c C s� g }x�t D ]�}|| j� kr q
t | d d � }|dkrJ|tkrJ|jt| � d|g}x:|D ]2}t|�tkrx|j|| � qX|j|t|� � qXW q
W |S )Nr z-t)�
DEFAULT_RULESr] � LOG_RULES�extend�type�listr& r )r rT Z
default_rulesr3 Z_default_rules�prefixr/ r r r �build_default_rules� s
z ebtables.build_default_rulesc C s
|| j kS )N)r
)r r
r r r �is_ipv_supported s zebtables.is_ipv_supported)N)r )�__name__�
__module__� __qualname__r
rQ Zpolicies_supportedr r r r rZ r1 r5 r8 r: r; r< r= r r[ r] r^ rc rd re rl rm r r r r r 4 s0
@
) �__all__Zos.pathr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r Zfirewall.configr Z
firewall.corer Zfirewall.errorsr
r rJ r2 rf rg Z
OUR_CHAINSr\ r3 �setr4 r& r7 �objectr r r r r �<module> s.