shell bypass 403
3
]ûf�� � @ s( d dl Zd dlZd dlmZ d dlmZ d dlmZm Z m
Z
m Z m Z m
Z
mZmZ d dlmZ d dlmZmZmZmZmZ d dlmZmZmZm Z m Z m Z m Z d dl Z dZ!d d
d gd d
gd d
d d
d gd d
d
gd d
d gd�Z"ddd�Z#ddd�Z$dd� Z%dd� Z&dd� Z'G dd� de(�Z)G d d � d e)�Z*dS ) � N)�runProg)�log)�tempFile�readfile� splitArgs� check_mac�portStr�check_single_address�
check_address� normalizeIP6)�config)�
FirewallError�INVALID_PASSTHROUGH� INVALID_RULE�
UNKNOWN_ERROR� INVALID_ADDR)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock� �INPUT�OUTPUT�FORWARD�
PREROUTING� POSTROUTING)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited)�ipv4�ipv6�icmpz ipv6-icmpc C s� ddddddd�}| dd� }x~|D ]v}y|j |�}W n tk
rL w$Y nX |d
kr�yt||d � W n tk
r~ Y nX |j|d � || ||< q$W |S ) z Inverse valid rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insert� )r' r( )�index� Exception�int�pop)�args� replace_args�ret_args�arg�idx� r3 � /usr/lib/python3.6/ipXtables.py�common_reverse_rule9 s(
r5 c C s� ddddddd�}| dd� }x�|D ]x}y|j |�}W n tk
rL w$Y nX |d kr�yt||d � W n tk
r~ Y nX |j|d � || ||< |S W ttd
��dS ) z Reverse valid passthough rule z-Dz--deletez-Xz--delete-chain)z-Az--appendz-Iz--insertz-Nz --new-chainN�-I�--insertr) zno '-A', '-I' or '-N' arg)r6 r7 )r* �
ValueErrorr, r- r
r )r. r/ r0 �xr2 r3 r3 r4 �common_reverse_passthrough^ s,
r: c C s� t | �} t ddddddddd d
d d d
dddddddg�}t| |@ �dkrbttdt| |@ �d ��t dddddd g�}t| |@ �dkr�ttd ��d S ) zZ Check if passthough rule is valid (only add, insert and new chain
rules are allowed) z-Cz--checkz-Dz--deletez-Rz --replacez-Lz--listz-Sz --list-rulesz-Fz--flushz-Zz--zeroz-Xz--delete-chainz-Pz--policyz-Ez--rename-chainr zarg '%s' is not allowedz-Az--appendz-Iz--insertz-Nz --new-chainzno '-A', '-I' or '-N' argN)�set�lenr
r �list)r. Z not_allowedZneededr3 r3 r4 �common_check_passthrough� s*
r> c @ s� e Zd ZdZd ZdZdd� Zdd� Zdd� Zd d
� Z d d � Z
d
d� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zdhd"d#�Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zdid,d-�Zd.d/� Zdjd1d2�Z d3d4� Z d5d6� Z dkd8d9�Z dld:d;�Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dmdRdS�Z,dndTdU�Z-dodVdW�Z.dXdY� Z/dpdZd[�Z0dqd\d]�Z1drd^d_�Z2dsd`da�Z3dbdc� Z4ddde� Z5dfdg� Z6d!S )t� ip4tablesr$ Tc C sd || _ tj| j | _tjd| j | _| j� | _| j� | _ | j
� g | _ i | _ i | _
g | _i | _d S )Nz
%s-restore)�_fwr ZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option� wait_option�_detect_restore_wait_option�restore_wait_option� fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�
our_chains)�self�fwr3 r3 r4 �__init__� s
zip4tables.__init__c C s$ t jj| j�| _t jj| j�| _d S )N)�os�path�existsrB Zcommand_existsrC Zrestore_command_exists)rN r3 r3 r4 rH � s zip4tables.fill_existsc C s� | j r(| j |kr(| j gdd� |D � }ndd� |D �}tjd| j| jdj|�� t| j|�\}}|dkr�td| jdj|�|f ��|S )Nc S s g | ] }d | �qS )z%sr3 )�.0�itemr3 r3 r4 �
<listcomp>� s z#ip4tables.__run.<locals>.<listcomp>c S s g | ] }d | �qS )z%sr3 )rT rU r3 r3 r4 rV � s z %s: %s %s� r z'%s %s' failed: %s)rE r �debug2� __class__rB �joinr r8 )rN r. Z_args�status�retr3 r3 r4 Z__run� s zip4tables.__runc
C s< y|j |�}W n tk
r" dS X ||||d �< dS d S )NF� T)r* r8 )rN �rule�patternZ replacement�ir3 r3 r4 �
_rule_replace� s zip4tables._rule_replacec C s |t ko|t | kS )N)�BUILT_IN_CHAINS)rN rA �table�chainr3 r3 r4 �is_chain_builtin� s zip4tables.is_chain_builtinc C s2 d|g}|r|j d� n
|j d� |j |� |gS )Nz-tz-Nz-X)�append)rN �addrc rd r^ r3 r3 r4 �build_chain_rules� s
zip4tables.build_chain_rulesc C s8 d|g}|r |d|t |�g7 }n |d|g7 }||7 }|S )Nz-tz-Iz-D)�str)rN rg rc rd r* r. r^ r3 r3 r4 �
build_rule� s zip4tables.build_rulec C s t |�S )N)r5 )rN r. r3 r3 r4 � reverse_rule� s zip4tables.reverse_rulec C s t |� d S )N)r> )rN r. r3 r3 r4 �check_passthrough� s zip4tables.check_passthroughc C s t |�S )N)r: )rN r. r3 r3 r4 �reverse_passthrough� s z ip4tables.reverse_passthroughc C s� d}y|j d�}W n tk
r& Y n X t|�|d krD||d }d }xLd
D ]D}y|j |�}W n tk
rt Y qNX t|�|d krN||d }qNW ||fS ) Nr# z-tr] �-A�--append�-I�--insert�-N� --new-chain)rn ro rp rq rr rs )r* r8 r< )rN r. rc r` rd �optr3 r3 r4 � passthrough_parse_table_chain� s$ z'ip4tables.passthrough_parse_table_chainc C s4 yH|j d�}|j|� |j|�}d|d kr:||d f}n ||d f}W nF tk
r� y |j d�}|j|� d }W n tk
r� d S X Y nX d}|d dkr�d }|r�| r�||kr�|j|� nn|�r0|� r�||kr�|j|� |jd d
� d� |j |�}n| jj�r d}nt|�}d|d< |j dd|d � d S )Nz%%ZONE_SOURCE%%z-m� � � z%%ZONE_INTERFACE%%Tr �-D�--deleteFc S s | d S )Nr r3 )r9 r3 r3 r4 �<lambda>& s z4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyz-Ir) z%dr] )ry rz )
r* r- r8 �removerf �sortr@ �_allow_zone_driftingr< �insert)rN r^ rL r` �zoneZ zone_source�rule_addr* r3 r3 r4 �_run_replace_zone_source s>
z"ip4tables._run_replace_zone_sourcec C s y|j |�}W n tk
r$ Y �n�X d}d}d}|j|� |j|�}t|�tkr\ttd��d} xLdD ]D}
y|j |
�} W n tk
r� Y qfX t|�| d krf|| d } qfW xhdD ]`}
y|j |
�}W n tk
r� Y q�X t|�|d k� r�||d } |
dk�rd}|
dkr�d}q�W | | f} |�sp| |k�sP||| k�sP|| | dk�rZttd��|| | d8 < n�| |k�r�i || < ||| k�r�d|| |< d}
xHt || j
� �D ]4}||k�r�|�r�P |
|| | 7 }
||k�r�P �q�W || | d7 < d
||< |j |d d|
� dS )a
Change something like
-t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
-t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
-t filter -I public_IN 4
or
-t filter -I public_IN
TFr] z%priority must be followed by a numberr# �-t�--table�-A�--append�-I�--insert�-D�--deleter z*nonexistent or underflow of priority countr) z%dN���)r� r� )r� r� r� r� r� r� )r� r� )r� r� ) r* r8 r- �typer, r
r r< r �sorted�keysr� )rN r^ Zpriority_counts�tokenr` r� r� Zinsert_add_index�priorityrc rt �jrd r* �pr3 r3 r4 �_set_rule_replace_priority2 sj
z$ip4tables._set_rule_replace_priorityc C sP t � }i }tj| j�}tj| j�}tj| j�}�x�|D �]�}|d d � } | j| dddt| j g� | j| dt | j g� y| j
d�}
W n t k
r� Y n8X |dkr�q6|d$kr�d
d d |g| |
|
d
�< n
| j |
� | j
| |d� | j
| |d� | j| |� d} xZd%D ]R} y| j
| �}
W n t k
�r, Y n(X t| �|
d
k�r| j |
� | j |
�} �qW xhtt| ��D ]X}
xPtjD ]F}
|
| |
k�rt| |
jd��o�| |
jd� �rtd| |
| |
< �qtW �qhW |j| g �j| � q6W xR|D ]J} || }|jd| � x"|D ]} |jdj| �d � �q W |jd� �q�W |j� tj|j �}t j d| j | j d|j |j!f � g }| j"�rz|j| j"� |jd� t#| j ||j d �\}}t j$� d k�r
t%|j �}|d k �r
d
}
xH|D ]@}t j&d |
|f d
d d � |jd��s�t j&d!d
d"� |
d
7 }
�q�W tj'|j � |d k�r:t d#| j dj|�|f ��|| _|| _|| _d S )&Nz
%%REJECT%%�REJECTz
--reject-withz%%ICMP%%z %%LOGTYPE%%�off�unicast� broadcast� multicastz-m�pkttypez
--pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r# �-t�--table�"z"%s"z*%s
rW �
zCOMMIT
z %s: %s %sz%s: %dz-n)�stdinr) z%8d: %sr )�nofmt�nlr )r� z'%s %s' failed: %s)r� r� r� )r� r� )(r �copy�deepcopyrJ rK rL ra �DEFAULT_REJECT_TYPErA �ICMPr* r8 r- r� r� r< �range�stringZ
whitespace�
startswith�endswith�
setdefaultrf �writerZ �closerQ �stat�namer rX rY rC �st_sizerG r ZgetDebugLogLevelr Zdebug3�unlink)rN �rules�
log_denied� temp_fileZ table_rulesrJ rK rL Z_ruler^ r` rc rt �cr� r. r[ r\ �lines�liner3 r3 r4 � set_rules� s�
zip4tables.set_rulesc
C s� | j |dddt| j g� | j |dt| j g� y|jd�}W n tk
rR Y n:X |dkr`dS |dkr�d d d
|g|||d �< n
|j|� tj| j �}tj| j
�}tj| j �}| j ||d� | j ||d� | j
||� | j|�}|| _ || _
|| _ |S )Nz
%%REJECT%%r� z
--reject-withz%%ICMP%%z %%LOGTYPE%%r� r r� r� r� z-mr� z
--pkt-typer] z%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%)r� r� r� )ra r� rA r� r* r8 r- r� r� rJ rK rL r� r� �_ip4tables__run)rN r^ r� r` rJ rK rL �outputr3 r3 r4 �set_rule� s.
zip4tables.set_ruleNc C s� g }|r|gnt j� }xx|D ]p}|| jkr6|j|� q y,| jd|ddg� | jj|� |j|� W q tk
r� tjd| j|f � Y q X q W |S )Nz-tz-Lz-nzA%s table '%s' does not exist (or not enough permission to check).) rb r� rI rf r� r8 r �debug1rA )rN rc r\ Ztablesr3 r3 r4 �get_available_tables s
z ip4tables.get_available_tablesc C s` d}t | jdddg�}|d dkr\d}t | jdddg�}|d dkrHd}tjd| j| j|� |S )Nr z-wz-Lz-nr z-w10z %s: %s will be using %s option.)r rB r rX rY )rN rE r\ r3 r3 r4 rD s z ip4tables._detect_wait_optionc C s� t � }|jd� |j� d}xJd D ]B}t| j|g|jd�}|d dkr"d|d kr"d |d kr"|}P q"W tjd
| j| j|� t j
|j� |S ) Nz#foor �-w�--wait=2)r� r zinvalid optionr] zunrecognized optionz %s: %s will be using %s option.)r� r� ) r r� r� r rC r� r rX rY rQ r� )rN r� rE Z test_optionr\ r3 r3 r4 rF " s
z%ip4tables._detect_restore_wait_optionc C sV i | _ i | _g | _g }x:tj� D ].}| j|�s0q x dD ]}|jd||g� q6W q W |S )N�-F�-X�-Zz-t)r� r� r� )rJ rK rL rb r� r� rf )rN r� rc �flagr3 r3 r4 �build_flush_rules5 s
zip4tables.build_flush_rulesc C sf g }|dkrdn|}xLt j� D ]@}| j|�s.q |dkr8q x$t | D ]}|jd|d||g� qBW q W |S )NZPANIC�DROPr" z-tz-P)rb r� r� rf )rN �policyr� �_policyrc rd r3 r3 r4 �build_set_policy_rulesD s
z ip4tables.build_set_policy_rulesc C s g }d}y"| j d| jdkr dnddg�}W nJ tk
rt } z.| jdkrVtjd| � ntjd| � W Y d d }~X nX |j� }d
}x�|D ]�}|r�|j� j� }|j� }xD|D ]<} | j d �r�| j
d �r�| d
d� }
n| }
|
|kr�|j |
� q�W | jdko�|j d��s| jdkr�|j d�r�d}q�W |S )zQReturn ICMP types that are supported by the iptables/ip6tables command and kernelr z-pr$ r& z ipv6-icmpz--helpziptables error: %szip6tables error: %sNF�(�)r] zValid ICMP Types:r% zValid ICMPv6 Types:Tr� ) r� rA r8 r r� �
splitlines�strip�lower�splitr� r� rf ) rN rA r\ r� Zexr� Zin_typesr� Zsplitsr� r9 r3 r3 r4 �supported_icmp_typesP s4
z ip4tables.supported_icmp_typesc C s g S )Nr3 )rN r3 r3 r4 �build_default_tablesq s z ip4tables.build_default_tablesr� c C s i }| j d�rpg |d< t� | jd< xLtd D ]@}|d jd| � |d jd||f � | jd jd| � q,W | j d��r\g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dkr�xt| jjr�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �qW q�W | j d��rNg |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |dk�r�xv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �q�W | j d��r@g |d< t� | jd< x�td D ]�}|d jd| � |d jd||f � | jd jd| � |d9k�rxxv| jj�r�ddd d
gndd d
gD ]R}|d jd ||f � |d jd |||f � | jd jtd
||f g�� �q�W �qxW g |d< t� | jd< |d jd� |d jd� |d jd� |d jd� | jd jtd�� xf| jj�r�ddd d
gndd d
gD ]B}|d jd| � |d jd| � | jd jtd| �� �q�W |dk�r |d jd� |d jd � |dk�rF|d jd � |d jd � |d jd � |d jd � |d jd!� |d jd"� | jd jtd#�� xJd:D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �q�W xzd;D ]r}xj| jj�r
dd gnd gD ]N}|d jd)||f � |d jd*||f � | jd jtd+||f �� �qW �q�W xJd<D ]B}|d jd$| � |d jd%| � | jd jtd&| �� �qnW |dk�r�|d jd,� |d jd-� |dk�r�|d jd.� |d jd/� |d d0d1d2d3g7 < | jd jtd4�� xJd=D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q2W xJd>D ]B}|d jd5| � |d jd6| � | jd jtd7| �� �q~W g }xJ|D ]B}|| j � k�r�q�x(|| D ] }|jd8|gt |� � �q�W �q�W |S )?Nr z -N %s_directz-A %s -j %s_directz %s_directr r � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz-N %s_%sz-A %s -j %s_%sz%s_%sr! r" r r# zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTz-N INPUT_directz-A INPUT -j INPUT_directZ INPUT_directz -N INPUT_%sz-A INPUT -j INPUT_%szINPUT_%sr� z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz-N FORWARD_directz -A FORWARD -j FORWARD_directZFORWARD_directz
-N FORWARD_%sz-A FORWARD -j FORWARD_%sz
FORWARD_%s�IN�OUTz-N FORWARD_%s_%sz-A FORWARD -j FORWARD_%s_%sz
FORWARD_%s_%sz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz -N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz OUTPUT_%sz-t)r r )r� )r� r� )r� )r� )r� )
r� r; rM rb rf rg r@ r �updater ) rN r� Z
default_rulesrd Zdispatch_suffix� directionZfinal_default_rulesrc r^ r3 r3 r4 �build_default_rulesu s�
$(
&*
&* &
(
"z ip4tables.build_default_rulesc C sf |dkrdddhS |dkr,d| j � kr,dhS |dkrHd| j � krHddhS |d krbd | j � krbdhS i S )
Nr# r �
FORWARD_IN� FORWARD_OUTr! r r" r r )r� )rN rc r3 r3 r4 �get_zone_table_chains� s
z ip4tables.get_zone_table_chainsc s� | j jj|���jdk r dnd��dkr4�dkr4dnd} | j jj|�t| �� g }
g } x|D ]} |
jd| g� qZW x|D ]} | jd | g� qvW xB|D ]:}
| j jj|
�}|dkr�| j |� r�q�|
j| j
d |
�� q�W x\|D ]T}
| j jj|
�}|dk�r| j |� �rq�t |
��r�dk�rq�| j| j
d|
�� q�W � �����fdd�}g }|
�r�x�|
D ]F}| �r�x8| D ]}|j|||�� �qdW n|�r�n|j||d �� �qTW nH|�r�n@| �r�x8| D ]}|j|d |�� �q�W n|�r�n|j|d d �� |S )Nr �pre�postr" r TFz-iz-or$ r% z-sr� r z-dc sV ddd�� }d�|d��f d�j g}| r6|j| � |rD|j|� |jd� g� |S )Nz-Az-D)TFz-tz%s_POLICIES_%sz%%POLICY_PRIORITY%%z-j)r� �extend)�ingress_fragment�egress_fragment�add_delr^ )r� rd � chain_suffix�enable�p_objrc r3 r4 � _generate_policy_dispatch_rule s
zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)r$ r% )r$ r% )r r� r ) r@ r� Z
get_policyr� �policy_base_chain_name�POLICY_CHAIN_PREFIXrf r� Z check_source�is_ipv_supported�_rule_addr_fragmentr )rN r� r� rc rd Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments� interface�addrrA r� r� r� r� r3 )r� rd r� r� r� rc r4 �!build_policy_ingress_egress_rules� sR
z+ip4tables.build_policy_ingress_egress_rulesFc
C s� |dkr|dkrdnd}| j jj||t|d�} ddddddd�| }
d } |rb| rbd
d | d g} n,|rtd
d | g} ndd | g} |s�| d g7 } | d||
|| | g7 } | gS )Nr" r TF)r� z-iz-o)r r r r� r� r z-gz-Iz%s_ZONESz%%ZONE_INTERFACE%%z-Az-Dz-t)r@ r� r� r� )
rN r� r� r� r� rc rd rf r� r� rt �actionr^ r3 r3 r4 �!build_zone_source_interface_rulesK s&
z+ip4tables.build_zone_source_interface_rulesc C s� |j d�rP|dd � }|dkr$d}nd}dj|g| jjj|� �}ddd ||gS t|�rz|dkrjttd
��dd d |j� gS t d
|�r�t
|�}n,t d
|�r�|j d�}t
|d �d |d }||gS d S )Nzipset:� z-d�dst�src�,z-mr; z --match-setz Can't match a destination MAC.�macz --mac-sourcer% �/r r] )
r� rZ r@ �ipsetZ
get_dimensionr r
r �upperr r r
r� )rN rt �address�invertr� �flags�
addr_splitr3 r3 r4 r� e s"
z ip4tables._rule_addr_fragmentc
C s� ddd�| }|dkr"|dkr"dnd}| j jj||t|d�} d d
d d d
d
d �| }
| j jrdd | } nd
| } t|�r�|dkr�g S || d|d|g} | j| j|
|�� | jd| g� | gS )Nz-Iz-D)TFr" r TF)r� z-sz-d)r r r r� r� r z%s_ZONES_SOURCEz%s_ZONESr� r z%%ZONE_SOURCE%%z-tz-g)r r� r )r@ r� r� r� r r r� r� )
rN r� r� r� r� rc rd r� r� r� rt Zzone_dispatch_chainr^ r3 r3 r4 � build_zone_source_address_rules{ s&
z)ip4tables.build_zone_source_address_rulesc C s> ddd�| }ddd�| }|dkr0|dkr0dnd }| j jj||t|d
�}| j| jt|d | d | d
| d| d| g�� g } | j||d|g� | j|d
| d|g� | j|d | d|g� | j|d | d|g� | j|d| d|g� | j|d| d|g� | j||d|dd
| g� | j||d|dd | g� | j||d|dd | g� | j||d|dd| g� | j||d|dd| g� | j jj| j }
| j j
� dk�r|dk�r|
d k�r�| j||d|ddddd| g � |
dk�r| j||d|ddddd| g � |dk�r,|
d k�r,| j||d|d|
g� |�s:| j � | S ) Nz-Nz-X)TFz-Az-Dr" r TF)r� z%s_logz%s_denyz%s_prez%s_postz%s_allowz-tz-jr� r# r� �
%%REJECT%%z %%LOGTYPE%%�LOGz --log-prefixz
"%s_REJECT: "r� z "%s_DROP: "�ACCEPT)r� r� )r� r� r� r� ) r@ r� r� r� rM r� r; rf Z _policies�target�get_log_denied�reverse) rN r� r� rc rd Z
add_del_chainZ add_del_ruler� r� r� r� r3 r3 r4 �build_policy_chain_rules� sN
z"ip4tables.build_policy_chain_rulesc C s2 |sg S ddd|j g}|jd k r.|d|jg7 }|S )Nz-m�limitz--limitz
--limit-burst)�valueZburst)rN r �sr3 r3 r4 � _rule_limit� s
zip4tables._rule_limitc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r �allowZdenyr� r� )
r� �elementr r r r� r r r r r
r r� )rN � rich_ruler3 r3 r4 �_rich_rule_chain_suffix� s
z!ip4tables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr
r r� )rN r r3 r3 r4 � _rich_rule_chain_suffix_from_log� s
z*ip4tables._rich_rule_chain_suffix_from_logc C s |j dkrg S d|j gS )Nr z%%RICH_RULE_PRIORITY%%)r� )rN r r3 r3 r4 � _rich_rule_priority_fragment� s
z&ip4tables._rich_rule_priority_fragmentc
C s� |j s
g S | jjj||t�}ddd�| }| j|�}d||d||f g} | | j|�7 } | |ddg 7 } |j jr�| dd |j j g7 } |j jr�| d
d |j j g7 } | | j |j j
�7 } | S ) Nz-Az-D)TFz-tz%s_%sz-jr� z --log-prefixz'%s'z --log-levelz%s) r r@ r� r� r� r r �prefix�levelr r )
rN r� r r� rc �
rule_fragmentr� r� r� r^ r3 r3 r4 �_rich_rule_log� s
zip4tables._rich_rule_logc C s� |j s
g S ddd�| }| jjj||t�}| j|�}d||d||f g} | | j|�7 } | |7 } t|j�t krrd}
n,t|j�t
kr�d}
nt|j�t kr�d}
nd }
| d
d d |
g7 } | | j |j j
�7 } | S )
Nz-Az-D)TFz-tz%s_%sZacceptZrejectZdrop�unknownz-jZAUDITz--type)r
r@ r� r� r� r r r� r� r r r r r ) rN r� r r� rc r r� r� r� r^ Z_typer3 r3 r4 �_rich_rule_audit s$
zip4tables._rich_rule_auditc C s2 |j s
g S ddd�| }| jjj||t�}| j|�}d||f } t|j �tkrXddg}
n�t|j �tkr�ddg}
|j jr�|
d|j jg7 }
nnt|j �t kr�dd g}
nVt|j �t
kr�d
}| jjj||t�}d||f } dd d |j j g}
nt t
d
t|j � ��d||| g} | | j|�7 } | ||
7 } | | j|j j�7 } | S )Nz-Az-D)TFz%s_%sz-jr� r� z
--reject-withr� r! �MARKz --set-xmarkzUnknown action %sz-t)r� r@ r� r� r� r r� r r r r r; r
r r r r ) rN r� r r� rc r r� r� r� rd Z rule_actionr^ r3 r3 r4 �_rich_rule_action$ s4
zip4tables._rich_rule_actionc C s� |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }q�td|j �r||j jd�}|dt|d �d |d g7 }q�|d|j g7 }nD|jr�|ddg7 }|jr�|jd� | jj j
|jd �}|d
|j|g7 }|S ) N�!r% z-dr� r r] z-mr; r� z --match-set) r� r� rf r r r
r� r� r@ r� �_ipset_match_flags)rN Z rich_destr r� r� r3 r3 r4 � _rich_rule_destination_fragmentF s&
"
z)ip4tables._rich_rule_destination_fragmentc C s |sg S g }|j r�|jr"|jd� td|j �rB|dt|j �g7 }nHtd|j �r||j jd�}|dt|d �d |d g7 }n|d|j g7 }n�t|d�r�|jr�|ddg7 }|jr�|jd� |d |jg7 }nPt|d
�o�|j �r|dd g7 }|jr�|jd� | j
j j |j d �}|d
|j |g7 }|S )Nr r% z-sr� r r] r� z-mz --mac-sourcer� r; r� z --match-set)
r� r� rf r r r
r� �hasattrr� r� r@ r� r )rN Z rich_sourcer r� r� r3 r3 r4 �_rich_rule_source_fragment^ s0
"
z$ip4tables._rich_rule_source_fragmentc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr# z-pz--dportz%sz-dz-m� conntrackz --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r � destinationr �sourcer� r� r rf r r r ) rN r� r� �proto�portr r r� rc r� r r� r3 r3 r4 �build_policy_ports_rules{ s* z"ip4tables.build_policy_ports_rulesc C s� ddd�| }d}| j jj||t�}d|g} |r<| d|g7 } |r`| | j|j�7 } | | j|j�7 } | stt|j �t
kr�| ddd d
g7 } g }
|r�|
j | j ||||| �� |
j | j
||||| �� |
j | j||||| �� n"|
j |d | d |g| d
dg � |
S )Nz-Az-D)TFr# z-pz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r� r� r rf r r r ) rN r� r� �protocolr r r� rc r� r r� r3 r3 r4 �build_policy_protocol_rules� s& z%ip4tables.build_policy_protocol_rulesc C s ddd�| }d}| j jj||t�} d|g}
|rD|
ddt|� g7 }
|rT|
d|g7 }
|rx|
| j|j�7 }
|
| j|j�7 }
| s�t |j
�t kr�|
d d
d d g7 }
g } |r�| j | j
|||||
�� | j | j|||||
�� | j | j|||||
�� n"| j |d
| d|g|
ddg � | S )Nz-Az-D)TFr# z-pz--sportz%sz-dz-mr z --ctstatez
NEW,UNTRACKEDz%s_allowz-tz-jr� )r@ r� r� r� r r r r r r� r� r rf r r r ) rN r� r� r r r r r� rc r� r r� r3 r3 r4 � build_policy_source_ports_rules� s* z)ip4tables.build_policy_source_ports_rulesc C sv d}| j jj||t�} ddd�| }
|
d| ddd|g} |rP| dd t|� g7 } |r`| d
|g7 } | d d d
|g7 } | gS )Nr z-Az-D)TFz%s_allowz-tz-pz--dportz%sz-dz-jZCTz--helper)r@ r� r� r� r ) rN r� r� r r r Z helper_nameZmodule_short_namerc r� r� r^ r3 r3 r4 � build_policy_helper_ports_rules� s z)ip4tables.build_policy_helper_ports_rulesc
C s� ddd�| }| j jj||t�}g } |rH| jdd|d| d|dd g� n6t|�rTg S | jdd|d| g| jd
|� dd g � | S ) Nz-Az-D)TFz-tr# z%s_allowz-oz-jr� z-d)r@ r� r� r� rf r r� )
rN r� r� r� rc r� r r� r� r� r3 r3 r4 �build_zone_forward_rules� s z"ip4tables.build_zone_forward_rulesc
C s, d}| j jj||tdd�}ddd�| }g }|rj| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}g } | j
dd|d ||f g| d
d d d
dg � g }|r�| j|�}|| j|�7 }|| j|j�7 }|| j|j �7 }nd}d}| j jj||t�}| j
dd|d ||f g| ddddd
dg � | S )Nr" T)r� z-Az-D)TFr z-tz%s_%sr z-o�loz-jZ
MASQUERADEr# z-mr z --ctstatez
NEW,UNTRACKEDr� ) r@ r� r� r� r r r r r r rf )
rN r� r� r rc r� r� r r� r� r3 r3 r4 � build_policy_masquerade_rules� s6
z'ip4tables.build_policy_masquerade_rulesc
C s
d}| j jj||t�} ddd�| }
d} |rPtd|�rH| dt|� 7 } n| |7 } |rn|dkrn| dt|d � 7 } g } |r�| j|�}
| j|�} | | j |j
�7 } | | j |j �7 } nd
}
g }|r�|j
| j|||d| �� |j
d d|
d | |
f g| d
|dt|�ddd| g � |S )Nr" z-Az-D)TFr r% z[%s]z:%s�-r z-tz%s_%sz-pz--dportz-jZDNATz--to-destination)r@ r� r� r� r r r r r r r r r rf r )rN r� r� r r ZtoportZtoaddrr rc r� r� Ztor r� r� r3 r3 r4 � build_policy_forward_port_rules s2
z)ip4tables.build_policy_forward_port_rulesc C s� d}| j jj||t�}ddd�| }| jdkrFddg}ddd |jg} ndd
g}dd d |jg} g }
| j jj|�r|d
| } d} n d| } d} g }
|r�|
| j|j�7 }
|
| j |j
�7 }
|
|| 7 }
|�rP|
j | j |||||
�� |
j | j
|||||
�� |j�r|
j | j|||||
�� n:| j|�}|
j d||d||f g| j|� |
ddg � n`| j j� dk�r�| dk�r�|
j || d|g|
ddddd| g � |
j || d|g|
d| g � |
S )Nr# z-Az-D)TFr$ z-pr& z-mz --icmp-typez ipv6-icmpZicmp6z
--icmpv6-typez%s_allowr� z%s_denyz
%%REJECT%%z-tz%s_%sz-jr� z %%LOGTYPE%%r� z --log-prefixz"%s_ICMP_BLOCK: ")r@ r� r� r� rA r� �query_icmp_block_inversionr r r r rf r r r� r r r r� )rN r� r� Zictr rc r� r� r �matchr� Z final_chainZ final_targetr r� r3 r3 r4 � build_policy_icmp_block_rules3 sJ
z'ip4tables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }d}| j jj|�r�d}| j j� dkr�|rRd|t|�g}nd|g}|d|dd d
d d d
d| g }|j|� |d7 }nd}|r�d|t|�g}nd|g}|d|dd d |g }|j|� |S )Nr# r� z
%%REJECT%%r� z-Iz-Dz-tz-pz%%ICMP%%z %%LOGTYPE%%z-jr� z --log-prefixz"%s_ICMP_BLOCK: "r] r� )r@ r� r� r� r) r� ri rf ) rN r� r� rc r� r� Zrule_idxZ
ibi_targetr^ r3 r3 r4 �'build_policy_icmp_block_inversion_rulesd s.
z1ip4tables.build_policy_icmp_block_inversion_rulesc C sx d}g }|| j |j�7 }|| j|j�7 }g }|j| j|||||�� |j| j|||||�� |j| j|||||�� |S )Nr# )r r r r rf r r r )rN r� r� r rc r r� r3 r3 r4 �*build_policy_rich_source_destination_rules� s z4ip4tables.build_policy_rich_source_destination_rulesc C s
|| j kS )N)rA )rN rA r3 r3 r4 r� � s zip4tables.is_ipv_supported)N)N)r� )F)F)NN)NN)NN)NN)N)N)N)7�__name__�
__module__� __qualname__rA r� Zpolicies_supportedrP rH r� ra re rh rj rk rl rm ru r� r� r� r� r� rD rF r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r r! r" r# r$ r& r( r+ r, r- r� r3 r3 r3 r4 r? � sh
)Pa#
!
zN
0 "
&
!
1"r? c @ s& e Zd ZdZd Zddd�Zdd� ZdS ) � ip6tablesr% Fc
C s� g }|j ddddddddd d
g
� |d krL|j ddddddddd d d
dg � |j dddddddd dg � |j dddddddd dg � |S )Nz-Ir z-tr! z-mZrpfilterz--invertz --validmarkz-jr� r� r� z --log-prefixzrpfilter_DROP: z-pz ipv6-icmpz$--icmpv6-type=neighbour-solicitationr� z"--icmpv6-type=router-advertisement)rf )rN r� r� r3 r3 r4 �build_rpfilter_rules� s$
z ip6tables.build_rpfilter_rulesc C s� ddddddddd g }d
}| j d j|� g }|jd d d
|g� xT|D ]L}|jd d d|d|ddddg
� | jjd krF|jd d d|d|ddddg
� qFW |jd d dddd|g� |jd d dddd|g� |S ) Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19Z RFC3964_IPv4r# z-tz-Nz-Iz-dz-jr� z
--reject-withz addr-unreachr� �allr� z --log-prefixz"RFC3964_IPv4_REJECT: "r �4r )r� r3 )rM rg rf r@ Z _log_denied)rN Z
daddr_listZ
chain_namer� Zdaddrr3 r3 r4 �build_rfc3964_ipv4_rules� s4
z"ip6tables.build_rfc3964_ipv4_rulesN)F)r. r/ r0 rA r� r2 r5 r3 r3 r3 r4 r1 � s
r1 )+Zos.pathrQ r� Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r r r r r r
r Zfirewallr Zfirewall.errorsr
r r r r Zfirewall.core.richr r r r r r r r� r� rb r� r� r5 r: r> �objectr? r1 r3 r3 r3 r4 �<module> s@ ( $ %* x