shell bypass 403
3
]ûf� � % @ sl d dl mZ d dlZd dlZd dlZd dlmZ d dlmZm Z m
Z
m Z m Z d dl
mZmZmZmZmZmZmZ d dlmZmZmZmZmZmZm Z d dl m Z dZ e d d
Z d Z!d Z"i d
ddCe" fiddDe" fdde" fd�dd e" fdd e" fdd e" fdd e" fd�d�Z#dEdd�Z$e$ddd �e$dd�e$dd �e$dd �e$ddd �e$ddd �e$ddd �e$dd!d"�e$ddd#�e$ddd"�e$dd$d"�e$ddd%�e$dd!d �e$ddd&�e$ddd �e$dd$�e$ddd'�e$ddd(�e$ddd)�e$dd!�e$dd$d"�e$dd*�e$dd+�e$dd,�e$ddd-�e$dd.�e$dd/�e$dd0�e$dd!d'�e$ddd1�e$dd!d)�e$ddd2�e$dd.d"�e$dd.d �d3�"e$d4dd'�e$d4d$d �e$d4dd)�e$d4dd"�e$d4d�e$d4d �e$d4d �e$d4dd-�e$d4d5�e$d4d6�e$d4d7�e$d4d8�e$d4d9�e$d4d:�e$d4dd �e$d4d;�e$d4d$�e$d4dd �e$d4d<�e$d4dd&�e$d4d=�e$d4d>�e$d4d.�e$d4d.d"�e$d4d.d �e$d4d$d"�e$d4d$d)�d?�d@�Z%G dAdB� dBe&�Z'dS )F� )�absolute_importN)�log)� check_mac� getPortRange� normalizeIP6�check_single_address�
check_address)�
FirewallError�
UNKNOWN_ERROR� INVALID_RULE�INVALID_ICMPTYPE� INVALID_TYPE�
INVALID_ENTRY� INVALID_PORT)� Rich_Accept� Rich_Reject� Rich_Drop� Rich_Mark�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock)�NftablesZ firewalld�_Z policy_dropZpolicy_�
�
PREROUTING�
prerouting� �d Z postrouting)r � POSTROUTING�input�forward�output)r �INPUT�FORWARD�OUTPUT)�raw�mangle�nat�filterc C sH dd| dd�id|d�ig}|d k rD|j dd| dd�id|d�i� |S )N�match�payload�type)�protocol�fieldz==)�left�op�right�code)�append)r, r+ r1 � fragments� r4 � /usr/lib/python3.6/nftables.py�_icmp_types_fragmentsS s r6 �icmpzdestination-unreachable�
z
echo-replyz echo-request� � �redirect� � zparameter-problem� � � � � zrouter-advertisementzrouter-solicitationz
source-quench� z
time-exceededztimestamp-replyztimestamp-request� � )"zcommunication-prohibitedzdestination-unreachablez
echo-replyz echo-requestzfragmentation-neededzhost-precedence-violationzhost-prohibitedz
host-redirectz host-unknownzhost-unreachablez
ip-header-badznetwork-prohibitedznetwork-redirectznetwork-unknownznetwork-unreachablezparameter-problemzport-unreachablezprecedence-cutoffzprotocol-unreachabler; zrequired-option-missingzrouter-advertisementzrouter-solicitationz
source-quenchzsource-route-failedz
time-exceededztimestamp-replyztimestamp-requestztos-host-redirectztos-host-unreachableztos-network-redirectztos-network-unreachablezttl-zero-during-reassemblyzttl-zero-during-transit�icmpv6zmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportznd-neighbor-advertznd-neighbor-solicitzpacket-too-bigz nd-redirectznd-router-advertznd-router-solicit)zaddress-unreachablez
bad-headerz beyond-scopezcommunication-prohibitedzdestination-unreachablez
echo-replyz echo-requestz
failed-policyzmld-listener-donezmld-listener-queryzmld-listener-reportzmld2-listener-reportzneighbour-advertisementzneighbour-solicitationzno-routezpacket-too-bigzparameter-problemzport-unreachabler; z reject-routezrouter-advertisementzrouter-solicitationz
time-exceededzttl-zero-during-reassemblyzttl-zero-during-transitzunknown-header-typezunknown-option)�ipv4�ipv6c @ s` e Zd Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Z d d
� Z
dd� Z d�dd�Z dd� Z
dd� Zdd� Zdd� Zd�dd �Zd d � Zd�d d!�Zd"d#� Zd�d%d&�Zd�d(d)�Zd�d*d+�Zd�d,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!d@dA� Z"dBdC� Z#dDdE� Z$dFdG� Z%dHdI� Z&d�dJdK�Z'dLdM� Z(dNdO� Z)dPdQ� Z*dRdS� Z+d�dTdU�Z,d�dVdW�Z-d�dXdY�Z.dZd[� Z/d�d\d]�Z0d�d^d_�Z1d�d`da�Z2d�dbdc�Z3d�ddde�Z4dfdg� Z5d�dhdi�Z6djdk� Z7d�dldm�Z8dndo� Z9dpdq� Z:drds� Z;dtdu� Z<d�dvdw�Z=d�dxdy�Z>dzd{� Z?d�d|d}�Z@d~d� ZAd�d�� ZBd�d�� ZCd�d�� ZDd�d�� ZEd�d�� ZFd�d�� ZGd�d�d��ZHdS )��nftablesTc C sb || _ d| _g | _i | _i | _i | _i | _i | _g g g d�| _t � | _
| j
j d� | j
j d� d S )NT)�inet�ip�ip6)
�_fwZrestore_command_existsZavailable_tables�rule_to_handle�rule_ref_count�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�created_tablesr rI Zset_echo_outputZset_handle_output)�self�fwr4 r4 r5 �__init__� s znftables.__init__c C s� xdD ]}||krP qW d|| d kr`|| d d d || d d d f}|| d d= n(d|| d kr�d }|| d d= nd S || d d }|r�|dkr�||kr�||| kr�|| j |� n�|dk�r�||kr�g ||< |�r(||| k�r|| j|� || jd
d � d � || j|�}n | jj�r8d
}n t|| �}|| }||= |d
k�rf||d< n |d8 }||d< ||d d d< d S )N�add�insert�deletez%%ZONE_SOURCE%%�rule�zone�addressz%%ZONE_INTERFACE%%�familyc S s | d S )Nr r4 )�xr4 r4 r5 �<lambda>� s z3nftables._run_replace_zone_source.<locals>.<lambda>)�keyr r< �index)rW rX rY )�remover2 �sortra rM �_allow_zone_drifting�len)rT rZ rR �verbZ zone_sourcer] ra �
_verb_snippetr4 r4 r5 �_run_replace_zone_source� sD
z!nftables._run_replace_zone_sourcec C sB d|krdt j|d �iS d|kr4dt j|d �iS ttd��d S )NrX rY rW zFailed to reverse rule)�copy�deepcopyr r
)rT �dictr4 r4 r5 � reverse_rule� s
znftables.reverse_rulec
C s� xd D ]}||krP qW ||| d k�r�|| d | }|| d |= t |�tkr^ttd��|| d d || d d f}|dkr�||ks�||| ks�|| | dkr�ttd ��|| | d
8 < n�||kr�i ||< ||| kr�d|| |< d}xVt|| j� �D ]B}||k�r"|dk�r"P ||| | 7 }||k�r|dk�rP �qW || | d
7 < || } ||= |dk�r�| |d< n |d
8 }| |d< ||d d d < d S )
NrW rX rY rZ z%priority must be followed by a numberr] �chainr z*nonexistent or underflow of priority countr< ra )rW rX rY )r+ �intr r r
�sorted�keys)
rT rZ Zpriority_counts�tokenrf �priorityrm ra �prg r4 r4 r5 �_set_rule_replace_priority� sD
z#nftables._set_rule_replace_priorityc C sf x`d
D ]X}||krd|| krt j|| d �}xd D ]}||kr6||= q6W tj|dd �}|S qW d S ) NrW rX rY rZ ra �handle�positionT)Z sort_keys)rW rX rY )ra ru rv )ri rj �json�dumps)rT rZ rf �rule_keyZnon_keyr4 r4 r5 �
_get_rule_key s
znftables._get_rule_keyc C sL dddddg}dddg}g }g }t j| j�}t j| j�}t j| j�} | jj � }
�x�|D �]�} t| �tkrvtt d| ��x|D ]} | | kr|P q|W | | kr�tt
d| ��| j | �}
|
|
k�rDt j
d| j|
|
|
� | dkr�|
|
d 7 < qVnX|
|
d k�r |
|
d 8 < qVn6|
|
d k�r,|
|
d 8 < ntt d
|
|
|
f ��n|
�r\| dk�r\d |
|
< |j| � t j| �}|
�rttd || d d ��|| d d < | j||d
� | j||d� | j|| � | dk�rdd |d d d |d d d |d d d | j|
d�ii}|j|� qVW dddd iig| i}t j� dk�rVt jd| jtj|�� | jj|�\}}}|dk�r�tdd|tj|�f ��|| _|| _| | _|
| _d}x�|D ]�} |d 7 }| j | �}
|
�s̐q�d| k�r�| j|
= | j|
= �q�x"|D ]} | |d | k�r�P �q�W | |d | k�r$�q�|d | | d d | j|
< �q�W d S ) NrW rX rY �flush�replacez#rule must be a dictionary, rule: %sz no valid verb found, rule: %sz %s: prev rule ref cnt %d, %sr< z)rule ref count bug: rule_key '%s', cnt %drZ �exprz%%RICH_RULE_PRIORITY%%z%%POLICY_PRIORITY%%r] �tablerm )r] r~ rm ru rI ZmetainfoZjson_schema_versionr@ z.%s: calling python-nftables with JSON blob: %sr z '%s' failed: %s
JSON blob:
%szpython-nftablesru ) ri rj rP rQ rR rO r+ rk r r
r rz r Zdebug2� __class__r2 �listr( rt rh rN ZgetDebugLogLevelZdebug3rw rx rI Zjson_cmd�
ValueError)rT �rules�
log_deniedZ _valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_executed_rulesrP rQ rR rO rZ rf ry Z_ruleZ json_blobZrcr! �errorra r4 r4 r5 � set_rules+ s�
&
znftables.set_rulesc C s | j |g|� dS )N� )r� )rT rZ r� r4 r4 r5 �set_rule� s znftables.set_ruleNc C s |r
|gS t j� S )N)�IPTABLES_TO_NFT_HOOKrp )rT r~ r4 r4 r5 �get_available_tables� s z nftables.get_available_tablesc C sF g }x<dD ]4}|j dd||d�ii� |j dd||d�ii� q
W |S ) NrJ rK rL rW r~ )r] �namerY )rJ rK rL )r2 )rT r~ r� r] r4 r4 r5 �_build_delete_table_rules� s
z"nftables._build_delete_table_rulesc C s� i }i }xB| j d�D ]4}| j|�}|| jkr| j| ||< | j| ||< qW || _|| _i | _i | _i | _x*dD ]"}t| j| krp| j| j t� qpW | j
t�S )NTrJ rK rL )rJ rK rL ) � _build_set_policy_rules_ct_rulesrz rN rO rP rQ rR �
TABLE_NAMErS rb r� )rT Zsaved_rule_to_handleZsaved_rule_ref_countrZ �
policy_keyr] r4 r4 r5 �build_flush_rules� s
znftables.build_flush_rulesc
C sl ddd�| }g }xTdD ]L}|j |ddtd d
|f d d d
diiddddgid�idd igd�ii� qW |S )NrW rY )TFr r r! rZ rJ z%s_%sr( r) �ctr` �state�in�set� established�related)r. r/ r0 �accept)r] r~ rm r} )r r r! )r2 �TABLE_NAME_POLICY)rT �enable�add_delr� �hookr4 r4 r5 r� � s
z)nftables._build_set_policy_rules_ct_rulesc C st g }|dkrt|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d
|f d |dt d
dd�ii� q:W |dk� r�|j dddtd�ii� | jd j t� x>dD ]6}|j dddtd d |f d |dt d
dd�ii� q�W || jd�7 }nz|dk�rfx4| jd�D ]&}| j|�}|| jk�r |j |� �q W || jt�7 }t| jd k�rp| jd jt� n
t t
d� |S )NZPANICrW r~ rJ )r] r� r r! rm z%s_%sr% r( i, r< �drop)r] r~ r� r+ r� �prio�policy�DROPr r r T�ACCEPTFznot implemented)r r! i���)r r r! ) r2 r� rS �NFT_HOOK_OFFSETr� rz rN r� rb r r
)rT r� r� r� rZ r� r4 r4 r5 �build_set_policy_rules� sH
z nftables.build_set_policy_rulesc C s< t � }x,|r|gntj� D ]}|jt| j� � qW t|�S )N)r� �ICMP_TYPES_FRAGMENTSrp �updater� )rT �ipvZ supportedZ_ipvr4 r4 r5 �supported_icmp_types� s z nftables.supported_icmp_typesc C s> g }x4dD ],}|j dd|td�ii� | j| j t� q
W |S )NrJ rK rL rW r~ )r] r� )rJ rK rL )r2 r� rS )rT Zdefault_tablesr] r4 r4 r5 �build_default_tables s
z nftables.build_default_tables�offc C s� g }x�t d j� D ]�}|jdddtd| ddt d | d t d | d d
�ii� xz| jjrld d d
dgnd d
dgD ]X}|jdddtd||f d�ii� |jdddtd| ddd||f iigd�ii� qvW qW x�d?D ]�}x�t d j� D ]�}|jdd|td| ddt d | d t d | d d
�ii� x~| jj�rJd d d
dgnd d
dgD ]Z}|jdd|td||f d�ii� |jdd|td| ddd||f iigd�ii� �qTW q�W q�W xVt d j� D ]F}|jdddtd| ddt d | d t d | d d
�ii� �q�W |jdddtdd d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd d d d d&iid d'd$�id%d igd�ii� |jdddtdd d d(d d)iid*d+d$�id%d igd�ii� x~| jj�r�d d d
dgnd d
dgD ]Z}|jdddtd,d|f d�ii� |jdddtdd ddd,d|f iigd�ii� �q�W |d-k�r�|jdddtdd d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd d d d d iid d!d.gid$�id2d igd�ii� |d-k�r$|jdddtdd | j|�d/d0d3iigd�ii� |jdddtdd d4d5d6d7�igd�ii� |jdddtdd8 d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtdd8 d d d d&iid d'd$�id%d igd�ii� |jdddtdd8 d d(d d)iid*d+d$�id%d igd�ii� xbd@D ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW x�dAD ]�}xz| jj�r�d d
gnd
gD ]^}|jdddtd;d8||f d�ii� |jdddtdd8 ddd;d8||f iigd�ii� �q�W �qvW xbdBD ]Z}|jdddtd,d8|f d�ii� |jdddtdd8 ddd,d8|f iigd�ii� �qW |d-k�r�|jdddtdd8 d d d d iid d!d.gid$�i| j|�d/d0d1iigd�ii� |jdddtdd8 d d d d iid d!d.gid$�id2d igd�ii� |d-k�r6|jdddtdd8 | j|�d/d0d3iigd�ii� |jdddtdd8 d4d5d6d7�igd�ii� |jdddtdd< d d d d iid d!d"d#gid$�id%d igd�ii� |jdddtd=d d(d d>iid*d+d$�id%d igd�ii� xbdCD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �q�W xbdDD ]Z}|jdddtd,d<|f d�ii� |jdddtdd< ddd,d<|f iigd�ii� �qHW |S )ENr& rW rm rJ z mangle_%sr( z%sr r< )r] r~ r� r+ r� r� � POLICIES_preZ ZONES_SOURCEZZONES�
POLICIES_postz mangle_%s_%s)r] r~ r� rZ �jump�target)r] r~ rm r} rK rL r' znat_%sz nat_%s_%sz filter_%sr" r) r� r` r� r� r� r� r� )r. r/ r0 r� Zstatus�dnat�meta�iifnamez==�loz filter_%s_%sr� Zinvalidr �prefixzSTATE_INVALID_DROP: r� zFINAL_REJECT: �reject�icmpxzadmin-prohibited)r+ r} r# �IN�OUTzfilter_%s_%s_%sr$ �
filter_OUTPUT�oifname)rK rL )r� )r� r� )r� )r� )r� )r� rp r2 r� rM rd �_pkttype_match_fragment)rT r� Z
default_rulesrm Zdispatch_suffixr] � directionr4 r4 r5 �build_default_rules s�
$
(
&
.
&
&
&
.
&
&
&z nftables.build_default_rulesc C s4 |dkrdddgS |dkr dgS |dkr0ddgS g S ) Nr( r" �
FORWARD_IN� FORWARD_OUTr& r r' r r4 )rT r~ r4 r4 r5 �get_zone_table_chains� s
z nftables.get_zone_table_chainsrJ c
s� �dkr\�dkr\g }
|
j �j�|��||||dd� � |
j �j�|��||||dd� � |
S �jjj|���jdk rxdnd��dkr��d kr�d
nd } �jjj|�t| �� g } g }
|r�| jd d
ddiiddt |�id�i� |�r|
jd d
ddiiddt |�id�i� ddd�}|�rlxT|D ]L}�dk�rT�jj
j |�}||k�rT�|| k�rT�q | j�j d|�� �q W |�r�xT|D ]L}�dk�r��jj
j |�}||k�r��|| k�r��qx|
j�j d|�� �qxW � �������fdd�}g }
| �rHx�| D ]P}|
�r xB|
D ]}|
j|||�� �qW n"�dk�r0|�r0n|
j||d �� �q�W n\�dk�rZ|�rZnJ|
�r�xB|
D ]}|
j|d |�� �qfW n"�dk�r�|�r�n|
j|d d �� |
S )Nr' rJ rK )r] rL r �pre�postr TFr) r� r` r� z==r� )r. r/ r0 r� )rG rH �saddr�daddrc s� g }| r|j | � |r |j |� |j ddd�� f ii� �td���f |d�}|j�j��� �rrdd|iiS dd|iiS d S ) Nr� r� z%s_%sz%s_%s_POLICIES_%s)r] r~ rm r} rW rZ rY )r2 r� r� �_policy_priority_fragment)�ingress_fragment�egress_fragment�expr_fragmentsrZ )�_policyrm � chain_suffixr� r] �p_objrT r~ r4 r5 � _generate_policy_dispatch_rule s
zRnftables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)
�extend�!build_policy_ingress_egress_rulesrM r� Z
get_policyrr �policy_base_chain_name�POLICY_CHAIN_PREFIXr2 r� r[ Z check_source�_rule_addr_fragment)rT r� r� r~ rm Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sourcesr] r� �isSNATZingress_fragmentsZegress_fragmentsZ
ipv_to_family�srcr� �dstr� r� r� r4 )r� rm r� r� r] r� rT r~ r5 r� � sv
z*nftables.build_policy_ingress_egress_rulesFc
C s� |dkrT|dkrTg } | j | j|||||||d�� | j | j|||||||d�� | S |dkrh|dkrhdnd}
| jjj||t|
d�} d d
d d d
d
d �| } |t|�d d
kr�|d t|�d � d }d}
|dkr�|
dd|| f iig}n,ddd| iid|d�i|
dd|| f iig}|�rL| �rLd}|td||f |d�}|j| j � � nP|�rnd}|td||f |d�}n.d}|td||f |d�}|�s�|j| j � � |d |iigS ) Nr' rJ rK rL r TF)r� r� r� )r r r" r� r� r$ r< �+�*�gotor� z%s_%sr) r� r` z==)r. r/ r0 rX z %s_%s_ZONES)r] r~ rm r} rW rY rZ )
r� �!build_zone_source_interface_rulesrM r� r� r� re r� r� �_zone_interface_fragment)rT r� r[ r� � interfacer~ rm r2 r] r� r� r� �opt�actionr� rf rZ r4 r4 r5 r� Q s\
z*nftables.build_zone_source_interface_rulesc C sn |dkr�|dkr�g }|j d�r6| j|td�d � �} nd } td|�sTt|�sT| dkrp|j| j||||||d�� td|�s�t|�s�| dkr�|j| j||||||d�� |S |dkr�|dkr�d nd
}
| jjj ||t
|
d �} d d
d�| } ddddddd�| }
| jj �rd||f }n d||f }d}|t || j
|
|�|dd|| f iigd�}|j| j||�� | d|iigS )Nr' rJ zipset:rG rK rH rL r TF)r� rX rY )TFr� r� )r r r" r� r� r$ z%s_%s_ZONES_SOURCEz %s_%s_ZONESr� r� z%s_%s)r] r~ rm r} rZ )�
startswith�_set_get_familyre r r r� � build_zone_source_address_rulesrM r� r� r� rd r� r� r� �_zone_source_fragment)rT r� r[ r� r\ r~ rm r] r� Z ipset_familyr� r� r� r� Zzone_dispatch_chainr� rZ r4 r4 r5 r� � sB
z(nftables.build_zone_source_address_rulesc
C s |dkrH|dkrHg }|j | j||||d�� |j | j||||d�� |S ddd�| }|dkrj|dkrjd nd
}| jjj||t|d �} g }|j|d |td
|| f d�ii� x0d!D ](}
|j|d |td|| |
f d�ii� q�W xDd"D ]<}
|j|d|td
|| f ddd|| |
f iigd�ii� q�W | jjj| j } | jj
� dk�r�|dk�r�| d#k�r�| } | d k�rhd} |j|d|td
|| f | j | jj
� �dd d | | f iigd�ii� |dk�r| d$k�r| d%k�r�| j � }
n | j
� d i}
|j|d|td
|| f |
gd�ii� |�s|j� |S )&Nr' rJ rK rL rW rY )TFr TF)r� rm z%s_%s)r] r~ r� r� r �deny�allowr� z%s_%s_%srZ r� r� )r] r~ rm r} r� r( �REJECT�
%%REJECT%%r� r� z"filter_%s_%s: "r� )r� r r� r� r� )r� r r� r� r� )r� r� r� )r� r� r� r� )r� r� )r� �build_policy_chain_rulesrM r� r� r� r2 r� Z _policiesr� �get_log_deniedr� �_reject_fragment�lower�reverse)rT r� r� r~ rm r] r� r� r� r� r� r� Z
log_suffix�target_fragmentr4 r4 r5 r� � sZ
&
z!nftables.build_policy_chain_rulesc C s< |dkr i S |d kr,ddddiid |d
�iS t td |��d S )
N�all�unicast� broadcast� multicastr) r� r` �pkttypez==)r. r/ r0 zInvalid pkttype "%s")r� r� r� )r r )rT r� r4 r4 r5 r� � s
z nftables._pkttype_match_fragmentc C s dddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�idddd�iddd d�iddd d�iddd
d�iddd
d�idd d
d�iddd d�iddd d�iddd
d�iddd
d�idddd�idddd�idddiidddiid�}|| S )Nr� r7 zhost-prohibited)r+ r} znet-prohibitedzadmin-prohibitedrF znet-unreachablezhost-unreachablezport-unreachabler� zprot-unreachablezaddr-unreachablezno-router+ z tcp reset)zicmp-host-prohibitedz host-prohibzicmp-net-prohibitedz
net-prohibzicmp-admin-prohibitedz admin-prohibzicmp6-adm-prohibitedzadm-prohibitedzicmp-net-unreachablez net-unreachzicmp-host-unreachablez host-unreachzicmp-port-unreachablezicmp6-port-unreachablez port-unreachzicmp-proto-unreachablez
proto-unreachzicmp6-addr-unreachablez addr-unreachzicmp6-no-routezno-routez tcp-resetztcp-rstr4 )rT Z reject_typeZfragsr4 r4 r5 �_reject_types_fragment� s0
z nftables._reject_types_fragmentc C s dddd�iS )Nr� r� zadmin-prohibited)r+ r} r4 )rT r4 r4 r5 r� s znftables._reject_fragmentc C s ddddiiddddgid �iS )
Nr) r� r` �l4protoz==r� r7 rF )r. r/ r0 r4 )rT r4 r4 r5 �_icmp_match_fragment" s z nftables._icmp_match_fragmentc C sP |si S ddddd�}|j � \}}||| d�}|j� }|d k rH||d< d|iS ) N�secondZminuteZhourZday)�s�m�h�d)�rateZper�burst�limit)Z value_parseZ burst_parse)rT r� Z rich_to_nftr� Zdurationr� r� r4 r4 r5 �_rich_rule_limit_fragment' s z"nftables._rich_rule_limit_fragmentc C s� t |j�tttgkrn<|jrHt |j�tttt gkrRt
t dt |j� ��n
t
t d��|j dkr�t |j�ttgks�t |j�tt gkr�dS t |j�tgks�t |j�ttgkr�dS n|j dk r�dS dS d S )NzUnknown action %szNo rule action specified.r r� r� r� r� )
r+ �elementr r r r� r r r r r r rr )rT � rich_ruler4 r4 r5 �_rich_rule_chain_suffix? s
z nftables._rich_rule_chain_suffixc C s> |j r|j rttd��|jdkr(dS |jdk r6dS dS d S )NzNot log or auditr r r� r� )r �auditr r rr )rT r� r4 r4 r5 � _rich_rule_chain_suffix_from_logU s
z)nftables._rich_rule_chain_suffix_from_logc C s dd iS )Nz%%ZONE_INTERFACE%%r4 )rT r4 r4 r5 r� ` s z!nftables._zone_interface_fragmentc C sN t d|�rt|�}n,td|�r@|jd�}t|d �d |d }d||d�iS )NrH �/r r< z%%ZONE_SOURCE%%)r[ r\ )r r r �split)rT r[ r\ Z
addr_splitr4 r4 r5 r� c s
z nftables._zone_source_fragmentc C s
d|j iS )Nz%%POLICY_PRIORITY%%)rr )rT r� r4 r4 r5 r� k s z"nftables._policy_priority_fragmentc C s | s|j dkri S d|j iS )Nr z%%RICH_RULE_PRIORITY%%)rr )rT r� r4 r4 r5 � _rich_rule_priority_fragmentn s z%nftables._rich_rule_priority_fragmentc C s� |j s
i S | jjj||t�}ddd�| }| j|�}i } |j jrPd|j j | d< |j jr|d|j jkrhdn|j j}
d|
| d< d td
|||f || j |j j
�d | ig d �} | j | j |�� |d
| iiS )NrW rY )TFz%sr� Zwarning�warn�levelrJ z%s_%s_%sr )r] r~ rm r} rZ )
r rM r� r� r� r� r� r r� r� r� r� r� ) rT r� r� r� r~ r� r� r� r� Z log_optionsr rZ r4 r4 r5 �_rich_rule_logs s&
znftables._rich_rule_logc
C s� |j s
i S | jjj||t�}ddd�| }| j|�}dtd|||f || j|j j�dddiig d �} | j | j
|�� |d
| iiS ) NrW rY )TFrJ z%s_%s_%sr r r� )r] r~ rm r} rZ ) r� rM r� r� r� r� r� r� r� r� r� )
rT r� r� r� r~ r� r� r� r� rZ r4 r4 r5 �_rich_rule_audit� s
znftables._rich_rule_auditc
C s� |j s
i S | jjj||t�}ddd�| }| j|�}d|||f } t|j �tkr\dd i}
�n t|j �tkr�|j jr�| j |j j�}
ndd i}
n�t|j �t
kr�dd i}
n�t|j �t k�rHd}| jjj||t�}d|||f } |j j j
d �} t| �d
k�r,dd d d
iiddd d d
ii| d
gi| d gid�i}
ndd d d
ii| d d�i}
nttdt|j � ��dt| || j|j j�|
g d�} | j| j|�� |d| iiS )NrW rY )TFz%s_%s_%sr� r� r� r& r� r< r� r` �mark�^�&r )r` �valuezUnknown action %srJ )r] r~ rm r} rZ )r� rM r� r� r� r� r+ r r r� r r r� r� re r r r� r� r� r� r� )
rT r� r� r� r~ r� r� r� r� rm Z rule_actionr rZ r4 r4 r5 �_rich_rule_action� sB
, znftables._rich_rule_actionc C s� |j d�r0| j|td�d � d|kr(dnd|�S t|�r>d}n�td|�rNd}nvtd|�r�d}tj|dd�}d |jj |j
d
�i}nDtd |�r�d }t |�}n,d }|j d
�}d t |d �t
|d �d
�i}dd||d�i|r�dnd|d�iS d S )Nzipset:r� TF�etherrG rK )�strictr� )�addrre rH rL r� r r< r) r* )r, r- z!=z==)r. r/ r0 )r� �_set_match_fragmentre r r r � ipaddressZ IPv4NetworkZnetwork_addressZ
compressedZ prefixlenr r� rn )rT Z
addr_fieldr\ �invertr] Znormalized_addressZaddr_lenr4 r4 r5 r� � s(
&
z nftables._rule_addr_fragmentc C s6 |si S |d
kr t td| ��ddddiid|d �iS ) NrG rH zInvalid familyr) r� r` �nfprotoz==)r. r/ r0 )rG rH )r r )rT Z rich_familyr4 r4 r5 �_rich_rule_family_fragment� s
z#nftables._rich_rule_family_fragmentc C s8 |si S |j r|j }n|jr&d|j }| jd||jd�S )Nzipset:r� )r )r �ipsetr� r )rT Z rich_destr\ r4 r4 r5 � _rich_rule_destination_fragment� s
z(nftables._rich_rule_destination_fragmentc C sZ |si S |j r|j }n2t|d�r.|jr.|j}nt|d�rH|jrHd|j }| jd||jd�S )N�macr zipset:r� )r )r �hasattrr r r� r )rT Z rich_sourcer\ r4 r4 r5 �_rich_rule_source_fragment� s
z#nftables._rich_rule_source_fragmentc C sP t |�}t|t�r$|dk r$tt��n(t|�dkr8|d S d|d |d giS d S )Nr r< �range)r �
isinstancern r r re )rT �portr r4 r4 r5 �_port_fragment s
znftables._port_fragmentc C sb ddd�| }d}| j jj||t�} g }
|r>|
j| j|j�� |rT|
j| jd|�� |r||
j| j|j �� |
j| j
|j �� |
jdd|dd �id
| j |�d �i� | s�t
|j�tkr�|
jdd d
diiddddgid �i� g } |�r0| j| j|||||
�� | j| j|||||
�� | j| j|||||
�� n.| j|ddtd|| f |
dd ig d�ii� | S )NrW rY )TFr( r� r) r* �dport)r, r- z==)r. r/ r0 r� r` r� r� r� �new� untrackedrZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r � destinationr �sourcer r+ r� r r r r r� ) rT r� r� �protor r r� r� r~ r� r� r� r4 r4 r5 �build_policy_ports_rules s:
z!nftables.build_policy_ports_rulesc C sZ ddd�| }d}| j jj||t�}g } |r>| j| j|j�� |rT| j| jd|�� |r|| j| j|j �� | j| j
|j �� | jdddd iid
|d �i� | s�t |j
�tkr�| jdd dd
iiddddgid �i� g }
|�r(|
j| j||||| �� |
j| j||||| �� |
j| j||||| �� n.|
j|ddtd||f | dd ig d�ii� |
S )NrW rY )TFr( r� r) r� r` r� z==)r. r/ r0 r� r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r+ r� r r r r r� ) rT r� r� r, r r� r� r~ r� r� r� r4 r4 r5 �build_policy_protocol_rules2 s8
z$nftables.build_policy_protocol_rulesc C sb ddd�| }d}| j jj||t�} g }
|r>|
j| j|j�� |rT|
j| jd|�� |r||
j| j|j �� |
j| j
|j �� |
jdd|dd �id
| j |�d �i� | s�t
|j�tkr�|
jdd d
diiddddgid �i� g } |�r0| j| j|||||
�� | j| j|||||
�� | j| j|||||
�� n.| j|ddtd|| f |
dd ig d�ii� | S )NrW rY )TFr( r� r) r* �sport)r, r- z==)r. r/ r0 r� r` r� r� r� r r rZ rJ z %s_%s_allowr� )r] r~ rm r} )rM r� r� r� r2 r r] r� r r r r r r+ r� r r r r r� ) rT r� r� r r r r� r� r~ r� r� r� r4 r4 r5 � build_policy_source_ports_rulesU s:
z(nftables.build_policy_source_ports_rulesc
C s� d}| j jj||t�} ddd�| }
g } |rR| jdddtd||f ||d�ii� g } |rl| j| jd |�� | jd
d |d d
�id| j|�d�i� | jdd||f i� | j|
ddtd| | d�ii� | S )Nr( rW rY )TFz ct helperrJ z helper-%s-%s)r] r~ r� r+ r, r� r) r* r )r, r- z==)r. r/ r0 rZ zfilter_%s_allow)r] r~ rm r} )rM r� r� r� r2 r� r� r )
rT r� r� r r r Z helper_nameZmodule_short_namer~ r� r� r� r� r4 r4 r5 � build_policy_helper_ports_rulesz s.
z(nftables.build_policy_helper_ports_rulesc C s� ddd�| }| j jj||t�}g } |rv|t|�d dkrT|d t|�d � d }ddd d
iid |d �id
d ig}
n| jd|�d
d ig}
dtd| |
d�} | j|d| ii� | S )NrW rY )TFr< r� r� r) r� r` r� z==)r. r/ r0 r� r� rJ zfilter_%s_allow)r] r~ rm r} rZ )rM r� r� r� re r� r� r2 ) rT r� r[ r� r~ r� r r� r� r� r} rZ r4 r4 r5 �build_zone_forward_rules� s" z!nftables.build_zone_forward_rulesc C s� d}| j jj||tdd�}ddd�| }g }|r`|j| j|j�� |j| j|j�� | j |�} nd} |t
d|| f |d d
d d iid
dd�idd ig d�}
|
j | j |�� |d|
iigS )Nr' T)r� rW rY )TFr� z nat_%s_%sr) r� r` r� z!=r� )r. r/ r0 Z
masquerade)r] r~ rm r} rZ )
rM r� r� r� r2 r r r r r� r� r� r� ) rT r� r� r] r� r~ r� r� r� r� rZ r4 r4 r5 �"_build_policy_masquerade_nat_rules� s&
z+nftables._build_policy_masquerade_nat_rulesc
C s^ g }|rD|j r|j dks,|jrDtd|jj�rD|j| j||d|�� nV|r�|j rX|j dksl|jr�td|jj�r�|j| j||d|�� n|j| j||d|�� d}| jjj||t �}ddd�| }g }|r�|j
| j |j �� |j
| j
|j�� | j|�} nd } d
td || f |d d
ddiiddddgid�idd ig d�}
|
j| j|�� |j
|d|
ii� |S )NrH rL rG rK r( rW rY )TFr� rJ z filter_%s_%sr) r� r` r� r� r� r r )r. r/ r0 r� )r] r~ rm r} rZ )r] r r r r� r& rM r� r� r� r2 r r r r� r� r� r� ) rT r� r� r� r� r~ r� r� r� r� rZ r4 r4 r5 � build_policy_masquerade_rules� s8
z&nftables.build_policy_masquerade_rulesc C s$ d} | j jj|| t�}
ddd�| } g } |r\| j| j|j�� | j| j|j�� | j |�}
nd}
| jdd|dd �id
| j
|�d �i� |r�t d |�r�t |�}|r�|d
kr�| jd|| j
|�d�i� q�| jdd|ii� n| jdd| j
|�ii� |t
d|
|
f | d�}|j| j|�� | d|iigS )Nr' rW rY )TFr� r) r* r )r, r- z==)r. r/ r0 rH r� r� )r r r r; r z nat_%s_%s)r] r~ rm r} rZ )rM r� r� r� r2 r r r r r� r r r r� r� r� )rT r� r� r r, �toaddr�toportr] r� r~ r� r� r� r� rZ r4 r4 r5 �$_build_policy_forward_port_nat_rules� s4
z-nftables._build_policy_forward_port_nat_rulesc
C s� g }|rF|j r|j dks&|rFtd|�rF|j| j||||||d|�� n�|r�|j rZ|j dksh|r�td|�r�|j| j||||||d|�� nL|r�td|�r�|j| j||||||d|�� n |j| j||||||d|�� |S )NrH rL rG rK )r] r r� r* ) rT r� r� r r, r) r( r� r� r4 r4 r5 � build_policy_forward_port_rules s z(nftables.build_policy_forward_port_rulesc C s2 |t | krt | | S ttd|| j|f ��d S )Nz)ICMP type '%s' not supported by %s for %s)r� r r r� )rT r� Z icmp_typer4 r4 r5 � _icmp_types_to_nft_fragments( s z%nftables._icmp_types_to_nft_fragmentsc C sB d}| j jj||t�}ddd�| }|r6|jr6|j}n<|jrjg }d|jkrT|jd� d|jkrr|jd� nddg}g } �x�|D �]�}
| j jj|�r�d||f } dd i} nd ||f } | j� } g }
|r�|
j| j |j
�� |
j| j |j�� |
j| j |j
�� |
j| j|
|j�� |�r�| j| j|||||
�� | j| j|||||
�� |j�rf| j| j|||||
�� nN| j|�}d
td |||f |
| j� g d �}|j| j|�� | j|d
|ii� q~| j j� dk�r| j jj|� �r| j|d
d
t| |
| j| j j� �ddd||f iig d �ii� | j|d
d
t| |
| g d �ii� q~W | S )Nr( rW rY )TFrG rH z %s_%s_allowr� z
%s_%s_denyrJ z%s_%s_%s)r] r~ rm r} rZ r� r r� z"%s_%s_ICMP_BLOCK: ")rM r� r� r� �ipvsr r2 �query_icmp_block_inversionr� r r] r r r r� r, r� r r r� r r� r� r� r� r� r� )rT r� r� Zictr� r~ r� r� r- r� r� Z final_chainr� r� r� rZ r4 r4 r5 � build_policy_icmp_block_rules/ sb
"
"
z&nftables.build_policy_icmp_block_rulesc C s� d}| j jj||t�}g }ddd�| }| j jj|�r@| j� }ndd i}|j|ddtd||f d | j� |gd
�ii� | j j � d kr�| j jj|�r�|j|ddtd||f d | j� | j
| j j � �d d
d||f iigd
�ii� |S )Nr( rW rY )TFr� rZ rJ z%s_%sr9 )r] r~ rm ra r} r� r r� z%s_%s_ICMP_BLOCK: ) rM r� r� r� r. r� r2 r� r� r� r� )rT r� r� r~ r� r� r� r� r4 r4 r5 �'build_policy_icmp_block_inversion_rulesk s,
z0nftables.build_policy_icmp_block_inversion_rulesc C s� g }ddddiiddd�iddd d
d gd d
�iddd�ig}|dkrV|j dddii� |j dd i� |j dddtd|d�ii� |j dddtdddddd �idd d d gid�id d igd�ii� |S )!Nr) r� r` r z==rH )r. r/ r0 Zfibr� Ziifr Zoif)�flags�resultFr� r r� zrpfilter_DROP: r� rX rZ rJ Zfilter_PREROUTING)r] r~ rm r} r* rF r+ )r, r- r� znd-router-advertznd-neighbor-solicitr� )r2 r� )rT r� r� r� r4 r4 r5 �build_rpfilter_rules� s0
z nftables.build_rpfilter_rulesc C s� ddddddddd g }d
d � |D �}d d
ddd�idd|id�ig}| j jd"krb|jdddii� |j| jd�� g }|jddd td d |d �ii� |jddd td d!|d �ii� |S )#Nz ::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19c S s2 g | ]*}d |j d�d t|j d�d �d�i�qS )r� r� r r< )r re )r� rn )�.0r^ r4 r4 r5 �
<listcomp>� s z5nftables.build_rfc3964_ipv4_rules.<locals>.<listcomp>r) r* rL r� )r, r- z==r� )r. r/ r0 r� r� r r� zRFC3964_IPv4_REJECT: z addr-unreachrW rZ rJ r� r< )r] r~ rm ra r} Zfilter_FORWARDrB )r� r� )rM Z _log_deniedr2 r� r� )rT Z daddr_setr� r� r4 r4 r5 �build_rfc3964_ipv4_rules� s:
z!nftables.build_rfc3964_ipv4_rulesc C s� d}g }|j | j|j�� |j | j|j�� |j | j|j�� g }|j | j|||||�� |j | j|||||�� |j | j |||||�� |S )Nr( )
r2 r r] r r r r r r r )rT r� r� r� r~ r� r� r4 r4 r5 �*build_policy_rich_source_destination_rules� s z3nftables.build_policy_rich_source_destination_rulesc C s |dkr dS dS )NrG rH �ebTF)rG rH r8 r4 )rT r� r4 r4 r5 �is_ipv_supported� s znftables.is_ipv_supportedc
C s� ddd�}|| || ddg|| dd|| g|| dd|| g|| dg|| || || g|| ddg|| dd|| g|| dgdd � }||kr�|| S t td
| ��d S ) NZ ipv4_addrZ ipv6_addr)rG rH Z
inet_protoZ inet_servicer ZifnameZ
ether_addr) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz!ipset type name '%s' is not valid)r r
)rT r� r+ Zipv_addr�typesr4 r4 r5 �_set_type_list� s"
znftables._set_type_listc
C s� |r d|kr |d dkr d}nd}t || j||�d�}x0|jd�d jd�D ]}|dkrLd g|d
< P qLW |r�d|kr�|d |d< d|kr�|d |d< g }x0dD ](}d|i} | j|� |jdd| ii� q�W |S )Nr] �inet6rH rG )r~ r� r+ �:r< �,rK �netr Zintervalr1 ZtimeoutZmaxelem�sizerJ rL rW r� )rK r? r )rJ rK rL )r� r; r� r� r2 )
rT r� r+ �optionsr� Zset_dict�tr� r] Z rule_dictr4 r4 r5 �build_set_create_rules� s*
z nftables.build_set_create_rulesc C s$ | j |||�}| j|| jj� � d S )N)rC r� rM r� )rT r� r+ rA r� r4 r4 r5 �
set_create s znftables.set_createc C s8 x2dD ]*}dd|t |d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� )rJ rK rL )r� r� rM r� )rT r� r] rZ r4 r4 r5 � set_destroy s
znftables.set_destroyc C s6 | j jj|�jjd�d jd�}g }x�tt|��D ]�}|| dkrr|jdddii� |jdd |rdd
nd d �i� q2|| d kr�|jd| j|�|r�dndd �i� q2|| dkr�|jdd|r�dndii� q2|| dkr�|jdddii� q2t d|| ��q2W dt|�dk�rd|in|d |�r&dndd | d �iS ) Nr= r< r> r r� r` r� r* Zthr r" )r, r- rK r? r r� r� Zifacer� r� r z-Unsupported ipset type for match fragment: %sr) �concatr z!=z==�@)r. r/ r0 )rK r? r )
rM r � get_ipsetr+ r� r re r2 r� r )rT r� Z
match_destr � type_formatr3 �ir4 r4 r5 r s$ z nftables._set_match_fragmentc C sN | j jj|�}|jjd�d jd�}|jd�}t|�t|�krHttd��g }�x�tt|��D �]�}|| dk�r,y|| j d�}W n& t
k
r� |j d� || } Y n,X |j || d |� � || |d d � } y| j d�}W n t
k
�r |j | � Y n(X |j d| d |� | |d d � gi� q\|| dk�r d|| k�rb|j d|| jd�i� n�y|| j d �}W nL t
k
�r� || }
d |j k�r�|j d d
k�r�t
|
�}
|j |
� Y n^X || d |� }
d |j k�r�|j d d
k�r�t
|
�}
|j d|
t|| |d d � �d�i� q\|j || � q\W t|�dk�rJd|igS |S )Nr= r< r> z+Number of values does not match ipset type.r Ztcp�-r rK r? r� r] r< r� )r re rF )rK r? )rM r rH r+ r� re r r r ra r� r2 rA r rn ) rT r� �entry�objrI Z entry_tokensZfragmentrJ ra Zport_strr r4 r4 r5 �_set_entry_fragment7 sL
( "z nftables._set_entry_fragmentc C s> g }| j ||�}x(dD ] }|jdd|t||d�ii� qW |S )NrJ rK rL rW r� )r] r~ r� �elem)rJ rK rL )rN r2 r� )rT r� rL r� r� r] r4 r4 r5 �build_set_add_rulesk s
z nftables.build_set_add_rulesc C s" | j ||�}| j|| jj� � d S )N)rP r� rM r� )rT r� rL r� r4 r4 r5 �set_addu s znftables.set_addc C sF | j ||�}x4dD ],}dd|t||d�ii}| j|| jj� � qW d S )NrJ rK rL rY r� )r] r~ r� rO )rJ rK rL )rN r� r� rM r� )rT r� rL r� r] rZ r4 r4 r5 �
set_deletey s
znftables.set_deletec C s4 g }x*dD ]"}dd|t |d�ii}|j|� q
W |S )NrJ rK rL r{ r� )r] r~ r� )rJ rK rL )r� r2 )rT r� r� r] rZ r4 r4 r5 �build_set_flush_rules� s
z nftables.build_set_flush_rulesc C s | j |�}| j|| jj� � d S )N)rS r� rM r� )rT r� r� r4 r4 r5 � set_flush� s
znftables.set_flushc C sJ | j jj|�}|jdkr d}n(|jrBd|jkrB|jd dkrBd}nd}|S )Nzhash:macr r] r< rL rK )rM r rH r+ rA )rT r� r r] r4 r4 r5 r� � s
znftables._set_get_familyc C s� g }|j | j|||�� |j | j|�� d}x^|D ]D}|j | j||�� |d7 }|dkr2| j|| jj� � |j� d}q2W | j|| jj� � d S )Nr r< i� )r� rC rS rP r� rM r� �clear) rT Zset_nameZ type_nameZentriesZcreate_optionsZ
entry_optionsr� �chunkrL r4 r4 r5 � set_restore� s
znftables.set_restore)N)N)r� )rJ )FrJ )rJ )rJ )F)NN)NN)NN)NN)N)N)N)N)N)F)N)N)F)NN)I�__name__�
__module__� __qualname__r� Zpolicies_supportedrV rh rl rt rz r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r� r r r r r r! r# r$ r% r& r' r* r+ r, r/ r0 r3 r6 r7 r9 r; rC rD rE r rN rP rQ rR rS rT r� rW r4 r4 r4 r5 rI � s� /.`
4
R
i
;
-
9
+
$
$
$
'
$
<
#
4
rI ij���i����)N)(Z
__future__r ri rw r
Zfirewall.core.loggerr Zfirewall.functionsr r r r r Zfirewall.errorsr r
r r r
r r Zfirewall.core.richr r r r r r r Znftables.nftablesr r� r� r� r� r� r6 r� �objectrI r4 r4 r4 r5 �<module> s� $$