MINI MINI MANI MO
ó
dßØ[c @ sc d d l Z d d l m Z d d l m Z d d l m Z m Z m Z d d l
m Z d d l Z i d d 6d d 6Z
i d
d d g d
6d d g d 6d d d
d d g d 6d d d g d 6d
d d g d 6Z i d d 6d d 6Z i d d 6d d 6Z i Z i Z i Z g e d
<e ƒ e d
<xW e d
D]K Z e d
j d e ƒ e d
j d e e f ƒ e d
j d e ƒ q-Wg e d <e ƒ e d <xë e d D]ß Z e d j d e ƒ e d j d e e f ƒ e d j d e ƒ e d k r}e d j d e ƒ e d j d e ƒ e d j d e e f ƒ e d j d e e f ƒ e d j e d e d e g ƒ ƒ n qžWg e d <e ƒ e d <xë e d D]ß Z e d j d e ƒ e d j d e e f ƒ e d j d e ƒ e d k r‚e d j d e ƒ e d j d e ƒ e d j d e e f ƒ e d j d e e f ƒ e d j e d e d e g ƒ ƒ n q£Wg e d <e ƒ e d <xñ e d D]å Z e d j d e ƒ e d j d e e f ƒ e d j d e ƒ e d d g k re d j d e ƒ e d j d e ƒ e d j d e e f ƒ e d j d e e f ƒ e d j e d e d e g ƒ ƒ n q¨Wd! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d: g e d <d; d< d= d> g e d <e d? d@ dA dB dC dD dE dF dG g ƒ e d <dH e f dI „ ƒ YZ dJ e f dK „ ƒ YZ dL „ Z d S(M iÿÿÿÿN( t runProg( t log( t tempFilet readfilet splitArgs( t configs /proc/net/ip_tables_namest ipv4s /proc/net/ip6_tables_namest ipv6t INPUTt OUTPUTt FORWARDt securityt
PREROUTINGt rawt POSTROUTINGt manglet natt filters icmp-host-prohibiteds icmp6-adm-prohibitedt icmps ipv6-icmps -N %s_directs -I %s 1 -j %s_directs %s_directs -N %s_ZONES_SOURCEs -N %s_ZONESs -I %s 2 -j %s_ZONES_SOURCEs -I %s 3 -j %s_ZONESs %s_ZONES_SOURCEs %s_ZONESs -N INPUT_directs -N INPUT_ZONES_SOURCEs -N INPUT_ZONESs? -I INPUT 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs -I INPUT 2 -i lo -j ACCEPTs -I INPUT 3 -j INPUT_directs -I INPUT 4 -j INPUT_ZONES_SOURCEs -I INPUT 5 -j INPUT_ZONESs1 -I INPUT 6 -m conntrack --ctstate INVALID -j DROPs -I INPUT 7 -j %%REJECT%%s -N FORWARD_directs -N FORWARD_IN_ZONES_SOURCEs -N FORWARD_IN_ZONESs -N FORWARD_OUT_ZONES_SOURCEs -N FORWARD_OUT_ZONESsA -I FORWARD 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTs -I FORWARD 2 -i lo -j ACCEPTs -I FORWARD 3 -j FORWARD_directs' -I FORWARD 4 -j FORWARD_IN_ZONES_SOURCEs -I FORWARD 5 -j FORWARD_IN_ZONESs( -I FORWARD 6 -j FORWARD_OUT_ZONES_SOURCEs! -I FORWARD 7 -j FORWARD_OUT_ZONESs3 -I FORWARD 8 -m conntrack --ctstate INVALID -j DROPs -I FORWARD 9 -j %%REJECT%%s -N OUTPUT_directs -I OUTPUT 1 -j OUTPUT_directs` -I INPUT 6 -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's; -I INPUT 8 %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'sb -I FORWARD 8 -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 's> -I FORWARD 10 %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 't INPUT_directt INPUT_ZONES_SOURCEt INPUT_ZONESt FORWARD_directt FORWARD_IN_ZONES_SOURCEt FORWARD_IN_ZONESt FORWARD_OUT_ZONES_SOURCEt FORWARD_OUT_ZONESt
OUTPUT_directt ip4tablesc B s e Z d Z d „ Z d „ Z d „ Z d d „ Z d „ Z e d d „ Z
d d „ Z d „ Z d
„ Z
d d „ Z d „ Z d
„ Z d „ Z d d „ Z d d d „ Z d „ Z d d „ Z RS( R c C sV t j | j | _ t j d | j | _ | j ƒ | _ | j ƒ | _ | j ƒ d S( Ns
%s-restore(
R t COMMANDSt ipvt _commandt _restore_commandt _detect_wait_optiont wait_optiont _detect_restore_wait_optiont restore_wait_optiont fill_exists( t self( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt __init__œ s
c C s4 t j j | j ƒ | _ t j j | j ƒ | _ d S( N( t ost patht existsR t command_existsR t restore_command_exists( R& ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR% £ s c C sÔ | j rB | j | k rB | j g g | D] } d | ^ q( } n g | D] } d | ^ qI } t j d | j | j d j | ƒ ƒ t | j | ƒ \ } } | d k rÐ t d | j d j | ƒ | f ƒ ‚ n | S( Ns %ss %s: %s %st i s '%s %s' failed: %s( R" R t debug2t __class__R t joinR t
ValueError( R& t argst itemt _argst statust ret( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt __run§ s * % c C sø | d k r | Sg } xÛ | D]Ó } t } x® | D]¦ } y | j | ƒ } Wn t k
r\ q0 Xt | ƒ | k r0 d | | d k r0 t } | | d j d ƒ } x3 | D]( } | }
| |
| d <| j |
ƒ q§ Wq0 q0 W| s | j | ƒ q q W| S( s5 Split values combined with commas for options in optst ,i N( t Nonet Falset indexR1 t lent Truet splitt append( R& t rulest optst out_rulest rulet processedt optt it itemsR3 t _rule( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt split_value´ s(
&
c C sA y | j | ƒ } Wn t k
r' t SX| | | | d +t Sd S( Ni ( R; R1 R: R= ( R& RC t patternt replacementRF ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
_rule_replaceÒ s
t offc C s t ƒ } i } xÖ| D]Î} | } | j | d d d t | j g ƒ | j | d t | j g ƒ y | j d ƒ } Wn t k
r‰ nL X| d k rœ q n | d& k rÈ d
d d | g | | | d
+n
| j | ƒ d } xp d d g D]b }
y | j |
ƒ } Wn t k
rqè Xt | ƒ | d
k rè | j | ƒ | j | ƒ } qè qè Wxz t t | ƒ ƒ D]f } x] t
j D]R } | | | k rq| | j d ƒ oª| | j
d ƒ rqd | | | | <qqqqWqaW| j | g ƒ j | ƒ q Wx‘ | D]‰ } | | } | j | d d g ƒ } | j | d d g ƒ } | j d | ƒ x( | D] } | j d j | ƒ d ƒ qGW| j d ƒ qïW| j ƒ t j | j ƒ } t j d | j | j d | j | j f ƒ g }
| j ræ|
j | j ƒ n | sü|
j d ƒ n t | j |
d | j ƒ\ } } t j ƒ d k r¹t | j ƒ } | d k r¹d
} xc | D]X } t j! d | | f d! d
d" d# ƒ| j
d ƒ s¥t j! d$ d! d
ƒn | d
7} qWWq¹n t j" | j ƒ | d# k rýt d% | j d j |
ƒ | f ƒ ‚ n | S(' Ns
%%REJECT%%t REJECTs
--reject-withs %%ICMP%%s %%LOGTYPE%%RM t unicastt broadcastt multicasts -mt pkttypes
--pkt-typei R s -ts --tablet "s "%s"s -ss --sources -ds
--destinations *%s
R- s
s COMMIT
s %s: %s %ss %s: %ds -nt stdini s %8d: %st nofmtt nli t s '%s %s' failed: %s( RO RP RQ (# R RL t DEFAULT_REJECT_TYPER t ICMPR; R1 t popR< t ranget stringt
whitespacet
startswitht endswitht
setdefaultR? RI t writeR0 t closeR( t statt nameR R. R/ R t st_sizeR$ R t getDebugLogLevelR R9 t debug3t unlink( R& R@ t flusht
log_deniedt temp_filet table_rulesRH RC RF t tableRE t cRc R2 R5 R6 t linest line( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt set_rulesÛ s€
#
# c C sÀ | j | d d d t | j g ƒ | j | d t | j g ƒ y | j d ƒ } Wn t k
rf nM X| d k rw d S| d k r¦ d d d
| j g | | | d +n
| j | ƒ | j | ƒ S( Ns
%%REJECT%%RN s
--reject-withs %%ICMP%%s %%LOGTYPE%%RM RW RO RP RQ s -mRR s
--pkt-typei ( s unicasts broadcasts multicast( RL RX R RY R; R1 t _log_deniedRZ t _ip4tables__run( R& RC Rj RF ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt set_rule6 s
c C s | j d g | ƒ d S( Ns -A( Rs ( R& RC ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt append_ruleN s c C s | j d g | ƒ d S( Ns -D( Rs ( R& RC ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt delete_ruleQ s c C sŽ g } | r | g n t j ƒ } xf | D]^ } y* | j d | d d g ƒ | j | ƒ Wq( t k
r… t j d | j | f ƒ q( Xq( W| S( Ns -ts -Ls -nsA %s table '%s' does not exist (or not enough permission to check).( t BUILT_IN_CHAINSt keysRs R? R1 R t debug1R ( R& Rm R6 t tables( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt available_tablesT s
"c C sx g } t | j } t j j | ƒ rt t | d ƒ ; } x1 | j ƒ D]# } | sT Pn | j | j ƒ ƒ qD WWd QXn | S( Nt r( t PROC_IPxTABLE_NAMESR R( R) R* t opent readlinesR? t strip( R& Rz t filenamet fRp ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt used_tables` s
c C sŽ d } t | j d d d g ƒ } | d d k rŠ d } t | j d d d g ƒ } | d d k rk d } n t j d | j | j | ƒ n | S( NRW s -ws -Ls -ni s -w2s %s: %s will be using %s option.( R R R R. R/ ( R& R" R6 ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR! m s c C sÅ t ƒ } | j d ƒ | j ƒ d } xl d d g D]^ } t | j | g d | j ƒ} | d d k r3 d | d k r3 d | d k r3 | } Pq3 q3 Wt j d
| j | j | ƒ t j
| j ƒ | S( Ns #fooRW s -ws --wait=2RT i s invalid optioni s unrecognized options %s: %s will be using %s option.( R Ra Rb R R Rd R R. R/ R( Rh ( R& Rk R" t test_optionR6 ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR# y s
c C s| | j ƒ } xi | D]a } xX d d d g D]G } | d k rZ | j | j d | | g ƒ q) | j d | | g ƒ q) Wq Wd S( Ns -Fs -Xs -Zs -t( Rƒ R9 t add_ruleR Rs ( R& t transactionRz Rm t flag( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyRi Œ s
t usedc C s¶ | d k r | j ƒ } n t t j ƒ ƒ } x‚ | D]z } | d k rL q4 n x_ t | D]S } | d k rŽ | j | j d | d | | g ƒ qW | j d | d | | g ƒ qW Wq4 Wd S( NRˆ R s -ts -P( Rƒ t listRw Rx R9 R… R Rs ( R& t policyt whichR† Rz Rm t chain( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt
set_policy˜ s
c
C s{ g } d } y1 | j d | j d k r- d n d d g ƒ } WnG t k
r† } | j d k rr t j d | ƒ q‡ t j d | ƒ n X| j ƒ } t } xÛ | D]Ó } | r.| j ƒ j ƒ } | j ƒ } xa | D]V } | j
d ƒ r| j d
ƒ r| d d !} n | } | | k rÑ | j | ƒ qÑ qÑ Wn | j d k rL| j
d
ƒ sj| j d k r | j
d ƒ r t
} q q W| S( sQ Return ICMP types that are supported by the iptables/ip6tables command and kernelRW s -pR R s ipv6-icmps --helps iptables error: %ss ip6tables error: %st (t )i iÿÿÿÿs Valid ICMP Types:R s Valid ICMPv6 Types:( Rs R R1 R Ry t
splitlinesR: R€ t lowerR> R^ R_ R? R= (
R& R6 t outputt exRo t in_typesRp t splitsR> t x( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt supported_icmp_types¨ s4
c C sà x¼ t D]´ } | | j ƒ k r% q n t | } | d k r\ | t k r\ | j t | ƒ n d | g } xP | D]H } t | ƒ t k r” | | } n | t | ƒ } | j | j | ƒ qo Wq Wd S( NRM s -t( t
DEFAULT_RULESR{ t LOG_RULESt extendt typeR‰ R R… R ( R& R† Rj Rm t
default_rulest prefixRC RH ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt apply_default_rulesÉ s
N( t __name__t
__module__R R' R% Rs R9 RI RL R: Rq Rt Ru Rv R{ Rƒ R! R# Ri R R— Rž ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR ™ s$
[
!t ip6tablesc B s e Z d Z e d „ Z RS( R c C s¬ | j | j d d d d d d d d d d
g
ƒ | j | j d d d d d d d
d d d g
ƒ | d k r¨ | j | j d d d d d d d
d d d d d g ƒ n d S( Ns -IR t 1s -tR
s -ps ipv6-icmps" --icmpv6-type=router-advertisements -jt ACCEPTt 2s -mt rpfilters --invertt DROPRM t LOGs --log-prefixs rpfilter_DROP: ( R… R ( R& R† Rj ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt apply_rpfilter_rulesÛ s
( RŸ R R R: R¨ ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyR¡ Ø s c C sÎ i d d 6d d 6d d 6d d 6d d 6d d
6} | } x | D]ˆ } y | j | ƒ } Wn t k
rm q> n X| d k r¸ y t | | d ƒ Wn t k
r£ q¸ X| j | d ƒ n | | | | <q> W| S(
s Inverse valid rule s -Ds -As --deletes --appends -Is --inserts -Xs -Ns --delete-chains --new-chaini ( s -Is --insert( R; t Exceptiont intRZ ( R& R2 t replace_argst ret_argst argt idx( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt reverse_ruleí s*
( t os.pathR( t firewall.core.progR t firewall.core.loggerR t firewall.functionsR R R t firewallR R\ R} Rw RX RY R˜ R™ t
OUR_CHAINSt setRŒ R? t addt updatet objectR R¡ R¯ ( ( ( s; /usr/lib/python2.7/site-packages/firewall/core/ipXtables.pyt <module> sÎ
,
,
,
ÿ @
OHA YOOOO