+
    im c                   sP   ^ RI t^ RIt^ RIHt ^ RIHt ^ RIHtH	t	H
t
HtHtHtHtHt ^ RIHt ^ RIHtHtHtHtHtHt ^ RIHtHtHtHtHtHtH t H!t!H"t" ^ RI#H$t$ ^ R	I%H&t&H't' ^ RI(t(R
t)R. RORRR.R. ROR. R OR. RO/t*RRRR/t+RRRR/t,R t-R t. ! R R4      t/ ! R R]/4      t0R# )!    N)runProg)log)tempFilereadfile	splitArgs	check_macportStrcheck_single_addresscheck_addressnormalizeIP6)config)FirewallErrorINVALID_PASSTHROUGHINVALID_RULEUNKNOWN_ERRORINVALID_ADDRINVALID_ICMPTYPE)	Rich_AcceptRich_Reject	Rich_Drop	Rich_Mark
Rich_NFLogRich_MasqueradeRich_ForwardPortRich_IcmpBlockRich_Tcp_Mss_Clamp)DEFAULT_ZONE_TARGET)
ICMP_TYPESICMPV6_TYPES securityOUTPUTraw
PREROUTINGmanglenatfilteripv4zicmp-host-prohibitedipv6zicmp6-adm-prohibitedicmp	ipv6-icmpc                sT   RRRRRRRRRRR	R
/pV R,          pV FY  p VP                  V4      pTR9   d2    \        Y$^,           ,          4       TP                  T^,           4       Y,          Y$&   Tu # 	  \	        \
        R4      h  \         d     K{  i ; i  \         d     L?i ; i)zReverse valid passthough rule-A-D--append--delete-I--insert-N-X--new-chain--delete-chainNNNno '-A', '-I' or '-N' argr.   r/   )index
ValueErrorintpopr   r   )argsZreplace_argsZret_argsZxZidx   &    </usr/lib/python3.14/site-packages/firewall/core/ipXtables.pycommon_reverse_passthroughr>   D   s    
 	dJdJd'
L AwH	..#C ""&H1W%& S1W%$% ( +-H
II#  		  s"   BBBBB'&B'c                s"   \        V 4      p \        . RO4      p\        W,          4      ^ 8  d.   \        \        R\	        W,          4      ^ ,          ,          4      h\        . RO4      p\        W,          4      ^ 8X  d   \        \        R4      hR# )zTCheck if passthough rule is valid (only add, insert and new chain
rules are allowed)zarg '%s' is not allowedr5   N)z-Cz--checkr+   r-   z-Rz	--replace-Lz--listz-Sz--list-rules-Fz--flush-Zz--zeror1   r3   -Pz--policyz-Ez--rename-chainr*   r,   r.   r/   r0   r2   )setlenr   r   list)r;   Znot_allowedZneeded   &  r=   common_check_passthroughrH   n   s     t9D	
K4 4"!:T$BT=UVW=X!X
 	

 JKF 4=Q/1LMM     c                   s  a  ] tR t^t o RtR tRtR tR tR t	R t
R tR tR	 tR
 tR tR tR tR tR tR tR7R ltR tR tR tR tR7R ltR tR tR8R ltR tR9R ltR:R lt R:R lt!R t"R  t#R! t$R" t%R# t&R$ t'R% t(R& t)R' t*R( t+R;R) lt,R;R* lt-R;R+ lt.R;R, lt/R- t0R;R. lt1R7R/ lt2R7R0 lt3R1 t4R;R2 lt5R3 t6R4 t7R5 t8R6t9V t:R# )<	ip4tablesr&   Tc                sr   Wn         \        P                  V P                  ,          V n        \        P                  R V P                  ,          ,          V n        V P                  4       V n        V P                  4       V n	        V P                  4        . V n        / V n        / V n        / V n        / V n        R# )z
%s-restoreN)_fwr   ZCOMMANDSipv_command_restore_command_detect_wait_optionwait_option_detect_restore_wait_optionrestore_wait_optionfill_existsavailable_tablesrich_rule_priority_countspolicy_dispatch_index_cache%policy_dispatch_index_cache_ref_count
our_chains)selfZfw   &&r=   __init__Zip4tables.__init__   s    1 &txx0G H335#'#C#C#E  ")+&+-(572rI   c                s    \         P                  P                  V P                  4      V n        \         P                  P                  V P
                  4      V n        R # N)osZpathZexistsrM   command_existsrN   restore_command_existsrY      &r=   rS   Zip4tables.fill_exists   s6     ggnnT]];&(ggnnT5J5J&K#rI   c                s   V P                   '       d>   V P                   V9  d-   V P                   .V Uu. uF  pR V,          NK  	  up,           pMV Uu. uF  pR V,          NK  	  pp\        P                  ! RV P                  V P                  RP                  V4      4       \        V P                  V4      w  rEV^ 8w  d1   \        RV P                  : RRP                  V4      : RV: 24      hV# u upi u upi )%s	%s: %s %s '
' failed: )rP   r   debug2	__class__rM   joinr   r8   )rY   r;   ZitemZ_argsstatusret   &&    r=   Z__runZip4tables.__run   s     0 0 <%%&$)G$$$++$)GGE-12TTTD[[TE2

;sxxOu5Q;(,sxxL  
 *H2s   C5C:c                sb     VP                  V4      pW1WD^,           % R#   \         d     R# i ; i)i   TF)r7   r8   )rY   ruleZpatternZreplacementi   &&&& r=   _rule_replaceZip4tables._rule_replace   s9    	

7#A *UO	  		s    ..c                sD    V\         9   ;'       d    V\         V,          9   # r\   )BUILT_IN_CHAINS)rY   rL   tablechains   &&&&r=   is_chain_builtinZip4tables.is_chain_builtin   s    'KKE_U5K,KKrI   c                s    R V.pV'       d   VP                  R4       MVP                  R4       VP                  V4       V.# )-tr0   r1   )append)rY   addrr   rs   rm   ro   r=   build_chain_rulesZip4tables.build_chain_rules   s9    e}KKKKEvrI   c                sp    R V.pV'       d   VRV\        V4      .,          pMVRV.,          pWe,          pV# )ru   r.   r+   )str)rY   rw   rr   rs   r7   r;   rm   s   &&&&&& r=   
build_ruleZip4tables.build_rule   s=    e}T5#e*--DT5M!DrI   c                s    \        V4       R # r\   )rH   rY   r;   rZ   r=   check_passthroughZip4tables.check_passthrough   s
     &rI   c                s    \        V4      # r\   )r>   r{   rZ   r=   reverse_passthroughZip4tables.reverse_passthrough   s    )$//rI   c                sL   R p VP                  R4      p\        V4      V^,           8  d   W^,           ,          pRpR F=  p TP                  T4      p\        T4      T^,           8  d   Y^,           ,          pK=  K?  	  Y$3#   \         d     LUi ; i  \         d     Kc  i ; i)r%   ru   NrC   )r7   rE   r8   )rY   r;   rr   rn   rs   optrl   r=   passthrough_parse_table_chainZ'ip4tables.passthrough_parse_table_chain   s    	$

4 A 4yAE!ULC(JJsO t9A% QKE & M ~  		  s#   B BBBB#"B#c                s    VP                  V4      pRpRpR	pVP                  V4       VP                  V4      p\        V\        4      '       g   \	        \
        R4      hRp	R
 F=  p
 VP                  V
4      p\        V4      V^,           8  d   W^,           ,          p	K=  K?  	  R FO  p
 VP                  V
4      p\        V4      V^,           8  d   W^,           ,          pV
R9   d   RpV
R9   d   RpKO  KQ  	  V	X3pV'       gU   W9  g"   WV,          9  g   W,,          V,          ^ 8:  d   \	        \        R4      hW,,          V;;,          ^,          uu&   R# W9  d   / W,&   WV,          9  d   ^ W,,          V&   ^p\        W,,          P                  4       4       F1  pW8X  d   V'       d    M"WV,          V,          ,          pW8X  g   K1   M	  W,,          V;;,          ^,          uu&   RW&   VP                  V^,           RV,          4       R#   \         d     EK  i ; i  \         d     EK  i ; i  \         d     R# i ; i)z
Change something like
  -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
or
  -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
into
  -t filter -I public_IN 4
or
  -t filter -I public_IN
TFz%priority must be followed by a numberr%   r.   z*nonexistent or underflow of priority countz%dNru   z--tabler*   r,   r.   r/   r+   r-   r6   r+   r-   )r7   r:   
isinstancer9   r   r   rE   r8   r   Zsortedkeysinsert)rY   rm   Zpriority_countsZtokenrn   Zrule_addr   Zinsert_add_indexpriorityrr   r~   jrs   r7   ps   &&&&           r=   _set_rule_replace_priorityZ$ip4tables._set_rule_replace_priority   s>   G	@

5!A HF!HHQKxx{Hh,,# "I  E(,

3A 4yAE) $U * ) N)'+zz#$ 4y$4q$88 $%9 :00!%00#( 1 N ENE 0u'==&-h71<'%'S   &x0A50/-/O*5#9978O*84  6 ; ; =>A}U3A66E} ?  &x0A50)-&,q0$,?i "  " 3  		s5   H: )H,H'H$#H$'H76H7:I	I	c                s    VP                  R 4      pTP                  T4       TP                  T4      pRpRpRpR F=  p	 TP                  T	4      p
\        T4      T
^,           8  g   K.  Y^,           ,          pK?  	  R FF  p	 TP                  T	4      p\        T4      T^,           8  d   Y^,           ,          pT	R9   g   KD  RpKH  	  TX3pT'       d   Y9   d   YRT,          9   d   Y9   da   YST,          9   dT   Y;,          T,          ^8X  d#   Y;,          T Y+,          P	                  T4       R# Y;,          T;;,          ^,          uu&   R# Y+,          P	                  T4       R# R# Y9  d   . Y+&   YRT,          9   dM   Y9  d   / Y;&   YST,          9  d   ^Y;,          T&   YST,          9   d   Y;,          T;;,          ^,          uu&   R# Y+,          P                  T4       Y+,          P                  4        Y+,          P                  T4      pRY&   TP                  T^,           T^,            4       R#   \         d     R# i ; i  \         d     EK  i ; i  \         d     EK  i ; i)	%%POLICY_SORT_KEY%%Fr%   r.   Tr   r   r   r   )r7   r8   r:   rE   Zremoverv   Zsortr   )rY   rm   rV   rW   rn   Z
sort_tupleZdeleteZ
verb_indexrr   r~   r   rs   r7   s   &&&&         r=   _set_rule_sort_policy_dispatchZ(ip4tables._set_rule_sort_policy_dispatchJ  sM   	

01A 	XXa[

$CJJsO 4yAE!U % JC!ZZ_
 4yJN*!^,(( J 4e"DD B"E&RR<CJOSTTAHT3:AA*M$=DZPTUUP#/6==jI 757+2 ??ECE9@5%QQOP9@Lu!MM9@LPQQL '.55jA'.335/6<<ZHE#DKK
Q519+7[  		    s5   H8 I
I8II
III-,I-c           	     s@	   \        4       p/ p\        P                  ! V P                  4      p\        P                  ! V P                  4      p\        P                  ! V P
                  4      pV EF  pVR ,          p	V P                  V	RRR\        V P                  ,          .4       V P                  V	R\        V P                  ,          .4        V	P                  R4      p
VR8X  d   K|  VR9   d   RRR	V.WV
^,           % MV	P                  V
4        V P                  WR
4       V P                  WV4      pV'       d   K  RpR FP  p V	P                  V4      p
\        V	4      V
^,           8  d%   V	P                  V
4       V	P                  V
4      pKP  KR  	  \!        V	4       F_  w  r\"        P$                   FF  pW9   g   K  VP'                  R4      '       d   VP)                  R4      '       d   K;  RV,          W&   KH  	  Ka  	  VP+                  V. 4      P-                  V	4       EK  	  V Fd  pWL,          pVP/                  RV,          4       V F*  p	VP/                  RP1                  V	4      R,           4       K,  	  VP/                  R4       Kf  	  VP3                  4        \4        P6                  ! VP8                  4      p\:        P<                  ! RV P>                  V P@                  RVP8                  VPB                  3,          4       . pV PD                  '       d   VP-                  V PD                  4       VP-                  R4       \G        V P@                  VVP8                  R7      w  pp\:        PH                  ! 4       ^8  d   \K        VP8                  4      pVef   ^p
V F]  p\:        PL                  ! RV
V3,          ^^ R7       VP)                  R4      '       g   \:        PL                  ! R^R7       V
^,          p
K_  	  \4        PN                  ! VP8                  4       V^ 8w  d1   \        RV P@                  : RRP1                  V4      : RV: 24      hWPn        W`n        VV n        R#   \         d     ELui ; i  \         d     EKV  i ; i)r4   
%%REJECT%%REJECT--reject-with%%ICMP%%%%LOGTYPE%%off-mpkttype
--pkt-type%%RICH_RULE_PRIORITY%%r%   Z"z"%s"z*%s
rd   Z
zCOMMIT
rc   z%s: %d-nZstdinNz%8d: %s)nofmtZnlr   )r   re   rf   unicastZ	broadcastZ	multicastr   )(r   copydeepcopyrU   rV   rW   rp   DEFAULT_REJECT_TYPErL   ICMPr7   r:   r8   r   r   rE   Z	enumeratestringZ
whitespace
startswithZendswithZ
setdefaultrv   writeri   closer]   statnamer   rg   rh   rN   Zst_sizerR   r   ZgetDebugLogLevelr   debug3unlink)rY   rules
log_denied	temp_fileZtable_rulesrU   rV   rW   _rulerm   rn   skiprr   r~   elementZcr   r;   rj   rk   ZlinesZlines   &&&                   r=   	set_rulesZip4tables.set_rules  s   J	$(MM$2P2P$Q!&*mmD4T4T&U#04661
- E8D ?,?,IJ tZ$txx.1AB
 JJ}- &!FF'+Yj&QDQUOHHQK++1I 663XD E(,

3A 4yAE) $ * ) (o
**A|**3//G4D4DS4I4I"(7"2	 + . ""5"-44T:u x !E&EOOGeO, 56 OOJ' ! 	wwy~~&

NN!!	55		
 ###KK001D 5 5t9>>R!A%Y^^,E !DJJyAt94A!D==..

2Q/FA	 " 			)..!Q;(,(=(=sxx~sS  *C&+F(1 	2m  2 " s$   Q;
R;R
	R
RRc                s   V P                  VR RR\        V P                  ,          .4       V P                  VR\        V P                  ,          .4        VP	                  R4      pVR8X  d   R# VR9   d   RRR	V.WV^,           % MVP                  V4        \        P                  ! V P                  4      p\        P                  ! V P                  4      p\        P                  ! V P                  4      pV P                  WR
4       V P                  WV4      pRpV'       g   V P                  V4      pW@n	        WPn
        VV n        V#   \         d     Li ; i)r   r   r   r   r   r   r   r   r   r   r   r   )rp   r   rL   r   r7   r:   r8   r   r   rU   rV   rW   r   r   _ip4tables__run)	rY   rm   r   rn   rU   rV   rW   r   Zoutput	   &&&      r=   set_ruleZip4tables.set_rule  sM   (;DHH(EF	
 	4d488n-=>
	

=)A U"BB#'L*"MQ$(MM$2P2P$Q!&*mmD4T4T&U#04661
- 	''-E	
 22/T
 ZZ%F)B&+F(1 	2 ?  		s   E EENc                s   . pV'       d   V.M\         P                  4       pV Fh  pWP                  9   d   VP                  V4       K&   V P	                  R VRR.4       V P                  P                  V4       VP                  V4       Kj  	  V#   \
         d-    \        P                  ! T P                  : RT: R24        K  i ; i)ru   r?   r   z table 'z5' does not exist (or not enough permission to check).)	rq   r   rT   rv   r   r8   r   Zdebug1rL   )rY   rr   rk   Ztables   &&  r=   get_available_tablesZip4tables.get_available_tables@  s    !%';';'=E---

5!JJeT489))007JJu%  
 " JJ88U,s   AB3C	C	c           	     s   R p\        V P                  . RO4      p\        P                  ! RV P                  V P                  RV^ ,          V^,          4       V^ ,          ^ 8X  d   Rp\        V P                  . RO4      p\        P                  ! RV P                  V P                  RV^ ,          V^,          4       V^ ,          ^ 8X  d   Rp\        P
                  ! RV P                  V P                  V4       V# )r   -w7%s: %s: probe for wait option (%s): ret=%u, output="%s"-w10%s: %s will be using %s option.)r   r?   r   )r   r?   r   )r   rM   r   r   rh   rg   )rY   rP   rk   rG   r=   rO   Zip4tables._detect_wait_optionS  s    dmm%78

ENNMMFF	
 q6Q;K3C JJIAA 1v{$JJ1	 rI   c           
     s0   \        4       pVP                  R 4       VP                  4        RpR F  p\        V P                  V.VP
                  R7      p\        P                  ! RV P                  V P                  VV^ ,          V^,          4       V^ ,          ^ 8X  g   Ks  RV^,          9  g   K  RV^,          9  g   K  Tp M	  \        P                  ! RV P                  V P                  V4       \        P                  ! VP
                  4       V# )z#foor   r   r   zinvalid optionzunrecognized optionr   )r   z--wait=2)r   r   r   r   rN   r   r   r   rh   rM   rg   r]   r   )rY   r   rP   Ztest_optionrk   r<   r=   rQ   Z%ip4tables._detect_restore_wait_optionv  s    J	-K$//+innUCJJIAA A!$CF2)Q7)! .$ 	

-NN!!		
 			)..!rI   c                s    / V n         / V n        / V n        . p\        P	                  4        F8  pV P                  V4      '       g   K  R F  pVP                  RW#.4       K  	  K:  	  V# )r@   ru   )r@   r1   rA   )rU   rV   rW   rq   r   r   rv   )rY   r   rr   Zflags   &   r=   build_flush_rulesZip4tables.build_flush_rules  sj    )+&+-(572$))+E,,U33 +dE01 + , rI   c           
     sP   . pVR 8X  d   RMTp\         P                  4        F  pV P                  V4      '       g   K  VR8X  d   K%  \         V,           FJ  pVR8X  d*   W&,          pVR8X  d   VP                  RVRVRR.4       RpMTpVP                  RVRWg.4       KL  	  K  	  V# )	ZPANICDROPr$   r%   r   ru   r*   -jrB   )rq   r   r   rv   )rY   policyZpolicy_detailsr   _policyrr   rs   r   s   &&&     r=   build_set_policy_rulesZ ip4tables.build_set_policy_rules  s    "g-&6$))+E,,U33~(//H$&-AH}dE4h%OP"AdE4:; 0 , rI   c                s   \        4       pVe   V P                  R8X  d%   VP                  \        P                  ! 4       4       Ve   V P                  R8X  d%   VP                  \
        P                  ! 4       4       \        V4      # )Nr&   r'   )rD   rL   updater   r   r   rF   )rY   rL   Z	supported   && r=   supported_icmp_typesZip4tables.supported_icmp_types  s_    E	;$((f,Z__./;$((f,\..01IrI   c                s    . # r\    r`   ra   r=   build_default_tablesZip4tables.build_default_tables  s    	rI   c                s   . pV P                   P                  '       dh   V P                  R ,          P                  V R24       VP	                  RV R24       VP	                  RV R24       VP	                  RV RV R24       V# )r%   _dnatz-N -A z_dnat -j %%REJECT%%z  -m conntrack --ctstate DNAT -j )rK   _strict_forward_portsrX   rw   rv   )rY   rs   Z
dnat_rulesr   r=   _build_default_rules_dnatZ#ip4tables._build_default_rules_dnat  s    
88)))OOH%))UG5/:E7%01E7*=>?E7*J5'QVWXrI   c                s"   / pV P                  R 4      '       d   . VR &   \        4       V P                  R &   \        R ,           Fl  pVR ,          P	                  RV,          4       VR ,          P	                  RV: RV: R24       V P                  R ,          P                  RV,          4       Kn  	  V P                  R4      '       Ed   . VR&   \        4       V P                  R&   \        R,           F  pVR,          P	                  RV,          4       VR,          P	                  RV: RV: R24       V P                  R,          P                  RV,          4       VR8X  g   Ku  VR,          P	                  RV,          4       V P                  R,          P                  \        R	V,          .4      4       VR,          P	                  RV: RV: R
24       K  	  V P                  R4      '       Ed   . VR&   \        4       V P                  R&   \        R,           F  pVR,          P	                  RV,          4       VR,          P	                  RV: RV: R24       V P                  R,          P                  RV,          4       VR8X  g   Ku  VR,          P	                  RV,          4       V P                  R,          P                  \        R	V,          .4      4       VR,          P	                  RV: RV: R
24       K  	  V P                  R4      '       Ed   . VR&   \        4       V P                  R&   \        R,           F  pVR,          P	                  RV,          4       VR,          P	                  RV: RV: R24       V P                  R,          P                  RV,          4       VR,          P	                  RV,          4       V P                  R,          P                  \        R	V,          .4      4       VR,          P	                  RV: RV: R
24       K  	  . VR&   \        4       V P                  R&   VR,          P	                  RP                  V P                  P                  '       d   RMR4      4       VR,          P                  V P                  R4      4       VR,          P	                  R4       VR8w  d   VR,          P	                  R4       VR,          P	                  R4       VR,          P	                  R4       VR,          P	                  R4       V P                  R,          P                  \        R4      4       VR,          P	                  R4       V P                  R,          P                  \        R4      4       VR,          P	                  R4       VR8w  d   VR,          P	                  R4       VR,          P	                  R4       VR,          P	                  RP                  V P                  P                  '       d   RMR4      4       VR,          P                  V P                  R4      4       VR,          P	                  R 4       VR8w  d   VR,          P	                  R!4       VR,          P	                  R"4       VR,          P	                  R#4       VR,          P	                  R$4       V P                  R,          P                  \        R%4      4       VR,          P	                  R&4       V P                  R,          P                  \        R'4      4       VR,          P	                  R(4       VR8w  d   VR,          P	                  R)4       VR,          P	                  R*4       VR;;,          R+.,          uu&   VR,          P	                  R,P                  V P                  P                  '       d   RMR4      4       VR,          P                  V P                  R-4      4       VR;;,          R.R/.,          uu&   V P                  R,          P                  \        R04      4       VR,          P	                  R14       VR,          P	                  R24       V P                  R,          P                  \        R34      4       . pV FK  pWPP                  4       9  d   K  W%,           F&  pVP	                  R4V.\        V4      ,           4       K(  	  KM  	  V# )5r   z-N %s_directr   z -j Z_directz	%s_directr!   r"   z-N %s_POLICIESz%s_POLICIES	_POLICIESr#   r$   r%   z?-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED{} -j ACCEPTr   z,DNATINPUTz-A INPUT -i lo -j ACCEPTr   z^-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z/-A INPUT -m conntrack --ctstate INVALID -j DROPz-N INPUT_directz-A INPUT -j INPUT_directZINPUT_directz-N INPUT_POLICIESZINPUT_POLICIESz-A INPUT -j INPUT_POLICIESz9-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A INPUT -j %%REJECT%%zA-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED{} -j ACCEPTFORWARDz-A FORWARD -i lo -j ACCEPTz`-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: 'z1-A FORWARD -m conntrack --ctstate INVALID -j DROPz-N FORWARD_directz-A FORWARD -j FORWARD_directZFORWARD_directz-N FORWARD_POLICIESZFORWARD_POLICIESz-A FORWARD -j FORWARD_POLICIESz;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: 'z-A FORWARD -j %%REJECT%%z-N OUTPUT_directz@-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED{} -j ACCEPTr    z-A OUTPUT -o lo -j ACCEPTz-A OUTPUT -j OUTPUT_directZOUTPUT_directz-N OUTPUT_POLICIESz-A OUTPUT -j OUTPUT_POLICIESZOUTPUT_POLICIESru   )r   rD   rX   rq   rv   rw   r   ZformatrK   r   extendr   r   )rY   r   Zdefault_rulesrs   Zfinal_default_rulesrr   rm   s   &&     r=   build_default_rulesZip4tables.build_default_rules  sZ   $$Z00(*M*%*-%DOOJ'(44j)00%1GHj)00PU1VW
+//e0CD 5
 $$U++#%M% %(UDOOE"(//e$++NU,BCe$++E5,QR&**;+>?L(!%(//0@E0JKOOE*11#}7N6O2PQ!%(//%QV0WX 0 $$X..&(M(#(+DOOH%(22h'..~/EFh'..ue/TU)--kE.ABL(!(+223Cu3MNOOH-44S-5:Q9R5ST!(+2227? 3 $$U++#%M% %(UDOOE"(//e$++NU,BCe$++E5,QR&**;+>?e$++,<,FG&--c=E3J2K.LMe$++eU,ST 0 #%h$'E!h&&MTThh444'	

 	h&&t'E'Eg'NOh&&'AB(#**p 	h&&=	
 	h&&'89h&&'AB!((^)<=h&&':;!((-=)>?h&&'CD(#**K 	h&&'?@h&&OVVhh444'	

 	h&&t'E'Ei'PQh&&'CD(#**r 	h&&?	
 	h&&':;h&&'EF!((-=)>?h&&'<=!((-?)@Ah&&'GH(#**M 	h&&'ABh$6#77h&&NUUhh444'	

 	h&&t'E'Eh'OPh'($
 	
 	!((_)=>h&&';<h&&'EF!((->)?@ "E5577%,,#**D%=9T?+JK - # #"rI   c                s    VR 8X  d   RR0# VR8X  d   RV P                  4       9   d   R0# VR8X  d   RV P                  4       9   d   RR0# VR8X  d   RV P                  4       9   d   R0# / # )r%   r   r   r#   r"   r$   POSTROUTINGr!   )r   )rY   rr   rZ   r=   get_zone_table_chainsZip4tables.get_zone_table_chainsZ  s~    HY''H44466$~%E>1133$m44E>1133$~%	rI   c                s   V P                   P                  P                  V4      pVR 8X  d   ^ M.V P                   P                  P	                  V4      P
                  pVR 8X  d   ^ M.V P                   P                  P	                  V4      P                  p^ pV'       d   ^pMV'       d   ^pV'       d   RpRp^ pV'       d   ^pM0V'       g   VP                  '       d   V
'       d   ^pV
'       d   RpRpVR8X  d7   V P                   P                  P	                  V4      P                  ^,           pVR8X  d7   V P                   P                  P	                  V4      P                  ^,           p^ pV	'       d   V'       d   ^pM^pVVVVV3pVVVVV3pVV3pV'       d   RVV,           V,           V3,           .# RVV,           V,           V3,           .# )HOSTr   +r   )	rK   r   
get_policyzoneZget_zoneingress_priorityegress_priorityderived_from_zoneZpriority_max)rY   r   ingress_zoneegress_zoneingress_interfaceingress_sourceegress_interfaceegress_sourcer   last
preroutingpostroutingr   p_objr   r   Zingress_sort_orderZegress_sort_orderZlast_sort_orderZingressZegressZsuffixs   &&&&&&&&&&&&&         r=   _policy_dispatch_sort_keyZ#ip4tables._policy_dispatch_sort_keyi  s    **62 v% ''5FF 	 f$ ''4DD 	 !"!"!$&! !%"9"9"9j ! #%  ##xx}}55lCPPSTTs""hhmm44[ANNQRRO"#"# 
 
 "8,)6G+;f+Dy+PQQ)7V+;f+Dy+PQQrI   c                s   R RRR/V,          pV P                   P                  P                  V4      pVR8X  d
   VR8X  d   R MRpV P                   P                  P                  W#\        V4      pVR8X  d   R MRpVR8X  d   R MRp\        V
4      '       g   V'       d   \        V4      '       d   . # . pRW<V R2.pV'       d#   VR	8w  d   V'       g   VP                  R
V.4       V	'       d#   V	R	8w  d   V'       g   VP                  RV	.4       V'       d"   VP                  V P                  RV4      4       V
'       d"   VP                  V P                  RV
4      4       V'       g   VP                  RV.4       EM=VR8w  g   VR9   d   VP                  RR.4       EMVP                  \        RRRR39   Ed    V P                   P                  4       R8w  d   VP                  \        RRR39   d   VR,          pVP                  R8X  d   RMRpVP                  RRRRV RV R2.4       VP                  V P                  VVVVVV	V
VP                  R R VVR7      4       VP                  V4       VP                  \        8X  d   VP                  RR.4       MVP                  RVP                  .4       VP                  V P                  VVVVVV	V
VP                  VVVR7      4       VP                  V4       V# )Tr.   Fr+   r$   r   r"   ru   r   r   z-i-o-s-dr   r%   ZRETURNACCEPTr   r   r   r   r4   r   LOG--log-prefix_z: )r   r   r   r   )r   r   r   )r"   r    )rK   r   r   policy_base_chain_namePOLICY_CHAIN_PREFIXr   r   _rule_addr_fragmenttargetr   get_log_deniedr   r   rv   )rY   enabler   rr   rs   r   r   r   r   r   r   r   add_delr   isSNATr   r   r   r   rm   r   Z_log_suffixs   &&&&&&&&&&&&          r=   &build_policy_ingress_egress_pair_rulesZ0ip4tables.build_policy_ingress_egress_pair_rules  s    ud+F3**625.Um-C%((//88.
 #l2T
#}4d% ]##	.8Q8QIey&9: !2c!9+KK012 0C 7
KK/01KK00~FGKK00}EFKKw(h%+C"CKKx()\\
 
 xx&&(E1ell#	G 7 Q(-(>fH%&")1[M4 22$#)&(%!#'$/#- 3   U#||22T8,-T5<<01**! '% + 	
  	TrI   c                s0   VP                  R 4      '       dX   VR,          pVR8X  d   RpMRpRP                  V.V P                  P                  P	                  V4      ,          4      pRRRWE.# \        V4      '       d,   VR8X  d   \        \        R	4      hRR
RVP                  4       .# \        RV4      '       d   \        V4      pW.# \        RV4      '       d9   VP                  R4      p\        V^ ,          4      R,           V^,          ,           pW.# )zipset::i   NNr   dstsrcZ,r   rD   --match-setzCan't match a destination MAC.mac--mac-sourcer'   /)r   ri   rK   ipsetZget_dimensionr   r   r   Zupperr   r
   r	   split)rY   r~   Zaddressinvertr   flags
addr_split   &&&&   r=   r   Zip4tables._rule_addr_fragment)  s    h''2;Dd{HHcUTXX^^%A%A$%GGHE%<<wd{#L2RSS%AA#FG44&w/ >! vw//$]]3/
&z!}5;jmK>!rI   c                s   R RRR/V,          pR RRR/V,          pVR8X  d
   VR8X  d   R MRpV P                   P                  P                  W#\        VR7      pV P                   P                  P	                  V4      p	V P
                  V,          P                  \        VR	V,          R
V,          RV,          RV,          RV,          .4      4       . p
V
P                  WXRV.4       V
P                  VRV,          RV.4       V
P                  VR	V,          RV.4       V
P                  VR
V,          RV.4       V
P                  VRV,          RV.4       V
P                  VRV,          RV.4       V
P                  WhRVRRV,          .4       V
P                  WhRVRR	V,          .4       V
P                  WhRVRR
V,          .4       V
P                  WhRVRRV,          .4       V
P                  WhRVRRV,          .4       V	P                  '       g   VR8X  d   V P                   P                  P                  V,          P                  pV P                   P                  4       R8w  dR   VR9   d#   V
P                  VVRVRRRRRV,          .	4       M(VR8X  d"   V
P                  VVRVRRRRRV,          .	4       VR9   d   V
P                  WhRVRV.4       V'       g   V
P                  4        V
# )Tr0   Fr1   r*   r+   r$   r   r   z%s_log%s_denyz%s_prez%s_post%s_allowru   r   r%   r   r   r   r   z%s_REJECT: r   z	%s_DROP: )r   r   )r   r   r   r   )rK   r   r   r   r   rX   r   rD   rv   r   Z	_policiesr   r   Zreverse)rY   r   r   rr   rs   Zadd_del_chainZadd_del_ruler   r   r   r   r   s   &&&&&       r=   build_policy_chain_rulesZ"ip4tables.build_policy_chain_rules?  s   tUD1&9dE4085.Um-C%((//88.v 9 
 **62%%w&'w&'(		
 mdE:;mX%7uEFmX%7uEFmY%8$FGmZ'%94GHmY%8$FGlT5$7@RSTlT5$7@RSTlT5$	G@STUlT5$
W@TUVlT5$	G@STU&&&5H+<XX__..v6==Fxx&&(E155LL(# !) !*)G3
 v%LL(# !) !*''1
 CClT5$OPMMOrI   c                s    V'       g   . # R RRVP                   .pVP                  '       d   VR\        VP                  4      .,          pV# )r   limitz--limitz--limit-burst)ZvalueZburstry   )rY   r   Zsr   r=   _rule_limitZip4tables._rule_limit  sB    I7Iu{{3;;;/3u{{#344ArI   c                s   \        VP                  4      \        \        \        \
        39   d   M{VP                  '       dZ   \        VP                  4      \        \        \        \        39  d+   \        \        R \        VP                  4      ,          4      hM\        \        R4      hVP                  ^ 8X  d   \        VP                  4      \        \        \
        39   g%   \        VP                  4      \        \        39   d   R# \        VP                  4      \        39   g%   \        VP                  4      \        \        39   d   R# R# VP                  ^ 8  d   R# R# )Unknown action %szNo rule action specified.allowZdenyprepostN)typer   r   r   r   r   actionr   r   r   r   r   r   r   rY   	rich_rulerZ   r=   _rich_rule_chain_suffixZ!ip4tables._rich_rule_chain_suffix  s7   	!!"	'
 
 I$$%	.  $ "5Y=M=M8N"N   .IJJ"I%%& "+  i&&'K+CCi''(^,<<  Ay)A* A* !#rI   c                s    VP                   '       g#   VP                  '       g   \        \        R 4      hVP                  ^ 8X  d   R# VP                  ^ 8  d   R# R# )zNot log or auditr   r  r  )r   auditr   r   r   r  rZ   r=    _rich_rule_chain_suffix_from_logZ*ip4tables._rich_rule_chain_suffix_from_log  sF    }}}Y___.@AA"!#rI   c                sD    VP                   ^ 8X  d   . # RVP                   .# )r    r   )r   r  rZ   r=   _rich_rule_priority_fragmentZ&ip4tables._rich_rule_priority_fragment  s&    "I()*<*<==rI   c                s|   VP                   '       g   . # V P                  P                  P                  W\        4      pR RRR/V,          pV P                  V4      pRWGV: RV: 2.p	WP                  V4      ,          p	\        VP                   \        4      '       d   WRR.,           ,          p	VP                   P                  '       d)   V	R\        VP                   P                  4      .,          p	VP                   P                  '       d'   V	R	R
VP                   P                  ,          .,          p	VP                   P                  '       d)   V	R\        VP                   P                  4      .,          p	MWRR.,           ,          p	VP                   P                  '       d'   V	RR
VP                   P                  ,          .,          p	VP                   P                  '       d'   V	RR
VP                   P                  ,          .,          p	WP                  VP                   P                  4      ,          p	V	# )Tr*   Fr+   ru   r   r   ZNFLOGz--nflog-groupz--nflog-prefixrb   z--nflog-thresholdr   r   z--log-level)r   rK   r   r   r   r  r  r   r   Zgroupry   ZprefixZ	thresholdZlevelr  r   )
rY   r   r	  r   rr   rule_fragmentr   r   chain_suffixrm   s
   &&&&&&    r=   _rich_rule_logZip4tables._rich_rule_log  s   }}}I((//88.
 ud+F3<<YGe,&GH11)<<immZ00T7O33D}}"""#imm.A.A*BCC}}###)4)--2F2F+FGG}}&&&,c)--2I2I.JKKT5M11D}}###	0D0D)DEE}}"""y}}/B/B(BCC  !4!455rI   c                sZ   VP                   '       g   . # R RRR/V,          pV P                  P                  P                  W\        4      pV P                  V4      pRWFV: RV: 2.p	WP                  V4      ,          p	W,          p	\        VP                  \        4      '       d   Rp
MH\        VP                  \        4      '       d   Rp
M%\        VP                  \        4      '       d   Rp
MR	p
V	R
RRV
.,          p	WP                  VP                   P                  4      ,          p	V	# )Tr*   Fr+   ru   r   ZacceptZrejectZdropZunknownr   ZAUDITz--type)r  rK   r   r   r   r  r  r   r  r   r   r   r  r   )rY   r   r	  r   rr   r  r   r   r  rm   _type   &&&&&&     r=   _rich_rule_auditZip4tables._rich_rule_audit  s   Iud+F3((//88.
 <<YGe,&GH11)<<i&&44E	((+66E	(()44EEw%00  !6!677rI   c                s   VP                   '       g   . # R RRR/V,          pV P                  P                  P                  W\        4      pV P                  V4      pV: RV: 2p	\        VP                   \        4      '       d   RR.p
EM\        VP                   \        4      '       dA   RR.p
VP                   P                  '       d    V
RVP                   P                  .,          p
M\        VP                   \        4      '       d   RR	.p
M\        VP                   \        4      '       dQ   R
pV P                  P                  P                  W\        4      pV: RV: 2p	RRRVP                   P                  .p
M*\        \        R\        VP                   4      ,          4      hRWFV	.pWP                  V4      ,          pWV
,           ,          pWP!                  VP                   P"                  4      ,          pV# )Tr*   Fr+   r   r   r   r   r   r   r#   ZMARKz--set-xmarkr  ru   )r  rK   r   r   r   r
  r   r   r   r  r   r   rD   r   r   r  r  r   )rY   r   r	  r   rr   r  r   r   r  rs   Zrule_actionrm   s   &&&&&&      r=   _rich_rule_actionZip4tables._rich_rule_action  s   Iud+F3((//88.
 33I>"L1i&&44*K	((+66*K$$$1A1A1F1FGG	(()44.K	(()44Ehhoo<<2G  '5E	8H8H8L8LMK1D9I9I4JJ  ee,11)<<++  !1!1!7!788rI   c                s   V'       g   . # . pVP                   '       d   VP                  '       d   VP                  R 4       \        RVP                   4      '       d!   VR\	        VP                   4      .,          pV# \        RVP                   4      '       dN   VP                   P                  R4      pVR\	        V^ ,          4      R,           V^,          ,           .,          pV# VRVP                   .,          p V# VP                  '       du   VRR.,          pVP                  '       d   VP                  R 4       V P                  P                  P                  VP                  R4      pVRVP                  V.,          pV# )!r'   r   r   r   rD   r   r   )addrr   rv   r   r
   r	   r   r   rK   r   _ipset_match_flags)rY   Z	rich_destr  r   r      &&   r=   _rich_rule_destination_fragmentZ)ip4tables._rich_rule_destination_fragment*  sG   I>>>$$S)#FINN;;$Y^^(D!EE   vy~~66&^^11#6
 A/#5
1E"   $	!77  ___dE]*M$$S)HHMM44Y__eLEmY__eDDMrI   c                s   V'       g   . # . pVP                   '       d   VP                  '       d   VP                  R 4       \        RVP                   4      '       d!   VR\	        VP                   4      .,          pV# \        RVP                   4      '       dN   VP                   P                  R4      pVR\	        V^ ,          4      R,           V^,          ,           .,          pV# VRVP                   .,          p V# \        VR4      '       dX   VP                  '       dF   VRR.,          pVP                  '       d   VP                  R 4       VRVP                  .,          pV# \        VR4      '       d   VP                  '       du   VRR.,          pVP                  '       d   VP                  R 4       V P                  P                  P                  VP                  R	4      pVR
VP                  V.,          pV# )r  r'   r   r   r   r   r   r   rD   r   r   )r  r   rv   r   r
   r	   r   Zhasattrr   r   rK   r   r  )rY   Zrich_sourcer  r   r   r  r=   _rich_rule_source_fragmentZ$ip4tables._rich_rule_source_fragmentE  s   I!!!$$S)#FK,<,<==$[5E5E(F!GG* ) v{'7'788(--33C8
 A/#5
1E" $  $(8(8!99  [%(([___dE]*M!!!$$S)nkoo>>M  ['**{/@/@/@dE]*M!!!$$S)HHMM44[5F5FNEm[->->FFMrI   c           	        R RRR/V,          pRpV P                   P                  P                  W(\        4      p	RV.p
V'       d   V
RR\	        V4      ,          .,          p
V'       d   V
RV.,          p
V'       dC   WP                  VP                  4      ,          p
WP                  VP                  4      ,          p
. pV'       di   VP                  V P                  W&WV
4      4       VP                  V P                  W&WV
4      4       VP                  V P                  W&WV
4      4       V# VP                  VR	V	,          R
V.V
,           RR.,           4       V# )Tr*   Fr+   r%   -p--dportrb   r   r   ru   r   r   rK   r   r   r   r   r  destinationr  sourcerv   r  r  r  rY   r   r   protoportr  r	  r   rr   r   r  r      &&&&&&&     r=   build_policy_ports_rulesZ"ip4tables.build_policy_ports_rulese  O    ud+F3((//88.
 ui)=>>MdK00MAA)BWBWXXM<<Y=M=MNNMLL##FvmT LL%%fV LL&&v&W  LL*0$> "# rI   c           	     sv   R RRR/V,          pRpV P                   P                  P                  W'\        4      pRV.p	V'       d   V	RV.,          p	V'       dC   WP	                  VP
                  4      ,          p	WP                  VP                  4      ,          p	. p
V'       di   V
P                  V P                  W%WV	4      4       V
P                  V P                  W%WV	4      4       V
P                  V P                  W%WV	4      4       V
# V
P                  VRV,          RV.V	,           R	R
.,           4       V
# )Tr*   Fr+   r%   r  r   r   ru   r   r   )rK   r   r   r   r  r  r  r   rv   r  r  r  )rY   r   r   protocolr  r	  r   rr   r   r  r   r  r=   build_policy_protocol_rulesZ%ip4tables.build_policy_protocol_rules  s5    ud+F3((//88.
 x(dK00MAA)BWBWXXM<<Y=M=MNNMLL##FvmT LL%%fV LL&&v&W  LL*0$> "# rI   c                s   R pRpV P                   P                  P                  W'\        4      pRRRR/V,          p	. ROp
V'       dk   V P	                  V4      pWP                  V4      ,          p
WP                  VP                  4      ,          p
WP                  VP                  4      ,          p
VR8X  g	   V'       g   V
. RO,          p
MV
RRR	V.,          p
R
RW: RV: 2.V
,           .# )r  r%   Tr*   Fr+   Zpmtur   TCPMSSz	--set-mssru   r   )r  Ztcpz--tcp-flagszSYN,RSTZSYN)r   r)  z--clamp-mss-to-pmtu)
rK   r   r   r   r
  r  r  r  r  r   )rY   r   r   Ztcp_mss_clamp_valuer  r	  r  rr   r   r   r  r  r=    build_policy_tcp_mss_clamp_rulesZ*ip4tables.build_policy_tcp_mss_clamp_rules  s     ((//88.
 ud+F3F77	BL>>yIIMAA)BWBWXXM<<Y=M=MNNM&(0CDDMdHk;NOOM 8W,&GH=X
 	
rI   c           	     r  )Tr*   Fr+   r%   r  z--sportrb   r   r   ru   r   r   r  r!  r$  r=   build_policy_source_ports_rulesZ)ip4tables.build_policy_source_ports_rules  r&  rI   c                s   R pV P                   P                  P                  W(\        4      p	RRRR/V,          p
V
RV	,          RR RV.pV'       d   VRR	\	        V4      ,          .,          pV'       d   VR
V.,          pVRRRV.,          pV.# )r!   Tr*   Fr+   r   ru   r  r  rb   r   r   ZCTz--helper)rK   r   r   r   r   )rY   r   r   r"  r#  r  Zhelper_nameZmodule_short_namerr   r   r   rm   s   &&&&&&&&    r=   build_policy_helper_ports_rulesZ)ip4tables.build_policy_helper_ports_rules  s     ((//88.
 ud+F3w/udEJYwt} 455DT;''DtZ):;;vrI   c           
     sj   R RRR/V,          pV P                   P                  P                  W4\        4      p. p	V'       d#   V	P	                  RRVRV,          RVRR	.4       V	# \        V4      '       d   . # V	P	                  RRVRV,          .V P                  R
V4      ,           RR	.,           4       V	# )Tr*   Fr+   ru   r%   r   r   r   r   r   )rK   r   r   r   rv   r   r   )
rY   r   r   r   rr   Z	interfacer   r   r   r   s
   &&&&&&&   r=   build_zone_forward_rulesZ"ip4tables.build_zone_forward_rules  s     ud+F3((//88.
 LL(	,    	LLx*w*>?**489"#
 rI   c                s   R pV P                   P                  P                  W$\        RR7      pRRRR/V,          p. pV'       dl   V P	                  V4      pWpP                  V4      ,          pWpP                  VP                  4      ,          pWpP                  VP                  4      ,          pMRp. p	V	P                  RR We: RV: 2.V,           . R	O,           4       V	# )
r$   Tr   r*   Fr+   r  ru   r   )r  r   Zlor   Z
MASQUERADE)rK   r   r   r   r
  r  r  r  r  r   rv   )
rY   r   r   r	  rr   r   r   r  r  r   s
   &&&&      r=   build_policy_masquerade_rulesZ'ip4tables.build_policy_masquerade_rules#  s    ((//88.t 9 
 ud+F377	BL>>yIIMAA)BWBWXXM<<Y=M=MNNM"L5'g|#DE34	
 rI   c                sN   R pV P                   P                  P                  W(\        4      p	V P                   P                  P	                  V4      p
RRRR/V,          pRpV'       d5   \        RV4      '       d   VR\        V4      ,          ,          pMW,          pV'       d"   VR8w  d   VR\        VR	4      ,          ,          p. p. pR
VR\        V4      .pV'       d   V P                  V4      pV P                  V4      pWP                  VP                  4      ,          pWP                  VP                  4      ,          pVP                  V P                  W'VR W,           4      4       MRpVP                  RR W: RV: 2.V,           V,           RRRV.,           4       V P                   P                   '       de   RV
P"                  9   d   RpMV'       d   RpMRpTP                  RRV'       d   RMRV R2.RRRRRRR\        V4      .,           RR.,           4       V# ) r$   Tr*   Fr+   r   r'   z[%s]z:%sZ-r  r  r  ru   r   r   ZDNATz--to-destinationr   r    r   r   r%   r.   r   r   Z	conntrackz	--ctstatez--ctdirZORIGINALz--ctorigdstportr   )rK   r   r   r   r   r   r
   r   r
  r  r  r  r  r   rv   r  r   Zingress_zones)rY   r   r   r#  r'  ZtoportZtoaddrr	  rr   r   r   r   Ztor   r  Zport_fragmentr  rs   s   &&&&&&&&          r=   build_policy_forward_port_rulesZ)ip4tables.build_policy_forward_port_rules=  s    ((//88.
 **62ud+F3#FF33f|F333fl%'&#...BxGDMB77	BL ==iHMAA)BWBWXXM<<Y=M=MNNMLL##vum6S #L5'g|#DE V/45	
 88))),,, !LLxTeWE?K%DM	
 "# rI   c                s   V P                   R 8X  dW   V\        9   dL   \        V,          w  r#pV'       d   \        V4      M!\        V4      R,           \        V4      ,           pRRRV.# V P                   R8X  dW   V\        9   dL   \        V,          w  r#pV'       d   \        V4      M!\        V4      R,           \        V4      ,           pRRRV.# \	        \
        RV R	V P                   24      h)
r&   r   r   r(   z--icmp-typer'   Zicmp6z--icmpv6-typez
ICMP type z not supported by )rL   r   ry   r   r   r   r   )rY   Z	icmp_typer  Z_codeZ
_omit_codeZ	_type_strrl   r=   _icmp_types_fragmentZip4tables._icmp_types_fragment  s    88v)z"9'1)'<$E*&0E
c%j36FU6SI&-;;XXI$='3I'>$E*&0E
c%j36FU6SI'?I>> Jyk9KDII;"W rI   c           	     s   R pV P                   P                  P                  W&\        4      pRRRR/V,          pV P                  R8X  d!   RR.p	V P                  VP                  4      p
MRR.p	V P                  VP                  4      p
. pV P                   P                  P                  V4      '       d   R	V,          pR
pMRV,          pRp. pV'       dC   WP                  VP                  4      ,          pWP                  VP                  4      ,          pWV
,           ,          pV'       d   VP                  V P                  W$WV4      4       VP                  V P                  W$WV4      4       VP                  '       d%   VP                  V P!                  W$WV4      4       V# V P#                  V4      pVP                  RWhV: RV: 2.V P%                  V4      ,           V,           RR.,           4        V# V P                   P'                  4       R8w  d6   VR
8w  d/   VP                  WRV.V,           RRRRRV,          .,           4       VP                  WRV.V,           RV.,           4       V# )r%   Tr*   Fr+   r&   r  r(   r)   r   r   r   r   ru   r   r   r   r   r   r   %s_ICMP_BLOCK: )rK   r   r   r   rL   r0  r   query_icmp_block_inversionr  r  r  r   rv   r  r  r  r  r
  r  r   )rY   r   r   Zictr	  Zipvsrr   r   r   r"  Zmatchr   Zfinal_chainZfinal_targetr  r  s   &&&&&&          r=   build_policy_icmp_block_rulesZ'ip4tables.build_policy_icmp_block_rules  sl    ((//88.
 ud+F388v6NE--chh7E;'E--chh7E88??55f==$0K#L#w/K'LAA)BWBWXXM<<Y=M=MNNM&LL##FvmT LL%%fV **6-@ 5  $;;IF5g|+LM77	BC#$ \*+2 % xx&&(E1lh6N47#$ &&)F2
 LLtU3 &' rI   c                s   R pV P                   P                  P                  W#\        4      p. p^pV P                   P                  P	                  V4      '       dq   RpV P                   P                  4       R8w  dO   V'       d   RV\        V4      .pMRV.pVRVRRRR	R
RRV,          .	,           pVP                  V4       V^,          pMRpV'       d   RV\        V4      .pMRV.pVRVRRR	V.,           pVP                  V4       V# )r%   r   r   r.   r+   ru   r  r   r   r   r   r   r1  r   )rK   r   r   r   r2  r   ry   rv   )	rY   r   r   rr   r   r   Zrule_idxZ
ibi_targetrm   r   r=   'build_policy_icmp_block_inversion_rulesZ1ip4tables.build_policy_icmp_block_inversion_rules  s   ((//88.
 88??55f==%Jxx&&(E1 '3x=9D '?D!"%/
 
 T"A!J'3x=1D'?DtUD*dJGGTrI   c           	     sb   R p. pWPP                  VP                  4      ,          pWPP                  VP                  4      ,          p. pVP	                  V P                  W#WV4      4       VP	                  V P                  W#WV4      4       VP	                  V P                  W#WV4      4       V# )r%   )r  r  r  r   rv   r  r  r  )rY   r   r   r	  rr   r  r   r   r=   *build_policy_rich_source_destination_rulesZ4ip4tables.build_policy_rich_source_destination_rules  s    ==i>S>STT889I9IJJ6-P	
 	!!&VMR	
 	""6f]S	
 rI   c                s    WP                   8H  # r\   )rL   )rY   rL   rZ   r=   is_ipv_supportedZip4tables.is_ipv_supported  s    hhrI   )rM   rK   rN   rT   r^   rX   rV   rW   r_   rR   rU   rP   r\   )r   )FFFFF)NN);__name__
__module____qualname____firstlineno__rL   r   Zpolicies_supportedr[   rS   r   rp   rt   rx   rz   r|   r}   r   r   r   r   r   r   rO   rQ   r   r   r   r   r   r   r   r   r   r   r   r  r
  r  r  r  r  r  r  r  r%  r(  r*  r+  r,  r-  r.  r/  r0  r3  r4  r5  r6  __static_attributes____classdictcell__Z__classdict__   @r=   rJ   rJ      s5    
CDLL'0(R@hRhq
f-^&!F!F&E#NMR^ob",JX$L	>
>6%N6@$L"H
4$L$ D4AFFP)V( rI   rJ   c                   s8   a  ] tR tRt o RtR tRR ltR tRtV t	R# )	ip6tablesi  r'   c                sB   . p. ROpV P                   P                  R8X  d   VR.,          pVP                  . ROV,           RR.,           4       VR8w  d$   VP                  . ROV,           . RO,           4       VP                  . R	O4       VP                  . R
O4       V# )r   Zloosez--looser   r   r   )r   Zrpfilterz--invertz--validmark)r.   r"   ru   r#   )r   r   r   zrpfilter_DROP: )	r.   r"   ru   r#   r  r)   z$--icmpv6-type=neighbour-solicitationr   r   )	r.   r"   ru   r#   r  r)   z"--icmpv6-type=router-advertisementr   r   )rK   Z_ipv6_rpfilterrv   )rY   r   r   Zrpfilter_fragmentr   r=   build_rpfilter_rulesZip6tables.build_rpfilter_rules  s    I88""g-),    
	
 LL $$ 	
	
 	
	
 rI   c                sp   . ROpRpV P                   R,          P                  V4       . pVP                  RRRV.4       V FV  pVP                  RRRVRVRRR	R
.
4       V P                  P                  R9   g   K;  VP                  RRRVRVRRRR.
4       KX  	  ^pV P                  P
                  '       d
   V^,          pVP                  RRRR\        V4      RV.4       V^,          pV P                  P                  4       R8w  d
   V^,          pVP                  RRRR\        V4      RV.4       V# )::0.0.0.0/96ZRFC3964_IPv4r%   ru   r0   r.   r   r   r   r   zaddr-unreachr   r   zRFC3964_IPv4_REJECT: r    r   r   )	rB  z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19)r   Zall)rX   rw   rv   rK   Z_log_deniedr   ry   r   )rY   Z
daddr_listZ
chain_namer   Zdaddrr7   s   &     r=   build_rfc3964_ipv4_rulesZ"ip6tables.build_rfc3964_ipv4_rules\  sV   


 $
!%%j1dHdJ78ELL#" xx##'99 "&/!  @ 88)))QJEdHdHc%j$
ST
88""$-QJEE

	
 rI   r   Nr7  )
r8  r9  r:  r;  rL   r   rA  rC  r<  r=  r>  r?  r=   r@  r@    s!     
CD=~E ErI   r@  )r   r    r   )r"   r   r   r    r   )r"   r   r    )1Zos.pathr]   r   Zfirewall.core.progr   Zfirewall.core.loggerr   Zfirewall.functionsr   r   r   r   r   r   r	   r
   Zfirewallr   Zfirewall.errorsr   r   r   r   r   r   Zfirewall.core.richr   r   r   r   r   r   r   r   r   Zfirewall.core.baser   Zfirewall.core.icmpr   r   r   r   rq   r   r   r>   rH   rJ   r@  r   rI   r=   <module>rD     s      & $	 	 	  
 
 
 3 7   .	L(#I	2, "
"  F
K%JT)NX| |~3H	 HrI   