+
    iٜ c                   s   ^ RI Ht ^ RIt^ RIt^ RIt^ RIHt ^ RIHtH	t	H
t
HtHt ^ RIHtHtHtHtHtHtHt ^ RIHtHtHtHtHtHtHtHtHt ^ RIH t  ^ RI!H"t"H#t# ^ R	I$H%t% R
t&]&R,           R,           t']&R,           R,           t(Rt)^
t*R/ RRRR]*,           3/RRRR ]*,           3RR^d]*,           3RRR ]*,           3/RRR^ ]*,           3RR^ ]*,           3RR^ ]*,           3RR^ ]*,           3//t+ ! R R4      t,R# )!    )GLibN)log)	check_macgetPortRangenormalizeIP6check_single_addresscheck_address)FirewallErrorUNKNOWN_ERRORINVALID_RULEINVALID_ICMPTYPEINVALID_TYPEINVALID_ENTRYINVALID_PORT)	Rich_AcceptRich_Reject	Rich_Drop	Rich_MarkRich_MasqueradeRich_ForwardPortRich_IcmpBlockRich_Tcp_Mss_Clamp
Rich_NFLog)DEFAULT_ZONE_TARGET)
ICMP_TYPESICMPV6_TYPES)NftablesZ	firewalld_Zpolicy_dropZprobeZpolicy_rawmangle
PREROUTING
preroutingnatPOSTROUTINGpostroutingOUTPUToutputfilterINPUTZinputFORWARDZforwardc                   s  a  ] tR t^^t o R tRtR tR tR tR t	R t
R tR tR	 tRIR ltR tR tR tR tR tRIR ltR tR tRJR ltR tRKR ltRLR ltR tR tR tR tR tR t R t!R t"R  t#R! t$R" t%R# t&RLR$ lt'R% t(R& t)R' t*R( t+RMR) lt,RMR* lt-RMR+ lt.RMR, lt/R- t0RMR. lt1RIR/ lt2RIR0 lt3RIR1 lt4R2 t5R
R3R4.3R5 lt6R6 t7RLR7 lt8R8 t9R9 t:R: t;R; t<RIR< lt=RIR= lt>R> t?RLR? lt@R@ tARA tBRB tCRC tDRD tERE tFRF tGRMRG ltHRHtIV tJR
# )NnftablesTc                s    Wn         R V n        RV n        . V n        / V n        / V n        / V n        / V n        \        4       V n	        V P                  P                  R 4       V P                  P                  R 4       R# )TFN)_fwrestore_command_existssupports_table_owneravailable_tablesrule_to_handlerule_ref_countrich_rule_priority_countspolicy_dispatch_index_cacher   r)   set_echo_outputZset_handle_output)selfZfw   &&;/usr/lib/python3.14/site-packages/firewall/core/nftables.py__init__Znftables.__init__b   sl    &*#$)! "  )+&+-( 
%%d+''-    c                s    R RR^//RRRRR\         RR	R
.///./pV P                  P                  V4      w  r#pV'       d   \        R4      hR RR^//RRRRR\         ///./pV P                  P	                  R4       V P                  P                  V4      w  r#pV P                  P	                  R4       VR ,          ^,          R,          R,          pR	V9  g   R
V9  d   \        R4      h\
        P                  ! R4       RV n         T P                  RRRRR\         ///T P                  P                  4       4       R#    \
        P                  ! R4       RT n         LZ; i    R# ; i)r)   metainfojson_schema_versionaddtablefamilyinetnameflagsownerpersistz!nftables probe table owner failedlistFTz3nftables: probe_support(): owner flag is supported.z7nftables: probe_support(): owner flag is NOT supported.deleteN)TABLE_NAME_PROBEr)   json_cmd
ValueErrorr2   r   debug2r,   set_ruler*   get_log_denied)r3   rulesrcr%   r   r?      &     r5   _probe_support_table_ownerZ#nftables._probe_support_table_ownerp   s   (	."7!;<# (& &(8 ''9)=& E !MM2259MB !DEE
 "7!;<g&&BR'STUE MM))%0 MM2259MBMM))$/:&q)'27;Ee#y'= !DEEJJLM(,D%
	MMGh@P%QRS'')	.JJPQ(-D%	s   D	E 6E( E%(E-c                s&    V P                  4        R # N)rM   r3      &r5   probe_supportZnftables.probe_support   s    '')r7   c                st   R	 F  pW19   g   K   M	   VX,          R,          P                  R4      pY,          R,          R,          Y,          R,          R,          3pTR8X  d1   YR9   d)   YBT,          9   d   Y%,          P                  T4       R# R# R# YR9  d   . Y%&   YBT,          9  d.   Y%,          P                  T4       Y%,          P	                  4        Y%,          P                  T4      pY,          pY T^ 8X  d   YqR&   R# T^,          pYqR &   YaR ,          R,          R&   R#   \         d     R# i ; i)
r:   insertrC   rule%%POLICY_SORT_KEY%%Nr<   chainindexr:   rR   rC   )ZpopZKeyErrorZremoveappendZsortrV   )r3   rS   r1   verbZ
sort_tuplerU   rV   _verb_snippet   &&&     r5   _set_rule_sort_policy_dispatchZ'nftables._set_rule_sort_policy_dispatch   s-   /D| 0	dF+//0EFJ F#H-tz&/A'/JK84e"DD+299*E E 5
 757+2 U!CC+299*E+2779/6<<ZHE JM
z!.X
+U/4UF#G,C  		s   D( (D76D7c                s   R
 F  pWA9   g   K   M	  W1X,          R,          9   Ed   W,          R,          V,          pW,          R,          V \        V\        4      '       g   \        \        R4      hW,          R,          R,          W,          R,          R,          3pVR8X  dU   Wb9  g"   WRV,          9  g   W&,          V,          ^ 8:  d   \        \        R4      hW&,          V;;,          ^,          uu&   R	# Wb9  d   / W&&   WRV,          9  d   ^ W&,          V&   ^ p\        W&,          P                  4       4       F9  pW8X  d
   VR8X  d    M+WrV,          V,          ,          pW8X  g   K0  VR 8X  g   K9   M	  W&,          V;;,          ^,          uu&   W,          p	W V^ 8X  d   WR&   R	# V^,          pWR &   WqR ,          R,          R&   R	# R	# )r:   rR   rC   rS   z%priority must be followed by a numberr<   rU   z*nonexistent or underflow of priority countrV   NrW   )
isinstanceintr   r
   r	   Zsortedkeys)
r3   rS   Zpriority_countsZtokenrY   priorityrU   rV   ZprZ   s
   &&&&      r5   _set_rule_replace_priorityZ#nftables._set_rule_replace_priority   s   /D| 0 Jv&&z&)%0H
6"5)h,,# "I  
6"8,
6"7+E x0u'==&-h71<'%'S   &x0A50/-/O*5#9978O*84  6 ; ; =>A})9U3A66E} ?  &x0A50 $
JA:%2NQJE"/K38K'0a 'r7   c                s    R FA  pW!9   g   K  RW,          9   g   K  \         P                  ! W,          R,          RR7      pVu # 	  R# )r:   rS   T)Z	sort_keysNrW   )jsondumps)r3   rS   rY   rule_key   &&  r5   _get_rule_keyZnftables._get_rule_key  s=    /D|$* 4  ::dj&8DI 0 r7   c                s	   . ROp. ROp. p. p. p\         P                  ! V P                  4      p\         P                  ! V P                  4      p	V P                  P                  4       p
V EF  p\        V\        4      '       g   \        \        RV,          4      hV F  pW9   g   K   M	  XV9  d   \        \        RV,          4      hV P                  V4      pW9   d   \        P                  ! RV P                  W,          VV4       VR8w  d   W;;,          ^,          uu&   K  W,          ^8  d   W;;,          ^,          uu&   K  W,          ^8X  d   W;;,          ^,          uu&   My\        \        RWV,          3,          4      hV'       d7   VR8w  d0   ^W&   \        P                  ! RV P                  W,          VV4       MV'       d   \        \        RV R24      hVP                  V4       VP                  V4       V'       Ed   \        \!        R	W,          R
,          R,          4      4      W,          R
,          R&   V P"                  P$                  '       d)   W,          R
,          R,          P'                  RRR	/4       V P)                  WR4       V P+                  W4       VR8X  d_   RR
RVR,          R
,          R,          RVR,          R
,          R,          RVR,          R
,          R,          RV P,                  V,          ///pVP                  V4       EK  	  RRR^//.V,           /p\        P.                  ! 4       ^8  d7   \        P0                  ! RV P                  \2        P4                  ! V4      4       V P6                  P9                  V4      w  pppV^ 8w  d,   \;        RR: RV: R\2        P4                  ! V4      : 24      hWn        Wn        Wn        ^ pV F  pVV,          pV^,          pV'       g   K  RV9   d5   V P                  V,          ^ 8:  d   V P,                  V V P                  V KZ  V F  pVVR,          V,          9   g   K   M	  K|  \<        VR,          V,          V,          R
,          R,          8X  d   K  VR,          V,          V,          R
,          R,          V P,                  V&   K  	  R	# )r:   rC   z#rule must be a dictionary, rule: %szno valid verb found, rule: %sz$%s: prev rule ref cnt %d, verb %s %sz)rule ref count bug: rule_key '%s', cnt %dz#%s: new rule ref cnt %d, verb %s %sz1rule ref count bug, missing ref count: rule_key 'Z'NrS   exprZcounter%%RICH_RULE_PRIORITY%%r<   r;   rU   Zhandler)   r8   r9   z.%s: calling python-nftables with JSON blob: %szpython-nftablesz
' failed: z
JSON blob:
)r:   rR   rC   flushreplace)r:   rR   rj   i)copyZdeepcopyr0   r1   r/   r]   Zdictr   r	   r
   rf   r   rG   Z	__class__rX   rB   r&   r*   Z_nftables_countersrR   ra   r\   r.   ZgetDebugLogLevelZdebug3rb   rc   r)   rE   rF   TABLE_NAME_POLICY)r3   rJ   
log_deniedZ_valid_verbsZ_valid_add_verbsZ_deduplicated_rulesZ_deduplicated_rules_keysZ_executed_rulesr0   r1   r/   rS   rY   rd   Z	json_blobrK   r%   errorrV   s   &&&                r5   	set_rulesZnftables.set_rules  su   F7 #% $(MM$2P2P$Q!&*mmD4T4T&U#,,113DdD))#!#HD#Q  %< % 4# "AT"J  ))$/H )

:NN", 8#",1,#-1",1,#-2",1,'%C#H%=>? 
 dh.+,(

9NN", #!GzQRS 
  &&t,$++H5x .24F!3F!;<.
6"6* 88...Jv&v.55b9d:KL//5M 33DV 8# " ($x.*@*J 'h)?)H 'h)?)H ($*=*=h*G	%#	D ""4(o t *'<a&@AB_T
	 !Q&JJ@

9%
 !MM229=FE7$eTZZ	-BD 
 *C&+F(,'D/6HQJE4D$7$7$AQ$F''1''1(6*-e44 )  !F:$6u$=d$CF$KG$TT,2:,>u,Ed,KF,S-D)/ (r7   c                s,    V P                  V.V4       R # ) )ro   )r3   rS   rm   s   &&&r5   rH   Znftables.set_rule  s    vz*r7   Nc                s@    V'       d   V.# \         P                  4       # rN   )IPTABLES_TO_NFT_HOOKr_   r3   r;   r4   r5   get_available_tablesZnftables.get_available_tables  s    w@%9%>%>%@@r7   c                s    R RRRRV///pV\         8X  dD   V P                  P                  '       d(   V P                  '       d   RR.VR ,          R,          R&   V.# )r:   r;   r<   r=   r>   r@   rA   r?   )
TABLE_NAMEr*   Z_nftables_table_ownerr,   )r3   r;   rS      && r5   _build_add_table_rulesZnftables._build_add_table_rules  s_    (FFE!BCD Z...)))-4i,@DK )vr7   c                sD    V P                  V4      R RRRRV///.,           # )rC   r;   r<   r=   r>   )rv   rr   r4   r5   _build_delete_table_rulesZ"nftables._build_delete_table_rules  s7     **51(FFE!BCD5
 
 	
r7   c                sd    / V n         / V n        / V n        / V n        V P	                  \
        4      # rN   )r.   r/   r0   r1   rw   rt   rO   rP   r5   build_flush_rulesZnftables.build_flush_rules  s3      )+&+-(--j99r7   c                sv    R RRR/V,          pVRRRR\         RR	: R
V: 2RRRRRR//RRRRRR.///RR/.///# )Tr:   FrC   rS   r<   r=   r;   rU   r&   r   rg   matchleftctkeystateopinrightsetestablishedrelatedacceptN)rl   )r3   enablehookadd_del   &&& r5   _build_set_policy_rules_ct_ruleZ(nftables._build_set_policy_rules_ct_rule  s    x08f.$7# &w/?(@ $d '%-1K)L& "4(		
 	
r7   c                s8   . pVR 8X  dp   VP                  V P                  \        4      4       R FC  pVP                  RRRRR\        RR: RV: 2R	R
RVRR\        ,           ^,
          RR///4       KE  	  V# VR8X  d   VP                  V P                  \        4      4       R F  pW$,          pVP                  4       pRV 2pVP                  RRRRR\        RVR	R
RVR^ \        ,           ^,
          RR///4       VP                  V P                  RV4      4       VR8X  d   RR/pMVR8X  d   RR/pMRR	RRR//pVP                  RRRRR\        RVRV.///4       K  	  V# VR8X  d   W0P                  \        4      ,          pV# \        \        R4      h)ZPANICr:   rU   r<   r=   r;   r>   r   r   typer&   r   priopolicydropDROPfilter_TACCEPTr   Nrejecticmpxrg   admin-prohibitedrS   znot implemented)r    r%   i)r'   r(   r$   )
extendrv   rl   rX   NFT_HOOK_OFFSETlowerr   rw   r   r	   )r3   r   Zpolicy_detailsrJ   r   Zd_policyZ
chain_nameZexpr_fragmentr[   r5   build_set_policy_rulesZnftables.build_set_policy_rules  s    WLL445FGH 1# (& '): &5$(? & & &(>(B (&&
  1N o vLL445FGH 7)/zz|&tf-
# (& '): &
 & & &O(;a(? (&&
   TAA$MNx'%-t$4M'%+TNM !67F<N"O%M " (& '): ' &	% 	C 7d  x334EFFE   /@AAr7   c                s    \        4       pVe   VR8X  d%   VP                  \        P                  ! 4       4       Ve   VR8X  d%   VP                  \        P                  ! 4       4       \        V4      # )Nipv4ipv6)r   updater   r_   r   rB   )r3   ipvZ	supportedru   r5   supported_icmp_typesZnftables.supported_icmp_types3  sU    E	;#-Z__./;#-\..01Ir7   c                s,    V P                  \        4      # rN   )rv   rt   rO   rP   r5   build_default_tablesZnftables.build_default_tables=  s    **:66r7   c                s   . pV P                   P                  '       d   VP                  R RRRR\        RRV R2///4       VP                  R RRRR\        RRV R2R	R
RRR	R//.///4       VP                  R RRRR\        RRV 2R	RRRRR//RRRR//RRRV R2//.///4       V# VP                  R RRRR\        RRV 2R	RRRRR//RRRR//RR/.///4       V# )r:   rU   r<   r=   r;   r>   r   _dnatrS   rg   r   r   r   r   ry   rz   r{   r|   Zstatusr~   r   r   dnatjumptargetr   N)r*   _strict_forward_portsrX   rt   )r3   rU   Z
dnat_rulesru   r5   _build_default_rules_dnatZ"nftables._build_default_rules_dnat@  s   
88))) $f#Z"geWE$:"
 $f#Z#wugU%;"$,(.(.0B/&!"%	!& $f#Z#wug%6"$+(.x7H0I(,d(/.&!" "((geWE4J)K L	%	!\ - $f#Z#wug%6"$+(.x7H0I(,d(/.&!" "*4 0	%	!, r7   c                s(   . p\         R ,          P                  4        F  pVP                  RRRRR\        RRV,          RR	R
R\         R ,          V,          ^ ,          ,          R\         R ,          V,          ^,          ///4       VP                  RRRRR\        RRV,          ///4       VP                  RRRRR\        RRV,          RRRRV,          //.///4       K  	  \         R,          P                  4        F  pVP                  RRRRR\        RRV,          RRR
R\         R,          V,          ^ ,          ,          R\         R,          V,          ^,          ///4       VP                  RRRRR\        RRV,          ///4       VP                  RRRRR\        RRV,          RRRRV,          //.///4       K  	  \         R	,          P                  4        Fh  pVP                  RRRRR\        RRV,          RR	R
R\         R	,          V,          ^ ,          ,          R\         R	,          V,          ^,          ///4       Kj  	  VP                  RRRRR\        RRR,          RRRRRR//RRRRR R!.///R"R#/.///4       VP	                  V P                  R4      4       VP                  RRRRR\        RRR,          RRRR$RR%//RR&RR'//R"R#/.///4       VR(8w  dN   VP                  RRRRR\        RRR,          RRRRRR//RRRRR).///V P                  V4      R*R+R,//.///4       VP                  RRRRR\        RRR,          RRRRRR//RRRRR).///R-R#/.///4       VP                  RRRRR\        RR.///4       VP                  RRRRR\        RRR,          RRRR.//.///4       VR(8w  d>   VP                  RRRRR\        RRR,          RV P                  V4      R*R+R///.///4       VP                  RRRRR\        RRR,          RR0RR1RR2//.///4       V P                  P                  R(8w  d   VP                  RR3RRR\        RR4R
R5R\        R6V P                  P                  P                  4       ///4       VP                  RRRRR\        RRR7,          RRRRRR//RRRRR R!.///RRR$RR8//RR&RRR9R:.///R;RRR3R<//.///4       VP                  RRRRR\        RRR7,          RRRRRR//RRRRR R!.///R"R#/.///4       VP	                  V P                  R74      4       VP                  RRRRR\        RRR7,          RRRR$RR%//RR&RR'//R"R#/.///4       VR(8w  dN   VP                  RRRRR\        RRR7,          RRRRRR//RRRRR).///V P                  V4      R*R+R,//.///4       VP                  RRRRR\        RRR7,          RRRRRR//RRRRR).///R-R#/.///4       VP                  RRRRR\        RR=///4       VP                  RRRRR\        RR>RRRR=//.///4       VR(8w  d>   VP                  RRRRR\        RRR7,          RV P                  V4      R*R+R///.///4       VP                  RRRRR\        RRR7,          RR0RR1RR2//.///4       VP                  RRRRR\        RRR?,          RRRRRR//RRRRR R!.///R"R#/.///4       VP	                  V P                  R?4      4       VP                  RRRRR\        RR@RRRR$RRA//RR&RR'//R"R#/.///4       VP                  RRRRR\        RRB///4       VP                  RRRRR\        RR@RRRRB//.///4       V# )Cr   r:   rU   r<   r=   r;   r>   z	mangle_%sr   r&   r   %sr   zmangle_%s_POLICIESrS   rg   r   r   r!   znat_%sznat_%s_POLICIESz	filter_%sr'   ry   rz   r{   r|   r}   r~   r   r   r   r   r   r   Nmetaiifname==looffZinvalidr   prefixzSTATE_INVALID_DROP: r   Zfilter_INPUT_POLICIESzFINAL_REJECT: r   r   r   Z	flowtableZfastpathingressZdevr(   l4prototcpZudpZflowz	@fastpathZfilter_FORWARD_POLICIESfilter_FORWARDr$   filter_OUTPUToifnameZfilter_OUTPUT_POLICIES)rq   r_   rX   rt   r   r   _pkttype_match_fragmentr*   _nftables_flowtabler   split)r3   rm   Zdefault_rulesrU   re   r5   build_default_rulesZnftables.build_default_rules  s   )(388:E  $f#Z"K%$7"H"D+?+I%+PQR+S$S"$8$B5$I!$L"	   $f#Z"$8E$B"
   $f#Z#[5%8"!'(4HE4R)S T%	!	5 ;R *%0557E  $f#Z"Hu$4"E"D+?+Fu+Ma+P$P"$8$?$Fq$I"	   $f#Z"$5$?"
   $f#Z#X%5"fx9Je9T.U%V$W	!	7 8P *(388:E  $f#Z"K%$7"H"D+?+I%+PQR+S$S"$8$B5$I!$L"	 ;" 	 &w!6 '$*TE73C,D$($$+emY5O-P*" &t,	!		
, 	T;;GDE &w!6 '$*VeY5G,H$($$+T*" &t,	!		
*   $f#Z#[7%:"$+(.w7G0H(,d(/%)1E.&!" !% < <Z H!&3I(J K
%	!, 	 &w!6 '$*TE73C,D$($$+ei[-A*" $TN	!		
* 	 & 7
	
 	 &w!6&85L*M!N O			
   $f#Z#[7%:" $ < <Z H!&3C(D E%	!
 	 &w!6%AS'TU!			
  88''50  #$f#Z"J"I"O!488#?#?#E#E#G&	   $f#Z#[9%<"$+(.w7G0H(,d(/%-9S1T.&!" %,(.%9K0L(,d(/%%1H.&!" "(${K)P Q%	!8 	 &y!8 '$*TE73C,D$($$+emY5O-P*" &t,	!		
, 	T;;IFG &y!8 '$*VeY5G,H$($$+T*" &t,	!		
*   $f#Z#[9%<"$+(.w7G0H(,d(/%)1E.&!" !% < <Z H!&3I(J K
%	!, 	 &y!8 '$*TE73C,D$($$+ei[-A*" $TN	!		
* 	 & 9
	
 	 &!1&85N*O!P Q			
   $f#Z#[9%<" $ < <Z H!&3C(D E%	!
 	 &y!8%AS'TU!			
  	 &x!7 '$*TE73C,D$($$+emY5O-P*" &t,	!		
, 	T;;HEF & '$*VeY5G,H$($$+T*" &t,	!		
* 	 & 8
	
 	 &&85M*N!O P			
 r7   c                sF    VR 8X  d   RR.# VR8X  d   R.# VR8X  d   RR.# . # )r&   r'   r(   r   r   r!   r"    rr   r4   r5   get_zone_table_chainsZnftables.get_zone_table_chains  s<    HY''H >!E> -00	r7   c                sr   V P                   P                  P                  V4      pVR 8X  d   ^ M.V P                   P                  P	                  V4      P
                  pVR 8X  d   ^ M.V P                   P                  P	                  V4      P                  p^ pV'       d   ^pM
V'       d   ^p^ pV'       d   ^pM0V'       g   VP                  '       d   V
'       d   ^pV
'       d   RpRpVR8X  d7   V P                   P                  P	                  V4      P                  ^,           pVR8X  d7   V P                   P                  P	                  V4      P                  ^,           p^ pV	'       d   V'       d   ^pM^pVVVVV3pVVVVV3pVV3pV'       d   RVV,           V,           /# RVV,           V,           /# )HOSTrp   *rT   )	r*   r   
get_policyzoneZget_zoneingress_priorityegress_priorityderived_from_zoneZpriority_max)r3   r   ingress_zoneegress_zoneingress_interfaceingress_sourceegress_interfaceegress_sourcer`   lastr    r#   rm   p_objr   r   Zingress_sort_orderZegress_sort_orderZlast_sort_orderr   ZegressZsuffixs   &&&&&&&&&&&&&         r5   _policy_dispatch_sort_keyZ"nftables._policy_dispatch_sort_key  s    **62 v% ''5FF 	 f$ ''4DD 	 !"!" !%"9"9"9j ! #%  ##xx}}55lCPPSTTs""hhmm44[ANNQRRO"#"# 
 
 "8,)6G+;f+DEE)7V+;f+DEEr7   c                s   R RRR/V,          pV P                   P                  P                  V4      pVR8X  d
   VR8X  d   R MRpV P                   P                  P                  W#\        V4      pVR8X  d   R MRpVR8X  d   R MRpV'       d;   V\        V4      ^,
          ,          R8X  d   VR\        V4      ^,
           R	,           pV	'       d;   V	\        V	4      ^,
          ,          R8X  d   V	R\        V	4      ^,
           R	,           p	. p. pV'       d%   VR	8w  d   VP                  R
RRRR//RRRV//4       V	'       d-   V	R	8w  d&   V'       g   VP                  R
RRRR//RRRV	//4       V'       d"   VP                  V P                  RV4      4       V
'       d"   VP                  V P                  RV
4      4       V'       g   VP                  RRV: RV: 2//4       EMVR8w  g   VR,9   d   VP                  RR/4       EMiVP                  \        RRRR39   EdO   V P                   P                  4       R8w  d   VP                  \        RRR39   d   VP                  R8X  d   RMRpRR R!\        R"V: RV: R#2R$VV P                  V P                   P                  4       4      R%R&R'V: RV: R(2//.,           /pVP                  V P                  VVVVVV	V
VP                  R R VVR)7      4       VP                  VR*V//4       VP                  \        RR39   d!   VP                  V P!                  4       4       M+VP                  VP                  P#                  4       R/4       RR R!\        R"V: RV: R#2R$V/pVP                  V P                  VVVVVV	V
VP                  VVVR+7      4       VP                  VR*V//4       V# )-Tr:   FrC   r!   r"   r   +Nr   ry   rz   r   r|   r   r~   r   r   r   saddrdaddrr   r   r   r&   Zreturnr   REJECT
%%REJECT%%r   r   r<   r=   r;   rU   Z	_POLICIESrg   r   r   r   : )r   rm   r#   r    rS   )r   r#   r    )r   r$   )r*   r   r   policy_base_chain_namePOLICY_CHAIN_PREFIXlenrX   _rule_addr_fragmentr   r   rI   rt   r   r   r   r`   _reject_fragmentr   )r3   r   r   r;   rU   r   r   r   r   r   r   r   r   r   isSNAT_policyr    r#   rJ   expr_fragmentsZ_log_suffixrS   s   &&&&&&&&&&&&          r5   &build_policy_ingress_egress_pair_rulesZ/nftables.build_policy_ingress_egress_pair_rules  s    x08**625.Um-C%((//88.
 #l2T
#}4d%!237H3IA3M!NRU!U 12NC8I4JQ4N ORU U 05E1F1J Ks R/0K#6F2G!2KLsR!2c!9!!%); <d!2  0C 7
!!%); <d!1 !!$":":7N"ST!!$":":7M"RS!!6H6P+Q"RSh%+C"C!!8T"23\\
 
 xx&&(E1ell#	G 7 ).(>fH fZ>N44TXX5L5L5NOw+T UV		 22$#)&(%!#'$/#- 3   g~67|| 3\8LL%%d&;&;&=>%%u||'9'9';T&BC fZ6N	
 	**! '% + 	
  	g~./r7   c                s   R RRR/V,          pVR8X  d
   VR8X  d   R MRpV P                   P                  P                  W#\        VR7      pV P                   P                  P	                  V4      p. p	V	P                  VRRR	R
\        RV: RV: 2///4       R Fe  p
V	P                  VRRR	R
\        RV: RV: RV
: 2///4       V	P                  VRRR	R
\        RV: RV: 2RRRV: RV: RV
: 2//.///4       Kg  	  VP                  '       Eg#   VR8X  Ed   V P                   P                  P                  V,          P                  pV P                   P                  4       R8w  dq   VR9   dj   VR8X  d   RMTpV	P                  VRRR	R
\        RV: RV: 2RV P                  V P                   P                  4       4      RRRV: RV: R2//.///4       VR9   dT   VR9   d   V P                  4       pMVP                  4       R/pV	P                  VRRR	R
\        RV: RV: 2RV.///4       V'       g   V	P                  4        V	# )Tr:   FrC   r!   r"   r   rU   r<   r=   r;   r>   r   r   rS   rg   r   r   r&   r   r   r   r   r   r   N)prer   denyallowpost)r   r   r   )r   r   r   r   )r   r   )r*   r   r   r   r   rX   rt   r   Z	_policiesr   rI   r   r   r   Zreverse)r3   r   r   r;   rU   r   r   r   r   rJ   chain_suffixr   Z
log_suffixtarget_fragments   &&&&&         r5   build_policy_chain_rulesZ!nftables.build_policy_chain_rulesh  s   x085.Um-C%((//88.v 9 
 **62 &5' :
	
 DLLL$f#Z"%,$O"
 LL$f#Z#w%?"$*(0+0'<3I-&!"%	! DB &&&5H+<XX__..v6==Fxx&&(E1==-3|-CJLL# &$,f$+Z$+w-G$*(,(D(D,0HH,C,C,E)* -2083:J;H4.)*	
-&	)"&. CC55&*&;&;&=O'-||~t&<O" (& ' 'E7)C &(9	%"	 MMOr7   c                sv    VR 8X  d   / # VR9   d   RRRRR//RRR	VR8X  d   R
//# T//# \        \        RV4      h)allunicastry   rz   r   r|   pkttyper~   r   r   ZhostzInvalid pkttype "%s")r   Z	broadcastZ	multicastr   r
   )r3   r   r4   r5   r   Z nftables._pkttype_match_fragment  sr    eI==VeY%78$w)';V  BI  L*@'JJr7   c                s   / R RRRRR//bRRRRRR//bRRRRRR//bR	RRRRR//bR
RRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//bRRRRRR//R RRRRR//R!RRRRR"//R"RRRRR"//R#RRR$//R%RRR$///CpW!,          # )&zicmp-host-prohibitedr   r   icmprg   zhost-prohibitedzhost-prohibzicmp-net-prohibitedznet-prohibitedz
net-prohibzicmp-admin-prohibitedr   zadmin-prohibzicmp6-adm-prohibitedicmpv6zadm-prohibitedzicmp-net-unreachableznet-unreachableznet-unreachzicmp-host-unreachablezhost-unreachablezhost-unreachzicmp-port-unreachablezport-unreachablezicmp6-port-unreachablezport-unreachr   zicmp-proto-unreachablezprot-unreachablezproto-unreachzicmp6-addr-unreachablezaddr-unreachableaddr-unreachzicmp6-no-routezno-routez	tcp-resetz	tcp resetztcp-rstr   )r3   Zreject_typeZfragsru   r5   _reject_types_fragmentZnftables._reject_types_fragment  s|   /
"6663DE%/

 Hvvv?P&QR/
 "6663CD$/
 8fff>N%OP/
 $6663EF&/
 X@R'ST/
 #68V5GH%/
" 68V5GH#/
( #6663DE%)/
. Hvvv?P&QR//
0 $6663EF&1/
6 X@R'ST7/
8 $6663EF&9/
> %68V5GH'?/
D XAS'TUE/
F %6663EF'G/
L hAS(TUM/
N %68V5GH' X&BT'UVx&(FJ)OPFHfj#IJ(V[$9:6;"78]/
` !!r7   c                s    R RRRR//# )r   r   r   rg   r   r   rO   rP   r5   r   Znftables._reject_fragment  s    67F4FGHHr7   c           	     s&    R RRRR//RRRRR	R
.///# )ry   rz   r   r|   r   r~   r   r   r   r   r   r   rO   rP   r5   _icmp_match_fragmentZnftables._icmp_match_fragment  s7    %!34d%&(!34
 	
r7   c                s    V'       g   / # R RRRRRRR/pRVP                   R	W!P                  ,          /pVP                  pVe   WCR
&   RV/# )ZsZsecondZmZminuteZhZhourdZdayrateZperburstlimit)r   Zdurationr   )r3   r   Zrich_to_nftr   r   s   &&   r5   _rich_rule_limit_fragmentZ"nftables._rich_rule_limit_fragment  sg    I 	
 EJJ;~~.

 gJ|r7   c                s   \        VP                  4      \        \        \        \
        39   d   M{VP                  '       dZ   \        VP                  4      \        \        \        \        39  d+   \        \        R \        VP                  4      ,          4      hM\        \        R4      hVP                  ^ 8X  d   \        VP                  4      \        \        \
        39   g%   \        VP                  4      \        \        39   d   R# \        VP                  4      \        39   g%   \        VP                  4      \        \        39   d   R# R# VP                  ^ 8  d   R# R# )Unknown action %szNo rule action specified.r   r   r   r   N)r   elementr   r   r   r   actionr   r   r   r   r   r
   r`   r3   	rich_ruler4   r5   _rich_rule_chain_suffixZ nftables._rich_rule_chain_suffix4  s7   	!!"	'
 
 I$$%	.  $ "5Y=M=M8N"N   .IJJ"I%%& "+  i&&'K+CCi''(^,<<  Ay)A* A* !#r7   c                s    VP                   '       g#   VP                  '       g   \        \        R 4      hVP                  ^ 8X  d   R# VP                  ^ 8  d   R# R# )zNot log or auditr   r   r   )r   auditr   r
   r`   r   r4   r5    _rich_rule_chain_suffix_from_logZ)nftables._rich_rule_chain_suffix_from_logZ  sF    }}}Y___.@AA"!#r7   c                sT    V'       d   VP                   ^ 8X  d   / # RVP                   /# )r    rh   )r`   r   r4   r5   _rich_rule_priority_fragmentZ%nftables._rich_rule_priority_fragmente  s(    I..!3I()*<*<==r7   c                s   VP                   '       g   / # V P                  P                  P                  W\        4      pR RRR/V,          pV P                  V4      p/ p	\        VP                   \        4      '       dP   VP                   P                  V	R&   VP                   P                  '       d   VP                   P                  V	R&   M[VP                   P                  '       d@   RVP                   P                  8X  d   RMVP                   P                  p
RV
,          V	R	&   VP                   P                  '       d!   RVP                   P                  ,          V	R
&   RRR\        RV: RV: RV: 2RVV P                  VP                   P                  4      RV	/.,           /pVP                  V P!                  V4      4       VRV//# )Tr:   FrC   groupzqueue-thresholdZwarningZwarnr   levelr   r<   r=   r;   rU   r   rg   r   rS   )r   r*   r   r   r   r   r]   r   r   Z	thresholdr   r   rt   r   r   r   r   )r3   r   r   r   r;   r   r   r   r   Zlog_optionsr   rS   s   &&&&&&      r5   _rich_rule_logZnftables._rich_rule_logj  s   }}}I((//88.
 x08<<YGimmZ00#,==#6#6K }}&&&1:1H1H-.}}"""'9==+>+>>FIMMDWDW  (,e|G$==$(9==+?+?$?K! fZ5'<@N..y}}/B/BC$		
 	D55i@A&$((r7   c                s   VP                   '       g   / # V P                  P                  P                  W\        4      pR RRR/V,          pV P                  V4      pRRR\        RV: RV: RV: 2R	VV P                  VP                   P                  4      R
RR//.,           /p	V	P                  V P                  V4      4       VRV	//# )Tr:   FrC   r<   r=   r;   rU   r   rg   r   r   r   rS   )r   r*   r   r   r   r   rt   r   r   r   r   )
r3   r   r   r   r;   r   r   r   r   rS   s
   &&&&&&    r5   _rich_rule_auditZnftables._rich_rule_audit  s    I((//88.
 x08<<YGfZ5'<@N..y/D/DE'*+		
 	D55i@A&$((r7   c                s   VP                   '       g   / # V P                  P                  P                  W\        4      pR RRR/V,          pV P                  V4      pV: RV: RV: 2p	\        VP                   \        4      '       d   RR/p
EM\        VP                   \        4      '       dJ   VP                   P                  '       d(   V P                  VP                   P                  4      p
EMRR/p
EM\        VP                   \        4      '       d   RR/p
M\        VP                   \        4      '       d   R	pV P                  P                  P                  W\        4      pV: RV: RV: 2p	VP                   P                  P                  R
4      p\        V4      ^8  d(   R	RRRR//RRRRRR//V^,          ./V^ ,          .///p
M>R	RRRR//RV^ ,          //p
M*\!        \"        R\        VP                   4      ,          4      hRRR\$        RV	RVV P'                  VP                   P(                  4      V
.,           /pVP+                  V P-                  V4      4       VRV//# )Tr:   FrC   r   r   Nr   r   r   /r|   r   markvalueZ^Z&r   r<   r=   r;   rU   rg   rS   )r   r*   r   r   r   r   r]   r   r   r   r   r   r   r   r   r   r   r
   rt   r   r   r   r   )r3   r   r   r   r;   r   r   r   r   rU   Zrule_actionr   rS   s   &&&&&&       r5   _rich_rule_actionZnftables._rich_rule_action  sS   I((//88.
 x0833I>#Wl;i&&44#T*K	((+66$$$"99):J:J:O:OP'.	(()44!4.K	(()44Ehhoo<<2G #(,?E$$((..s3E5zA~8!$'@%(&K L %a""
 uvv&?%PQ(S
  1D9I9I4JJ 
 fZUN--i.>.>.D.DE{ST	
 	D55i@A&$((r7   c                sl   VP                  R 4      '       d.   T P                  V\        R 4      R RV8X  d   RV4      # RV4      # \        V4      '       d   RpM\	        RV4      '       d   RpM\        RV4      '       dB   Rp\        P                  ! VRR7      pR	R
VP                  P                  RVP                  //pM[\	        RV4      '       d   Rp\        V4      pM;RpVP                  R4      pR	R
\        V^ ,          4      R\        V^,          4      //pRRRRVRV//RV'       d   RMRRV//# )ipset:Nr   TFetherr   ip)Zstrictr   addrr   r   ip6r   ry   rz   payloadprotocolfieldr~   !=r   r   )Z
startswith_set_match_fragmentr   r   r   r   	ipaddressZIPv4NetworkZnetwork_addressZ
compressedZ	prefixlenr   r   r^   )r3   Z
addr_fieldaddressinvertr<   Znormalized_addressZaddr_len   &&&&   r5   r   Znftables._rule_addr_fragment  sX   h''++H(:- 38  !! %fg66vw//%.%:%:75%Q" 2 B B M M1;; &fg66&w/"==-Xa[ 9s8A;/ YVWj(QR&$dW r7   c                sn    V'       g   / # VR
9  d   \        \        RV,          4      hRRRRR//RRR	V//# )r   zInvalid familyry   rz   r   r|   nfprotor~   r   r   )r   r   r   )r3   Zrich_familyr4   r5   _rich_rule_family_fragmentZ#nftables._rich_rule_family_fragment  sS    I...>.LMM %!34d
 	
r7   c                s    V'       g   / # VP                   '       d   VP                   pM%VP                  '       d   R VP                  ,           pV P                  RXVP                  R7      # )r   r   r	  )r   ipsetr   r	  )r3   Z	rich_destr  ru   r5   _rich_rule_destination_fragmentZ(nftables._rich_rule_destination_fragment  sQ    I>>>nnG___0G''AQAQ'RRr7   c                s`   V'       g   / # VP                   '       d   VP                   pMh\        VR 4      '       d    VP                  '       d   VP                  pM7\        VR4      '       d&   VP                  '       d   RVP                  ,           pV P	                  RXVP
                  R7      # )macr  r   r   r  )r   Zhasattrr  r  r   r	  )r3   Zrich_sourcer  ru   r5   _rich_rule_source_fragmentZ#nftables._rich_rule_source_fragment(  s    I!&&G[%(([___!ooG['**{/@/@/@!2!22G''ASAS'TTr7   c                s    \        V4      p\        V\        4      '       d   V^ 8  d   \        \        4      h\        V4      ^8X  d
   V^ ,          # RV^ ,          V^,          ./# )r    range)r   r]   r^   r   r   r   )r3   portr  ru   r5   _port_fragmentZnftables._port_fragment5  sV    T"eS!!eai--Z1_8OeAha122r7   c                   R RRR/V,          pRpV P                   P                  P                  W(\        4      p	. p
V'       d+   V
P	                  V P                  VP                  4      4       V'       d"   V
P	                  V P                  RV4      4       V'       dU   V
P	                  V P                  VP                  4      4       V
P	                  V P                  VP                  4      4       V
P	                  RRRR	VR
R//RRRV P                  V4      //4       . pV'       di   VP	                  V P                  W&WV
4      4       VP	                  V P                  W&WV
4      4       VP	                  V P                  W&WV
4      4       V# VP	                  VRRRR\         RV: RV	: R2RV
RR/.,           ///4       V# )Tr:   FrC   r&   r   ry   rz   r  r  r  dportr~   r   r   rS   r<   r=   r;   rU   r   _allowrg   r   Nr*   r   r   r   rX   r  r<   r   r  destinationr  sourcer  r   r   r   rt   r3   r   r   protor  r  r   r   r;   r   r   rJ      &&&&&&&     r5   build_policy_ports_rulesZ!nftables.build_policy_ports_rules>      x08((//88.
 !!$"A"A)BRBR"ST!!$":":7K"PQ!!44Y5J5JK !!$"A"A)BRBR"STYUGW(MN$T006	
 LL##FvnU LL%%fW LL&&v&X"  LL$f#Z#eW%E"Nx6F5G$G	!	 r7   c                sn   R RRR/V,          pRpV P                   P                  P                  W'\        4      p. p	V'       d+   V	P	                  V P                  VP                  4      4       V'       d"   V	P	                  V P                  RV4      4       V'       dU   V	P	                  V P                  VP                  4      4       V	P	                  V P                  VP                  4      4       V	P	                  RRRR	R
//RRRV//4       . p
V'       di   V
P	                  V P                  W%WV	4      4       V
P	                  V P                  W%WV	4      4       V
P	                  V P                  W%WV	4      4       V
# V
P	                  VRRRR\        RV: RV: R2RV	RR/.,           ///4       V
# )Tr:   FrC   r&   r   ry   rz   r   r|   r   r~   r   r   rS   r<   r=   r;   rU   r   r  rg   r   N)r*   r   r   r   rX   r  r<   r   r  r  r  r  r   r   r   rt   )r3   r   r   r  r  r   r   r;   r   r   rJ      &&&&&&     r5   build_policy_protocol_rulesZ$nftables.build_policy_protocol_rulesw  s    x08((//88.
 !!$"A"A)BRBR"ST!!$":":7K"PQ!!44Y5J5JK !!$"A"A)BRBR"STVeY%78$X	
 LL##FvnU LL%%fW LL&&v&X"  LL$f#Z#eW%E"Nx6F5G$G	!	 r7   c                sf   R pRpV P                   P                  P                  W'\        4      pRRRR/V,          p	. p
V'       df   V
P	                  V P                  VP                  4      4       V
P	                  V P                  VP                  4      4       V P                  V4      pV
P	                  RRRR	R
RRRR//RR//4       VR8X  g	   V'       g#   V
P	                  RRRRRRR//RRRR////4       MV
P	                  RRRRRRR//RV//4       V	RRRR\        RR V: R!V: 2R"V
///.# )#r   r&   Tr:   FrC   ry   r~   r   rz   r  r  r   r  r?   r   ZsynZpmtur   r|   z
tcp optionr>   Zmaxsegsizer   ZrtZmturS   r<   r=   r;   rU   r   r   rg   )r*   r   r   r   rX   r  r  r  r  r   rt   )r3   r   r   Ztcp_mss_clamp_valuer  r   r   r;   r   r   r   r   r5    build_policy_tcp_mss_clamp_rulesZ)nftables.build_policy_tcp_mss_clamp_rules  s    ((//88.
 x08!!44Y5J5JK !!$"A"A)BRBR"ST77	BL$YUGW(MNU	
 &(0C!!vx&.QR$!7 !!vx&.QR!4  &7L!I		
 	
r7   c                r  )Tr:   FrC   r&   r   ry   rz   r  r  r  sportr~   r   r   rS   r<   r=   r;   rU   r   r  rg   r   Nr  r  r  r5   build_policy_source_ports_rulesZ(nftables.build_policy_source_ports_rules  r  r7   c                s   R pV P                   P                  P                  W(\        4      p	RRRR/V,          p
. pV'       d,   VP	                  RRRRR\
        R	R
V: RV: 2RVRV///4       . pV'       d"   VP	                  V P                  RV4      4       VP	                  RRRRVRR//RRRV P                  V4      //4       VP	                  RR
V: RV: 2/4       VP	                  V
RRRR\
        RRV	,          RV///4       V# )r&   Tr:   FrC   z	ct helperr<   r=   r;   r>   zhelper--r   r  r   ry   rz   r  r  r  r~   r   r   rS   rU   filter_%s_allowrg   )r*   r   r   r   rX   rt   r   r  )r3   r   r   r  r  r  Zhelper_nameZmodule_short_namer;   r   r   rJ   r   s   &&&&&&&&     r5   build_policy_helper_ports_rulesZ(nftables.build_policy_helper_ports_rules%  sH    ((//88.
 x08LL#$f#Z"k5$I"$5&&
 !!$":":7K"PQYUGW(MN$T006	
 	{k5,QRS &!2g!>			
 r7   c                s   R RRR/V,          pV P                   P                  P                  W4\        4      p. p	V'       dN   V\	        V4      ^,
          ,          R8X  d   VR\	        V4      ^,
           R,           pRRR	R
R//RRRV//RR/.p
MV P                  RV4      RR/.p
RRR\        RRV,          RV
/pV	P                  VRV//4       V	# )Tr:   FrC   r   Nr   ry   rz   r   r|   r   r~   r   r   r   r   r<   r=   r;   rU   r'  rg   rS   )r*   r   r   r   r   r   rt   rX   )r3   r   r   r   r;   Z	interfacer  r   r   rJ   rg   rS   r  r5   build_zone_forward_rulesZ!nftables.build_zone_forward_rulesZ  s    x08((//88.
 Y!+,3%&:I(:;cA	 %); <d 4 	D ,,Wf=$?OPD fZ&'2D	
 	g~./r7   c                s   R RRR/V,          p. p. pV'       d   VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       V P                  V4      pMVP                  RRRRR//R	R
RR//4       RpRpV P                  P                  P                  W(\        R R7      p	RRR\        RRV	: RV: 2RVRRRRR//R	RRR//RR/.,           /p
V
P                  V P                  V4      4       VP                  VRV
//4       V# )Tr:   FrC   ry   rz   r   r|   r  r~   r   r   r   r   r!   r   r<   r=   r;   rU   nat_r   rg   r   r  r   Z
masqueradeNrS   )rX   r  r<   r  r  r  r  r   r*   r   r   r   rt   r   r   )r3   r   r   r   r   rJ   r   r   r;   r   rS   s   &&&&       r5   build_policy_masquerade_rulesZ&nftables.build_policy_masquerade_rules  s   x08!!$"A"A)BRBR"ST!!44Y5J5JK !!$"A"A)BRBR"ST77	BL!!%); <d #L((//88.t 9 
 fZG\:N %); <d t$	
	
  	D55i@Ag~./r7   c                s   R pV P                   P                  P                  W(\        4      p	V P                   P                  P	                  V4      p
RRRR/V,          p. pV'       d   VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       V P                  V4      pM=RpV'       d   \        RV4      '       d   RpVP                  RRR	R
R//RRRV//4       RpVP                  RRRRVRR//RRRV P                  V4      //4       . pV'       d#   VP                  V P                  W'WV4      4       V'       dj   \        RV4      '       d   \!        V4      pV'       d/   VR8w  d(   VP                  RRVRV P                  V4      //4       M:VP                  RRV//4       M$VP                  RRV P                  V4      //4       RRR\"        RRV	: RV: 2RV/pVP%                  V P'                  V4      4       VP                  VR V//4       V P                   P(                  '       dt   R!V
P*                  9   d   R"pMV'       d   R#pMR$pRRR\"        RR%V R&2RRRR'R
R(R)R*//RRRV P                  V4      //R+R,/./pTP                  V'       d   R-MRR V//4       V# ).r!   Tr:   FrC   r   r   ry   rz   r   r|   r  r~   r   r   r   r  r  r  r  rp   r   r   r  Zredirectr<   r=   r;   rU   r*  r   rg   rS   r   r$   r(   r'   r   r   r{   z	proto-dstZdirZoriginalr   NrR   )r*   r   r   r   r   rX   r  r<   r  r  r  r  r   r   r  r   r   rt   r   r   r   Zingress_zones)r3   r   r   r  r  ZtoportZtoaddrr   r;   r   r   r   r   r   r  rJ   rS   rU   s   &&&&&&&&          r5   build_policy_forward_port_rulesZ(nftables.build_policy_forward_port_rules  s     ((//88.
 **62x08!!$"A"A)BRBR"ST!!44Y5J5JK !!$"A"A)BRBR"ST77	BLG.vv>> !!%); <d #LYXw(PQ$T006	
 LL##FvnU #FF33%f-&B,%%fffd6I6I&6QRS %%v/?&@A!!:8K8KF8S/T"UV fZG\:N	
 	D55i@Ag~./88))),,, !&75'/"TE;z+R$S $#T%8%8%>" t$		D LLf((VTNKLr7   c           	     sn    R RRRVRR//RRRV//.pVe    VP                  R RRRVRR	//RRRV//4       V# )
ry   rz   r  r  r  r   r~   r   r   code)rX   )r3   r  r   r-  	fragments   &&&& r5   _icmp_types_fragmentsZnftables._icmp_types_fragments	  s}     YXw(OP$T
	 Z7F,S Td r7   c           	     sV   VR 8X  d<   V\         9   d1   \         V,          w  r4pT P                  RY5'       d   R4      # T4      # VR8X  d<   V\        9   d1   \        V,          w  r4pT P                  RY5'       d   R4      # T4      # \        \        RV: RV P
                  : RV: 24      h)r   r   Nr   r   zICMP type 'z' not supported by z for )r   r0  r   r   r   r>   )r3   r   Z	icmp_typeZ_typeZ_codeZ
_omit_codes   &&&   r5   _icmp_types_to_nft_fragmentsZ%nftables._icmp_types_to_nft_fragments'	  s    &=Y*4'1)'<$E*--zt 7<  F]yL8'3I'>$E*--% 9>    dii. r7   r   r   c                s0   R pV P                   P                  P                  W&\        4      pRRRR/V,          p. p	V EF  p
V P                   P                  P	                  V4      '       d   V: RV: R2pRR/pMV: RV: R	2pV P                  4       p. pV'       d   VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       VP                  V P                  WP                  4      4       V'       d   V	P                  V P!                  W$WV4      4       V	P                  V P#                  W$WV4      4       VP$                  '       d&   V	P                  V P'                  W$WV4      4       EK  V P)                  V4      pR
RR\*        RV: RV: RV: 2RWP                  4       .,           /pVP-                  V P/                  V4      4       V	P                  VRV//4       EK  V P                   P1                  4       R8w  d   V P                   P                  P	                  V4      '       g^   V	P                  VRR
RR\*        RVRVV P3                  V P                   P1                  4       4      RRV: RV: R2//.,           ///4       V	P                  VRR
RR\*        RVRW.,           ///4       EK  	  V	# )r&   Tr:   FrC   r   r  r   NZ_denyr<   r=   r;   rU   rg   rS   r   r   r   _ICMP_BLOCK: )r*   r   r   r   query_icmp_block_inversionr   rX   r  r<   r  r  r  r  r   r1  r>   r   r   r   r   r   rt   r   r   rI   r   )r3   r   r   Zictr   Zipvsr;   r   r   rJ   r   Zfinal_chainr   r   r   rS   s   &&&&&&          r5   build_policy_icmp_block_rulesZ&nftables.build_policy_icmp_block_rules9	  s    ((//88.
 x08Cxx99&AA/4g>#+T"2.3W="&"7"7"9N%%d&E&EiFVFV&WX%%889N9NO %%d&E&EiFVFV&WX!!$"C"CC"RS''6.
 ))6.
 ###LL.."vn $(#?#?	#JL &ug|!L2G2G2I1J J	D KK A A) LMLL'FD>!:; HH++-6 HHOOFFvNNLL# &$,f$+Z$+[$*(6,0,H,H040G0G0I-. 164<7<f?F82-.	
+*)*)"&2 " (& ' ' &9J(J	%"	U n r7   c                s   R pV P                   P                  P                  W#\        4      p. pRRRR/V,          pV P                   P                  P	                  V4      '       d   V P                  4       pMRR/pVP                  VRRR	R
\        RV: RV: 2R^RV P                  4       V.///4       V P                   P                  4       R8w  d   V P                   P                  P	                  V4      '       do   VP                  VRRR	R
\        RV: RV: 2R^RV P                  4       V P                  V P                   P                  4       4      RRV: RV: R2//.///4       V# )r&   Tr:   FrC   r   NrS   r<   r=   r;   rU   r   rV   rg   r   r   r   r2  )r*   r   r   r   r3  r   rX   rt   r   rI   r   )r3   r   r   r;   r   rJ   r   r   r[   r5   'build_policy_icmp_block_inversion_rulesZ0nftables.build_policy_icmp_block_inversion_rules	  sw   ((//88.
 x0888??55f=="335O'.O
 	 &E7!;!:!:!<o N
	
 HH##%.::6BBLL$f#Z#w%?#Q" $ 9 9 ; $ < <TXX=T=T=V W$)(0%QW2X,&!"%!* r7   c                s^   . pR pV P                   P                  R8X  d   RR.pMHV P                   P                  R8X  d   RR.pRpM&V P                   P                  R8X  d   . R+OpRpM. R+OpRRR	R
R//RRRR//RRRRVRR//RRRR//.pVR8w  d   VP                  RRR//4       VP                  RR/4       VP                  RRRRR\        R VR!V///4       V P                   P                  R,9  d8   VP                  RRRRR\        R VR!RRR"R#R$R%R&//RRRR'R(R).///R*R/.///4       V# )-Zfilter_PREROUTINGZlooser   r   loose-forwardr   strict-forwardry   rz   r   r|   r  r~   r   r   r   Zfibr?   ZresultZoifFr   r   r   zrpfilter_DROP: r   NrR   rS   r<   r=   r;   rU   rg   r  r  r   r  r   r   znd-router-advertznd-neighbor-solicitr   )r   r   Ziifr6  r7  )r*   _ipv6_rpfilterrX   rt   )r3   rm   rJ   Zrpfilter_chainZ	fib_flagsr   s   &&    r5   build_rpfilter_rulesZnftables.build_rpfilter_rules	  s   ,88""g- &)IXX$$7 &)I-NXX$$(880I-N0I VeY%78$V UWi5$IJ$U
  !!585F*G"HIvtn- &			
 88""*MMLL$f#Z#^"$+(.,50:H078.1* )-d(/,10B0E4.2*.&!"" "*4 0%%	!> r7   c                s   . ROpV Uu. uF@  pRRVP                  R4      ^ ,          R\        VP                  R4      ^,          4      //NKB  	  ppRRRRR	R
R//RRRRV///.pV P                  P                  R9   d   VP	                  RRR//4       VP	                  V P                  R4      4       . pVP	                  RRRRR\        RRR^RV///4       ^pV P                  P                  R8w  d
   V^,          pV P                  P                  4       R8w  d
   V^,          pV P                  P                  R 9   d
   V^,          pVP	                  RRRRR\        RRRVRV///4       V# u upi )!::0.0.0.0/96r   r   r   r   ry   rz   r  r  r  r  r   r~   r   r   r   r   zRFC3964_IPv4_REJECT: r   r:   rS   r<   r=   r;   rU   r   rV   rg   r   r   )	r;  z::ffff:0.0.0.0/96z2002:0000::/24z2002:0a00::/24z2002:7f00::/24z2002:ac10::/28z2002:c0a8::/32z2002:a9fe::/32z2002:e000::/19)r   r   r8  )
r   r^   r*   Z_log_deniedrX   r   rt   r   rI   r9  )r3   Z	daddr_setxr   rJ   Zforward_indexrL   r5   build_rfc3964_ipv4_rulesZ!nftables.build_rfc3964_ipv4_rules(
  s   

	 
 QAGGCLO8LMN 	 
 YUGW(MN$eY/
 88#55!!585L*M"NOd99.IJ &
	
 88''50QM88""$-QM88""&IIQM &!1
	
 k
s   AE0c           	     s   R p. pVP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       VP                  V P                  VP                  4      4       . pVP                  V P                  W#WV4      4       VP                  V P                  W#WV4      4       VP                  V P                  W#WV4      4       V# )r&   )
rX   r  r<   r  r  r  r  r   r   r   )r3   r   r   r   r;   r   rJ   r
  r5   *build_policy_rich_source_destination_rulesZ3nftables.build_policy_rich_source_destination_rulesk
  s    d==i>N>NOP001F1FG	
 	d==i>N>NOP6.Q	
 	!!&VNS	
 	""6f^T	
 r7   c                s    VR9   d   R# R# )r   TF)r   r   Zebr   )r3   r   r4   r5   is_ipv_supportedZnftables.is_ipv_supported
  s    ((r7   c                s`   R RRR/pRW1,          RW1,          RR.RW1,          RRW1,          .R	W1,          RRW1,          .R
W1,          R.RW1,          RW1,          W1,          .RW1,          RR.RW1,          RRW1,          .RW1,          R.RR/pW$9   d	   WB,          # \        \        RV,          4      h)r   Z	ipv4_addrr   Z	ipv6_addrzhash:ipzhash:ip,portZ
inet_protoZinet_servicezhash:ip,port,ipzhash:ip,port,netzhash:ip,markr   zhash:netzhash:net,netzhash:net,portzhash:net,port,netzhash:net,ifaceZifnamehash:macZ
ether_addrz!ipset type name '%s' is not valid)r   r   )r3   r   r   Zipv_addrZtypes   &&&  r5   _set_type_listZnftables._set_type_list
  s    KK

 x}X]L.I	  	! X]F3X]HM:hm\>J	" x}h75
8 =;ADH r7   c                s   V'       d   R V9   d   VR ,          R8X  d   RpMRpR RR\         RVRV P                  WB4      /pVP                  R4      ^,          P                  R	4       F  pVR9   g   K  R
.VR&    M	  V'       d9   RV9   d   \        VR,          4      VR&   RV9   d   \        VR,          4      VR&   RRV//.# )r<   inet6r   r   r=   r;   r>   r   :,Zintervalr?   ZtimeoutZmaxelemr"  r:   r   )r   netr  )rt   rB  r   r^   )r3   r>   r   optionsr   Zset_dictZtr
  r5   build_set_create_rulesZnftables.build_set_create_rules
  s    x7*wx/@G/KCC fZDD''2	
 C#))#.A))%/L! /
 G#&)')*<&=#G##&wy'9#: )*++r7   c                s|    V P                  WV4      pV P                  W@P                  P                  4       4       R # rN   )rH  ro   r*   rI   )r3   r>   r   rG  rJ   r/  r5   
set_createZnftables.set_create
  s-    ++D@uhh5578r7   c                sx    R RRRR\         RV///pV P                  W P                  P                  4       4       R# )rC   r   r<   r=   r;   r>   N)rt   rH   r*   rI   )r3   r>   rS   ru   r5   set_destroyZnftables.set_destroy
  s;    ux*fdST
 	dHH3356r7   c                s   V P                   P                  P                  V4      P                  P	                  R 4      ^,          P	                  R4      p. pV F  pVR8X  d9   VP                  RRR//4       TP                  RRRR	V'       d   R
MR//4       KB  VR9   d3   TP                  RRV P                  V4      R	V'       d   RMR//4       K{  VR8X  d"   TP                  RRV'       d   RMR//4       K  VR8X  d   VP                  RRR//4       K  \        \        RV,          4      h	  RR\        V4      ^8  d   RV/MV^ ,          RV'       d   RMRRRV,           //# )rD  rE  r  r   r|   r   r  r  Zthr  r  r$  r   r   Zifacer   r   r   z-Unsupported ipset type for match fragment: %sry   rz   concatr~   r  r   r   Z@)r   rF  r  )
r*   r  	get_ipsetr   r   rX   _set_get_familyr   r   r   )r3   r>   Z
match_destr	  type_formatr.  formatr
  r5   r  Znftables._set_match_fragment
  sx   hhnn..t499??DQGMMcR	!F  &5)*<!=>  !&#
W$ //  !&(<(<T(B#
W$ 7"  e*Y)LM 6!  &5&/!:;# CvN 7 "B [1AA1E9-9UV<fd$t
 	
r7   c                s   V P                   P                  P                  V4      pVP                  P	                  R 4      ^,          P	                  R4      pVP	                  R4      p\        V4      \        V4      8w  d   \        \        R4      h. p\        V4       EFe  w  rxVR8X  dz    WW,          P                  R 4      p	VP                  WW,          RV	 4       WW,          V	^,           R p
 V
P                  R4      p	VP                  RV
RV	 W^,           R ./4       K  VR9   d   RWW,          9   d+   VP                  RWW,          P	                  R4      /4       K   WW,          P                  R4      p	WW,          RV	 pR	VP                  9   d$   VP                  R	,          R
8X  d   \        V4      pVP                  RRVR\        WW,          V	^,           R 4      //4       EKN  VP                  WW,          4       EKh  	  \        V4      ^8  d   RV/.# T#   \         d    TP                  R4       YW,          p
 ELWi ; i  \         d    TP                  T
4        EK  i ; i  \         dS    YW,          pR	TP                  9   d$   TP                  R	,          R
8X  d   \        T4      pTP                  T4        EK,  i ; i)rD  rE  z+Number of values does not match ipset type.r  Nr   r&  r  r   r<   rC  r   r   r   rK  )r   rF  )r*   r  rL  r   r   r   r   r   Z	enumeraterV   rX   rF   rG  r   r^   )r3   r>   entryZobjrN  Zentry_tokensZfragmentZirO  rV   Zport_strr   s   &&&         r5   _set_entry_fragmentZnftables._set_entry_fragment   s   
 hhnn&&t,hhnnS)!,2237{{3'{s<00L  ";/IA<(O11#6E OOLOFU$;<+uqy{;H$NN3/E OO 8FU#3Xaik5J"KL =(,/)OOWlo.C.CC.H$IJ , 5 5c :  ,v6#s{{2s{{87LPW7W#/#5D  ($*D$)3|uqy{/K+L+" 0[ 0\ *-[)9A)=8$%K8KU " /OOE*+H/ " .OOH--. & .+#s{{2s{{87LPW7W#/#5D --	.s7   ,H0I
#I.$II
I+*I+.AK
Kc                sn    . pV P                  W4      pVP                  R RRRR\        RVRV///4       V# )r:   r   r<   r=   r;   r>   elem)rQ  rX   rt   )r3   r>   rP  rJ   r   rA  r5   build_set_add_rulesZnftables.build_set_add_rules=  sS    **47 &	 		
 r7   c                sz    V P                  W4      pV P                  W0P                  P                  4       4       R # rN   )rS  ro   r*   rI   )r3   r>   rP  rJ   r   r5   set_addZnftables.set_addN  s+    ((5uhh5578r7   c           
     s    V P                  W4      pR RRRR\        RVRV///pV P                  W@P                  P	                  4       4       R# )rC   r   r<   r=   r;   r>   rR  N)rQ  rt   rH   r*   rI   )r3   r>   rP  r   rS   rA  r5   
set_deleteZnftables.set_deleteR  sX    **47fZDG		
 	dHH3356r7   c                s$    R RRRR\         RV///.# )ri   r   r<   r=   r;   r>   )rt   )r3   r>   r4   r5   build_set_flush_rulesZnftables.build_set_flush_rules`  s&    ux*fdSTU
 	
r7   c                sz    V P                  V4      pV P                  W P                  P                  4       4       R # rN   )rV  ro   r*   rI   )r3   r>   rJ   ru   r5   	set_flushZnftables.set_flushe  s+    **40uhh5578r7   c                s    V P                   P                  P                  V4      pVP                  R 8X  d   RpV# VP                  '       d.   RVP                  9   d   VP                  R,          R8X  d   RpV# RpV# )r@  r   r<   rC  r  r   )r*   r  rL  r   rG  )r3   r>   r  r<   re   r5   rM  Znftables._set_get_familyi  sr    ((.::#F  MMMEMM)h'72F  Fr7   c                s  a a	 . pVP                  S P                  WV4      4       VP                  S P                  V4      4       S P                  VS P                  P                  4       4       V 3R  lo	^ p. pV FT  pVP                  S P                  W4      4       V^,          pVR8  g   K5  \        P                  ! V	3R lV4       . p^ pKV  	  \        P                  ! V	3R lV4       R# )c                 s   <  SP                  V SP                  P                  4       4       R#   \         d8   p\        P
                  ! R 4       \        P
                  ! T4        Rp?R# Rp?ii ; i)z;While restoring ipset entries the following Error occurred:N)ro   r*   rI   Z	Exceptionr   rn   )rJ   Zer3   s   & r5   _idle_set_add_entriesZ3nftables.set_restore.<locals>._idle_set_add_entries  sM    udhh&=&=&?@ 		WX		!s   */ A1,A,,A1i  c                    < S! V 4      # rN   r   r<  rX     &r5   <lambda>&nftables.set_restore.<locals>.<lambda>  s    (=a(@r7   c                 rY  rN   r   rZ  r[  r5   r\  r]    s    $9!$<r7   N)	r   rH  rV  ro   r*   rI   rS  r   Zidle_add)
r3   Zset_nameZ	type_nameZentriesZcreate_optionsZentry_optionsrJ   ZchunkrP  rX  s
   f&&&&&   @r5   set_restoreZnftables.set_restorey  s     T00nUVT//9:udhh5578	 ELL11(BCQJE}@%H  MM<eDr7   )	r*   r-   r)   r1   r+   r0   r/   r.   r,   rN   )r   )FFFF)F)NN)KZ__name__Z
__module__Z__qualname__Z__firstlineno__r>   Zpolicies_supportedr6   rM   rQ   r\   ra   rf   ro   rH   rs   rv   rw   rx   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r!  r#  r%  r(  r)  r+  r,  r0  r1  r4  r5  r:  r=  r>  r?  rB  rH  rI  rJ  r  rQ  rS  rT  rU  rV  rW  rM  r^  Z__static_attributes__Z__classdictcell__)Z__classdict__s   @r5   r)   r)   ^   s    D.1f*(5T59nQfA

:
,Qf7RhtlJFXFPgRK1"fI
,$L	>
&)P)0:)x(T
SU37r7r:
x7r3j#J0d^@,& .28HaF7rQfAF.
&P,697*
X;Lz"97

9 E Er7   r)   iji)-Zgi.repositoryr   rk   rb   r  Zfirewall.core.loggerr   Zfirewall.functionsr   r   r   r   r   Zfirewall.errorsr   r	   r
   r   r   r   r   Zfirewall.core.richr   r   r   r   r   r   r   r   r   Zfirewall.core.baser   Zfirewall.core.icmpr   r   Znftables.nftablesr   rt   rl   rD   r   r   rq   r)   r   r7   r5   <module>r_     s2       $   
 
 
 3 7 &
$}4 #g-    
  |TO%;< 
|TO%;<s_'<=8TO34	 |Q%89'1./Iq?238Q01	/ @x,E x,Er7   