Tc @ s d d k Z d d k Z d d k Z d d k Z d d k Z d d k Z d d k Z d d k l Z d d k Td f d YZ
e
d e d e d e e e
d e d
e d e
d e d
e d e
d e d e d e
d e d e d e e e
d e d e d e
d e d e d e e g Z d Z
d Z d f d YZ d e f d YZ d! f d" YZ d# e f d$ YZ d S(% iN( t _( t *t _Settingc B s e Z d e e d Z RS( c C s1 | | _ | | _ | | _ | | _ | | _ d S( N( t keyt namet descriptiont iptablest ip6tables( t selfR R R R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt __init__! s
N( t __name__t
__module__t Nonet FalseR ( ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s t MODULES_UNLOADs" Unload modules on restart and stopso To ensure a sane state, the kernel firewall modules must be unloaded when the firewall is restarted or stopped.t SAVE_ON_STOPs Save on stops Save the active firewall configuration with all changes since the last start before stopping the firewall. Only do this if you need to preserve the active state for the next start.t SAVE_ON_RESTARTs Save on restarts Save the active firewall configuration with all changes since the last start before restarting the firewall. Only do this if you need to preserve the active state for the next start.t SAVE_COUNTERs Save and restore countersX <i>Save on stop</i> and <i>Save on restart</i> additionally save rule and chain counter.t STATUS_NUMERICs Numeric status outputsB Print addresses and ports in numeric format for the status output.t STATUS_VERBOSEs Verbose statuss| Print information about the number of packets and bytes plus the <i>input-</i> and <i>outputdevice</i> in the status output.t STATUS_LINENUMBERSs Status line numberss; Print a counter/number for every rule in the status output.c C s* x# t D] } | i | j o | Sq Wd S( N( t setting_listR R ( R t x( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt getByKeyF s
c C s* x# t D] } | i | j o | Sq Wd S( N( R R R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt getByNameL s
t ip4tablesConfigc B sV e Z d Z d Z d Z d Z d Z d Z d Z d Z d Z
RS( t IPTABLES_c C s | | _ | i d S( N( t filenamet clear( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR W s c C s h | _ | i d | i g | i d | i d | i d | i d | i d | i d | i d | i d | i d | i d | i d | i d | i d
| i d d S( Ns %sMODULESs %sMODULES_UNLOADt yess %sSAVE_ON_STOPt nos %sSAVE_ON_RESTARTs %sSAVE_COUNTERs %sSTATUS_NUMERICs %sSTATUS_VERBOSEs %sSTATUS_LINENUMBERS( t p_configt sett prefix( R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR [ s c C s& | | i i j o | i | Sd S( N( R t keysR ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt getf s c C sE | d d j o | | i | i <n | i | i | i <d S( Nit _MODULES( R t strip( R R t value( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR k s c C sS d } xF | i i D]5 \ } } | o | d 7} n | d | | f 7} q W| S( Nt s
s %s = %s( R t items( R t sR R& ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt __str__q s c C sA | i t | i d } x| i D]} | p Pn | i } t | d j p | d d j o q) n | i d } t | d j o q) n | d i } | d i } t | d j o3 | d d j o" | d d j o | d d !} n | d d
j o | i } n | | i | <q) W| i d S( Nt ri i t #t =i t "iiR$ ( R t openR t
xreadlinesR% t lent splitR t close( R t filet linet pR R& ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt readz s(
$5c
C s t | i d j o d St i i | i o t i | i d | i n t i } d | d f } t
| d } t } y t
| i d } Wn
d } nXx| i
D]} | p Pn | d d j o | d } n t | d j o | i d q n | d d
j oat | d j oN| i d } t | d j o | i | d q n | d i } | d i } t | d j o3 | d d
j o" | d d
j o | d d !} n | d d j o | i } n | | i i j o | i | | j p | | i i j o. | i | | | i | t } | i | =q| i | d | i | =q | i | d q Wt | i d j o | i d n x6 | i i D]% \ } } | i | | | t } qW| o | i n | i y t
| i d } Wn$ t i | t d | i n Xt i | i d x$ t
| d D] } | i | qqW| i t i | d S( Ni s %s.olds %s/%st configt wR+ is
i R, R- i R. iR$ s Permission denied: '%s'i ( R1 R t ost patht existsR t shutilt copy2t tempfilet mkdtempR/ R
R R0 t writeR2 R% R" t _writet TrueR( R3 t rmtreet IOErrort chmod(
R t temp_dirt temp_filet fdt modifiedR4 R5 R6 R R& ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRA sz
$5
c C sZ t | t i p t | t i o d i | } n | } | i d | | f d S( Nt s %s="%s"
( t
isinstancet typest ListTypet TupleTypet joinRA ( R RI R R& t val( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRB s
( R
R R! R R R# R R* R7 RA RB ( ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR T s Kt ip6tablesConfigc B s e Z d Z RS( t
IP6TABLES_( R
R R! ( ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRR s t
iptablesClassc B s e Z d Z d Z d Z d Z d Z d d Z e d Z e d Z
e d Z e d
Z e d Z
e d Z e d
Z e d Z d Z RS( R t ipv4c C s
| | _ d S( N( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s c " C s0
| i d j o
d } n d } g } g } g } | i o t | i d j o x | i D] \ } } } | | i j o q\ n t i i | p t i i | o q\ n | d j o | i | q\ | d j o | i | q\ | d j o | i | q\ q\ Wn t i i | i o t i
| i d | i n t } t }
| i o8 x5 | i D]& } | i
d o
t }
qgt } qgWn d
} t | i d }
t i | i d |
i d
|
i d t | d j p | i d j o3| o,|
i d |
i d |
i d |
i d |
i d |
i d x | D] } t |
| qYW| i d j o | i o t | i d j o x| | i D]m } | i
d o qn | i | d } | | d <| d 7} |
i d | d | d | | d f qWn |
i d n | i d j o| i o t | i d j p3 t | d j p | i owt | i d j oa|
i d |
i d |
i d |
i d | i o) x& | i D] } |
i d | qWn | i o x | i D] } | i | d } d } d } | i
d o | | d 7} n d | d } | i
d o" | d! | i | d d" 7} n |
i d# | d | d | | | f qWn x | D] } t |
| qW|
i d n |
i d$ |
i d |
i d |
i d |
i d% | i | |
d& | |
i d' | i d( j o |
i d) n | i o) x& | i D] } |
i d* | qWn | i d j o | i o x | i D] } | i
d o qn d+ | d | d | d f } | i
d o | d, | i | d 7} n | d- | d 7} | d. 7} |
i | qWn | i o t | i d j ox| i D] } t i | } x | i D] \ } } d } d } d } | dB j o d1 } d2 | | f } n) | i d j o d3 | } n d4 | } | o d5 | } n | i i
| i o d6 | i | i } n |
i d7 | | | | d8 qWqWn | i oW t | i d j oA x> | i D]/ \ } } |
i d9 | | | i | f qWn | i o t | i d j pG | i d j o | i o t | i d j p | i d j ok|
od|
i d: | i | |
d; | |
i d< | i o) x& | i D] } |
i d= | qWn | i d j o3 | i o) x& | i D] } |
i d> | qWn | i d j o | i o |
o x | i D] } | i
d p q+ n | i
d o | i | d } n | i | d } |
i d? | d | d | d | d | f q+ Wq n t | d j o" x | D] } t |
| q Wn |
i d@ | |
i dA | |
i d |
i d S(C NRU s icmp-host-prohibiteds icmp6-adm-prohibitedi t manglet natt filters %s.oldt toaddrid R9 i s; # Firewall configuration written by system-config-firewall
s8 # Manual customization of this file is not recommended.
s *mangle
s :PREROUTING ACCEPT [0:0]
s :INPUT ACCEPT [0:0]
s :FORWARD ACCEPT [0:0]
s :OUTPUT ACCEPT [0:0]
s :POSTROUTING ACCEPT [0:0]
t portt marki s= -A PREROUTING -i %s -p %s --dport %s -j MARK --set-mark 0x%x
t ift protos COMMIT
s *nat
s# -A POSTROUTING -o %s -j MASQUERADE
R' s -m mark --mark 0x%x t toports :%st -sC -A PREROUTING -i %s -p %s --dport %s %s-j DNAT --to-destination %s
s *filter
s8 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
t INPUTs -A INPUT -i lo -j ACCEPT
t ipv6sO -A INPUT -m state --state NEW -m udp -p udp --dport 546 -d fe80::/64 -j ACCEPT
s -A INPUT -i %s -j ACCEPT
s/ -A INPUT -i %s -m state --state NEW -m %s -p %ss --dport %ss -m mark --mark 0x%xs -j ACCEPT
t tcpt udps -m state --state NEW s -m %s -p %s s -p %s s -m ipv6header --header %s s --dport %s s -d %s s -A INPUT s
-j ACCEPT
s? -A INPUT -m state --state NEW -m %s -p %s --dport %s -j ACCEPT
s: -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
t FORWARDs -A FORWARD -i lo -j ACCEPT
s -A FORWARD -i %s -j ACCEPT
s -A FORWARD -o %s -j ACCEPT
sM -A FORWARD -i %s -m state --state NEW -m %s -p %s -d %s --dport %s -j ACCEPT
s$ -A INPUT -j REJECT --reject-with %s
s& -A FORWARD -j REJECT --reject-with %s
( Rb Rc ( t typet custom_rulesR1 R: R; R< t isfilet appendR R= R> R
t forward_portt has_keyRC R/ RF RA t catFilet _portStrt masqt _icmpt trustt servicest fw_servicesR t portst destinationR3 ( R t conft reject_typet
custom_manglet
custom_natt
custom_filtert _typet tableR t
local_forwardt remote_forwardt fwdt mark_idxRI RZ t devt toR[ R5 t servicet svcR] t _statet _destt _portt _protoRr t _filename( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRA sZ
*
3
" '
" 0
!
c C s | i d j o d } d } n
d } d } xd | i D]Y } t i | } | i o | i | i j o q6 n | i d | | | | | f q6 W| i d | | f d S( NRU s -p icmps -m icmp --icmp-types -p ipv6-icmps -m icmp6 --icmpv6-types* -A %s %s %s %s -j REJECT --reject-with %s
s -A %s %s -j ACCEPT
( Re t
block_icmpt fw_icmpR RA ( R Rt RI t chainRu R] t matchR t icmp( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRn s
t :c C s9 t | d j o d | Sd | d | | d f Sd S( Ni s %ss %s%s%si ( R1 ( R RZ t delimiter( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRl s c C s< d | | i | f } | p | d 7} n t i | d ?S( Ns %s %s %ss >/dev/null 2>&1i ( t progR: t system( R R t argt verboset cmd( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt _run s c C s | i d d | S( Ns
/sbin/servicet start( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s c C s | i d d | S( Ns
/sbin/servicet restart( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s c C s | i d d | S( Ns
/sbin/servicet condrestart( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s c C s | i d d | S( Ns
/sbin/servicet status( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s c C s | i d d | S( Ns
/sbin/servicet stop( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s c C s | i d d | S( Ns /sbin/chkconfigt on( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt chkconfig_on s c C s | i d d | S( Ns /sbin/chkconfigt off( R ( R R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt
chkconfig_off s c C sD t i i | i o* t i i | i o t i | i n d S( N( R: R; R< R Rg t unlink( R ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR s ,( R
R R Re R RA Rn Rl R
R R R R R R R R R ( ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyRT s t ip6tablesClassc B s e Z d Z d Z RS( R Ra ( R
R R Re ( ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyR
s ( R: t os.pathR? R= RM Rq R t fw_configR t fw_functionsR RC R R R R RR RT R ( ( ( s0 /usr/share/system-config-firewall/fw_iptables.pyt <module> s@
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`
