Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:26
📄 __init__.py ''' Nfnetlink ========= The support of nfnetlink families is now at the very beginning. So there is no public exports yet, but you can review the code. Work is in progress, stay tuned. nf-queue ++++++++ Netfilter protocol for NFQUEUE iptables target. ''' from pyroute2.netlink import nlmsg NFNL_SUBSYS_NONE = 0 NFNL_SUBSYS_CTNETLINK = 1 NFNL_SUBSYS_CTNETLINK_EXP = 2 NFNL_SUBSYS_QUEUE = 3 NFNL_SUBSYS_ULOG = 4 NFNL_SUBSYS_OSF = 5 NFNL_SUBSYS_IPSET = 6 NFNL_SUBSYS_ACCT = 7 NFNL_SUBSYS_CTNETLINK_TIMEOUT = 8 NFNL_SUBSYS_CTHELPER = 9 NFNL_SUBSYS_NFTABLES = 10 NFNL_SUBSYS_NFT_COMPAT = 11 NFNL_SUBSYS_COUNT = 12 # multicast group ids (for use with {add,drop}_membership) NFNLGRP_NONE = 0 NFNLGRP_CONNTRACK_NEW = 1 NFNLGRP_CONNTRACK_UPDATE = 2 NFNLGRP_CONNTRACK_DESTROY = 3 NFNLGRP_CONNTRACK_EXP_NEW = 4 NFNLGRP_CONNTRACK_EXP_UPDATE = 5 NFNLGRP_CONNTRACK_EXP_DESTROY = 6 NFNLGRP_NFTABLES = 7 NFNLGRP_ACCT_QUOTA = 8 NFNLGRP_NFTRACE = 9 class nfgen_msg(nlmsg): fields = (('nfgen_family', 'B'), ('version', 'B'), ('res_id', '!H'))	1.01 KB	2025-05-25 12:26
📁 __pycache__	-	2025-05-25 12:26
📄 ipset.py from pyroute2.netlink import NLA_F_NESTED, NLA_F_NET_BYTEORDER, nla from pyroute2.netlink.nfnetlink import NFNL_SUBSYS_IPSET, nfgen_msg IPSET_MAXNAMELEN = 32 IPSET_DEFAULT_MAXELEM = 65536 IPSET_CMD_NONE = 0 IPSET_CMD_PROTOCOL = 1 # Return protocol version IPSET_CMD_CREATE = 2 # Create a new (empty) set IPSET_CMD_DESTROY = 3 # Destroy a (empty) set IPSET_CMD_FLUSH = 4 # Remove all elements from a set IPSET_CMD_RENAME = 5 # Rename a set IPSET_CMD_SWAP = 6 # Swap two sets IPSET_CMD_LIST = 7 # List sets IPSET_CMD_SAVE = 8 # Save sets IPSET_CMD_ADD = 9 # Add an element to a set IPSET_CMD_DEL = 10 # Delete an element from a set IPSET_CMD_TEST = 11 # Test an element in a set IPSET_CMD_HEADER = 12 # Get set header data only IPSET_CMD_TYPE = 13 # 13: Get set type IPSET_CMD_GET_BYNAME = 14 # 14: Get set index by name IPSET_CMD_GET_BYINDEX = 15 # 15: Get set index by index # flags at command level (IPSET_ATTR_FLAGS) IPSET_FLAG_LIST_SETNAME = 1 << 1 IPSET_FLAG_LIST_HEADER = 1 << 2 IPSET_FLAG_SKIP_COUNTER_UPDATE = 1 << 3 IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE = 1 << 4 IPSET_FLAG_MATCH_COUNTERS = 1 << 5 IPSET_FLAG_RETURN_NOMATCH = 1 << 7 # flags at cadt attribute (IPSET_ATTR_CADT_FLAGS) IPSET_FLAG_PHYSDEV = 1 << 1 IPSET_FLAG_NOMATCH = 1 << 2 IPSET_FLAG_WITH_COUNTERS = 1 << 3 IPSET_FLAG_WITH_COMMENT = 1 << 4 IPSET_FLAG_WITH_FORCEADD = 1 << 5 IPSET_FLAG_WITH_SKBINFO = 1 << 6 IPSET_FLAG_IFACE_WILDCARD = 1 << 7 IPSET_ERR_PROTOCOL = 4097 IPSET_ERR_FIND_TYPE = 4098 IPSET_ERR_MAX_SETS = 4099 IPSET_ERR_BUSY = 4100 IPSET_ERR_EXIST_SETNAME2 = 4101 IPSET_ERR_TYPE_MISMATCH = 4102 IPSET_ERR_EXIST = 4103 IPSET_ERR_INVALID_CIDR = 4104 IPSET_ERR_INVALID_NETMASK = 4105 IPSET_ERR_INVALID_FAMILY = 4106 IPSET_ERR_TIMEOUT = 4107 IPSET_ERR_REFERENCED = 4108 IPSET_ERR_IPADDR_IPV4 = 4109 IPSET_ERR_IPADDR_IPV6 = 4110 IPSET_ERR_COUNTER = 4111 IPSET_ERR_COMMENT = 4112 IPSET_ERR_INVALID_MARKMASK = 4113 IPSET_ERR_SKBINFO = 4114 IPSET_ERR_TYPE_SPECIFIC = 4352 class ipset_base(nla): class ipset_ip(nla): nla_flags = NLA_F_NESTED nla_map = ( ('IPSET_ATTR_UNSPEC', 'none'), ('IPSET_ATTR_IPADDR_IPV4', 'ip4addr', NLA_F_NET_BYTEORDER), ('IPSET_ATTR_IPADDR_IPV6', 'ip6addr', NLA_F_NET_BYTEORDER), ) class ipset_msg(nfgen_msg): ''' Since the support just begins to be developed, many attrs are still in `hex` format -- just to dump the content. ''' nla_map = ( ('IPSET_ATTR_UNSPEC', 'none'), ('IPSET_ATTR_PROTOCOL', 'uint8'), ('IPSET_ATTR_SETNAME', 'asciiz'), ('IPSET_ATTR_TYPENAME', 'asciiz'), ('IPSET_ATTR_REVISION', 'uint8'), ('IPSET_ATTR_FAMILY', 'uint8'), ('IPSET_ATTR_FLAGS', 'be32'), ('IPSET_ATTR_DATA', 'get_data_type'), ('IPSET_ATTR_ADT', 'attr_adt'), ('IPSET_ATTR_LINENO', 'be32'), ('IPSET_ATTR_PROTOCOL_MIN', 'uint8'), ('IPSET_ATTR_INDEX', 'be16'), ) @staticmethod def get_data_type(self, args, *kwargs): # create and list commands have specific attributes. See linux_ip_set.h # for more information (and/or lib/PROTOCOL of ipset sources) cmd = self['header']['type'] & ~(NFNL_SUBSYS_IPSET << 8) if cmd == IPSET_CMD_CREATE or cmd == IPSET_CMD_LIST: return self.cadt_data return self.ipset_generic.adt_data class ipset_generic(ipset_base): class adt_data(ipset_base): nla_flags = NLA_F_NESTED nla_map = ( (0, 'IPSET_ATTR_UNSPEC', 'none'), (1, 'IPSET_ATTR_IP', 'ipset_ip'), (1, 'IPSET_ATTR_IP_FROM', 'ipset_ip'), (2, 'IPSET_ATTR_IP_TO', 'ipset_ip'), (3, 'IPSET_ATTR_CIDR', 'be8', NLA_F_NET_BYTEORDER), (4, 'IPSET_ATTR_PORT', 'be16', NLA_F_NET_BYTEORDER), (4, 'IPSET_ATTR_PORT_FROM', 'be16', NLA_F_NET_BYTEORDER), (5, 'IPSET_ATTR_PORT_TO', 'be16', NLA_F_NET_BYTEORDER), (6, 'IPSET_ATTR_TIMEOUT', 'be32', NLA_F_NET_BYTEORDER), (7, 'IPSET_ATTR_PROTO', 'be8', NLA_F_NET_BYTEORDER), (8, 'IPSET_ATTR_CADT_FLAGS', 'be32', NLA_F_NET_BYTEORDER), (9, 'IPSET_ATTR_CADT_LINENO', 'be32'), (10, 'IPSET_ATTR_MARK', 'be32', NLA_F_NET_BYTEORDER), (11, 'IPSET_ATTR_MARKMASK', 'be32', NLA_F_NET_BYTEORDER), (17, 'IPSET_ATTR_ETHER', 'l2addr'), (18, 'IPSET_ATTR_NAME', 'asciiz'), (19, 'IPSET_ATTR_NAMEREF', 'be32'), (20, 'IPSET_ATTR_IP2', 'ipset_ip'), (21, 'IPSET_ATTR_CIDR2', 'be8', NLA_F_NET_BYTEORDER), (22, 'IPSET_ATTR_IP2_TO', 'ipset_ip'), (23, 'IPSET_ATTR_IFACE', 'asciiz'), (24, 'IPSET_ATTR_BYTES', 'be64', NLA_F_NET_BYTEORDER), (25, 'IPSET_ATTR_PACKETS', 'be64', NLA_F_NET_BYTEORDER), (26, 'IPSET_ATTR_COMMENT', 'asciiz'), (27, 'IPSET_ATTR_SKBMARK', 'skbmark'), (28, 'IPSET_ATTR_SKBPRIO', 'skbprio'), (29, 'IPSET_ATTR_SKBQUEUE', 'be16', NLA_F_NET_BYTEORDER), ) class skbmark(nla): nla_flags = NLA_F_NET_BYTEORDER fields = [('value', '>II')] class skbprio(nla): nla_flags = NLA_F_NET_BYTEORDER fields = [('value', '>HH')] class cadt_data(ipset_base): nla_flags = NLA_F_NESTED nla_map = ( (0, 'IPSET_ATTR_UNSPEC', 'none'), (1, 'IPSET_ATTR_IP', 'ipset_ip'), (1, 'IPSET_ATTR_IP_FROM', 'ipset_ip'), (2, 'IPSET_ATTR_IP_TO', 'ipset_ip'), (3, 'IPSET_ATTR_CIDR', 'be8', NLA_F_NET_BYTEORDER), (4, 'IPSET_ATTR_PORT', 'be16', NLA_F_NET_BYTEORDER), (4, 'IPSET_ATTR_PORT_FROM', 'be16', NLA_F_NET_BYTEORDER), (5, 'IPSET_ATTR_PORT_TO', 'be16', NLA_F_NET_BYTEORDER), (6, 'IPSET_ATTR_TIMEOUT', 'be32', NLA_F_NET_BYTEORDER), (7, 'IPSET_ATTR_PROTO', 'be8', NLA_F_NET_BYTEORDER), (8, 'IPSET_ATTR_CADT_FLAGS', 'be32', NLA_F_NET_BYTEORDER), (9, 'IPSET_ATTR_CADT_LINENO', 'be32'), (10, 'IPSET_ATTR_MARK', 'be32', NLA_F_NET_BYTEORDER), (11, 'IPSET_ATTR_MARKMASK', 'be32', NLA_F_NET_BYTEORDER), (17, 'IPSET_ATTR_INITVAL', 'be32', NLA_F_NET_BYTEORDER), (18, 'IPSET_ATTR_HASHSIZE', 'be32', NLA_F_NET_BYTEORDER), (19, 'IPSET_ATTR_MAXELEM', 'be32', NLA_F_NET_BYTEORDER), (20, 'IPSET_ATTR_NETMASK', 'hex'), (21, 'IPSET_ATTR_BUCKETSIZE', 'uint8'), (22, 'IPSET_ATTR_RESIZE', 'hex'), (23, 'IPSET_ATTR_SIZE', 'be32', NLA_F_NET_BYTEORDER), (24, 'IPSET_ATTR_ELEMENTS', 'be32', NLA_F_NET_BYTEORDER), (25, 'IPSET_ATTR_REFERENCES', 'be32', NLA_F_NET_BYTEORDER), (26, 'IPSET_ATTR_MEMSIZE', 'be32', NLA_F_NET_BYTEORDER), ) class attr_adt(ipset_generic): nla_flags = NLA_F_NESTED nla_map = ((7, 'IPSET_ATTR_DATA', 'adt_data'),)	6.98 KB	2025-05-25 12:26
📄 nfctsocket.py """ NFCTSocket -- low level connection tracking API See also: pyroute2.conntrack """ import socket from pyroute2.netlink import ( NETLINK_NETFILTER, NLA_F_NESTED, NLM_F_ACK, NLM_F_CREATE, NLM_F_DUMP, NLM_F_EXCL, NLM_F_REQUEST, NLMSG_ERROR, nla, ) from pyroute2.netlink.nfnetlink import NFNL_SUBSYS_CTNETLINK, nfgen_msg from pyroute2.netlink.nlsocket import NetlinkSocket IPCTNL_MSG_CT_NEW = 0 IPCTNL_MSG_CT_GET = 1 IPCTNL_MSG_CT_DELETE = 2 IPCTNL_MSG_CT_GET_CTRZERO = 3 IPCTNL_MSG_CT_GET_STATS_CPU = 4 IPCTNL_MSG_CT_GET_STATS = 5 IPCTNL_MSG_CT_GET_DYING = 6 IPCTNL_MSG_CT_GET_UNCONFIRMED = 7 IPCTNL_MSG_MAX = 8 try: IP_PROTOCOLS = { num: name[8:] for name, num in vars(socket).items() if name.startswith("IPPROTO") } except (IOError, OSError): IP_PROTOCOLS = {} # Window scaling is advertised by the sender IP_CT_TCP_FLAG_WINDOW_SCALE = 0x01 # SACK is permitted by the sender IP_CT_TCP_FLAG_SACK_PERM = 0x02 # This sender sent FIN first IP_CT_TCP_FLAG_CLOSE_INIT = 0x04 # Be liberal in window checking IP_CT_TCP_FLAG_BE_LIBERAL = 0x08 # Has unacknowledged data IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED = 0x10 # The field td_maxack has been set IP_CT_TCP_FLAG_MAXACK_SET = 0x20 # From linux/include/net/tcp_states.h TCPF_ESTABLISHED = 1 << 1 TCPF_SYN_SENT = 1 << 2 TCPF_SYN_RECV = 1 << 3 TCPF_FIN_WAIT1 = 1 << 4 TCPF_FIN_WAIT2 = 1 << 5 TCPF_TIME_WAIT = 1 << 6 TCPF_CLOSE = 1 << 7 TCPF_CLOSE_WAIT = 1 << 8 TCPF_LAST_ACK = 1 << 9 TCPF_LISTEN = 1 << 10 TCPF_CLOSING = 1 << 11 TCPF_NEW_SYN_RECV = 1 << 12 TCPF_TO_NAME = { TCPF_ESTABLISHED: 'ESTABLISHED', TCPF_SYN_SENT: 'SYN_SENT', TCPF_SYN_RECV: 'SYN_RECV', TCPF_FIN_WAIT1: 'FIN_WAIT1', TCPF_FIN_WAIT2: 'FIN_WAIT2', TCPF_TIME_WAIT: 'TIME_WAIT', TCPF_CLOSE: 'CLOSE', TCPF_CLOSE_WAIT: 'CLOSE_WAIT', TCPF_LAST_ACK: 'LAST_ACK', TCPF_LISTEN: 'LISTEN', TCPF_CLOSING: 'CLOSING', TCPF_NEW_SYN_RECV: 'NEW_SYN_RECV', } # From include/uapi/linux/netfilter/nf_conntrack_common.h IPS_EXPECTED = 1 << 0 IPS_SEEN_REPLY = 1 << 1 IPS_ASSURED = 1 << 2 IPS_CONFIRMED = 1 << 3 IPS_SRC_NAT = 1 << 4 IPS_DST_NAT = 1 << 5 IPS_NAT_MASK = IPS_DST_NAT \| IPS_SRC_NAT IPS_SEQ_ADJUST = 1 << 6 IPS_SRC_NAT_DONE = 1 << 7 IPS_DST_NAT_DONE = 1 << 8 IPS_NAT_DONE_MASK = IPS_DST_NAT_DONE \| IPS_SRC_NAT_DONE IPS_DYING = 1 << 9 IPS_FIXED_TIMEOUT = 1 << 10 IPS_TEMPLATE = 1 << 11 IPS_UNTRACKED = 1 << 12 IPS_HELPER = 1 << 13 IPS_OFFLOAD = 1 << 14 IPS_UNCHANGEABLE_MASK = ( IPS_NAT_DONE_MASK \| IPS_NAT_MASK \| IPS_EXPECTED \| IPS_CONFIRMED \| IPS_DYING \| IPS_SEQ_ADJUST \| IPS_TEMPLATE \| IPS_OFFLOAD ) IPSBIT_TO_NAME = { IPS_EXPECTED: 'EXPECTED', IPS_SEEN_REPLY: 'SEEN_REPLY', IPS_ASSURED: 'ASSURED', IPS_CONFIRMED: 'CONFIRMED', IPS_SRC_NAT: 'SRC_NAT', IPS_DST_NAT: 'DST_NAT', IPS_SEQ_ADJUST: 'SEQ_ADJUST', IPS_SRC_NAT_DONE: 'SRC_NAT_DONE', IPS_DST_NAT_DONE: 'DST_NAT_DONE', IPS_DYING: 'DYING', IPS_FIXED_TIMEOUT: 'FIXED_TIMEOUT', IPS_TEMPLATE: 'TEMPLATE', IPS_UNTRACKED: 'UNTRACKED', IPS_HELPER: 'HELPER', IPS_OFFLOAD: 'OFFLOAD', } # From include/uapi/linux/netfilter/nf_conntrack_tcp.h IP_CT_TCP_FLAG_WINDOW_SCALE = 0x01 IP_CT_TCP_FLAG_SACK_PERM = 0x02 IP_CT_TCP_FLAG_CLOSE_INIT = 0x04 IP_CT_TCP_FLAG_BE_LIBERAL = 0x08 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED = 0x10 IP_CT_TCP_FLAG_MAXACK_SET = 0x20 IP_CT_EXP_CHALLENGE_ACK = 0x40 IP_CT_TCP_SIMULTANEOUS_OPEN = 0x80 IP_CT_TCP_FLAG_TO_NAME = { IP_CT_TCP_FLAG_WINDOW_SCALE: 'WINDOW_SCALE', IP_CT_TCP_FLAG_SACK_PERM: 'SACK_PERM', IP_CT_TCP_FLAG_CLOSE_INIT: 'CLOSE_INIT', IP_CT_TCP_FLAG_BE_LIBERAL: 'BE_LIBERAL', IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED: 'DATA_UNACKNOWLEDGED', IP_CT_TCP_FLAG_MAXACK_SET: 'MAXACK_SET', IP_CT_EXP_CHALLENGE_ACK: 'CHALLENGE_ACK', IP_CT_TCP_SIMULTANEOUS_OPEN: 'SIMULTANEOUS_OPEN', } # From linux/include/uapi/linux/netfilter/nf_conntrack_tcp.h TCP_CONNTRACK_SYN_SENT = 1 TCP_CONNTRACK_SYN_RECV = 2 TCP_CONNTRACK_ESTABLISHED = 3 TCP_CONNTRACK_FIN_WAIT = 4 TCP_CONNTRACK_CLOSE_WAIT = 5 TCP_CONNTRACK_LAST_ACK = 6 TCP_CONNTRACK_TIME_WAIT = 7 TCP_CONNTRACK_CLOSE = 8 TCP_CONNTRACK_LISTEN = 9 TCP_CONNTRACK_MAX = 10 TCP_CONNTRACK_IGNORE = 11 TCP_CONNTRACK_RETRANS = 12 TCP_CONNTRACK_UNACK = 13 TCP_CONNTRACK_TIMEOUT_MAX = 14 TCP_CONNTRACK_TO_NAME = { TCP_CONNTRACK_SYN_SENT: "SYN_SENT", TCP_CONNTRACK_SYN_RECV: "SYN_RECV", TCP_CONNTRACK_ESTABLISHED: "ESTABLISHED", TCP_CONNTRACK_FIN_WAIT: "FIN_WAIT", TCP_CONNTRACK_CLOSE_WAIT: "CLOSE_WAIT", TCP_CONNTRACK_LAST_ACK: "LAST_ACK", TCP_CONNTRACK_TIME_WAIT: "TIME_WAIT", TCP_CONNTRACK_CLOSE: "CLOSE", TCP_CONNTRACK_LISTEN: "LISTEN", TCP_CONNTRACK_MAX: "MAX", TCP_CONNTRACK_IGNORE: "IGNORE", TCP_CONNTRACK_RETRANS: "RETRANS", TCP_CONNTRACK_UNACK: "UNACK", TCP_CONNTRACK_TIMEOUT_MAX: "TIMEOUT_MAX", } def terminate_single_msg(msg): return msg def terminate_error_msg(msg): return msg['header']['type'] == NLMSG_ERROR class nfct_stats(nfgen_msg): nla_map = ( ('CTA_STATS_GLOBAL_UNSPEC', 'none'), ('CTA_STATS_GLOBAL_ENTRIES', 'be32'), ('CTA_STATS_GLOBAL_MAX_ENTRIES', 'be32'), ) class nfct_stats_cpu(nfgen_msg): nla_map = ( ('CTA_STATS_UNSPEC', 'none'), ('CTA_STATS_SEARCHED', 'be32'), ('CTA_STATS_FOUND', 'be32'), ('CTA_STATS_NEW', 'be32'), ('CTA_STATS_INVALID', 'be32'), ('CTA_STATS_IGNORE', 'be32'), ('CTA_STATS_DELETE', 'be32'), ('CTA_STATS_DELETE_LIST', 'be32'), ('CTA_STATS_INSERT', 'be32'), ('CTA_STATS_INSERT_FAILED', 'be32'), ('CTA_STATS_DROP', 'be32'), ('CTA_STATS_EARLY_DROP', 'be32'), ('CTA_STATS_ERROR', 'be32'), ('CTA_STATS_SEARCH_RESTART', 'be32'), ) class nfct_msg(nfgen_msg): prefix = 'CTA_' nla_map = ( ('CTA_UNSPEC', 'none'), ('CTA_TUPLE_ORIG', 'cta_tuple'), ('CTA_TUPLE_REPLY', 'cta_tuple'), ('CTA_STATUS', 'be32'), ('CTA_PROTOINFO', 'cta_protoinfo'), ('CTA_HELP', 'asciiz'), ('CTA_NAT_SRC', 'cta_nat'), ('CTA_TIMEOUT', 'be32'), ('CTA_MARK', 'be32'), ('CTA_COUNTERS_ORIG', 'cta_counters'), ('CTA_COUNTERS_REPLY', 'cta_counters'), ('CTA_USE', 'be32'), ('CTA_ID', 'be32'), ('CTA_NAT_DST', 'cta_nat'), ('CTA_TUPLE_MASTER', 'cta_tuple'), ('CTA_SEQ_ADJ_ORIG', 'cta_nat_seq_adj'), ('CTA_SEQ_ADJ_REPLY', 'cta_nat_seq_adj'), ('CTA_SECMARK', 'be32'), ('CTA_ZONE', 'be16'), ('CTA_SECCTX', 'cta_secctx'), ('CTA_TIMESTAMP', 'cta_timestamp'), ('CTA_MARK_MASK', 'be32'), ('CTA_LABELS', 'cta_labels'), ('CTA_LABELS_MASK', 'cta_labels'), ('CTA_SYNPROXY', 'cta_synproxy'), ('CTA_FILTER', 'cta_filter'), ('CTA_STATUS_MASK', 'be32'), ) @classmethod def create_from(cls, kwargs): self = cls() for key, value in kwargs.items(): if isinstance(value, NFCTAttr): value = {'attrs': value.attrs()} if value is not None: self['attrs'].append([self.name2nla(key), value]) return self class cta_tuple(nla): nla_map = ( ('CTA_TUPLE_UNSPEC', 'none'), ('CTA_TUPLE_IP', 'cta_ip'), ('CTA_TUPLE_PROTO', 'cta_proto'), ) class cta_ip(nla): nla_map = ( ('CTA_IP_UNSPEC', 'none'), ('CTA_IP_V4_SRC', 'ip4addr'), ('CTA_IP_V4_DST', 'ip4addr'), ('CTA_IP_V6_SRC', 'ip6addr'), ('CTA_IP_V6_DST', 'ip6addr'), ) class cta_proto(nla): nla_map = ( ('CTA_PROTO_UNSPEC', 'none'), ('CTA_PROTO_NUM', 'uint8'), ('CTA_PROTO_SRC_PORT', 'be16'), ('CTA_PROTO_DST_PORT', 'be16'), ('CTA_PROTO_ICMP_ID', 'be16'), ('CTA_PROTO_ICMP_TYPE', 'uint8'), ('CTA_PROTO_ICMP_CODE', 'uint8'), ('CTA_PROTO_ICMPV6_ID', 'be16'), ('CTA_PROTO_ICMPV6_TYPE', 'uint8'), ('CTA_PROTO_ICMPV6_CODE', 'uint8'), ) class cta_protoinfo(nla): nla_map = ( ('CTA_PROTOINFO_UNSPEC', 'none'), ('CTA_PROTOINFO_TCP', 'cta_protoinfo_tcp'), ('CTA_PROTOINFO_DCCP', 'cta_protoinfo_dccp'), ('CTA_PROTOINFO_SCTP', 'cta_protoinfo_sctp'), ) class cta_protoinfo_tcp(nla): nla_map = ( ('CTA_PROTOINFO_TCP_UNSPEC', 'none'), ('CTA_PROTOINFO_TCP_STATE', 'uint8'), ('CTA_PROTOINFO_TCP_WSCALE_ORIGINAL', 'uint8'), ('CTA_PROTOINFO_TCP_WSCALE_REPLY', 'uint8'), ('CTA_PROTOINFO_TCP_FLAGS_ORIGINAL', 'cta_tcp_flags'), ('CTA_PROTOINFO_TCP_FLAGS_REPLY', 'cta_tcp_flags'), ) class cta_tcp_flags(nla): fields = [('value', 'BB')] class cta_protoinfo_dccp(nla): nla_map = ( ('CTA_PROTOINFO_DCCP_UNSPEC', 'none'), ('CTA_PROTOINFO_DCCP_STATE', 'uint8'), ('CTA_PROTOINFO_DCCP_ROLE', 'uint8'), ('CTA_PROTOINFO_DCCP_HANDSHAKE_SEQ', 'be64'), ) class cta_protoinfo_sctp(nla): nla_map = ( ('CTA_PROTOINFO_SCTP_UNSPEC', 'none'), ('CTA_PROTOINFO_SCTP_STATE', 'uint8'), ('CTA_PROTOINFO_SCTP_VTAG_ORIGINAL', 'be32'), ('CTA_PROTOINFO_SCTP_VTAG_REPLY', 'be32'), ) class cta_nat(nla): nla_map = ( ('CTA_NAT_UNSPEC', 'none'), ('CTA_NAT_V4_MINIP', 'ip4addr'), ('CTA_NAT_V4_MAXIP', 'ip4addr'), ('CTA_NAT_PROTO', 'cta_protonat'), ('CTA_NAT_V6_MINIP', 'ip6addr'), ('CTA_NAT_V6_MAXIP', 'ip6addr'), ) class cta_protonat(nla): nla_map = ( ('CTA_PROTONAT_UNSPEC', 'none'), ('CTA_PROTONAT_PORT_MIN', 'be16'), ('CTA_PROTONAT_PORT_MAX', 'be16'), ) class cta_nat_seq_adj(nla): nla_map = ( ('CTA_NAT_SEQ_UNSPEC', 'none'), ('CTA_NAT_SEQ_CORRECTION_POS', 'be32'), ('CTA_NAT_SEQ_OFFSET_BEFORE', 'be32'), ('CTA_NAT_SEQ_OFFSET_AFTER', 'be32'), ) class cta_counters(nla): nla_map = ( ('CTA_COUNTERS_UNSPEC', 'none'), ('CTA_COUNTERS_PACKETS', 'be64'), ('CTA_COUNTERS_BYTES', 'be64'), ('CTA_COUNTERS32_PACKETS', 'be32'), ('CTA_COUNTERS32_BYTES', 'be32'), ) class cta_secctx(nla): nla_map = ( ('CTA_SECCTX_UNSPEC', 'none'), ('CTA_SECCTX_NAME', 'asciiz'), ) class cta_timestamp(nla): nla_map = ( ('CTA_TIMESTAMP_UNSPEC', 'none'), ('CTA_TIMESTAMP_START', 'be64'), ('CTA_TIMESTAMP_STOP', 'be64'), ) class cta_filter(nla): nla_flags = NLA_F_NESTED nla_map = ( ('CTA_FILTER_UNSPEC', 'none'), ('CTA_FILTER_ORIG_FLAGS', 'uint32'), ('CTA_FILTER_REPLY_FLAGS', 'uint32'), ) class cta_labels(nla): fields = [('value', 'QQ')] def encode(self): if not isinstance(self['value'], tuple): self['value'] = ( self['value'] & 0xFFFFFFFFFFFFFFFF, self['value'] >> 64, ) nla.encode(self) def decode(self): nla.decode(self) if isinstance(self['value'], tuple): self['value'] = (self['value'][0] & 0xFFFFFFFFFFFFFFFF) \| ( self['value'][1] << 64 ) class cta_synproxy(nla): nla_map = ( ('CTA_SYNPROXY_UNSPEC', 'none'), ('CTA_SYNPROXY_ISN', 'be32'), ('CTA_SYNPROXY_ITS', 'be32'), ('CTA_SYNPROXY_TSOFF', 'be32'), ) FILTER_FLAG_CTA_IP_SRC = 1 << 0 FILTER_FLAG_CTA_IP_DST = 1 << 1 FILTER_FLAG_CTA_TUPLE_ZONE = 1 << 2 FILTER_FLAG_CTA_PROTO_NUM = 1 << 3 FILTER_FLAG_CTA_PROTO_SRC_PORT = 1 << 4 FILTER_FLAG_CTA_PROTO_DST_PORT = 1 << 5 FILTER_FLAG_CTA_PROTO_ICMP_TYPE = 1 << 6 FILTER_FLAG_CTA_PROTO_ICMP_CODE = 1 << 7 FILTER_FLAG_CTA_PROTO_ICMP_ID = 1 << 8 FILTER_FLAG_CTA_PROTO_ICMPV6_TYPE = 1 << 9 FILTER_FLAG_CTA_PROTO_ICMPV6_CODE = 1 << 10 FILTER_FLAG_CTA_PROTO_ICMPV6_ID = 1 << 11 FILTER_FLAG_ALL_CTA_PROTO = ( FILTER_FLAG_CTA_PROTO_SRC_PORT \| FILTER_FLAG_CTA_PROTO_DST_PORT \| FILTER_FLAG_CTA_PROTO_ICMP_TYPE \| FILTER_FLAG_CTA_PROTO_ICMP_CODE \| FILTER_FLAG_CTA_PROTO_ICMP_ID \| FILTER_FLAG_CTA_PROTO_ICMPV6_TYPE \| FILTER_FLAG_CTA_PROTO_ICMPV6_CODE \| FILTER_FLAG_CTA_PROTO_ICMPV6_ID ) FILTER_FLAG_ALL = 0xFFFFFFFF class NFCTAttr(object): def attrs(self): return [] class NFCTAttrTuple(NFCTAttr): __slots__ = ( 'saddr', 'daddr', 'proto', 'sport', 'dport', 'icmp_id', 'icmp_type', 'family', '_attr_ip', '_attr_icmp', ) def __init__( self, family=socket.AF_INET, saddr=None, daddr=None, proto=None, sport=None, dport=None, icmp_id=None, icmp_type=None, icmp_code=None, ): self.saddr = saddr self.daddr = daddr self.proto = proto self.sport = sport self.dport = dport self.icmp_id = icmp_id self.icmp_type = icmp_type self.icmp_code = icmp_code self.family = family self._attr_ip, self._attr_icmp = { socket.AF_INET: ['CTA_IP_V4', 'CTA_PROTO_ICMP'], socket.AF_INET6: ['CTA_IP_V6', 'CTA_PROTO_ICMPV6'], }[self.family] def proto_name(self): return IP_PROTOCOLS.get(self.proto, None) def reverse(self): return NFCTAttrTuple( family=self.family, saddr=self.daddr, daddr=self.saddr, proto=self.proto, sport=self.dport, dport=self.sport, icmp_id=self.icmp_id, icmp_type=self.icmp_type, icmp_code=self.icmp_code, ) def attrs(self): cta_ip = [] cta_proto = [] cta_tuple = [] self.flags = 0 if self.saddr is not None: cta_ip.append([self._attr_ip + '_SRC', self.saddr]) self.flags \|= FILTER_FLAG_CTA_IP_SRC if self.daddr is not None: cta_ip.append([self._attr_ip + '_DST', self.daddr]) self.flags \|= FILTER_FLAG_CTA_IP_DST if self.proto is not None: cta_proto.append(['CTA_PROTO_NUM', self.proto]) self.flags \|= FILTER_FLAG_CTA_PROTO_NUM if self.sport is not None: cta_proto.append(['CTA_PROTO_SRC_PORT', self.sport]) self.flags \|= FILTER_FLAG_CTA_PROTO_SRC_PORT if self.dport is not None: cta_proto.append(['CTA_PROTO_DST_PORT', self.dport]) self.flags \|= FILTER_FLAG_CTA_PROTO_DST_PORT if self.icmp_id is not None: cta_proto.append([self._attr_icmp + '_ID', self.icmp_id]) if self.icmp_type is not None: cta_proto.append([self._attr_icmp + '_TYPE', self.icmp_type]) if self.icmp_code is not None: cta_proto.append([self._attr_icmp + '_CODE', self.icmp_code]) if cta_ip: cta_tuple.append(['CTA_TUPLE_IP', {'attrs': cta_ip}]) if cta_proto: cta_tuple.append(['CTA_TUPLE_PROTO', {'attrs': cta_proto}]) return cta_tuple @classmethod def from_netlink(cls, family, ndmsg): cta_ip = ndmsg.get_attr('CTA_TUPLE_IP') cta_proto = ndmsg.get_attr('CTA_TUPLE_PROTO') kwargs = {'family': family} if family == socket.AF_INET: kwargs['saddr'] = cta_ip.get_attr('CTA_IP_V4_SRC') kwargs['daddr'] = cta_ip.get_attr('CTA_IP_V4_DST') elif family == socket.AF_INET6: kwargs['saddr'] = cta_ip.get_attr('CTA_IP_V6_SRC') kwargs['daddr'] = cta_ip.get_attr('CTA_IP_V6_DST') else: raise NotImplementedError(family) proto = cta_proto.get_attr('CTA_PROTO_NUM') kwargs['proto'] = proto if proto == socket.IPPROTO_ICMP: kwargs['icmp_id'] = cta_proto.get_attr('CTA_PROTO_ICMP_ID') kwargs['icmp_type'] = cta_proto.get_attr('CTA_PROTO_ICMP_TYPE') kwargs['icmp_code'] = cta_proto.get_attr('CTA_PROTO_ICMP_CODE') elif proto == socket.IPPROTO_ICMPV6: kwargs['icmp_id'] = cta_proto.get_attr('CTA_PROTO_ICMPV6_ID') kwargs['icmp_type'] = cta_proto.get_attr('CTA_PROTO_ICMPV6_TYPE') kwargs['icmp_code'] = cta_proto.get_attr('CTA_PROTO_ICMPV6_CODE') elif proto in (socket.IPPROTO_TCP, socket.IPPROTO_UDP): kwargs['sport'] = cta_proto.get_attr('CTA_PROTO_SRC_PORT') kwargs['dport'] = cta_proto.get_attr('CTA_PROTO_DST_PORT') return cls(kwargs) def is_attr_match(self, other, attrname): l_attr = getattr(self, attrname) if l_attr is not None: r_attr = getattr(other, attrname) if l_attr != r_attr: return False return True def nla_eq(self, family, ndmsg): if self.family != family: return False test_attr = [] cta_ip = ndmsg.get_attr('CTA_TUPLE_IP') if family == socket.AF_INET: test_attr.append((self.saddr, cta_ip, 'CTA_IP_V4_SRC')) test_attr.append((self.daddr, cta_ip, 'CTA_IP_V4_DST')) elif family == socket.AF_INET6: test_attr.append((self.saddr, cta_ip, 'CTA_IP_V6_SRC')) test_attr.append((self.daddr, cta_ip, 'CTA_IP_V6_DST')) else: raise NotImplementedError(family) if self.proto is not None: cta_proto = ndmsg.get_attr('CTA_TUPLE_PROTO') if self.proto != cta_proto.get_attr('CTA_PROTO_NUM'): return False if self.proto == socket.IPPROTO_ICMP: ( test_attr.append( (self.icmp_id, cta_proto, 'CTA_PROTO_ICMP_ID') ) ) ( test_attr.append( (self.icmp_type, cta_proto, 'CTA_PROTO_ICMP_TYPE') ) ) ( test_attr.append( (self.icmp_code, cta_proto, 'CTA_PROTO_ICMP_CODE') ) ) elif self.proto == socket.IPPROTO_ICMPV6: ( test_attr.append( (self.icmp_id, cta_proto, 'CTA_PROTO_ICMPV6_ID') ) ) ( test_attr.append( (self.icmp_type, cta_proto, 'CTA_PROTO_ICMPV6_TYPE') ) ) ( test_attr.append( (self.icmp_code, cta_proto, 'CTA_PROTO_ICMPV6_CODE') ) ) elif self.proto in (socket.IPPROTO_TCP, socket.IPPROTO_UDP): ( test_attr.append( (self.sport, cta_proto, 'CTA_PROTO_SRC_PORT') ) ) ( test_attr.append( (self.dport, cta_proto, 'CTA_PROTO_DST_PORT') ) ) for val, ndmsg, attrname in test_attr: if val is not None and val != ndmsg.get_attr(attrname): return False return True def __ne__(self, other): return not self.__eq__(other) def __eq__(self, other): if not isinstance(other, self.__class__): raise NotImplementedError() if self.family != other.family: return False for attrname in ('saddr', 'daddr'): if not self.is_attr_match(other, attrname): return False if self.proto is not None: if self.proto != other.proto: return False if self.proto in (socket.IPPROTO_UDP, socket.IPPROTO_TCP): for attrname in ('sport', 'dport'): if not self.is_attr_match(other, attrname): return False elif self.proto in (socket.IPPROTO_ICMP, socket.IPPROTO_ICMPV6): for attrname in ('icmp_id', 'icmp_type', 'icmp_code'): if not self.is_attr_match(other, attrname): return False return True def __repr__(self): proto_name = self.proto_name() if proto_name is None: proto_name = 'UNKNOWN' if self.family == socket.AF_INET: r = 'IPv4(' elif self.family == socket.AF_INET6: r = 'IPv6(' else: r = 'Unkown[family={}]('.format(self.family) r += 'saddr={}, daddr={}, '.format(self.saddr, self.daddr) r += '{}('.format(proto_name) if self.proto in (socket.IPPROTO_ICMP, socket.IPPROTO_ICMPV6): r += 'id={}, type={}, code={}'.format( self.icmp_id, self.icmp_type, self.icmp_code ) elif self.proto in (socket.IPPROTO_TCP, socket.IPPROTO_UDP): r += 'sport={}, dport={}'.format(self.sport, self.dport) return r + '))' class NFCTSocket(NetlinkSocket): policy = { k \| (NFNL_SUBSYS_CTNETLINK << 8): v for k, v in { IPCTNL_MSG_CT_NEW: nfct_msg, IPCTNL_MSG_CT_GET: nfct_msg, IPCTNL_MSG_CT_DELETE: nfct_msg, IPCTNL_MSG_CT_GET_CTRZERO: nfct_msg, IPCTNL_MSG_CT_GET_STATS_CPU: nfct_stats_cpu, IPCTNL_MSG_CT_GET_STATS: nfct_stats, IPCTNL_MSG_CT_GET_DYING: nfct_msg, IPCTNL_MSG_CT_GET_UNCONFIRMED: nfct_msg, }.items() } def __init__(self, nfgen_family=socket.AF_INET, kwargs): super(NFCTSocket, self).__init__(family=NETLINK_NETFILTER, kwargs) self.register_policy(self.policy) self._nfgen_family = nfgen_family def request(self, msg, msg_type, kwargs): msg['nfgen_family'] = self._nfgen_family msg_type \|= NFNL_SUBSYS_CTNETLINK << 8 return tuple(self.nlm_request(msg, msg_type, kwargs)) def dump( self, mark=None, mark_mask=0xFFFFFFFF, tuple_orig=None, tuple_reply=None, status=None, status_mask=None, ): """Dump conntrack entries Several kernel side filtering are supported: * mark and mark_mask, for almost all kernel * tuple_orig and tuple_reply, since kernel 5.8 and newer. Warning: tuple_reply has a bug in kernel, fixed only recently. * status and status_mask, available since kernel 5.15 tuple_orig and tuple_reply are type NFCTAttrTuple. You can give only some attribute for filtering. Example:: # Get only connections from 192.168.1.1 filter = NFCTAttrTuple(saddr='192.168.1.1') ct.dump_entries(tuple_orig=filter) # Get HTTPS connections filter = NFCTAttrTuple(proto=socket.IPPROTO_TCP, dport=443) ct.dump_entries(tuple_orig=filter) # Get only one way connection (no reply) ct.dump_entries(status=0, status_mask=IPS_SEEN_REPLY) Note that NFCTAttrTuple attributes are working like one AND operator. Example:: # Get connections from 192.168.1.1 AND on port 443 TCP = socket.IPPROTO_TCP filter = NFCTAttrTuple(saddr='192.168.1.1', proto=TCP, dport=443) ct.dump_entries(tuple_orig=filter) """ if tuple_orig is not None: tuple_orig.attrs() # for creating flags cta_filter = { 'attrs': [['CTA_FILTER_ORIG_FLAGS', tuple_orig.flags]] } msg = nfct_msg.create_from( tuple_orig=tuple_orig, cta_filter=cta_filter ) elif tuple_reply is not None: tuple_reply.attrs() cta_filter = { 'attrs': [['CTA_FILTER_REPLY_FLAGS', tuple_reply.flags]] } msg = nfct_msg.create_from( tuple_reply=tuple_reply, cta_filter=cta_filter ) else: kwargs = {} if mark: kwargs['mark'] = mark kwargs['mark_mask'] = mark_mask if status is not None: kwargs['status'] = status if status_mask is not None: kwargs['status_mask'] = status_mask msg = nfct_msg.create_from(kwargs) return self.request( msg, IPCTNL_MSG_CT_GET, msg_flags=NLM_F_REQUEST \| NLM_F_DUMP ) def stat(self): return self.request( nfct_msg(), IPCTNL_MSG_CT_GET_STATS_CPU, msg_flags=NLM_F_REQUEST \| NLM_F_DUMP, ) def count(self): return self.request( nfct_msg(), IPCTNL_MSG_CT_GET_STATS, msg_flags=NLM_F_REQUEST \| NLM_F_DUMP, terminate=terminate_single_msg, ) def flush(self, mark=None, mark_mask=None): msg = nfct_msg.create_from(mark=mark, mark_mask=mark_mask) return self.request( msg, IPCTNL_MSG_CT_DELETE, msg_flags=NLM_F_REQUEST \| NLM_F_ACK, terminate=terminate_error_msg, ) def conntrack_max_size(self): return self.request( nfct_msg(), IPCTNL_MSG_CT_GET_STATS, msg_flags=NLM_F_REQUEST \| NLM_F_DUMP, terminate=terminate_single_msg, ) def entry(self, cmd, kwargs): """ Get or change a conntrack entry. Examples:: # add an entry ct.entry('add', timeout=30, tuple_orig=NFCTAttrTuple( saddr='192.168.122.1', daddr='192.168.122.67', proto=6, sport=34857, dport=5599), tuple_reply=NFCTAttrTuple( saddr='192.168.122.67', daddr='192.168.122.1', proto=6, sport=5599, dport=34857)) # set mark=5 on the matching entry ct.entry('set', mark=5, tuple_orig=NFCTAttrTuple( saddr='192.168.122.1', daddr='192.168.122.67', proto=6, sport=34857, dport=5599)) # get an entry ct.entry('get', tuple_orig=NFCTAttrTuple( saddr='192.168.122.1', daddr='192.168.122.67', proto=6, sport=34857, dport=5599)) # delete an entry ct.entry('del', tuple_orig=NFCTAttrTuple( saddr='192.168.122.1', daddr='192.168.122.67', proto=6, sport=34857, dport=5599)) """ msg_type, msg_flags = { 'add': [IPCTNL_MSG_CT_NEW, NLM_F_ACK \| NLM_F_EXCL \| NLM_F_CREATE], 'set': [IPCTNL_MSG_CT_NEW, NLM_F_ACK], 'get': [IPCTNL_MSG_CT_GET, NLM_F_ACK], 'del': [IPCTNL_MSG_CT_DELETE, NLM_F_ACK], }[cmd] if msg_type == IPCTNL_MSG_CT_DELETE and not ( 'tuple_orig' in kwargs or 'tuple_reply' in kwargs ): raise ValueError('Deletion requires a tuple at least') return self.request( nfct_msg.create_from(**kwargs), msg_type, msg_flags=NLM_F_REQUEST \| msg_flags, terminate=terminate_error_msg, )	27.53 KB	2025-05-25 12:26
📄 nftsocket.py """ NFTSocket -- low level nftables API See also: pyroute2.nftables """ import enum import struct import threading from pyroute2.netlink import ( NETLINK_NETFILTER, NLM_F_ACK, NLM_F_APPEND, NLM_F_CREATE, NLM_F_DUMP, NLM_F_EXCL, NLM_F_REPLACE, NLM_F_REQUEST, nla, nla_base_string, nlmsg_atoms, ) from pyroute2.netlink.nfnetlink import NFNL_SUBSYS_NFTABLES, nfgen_msg from pyroute2.netlink.nlsocket import AsyncNetlinkSocket, NetlinkSocket NFT_MSG_NEWTABLE = 0 NFT_MSG_GETTABLE = 1 NFT_MSG_DELTABLE = 2 NFT_MSG_NEWCHAIN = 3 NFT_MSG_GETCHAIN = 4 NFT_MSG_DELCHAIN = 5 NFT_MSG_NEWRULE = 6 NFT_MSG_GETRULE = 7 NFT_MSG_DELRULE = 8 NFT_MSG_NEWSET = 9 NFT_MSG_GETSET = 10 NFT_MSG_DELSET = 11 NFT_MSG_NEWSETELEM = 12 NFT_MSG_GETSETELEM = 13 NFT_MSG_DELSETELEM = 14 NFT_MSG_NEWGEN = 15 NFT_MSG_GETGEN = 16 NFT_MSG_TRACE = 17 NFT_MSG_NEWOBJ = 18 NFT_MSG_GETOBJ = 19 NFT_MSG_DELOBJ = 20 NFT_MSG_GETOBJ_RESET = 21 NFT_MSG_NEWFLOWTABLE = 22 NFT_MSG_GETFLOWTABLE = 23 NFT_MSG_DELFLOWTABLE = 24 # from nftables/include/datatype.h DATA_TYPE_INVALID = 0 DATA_TYPE_VERDICT = 1 DATA_TYPE_NFPROTO = 2 DATA_TYPE_BITMASK = 3 DATA_TYPE_INTEGER = 4 DATA_TYPE_STRING = 5 DATA_TYPE_LLADDR = 6 DATA_TYPE_IPADDR = 7 DATA_TYPE_IP6ADDR = 8 DATA_TYPE_ETHERADDR = 9 DATA_TYPE_ETHERTYPE = 10 DATA_TYPE_ARPOP = 11 DATA_TYPE_INET_PROTOCOL = 12 DATA_TYPE_INET_SERVICE = 13 DATA_TYPE_ICMP_TYPE = 14 DATA_TYPE_TCP_FLAG = 15 DATA_TYPE_DCCP_PKTTYPE = 16 DATA_TYPE_MH_TYPE = 17 DATA_TYPE_TIME = 18 DATA_TYPE_MARK = 19 DATA_TYPE_IFINDEX = 20 DATA_TYPE_ARPHRD = 21 DATA_TYPE_REALM = 22 DATA_TYPE_CLASSID = 23 DATA_TYPE_UID = 24 DATA_TYPE_GID = 25 DATA_TYPE_CT_STATE = 26 DATA_TYPE_CT_DIR = 27 DATA_TYPE_CT_STATUS = 28 DATA_TYPE_ICMP6_TYPE = 29 DATA_TYPE_CT_LABEL = 30 DATA_TYPE_PKTTYPE = 31 DATA_TYPE_ICMP_CODE = 32 DATA_TYPE_ICMPV6_CODE = 33 DATA_TYPE_ICMPX_CODE = 34 DATA_TYPE_DEVGROUP = 35 DATA_TYPE_DSCP = 36 DATA_TYPE_ECN = 37 DATA_TYPE_FIB_ADDR = 38 DATA_TYPE_BOOLEAN = 39 DATA_TYPE_CT_EVENTBIT = 40 DATA_TYPE_IFNAME = 41 DATA_TYPE_IGMP_TYPE = 42 DATA_TYPE_TIME_DATE = 43 DATA_TYPE_TIME_HOUR = 44 DATA_TYPE_TIME_DAY = 45 DATA_TYPE_CGROUPV2 = 46 # from include/uapi/linux/netfilter.h NFPROTO_INET = 1 NFPROTO_IPV4 = 2 NFPROTO_ARP = 3 NFPROTO_NETDEV = 5 NFPROTO_BRIDGE = 7 NFPROTO_IPV6 = 10 class Cmp(enum.IntEnum): NFT_CMP_EQ: int = 0 NFT_CMP_NEQ: int = 1 NFT_CMP_LT: int = 2 NFT_CMP_LTE: int = 3 NFT_CMP_GT: int = 4 NFT_CMP_GTE: int = 5 class Meta(enum.IntEnum): NFT_META_LEN: int = 0 NFT_META_PROTOCOL: int = 1 NFT_META_PRIORITY: int = 2 NFT_META_MARK: int = 3 NFT_META_IIF: int = 4 NFT_META_OIF: int = 5 NFT_META_IIFNAME: int = 6 NFT_META_OIFNAME: int = 7 NFT_META_IIFTYPE: int = 8 NFT_META_OIFTYPE: int = 9 NFT_META_SKUID: int = 10 NFT_META_SKGID: int = 11 NFT_META_NFTRACE: int = 12 NFT_META_RTCLASSID: int = 13 NFT_META_SECMARK: int = 14 NFT_META_NFPROTO: int = 15 NFT_META_L4PROTO: int = 16 NFT_META_BRI_IIFNAME: int = 17 NFT_META_BRI_OIFNAME: int = 18 NFT_META_PKTTYPE: int = 19 NFT_META_CPU: int = 20 NFT_META_IIFGROUP: int = 21 NFT_META_OIFGROUP: int = 22 NFT_META_CGROUP: int = 23 NFT_META_PRANDOM: int = 24 NFT_META_SECPATH: int = 25 NFT_META_IIFKIND: int = 26 NFT_META_OIFKIND: int = 27 NFT_META_BRI_IIFPVID: int = 28 NFT_META_BRI_IIFVPROTO: int = 29 NFT_META_TIME_NS: int = 30 NFT_META_TIME_DAY: int = 31 NFT_META_TIME_HOUR: int = 32 NFT_META_SDIF: int = 33 NFT_META_SDIFNAME: int = 34 class Regs(enum.IntEnum): NFT_REG_VERDICT: int = 0x00 NFT_REG_1: int = 0x01 NFT_REG_2: int = 0x02 NFT_REG_3: int = 0x03 NFT_REG_4: int = 0x04 NFT_REG32_00: int = 0x08 NFT_REG32_01: int = 0x09 NFT_REG32_02: int = 0x0A NFT_REG32_03: int = 0x0B NFT_REG32_04: int = 0x0C NFT_REG32_05: int = 0x0D NFT_REG32_06: int = 0x0E NFT_REG32_07: int = 0x0F NFT_REG32_08: int = 0x10 NFT_REG32_09: int = 0x11 NFT_REG32_10: int = 0x12 NFT_REG32_11: int = 0x13 NFT_REG32_12: int = 0x14 NFT_REG32_13: int = 0x15 NFT_REG32_14: int = 0x16 NFT_REG32_15: int = 0x17 class nftnl_udata(nla_base_string): # TLV structures: # nftnl_udata # <-------- HEADER --------> <------ PAYLOAD ------> # +------------+-------------+- - - - - - - - - - - -+ # \| type \| len \| value \| # \| (1 byte) \| (1 byte) \| \| # +--------------------------+- - - - - - - - - - - -+ # <-- sizeof(nftnl_udata) -> <-- nftnl_udata->len --> __slots__ = () @classmethod def udata_decode(cls, data): offset = 0 result = [] while offset + 2 < len(data): utype = data[offset] ulen = data[offset + 1] offset += 2 if offset + ulen > len(data): return None # bad decode try: type_name = cls.udata_types[utype] except IndexError: return None # bad decode value = data[offset : offset + ulen] if type_name.endswith("_COMMENT") and value[-1] == 0: value = value[:-1] # remove \x00 c str result.append((type_name, value)) offset += ulen return result @classmethod def udata_encode(cls, values): value = b"" for type_name, udata in values: if isinstance(udata, str): udata = udata.encode() if type_name.endswith("_COMMENT") and udata[-1] != 0: udata = udata + b"\x00" utype = cls.udata_types.index(type_name) value += struct.pack("BB", utype, len(udata)) + udata return value def decode(self): nla_base_string.decode(self) value = self.udata_decode(self['value']) if value is not None: self.value = value def encode(self): if not isinstance(self.value, (bytes, str)): self['value'] = self.udata_encode(self.value) nla_base_string.encode(self) class nft_map_uint8(nla): ops = {} fields = [('value', 'B')] def decode(self): nla.decode(self) self.value = self.ops.get(self['value']) class nft_map_be32(nft_map_uint8): fields = [('value', '>I')] class nft_map_be32_signed(nft_map_uint8): fields = [('value', '>i')] class nft_flags_be32(nla): fields = [('value', '>I')] ops = None def decode(self): nla.decode(self) self.value = frozenset( o for i, o in enumerate(self.ops) if self['value'] & 1 << i ) def encode(self): value = 0 for i, name in enumerate(self.ops): if name in self.value: value \|= 1 << i self["value"] = value nla.encode(self) class nft_flags_be16(nla): fields = [('value', '>H')] ops = None def decode(self): nla.decode(self) self.value = frozenset( o for i, o in enumerate(self.ops) if self['value'] & 1 << i ) class nft_device(nla): class device_attributes(nla): nla_map = ( ('NFTA_DEVICE_UNSPEC', 'none'), ('NFTA_DEVICE_NAME', 'asciiz'), ) class nft_gen_msg(nfgen_msg): nla_map = ( ('NFTA_GEN_UNSPEC', 'none'), ('NFTA_GEN_ID', 'be32'), ('NFTA_GEN_PROC_PID', 'be32'), ('NFTA_GEN_PROC_NAME', 'asciiz'), ) class CData: @staticmethod def decode_from(data, offset=0): (length,) = struct.unpack_from('>H', data, offset) (data,) = struct.unpack_from(f'{length - 1}s', data, offset + 2) return (data.decode('utf-8'), offset + 2 + length) @staticmethod def encode_into(data, offset, value): encoded = value.encode('utf-8') length = len(encoded) + 1 data.extend([0] (length + 2)) struct.pack_into(f'>H{length}s', data, offset, length, encoded) return offset + length + 2 class nft_has_comment: class comment(nla): fields = [('value', CData)] class nft_chain_msg(nfgen_msg, nft_has_comment): prefix = 'NFTA_CHAIN_' nla_map = ( ('NFTA_CHAIN_UNSPEC', 'none'), ('NFTA_CHAIN_TABLE', 'asciiz'), ('NFTA_CHAIN_HANDLE', 'be64'), ('NFTA_CHAIN_NAME', 'asciiz'), ('NFTA_CHAIN_HOOK', 'hook'), ('NFTA_CHAIN_POLICY', 'be32'), ('NFTA_CHAIN_USE', 'be32'), ('NFTA_CHAIN_TYPE', 'asciiz'), ('NFTA_CHAIN_COUNTERS', 'counters'), ('NFTA_CHAIN_PAD', 'hex'), ('NFTA_CHAIN_FLAGS', 'flags'), ('NFTA_CHAIN_ID', 'be32'), ('NFTA_CHAIN_USERDATA', 'comment'), ) class counters(nla): nla_map = ( ('NFTA_COUNTER_UNSPEC', 'none'), ('NFTA_COUNTER_BYTES', 'be64'), ('NFTA_COUNTER_PACKETS', 'be64'), ) class hook(nft_device): nla_map = ( ('NFTA_HOOK_UNSPEC', 'none'), ('NFTA_HOOK_HOOKNUM', 'be32'), ('NFTA_HOOK_PRIORITY', 'sbe32'), ('NFTA_HOOK_DEV', 'asciiz'), ('NFTA_HOOK_DEVS', 'device_attributes'), ) class flags(nft_flags_be32): ops = ('NFT_CHAIN_HW_OFFLOAD', 'NFT_CHAIN_BINDING') class nat_flags(nla): class nat_range(nft_flags_be32): ops = ( 'NF_NAT_RANGE_MAP_IPS', 'NF_NAT_RANGE_PROTO_SPECIFIED', 'NF_NAT_RANGE_PROTO_RANDOM', 'NF_NAT_RANGE_PERSISTENT', 'NF_NAT_RANGE_PROTO_RANDOM_FULLY', 'NF_NAT_RANGE_PROTO_OFFSET', 'NF_NAT_RANGE_NETMAP', ) class nft_regs(nla): class regs(nft_map_be32): ops = {x.value: x.name for x in Regs} class nft_data(nla): class nfta_data(nla): nla_map = ( ('NFTA_DATA_UNSPEC', 'none'), ('NFTA_DATA_VALUE', 'cdata'), ('NFTA_DATA_VERDICT', 'verdict'), ) class verdict(nla): nla_map = ( ('NFTA_VERDICT_UNSPEC', 'none'), ('NFTA_VERDICT_CODE', 'verdict_code'), ('NFTA_VERDICT_CHAIN', 'asciiz'), ) class verdict_code(nft_map_be32_signed): ops = { 0: 'NF_DROP', 1: 'NF_ACCEPT', 2: 'NF_STOLEN', 3: 'NF_QUEUE', 4: 'NF_REPEAT', 5: 'NF_STOP', -1: 'NFT_CONTINUE', -2: 'NFT_BREAK', -3: 'NFT_JUMP', -4: 'NFT_GOTO', -5: 'NFT_RETURN', } # nft_expr struct, used for rules and set class nft_contains_expr: class nft_expr(nla): header_type = 1 nla_map = ( ('NFTA_EXPR_UNSPEC', 'none'), ('NFTA_EXPR_NAME', 'asciiz'), ('NFTA_EXPR_DATA', 'expr'), ) class nft_bitwise(nft_data, nft_regs): nla_map = ( ('NFTA_BITWISE_UNSPEC', 'none'), ('NFTA_BITWISE_SREG', 'regs'), ('NFTA_BITWISE_DREG', 'regs'), ('NFTA_BITWISE_LEN', 'be32'), ('NFTA_BITWISE_MASK', 'nfta_data'), ('NFTA_BITWISE_XOR', 'nfta_data'), ('NFTA_BITWISE_OP', 'bitwise_op'), ('NFTA_BITWISE_DATA', 'nfta_data'), ) class bitwise_op(nft_map_be32): ops = { 0: 'NFT_BITWISE_BOOL', 1: 'NFT_BITWISE_LSHIFT', 2: 'NFT_BITWISE_RSHIFT', } class nft_byteorder(nft_regs): nla_map = ( ('NFTA_BYTEORDER_UNSPEC', 'none'), ('NFTA_BYTEORDER_SREG', 'regs'), ('NFTA_BYTEORDER_DREG', 'regs'), ('NFTA_BYTEORDER_OP', 'ops'), ('NFTA_BYTEORDER_LEN', 'be32'), ('NFTA_BYTEORDER_SIZE', 'be32'), ) class ops(nft_map_be32): ops = {0: 'NFT_BYTEORDER_NTOH', 1: 'NFT_BYTEORDER_HTON'} class nft_cmp(nft_data, nft_regs): nla_map = ( ('NFTA_CMP_UNSPEC', 'none'), ('NFTA_CMP_SREG', 'regs'), ('NFTA_CMP_OP', 'ops'), ('NFTA_CMP_DATA', 'nfta_data'), ) class ops(nft_map_be32): ops = {x.value: x.name for x in Cmp} class nft_match(nla): nla_map = ( ('NFTA_MATCH_UNSPEC', 'none'), ('NFTA_MATCH_NAME', 'asciiz'), ('NFTA_MATCH_REV', 'be32'), ('NFTA_MATCH_INFO', 'hex'), ('NFTA_MATCH_PROTOCOL', 'hex'), ('NFTA_MATCH_FLAGS', 'hex'), ) class nft_target(nla): nla_map = ( ('NFTA_TARGET_UNSPEC', 'none'), ('NFTA_TARGET_NAME', 'asciiz'), ('NFTA_TARGET_REV', 'be32'), ('NFTA_TARGET_INFO', 'hex'), ('NFTA_TARGET_PROTOCOL', 'hex'), ('NFTA_TARGET_FLAGS', 'hex'), ) class nft_connlimit(nla): nla_map = ( ('NFTA_CONNLIMIT_UNSPEC', 'none'), ('NFTA_CONNLIMIT_COUNT', 'be32'), ('NFTA_CONNLIMIT_FLAGS', 'connlimit_flags'), ) class connlimit_flags(nft_flags_be32): ops = ('NFT_LIMIT_F_INV',) class nft_counter(nla): nla_map = ( ('NFTA_COUNTER_UNSPEC', 'none'), ('NFTA_COUNTER_BYTES', 'be64'), ('NFTA_COUNTER_PACKETS', 'be64'), ) class nft_ct(nft_regs): nla_map = ( ('NFTA_CT_UNSPEC', 'none'), ('NFTA_CT_DREG', 'regs'), ('NFTA_CT_KEY', 'keys'), ('NFTA_CT_DIRECTION', 'uint8'), ('NFTA_CT_SREG', 'regs'), ) class keys(nft_map_be32): ops = { 0x00: 'NFT_CT_STATE', 0x01: 'NFT_CT_DIRECTION', 0x02: 'NFT_CT_STATUS', 0x03: 'NFT_CT_MARK', 0x04: 'NFT_CT_SECMARK', 0x05: 'NFT_CT_EXPIRATION', 0x06: 'NFT_CT_HELPER', 0x07: 'NFT_CT_L3PROTOCOL', 0x08: 'NFT_CT_SRC', 0x09: 'NFT_CT_DST', 0x0A: 'NFT_CT_PROTOCOL', 0x0B: 'NFT_CT_PROTO_SRC', 0x0C: 'NFT_CT_PROTO_DST', 0x0D: 'NFT_CT_LABELS', 0x0E: 'NFT_CT_PKTS', 0x0F: 'NFT_CT_BYTES', 0x10: 'NFT_CT_AVGPKT', 0x11: 'NFT_CT_ZONE', 0x12: 'NFT_CT_EVENTMASK', 0x13: 'NFT_CT_SRC_IP', 0x14: 'NFT_CT_DST_IP', 0x15: 'NFT_CT_SRC_IP6', 0x16: 'NFT_CT_DST_IP6', 0x17: 'NFT_CT_ID', } class nft_dup(nft_regs): nla_map = ( ('NFTA_DUP_UNSPEC', 'none'), ('NFTA_DUP_SREG_ADDR', 'regs'), ('NFTA_DUP_SREG_DEV', 'regs'), ) class nft_exthdr(nft_regs): nla_map = ( ('NFTA_EXTHDR_UNSPEC', 'none'), ('NFTA_EXTHDR_DREG', 'regs'), ('NFTA_EXTHDR_TYPE', 'uint8'), ('NFTA_EXTHDR_OFFSET', 'be32'), ('NFTA_EXTHDR_LEN', 'be32'), ('NFTA_EXTHDR_FLAGS', 'exthdr_flags'), ('NFTA_EXTHDR_OP', 'exthdr_op'), ('NFTA_EXTHDR_SREG', 'regs'), ) class exthdr_flags(nft_flags_be32): ops = ('NFT_EXTHDR_F_PRESENT',) class exthdr_op(nft_map_be32): ops = { 0: 'NFT_EXTHDR_OP_IPV6', 1: 'NFT_EXTHDR_OP_TCPOPT', 2: 'NFT_EXTHDR_OP_IPV4', } class nft_fib(nft_regs): nla_map = ( ('NFTA_FIB_UNSPEC', 'none'), ('NFTA_FIB_DREG', 'regs'), ('NFTA_FIB_RESULT', 'fib_result'), ('NFTA_FIB_FLAGS', 'fib_flags'), ) class fib_result(nft_flags_be32): ops = ( 'NFT_FIB_RESULT_UNSPEC', 'NFT_FIB_RESULT_OIF', 'NFT_FIB_RESULT_OIFNAME', 'NFT_FIB_RESULT_ADDRTYPE', ) class fib_flags(nft_map_be32): ops = { 0: 'NFTA_FIB_F_SADDR', 1: 'NFTA_FIB_F_DADDR', 2: 'NFTA_FIB_F_MARK', 3: 'NFTA_FIB_F_IIF', 4: 'NFTA_FIB_F_OIF', 5: 'NFTA_FIB_F_PRESENT', } class nft_fwd(nft_regs): nla_map = ( ('NFTA_FWD_UNSPEC', 'none'), ('NFTA_FWD_SREG_DEV', 'regs'), ('NFTA_FWD_SREG_ADDR', 'regs'), ('NFTA_FWD_NFPROTO', 'u32'), ) class nft_hash(nft_regs): nla_map = ( ('NFTA_HASH_UNSPEC', 'none'), ('NFTA_HASH_SREG', 'regs'), ('NFTA_HASH_DREG', 'regs'), ('NFTA_HASH_LEN', 'be32'), ('NFTA_HASH_MODULUS', 'be32'), ('NFTA_HASH_SEED', 'be32'), ('NFTA_HASH_OFFSET', 'be32'), ('NFTA_HASH_TYPE', 'hash_type'), ('NFTA_HASH_SET_NAME', 'asciiz'), ('NFTA_HASH_SET_ID', 'be32'), ) class hash_type(nft_map_be32): ops = {0: 'NFT_HASH_JENKINS', 1: 'NFT_HASH_SYM'} class nft_immediate(nft_data, nft_regs): nla_map = ( ('NFTA_IMMEDIATE_UNSPEC', 'none'), ('NFTA_IMMEDIATE_DREG', 'regs'), ('NFTA_IMMEDIATE_DATA', 'nfta_data'), ) class nft_limit(nla): nla_map = ( ('NFTA_LIMIT_UNSPEC', 'none'), ('NFTA_LIMIT_RATE', 'be64'), ('NFTA_LIMIT_UNIT', 'be64'), ('NFTA_LIMIT_BURST', 'be32'), ('NFTA_LIMIT_TYPE', 'types'), ('NFTA_LIMIT_FLAGS', 'be32'), ) # make flags type class types(nft_map_be32): ops = {0: 'NFT_LIMIT_PKTS', 1: 'NFT_LIMIT_PKT_BYTES'} class nft_log(nla): nla_map = ( ('NFTA_LOG_UNSPEC', 'none'), ('NFTA_LOG_GROUP', 'be32'), ('NFTA_LOG_PREFIX', 'asciiz'), ('NFTA_LOG_SNAPLEN', 'be32'), ('NFTA_LOG_QTHRESHOLD', 'be32'), ('NFTA_LOG_LEVEL', 'log_level'), ('NFTA_LOG_FLAGS', 'log_flags'), ) class log_level(nft_map_be32): ops = { 0: 'NFT_LOGLEVEL_EMERG', 1: 'NFT_LOGLEVEL_ALERT', 2: 'NFT_LOGLEVEL_CRIT', 3: 'NFT_LOGLEVEL_ERR', 4: 'NFT_LOGLEVEL_WARNING', 5: 'NFT_LOGLEVEL_NOTICE', 6: 'NFT_LOGLEVEL_INFO', 7: 'NFT_LOGLEVEL_DEBUG', 8: 'NFT_LOGLEVEL_AUDIT', } class log_flags(nft_flags_be32): ops = ( 'NF_LOG_TCPSEQ', 'NF_LOG_TCPOPT', 'NF_LOG_IPOPT', 'NF_LOG_UID', 'NF_LOG_NFLOG', 'NF_LOG_MACDECODE', ) class nft_lookup(nft_regs): nla_map = ( ('NFTA_LOOKUP_UNSPEC', 'none'), ('NFTA_LOOKUP_SET', 'asciiz'), ('NFTA_LOOKUP_SREG', 'regs'), ('NFTA_LOOKUP_DREG', 'regs'), ('NFTA_LOOKUP_SET_ID', 'be32'), ('NFTA_LOOKUP_FLAGS', 'lookup_flags'), ) class lookup_flags(nft_flags_be32): ops = ('NFT_LOOKUP_F_INV',) class nft_masq(nft_regs, nat_flags): nla_map = ( ('NFTA_MASQ_UNSPEC', 'none'), ('NFTA_MASQ_FLAGS', 'nat_range'), ('NFTA_MASQ_REG_PROTO_MIN', 'regs'), ('NFTA_MASQ_REG_PROTO_MAX', 'regs'), ) class nft_meta(nft_regs): nla_map = ( ('NFTA_META_UNSPEC', 'none'), ('NFTA_META_DREG', 'regs'), ('NFTA_META_KEY', 'meta_key'), ('NFTA_META_SREG', 'regs'), ) class meta_key(nft_map_be32): ops = {x.value: x.name for x in Meta} class nft_nat(nft_regs, nat_flags): nla_map = ( ('NFTA_NAT_UNSPEC', 'none'), ('NFTA_NAT_TYPE', 'types'), ('NFTA_NAT_FAMILY', 'be32'), ('NFTA_NAT_REG_ADDR_MIN', 'regs'), ('NFTA_NAT_REG_ADDR_MAX', 'regs'), ('NFTA_NAT_REG_PROTO_MIN', 'regs'), ('NFTA_NAT_REG_PROTO_MAX', 'regs'), ('NFTA_NAT_FLAGS', 'nat_range'), ) class types(nft_map_be32): ops = {0: 'NFT_NAT_SNAT', 1: 'NFT_NAT_DNAT'} class nft_numgen(nft_regs): nla_map = ( ('NFTA_NG_UNSPEC', 'none'), ('NFTA_NG_DREG', 'regs'), ('NFTA_NG_MODULUS', 'be32'), ('NFTA_NG_TYPE', 'types'), ('NFTA_NG_OFFSET', 'be32'), ('NFTA_NG_SET_NAME', 'asciiz'), ('NFTA_NG_SET_ID', 'be32'), ) class types(nft_map_be32): ops = {0: 'NFT_NG_INCREMENTAL', 1: 'NFT_NG_RANDOM'} class nft_objref(nft_regs): nla_map = ( ('NFTA_OBJREF_UNSPEC', 'none'), ('NFTA_OBJREF_IMM_TYPE', 'regs'), ('NFTA_OBJREF_IMM_NAME', 'asciiz'), ('NFTA_OBJREF_SET_SREG', 'regs'), ('NFTA_OBJREF_SET_NAME', 'asciiz'), ('NFTA_OBJREF_SET_ID', 'be32'), ) class nft_offload(nla): nla_map = ( ('NFTA_FLOW_UNSPEC', 'none'), ('NFTA_FLOW_TABLE_NAME', 'asciiz'), ) class nft_osf(nft_regs): nla_map = ( ('NFTA_OSF_UNSPEC', 'none'), ('NFTA_OSF_DREG', 'regs'), ('NFTA_OSF_TTL', 'uint8'), ('NFTA_OSF_FLAGS', 'osf_flags'), ) class osf_flags(nft_flags_be32): ops = ('NFT_OSF_F_VERSION',) class nft_payload(nft_regs): nla_map = ( ('NFTA_PAYLOAD_UNSPEC', 'none'), ('NFTA_PAYLOAD_DREG', 'regs'), ('NFTA_PAYLOAD_BASE', 'base_type'), ('NFTA_PAYLOAD_OFFSET', 'be32'), ('NFTA_PAYLOAD_LEN', 'be32'), ('NFTA_PAYLOAD_SREG', 'regs'), ('NFTA_PAYLOAD_CSUM_TYPE', 'csum_type'), ('NFTA_PAYLOAD_CSUM_OFFSET', 'be32'), ('NFTA_PAYLOAD_CSUM_FLAGS', 'csum_flags'), ) class base_type(nft_map_be32): ops = { 0: 'NFT_PAYLOAD_LL_HEADER', 1: 'NFT_PAYLOAD_NETWORK_HEADER', 2: 'NFT_PAYLOAD_TRANSPORT_HEADER', } class csum_type(nft_map_be32): ops = { 0: 'NFT_PAYLOAD_CSUM_NONE', 1: 'NFT_PAYLOAD_CSUM_INET', # RFC 791 2: 'NFT_PAYLOAD_CSUM_SCTP', } # RFC 3309 class csum_flags(nft_flags_be32): ops = ('NFT_PAYLOAD_L4CSUM_PSEUDOHDR',) class nft_queue(nft_regs): nla_map = ( ('NFTA_QUEUE_UNSPEC', 'none'), ('NFTA_QUEUE_NUM', 'be16'), ('NFTA_QUEUE_TOTAL', 'be16'), ('NFTA_QUEUE_FLAGS', 'queue_flags'), ('NFTA_QUEUE_SREG_QNUM', 'regs'), ) class queue_flags(nft_flags_be16): ops = ('NFT_QUEUE_FLAG_BYPASS', 'NFT_QUEUE_FLAG_CPU_FANOUT') class nft_quota(nla): nla_map = ( ('NFTA_QUOTA_UNSPEC', 'none'), ('NFTA_QUOTA_BYTES', 'be16'), ('NFTA_QUOTA_FLAGS', 'quota_flags'), ('NFTA_QUOTA_PAD', 'hex'), ('NFTA_QUOTA_CONSUMED', 'be64'), ) class quota_flags(nft_flags_be32): ops = ('NFT_QUOTA_F_INV', 'NFT_QUOTA_F_DEPLETED') class nft_range(nft_regs, nft_data): nla_map = ( ('NFTA_RANGE_UNSPEC', 'none'), ('NFTA_RANGE_SREG', 'regs'), ('NFTA_RANGE_OP', 'range_op'), ('NFTA_RANGE_FROM_DATA', 'nfta_data'), ('NFTA_RANGE_TO_DATA', 'nfta_data'), ) class range_op(nft_map_be32): ops = {0: 'NFT_RANGE_EQ', 1: 'NFT_RANGE_NEQ'} class nft_redir(nft_regs, nat_flags): nla_map = ( ('NFTA_REDIR_UNSPEC', 'none'), ('NFTA_REDIR_REG_PROTO_MIN', 'regs'), ('NFTA_REDIR_REG_PROTO_MAX', 'regs'), ('NFTA_REDIR_FLAGS', 'nat_range'), ) class nft_reject(nla): nla_map = ( ('NFTA_REJECT_UNSPEC', 'none'), ('NFTA_REJECT_TYPE', 'types'), ('NFTA_REJECT_ICMP_CODE', 'codes'), ) class types(nft_map_be32): ops = { 0: 'NFT_REJECT_ICMP_UNREACH', 1: 'NFT_REJECT_TCP_RST', 2: 'NFT_REJECT_ICMPX_UNREACH', } class codes(nft_map_uint8): ops = { 0: 'NFT_REJECT_ICMPX_NO_ROUTE', 1: 'NFT_REJECT_ICMPX_PORT_UNREACH', 2: 'NFT_REJECT_ICMPX_HOST_UNREACH', 3: 'NFT_REJECT_ICMPX_ADMIN_PROHIBITED', } class nft_rt(nft_regs): nla_map = ( ('NFTA_RT_UNSPEC', 'none'), ('NFTA_RT_DREG', 'regs'), ('NFTA_RT_KEY', 'rt_keys'), ) class rt_keys(nft_map_be32): ops = { 0: 'NFT_RT_CLASSID', 1: 'NFT_RT_NEXTHOP4', 2: 'NFT_RT_NEXTHOP6', 3: 'NFT_RT_TCPMSS', 4: 'NFT_RT_XFRM', } class nft_secmark(nla): nla_map = ( ('NFTA_SECMARK_UNSPEC', 'none'), ('NFTA_SECMARK_CTX', 'asciiz'), ) class nft_socket(nft_regs): nla_map = ( ('NFTA_SOCKET_UNSPEC', 'none'), ('NFTA_SOCKET_KEY', 'socket_keys'), ('NFTA_SOCKET_DREG', 'regs'), ) class socket_keys(nft_map_be32): ops = { 0: 'NFT_SOCKET_TRANSPARENT', 1: 'NFT_SOCKET_MARK', 2: 'NFT_SOCKET_WILDCARD', } class nft_synproxy(nla): nla_map = ( ('NFTA_SYNPROXY_UNSPEC', 'none'), ('NFTA_SYNPROXY_MSS', 'u16'), ('NFTA_SYNPROXY_WSCALE', 'uint8'), ('NFTA_SYNPROXY_FLAGS', 'synproxy_flags'), ) class synproxy_flags(nft_flags_be32): ops = ( 'NF_SYNPROXY_OPT_MSS', 'NF_SYNPROXY_OPT_WSCALE', 'NF_SYNPROXY_OPT_SACK_PERM', 'NF_SYNPROXY_OPT_TIMESTAMP', 'NF_SYNPROXY_OPT_ECN', ) class nft_tproxy(nft_regs): nla_map = ( ('NFTA_TPROXY_UNSPEC', 'none'), ('NFTA_TPROXY_FAMILY', 'regs'), ('NFTA_TPROXY_REG_ADDR', 'regs'), ('NFTA_TPROXY_REG_PORT', 'regs'), ) class nft_dynset(nft_regs): rule_expr = None nla_map = ( ('NFTA_DYNSET_UNSPEC', 'none'), ('NFTA_DYNSET_SET_NAME', 'asciiz'), ('NFTA_DYNSET_SET_ID', 'be32'), ('NFTA_DYNSET_OP', 'dynset_op'), ('NFTA_DYNSET_SREG_KEY', 'regs'), ('NFTA_DYNSET_SREG_DATA', 'regs'), ('NFTA_DYNSET_TIMEOUT', 'be64'), ('NFTA_DYNSET_EXPR', 'rule_expr'), ('NFTA_DYNSET_PAD', 'hex'), ('NFTA_DYNSET_FLAGS', 'dynset_flags'), ) class dynset_flags(nft_flags_be32): ops = ('NFT_DYNSET_F_INV',) class dynset_op(nft_map_be32): ops = { 0: 'NFT_DYNSET_OP_ADD', 1: 'NFT_DYNSET_OP_UPDATE', 2: 'NFT_DYNSET_OP_DELETE', } class nft_xfrm(nft_regs): nla_map = ( ('NFTA_XFRM_UNSPEC', 'none'), ('NFTA_XFRM_DREG', 'regs'), ('NFTA_XFRM_KEY', 'xfrm_key'), ('NFTA_XFRM_DIR', 'uint8'), ('NFTA_XFRM_SPNUM', 'be32'), ) class xfrm_key(nft_map_be32): ops = { 0: 'NFT_XFRM_KEY_UNSPEC', 1: 'NFT_XFRM_KEY_DADDR_IP4', 2: 'NFT_XFRM_KEY_DADDR_IP6', 3: 'NFT_XFRM_KEY_SADDR_IP4', 4: 'NFT_XFRM_KEY_SADDR_IP6', 5: 'NFT_XFRM_KEY_REQID', 6: 'NFT_XFRM_KEY_SPI', } @staticmethod def expr(self, argv, kwarg): data_type = self.get_attr('NFTA_EXPR_NAME') expr = getattr(self, 'nft_%s' % data_type, self.hex) if hasattr(expr, 'rule_expr'): expr.rule_expr = self.__class__ return expr class nft_rule_msg(nfgen_msg, nft_contains_expr, nft_has_comment): prefix = 'NFTA_RULE_' nla_map = ( ('NFTA_RULE_UNSPEC', 'none'), ('NFTA_RULE_TABLE', 'asciiz'), ('NFTA_RULE_CHAIN', 'asciiz'), ('NFTA_RULE_HANDLE', 'be64'), ('NFTA_RULE_EXPRESSIONS', 'nft_expr'), ('NFTA_RULE_COMPAT', 'hex'), ('NFTA_RULE_POSITION', 'be64'), ('NFTA_RULE_USERDATA', 'comment'), ('NFTA_RULE_PAD', 'hex'), ('NFTA_RULE_ID', 'be32'), ('NFTA_RULE_POSITION_ID', 'be32'), ('NFTA_RULE_CHAIN_ID', 'be32'), ) class nft_set_msg(nfgen_msg, nft_contains_expr): prefix = 'NFTA_SET_' nla_map = ( ('NFTA_SET_UNSPEC', 'none'), ('NFTA_SET_TABLE', 'asciiz'), ('NFTA_SET_NAME', 'asciiz'), ('NFTA_SET_FLAGS', 'set_flags'), ('NFTA_SET_KEY_TYPE', 'be32'), ('NFTA_SET_KEY_LEN', 'be32'), ('NFTA_SET_DATA_TYPE', 'be32'), ('NFTA_SET_DATA_LEN', 'be32'), ('NFTA_SET_POLICY', 'set_policy'), ('NFTA_SET_DESC', 'set_desc'), ('NFTA_SET_ID', 'be32'), ('NFTA_SET_TIMEOUT', 'be64'), ('NFTA_SET_GC_INTERVAL', 'be32'), ('NFTA_SET_USERDATA', 'set_udata'), ('NFTA_SET_PAD', 'hex'), ('NFTA_SET_OBJ_TYPE', 'be32'), ('NFTA_SET_HANDLE', 'be64'), ('NFTA_SET_EXPR', 'nft_expr'), ('NFTA_SET_EXPRESSIONS', 'nft_expr'), ) class set_udata(nftnl_udata): udata_types = ( "NFTNL_UDATA_SET_KEYBYTEORDER", "NFTNL_UDATA_SET_DATABYTEORDER", "NFTNL_UDATA_SET_MERGE_ELEMENTS", "NFTNL_UDATA_SET_KEY_TYPEOF", "NFTNL_UDATA_SET_DATA_TYPEOF", "NFTNL_UDATA_SET_EXPR", "NFTNL_UDATA_SET_DATA_INTERVAL", "NFTNL_UDATA_SET_COMMENT", ) class set_flags(nft_flags_be32): ops = ( 'NFT_SET_ANONYMOUS', 'NFT_SET_CONSTANT', 'NFT_SET_INTERVAL', 'NFT_SET_MAP', 'NFT_SET_TIMEOUT', 'NFT_SET_EVAL', 'NFT_SET_OBJECT', 'NFT_SET_CONCAT', ) class set_policy(nft_map_be32): ops = {0: 'NFT_SET_POL_PERFORMANCE', 1: 'NFT_SET_POL_MEMORY'} class set_desc(nla): nla_map = ( ('NFTA_SET_DESC_UNSPEC', 'none'), ('NFTA_SET_DESC_SIZE', 'be32'), ('NFTA_SET_DESC_CONCAT', 'list_elem'), ) class list_elem(nla): nla_map = ( ('NFTA_LIST_UNSPEC', 'none'), ('NFTA_LIST_ELEM', 'set_field_attribute'), ) class set_field_attribute(nla): nla_map = ( ('NFTA_SET_FIELD_UNSPEC', 'none'), ('NFTA_SET_FIELD_LEN', 'be32'), ) class nft_table_msg(nfgen_msg, nft_contains_expr, nft_has_comment): prefix = 'NFTA_TABLE_' nla_map = ( ('NFTA_TABLE_UNSPEC', 'none'), ('NFTA_TABLE_NAME', 'asciiz'), ('NFTA_TABLE_FLAGS', 'be32'), ('NFTA_TABLE_USE', 'be32'), ('NFTA_TABLE_HANDLE', 'be64'), ('NFTA_TABLE_PAD', 'hex'), ('NFTA_TABLE_USERDATA', 'comment'), ) class nft_set_elem_list_msg(nfgen_msg): prefix = 'NFTA_SET_ELEM_LIST_' nla_map = ( ('NFTA_SET_ELEM_LIST_UNSPEC', 'none'), ('NFTA_SET_ELEM_LIST_TABLE', 'asciiz'), ('NFTA_SET_ELEM_LIST_SET', 'asciiz'), ('NFTA_SET_ELEM_LIST_ELEMENTS', 'set_elem'), ('NFTA_SET_ELEM_LIST_SET_ID', 'be32'), ) class set_elem(nla, nft_contains_expr): nla_map = ( ('NFTA_SET_ELEM_UNSPEC', 'none'), ('NFTA_SET_ELEM_KEY', 'data_attributes'), ('NFTA_SET_ELEM_DATA', 'data_attributes'), ('NFTA_SET_ELEM_FLAGS', 'set_elem_flags'), ('NFTA_SET_ELEM_TIMEOUT', 'be64'), ('NFTA_SET_ELEM_EXPIRATION', 'be64'), ('NFTA_SET_ELEM_USERDATA', 'set_elem_udata'), ('NFTA_SET_ELEM_EXPR', 'nft_expr'), ('NFTA_SET_ELEM_PAD', 'hex'), ('NFTA_SET_ELEM_OBJREF', 'asciiz'), ('NFTA_SET_ELEM_KEY_END', 'data_attributes'), ('NFTA_SET_ELEM_EXPRESSIONS', '*nft_expr'), ) class set_elem_udata(nftnl_udata): udata_types = ( "NFTNL_UDATA_SET_ELEM_COMMENT", "NFTNL_UDATA_SET_ELEM_FLAGS", ) class set_elem_flags(nft_flags_be32): ops = {1: 'NFT_SET_ELEM_INTERVAL_END'} class data_attributes(nla): nla_map = ( ('NFTA_DATA_UNSPEC', 'none'), ('NFTA_DATA_VALUE', 'binary'), ('NFTA_DATA_VERDICT', 'verdict_attributes'), ) class verdict_attributes(nla): nla_map = ( ('NFTA_VERDICT_UNSPEC', 'none'), ('NFTA_VERDICT_CODE', 'verdict_code'), ('NFTA_VERDICT_CHAIN', 'asciiz'), ('NFTA_VERDICT_CHAIN_ID', 'be32'), ) class verdict_code(nft_map_be32_signed): ops = { 0: 'NF_DROP', 1: 'NF_ACCEPT', 2: 'NF_STOLEN', 3: 'NF_QUEUE', 4: 'NF_REPEAT', 5: 'NF_STOP', -1: 'NFT_CONTINUE', -2: 'NFT_BREAK', -3: 'NFT_JUMP', -4: 'NFT_GOTO', -5: 'NFT_RETURN', } class nft_flowtable_msg(nfgen_msg): prefix = 'NFTA_FLOWTABLE_' nla_map = ( ('NFTA_FLOWTABLE_UNSPEC', 'none'), ('NFTA_FLOWTABLE_TABLE', 'asciiz'), ('NFTA_FLOWTABLE_NAME', 'asciiz'), ('NFTA_FLOWTABLE_HOOK', 'flowtable_hook'), ('NFTA_FLOWTABLE_USE', 'be32'), ('NFTA_FLOWTABLE_HANDLE', 'be64'), ('NFTA_FLOWTABLE_PAD', 'hex'), ('NFTA_FLOWTABLE_FLAGS', 'nft_flowtable_flags'), ) class nft_flowtable_flags(nft_flags_be32): ops = ('NFT_FLOWTABLE_HW_OFFLOAD', 'NFT_FLOWTABLE_COUNTER') class flowtable_hook(nft_device): nla_map = ( ('NFTA_FLOWTABLE_HOOK_UNSPEC', 'none'), ('NFTA_FLOWTABLE_HOOK_NUM', 'be32'), ('NFTA_FLOWTABLE_HOOK_PRIORITY', 'be32'), ('NFTA_FLOWTABLE_HOOK_DEVS', 'device_attributes'), ) class NFTSocket(NetlinkSocket): def __init__(self, version=1, attr_revision=0, nfgen_family=2): self.asyncore = AsyncNFTSocket(version, attr_revision, nfgen_family) self.asyncore.local.keep_event_loop = True self.asyncore.event_loop.run_until_complete( self.asyncore.setup_endpoint() ) def begin(self): return self.asyncore.begin() def commit(self): return self.asyncore.commit() def request_get( self, msg, msg_type, msg_flags=NLM_F_REQUEST \| NLM_F_DUMP, terminate=None, ): async def collect_data(): return [ x async for x in await self.asyncore.request_get( msg, msg_type, msg_flags, terminate ) ] return self._run_with_cleanup(collect_data, 'ntfsocket-get') def request_put(self, msg, msg_type, msg_flags=NLM_F_REQUEST): return self._run_with_cleanup( self.asyncore.request_put, 'nftsocket-put', msg, msg_type, msg_flags, ) def _command(self, msg_class, commands, cmd, kwarg): return self._run_with_cleanup( self.asyncore._command, 'nftsocket-cmd', msg_class, commands, cmd, kwarg, ) class AsyncNFTSocket(AsyncNetlinkSocket): ''' NFNetlink socket (family=NETLINK_NETFILTER). Implements API to the nftables functionality. ''' policy = { NFT_MSG_NEWTABLE: nft_table_msg, NFT_MSG_GETTABLE: nft_table_msg, NFT_MSG_DELTABLE: nft_table_msg, NFT_MSG_NEWCHAIN: nft_chain_msg, NFT_MSG_GETCHAIN: nft_chain_msg, NFT_MSG_DELCHAIN: nft_chain_msg, NFT_MSG_NEWRULE: nft_rule_msg, NFT_MSG_GETRULE: nft_rule_msg, NFT_MSG_DELRULE: nft_rule_msg, NFT_MSG_NEWSET: nft_set_msg, NFT_MSG_GETSET: nft_set_msg, NFT_MSG_DELSET: nft_set_msg, NFT_MSG_NEWGEN: nft_gen_msg, NFT_MSG_GETGEN: nft_gen_msg, NFT_MSG_NEWSETELEM: nft_set_elem_list_msg, NFT_MSG_GETSETELEM: nft_set_elem_list_msg, NFT_MSG_DELSETELEM: nft_set_elem_list_msg, NFT_MSG_NEWFLOWTABLE: nft_flowtable_msg, NFT_MSG_GETFLOWTABLE: nft_flowtable_msg, NFT_MSG_DELFLOWTABLE: nft_flowtable_msg, } def __init__(self, version=1, attr_revision=0, nfgen_family=2): super().__init__(family=NETLINK_NETFILTER) policy = dict( [ (x \| (NFNL_SUBSYS_NFTABLES << 8), y) for (x, y) in self.policy.items() ] ) self.register_policy(policy) self._proto_version = version self._attr_revision = attr_revision self._nfgen_family = nfgen_family self._ts = threading.local() self._write_lock = threading.RLock() def begin(self): with self._write_lock: if hasattr(self._ts, 'data'): # transaction is already started return False self._ts.data = b'' self._ts.seqnum = ( self.addr_pool.alloc(), # begin self.addr_pool.alloc(), # tx self.addr_pool.alloc(), ) # commit msg = nfgen_msg() msg['res_id'] = NFNL_SUBSYS_NFTABLES msg['header']['type'] = 0x10 msg['header']['flags'] = NLM_F_REQUEST msg['header']['sequence_number'] = self._ts.seqnum[0] msg.encode() self._ts.data += msg.data return True def commit(self): with self._write_lock: msg = nfgen_msg() msg['res_id'] = NFNL_SUBSYS_NFTABLES msg['header']['type'] = 0x11 msg['header']['flags'] = NLM_F_REQUEST msg['header']['sequence_number'] = self._ts.seqnum[2] msg.encode() self._ts.data += msg.data self.sendto(self._ts.data, (0, 0)) for seqnum in self._ts.seqnum: self.addr_pool.free(seqnum, ban=10) del self._ts.data async def request_get( self, msg, msg_type, msg_flags=NLM_F_REQUEST \| NLM_F_DUMP, terminate=None, ): ''' Read-only requests do not require transactions. Just run the request and get an answer. ''' msg['nfgen_family'] = self._nfgen_family return await self.nlm_request( msg, msg_type \| (NFNL_SUBSYS_NFTABLES << 8), msg_flags, terminate=terminate, ) async def request_put(self, msg, msg_type, msg_flags=NLM_F_REQUEST): ''' Read-write requests. ''' one_shot = self.begin() msg['header']['type'] = (NFNL_SUBSYS_NFTABLES << 8) \| msg_type msg['header']['flags'] = msg_flags msg['header']['sequence_number'] = self._ts.seqnum[1] msg['nfgen_family'] = self._nfgen_family msg.encode() self._ts.data += msg.data if one_shot: self.commit() async def _command(self, msg_class, commands, cmd, kwarg): flags = kwarg.pop('flags', NLM_F_ACK) cmd_name = cmd cmd_flags = { 'add': NLM_F_CREATE \| NLM_F_APPEND, 'create': NLM_F_CREATE \| NLM_F_APPEND \| NLM_F_EXCL, 'insert': NLM_F_CREATE, 'replace': NLM_F_REPLACE, } flags \|= cmd_flags.get(cmd, 0) flags \|= NLM_F_REQUEST cmd = commands[cmd] msg = msg_class() msg['attrs'] = [] # # a trick to pass keyword arguments as On rderedDict instance: # # ordered_args = OrderedDict() # ordered_args['arg1'] = value1 # ordered_args['arg2'] = value2 # ... # nft.rule('add', kwarg=ordered_args) # if 'kwarg' in kwarg: kwarg = kwarg['kwarg'] # for key, value in kwarg.items(): nla = msg_class.name2nla(key) msg['attrs'].append([nla, value]) msg['header']['type'] = (NFNL_SUBSYS_NFTABLES << 8) \| cmd msg['header']['flags'] = flags \| NLM_F_REQUEST msg['nfgen_family'] = self._nfgen_family if cmd_name != 'get': trans_start = nfgen_msg() trans_start['res_id'] = NFNL_SUBSYS_NFTABLES trans_start['header']['type'] = 0x10 trans_start['header']['flags'] = NLM_F_REQUEST trans_end = nfgen_msg() trans_end['res_id'] = NFNL_SUBSYS_NFTABLES trans_end['header']['type'] = 0x11 trans_end['header']['flags'] = NLM_F_REQUEST messages = [trans_start, msg, trans_end] return [ x async for x in self.nlm_request_batch( messages, noraise=(flags & NLM_F_ACK) == 0 ) ] # Only throw an error when the request fails. For now, # do not return anything. else: return self.request_get(msg, msg['header']['type'], flags)[0] # call nft describe "data_type" for more informations DATA_TYPE_NAME_TO_INFO = { "verdict": (DATA_TYPE_VERDICT, 4, nft_data.nfta_data.verdict.verdict_code), "nf_proto": (DATA_TYPE_NFPROTO, 1, nlmsg_atoms.uint8), "bitmask": (DATA_TYPE_BITMASK, 4, nlmsg_atoms.uint32), "integer": (DATA_TYPE_INTEGER, 4, nlmsg_atoms.int32), "string": (DATA_TYPE_STRING, 0, nlmsg_atoms.asciiz), "lladdr": (DATA_TYPE_LLADDR, 0, nlmsg_atoms.lladdr), "ipv4_addr": (DATA_TYPE_IPADDR, 4, nlmsg_atoms.ip4addr), "ipv6_addr": (DATA_TYPE_IP6ADDR, 16, nlmsg_atoms.ip6addr), "ether_addr": (DATA_TYPE_ETHERADDR, 6, nlmsg_atoms.l2addr), "ether_type": (DATA_TYPE_ETHERADDR, 2, nlmsg_atoms.uint16), "inet_proto": (DATA_TYPE_INET_PROTOCOL, 1, nlmsg_atoms.uint8), } DATA_TYPE_ID_TO_NAME = { value[0]: key for key, value in DATA_TYPE_NAME_TO_INFO.items() }	43.76 KB	2025-05-25 12:26

Terminal