File: //lib/python3.6/site-packages/sshuttle/methods/__pycache__/pf.cpython-36.pyc
3
��^<C � @ s� d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl m
Z
mZmZmZmZmZmZmZmZ d dlmZ d dlmZmZmZm Z m Z d dl m Z d dg d�Z da!G d d
� d
e"�Z#G d d � d e#�Z$G d
d� de#�Z%G dd� de$�Z&G dd� de$�Z'ejdk�r(e&� Z(n4ejj)d��r>e%� Z(n ej*� j+d��rVe'� Z(ne$� Z(d dd�Z,dd� Z-dd� Z.G d d � d e �Z/dS ) � N)�ioctl) �c_char�c_uint8�c_uint16�c_uint32�Union� Structure�sizeof� addressof�memmove)�
subnet_weight)�debug1�debug2�debug3�Fatal�family_to_string)�
BaseMethodT)�started_by_sshuttle�loaded_by_sshuttle�Xtokenc @ s� e Zd ZdZdZdZdZdZdZdZ dZ
dZ G dd� de �Z
d d
� Zd d � Zed
d� �Zdd� Zedd� �Zedd� �Zd"dd�Zd#dd�Zedd� �Zed d � �Zed d � �Zed d!� �ZdS )$�Generici � � r � i c @ s* e Zd ZG dd� de�ZdefgZdZdS )zGeneric.pf_addrc @ s> e Zd Zdefded fded fded fded fgZd S )
zGeneric.pf_addr._pfaZv4Zv6� Zaddr8� Zaddr16r Zaddr32N)�__name__�
__module__� __qualname__r r r �_fields_� r r �/usr/lib/python3.6/pf.py�_pfa& s
r" �pfaN)r# )r r r r r" r Z _anonymous_r r r r! �pf_addr% s
r$ c C s� d| _ td | _d t| j�d@ d> B td�d> B d B | _d
t| j�d@ d> B td�d> B d
B | _dt| j�d@ d> B td�d> B d B | _ d S )N� ip i @l i� r �Dr � � �3 l l l )
�statusr �pfioc_pooladdrr �
pfioc_natlook�ord� DIOCNATLOOK�
pfioc_rule�DIOCCHANGERULE�DIOCBEGINADDRS)�selfr r r! �__init__0 s
((zGeneric.__init__c C s& d| j kr"td� td d7 < d S )Ns INFO:
Status: Disabledz-er � )r* �pfctl� _pf_context)r2 r r r! �enableA s
zGeneric.enablec C s4 t d| � td dkr t d� td d8 < d S )Nz -a %s -F allr r4 z-d)r5 r6 )�anchorr r r! �disableF s zGeneric.disablec
C s� dd� ||||gD �\}}}}t j||�}t j||�}t|�t|�ksJt�t|�} | j� }
||
_| j|
_||
_t t
|
j �|| � t t
|
j �|| � | j
|
||� tt� | jtt|
� jt
|
��� t j|
jt| jt
|
j��j�} t j| j|
j��} | | fS )Nc S s g | ] }t |��qS r )�int)�.0�vr r r! �
<listcomp>O s z%Generic.query_nat.<locals>.<listcomp>)�socketZ inet_pton�len�AssertionErrorr, �proto�PF_OUT� direction�afr r
�saddr�daddr�_add_natlook_portsr �
pf_get_devr. r r Z from_addressZ inet_ntop�rdaddr�rawZntohs�_get_natlook_port�rdxport)
r2 �familyrA Zsrc_ip�src_portZdst_ip�dst_portZ
packed_src_ipZ
packed_dst_ipZlength�pnl�ip�portr r r! � query_natM s$
zGeneric.query_natc C s t j|�| _t j|�| _d S )N)r> �htons�sxport�dxport)rP rN rO r r r! rG g s zGeneric._add_natlook_portsc C s | S )Nr )�xportr r r! rK l s zGeneric._get_natlook_portNc C sD |d krt d�d }|| _d| jd�|kr@| j| j|jd�� d S )Nz-s allr z
anchor "%s"�ASCII)r5 r* �encode�_add_anchor_rule�PF_PASS)r2 r8 r* r r r! � add_anchorsp s
zGeneric.add_anchorsc C s� |d kr| j � }tt|�| j |t| jt|��� tt|�| j tj d|�d� tt|�| j
tj d| j �d� t t
� tj|� tt|�| j
tj d| j�d� t t
� tj|� d S )N�Ir )r/ r r
�ANCHOR_CALL_OFFSET�min�
MAXPATHLENr? �RULE_ACTION_OFFSET�struct�pack�
ACTION_OFFSET�PF_CHANGE_GET_TICKETr rH �pfr0 �PF_CHANGE_ADD_TAIL)r2 �kind�name�prr r r! rZ w s zGeneric._add_anchor_rulec C s | t jkrdS dS )Ns inets inet6)r> �AF_INET)rM r r r! �
_inet_version� s zGeneric._inet_versionc C s | t jkrdS dS )Ns 127.0.0.1s ::1)r> rk )rM r r r! �_lo_addr� s zGeneric._lo_addrc C s2 t |t�st�td|jd� � td| |� d S )Nzrules:
rX z-a %s -f /dev/stdin)�
isinstance�bytesr@ r �decoder5 )r8 �rulesr r r! � add_rules� s zGeneric.add_rulesc C s dt d�d kS )Ns skipz-s Interfaces -i lo -vr )r5 r r r r! �has_skip_loopback� s zGeneric.has_skip_loopback)N)N)r r r r` rg re r[ �PF_RDRrB rd �POOL_TICKET_OFFSETr^ r r$ r3 r7 � staticmethodr9 rS rG rK r\ rZ rl rm rr rs r r r r! r s,
r c sZ e Zd ZdZdd� Z� fdd�Z� fdd�Z� fdd �Zd� fd d � Z� fd
d�Z � Z
S )�FreeBsdi� c C s. G dd� dt �}tj| �}td |_||_|S )Nc
@ s^ e Zd ZejZdefdefdefdefdefdefdefdefd efd
efd efd efg Zd
S )z&FreeBsd.__new__.<locals>.pfioc_natlookrE rF �rsaddrrI rU rV �rsxportrL rD rA �
proto_variantrC N)r r r r r$ r r r r r r r! r, � s r, i� )r r �__new__r r/ r, )�clsr, Zfreebsdr r r! r{ � s
zFreeBsd.__new__c s0 t jddg�}tt| �j� |dkr,dtd< d S )NZkldloadrf r Tr )� ssubprocess�call�superrw r7 r6 )r2 �
returncode)� __class__r r! r7 � s zFreeBsd.enablec s6 t t| �j|� td r2td dkr2tjddg� d S )Nr r r Z kldunloadrf )r rw r9 r6 r} r~ )r2 r8 )r� r r! r9 � s zFreeBsd.disablec sJ t d�d }d| jd�|kr2| j| j|jd�� tt| �j||d� d S )Nz-s allr z
rdr-anchor "%s"rX )r* )r5 rY rZ rt r rw r\ )r2 r8 r* )r� r r! r\ � s zFreeBsd.add_anchorsNc s\ |p
| j � }| j� }tt� | j|� tt|�| j |dd� d� tt | �j
|||d� d S )Nr r )rj ) r/ r+ r rH r1 r r
ru r rw rZ )r2 rh ri rj Zppa)r� r r! rZ � s
zFreeBsd._add_anchor_rulec s� | j |�� | j|��g }� ��fdd�|D �}� fdd�|D �} |r�|jddjdd� |D �� � |jd� �|f � | jd� � d j|| | �d }
tt| �j||
� d S )
Nc s& g | ] \}}|sd � �|��f �qS )s: rdr pass on lo0 %s proto tcp from ! %s to %s -> %s port %rr )r; �exclude�subnet)� inet_version�lo_addrrR r r! r= � s z%FreeBsd.add_rules.<locals>.<listcomp>c s, g | ]$\}}|s d � |f n
d� |f �qS )s3 pass out route-to lo0 %s proto tcp to %s keep states pass out %s proto tcp to %sr )r; r� r� )r� r r! r= � s s table <dns_servers> {%s}� ,c S s g | ]}|d j d��qS )r4 rX )rY )r; �nsr r r! r= � s sC rdr pass on lo0 %s proto udp to <dns_servers> port 53 -> %s port %rsF pass out route-to lo0 %s proto udp to <dns_servers> port 53 keep state�
)rl rm �append�joinr rw rr ) r2 r8 �includesrR �dnsport�nslistrM �tables�translating_rules�filtering_rulesrq )r� )r� r� rR r! rr � s(
zFreeBsd.add_rules)N) r r r ra r{ r7 r9 r\ rZ rr �
__classcell__r r )r� r! rw � s rw c s@ e Zd ZdZdZdZ� fdd�Z� fdd�Z� fdd �Z� Z S )
�OpenBsdr i� i c s2 G dd� dt �}td | _|| _tt| �j� d S )Nc @ sj e Zd ZejZdefdefdefdefdefdefdefdefd efd
efd efd efd
efdefgZdS )z'OpenBsd.__init__.<locals>.pfioc_natlookrE rF rx rI ZrdomainZrrdomainrU rV ry rL rD rA rz rC N)r r r r r$ r r r r r r r! r, � s r, i`
)r r r/ r, r r� r3 )r2 r, )r� r r! r3 � s
zOpenBsd.__init__c s& | j � rtdd� tt| �j|� d S )Nz
-f /dev/stdins match on lo
)rs r5 r r� r\ )r2 r8 )r� r r! r\ s
zOpenBsd.add_anchorsc s� | j |�� | j|��g }� ��fdd�|D �}� fdd�|D �} |r�|jddjdd� |D �� � |jd� �|f � | jd� � d j|| | �d }
tt| �j||
� d S )
Nc s$ g | ] \}}|sd � |��f �qS )s6 pass in on lo0 %s proto tcp to %s divert-to %s port %rr )r; r� r� )r� r� rR r r! r= s z%OpenBsd.add_rules.<locals>.<listcomp>c s, g | ]$\}}|s d � |f n
d� |f �qS )s3 pass out %s proto tcp to %s route-to lo0 keep states pass out %s proto tcp to %sr )r; r� r� )r� r r! r= # s s table <dns_servers> {%s}r� c S s g | ]}|d j d��qS )r4 rX )rY )r; r� r r r! r= - s sF pass in on lo0 %s proto udp to <dns_servers> port 53 rdr-to %s port %rsF pass out %s proto udp to <dns_servers> port 53 route-to lo0 keep stater� )rl rm r� r� r r� rr ) r2 r8 r� rR r� r� rM r� r� r� rq )r� )r� r� rR r! rr s(
zOpenBsd.add_rules)
r r r ru ra r^ r3 r\ rr r� r r )r� r! r� � s r� c sL e Zd ZdZ� fdd�Zdd� Zdd� Z� fdd �Zd
d � Zd d
� Z � Z
S )�Darwini� c sF G dd� dt �� G � fdd�dt�}td | _|| _tt| �j� d S )Nc @ s" e Zd ZdefdefdefgZdS )z'Darwin.__init__.<locals>.pf_state_xportrR Zcall_idZspiN)r r r r r r r r r r! �pf_state_xport? s r� c
s^ e Zd ZejZdefdefdefdefd� fd� fd� fd� fd efd
efd efd efg Zd
S )z&Darwin.__init__.<locals>.pfioc_natlookrE rF rx rI rU rV ry rL rD rA rz rC N)r r r r r$ r r r )r� r r! r, D s r, i )r r r r/ r, r r� r3 )r2 r, )r� )r� r! r3 > s
zDarwin.__init__c C s, t d�}td jtjd|d �jd�� d S )Nz-Er s Token : (.+)r4 )r5 r6 r� �re�search�group)r2 �or r r! r7 W s z
Darwin.enablec C s2 t d| � td r.t dtd j� jd� � d S )Nz -a %s -F allr z-X %srX )r5 r6 �poprp )r2 r8 r r r! r9 [ s zDarwin.disablec s& | j � rtdd� tt| �j|� d S )Nz
-f /dev/stdins pass on lo
)rs r5 r r� r\ )r2 r8 )r� r r! r\ ` s
zDarwin.add_anchorsc C s t j|�|j_t j|�|j_d S )N)r> rT rU rR rV )r2 rP rN rO r r r! rG h s zDarwin._add_natlook_portsc C s |j S )N)rR )r2 rW r r r! rK l s zDarwin._get_natlook_port) r r r ra r3 r7 r9 r\ rG rK r� r r )r� r! r� ; s r� c s e Zd ZdZ� fdd�Z� ZS )�PfSensei� c s t d | _tt| �j� d S )Ni( )r r/ r r� r3 )r2 )r� r r! r3 s s
zPfSense.__init__)r r r ra r3 r� r r )r� r! r� p s r� �darwinZopenbsdZpfSensec C sr dgt j| � }tddj|� � tjd dd�}tj|tjtjtj|d�}|j |�}|j
rnt d||j
f ��|S ) Nr5 z>> %s
� �PATH�C)r� �LC_ALL)�stdin�stdout�stderr�envz%r returned %d) �shlex�splitr
r� �os�environr} �Popen�PIPEZ communicater� r )�argsr� �argvr� �pr� r r r! r5 � s
r5 c C s t d krtjdtj�a t S )Nz/dev/pf)�_pf_fdr� �open�O_RDWRr r r r! rH � s rH c C s d| t jkrdnd|f S )Nz
sshuttle%s-%d� �6)r> rk )rM rR r r r! �
pf_get_anchor� s r� c s< e Zd Z� fdd�Zdd� Zdd� Zdd� Zd d
� Z� ZS ) �Methodc s t t| �j� }d|_|S )NT)r r� �get_supported_featuresZipv6)r2 �result)r� r r! r� � s z Method.get_supported_featuresc C s
| j j}y |j� }W nB tjk
rV tj� d d� \}}|jd tj krR|j
� S Y nX |j
� }|j tj |d j
d�|d |d j
d�|d f}d| }|j|� |j� |j� } t|jd�d | jd� � | jd��r| dd � jd �\}
} |
jd�t| �fS |j
� S )
Nr r rX r4 s QUERY_PF_NAT %d,%d,%s,%d,%s,%d
z > s QUERY_PF_NAT_SUCCESS � r� )Zfirewall�pfileZ getpeernamer> �error�sys�exc_infor� �errnoZEINVALZ getsocknamerM Z IPPROTO_TCPrY �write�flush�readliner rp �
startswithr� r: ) r2 Zsockr� Zpeer�_�e�proxyr� Zout_lineZin_linerQ rR r r r! �
get_tcp_dstip� s(
zMethod.get_tcp_dstipc C s� |t jt jgkr tdt|� ��|r,td��|r�g }xNt|td�D ]>\} }
} } }
}|j| d| jd�|
|
rtd|
|f ndf f� qBW t ||�}t
j |� t
j ||||||� t
j
� d S )Nz1Address family "%s" unsupported by pf method_namez#UDP not supported by pf method_name)�keys %s/%d%srX s port %d:%dr% )r> rk �AF_INET6� Exceptionr �sortedr r� rY r� rf r\ rr r7 )r2 rR r� r� rM Zsubnets�udp�userr� r� ZswidthZsexcludeZsnetZfportZlportr8 r r r! �setup_firewall� s$
zMethod.setup_firewallc C s@ |t jt jgkr tdt|� ��|r,td��tjt||�� d S )Nz1Address family "%s" unsupported by pf method_namez#UDP not supported by pf method_name)r> rk r� r� r rf r9 r� )r2 rR rM r� r� r r r! �restore_firewall� s zMethod.restore_firewallc C s� |j d�rxy,tj|dd � jd�� }tjjd| � W n2 tk
rh } ztjjd| � W Y d d }~X nX tjj� dS dS d S )Nz
QUERY_PF_NAT �
�,zQUERY_PF_NAT_SUCCESS %s,%r
zQUERY_PF_NAT_FAILURE %s
TF) r� rf rS r� r� r� r� �IOErrorr� )r2 �line�dstr� r r r! �firewall_command� s
"
zMethod.firewall_command) r r r r� r� r� r� r� r� r r )r� r! r� � s
r� )N)0r� r� �platformr� r> r� rb �
subprocessr} r� Zfcntlr Zctypesr r r r r r r r
r Zsshuttle.firewallr Zsshuttle.helpersr
r r r r Zsshuttle.methodsr r6 r� �objectr rw r� r� r� rf r� �version�endswithr5 rH r� r� r r r r! �<module> sD , XF5