<h2>Editing File: /lib/python3.6/site-packages/firewall/core/ipXtables.py</h2><form method='post'><textarea name='content' class='file-edit'># -*- coding: utf-8 -*-
#
# Copyright (C) 2010-2016 Red Hat, Inc.
#
# Authors:
# Thomas Woerner &lt;twoerner@redhat.com&gt;
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#

import os.path
import copy

from firewall.core.prog import runProg
from firewall.core.logger import log
from firewall.functions import tempFile, readfile, splitArgs, check_mac, portStr, \
                               check_single_address, check_address, normalizeIP6
from firewall import config
from firewall.errors import FirewallError, INVALID_PASSTHROUGH, INVALID_RULE, UNKNOWN_ERROR, INVALID_ADDR, \
                            INVALID_ICMPTYPE
from firewall.core.rich import Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark, \
                               Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock
from firewall.core.icmp import ICMP_TYPES, ICMPV6_TYPES
import string

POLICY_CHAIN_PREFIX = &quot;&quot;

BUILT_IN_CHAINS = {
    &quot;security&quot;: [ &quot;INPUT&quot;, &quot;OUTPUT&quot;, &quot;FORWARD&quot; ],
    &quot;raw&quot;: [ &quot;PREROUTING&quot;, &quot;OUTPUT&quot; ],
    &quot;mangle&quot;: [ &quot;PREROUTING&quot;, &quot;POSTROUTING&quot;, &quot;INPUT&quot;, &quot;OUTPUT&quot;, &quot;FORWARD&quot; ],
    &quot;nat&quot;: [ &quot;PREROUTING&quot;, &quot;POSTROUTING&quot;, &quot;OUTPUT&quot; ],
    &quot;filter&quot;: [ &quot;INPUT&quot;, &quot;OUTPUT&quot;, &quot;FORWARD&quot; ],
}

DEFAULT_REJECT_TYPE = {
    &quot;ipv4&quot;: &quot;icmp-host-prohibited&quot;,
    &quot;ipv6&quot;: &quot;icmp6-adm-prohibited&quot;,
}

ICMP = {
    &quot;ipv4&quot;: &quot;icmp&quot;,
    &quot;ipv6&quot;: &quot;ipv6-icmp&quot;,
}

# ipv ebtables also uses this
#
def common_reverse_rule(args):
    &quot;&quot;&quot; Inverse valid rule &quot;&quot;&quot;

    replace_args = {
        # Append
        &quot;-A&quot;: &quot;-D&quot;,
        &quot;--append&quot;: &quot;--delete&quot;,
        # Insert
        &quot;-I&quot;: &quot;-D&quot;,
        &quot;--insert&quot;: &quot;--delete&quot;,
        # New chain
        &quot;-N&quot;: &quot;-X&quot;,
        &quot;--new-chain&quot;: &quot;--delete-chain&quot;,
    }

    ret_args = args[:]

    for arg in replace_args:
        try:
            idx = ret_args.index(arg)
        except Exception:
            continue

        if arg in [ &quot;-I&quot;, &quot;--insert&quot; ]:
            # With insert rulenum, then remove it if it is a number
            # Opt at position idx, chain at position idx+1, [rulenum] at
            # position idx+2
            try:
                int(ret_args[idx+2])
            except Exception:
                pass
            else:
                ret_args.pop(idx+2)

        ret_args[idx] = replace_args[arg]
    return ret_args

def common_reverse_passthrough(args):
    &quot;&quot;&quot; Reverse valid passthough rule &quot;&quot;&quot;

    replace_args = {
        # Append
        &quot;-A&quot;: &quot;-D&quot;,
        &quot;--append&quot;: &quot;--delete&quot;,
        # Insert
        &quot;-I&quot;: &quot;-D&quot;,
        &quot;--insert&quot;: &quot;--delete&quot;,
        # New chain
        &quot;-N&quot;: &quot;-X&quot;,
        &quot;--new-chain&quot;: &quot;--delete-chain&quot;,
    }

    ret_args = args[:]

    for x in replace_args:
        try:
            idx = ret_args.index(x)
        except ValueError:
            continue

        if x in [ &quot;-I&quot;, &quot;--insert&quot; ]:
            # With insert rulenum, then remove it if it is a number
            # Opt at position idx, chain at position idx+1, [rulenum] at
            # position idx+2
            try:
                int(ret_args[idx+2])
            except ValueError:
                pass
            else:
                ret_args.pop(idx+2)

        ret_args[idx] = replace_args[x]
        return ret_args

    raise FirewallError(INVALID_PASSTHROUGH,
                        &quot;no '-A', '-I' or '-N' arg&quot;)

# ipv ebtables also uses this
#
def common_check_passthrough(args):
    &quot;&quot;&quot; Check if passthough rule is valid (only add, insert and new chain
    rules are allowed) &quot;&quot;&quot;

    args = set(args)
    not_allowed = set([&quot;-C&quot;, &quot;--check&quot;,           # check rule
                       &quot;-D&quot;, &quot;--delete&quot;,          # delete rule
                       &quot;-R&quot;, &quot;--replace&quot;,         # replace rule
                       &quot;-L&quot;, &quot;--list&quot;,            # list rule
                       &quot;-S&quot;, &quot;--list-rules&quot;,      # print rules
                       &quot;-F&quot;, &quot;--flush&quot;,           # flush rules
                       &quot;-Z&quot;, &quot;--zero&quot;,            # zero rules
                       &quot;-X&quot;, &quot;--delete-chain&quot;,    # delete chain
                       &quot;-P&quot;, &quot;--policy&quot;,          # policy
                       &quot;-E&quot;, &quot;--rename-chain&quot;])   # rename chain)
    # intersection of args and not_allowed is not empty, i.e.
    # something from args is not allowed
    if len(args &amp; not_allowed) &gt; 0:
        raise FirewallError(INVALID_PASSTHROUGH,
                            &quot;arg '%s' is not allowed&quot; %
                            list(args &amp; not_allowed)[0])

    # args need to contain one of -A, -I, -N
    needed = set([&quot;-A&quot;, &quot;--append&quot;,
                  &quot;-I&quot;, &quot;--insert&quot;,
                  &quot;-N&quot;, &quot;--new-chain&quot;])
    # empty intersection of args and needed, i.e.
    # none from args contains any needed command
    if len(args &amp; needed) == 0:
        raise FirewallError(INVALID_PASSTHROUGH,
                            &quot;no '-A', '-I' or '-N' arg&quot;)

class ip4tables(object):
    ipv = &quot;ipv4&quot;
    name = &quot;ip4tables&quot;
    policies_supported = True

    def __init__(self, fw):
        self._fw = fw
        self._command = config.COMMANDS[self.ipv]
        self._restore_command = config.COMMANDS[&quot;%s-restore&quot; % self.ipv]
        self.wait_option = self._detect_wait_option()
        self.restore_wait_option = self._detect_restore_wait_option()
        self.fill_exists()
        self.available_tables = []
        self.rich_rule_priority_counts = {}
        self.policy_priority_counts = {}
        self.zone_source_index_cache = []
        self.our_chains = {} # chains created by firewalld

    def fill_exists(self):
        self.command_exists = os.path.exists(self._command)
        self.restore_command_exists = os.path.exists(self._restore_command)

    def __run(self, args):
        # convert to string list
        if self.wait_option and self.wait_option not in args:
            _args = [self.wait_option] + [&quot;%s&quot; % item for item in args]
        else:
            _args = [&quot;%s&quot; % item for item in args]
        log.debug2(&quot;%s: %s %s&quot;, self.__class__, self._command, &quot; &quot;.join(_args))
        (status, ret) = runProg(self._command, _args)
        if status != 0:
            raise ValueError(&quot;'%s %s' failed: %s&quot; % (self._command,
                                                     &quot; &quot;.join(_args), ret))
        return ret

    def _rule_replace(self, rule, pattern, replacement):
        try:
            i = rule.index(pattern)
        except ValueError:
            return False
        else:
            rule[i:i+1] = replacement
            return True

    def is_chain_builtin(self, ipv, table, chain):
        return table in BUILT_IN_CHAINS and \
               chain in BUILT_IN_CHAINS[table]

    def build_chain_rules(self, add, table, chain):
        rule = [ &quot;-t&quot;, table ]
        if add:
            rule.append(&quot;-N&quot;)
        else:
            rule.append(&quot;-X&quot;)
        rule.append(chain)
        return [rule]

    def build_rule(self, add, table, chain, index, args):
        rule = [ &quot;-t&quot;, table ]
        if add:
            rule += [ &quot;-I&quot;, chain, str(index) ]
        else:
            rule += [ &quot;-D&quot;, chain ]
        rule += args
        return rule

    def reverse_rule(self, args):
        return common_reverse_rule(args)

    def check_passthrough(self, args):
        common_check_passthrough(args)

    def reverse_passthrough(self, args):
        return common_reverse_passthrough(args)

    def passthrough_parse_table_chain(self, args):
        table = &quot;filter&quot;
        try:
            i = args.index(&quot;-t&quot;)
        except ValueError:
            pass
        else:
            if len(args) &gt;= i+1:
                table = args[i+1]
        chain = None
        for opt in [ &quot;-A&quot;, &quot;--append&quot;,
                     &quot;-I&quot;, &quot;--insert&quot;,
                     &quot;-N&quot;, &quot;--new-chain&quot; ]:
            try:
                i = args.index(opt)
            except ValueError:
                pass
            else:
                if len(args) &gt;= i+1:
                    chain = args[i+1]
        return (table, chain)

    def _run_replace_zone_source(self, rule, zone_source_index_cache):
        try:
            i = rule.index(&quot;%%ZONE_SOURCE%%&quot;)
            rule.pop(i)
            zone = rule.pop(i)
            if &quot;-m&quot; == rule[4]: # ipset/mac
                zone_source = (zone, rule[7]) # (zone, address)
            else:
                zone_source = (zone, rule[5]) # (zone, address)
        except ValueError:
            try:
                i = rule.index(&quot;%%ZONE_INTERFACE%%&quot;)
                rule.pop(i)
                zone_source = None
            except ValueError:
                return

        rule_add = True
        if rule[0] in [&quot;-D&quot;, &quot;--delete&quot;]:
            rule_add = False

        if zone_source and not rule_add:
            if zone_source in zone_source_index_cache:
                zone_source_index_cache.remove(zone_source)
        elif rule_add:
            if zone_source:
                # order source based dispatch by zone name
                if zone_source not in zone_source_index_cache:
                    zone_source_index_cache.append(zone_source)
                    zone_source_index_cache.sort(key=lambda x: x[0])

                index = zone_source_index_cache.index(zone_source)
            else:
                if self._fw._allow_zone_drifting:
                    index = 0
                else:
                    index = len(zone_source_index_cache)

            rule[0] = &quot;-I&quot;
            rule.insert(2, &quot;%d&quot; % (index + 1))

    def _set_rule_replace_priority(self, rule, priority_counts, token):
        &quot;&quot;&quot;
        Change something like
          -t filter -I public_IN %%RICH_RULE_PRIORITY%% 123
        or
          -t filter -A public_IN %%RICH_RULE_PRIORITY%% 321
        into
          -t filter -I public_IN 4
        or
          -t filter -I public_IN
        &quot;&quot;&quot;
        try:
            i = rule.index(token)
        except ValueError:
            pass
        else:
            rule_add = True
            insert = False
            insert_add_index = -1
            rule.pop(i)
            priority = rule.pop(i)
            if type(priority) != int:
                raise FirewallError(INVALID_RULE, &quot;priority must be followed by a number&quot;)

            table = &quot;filter&quot;
            for opt in [ &quot;-t&quot;, &quot;--table&quot; ]:
                try:
                    j = rule.index(opt)
                except ValueError:
                    pass
                else:
                    if len(rule) &gt;= j+1:
                        table = rule[j+1]
            for opt in [ &quot;-A&quot;, &quot;--append&quot;,
                         &quot;-I&quot;, &quot;--insert&quot;,
                         &quot;-D&quot;, &quot;--delete&quot; ]:
                try:
                    insert_add_index = rule.index(opt)
                except ValueError:
                    pass
                else:
                    if len(rule) &gt;= insert_add_index+1:
                        chain = rule[insert_add_index+1]

                    if opt in [ &quot;-I&quot;, &quot;--insert&quot; ]:
                        insert = True
                    if opt in [ &quot;-D&quot;, &quot;--delete&quot; ]:
                        rule_add = False

            chain = (table, chain)

            # Add the rule to the priority counts. We don't need to store the
            # rule, just bump the ref count for the priority value.
            if not rule_add:
                if chain not in priority_counts or \
                   priority not in priority_counts[chain] or \
                   priority_counts[chain][priority] &lt;= 0:
                    raise FirewallError(UNKNOWN_ERROR, &quot;nonexistent or underflow of priority count&quot;)

                priority_counts[chain][priority] -= 1
            else:
                if chain not in priority_counts:
                    priority_counts[chain] = {}
                if priority not in priority_counts[chain]:
                    priority_counts[chain][priority] = 0

                # calculate index of new rule
                index = 1
                for p in sorted(priority_counts[chain].keys()):
                    if p == priority and insert:
                        break
                    index += priority_counts[chain][p]
                    if p == priority:
                        break

                priority_counts[chain][priority] += 1

                rule[insert_add_index] = &quot;-I&quot;
                rule.insert(insert_add_index+2, &quot;%d&quot; % index)

    def set_rules(self, rules, log_denied):
        temp_file = tempFile()

        table_rules = { }
        rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts)
        policy_priority_counts = copy.deepcopy(self.policy_priority_counts)
        zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache)
        for _rule in rules:
            rule = _rule[:]

            # replace %%REJECT%%
            self._rule_replace(rule, &quot;%%REJECT%%&quot;, \
                    [&quot;REJECT&quot;, &quot;--reject-with&quot;, DEFAULT_REJECT_TYPE[self.ipv]])

            # replace %%ICMP%%
            self._rule_replace(rule, &quot;%%ICMP%%&quot;, [ICMP[self.ipv]])

            # replace %%LOGTYPE%%
            try:
                i = rule.index(&quot;%%LOGTYPE%%&quot;)
            except ValueError:
                pass
            else:
                if log_denied == &quot;off&quot;:
                    continue
                if log_denied in [ &quot;unicast&quot;, &quot;broadcast&quot;, &quot;multicast&quot; ]:
                    rule[i:i+1] = [ &quot;-m&quot;, &quot;pkttype&quot;, &quot;--pkt-type&quot;, log_denied ]
                else:
                    rule.pop(i)

            self._set_rule_replace_priority(rule, rich_rule_priority_counts, &quot;%%RICH_RULE_PRIORITY%%&quot;)
            self._set_rule_replace_priority(rule, policy_priority_counts, &quot;%%POLICY_PRIORITY%%&quot;)
            self._run_replace_zone_source(rule, zone_source_index_cache)

            table = &quot;filter&quot;
            # get table form rule
            for opt in [ &quot;-t&quot;, &quot;--table&quot; ]:
                try:
                    i = rule.index(opt)
                except ValueError:
                    pass
                else:
                    if len(rule) &gt;= i+1:
                        rule.pop(i)
                        table = rule.pop(i)

            # we can not use joinArgs here, because it would use &quot;'&quot; instead
            # of '&quot;' for the start and end of the string, this breaks
            # iptables-restore
            for i in range(len(rule)):
                for c in string.whitespace:
                    if c in rule[i] and not (rule[i].startswith('&quot;') and
                                             rule[i].endswith('&quot;')):
                        rule[i] = '&quot;%s&quot;' % rule[i]

            table_rules.setdefault(table, []).append(rule)

        for table in table_rules:
            rules = table_rules[table]

            temp_file.write(&quot;*%s\n&quot; % table)
            for rule in rules:
                temp_file.write(&quot; &quot;.join(rule) + &quot;\n&quot;)
            temp_file.write(&quot;COMMIT\n&quot;)

        temp_file.close()

        stat = os.stat(temp_file.name)
        log.debug2(&quot;%s: %s %s&quot;, self.__class__, self._restore_command,
                   &quot;%s: %d&quot; % (temp_file.name, stat.st_size))
        args = [ ]
        if self.restore_wait_option:
            args.append(self.restore_wait_option)
        args.append(&quot;-n&quot;)

        (status, ret) = runProg(self._restore_command, args,
                                stdin=temp_file.name)

        if log.getDebugLogLevel() &gt; 2:
            lines = readfile(temp_file.name)
            if lines is not None:
                i = 1
                for line in lines:
                    log.debug3(&quot;%8d: %s&quot; % (i, line), nofmt=1, nl=0)
                    if not line.endswith(&quot;\n&quot;):
                        log.debug3(&quot;&quot;, nofmt=1)
                    i += 1

        os.unlink(temp_file.name)

        if status != 0:
            raise ValueError(&quot;'%s %s' failed: %s&quot; % (self._restore_command,
                                                     &quot; &quot;.join(args), ret))
        self.rich_rule_priority_counts = rich_rule_priority_counts
        self.policy_priority_counts = policy_priority_counts
        self.zone_source_index_cache = zone_source_index_cache

    def set_rule(self, rule, log_denied):
        # replace %%REJECT%%
        self._rule_replace(rule, &quot;%%REJECT%%&quot;, \
                [&quot;REJECT&quot;, &quot;--reject-with&quot;, DEFAULT_REJECT_TYPE[self.ipv]])

        # replace %%ICMP%%
        self._rule_replace(rule, &quot;%%ICMP%%&quot;, [ICMP[self.ipv]])

        # replace %%LOGTYPE%%
        try:
            i = rule.index(&quot;%%LOGTYPE%%&quot;)
        except ValueError:
            pass
        else:
            if log_denied == &quot;off&quot;:
                return &quot;&quot;
            if log_denied in [ &quot;unicast&quot;, &quot;broadcast&quot;, &quot;multicast&quot; ]:
                rule[i:i+1] = [ &quot;-m&quot;, &quot;pkttype&quot;, &quot;--pkt-type&quot;, log_denied ]
            else:
                rule.pop(i)

        rich_rule_priority_counts = copy.deepcopy(self.rich_rule_priority_counts)
        policy_priority_counts = copy.deepcopy(self.policy_priority_counts)
        zone_source_index_cache = copy.deepcopy(self.zone_source_index_cache)
        self._set_rule_replace_priority(rule, rich_rule_priority_counts, &quot;%%RICH_RULE_PRIORITY%%&quot;)
        self._set_rule_replace_priority(rule, policy_priority_counts, &quot;%%POLICY_PRIORITY%%&quot;)
        self._run_replace_zone_source(rule, zone_source_index_cache)

        output = self.__run(rule)

        self.rich_rule_priority_counts = rich_rule_priority_counts
        self.policy_priority_counts = policy_priority_counts
        self.zone_source_index_cache = zone_source_index_cache
        return output

    def get_available_tables(self, table=None):
        ret = []
        tables = [ table ] if table else BUILT_IN_CHAINS.keys()
        for table in tables:
            if table in self.available_tables:
                ret.append(table)
            else:
                try:
                    self.__run([&quot;-t&quot;, table, &quot;-L&quot;, &quot;-n&quot;])
                    self.available_tables.append(table)
                    ret.append(table)
                except ValueError:
                    log.debug1(&quot;%s table '%s' does not exist (or not enough permission to check).&quot; % (self.ipv, table))

        return ret

    def _detect_wait_option(self):
        wait_option = &quot;&quot;
        ret = runProg(self._command, [&quot;-w&quot;, &quot;-L&quot;, &quot;-n&quot;])  # since iptables-1.4.20
        if ret[0] == 0:
            wait_option = &quot;-w&quot;  # wait for xtables lock
            ret = runProg(self._command, [&quot;-w10&quot;, &quot;-L&quot;, &quot;-n&quot;])  # since iptables &gt; 1.4.21
            if ret[0] == 0:
                wait_option = &quot;-w10&quot;  # wait max 10 seconds
            log.debug2(&quot;%s: %s will be using %s option.&quot;, self.__class__, self._command, wait_option)

        return wait_option

    def _detect_restore_wait_option(self):
        temp_file = tempFile()
        temp_file.write(&quot;#foo&quot;)
        temp_file.close()

        wait_option = &quot;&quot;
        for test_option in [&quot;-w&quot;, &quot;--wait=2&quot;]:
            ret = runProg(self._restore_command, [test_option], stdin=temp_file.name)
            if ret[0] == 0 and &quot;invalid option&quot; not in ret[1] \
                           and &quot;unrecognized option&quot; not in ret[1]:
                wait_option = test_option
                break

        log.debug2(&quot;%s: %s will be using %s option.&quot;, self.__class__, self._restore_command, wait_option)

        os.unlink(temp_file.name)

        return wait_option

    def build_flush_rules(self):
        self.rich_rule_priority_counts = {}
        self.policy_priority_counts = {}
        self.zone_source_index_cache = []
        rules = []
        for table in BUILT_IN_CHAINS.keys():
            if not self.get_available_tables(table):
                continue
            # Flush firewall rules: -F
            # Delete firewall chains: -X
            # Set counter to zero: -Z
            for flag in [ &quot;-F&quot;, &quot;-X&quot;, &quot;-Z&quot; ]:
                rules.append([&quot;-t&quot;, table, flag])
        return rules

    def build_set_policy_rules(self, policy):
        rules = []
        _policy = &quot;DROP&quot; if policy == &quot;PANIC&quot; else policy
        for table in BUILT_IN_CHAINS.keys():
            if not self.get_available_tables(table):
                continue
            if table == &quot;nat&quot;:
                continue
            for chain in BUILT_IN_CHAINS[table]:
                rules.append([&quot;-t&quot;, table, &quot;-P&quot;, chain, _policy])
        return rules

    def supported_icmp_types(self, ipv=None):
        supported = set()

        if ipv is None or self.ipv == &quot;ipv4&quot;:
            supported.update(ICMP_TYPES.keys())
        if ipv is None or self.ipv == &quot;ipv6&quot;:
            supported.update(ICMPV6_TYPES.keys())

        return list(supported)

    def build_default_tables(self):
        # nothing to do, they always exist
        return []

    def build_default_rules(self, log_denied=&quot;off&quot;):
        default_rules = {}

        if self.get_available_tables(&quot;security&quot;):
            default_rules[&quot;security&quot;] = [ ]
            self.our_chains[&quot;security&quot;] = set()
            for chain in BUILT_IN_CHAINS[&quot;security&quot;]:
                default_rules[&quot;security&quot;].append(&quot;-N %s_direct&quot; % chain)
                default_rules[&quot;security&quot;].append(&quot;-A %s -j %s_direct&quot; % (chain, chain))
                self.our_chains[&quot;security&quot;].add(&quot;%s_direct&quot; % chain)

        if self.get_available_tables(&quot;raw&quot;):
            default_rules[&quot;raw&quot;] = [ ]
            self.our_chains[&quot;raw&quot;] = set()
            for chain in BUILT_IN_CHAINS[&quot;raw&quot;]:
                default_rules[&quot;raw&quot;].append(&quot;-N %s_direct&quot; % chain)
                default_rules[&quot;raw&quot;].append(&quot;-A %s -j %s_direct&quot; % (chain, chain))
                self.our_chains[&quot;raw&quot;].add(&quot;%s_direct&quot; % chain)

                if chain == &quot;PREROUTING&quot;:
                    for dispatch_suffix in [&quot;POLICIES_pre&quot;, &quot;ZONES_SOURCE&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;] if self._fw._allow_zone_drifting else [&quot;POLICIES_pre&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;]:
                        default_rules[&quot;raw&quot;].append(&quot;-N %s_%s&quot; % (chain, dispatch_suffix))
                        default_rules[&quot;raw&quot;].append(&quot;-A %s -j %s_%s&quot; % (chain, chain, dispatch_suffix))
                        self.our_chains[&quot;raw&quot;].update(set([&quot;%s_%s&quot; % (chain, dispatch_suffix)]))

        if self.get_available_tables(&quot;mangle&quot;):
            default_rules[&quot;mangle&quot;] = [ ]
            self.our_chains[&quot;mangle&quot;] = set()
            for chain in BUILT_IN_CHAINS[&quot;mangle&quot;]:
                default_rules[&quot;mangle&quot;].append(&quot;-N %s_direct&quot; % chain)
                default_rules[&quot;mangle&quot;].append(&quot;-A %s -j %s_direct&quot; % (chain, chain))
                self.our_chains[&quot;mangle&quot;].add(&quot;%s_direct&quot; % chain)

                if chain == &quot;PREROUTING&quot;:
                    for dispatch_suffix in [&quot;POLICIES_pre&quot;, &quot;ZONES_SOURCE&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;] if self._fw._allow_zone_drifting else [&quot;POLICIES_pre&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;]:
                        default_rules[&quot;mangle&quot;].append(&quot;-N %s_%s&quot; % (chain, dispatch_suffix))
                        default_rules[&quot;mangle&quot;].append(&quot;-A %s -j %s_%s&quot; % (chain, chain, dispatch_suffix))
                        self.our_chains[&quot;mangle&quot;].update(set([&quot;%s_%s&quot; % (chain, dispatch_suffix)]))

        if self.get_available_tables(&quot;nat&quot;):
            default_rules[&quot;nat&quot;] = [ ]
            self.our_chains[&quot;nat&quot;] = set()
            for chain in BUILT_IN_CHAINS[&quot;nat&quot;]:
                default_rules[&quot;nat&quot;].append(&quot;-N %s_direct&quot; % chain)
                default_rules[&quot;nat&quot;].append(&quot;-A %s -j %s_direct&quot; % (chain, chain))
                self.our_chains[&quot;nat&quot;].add(&quot;%s_direct&quot; % chain)

                if chain in [ &quot;PREROUTING&quot;, &quot;POSTROUTING&quot; ]:
                    for dispatch_suffix in [&quot;POLICIES_pre&quot;, &quot;ZONES_SOURCE&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;] if self._fw._allow_zone_drifting else [&quot;POLICIES_pre&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;]:
                        default_rules[&quot;nat&quot;].append(&quot;-N %s_%s&quot; % (chain, dispatch_suffix))
                        default_rules[&quot;nat&quot;].append(&quot;-A %s -j %s_%s&quot; % (chain, chain, dispatch_suffix))
                        self.our_chains[&quot;nat&quot;].update(set([&quot;%s_%s&quot; % (chain, dispatch_suffix)]))

        default_rules[&quot;filter&quot;] = []
        self.our_chains[&quot;filter&quot;] = set()
        default_rules[&quot;filter&quot;].append(&quot;-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A INPUT -i lo -j ACCEPT&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-N INPUT_direct&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A INPUT -j INPUT_direct&quot;)
        self.our_chains[&quot;filter&quot;].update(set(&quot;INPUT_direct&quot;))
        for dispatch_suffix in [&quot;POLICIES_pre&quot;, &quot;ZONES_SOURCE&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;] if self._fw._allow_zone_drifting else [&quot;POLICIES_pre&quot;, &quot;ZONES&quot;, &quot;POLICIES_post&quot;]:
            default_rules[&quot;filter&quot;].append(&quot;-N INPUT_%s&quot; % (dispatch_suffix))
            default_rules[&quot;filter&quot;].append(&quot;-A INPUT -j INPUT_%s&quot; % (dispatch_suffix))
            self.our_chains[&quot;filter&quot;].update(set(&quot;INPUT_%s&quot; % (dispatch_suffix)))
        if log_denied != &quot;off&quot;:
            default_rules[&quot;filter&quot;].append(&quot;-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A INPUT -m conntrack --ctstate INVALID -j DROP&quot;)
        if log_denied != &quot;off&quot;:
            default_rules[&quot;filter&quot;].append(&quot;-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A INPUT -j %%REJECT%%&quot;)

        default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -i lo -j ACCEPT&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-N FORWARD_direct&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -j FORWARD_direct&quot;)
        self.our_chains[&quot;filter&quot;].update(set(&quot;FORWARD_direct&quot;))
        for dispatch_suffix in [&quot;POLICIES_pre&quot;]:
            default_rules[&quot;filter&quot;].append(&quot;-N FORWARD_%s&quot; % (dispatch_suffix))
            default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -j FORWARD_%s&quot; % (dispatch_suffix))
            self.our_chains[&quot;filter&quot;].update(set(&quot;FORWARD_%s&quot; % (dispatch_suffix)))
        for direction in [&quot;IN&quot;, &quot;OUT&quot;]:
            for dispatch_suffix in [&quot;ZONES_SOURCE&quot;, &quot;ZONES&quot;] if self._fw._allow_zone_drifting else [&quot;ZONES&quot;]:
                default_rules[&quot;filter&quot;].append(&quot;-N FORWARD_%s_%s&quot; % (direction, dispatch_suffix))
                default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -j FORWARD_%s_%s&quot; % (direction, dispatch_suffix))
                self.our_chains[&quot;filter&quot;].update(set(&quot;FORWARD_%s_%s&quot; % (direction, dispatch_suffix)))
        for dispatch_suffix in [&quot;POLICIES_post&quot;]:
            default_rules[&quot;filter&quot;].append(&quot;-N FORWARD_%s&quot; % (dispatch_suffix))
            default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -j FORWARD_%s&quot; % (dispatch_suffix))
            self.our_chains[&quot;filter&quot;].update(set(&quot;FORWARD_%s&quot; % (dispatch_suffix)))
        if log_denied != &quot;off&quot;:
            default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -m conntrack --ctstate INVALID -j DROP&quot;)
        if log_denied != &quot;off&quot;:
            default_rules[&quot;filter&quot;].append(&quot;-A FORWARD %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '&quot;)
        default_rules[&quot;filter&quot;].append(&quot;-A FORWARD -j %%REJECT%%&quot;)

        default_rules[&quot;filter&quot;] += [
            &quot;-N OUTPUT_direct&quot;,

            &quot;-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT&quot;,
            &quot;-A OUTPUT -o lo -j ACCEPT&quot;,
            &quot;-A OUTPUT -j OUTPUT_direct&quot;,
        ]
        self.our_chains[&quot;filter&quot;].update(set(&quot;OUTPUT_direct&quot;))
        for dispatch_suffix in [&quot;POLICIES_pre&quot;]:
            default_rules[&quot;filter&quot;].append(&quot;-N OUTPUT_%s&quot; % (dispatch_suffix))
            default_rules[&quot;filter&quot;].append(&quot;-A OUTPUT -j OUTPUT_%s&quot; % (dispatch_suffix))
            self.our_chains[&quot;filter&quot;].update(set(&quot;OUTPUT_%s&quot; % (dispatch_suffix)))
        for dispatch_suffix in [&quot;POLICIES_post&quot;]:
            default_rules[&quot;filter&quot;].append(&quot;-N OUTPUT_%s&quot; % (dispatch_suffix))
            default_rules[&quot;filter&quot;].append(&quot;-A OUTPUT -j OUTPUT_%s&quot; % (dispatch_suffix))
            self.our_chains[&quot;filter&quot;].update(set(&quot;OUTPUT_%s&quot; % (dispatch_suffix)))

        final_default_rules = []
        for table in default_rules:
            if table not in self.get_available_tables():
                continue
            for rule in default_rules[table]:
                final_default_rules.append([&quot;-t&quot;, table] + splitArgs(rule))

        return final_default_rules

    def get_zone_table_chains(self, table):
        if table == &quot;filter&quot;:
            return { &quot;INPUT&quot;, &quot;FORWARD_IN&quot;, &quot;FORWARD_OUT&quot; }
        if table == &quot;mangle&quot;:
            if &quot;mangle&quot; in self.get_available_tables():
                return { &quot;PREROUTING&quot; }
        if table == &quot;nat&quot;:
            if &quot;nat&quot; in self.get_available_tables():
                return { &quot;PREROUTING&quot;, &quot;POSTROUTING&quot; }
        if table == &quot;raw&quot;:
            if &quot;raw&quot; in self.get_available_tables():
                return { &quot;PREROUTING&quot; }

        return {}

    def build_policy_ingress_egress_rules(self, enable, policy, table, chain,
                                          ingress_interfaces, egress_interfaces,
                                          ingress_sources, egress_sources):
        p_obj = self._fw.policy.get_policy(policy)
        chain_suffix = &quot;pre&quot; if p_obj.priority &lt; 0 else &quot;post&quot;
        isSNAT = True if (table == &quot;nat&quot; and chain == &quot;POSTROUTING&quot;) else False
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT)

        ingress_fragments = []
        egress_fragments = []
        for interface in ingress_interfaces:
            ingress_fragments.append([&quot;-i&quot;, interface])
        for interface in egress_interfaces:
            egress_fragments.append([&quot;-o&quot;, interface])
        for addr in ingress_sources:
            ipv = self._fw.zone.check_source(addr)
            if ipv in [&quot;ipv4&quot;, &quot;ipv6&quot;] and not self.is_ipv_supported(ipv):
                continue
            ingress_fragments.append(self._rule_addr_fragment(&quot;-s&quot;, addr))
        for addr in egress_sources:
            ipv = self._fw.zone.check_source(addr)
            if ipv in [&quot;ipv4&quot;, &quot;ipv6&quot;] and not self.is_ipv_supported(ipv):
                continue
            # iptables can not match destination MAC
            if check_mac(addr) and chain in [&quot;POSTROUTING&quot;, &quot;FORWARD_OUT&quot;, &quot;OUTPUT&quot;]:
                continue

            egress_fragments.append(self._rule_addr_fragment(&quot;-d&quot;, addr))

        def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment):
            add_del = {True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]
            rule = [&quot;-t&quot;, table, add_del, &quot;%s_POLICIES_%s&quot; % (chain, chain_suffix),
                    &quot;%%POLICY_PRIORITY%%&quot;, p_obj.priority]
            if ingress_fragment:
                rule.extend(ingress_fragment)
            if egress_fragment:
                rule.extend(egress_fragment)
            rule.extend([&quot;-j&quot;, _policy])

            return rule

        rules = []
        if ingress_fragments:
            # zone --&gt; [zone, ANY, HOST]
            for ingress_fragment in ingress_fragments:
                # zone --&gt; zone
                if egress_fragments:
                    for egress_fragment in egress_fragments:
                        rules.append(_generate_policy_dispatch_rule(ingress_fragment, egress_fragment))
                elif egress_sources:
                    # if the egress source is not for the current family (there
                    # are no egress fragments), then avoid creating an invalid
                    # catch all rule.
                    pass
                else:
                    rules.append(_generate_policy_dispatch_rule(ingress_fragment, None))
        elif ingress_sources:
            # if the ingress source is not for the current family (there are no
            # ingress fragments), then avoid creating an invalid catch all
            # rule.
            pass
        else: # [ANY, HOST] --&gt; [zone, ANY, HOST]
            # [ANY, HOST] --&gt; zone
            if egress_fragments:
                for egress_fragment in egress_fragments:
                    rules.append(_generate_policy_dispatch_rule(None, egress_fragment))
            elif egress_sources:
                # if the egress source is not for the current family (there
                # are no egress fragments), then avoid creating an invalid
                # catch all rule.
                pass
            else:
                # [ANY, HOST] --&gt; [ANY, HOST]
                rules.append(_generate_policy_dispatch_rule(None, None))

        return rules

    def build_zone_source_interface_rules(self, enable, zone, policy, interface,
                                          table, chain, append=False):
        isSNAT = True if (table == &quot;nat&quot; and chain == &quot;POSTROUTING&quot;) else False
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
        opt = {
            &quot;PREROUTING&quot;: &quot;-i&quot;,
            &quot;POSTROUTING&quot;: &quot;-o&quot;,
            &quot;INPUT&quot;: &quot;-i&quot;,
            &quot;FORWARD_IN&quot;: &quot;-i&quot;,
            &quot;FORWARD_OUT&quot;: &quot;-o&quot;,
            &quot;OUTPUT&quot;: &quot;-o&quot;,
        }[chain]

        action = &quot;-g&quot;

        if enable and not append:
            rule = [ &quot;-I&quot;, &quot;%s_ZONES&quot; % chain, &quot;%%ZONE_INTERFACE%%&quot; ]
        elif enable:
            rule = [ &quot;-A&quot;, &quot;%s_ZONES&quot; % chain ]
        else:
            rule = [ &quot;-D&quot;, &quot;%s_ZONES&quot; % chain ]
            if not append:
                rule += [&quot;%%ZONE_INTERFACE%%&quot;]
        rule += [ &quot;-t&quot;, table, opt, interface, action, _policy ]
        return [rule]

    def _rule_addr_fragment(self, opt, address, invert=False):
        if address.startswith(&quot;ipset:&quot;):
            name = address[6:]
            if opt == &quot;-d&quot;:
                opt = &quot;dst&quot;
            else:
                opt = &quot;src&quot;
            flags = &quot;,&quot;.join([opt] * self._fw.ipset.get_dimension(name))
            return [&quot;-m&quot;, &quot;set&quot;, &quot;--match-set&quot;, name, flags]
        elif check_mac(address):
            # outgoing can not be set
            if opt == &quot;-d&quot;:
                raise FirewallError(INVALID_ADDR, &quot;Can't match a destination MAC.&quot;)
            return [&quot;-m&quot;, &quot;mac&quot;, &quot;--mac-source&quot;, address.upper()]
        else:
            if check_single_address(&quot;ipv6&quot;, address):
                address = normalizeIP6(address)
            elif check_address(&quot;ipv6&quot;, address):
                addr_split = address.split(&quot;/&quot;)
                address = normalizeIP6(addr_split[0]) + &quot;/&quot; + addr_split[1]
            return [opt, address]

    def build_zone_source_address_rules(self, enable, zone, policy,
                                        address, table, chain):
        add_del = { True: &quot;-I&quot;, False: &quot;-D&quot; }[enable]

        isSNAT = True if (table == &quot;nat&quot; and chain == &quot;POSTROUTING&quot;) else False
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)
        opt = {
            &quot;PREROUTING&quot;: &quot;-s&quot;,
            &quot;POSTROUTING&quot;: &quot;-d&quot;,
            &quot;INPUT&quot;: &quot;-s&quot;,
            &quot;FORWARD_IN&quot;: &quot;-s&quot;,
            &quot;FORWARD_OUT&quot;: &quot;-d&quot;,
            &quot;OUTPUT&quot;: &quot;-d&quot;,
        }[chain]

        if self._fw._allow_zone_drifting:
            zone_dispatch_chain = &quot;%s_ZONES_SOURCE&quot; % (chain)
        else:
            zone_dispatch_chain = &quot;%s_ZONES&quot; % (chain)

        # iptables can not match destination MAC
        if check_mac(address) and chain in [&quot;POSTROUTING&quot;, &quot;FORWARD_OUT&quot;, &quot;OUTPUT&quot;]:
            return []

        rule = [add_del, zone_dispatch_chain, &quot;%%ZONE_SOURCE%%&quot;, zone, &quot;-t&quot;, table]
        rule.extend(self._rule_addr_fragment(opt, address))
        rule.extend([&quot;-g&quot;, _policy])

        return [rule]

    def build_policy_chain_rules(self, enable, policy, table, chain):
        add_del_chain = { True: &quot;-N&quot;, False: &quot;-X&quot; }[enable]
        add_del_rule = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]
        isSNAT = True if (table == &quot;nat&quot; and chain == &quot;POSTROUTING&quot;) else False
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=isSNAT)

        self.our_chains[table].update(set([_policy,
                                      &quot;%s_log&quot; % _policy,
                                      &quot;%s_deny&quot; % _policy,
                                      &quot;%s_pre&quot; % _policy,
                                      &quot;%s_post&quot; % _policy,
                                      &quot;%s_allow&quot; % _policy]))

        rules = []
        rules.append([ add_del_chain, _policy, &quot;-t&quot;, table ])
        rules.append([ add_del_chain, &quot;%s_pre&quot; % _policy, &quot;-t&quot;, table ])
        rules.append([ add_del_chain, &quot;%s_log&quot; % _policy, &quot;-t&quot;, table ])
        rules.append([ add_del_chain, &quot;%s_deny&quot; % _policy, &quot;-t&quot;, table ])
        rules.append([ add_del_chain, &quot;%s_allow&quot; % _policy, &quot;-t&quot;, table ])
        rules.append([ add_del_chain, &quot;%s_post&quot; % _policy, &quot;-t&quot;, table ])
        rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;-j&quot;, &quot;%s_pre&quot; % _policy ])
        rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;-j&quot;, &quot;%s_log&quot; % _policy ])
        rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;-j&quot;, &quot;%s_deny&quot; % _policy ])
        rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;-j&quot;, &quot;%s_allow&quot; % _policy ])
        rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;-j&quot;, &quot;%s_post&quot; % _policy ])

        target = self._fw.policy._policies[policy].target

        if self._fw.get_log_denied() != &quot;off&quot;:
            if table == &quot;filter&quot;:
                if target in [ &quot;REJECT&quot;, &quot;%%REJECT%%&quot; ]:
                    rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;%%LOGTYPE%%&quot;,
                                   &quot;-j&quot;, &quot;LOG&quot;, &quot;--log-prefix&quot;,
                                   &quot;\&quot;%s_REJECT: \&quot;&quot; % _policy ])
                if target == &quot;DROP&quot;:
                    rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;%%LOGTYPE%%&quot;,
                                   &quot;-j&quot;, &quot;LOG&quot;, &quot;--log-prefix&quot;,
                                   &quot;\&quot;%s_DROP: \&quot;&quot; % _policy ])

        if table == &quot;filter&quot; and \
           target in [ &quot;ACCEPT&quot;, &quot;REJECT&quot;, &quot;%%REJECT%%&quot;, &quot;DROP&quot; ]:
            rules.append([ add_del_rule, _policy, &quot;-t&quot;, table, &quot;-j&quot;, target ])

        if not enable:
            rules.reverse()

        return rules

    def _rule_limit(self, limit):
        if not limit:
            return []
        s = [&quot;-m&quot;, &quot;limit&quot;, &quot;--limit&quot;, limit.value]
        if limit.burst is not None:
            s += [&quot;--limit-burst&quot;, limit.burst]
        return s

    def _rich_rule_chain_suffix(self, rich_rule):
        if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort, Rich_IcmpBlock]:
            # These are special and don't have an explicit action
            pass
        elif rich_rule.action:
            if type(rich_rule.action) not in [Rich_Accept, Rich_Reject, Rich_Drop, Rich_Mark]:
                raise FirewallError(INVALID_RULE, &quot;Unknown action %s&quot; % type(rich_rule.action))
        else:
            raise FirewallError(INVALID_RULE, &quot;No rule action specified.&quot;)

        if rich_rule.priority == 0:
            if type(rich_rule.element) in [Rich_Masquerade, Rich_ForwardPort] or \
               type(rich_rule.action) in [Rich_Accept, Rich_Mark]:
                return &quot;allow&quot;
            elif type(rich_rule.element) in [Rich_IcmpBlock] or \
                 type(rich_rule.action) in [Rich_Reject, Rich_Drop]:
                return &quot;deny&quot;
        elif rich_rule.priority &lt; 0:
            return &quot;pre&quot;
        else:
            return &quot;post&quot;

    def _rich_rule_chain_suffix_from_log(self, rich_rule):
        if not rich_rule.log and not rich_rule.audit:
            raise FirewallError(INVALID_RULE, &quot;Not log or audit&quot;)

        if rich_rule.priority == 0:
            return &quot;log&quot;
        elif rich_rule.priority &lt; 0:
            return &quot;pre&quot;
        else:
            return &quot;post&quot;

    def _rich_rule_priority_fragment(self, rich_rule):
        if rich_rule.priority == 0:
            return []
        return [&quot;%%RICH_RULE_PRIORITY%%&quot;, rich_rule.priority]

    def _rich_rule_log(self, policy, rich_rule, enable, table, rule_fragment):
        if not rich_rule.log:
            return []

        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule)
        rule = [&quot;-t&quot;, table, add_del, &quot;%s_%s&quot; % (_policy, chain_suffix)]
        rule += self._rich_rule_priority_fragment(rich_rule)
        rule += rule_fragment + [ &quot;-j&quot;, &quot;LOG&quot; ]
        if rich_rule.log.prefix:
            rule += [ &quot;--log-prefix&quot;, &quot;'%s'&quot; % rich_rule.log.prefix ]
        if rich_rule.log.level:
            rule += [ &quot;--log-level&quot;, &quot;%s&quot; % rich_rule.log.level ]
        rule += self._rule_limit(rich_rule.log.limit)

        return rule

    def _rich_rule_audit(self, policy, rich_rule, enable, table, rule_fragment):
        if not rich_rule.audit:
            return []

        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        chain_suffix = self._rich_rule_chain_suffix_from_log(rich_rule)
        rule = [&quot;-t&quot;, table, add_del, &quot;%s_%s&quot; % (_policy, chain_suffix)]
        rule += self._rich_rule_priority_fragment(rich_rule)
        rule += rule_fragment
        if type(rich_rule.action) == Rich_Accept:
            _type = &quot;accept&quot;
        elif type(rich_rule.action) == Rich_Reject:
            _type = &quot;reject&quot;
        elif type(rich_rule.action) ==  Rich_Drop:
            _type = &quot;drop&quot;
        else:
            _type = &quot;unknown&quot;
        rule += [ &quot;-j&quot;, &quot;AUDIT&quot;, &quot;--type&quot;, _type ]
        rule += self._rule_limit(rich_rule.audit.limit)

        return rule

    def _rich_rule_action(self, policy, rich_rule, enable, table, rule_fragment):
        if not rich_rule.action:
            return []

        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        chain_suffix = self._rich_rule_chain_suffix(rich_rule)
        chain = &quot;%s_%s&quot; % (_policy, chain_suffix)
        if type(rich_rule.action) == Rich_Accept:
            rule_action = [ &quot;-j&quot;, &quot;ACCEPT&quot; ]
        elif type(rich_rule.action) == Rich_Reject:
            rule_action = [ &quot;-j&quot;, &quot;REJECT&quot; ]
            if rich_rule.action.type:
                rule_action += [ &quot;--reject-with&quot;, rich_rule.action.type ]
        elif type(rich_rule.action) ==  Rich_Drop:
            rule_action = [ &quot;-j&quot;, &quot;DROP&quot; ]
        elif type(rich_rule.action) == Rich_Mark:
            table = &quot;mangle&quot;
            _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
            chain = &quot;%s_%s&quot; % (_policy, chain_suffix)
            rule_action = [ &quot;-j&quot;, &quot;MARK&quot;, &quot;--set-xmark&quot;, rich_rule.action.set ]
        else:
            raise FirewallError(INVALID_RULE,
                                &quot;Unknown action %s&quot; % type(rich_rule.action))

        rule = [&quot;-t&quot;, table, add_del, chain]
        rule += self._rich_rule_priority_fragment(rich_rule)
        rule += rule_fragment + rule_action
        rule += self._rule_limit(rich_rule.action.limit)

        return rule

    def _rich_rule_destination_fragment(self, rich_dest):
        if not rich_dest:
            return []

        rule_fragment = []
        if rich_dest.addr:
            if rich_dest.invert:
                rule_fragment.append(&quot;!&quot;)
            if check_single_address(&quot;ipv6&quot;, rich_dest.addr):
                rule_fragment += [ &quot;-d&quot;, normalizeIP6(rich_dest.addr) ]
            elif check_address(&quot;ipv6&quot;, rich_dest.addr):
                addr_split = rich_dest.addr.split(&quot;/&quot;)
                rule_fragment += [ &quot;-d&quot;, normalizeIP6(addr_split[0]) + &quot;/&quot; + addr_split[1] ]
            else:
                rule_fragment += [ &quot;-d&quot;, rich_dest.addr ]
        elif rich_dest.ipset:
            rule_fragment += [ &quot;-m&quot;, &quot;set&quot; ]
            if rich_dest.invert:
                rule_fragment.append(&quot;!&quot;)
            flags = self._fw.zone._ipset_match_flags(rich_dest.ipset, &quot;dst&quot;)
            rule_fragment += [ &quot;--match-set&quot;, rich_dest.ipset, flags ]

        return rule_fragment

    def _rich_rule_source_fragment(self, rich_source):
        if not rich_source:
            return []

        rule_fragment = []
        if rich_source.addr:
            if rich_source.invert:
                rule_fragment.append(&quot;!&quot;)
            if check_single_address(&quot;ipv6&quot;, rich_source.addr):
                rule_fragment += [ &quot;-s&quot;, normalizeIP6(rich_source.addr) ]
            elif check_address(&quot;ipv6&quot;, rich_source.addr):
                addr_split = rich_source.addr.split(&quot;/&quot;)
                rule_fragment += [ &quot;-s&quot;, normalizeIP6(addr_split[0]) + &quot;/&quot; + addr_split[1] ]
            else:
                rule_fragment += [ &quot;-s&quot;, rich_source.addr ]
        elif hasattr(rich_source, &quot;mac&quot;) and rich_source.mac:
            rule_fragment += [ &quot;-m&quot;, &quot;mac&quot; ]
            if rich_source.invert:
                rule_fragment.append(&quot;!&quot;)
            rule_fragment += [ &quot;--mac-source&quot;, rich_source.mac ]
        elif hasattr(rich_source, &quot;ipset&quot;) and rich_source.ipset:
            rule_fragment += [ &quot;-m&quot;, &quot;set&quot; ]
            if rich_source.invert:
                rule_fragment.append(&quot;!&quot;)
            flags = self._fw.zone._ipset_match_flags(rich_source.ipset, &quot;src&quot;)
            rule_fragment += [ &quot;--match-set&quot;, rich_source.ipset, flags ]

        return rule_fragment

    def build_policy_ports_rules(self, enable, policy, proto, port, destination=None, rich_rule=None):
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]
        table = &quot;filter&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        rule_fragment = [ &quot;-p&quot;, proto ]
        if port:
            rule_fragment += [ &quot;--dport&quot;, &quot;%s&quot; % portStr(port) ]
        if destination:
            rule_fragment += [ &quot;-d&quot;, destination ]
        if rich_rule:
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        if not rich_rule or type(rich_rule.action) != Rich_Mark:
            rule_fragment += [ &quot;-m&quot;, &quot;conntrack&quot;, &quot;--ctstate&quot;, &quot;NEW,UNTRACKED&quot; ]

        rules = []
        if rich_rule:
            rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
        else:
            rules.append([add_del, &quot;%s_allow&quot; % (_policy), &quot;-t&quot;, table] +
                         rule_fragment + [ &quot;-j&quot;, &quot;ACCEPT&quot; ])

        return rules

    def build_policy_protocol_rules(self, enable, policy, protocol, destination=None, rich_rule=None):
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]
        table = &quot;filter&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        rule_fragment = [ &quot;-p&quot;, protocol ]
        if destination:
            rule_fragment += [ &quot;-d&quot;, destination ]
        if rich_rule:
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        if not rich_rule or type(rich_rule.action) != Rich_Mark:
            rule_fragment += [ &quot;-m&quot;, &quot;conntrack&quot;, &quot;--ctstate&quot;, &quot;NEW,UNTRACKED&quot; ]

        rules = []
        if rich_rule:
            rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
        else:
            rules.append([add_del, &quot;%s_allow&quot; % (_policy), &quot;-t&quot;, table] +
                         rule_fragment + [ &quot;-j&quot;, &quot;ACCEPT&quot; ])

        return rules

    def build_policy_source_ports_rules(self, enable, policy, proto, port,
                                     destination=None, rich_rule=None):
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]
        table = &quot;filter&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        rule_fragment = [ &quot;-p&quot;, proto ]
        if port:
            rule_fragment += [ &quot;--sport&quot;, &quot;%s&quot; % portStr(port) ]
        if destination:
            rule_fragment += [ &quot;-d&quot;, destination ]
        if rich_rule:
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        if not rich_rule or type(rich_rule.action) != Rich_Mark:
            rule_fragment += [ &quot;-m&quot;, &quot;conntrack&quot;, &quot;--ctstate&quot;, &quot;NEW,UNTRACKED&quot; ]

        rules = []
        if rich_rule:
            rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
        else:
            rules.append([add_del, &quot;%s_allow&quot; % (_policy), &quot;-t&quot;, table] +
                         rule_fragment + [ &quot;-j&quot;, &quot;ACCEPT&quot; ])

        return rules

    def build_policy_helper_ports_rules(self, enable, policy, proto, port,
                                      destination, helper_name, module_short_name):
        table = &quot;raw&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        rule = [ add_del, &quot;%s_allow&quot; % (_policy), &quot;-t&quot;, &quot;raw&quot;, &quot;-p&quot;, proto ]
        if port:
            rule += [ &quot;--dport&quot;, &quot;%s&quot; % portStr(port) ]
        if destination:
            rule += [ &quot;-d&quot;,  destination ]
        rule += [ &quot;-j&quot;, &quot;CT&quot;, &quot;--helper&quot;, module_short_name ]

        return [rule]

    def build_zone_forward_rules(self, enable, zone, policy, table, interface=None, source=None):
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        rules = []
        if interface:
            rules.append([&quot;-t&quot;, &quot;filter&quot;, add_del, &quot;%s_allow&quot; % _policy,
                          &quot;-o&quot;, interface, &quot;-j&quot;, &quot;ACCEPT&quot;])
        else: # source
            # iptables can not match destination MAC
            if check_mac(source):
                return []

            rules.append([&quot;-t&quot;, &quot;filter&quot;, add_del, &quot;%s_allow&quot; % _policy]
                         + self._rule_addr_fragment(&quot;-d&quot;, source) +
                         [&quot;-j&quot;, &quot;ACCEPT&quot;])
        return rules

    def build_policy_masquerade_rules(self, enable, policy, rich_rule=None):
        table = &quot;nat&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX, isSNAT=True)

        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        rule_fragment = []
        if rich_rule:
            chain_suffix = self._rich_rule_chain_suffix(rich_rule)
            rule_fragment += self._rich_rule_priority_fragment(rich_rule)
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        else:
            chain_suffix = &quot;allow&quot;

        rules = []
        rules.append([&quot;-t&quot;, &quot;nat&quot;, add_del, &quot;%s_%s&quot; % (_policy, chain_suffix)]
                     + rule_fragment +
                     [ &quot;!&quot;, &quot;-o&quot;, &quot;lo&quot;, &quot;-j&quot;, &quot;MASQUERADE&quot; ])

        rule_fragment = []
        if rich_rule:
            chain_suffix = self._rich_rule_chain_suffix(rich_rule)
            rule_fragment += self._rich_rule_priority_fragment(rich_rule)
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        else:
            chain_suffix = &quot;allow&quot;

        table = &quot;filter&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
        rules.append([&quot;-t&quot;, &quot;filter&quot;, add_del, &quot;%s_%s&quot; % (_policy, chain_suffix)]
                     + rule_fragment +
                     [&quot;-m&quot;, &quot;conntrack&quot;, &quot;--ctstate&quot;, &quot;NEW,UNTRACKED&quot;, &quot;-j&quot;, &quot;ACCEPT&quot; ])

        return rules

    def build_policy_forward_port_rules(self, enable, policy, port,
                                      protocol, toport, toaddr, rich_rule=None):
        table = &quot;nat&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        to = &quot;&quot;
        if toaddr:
            if check_single_address(&quot;ipv6&quot;, toaddr):
                to += &quot;[%s]&quot; % normalizeIP6(toaddr)
            else:
                to += toaddr
        if toport and toport != &quot;&quot;:
            to += &quot;:%s&quot; % portStr(toport, &quot;-&quot;)

        rule_fragment = []
        if rich_rule:
            chain_suffix = self._rich_rule_chain_suffix(rich_rule)
            rule_fragment = self._rich_rule_priority_fragment(rich_rule)
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        else:
            chain_suffix = &quot;allow&quot;

        rules = []
        if rich_rule:
            rules.append(self._rich_rule_log(policy, rich_rule, enable, &quot;nat&quot;, rule_fragment))
        rules.append([&quot;-t&quot;, &quot;nat&quot;, add_del, &quot;%s_%s&quot; % (_policy, chain_suffix)]
                     + rule_fragment +
                     [&quot;-p&quot;, protocol, &quot;--dport&quot;, portStr(port),
                      &quot;-j&quot;, &quot;DNAT&quot;, &quot;--to-destination&quot;, to])

        return rules

    def _icmp_types_fragment(self, icmp_type):
        if self.ipv == &quot;ipv4&quot; and icmp_type in ICMP_TYPES:
            _type, _code, _omit_code = ICMP_TYPES[icmp_type]
            _type_str = str(_type) if _omit_code else str(_type) + &quot;/&quot; + str(_code)
            return [&quot;-m&quot;, &quot;icmp&quot;, &quot;--icmp-type&quot;, _type_str]
        elif self.ipv == &quot;ipv6&quot; and icmp_type in ICMPV6_TYPES:
            _type, _code, _omit_code = ICMPV6_TYPES[icmp_type]
            _type_str = str(_type) if _omit_code else str(_type) + &quot;/&quot; + str(_code)
            return [&quot;-m&quot;, &quot;icmp6&quot;, &quot;--icmpv6-type&quot;, _type_str]
        else:
            raise FirewallError(
                INVALID_ICMPTYPE, f&quot;ICMP type {icmp_type} not supported by {self.name}&quot;
            )

    def build_policy_icmp_block_rules(self, enable, policy, ict, rich_rule=None):
        table = &quot;filter&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
        add_del = { True: &quot;-A&quot;, False: &quot;-D&quot; }[enable]

        if self.ipv == &quot;ipv4&quot;:
            proto = [ &quot;-p&quot;, &quot;icmp&quot; ]
            match = self._icmp_types_fragment(ict.name)
        else:
            proto = [ &quot;-p&quot;, &quot;ipv6-icmp&quot; ]
            match = self._icmp_types_fragment(ict.name)

        rules = []
        if self._fw.policy.query_icmp_block_inversion(policy):
            final_chain = &quot;%s_allow&quot; % (_policy)
            final_target = &quot;ACCEPT&quot;
        else:
            final_chain = &quot;%s_deny&quot; % (_policy)
            final_target = &quot;%%REJECT%%&quot;

        rule_fragment = []
        if rich_rule:
            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
        rule_fragment += proto + match

        if rich_rule:
            rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
            rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
            if rich_rule.action:
                rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))
            else:
                chain_suffix = self._rich_rule_chain_suffix(rich_rule)
                rules.append([&quot;-t&quot;, table, add_del, &quot;%s_%s&quot; % (_policy, chain_suffix)]
                             + self._rich_rule_priority_fragment(rich_rule)
                             + rule_fragment +
                             [ &quot;-j&quot;, &quot;%%REJECT%%&quot; ])
        else:
            if self._fw.get_log_denied() != &quot;off&quot; and final_target != &quot;ACCEPT&quot;:
                rules.append([ add_del, final_chain, &quot;-t&quot;, table ]
                             + rule_fragment +
                             [ &quot;%%LOGTYPE%%&quot;, &quot;-j&quot;, &quot;LOG&quot;,
                               &quot;--log-prefix&quot;, &quot;\&quot;%s_ICMP_BLOCK: \&quot;&quot; % policy ])
            rules.append([ add_del, final_chain, &quot;-t&quot;, table ]
                         + rule_fragment +
                         [ &quot;-j&quot;, final_target ])

        return rules

    def build_policy_icmp_block_inversion_rules(self, enable, policy):
        table = &quot;filter&quot;
        _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)

        rules = []
        rule_idx = 6

        if self._fw.policy.query_icmp_block_inversion(policy):
            ibi_target = &quot;%%REJECT%%&quot;

            if self._fw.get_log_denied() != &quot;off&quot;:
                if enable:
                    rule = [ &quot;-I&quot;, _policy, str(rule_idx) ]
                else:
                    rule = [ &quot;-D&quot;, _policy ]

                rule = rule + [ &quot;-t&quot;, table, &quot;-p&quot;, &quot;%%ICMP%%&quot;,
                              &quot;%%LOGTYPE%%&quot;,
                              &quot;-j&quot;, &quot;LOG&quot;, &quot;--log-prefix&quot;,
                              &quot;\&quot;%s_ICMP_BLOCK: \&quot;&quot; % _policy ]
                rules.append(rule)
                rule_idx += 1
        else:
            ibi_target = &quot;ACCEPT&quot;

        if enable:
            rule = [ &quot;-I&quot;, _policy, str(rule_idx) ]
        else:
            rule = [ &quot;-D&quot;, _policy ]
        rule = rule + [ &quot;-t&quot;, table, &quot;-p&quot;, &quot;%%ICMP%%&quot;, &quot;-j&quot;, ibi_target ]
        rules.append(rule)

        return rules

    def build_policy_rich_source_destination_rules(self, enable, policy, rich_rule):
        table = &quot;filter&quot;

        rule_fragment = []
        rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
        rule_fragment += self._rich_rule_source_fragment(rich_rule.source)

        rules = []
        rules.append(self._rich_rule_log(policy, rich_rule, enable, table, rule_fragment))
        rules.append(self._rich_rule_audit(policy, rich_rule, enable, table, rule_fragment))
        rules.append(self._rich_rule_action(policy, rich_rule, enable, table, rule_fragment))

        return rules

    def is_ipv_supported(self, ipv):
        return ipv == self.ipv

class ip6tables(ip4tables):
    ipv = &quot;ipv6&quot;
    name = &quot;ip6tables&quot;

    def build_rpfilter_rules(self, log_denied=False):
        rules = []
        rules.append([ &quot;-I&quot;, &quot;PREROUTING&quot;, &quot;-t&quot;, &quot;mangle&quot;,
                       &quot;-m&quot;, &quot;rpfilter&quot;, &quot;--invert&quot;, &quot;--validmark&quot;,
                       &quot;-j&quot;, &quot;DROP&quot; ])
        if log_denied != &quot;off&quot;:
            rules.append([ &quot;-I&quot;, &quot;PREROUTING&quot;, &quot;-t&quot;, &quot;mangle&quot;,
                           &quot;-m&quot;, &quot;rpfilter&quot;, &quot;--invert&quot;, &quot;--validmark&quot;,
                           &quot;-j&quot;, &quot;LOG&quot;,
                           &quot;--log-prefix&quot;, &quot;rpfilter_DROP: &quot; ])
        rules.append([ &quot;-I&quot;, &quot;PREROUTING&quot;, &quot;-t&quot;, &quot;mangle&quot;,
                       &quot;-p&quot;, &quot;ipv6-icmp&quot;,
                       &quot;--icmpv6-type=neighbour-solicitation&quot;,
                       &quot;-j&quot;, &quot;ACCEPT&quot; ]) # RHBZ#1575431, kernel bug in 4.16-4.17
        rules.append([ &quot;-I&quot;, &quot;PREROUTING&quot;, &quot;-t&quot;, &quot;mangle&quot;,
                       &quot;-p&quot;, &quot;ipv6-icmp&quot;,
                       &quot;--icmpv6-type=router-advertisement&quot;,
                       &quot;-j&quot;, &quot;ACCEPT&quot; ]) # RHBZ#1058505
        return rules

    def build_rfc3964_ipv4_rules(self):
        daddr_list = [
                     &quot;::0.0.0.0/96&quot;, # IPv4 compatible
                     &quot;::ffff:0.0.0.0/96&quot;, # IPv4 mapped
                     &quot;2002:0000::/24&quot;, # 0.0.0.0/8 (the system has no address assigned yet)
                     &quot;2002:0a00::/24&quot;, # 10.0.0.0/8 (private)
                     &quot;2002:7f00::/24&quot;, # 127.0.0.0/8 (loopback)
                     &quot;2002:ac10::/28&quot;, # 172.16.0.0/12 (private)
                     &quot;2002:c0a8::/32&quot;, # 192.168.0.0/16 (private)
                     &quot;2002:a9fe::/32&quot;, # 169.254.0.0/16 (IANA Assigned DHCP link-local)
                     &quot;2002:e000::/19&quot;, # 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved and broadcast)
                     ]

        chain_name = &quot;RFC3964_IPv4&quot;
        self.our_chains[&quot;filter&quot;].add(chain_name)

        rules = []
        rules.append([&quot;-t&quot;, &quot;filter&quot;, &quot;-N&quot;, chain_name])
        for daddr in daddr_list:
            rules.append([&quot;-t&quot;, &quot;filter&quot;, &quot;-I&quot;, chain_name,
                          &quot;-d&quot;, daddr, &quot;-j&quot;, &quot;REJECT&quot;, &quot;--reject-with&quot;,
                          &quot;addr-unreach&quot;])
            if self._fw._log_denied in [&quot;unicast&quot;, &quot;all&quot;]:
                rules.append([&quot;-t&quot;, &quot;filter&quot;, &quot;-I&quot;, chain_name,
                              &quot;-d&quot;, daddr, &quot;-j&quot;, &quot;LOG&quot;,
                              &quot;--log-prefix&quot;, &quot;\&quot;RFC3964_IPv4_REJECT: \&quot;&quot;])

        # Inject into FORWARD and OUTPUT chains
        rules.append([&quot;-t&quot;, &quot;filter&quot;, &quot;-I&quot;, &quot;OUTPUT&quot;, &quot;4&quot;,
                      &quot;-j&quot;, chain_name])
        rules.append([&quot;-t&quot;, &quot;filter&quot;, &quot;-I&quot;, &quot;FORWARD&quot;, &quot;4&quot;,
                      &quot;-j&quot;, chain_name])
        return rules
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Flib%2Fpython3.6%2Fsite-packages%2Ffirewall%2Fcore'>Back to Directory</a>