File: //proc/self/root/usr/lib/python3/dist-packages/ufw/__pycache__/backend.cpython-38.pyc
U
��\7j � @ s~ d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m
Z
m Z m Z ddl
mZmZ ddlZG dd� d�ZdS )z&backend.py: interface for ufw backends� N)�error�warn�debug� _findpath)�UFWError�UFWRulec @ s� e Zd ZdZd=dd�Zdd� Zdd� Zd d
� Zd>d
d�Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z dS )?�
UFWBackendzInterface for backendsNc C sJ d | _ || _|| _g | _g | _ttjj|�}t j
� |d�t j
� |d�t j
� |d�d�| _ |d k rl| j �
|� ddddd d
�| _tjj| _| �� | �� | �� tj�| j d �| _t j
� tjjd �| _t j
� tjjd
�| _t j
� tjjd�| _t j
� tjjd�| _ztj� | j�| _ W n& t k
�r> t d�}t |��Y nX d | _!d S )Nz default/ufwz ufw/ufw.confzufw/applications.d)�defaults�conf�appsr �d �� i, i� )�off�lowZmediumZhighZfullr �iptablesziptables-restore� ip6tableszip6tables-restorez#Couldn't determine iptables version)"r �name�dryrun�rules�rules6r �ufw�commonZ
config_dir�os�path�join�files�update� loglevels� do_checks�
_do_checks�
_get_defaultsZ _read_rules� applicationsZ get_profiles�profilesZ iptables_dirr Ziptables_restorer Zip6tables_restore�utilZget_iptables_versionZiptables_version�OSError�_r �caps)�selfr r Z extra_filesZrootdirZdatadir�p�err_msg� r* �-/usr/lib/python3/dist-packages/ufw/backend.py�__init__ sJ � �
� �zUFWBackend.__init__c
C sf | j dk rdS i | _ i | j d< d| j d d< d| j d d< | j�rbt�� dk�rb| j�sbztj�| j�}W nH t k
r� } z*d| }| �
� r�t |� t |� W Y �dS d}~X Y nX d |kr�d
|kr�d| j d d< nd| j d d< | �
� �rbztj�| j�}W n0 t k
�r. } zt d| � W 5 d}~X Y nX d |k�rTd
|k�rTd| j d d< nd| j d d< dS ) zgInitialize the capabilities database. This needs to be called
before accessing the database.N�limitT�4F�6r z initcaps
%sz
recent-setz
recent-update)r& r r �getuidr r r# Zget_netfilter_capabilitiesr r$ �
is_enabledr r �use_ipv6r )r' Znf_caps�e�msgr* r* r+ �initcapsL s4
zUFWBackend.initcapsc C s d| j kr | j d dkr dS dS )z!Is firewall configured as enabled�enabled�yesTF)r �r' r* r* r+ r1 x s
�zUFWBackend.is_enabledc C s, d| j kr(| j d dkr(tj�d�r(dS dS )z"Is firewall configured to use IPv6Zipv6r7 z/proc/sys/net/ipv6TF)r r r �existsr8 r* r* r+ r2 s
�
�zUFWBackend.use_ipv6�inputFc C s� d| d }d}| j | dkr$d}n| j | dkr8d}nd}|r�|dkr�d }td
�}tj�d d g�\}}|d
krxt|��d|kr�d}| �� r�tj�d dg�\}}|d
kr�d|kr�d}tj�d dg�\}}|d
kr�d|kr�d}|s�d}|S )z.Get default policy for specified primary chainZdefault_Z_policy� �accept�allow�reject�deny�forwardFzproblem running sysctlZsysctlznet.ipv4.ip_forwardr �1Tz net.ipv6.conf.default.forwardingz net.ipv6.conf.all.forwardingZdisabled)r r% r r# �cmdr r2 ) r' ZprimaryZ
check_forward�policy�rstrr6 r) Zrc�outr* r* r+ �_get_default_policy� s2 z UFWBackend._get_default_policyc C sp | j std�}t|� dS t�� t�� kr:td�}t|��t�� t�� krZtd�}t|��t�� }|dkrztd�}t|��i }i }i }g }tj �
| j d �s�td�| j d }t|� nDt �
d �}t�| j d �D ](} |�| �s�|�tj �| j d | �� q�t| j �� �tj �tjd �g | D �]�}
|
�d
��sDd t�� |
f }
td |
� |
| j d k�rxtj �
| j d ��sx�q"zt�|
�} | tj } W n@ t k
�r� td
�|
}t|��Y n t k
�r� � Y nX d}
d}d}z4t � | j �d |
k�s t � | j �d |k�rd}W n t!k
�r( Y nX | j dk�rt|�st|
|k�rttd�t"|�|
t"| j �d� }t|� d||
< | tj#@ �r�|
|k�r�td�|
}t|� d||
< | tj$@ �r�|
|k�r�| j%dk�r�td�|
}t|� d||
< |
d
k�r�q"|
}tj �&|
�}
|
�sDt t'j(d| ���qD�q"| j D ]D}|dk�r&tj �)| j | ��s&td�|| j | d� }t|���q&dS )a8 Perform basic security checks:
is setuid or setgid (for non-Linux systems)
checks that script is owned by root
checks that every component in absolute path are owned by root
warn if script is group writable
warn if part of script path is group writable
Doing this at the beginning causes a race condition with later
operations that don't do these checks. However, if the user running
this script is root, then need to be root to exploit the race
condition (and you are hosed anyway...)
zChecks disabledTz%ERROR: this script should not be SUIDz%ERROR: this script should not be SGIDr z&You need to be root to run this scriptr z'%s' does not existz^\.�/z%s/%sz Checking zCouldn't stat '%s'ZclickpkgZ snappypkgFz4uid is %(uid)s but '%(path)s' is owned by %(st_uid)s)�uidr �st_uidz%s is world writable!z%s is group writable!z Could not find parent for '%s'z&'%(f)s' file '%(name)s' does not exist)�fr N)*r r% r r r0 �geteuidr �getgid�getegidr �isdirr �re�compile�listdir�search�appendr �list�values�abspath�sys�argv�
startswith�getcwdr �stat�ST_MODEr$ � Exception�pwd�getpwuidrI �KeyError�str�S_IWOTH�S_IWGRP�st_gid�dirname�errnoZENOENT�isfile)r' r) rH Zwarned_world_writeZwarned_group_writeZ warned_ownerr" Zwarn_msg�pat�profiler Zstatinfo�modeZ
click_userZ snap_userZis_unpack_userZ last_pathrJ r* r* r+ r � s�
��
�
���� �
��
�zUFWBackend._do_checksc
C s i | _ | jd | jd fD ]�}ztj�|�}W n( tk
rV td�| }t|��Y nX t� d�}|D ]>}|�
|�rft� d|� � �}|d �
� � d�| j |d �
� < qf|�� qd d
d g}d D ]V}d
| | j kr�td| �}t|��| j d
| } | |kr�td| |d� �}t|��q�dS )z#Get all settings from defaults filer r
z Couldn't open '%s' for readingz ^\w+="?\w+"?�=� �"'r r< Zdropr> )r: �outputr@ zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')rC �chainN)r r r r# Zopen_file_readr] r% r rO rP rR �split�strip�lower�close)
r' rJ �origr) rh �line�tmpZpolicies�cr( r* r* r+ r s0
"
�zUFWBackend._get_defaultsc
C s t �d|�s td�}t|��t�|tj�s>td| �}t|��tj� |�}|d }d}t �
d| d �}|d D ]<} |� | �r�tj� ||d | d � d
}qptj� || � qp|s�tj� ||d | d � ztj�
|� W n tk
r� � Y nX |�� �d �| j|�� < d S )
z Sets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writablerv F�^rk rt �
Trm N)rO �matchr% r r �access�W_OKr r# Z
open_filesrP rR Z
write_to_fileZ close_filesr] rr rq r )
r' �fnZopt�valuer) Zfns�fd�foundrh ru r* r* r+ � set_default: s,
zUFWBackend.set_defaultc C s� | j s�|dkr$| �| jd dd� nn|dkrB| �| jd dd� nP|dkr`| �| jd dd� n2|d kr~| �| jd dd
� ntd �| }t|��td �| }|S )
z+Sets default application policy of firewallr= r ZDEFAULT_APPLICATION_POLICYz"ACCEPT"r? z"DROP"r> z"REJECT"�skipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')r r� r r% r )r' rC r) rD r* r* r+ � set_default_application_policy^ s2 � � � � z)UFWBackend.set_default_application_policyc C s\ g }t | j�� �}|j|k�r\|j|k�r\tj�| j|j �}tj�| j|j �}|D �] }|�� }d|_ |�
dd� tj � |�\}} |�
| � |�
|d� |j |_ |j|jkr�d|_tj � |�\}} |�
| � |�
|d� |j|_|�|� qV|D ]b}
|�� } d| _tj � |
�\}} | �
| � | �
|d� | jdk�rD| �
|j� |j| _|�| � q�qVn�|j|k�r�tj�| j|j �D ]L} |�� } d| _tj � | �\}} | �
| � | �
|d� |j| _|�| � �q|nn|j|k�r:tj�| j|j �D ]L} |�� } d| _ tj � | �\}} | �
| � | �
|d� |j | _ |�| � �q�t|�dk �rXtd�}
t|
��|S )z4Return a list of UFWRules based on the template ruler; �any�src�dstrl z&No rules found for application profile)rT r" �keysZdportZsportr r! Z get_ports�dup_rule�dapp�set_portr# Zparse_port_proto� set_protocol�sapprS Zprotocol�lenr% r )r' �templater Z
profile_namesZdportsZsports�irv Zport�proto�j�ruler( r) r* r* r+ �get_app_rules_from_templatey sh
z&UFWBackend.get_app_rules_from_templatec
C sX g }g }d}d}d}| j | j D ]�}|j|ks8|j|kr�|�� }||krLq q�|�� } | �d� | jdkrv| �| jd� | jdkr�| �| jd� | �| �}
|
D ](} | � � | j
r�|� | � q�|� | � q�|}d}q |j
r�|� |� q |� |� q |�rP|| _ || _|t d�| 7 }z| �
d� | �
d� W n& tk
�rN t d�} t| ��Y nX ||fS ) z�Update rule for profile in place. Returns result string and bool
on whether or not the profile is used in the current ruleset.
r; Fr� r� r� Tz Rules updated for profile '%s'z!Couldn't update application rules)r r r� r� �
get_app_tupler� r� r� r� Z normalize�v6rS r% Z _write_rulesr] r )
r' ri Z
updated_rulesZupdated_rules6Z
last_tuplerD Zupdated_profile�r�tuplr� Z
new_app_rulesZnew_rr) r* r* r+ �update_app_rule� sP
�
zUFWBackend.update_app_rulec C s� || j kr|S d}d}t| j �� �D ] }|�� |�� kr$|}|d7 }q$d||f }t|� |dkrf|S |dkr|td�| }n td�| }t|��dS )z2Find the application profile name for profile_namer; r rl z'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s'N)r" rT r� rr r r% r )r' Z profile_namerz Zmatches�nZ debug_msgr) r* r* r+ �find_application_name� s(
��z UFWBackend.find_application_namec C s@ |r|t | j�krt� �|s0|t | j�kr0t� �|dk r>t� �g }|rN| j}n| j}i }d}t|�D ]N\}}||krx q�d}|jdks�|jdkrd|�� }||kr�|d7 }qdd||< qdg }|r�| j}| j|d | �� } | � d� n&| j}| j|d | �� } | � d� d}
|D ](}t
� || �dk�r0|
S |
d7 }
�qdS )a. Return the absolute position in the other list of the rule with the
user position of the given list. For example, find_other_position(4,
True) will return the absolute position of the rule in the ipv4 list
matching the user specified '4' rule in the ipv6 list.
rl r r; TF) r� r �
ValueErrorr � enumerater� r� r� r� Zset_v6r rz ) r' Zpositionr� r � app_rulesZ tuple_offsetr� r� r� Z
match_rule�countr* r* r+ �find_other_position sF
z UFWBackend.find_other_positionc C s| d}t d�}d| jks.| jd t| j�� �kr@d}|t d�7 }n4| j| jd }|dkrb|d7 }n|d| jd 7 }||fS )z"Gets current log level of firewallr z Logging: �loglevel����unknownr zon (%s))r% r rT r r� )r' �levelrD r* r* r+ � get_loglevelO s
�
zUFWBackend.get_loglevelc C s� |t | j�� �dg kr,td�| }t|��|}|dkr`d| jksP| jd dkrVd}n
| jd }| �| jd d|� | �|� |dkr�td�S td �S d
S ) zSets log level of firewallZonzInvalid log level '%s'r� r r r
ZLOGLEVELzLogging disabledzLogging enabledN) rT r r� r% r r r� r �update_logging)r' r� r) Z new_levelr* r* r+ � set_loglevel_ s
�
zUFWBackend.set_loglevelc C s | j | j S )zReturn list of all rules)r r r8 r* r* r+ � get_rulesu s zUFWBackend.get_rulesc C st g }|r| j }n| j}d}i }|D ]L}d}|jdks>|jdkrf|�� }||kr^td| � q"nd||< |d7 }q"|S )z/Return number of ufw rules (not iptables rules)r r; �Skipping found tuple '%s'Trl )r r r� r� r� r )r' r� r r� r� r� r� r* r* r+ �get_rules_county s
zUFWBackend.get_rules_countc C sz | � � }d}i }|D ]`}d}|jdks0|jdkrX|�� }||krPtd| � qnd||< |t|�krl| S |d7 }qdS )z:Return rule specified by number seen via "status numbered"rl r; r� TN)r� r� r� r� r �int)r' Znumr r� r� r� r� r* r* r+ �get_rule_by_number� s
z UFWBackend.get_rule_by_numberc C s> g }d}| � � D ](}|d7 }|�|�}|dk r|�|� q|S )zmSee if there is a matching rule in the existing ruleset. Note this
does not group rules by tuples.r rl )r� Zfuzzy_dst_matchrS )r' r� Zmatchedr� r� Zretr* r* r+ � get_matching� s
zUFWBackend.get_matchingc C s t d��dS )z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to overrideN�r )r' rC � directionr* r* r+ �set_default_policy� s z UFWBackend.set_default_policyc C s t d��dS )z Get status of running firewallz,UFWBackend.get_running_raw: need to overrideNr� )r' Z
rules_typer* r* r+ �get_running_raw� s zUFWBackend.get_running_rawc C s t d��dS )zGet managed rulesz'UFWBackend.get_status: need to overrideNr� )r' �verboseZ
show_countr* r* r+ �
get_status� s zUFWBackend.get_statusc C s t d��dS )zUpdate firewall with rulez%UFWBackend.set_rule: need to overrideNr� )r' r� Z allow_reloadr* r* r+ �set_rule� s zUFWBackend.set_rulec C s t d��dS )zStart the firewallz+UFWBackend.start_firewall: need to overrideNr� r8 r* r* r+ �start_firewall� s zUFWBackend.start_firewallc C s t d��dS )zStop the firewallz*UFWBackend.stop_firewall: need to overrideNr� r8 r* r* r+ �
stop_firewall� s zUFWBackend.stop_firewallc C s t d��dS )z%Get a list if rules based on templatez6UFWBackend.get_app_rules_from_system: need to overrideNr� )r' r� r� r* r* r+ �get_app_rules_from_system� s z$UFWBackend.get_app_rules_from_systemc C s t d��dS )z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrideNr� )r' r� r* r* r+ r� � s zUFWBackend.update_loggingc C s t d��dS )zReset the firewallz"UFWBackend.reset: need to overrideNr� r8 r* r* r+ �reset� s zUFWBackend.reset)NNN)r: F) �__name__�
__module__� __qualname__�__doc__r, r5 r1 r2 rF r r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r* r* r* r+ r s@ �
,,
&p $D><r )r� rf r r^ rO r[ rW Zufw.utilr r r r r Z
ufw.commonr r Zufw.applicationsr r* r* r* r+ �<module> s