File: //proc/self/root/usr/lib/python3/dist-packages/ufw/__pycache__/frontend.cpython-38.pyc
U
��\l� � @ sz d Z ddlZddlZddlZddlmZ ddlZddlmZm Z m
Z
ddl m Z ddl
Zdd� Zdd � ZG d
d � d �ZdS ) z'frontend.py: frontend interface for ufw� N)�UFWError)�error�warn�msg)�UFWBackendIptablesc
C s� t j�� }dD ]}|�t j�|�� qdD ]}|�t j�|�� q*dD ]}|�t j�|�� qFdD ]}|�t j�|�� qbdD ]}|�t j�|�� q~dD ]}|�t j� |�� q�ddd d
d d d
g}|D ](}|�t j�
|�� |�t j� |�� q�t | �dk�r\d}| | �
� dk�rd}| | �
� dk�r\| | �
� dk�r\| | �
� |k�r\| �|d� t | �dk �s�d| k�r�t | �dk �r�td� z|�| dd� �}W nT tk
�r� } ztd|j � W 5 d}~X Y n$ tk
�r� tddd� � Y nX |S )zEParse command. Returns tuple for action, rule, ip_version and dryrun.)�enable�disable�helpz--help�versionz --version�reload�reset)�list�info�default�update)�on�offZlowZmediumZhighZfull)�allow�deny�reject)N�verboseZnumbered)�rawz before-rulesz
user-rulesz after-rulesz
logging-rules�builtins� listening�addedr �limitr r �insert�delete�prepend� � � --dry-runr �route�rule� znot enough argsNz%szInvalid syntaxF)Zdo_exit)�ufw�parserZ UFWParserZregister_commandZUFWCommandBasicZ
UFWCommandAppZUFWCommandLoggingZUFWCommandDefaultZUFWCommandStatusZUFWCommandShow�UFWCommandRule�UFWCommandRouteRule�len�lowerr r �
parse_commandr �value� Exception)�argv�p�iZ
rule_commands�idx�pr�e� r4 �./usr/lib/python3/dist-packages/ufw/frontend.pyr+ sN
��� & r+ c & C s\ t dtjjdddddddd d
d d d
ddddddddddddddd d d d d d!d"d#d$�# �} | S )%zPrint help messagea
Usage: %(progname)s %(command)s
%(commands)s:
%(enable)-31s enables the firewall
%(disable)-31s disables the firewall
%(default)-31s set default policy
%(logging)-31s set logging to %(level)s
%(allow)-31s add allow %(rule)s
%(deny)-31s add deny %(rule)s
%(reject)-31s add reject %(rule)s
%(limit)-31s add limit %(rule)s
%(delete)-31s delete %(urule)s
%(insert)-31s insert %(urule)s at %(number)s
%(route)-31s add route %(urule)s
%(route-delete)-31s delete route %(urule)s
%(route-insert)-31s insert route %(urule)s at %(number)s
%(reload)-31s reload firewall
%(reset)-31s reset firewall
%(status)-31s show firewall status
%(statusnum)-31s show firewall status as numbered list of %(rules)s
%(statusverbose)-31s show verbose firewall status
%(show)-31s show firewall report
%(version)-31s display version information
%(appcommands)s:
%(applist)-31s list application profiles
%(appinfo)-31s show information on %(profile)s
%(appupdate)-31s update %(profile)s
%(appdefault)-31s set default application policy
ZCOMMANDZCommandsr r z default ARGz
logging LEVELZLEVELz
allow ARGSr# z deny ARGSz reject ARGSz
limit ARGSzdelete RULE|NUMZRULEzinsert NUM RULEz prepend RULEz
route RULEzroute delete RULE|NUMzroute insert NUM RULEZNUMr r �statuszstatus numberedZRULESzstatus verbosezshow ARGr
z Application profile commandszapp listzapp info PROFILEZPROFILEzapp update PROFILEzapp default ARG)#ZprognameZcommandZcommandsr r r Zlogging�levelr r# r r r r Zuruler r r" z route-deletez route-insert�numberr r r6 Z statusnum�rulesZ
statusverbose�showr
Z appcommandsZapplistZappinfo�profileZ appupdateZ
appdefault)�_r% �commonZ programName)Zhelp_msgr4 r4 r5 �get_command_help[ sN ��Br> c @ s� e Zd ZdZd,dd�Zdd� Zdd � Zd
d � Zd-d
d�Zd.dd�Z dd� Z
dd� Z dd� Z d/dd�Z
d0dd�Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd1d*d+�ZdS )2� UFWFrontendZUI�iptablesNc C sd |dkr6zt |||d�| _W qB tk
r2 � Y qBX n td| ��td�| _td�| _td�| _d S )Nr@ )�rootdir�datadirz Unsupported backend type '%s'�n�y�yes)r �backendr- r r< �norE �yes_full)�self�dryrunZ backend_typerA rB r4 r4 r5 �__init__� s �
zUFWFrontend.__init__c
C sz d}d}|rd}d}|r"| j �� r0|s4| j �� r4d}|r�z | j �| j jd d|� W n, tk
r� } zt|j� W 5 d}~X Y nX d}|�r0z| j �� W n, tk
r� } z|r�|j}W 5 d}~X Y nX |dk�r&z | j �| j jd dd� W n. tk
�r } zt|j� W 5 d}~X Y nX t|� td �}nFz| j � � W n. tk
�rl } zt|j� W 5 d}~X Y nX td
�}|S ) zlToggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or
stops running firewall.
� rG rE FT�confZENABLEDNz0Firewall is active and enabled on system startupz/Firewall stopped and disabled on system startup)
rF �
is_enabledZ set_default�filesr r r, �start_firewallr< �
stop_firewall)rI �enabled�resZ
config_strZchangedr3 Z error_strr4 r4 r5 � set_enabled� sT �� �
�
zUFWFrontend.set_enabledc
C sf d}z0| j �||�}| j �� r2| j �� | j �� W n, tk
r` } zt|j� W 5 d}~X Y nX |S )z Sets default policy of firewallrL N)rF �set_default_policyrN rQ rP r r r, )rI �policy� directionrS r3 r4 r4 r5 rU � s
z UFWFrontend.set_default_policyc
C sF d}z| j �|�}W n, tk
r@ } zt|j� W 5 d}~X Y nX |S )zSets log level of firewallrL N)rF � set_loglevelr r r, )rI r7 rS r3 r4 r4 r5 rX � s zUFWFrontend.set_loglevelFc
C sD z| j �||�}W n, tk
r> } zt|j� W 5 d}~X Y nX |S )zShows status of firewallN)rF �
get_statusr r r, )rI r Z
show_count�outr3 r4 r4 r5 rY s
zUFWFrontend.get_statusr c
C sB z| j �|�}W n, tk
r< } zt|j� W 5 d}~X Y nX |S )z Shows raw output of firewallN)rF Zget_running_rawr r r, )rI Z
rules_typerZ r3 r4 r4 r5 � get_show_raw
s
zUFWFrontend.get_show_rawc C s$ d}zt j�| j�� �}W n$ tk
r> td�}t|��Y nX | j�� }t |�
� �}|� � |D �]�}| j�� s||dkr|qb|d| 7 }t || �
� �}|� � |D �]^}|| | D �]J} | d }
|
� d�s�|
� d�s�d} |d| 7 }|
d ks�|
d
k�r|d 7 }d | d }
n|d
|
7 }t j�
|
�} |dtj�| d � 7 }t jjd|dd� ||
ddd�} | �|�d�� | dk�r�| �d| � | �� | j�| �}
t|
�dk�r�|d7 }|
D ]D}|dk�r�|d t|�k �r�|d|t jj�||d �f 7 }�q�|d7 }q�q�qb| j�� �s t j� d� |S ) zMShows listening services and incoming rules that might affect
themrL z Could not get listening status)Ztcp6Zudp6z%s:
Zladdrz127.z::1z %s z0.0.0.0z::z* z%s/0z%s z(%s)�exer Nr$ �inF)�actionZprotocolZdport�dstrW �forward�6r �
r z [%2d] %s
z)Skipping tcp6 and udp6 (IPv6 is disabled)) r% �utilZparse_netstat_outputrF �use_ipv6r- r< r � get_rulesr
�keys�sort�
startswithZget_if_from_ip�os�path�basenamer= ZUFWRule�set_v6�endswithZ
set_interfaceZ normalizeZ get_matchingr) r& r' � get_command�debug)rI rS �d�err_msgr9 Z protocols�proto�portsZport�itemZaddrZifnamer# Zmatchingr0 r4 r4 r5 �get_show_listening sl
�
�
�� z UFWFrontend.get_show_listeningc C s� | j �� }td�}t|�dkr*|td� S g }| j �� D ]L}|jrVdtjj�|� }ntjj �|�}||krnq8|�
|� |d| 7 }q8|S )z!Shows added rules to the firewallz9Added user rules (see 'ufw status' for running firewall):r z
(None)�route %sz
ufw %s) rF re r< r) r` r% r& r( rn r' �append)rI r9 rZ r �r�rstrr4 r4 r5 �get_show_added[ s
�
zUFWFrontend.get_show_addedc C s d}d}d}g }|j dkr2|jdkr2|�|� �n�g }�zt|j�r�|dkrZ| j�|d�}n�|dkrr| j�|d�}nt|dkr�| j�|d�}| j�|d�}|D ]4} |D ]*}
|
j} d|
_| �|
�s�| |
_|�|
� q�q�ntd�| }t |��t
|�dk�rJ| jj �sJtd �}|dk�r|}n.|dk�r*|d
}n|dk�rD|d | d
}|W S |D ]8}|� � } |j| _| �
|j� | �|j� |�| � �qNn | j�|�}|jdk�r�|�� W n tk
�r� � Y nX d}
d}td �}| j�d�}| j�d�}t|�D �]\}} |}
| j|| k�r.|t| j�d
7 }t |���z�| j�� �r(|dk�r�| jdk�r||
dk�rl|dk�rldnd}| �|� n&| j|k�r�|t| j�d
7 }t |��| �d� | j�| �}�q�|dk�rd| jdk�r�|
dk�r�|dk�r�dnd}| �|� nP| j|k�r| �| j| � n2| jdk�rJ| j|k�rJ|t| j�d
7 }t |��| �d� | j�| �}�q�|dk�r| j}| �d� |dk�r�|
dk�r�|dk�r�dnd}| �|� nH| j�s�||k�r�| j� || |
d�}|dk�r�| �|� n
| �d� | j�| �}| j�s0|dk�r0| j�d�}| �|d � | �d� |dk�rl|
dk�r\|dk�r\dnd}| �|� nT| j�s�| jdk�r�| j|k�r�| j� | jd�}|dk�r�| �||
� n
| �d� |dk�r�|d 7 }| j�s | j|k�r |dk�r | �| j| � || j�| �7 }ntd�| }t |��n�| jdk�rZ|
dk�rL|dk�rLdnd}| �|� |dk�sn|dk�r�| �d� | j�| �}n0|dk�r�td�}t |��ntd�| }t |��W n: t k
�r� } z|j }d}W Y �
�qW 5 d}~X Y nX | j �r�td�}t � |� �q�|�s"||7 }n�t
|�dk�r:t!|� n�d}t"t#|
d ��}|�� |D ]p}|
dk�rZ|| �rZ|| � � }d|_z| �||� W n2 tk
�r� d}td�| �$� }t |� Y nX �qZ|td�7 }|�r�|td�7 }n |td�7 }t |��|S )zUpdates firewall with rulerL �v4F�v6TZbothzInvalid IP version '%s'r z"Could not delete non-existent rulez (v6)rb zInvalid position '�'���r zIPv6 support not enabledNz Rule changed after normalizationz Could not back out rule '%s'z"
Error applying application rules.z# Some rules could not be unapplied.z( Attempted rules successfully unapplied.)%�dapp�sapprw �removerF Zget_app_rules_from_systemr| �matchr< r r) rJ Zdup_ruleZ
set_actionr^ Z set_logtypeZlogtypeZget_app_rules_from_templateZposition�reverser- Zget_rules_count� enumerate�strrd Z set_positionrl �set_ruleZfind_other_positionr, �updated�warningsr r r
�rangeZ format_rule) rI r# �
ip_versionrS rq �tmpr9 ZtmprulesZ tmprules6�xrD Zprev6rx �countZ set_errorZ pos_err_msgZnum_v4Znum_v6r0 ZbeginZuser_posr/ r3 Zwarn_msgZ
undo_errorZindexes�jZ backout_ruler4 r4 r5 r� x sX � � � �
�
�
�
�
� zUFWFrontend.set_rulec
C s^ z t |�}W n( tk
r4 td�| }t|��Y nX | j�� }|dksT|t|�krhtd�| }t|��| j�|�}|s�td�| }t|��d|_d}|j r�d}d}|�s:|j
r�dt j j
�|� } nt j j�|�} td�| | j| jd � }
t|
tjd
d � tj�� �� �� } | d k�r:| | j�� k�r:| | j�� k�r:d
}d
} |�rR| �||�} ntd�} | S )z Delete rulezCould not find rule '%s'r zCould not find rule '%d'Tr{ r| rv z=Deleting:
%(rule)s
Proceed with operation (%(yes)s|%(no)s)? )r# rE rG F��output�newlinerD rL �Aborted)�intr- r< r rF re r) Zget_rule_by_numberr� r| r` r% r& r( rn r' rE rG r �sys�stdout�stdin�readliner* �striprH r� )
rI r8 �forcerC rq r9 r# r� �proceedry �prompt�ansrS r4 r4 r5 � delete_ruleD sR
��� �zUFWFrontend.delete_rulec
C sV d}|� d�rB|�d�}t|�dkr4| �|d �}n
| �d�}�n|dkrX| �d�}�n�|� d�r�td �}|�d
�}t|�d kr�t|��| �|d |d �}�n�|d
kr�| �|�}�n�|dkr�| �� }�n�|dkr�| �d�}�nr|� d��r0|�d
�d }|dk�r| � � }n |dk�r"| �
� }n
| � |�}�n"|dk�rJ| �dd�}�n|dk�rb| � d�}�n�|dk�rz| � d�}�n�|dk�r�| j
�� �r�| � d� | � d� td�}ntd�}�n�|� d��r�| �|�d
�d |�}�nr|d k�s|d k�s|d k�s|d k�r>|jdk�r�z0| j
�|j�}||jk�rB||_|�|d � W nV tk
�r� } z6|j�sjt|j� tj�|j��s�td!�}t|��W 5 d"}~X Y nX |jdk�r0z0| j
�|j�}||jk�r�||_|�|d � W nV tk
�r. } z6|j�s�t|j� tj�|j��s td!�}t|��W 5 d"}~X Y nX | �||�}ntd#�| }t|��|S )$z�Perform action on rule. action, rule and ip_version are usually
based on return values from parse_command().
rL z
logging-onr< r r z logging-offr zdefault-zUnsupported default policy�-r$ r r r6 zstatus-verboseTr: r r zstatus-numberedFr r r �Firewall reloadedz&Firewall not enabled (skipping reload)zdelete-r r r r r_ �Invalid profile nameN�Unsupported action '%s')rh �splitr) rX r< r rU r rY ru rz r[ rT rF rN r� r Zfind_application_nameZset_portr� r r, r% � applications�valid_profile_namer� r� ) rI r^ r# r� r� rS r� rq r3 r4 r4 r5 � do_actionu s�
�
zUFWFrontend.do_actionc
C sF d}z| j �|�}W n, tk
r@ } zt|j� W 5 d}~X Y nX |S )z+Sets default application policy of firewallrL N)rF � set_default_application_policyr r r, )rI rV rS r3 r4 r4 r5 r� � s z*UFWFrontend.set_default_application_policyc C s: t | jj�� �}|�� td�}|D ]}|d| 7 }q$|S )z*Display list of known application profileszAvailable applications:�
%s)r
rF �profilesrf rg r< )rI �namesry rC r4 r4 r5 �get_application_list� s z UFWFrontend.get_application_listc C s� g }|dkr&t | jj�� �}|�� n&tj�|�sBtd�}t |��|�
|� d}|D �]$}|| jjksr| jj| s�td�| }t |��tj� || jj| �s�td�}t |��|td�| 7 }|td�tj� | jj| � 7 }|td�tj�
| jj| � 7 }tj�| jj| �}t|�d k�s,d
|d k�r:|td �7 }n |td
�7 }|D ]}|d| 7 }�qJ||t|�d krT|d7 }qTtj�|�S )z Display information on profile�allr� rL zCould not find profile '%s'zInvalid profilez Profile: %s
z
Title: %s
zDescription: %s
r �,r zPorts:zPort:r� z
--
)r
rF r� rf rg r% r� r� r< r rw Zverify_profileZ get_titleZget_descriptionZ get_portsr) rc � wrap_text)rI Zpnamer� rq ry �namers r/ r4 r4 r5 �get_application_info� sL
�
�
�
��
z UFWFrontend.get_application_infoc C s d}d}d}z| j jr$tj�� r$d}W n tk
r> d}Y nX |dkr�t| j j�� �}|� � |D ]4}| j �
|�\}}|rd|dkr�|d7 }||7 }|}qdn | j �
|�\}}|dkr�|d7 }|�r| j � � �r|�rz| j � � W n tk
r� � Y nX |t
d�7 }n |t
d�7 }|S )�Refresh application profilerL TFr� rb r� zSkipped reloading firewall)rF � do_checksr% rc � under_sshr- r
r� rf rg Zupdate_app_rulerN Z_reload_user_rulesr< ) rI r; ry Z allow_reloadZtrigger_reloadr� r/ r� �foundr4 r4 r5 �application_update s<
z UFWFrontend.application_updatec C s d}d}|dkr t d�}t|��| jjd }|dkrLtj�d||f � |S |dkrZd}n0|d krhd
}n"|d krvd }nt d �| }t|��d
g}| jjr�|�d� |||g7 }z t |�}W n t
k
r� � Y nX d|j kr�| � |j
|j d |j d �}n| � |j
dd�}|S )r� rL r� z%Cannot specify 'all' with '--add-new'Zdefault_application_policy�skipz'Policy is '%s', not adding profile '%s'Zacceptr Zdropr r zUnknown policy '%s'r% r! r# Ziptype)r< r rF �defaultsr% rc ro rJ rw r+ r- �datar� r^ )rI r; ry rV rq r �argsr2 r4 r4 r5 �application_add7 sB �
�zUFWFrontend.application_addc C s� d}|dkr| � d�}n�|dkr,| � d�}n�|dkr@| � d�}n�|dkrT| � d �}n�|d
krf| �� }nz|d krz| �|�}nf|d ks�|d
kr�| �|�}d}|d
kr�| �|�}|dkr�|dkr�|d7 }|| }ntd�| }t|��|S )zzPerform action on profile. action and profile are usually based on
return values from parse_command().
rL z
default-allowr z default-denyr zdefault-rejectr z default-skipr� r
r r zupdate-with-newrb r� )r� r� r� r� r� r< r )rI r^ r; rS Zstr1Zstr2rq r4 r4 r5 �do_application_actiona s0
z!UFWFrontend.do_application_actionc C sr d}| j jrntj�� rntd�| j| jd� }t|t j
dd� t j � � �
� �� }|dkrn|| jkrn|| jkrnd}|S )z6If running under ssh, prompt the user for confirmationTzWCommand may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? �rE rG Fr� rD )rF r� r% rc r� r< rE rG r r� r� r� r� r* r� rH )rI r� r� r� r4 r4 r5 �continue_under_ssh� s � z UFWFrontend.continue_under_sshc C s� d}t d�| j| jd� }| jjrBtj�� rBt d�| j| jd� }| jjr�|s�ttj� |�t
j dd� t
j �
� �� �� }|dkr�|| jkr�|| jkr�t d�}|S | j�� r�|| �d�7 }| j�� }|S ) zReset the firewallrL zTResetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? r� zResetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? Fr� rD r� )r< rE rG rF r� r% rc r� r r� r� r� r� r� r* r� rH rN rT r )rI r� rS r� r� r4 r4 r5 r � s$ � �
zUFWFrontend.reset)r@ NN)FF)r )F)F)F)�__name__�
__module__� __qualname__�__doc__rK rT rU rX rY r[ ru rz r� r� r� r� r� r� r� r� r� r� r r4 r4 r4 r5 r? � s0 �
6
H M
1
V
.+* r? )r� ri r� r� Z
ufw.commonr Zufw.utilr% r r r Zufw.backend_iptablesr Z
ufw.parserr+ r> r? r4 r4 r4 r5 �<module> s >G