OwlCyberSecurity - MANAGER
Edit File: backend.cpython-38.pyc
U ��\7j � @ s~ d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z m Z ddl mZmZ ddlZG dd� d�ZdS )z&backend.py: interface for ufw backends� N)�error�warn�debug� _findpath)�UFWError�UFWRulec @ s� e Zd ZdZd=dd�Zdd� Zdd� Zd d � Zd>d d�Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z dS )?� UFWBackendzInterface for backendsNc C sJ d | _ || _|| _g | _g | _ttjj|�}t j � |d�t j � |d�t j � |d�d�| _ |d k rl| j � |� ddddd d �| _tjj| _| �� | �� | �� tj�| j d �| _t j � tjjd �| _t j � tjjd �| _t j � tjjd�| _t j � tjjd�| _ztj� | j�| _ W n& t k �r> t d�}t |��Y nX d | _!d S )Nz default/ufwz ufw/ufw.confzufw/applications.d)�defaults�conf�appsr �d �� i, i� )�off�lowZmediumZhighZfullr �iptablesziptables-restore� ip6tableszip6tables-restorez#Couldn't determine iptables version)"r �name�dryrun�rules�rules6r �ufw�commonZ config_dir�os�path�join�files�update� loglevels� do_checks� _do_checks� _get_defaultsZ _read_rules� applicationsZ get_profiles�profilesZ iptables_dirr Ziptables_restorer Zip6tables_restore�utilZget_iptables_versionZiptables_version�OSError�_r �caps)�selfr r Z extra_filesZrootdirZdatadir�p�err_msg� r* �-/usr/lib/python3/dist-packages/ufw/backend.py�__init__ sJ � � � �zUFWBackend.__init__c C sf | j dk rdS i | _ i | j d< d| j d d< d| j d d< | j�rbt�� dk�rb| j�sbztj�| j�}W nH t k r� } z*d| }| � � r�t |� t |� W Y �dS d}~X Y nX d |kr�d |kr�d| j d d< nd| j d d< | � � �rbztj�| j�}W n0 t k �r. } zt d| � W 5 d}~X Y nX d |k�rTd |k�rTd| j d d< nd| j d d< dS ) zgInitialize the capabilities database. This needs to be called before accessing the database.N�limitT�4F�6r z initcaps %sz recent-setz recent-update)r& r r �getuidr r r# Zget_netfilter_capabilitiesr r$ � is_enabledr r �use_ipv6r )r' Znf_caps�e�msgr* r* r+ �initcapsL s4 zUFWBackend.initcapsc C s d| j kr | j d dkr dS dS )z!Is firewall configured as enabled�enabled�yesTF)r �r' r* r* r+ r1 x s �zUFWBackend.is_enabledc C s, d| j kr(| j d dkr(tj�d�r(dS dS )z"Is firewall configured to use IPv6Zipv6r7 z/proc/sys/net/ipv6TF)r r r �existsr8 r* r* r+ r2 s � �zUFWBackend.use_ipv6�inputFc C s� d| d }d}| j | dkr$d}n| j | dkr8d}nd}|r�|dkr�d }td �}tj�d d g�\}}|d krxt|��d|kr�d}| �� r�tj�d dg�\}}|d kr�d|kr�d}tj�d dg�\}}|d kr�d|kr�d}|s�d}|S )z.Get default policy for specified primary chainZdefault_Z_policy� �accept�allow�reject�deny�forwardFzproblem running sysctlZsysctlznet.ipv4.ip_forwardr �1Tz net.ipv6.conf.default.forwardingz net.ipv6.conf.all.forwardingZdisabled)r r% r r# �cmdr r2 ) r' ZprimaryZ check_forward�policy�rstrr6 r) Zrc�outr* r* r+ �_get_default_policy� s2 z UFWBackend._get_default_policyc C sp | j std�}t|� dS t�� t�� kr:td�}t|��t�� t�� krZtd�}t|��t�� }|dkrztd�}t|��i }i }i }g }tj � | j d �s�td�| j d }t|� nDt � d �}t�| j d �D ](} |�| �s�|�tj �| j d | �� q�t| j �� �tj �tjd �g | D �]�} | �d ��sDd t�� | f } td | � | | j d k�rxtj � | j d ��sx�q"zt�| �} | tj } W n@ t k �r� td �| }t|��Y n t k �r� � Y nX d} d}d}z4t � | j �d | k�s t � | j �d |k�rd}W n t!k �r( Y nX | j dk�rt|�st| |k�rttd�t"|�| t"| j �d� }t|� d|| < | tj#@ �r�| |k�r�td�| }t|� d|| < | tj$@ �r�| |k�r�| j%dk�r�td�| }t|� d|| < | d k�r�q"| }tj �&| �} | �sDt t'j(d| ���qD�q"| j D ]D}|dk�r&tj �)| j | ��s&td�|| j | d� }t|���q&dS )a8 Perform basic security checks: is setuid or setgid (for non-Linux systems) checks that script is owned by root checks that every component in absolute path are owned by root warn if script is group writable warn if part of script path is group writable Doing this at the beginning causes a race condition with later operations that don't do these checks. However, if the user running this script is root, then need to be root to exploit the race condition (and you are hosed anyway...) zChecks disabledTz%ERROR: this script should not be SUIDz%ERROR: this script should not be SGIDr z&You need to be root to run this scriptr z'%s' does not existz^\.�/z%s/%sz Checking zCouldn't stat '%s'ZclickpkgZ snappypkgFz4uid is %(uid)s but '%(path)s' is owned by %(st_uid)s)�uidr �st_uidz%s is world writable!z%s is group writable!z Could not find parent for '%s'z&'%(f)s' file '%(name)s' does not exist)�fr N)*r r% r r r0 �geteuidr �getgid�getegidr �isdirr �re�compile�listdir�search�appendr �list�values�abspath�sys�argv� startswith�getcwdr �stat�ST_MODEr$ � Exception�pwd�getpwuidrI �KeyError�str�S_IWOTH�S_IWGRP�st_gid�dirname�errnoZENOENT�isfile)r' r) rH Zwarned_world_writeZwarned_group_writeZ warned_ownerr" Zwarn_msg�pat�profiler Zstatinfo�modeZ click_userZ snap_userZis_unpack_userZ last_pathrJ r* r* r+ r � s� �� � ���� � �� �zUFWBackend._do_checksc C s i | _ | jd | jd fD ]�}ztj�|�}W n( tk rV td�| }t|��Y nX t� d�}|D ]>}|� |�rft� d|� � �}|d � � � d�| j |d � � < qf|�� qd d d g}d D ]V}d | | j kr�td| �}t|��| j d | } | |kr�td| |d� �}t|��q�dS )z#Get all settings from defaults filer r z Couldn't open '%s' for readingz ^\w+="?\w+"?�=� �"'r r< Zdropr> )r: �outputr@ zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')rC �chainN)r r r r# Zopen_file_readr] r% r rO rP rR �split�strip�lower�close) r' rJ �origr) rh �line�tmpZpolicies�cr( r* r* r+ r s0 " �zUFWBackend._get_defaultsc C s t �d|�s td�}t|��t�|tj�s>td| �}t|��tj� |�}|d }d}t � d| d �}|d D ]<} |� | �r�tj� ||d | d � d }qptj� || � qp|s�tj� ||d | d � ztj� |� W n tk r� � Y nX |�� �d �| j|�� < d S ) z Sets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writablerv F�^rk rt � Trm N)rO �matchr% r r �access�W_OKr r# Z open_filesrP rR Z write_to_fileZ close_filesr] rr rq r ) r' �fnZopt�valuer) Zfns�fd�foundrh ru r* r* r+ � set_default: s, zUFWBackend.set_defaultc C s� | j s�|dkr$| �| jd dd� nn|dkrB| �| jd dd� nP|dkr`| �| jd dd� n2|d kr~| �| jd dd � ntd �| }t|��td �| }|S ) z+Sets default application policy of firewallr= r ZDEFAULT_APPLICATION_POLICYz"ACCEPT"r? z"DROP"r> z"REJECT"�skipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')r r� r r% r )r' rC r) rD r* r* r+ � set_default_application_policy^ s2 � � � � z)UFWBackend.set_default_application_policyc C s\ g }t | j�� �}|j|k�r\|j|k�r\tj�| j|j �}tj�| j|j �}|D �] }|�� }d|_ |� dd� tj � |�\}} |� | � |� |d� |j |_ |j|jkr�d|_tj � |�\}} |� | � |� |d� |j|_|�|� qV|D ]b} |�� } d| _tj � | �\}} | � | � | � |d� | jdk�rD| � |j� |j| _|�| � q�qVn�|j|k�r�tj�| j|j �D ]L} |�� } d| _tj � | �\}} | � | � | � |d� |j| _|�| � �q|nn|j|k�r:tj�| j|j �D ]L} |�� } d| _ tj � | �\}} | � | � | � |d� |j | _ |�| � �q�t|�dk �rXtd�} t| ��|S )z4Return a list of UFWRules based on the template ruler; �any�src�dstrl z&No rules found for application profile)rT r" �keysZdportZsportr r! Z get_ports�dup_rule�dapp�set_portr# Zparse_port_proto� set_protocol�sapprS Zprotocol�lenr% r )r' �templater Z profile_namesZdportsZsports�irv Zport�proto�j�ruler( r) r* r* r+ �get_app_rules_from_templatey sh z&UFWBackend.get_app_rules_from_templatec C sX g }g }d}d}d}| j | j D ]�}|j|ks8|j|kr�|�� }||krLq q�|�� } | �d� | jdkrv| �| jd� | jdkr�| �| jd� | �| �} | D ](} | � � | j r�|� | � q�|� | � q�|}d}q |j r�|� |� q |� |� q |�rP|| _ || _|t d�| 7 }z| � d� | � d� W n& tk �rN t d�} t| ��Y nX ||fS ) z�Update rule for profile in place. Returns result string and bool on whether or not the profile is used in the current ruleset. r; Fr� r� r� Tz Rules updated for profile '%s'z!Couldn't update application rules)r r r� r� � get_app_tupler� r� r� r� Z normalize�v6rS r% Z _write_rulesr] r ) r' ri Z updated_rulesZupdated_rules6Z last_tuplerD Zupdated_profile�r�tuplr� Z new_app_rulesZnew_rr) r* r* r+ �update_app_rule� sP � zUFWBackend.update_app_rulec C s� || j kr|S d}d}t| j �� �D ] }|�� |�� kr$|}|d7 }q$d||f }t|� |dkrf|S |dkr|td�| }n td�| }t|��dS )z2Find the application profile name for profile_namer; r rl z'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s'N)r" rT r� rr r r% r )r' Z profile_namerz Zmatches�nZ debug_msgr) r* r* r+ �find_application_name� s( ��z UFWBackend.find_application_namec C s@ |r|t | j�krt� �|s0|t | j�kr0t� �|dk r>t� �g }|rN| j}n| j}i }d}t|�D ]N\}}||krx q�d}|jdks�|jdkrd|�� }||kr�|d7 }qdd||< qdg }|r�| j}| j|d | �� } | � d� n&| j}| j|d | �� } | � d� d} |D ](}t � || �dk�r0| S | d7 } �qdS )a. Return the absolute position in the other list of the rule with the user position of the given list. For example, find_other_position(4, True) will return the absolute position of the rule in the ipv4 list matching the user specified '4' rule in the ipv6 list. rl r r; TF) r� r � ValueErrorr � enumerater� r� r� r� Zset_v6r rz ) r' Zpositionr� r � app_rulesZ tuple_offsetr� r� r� Z match_rule�countr* r* r+ �find_other_position sF z UFWBackend.find_other_positionc C s| d}t d�}d| jks.| jd t| j�� �kr@d}|t d�7 }n4| j| jd }|dkrb|d7 }n|d| jd 7 }||fS )z"Gets current log level of firewallr z Logging: �loglevel����unknownr zon (%s))r% r rT r r� )r' �levelrD r* r* r+ � get_loglevelO s � zUFWBackend.get_loglevelc C s� |t | j�� �dg kr,td�| }t|��|}|dkr`d| jksP| jd dkrVd}n | jd }| �| jd d|� | �|� |dkr�td�S td �S d S ) zSets log level of firewallZonzInvalid log level '%s'r� r r r ZLOGLEVELzLogging disabledzLogging enabledN) rT r r� r% r r r� r �update_logging)r' r� r) Z new_levelr* r* r+ � set_loglevel_ s � zUFWBackend.set_loglevelc C s | j | j S )zReturn list of all rules)r r r8 r* r* r+ � get_rulesu s zUFWBackend.get_rulesc C st g }|r| j }n| j}d}i }|D ]L}d}|jdks>|jdkrf|�� }||kr^td| � q"nd||< |d7 }q"|S )z/Return number of ufw rules (not iptables rules)r r; �Skipping found tuple '%s'Trl )r r r� r� r� r )r' r� r r� r� r� r� r* r* r+ �get_rules_county s zUFWBackend.get_rules_countc C sz | � � }d}i }|D ]`}d}|jdks0|jdkrX|�� }||krPtd| � qnd||< |t|�krl| S |d7 }qdS )z:Return rule specified by number seen via "status numbered"rl r; r� TN)r� r� r� r� r �int)r' Znumr r� r� r� r� r* r* r+ �get_rule_by_number� s z UFWBackend.get_rule_by_numberc C s> g }d}| � � D ](}|d7 }|�|�}|dk r|�|� q|S )zmSee if there is a matching rule in the existing ruleset. Note this does not group rules by tuples.r rl )r� Zfuzzy_dst_matchrS )r' r� Zmatchedr� r� Zretr* r* r+ � get_matching� s zUFWBackend.get_matchingc C s t d��dS )z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to overrideN�r )r' rC � directionr* r* r+ �set_default_policy� s z UFWBackend.set_default_policyc C s t d��dS )z Get status of running firewallz,UFWBackend.get_running_raw: need to overrideNr� )r' Z rules_typer* r* r+ �get_running_raw� s zUFWBackend.get_running_rawc C s t d��dS )zGet managed rulesz'UFWBackend.get_status: need to overrideNr� )r' �verboseZ show_countr* r* r+ � get_status� s zUFWBackend.get_statusc C s t d��dS )zUpdate firewall with rulez%UFWBackend.set_rule: need to overrideNr� )r' r� Z allow_reloadr* r* r+ �set_rule� s zUFWBackend.set_rulec C s t d��dS )zStart the firewallz+UFWBackend.start_firewall: need to overrideNr� r8 r* r* r+ �start_firewall� s zUFWBackend.start_firewallc C s t d��dS )zStop the firewallz*UFWBackend.stop_firewall: need to overrideNr� r8 r* r* r+ � stop_firewall� s zUFWBackend.stop_firewallc C s t d��dS )z%Get a list if rules based on templatez6UFWBackend.get_app_rules_from_system: need to overrideNr� )r' r� r� r* r* r+ �get_app_rules_from_system� s z$UFWBackend.get_app_rules_from_systemc C s t d��dS )z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrideNr� )r' r� r* r* r+ r� � s zUFWBackend.update_loggingc C s t d��dS )zReset the firewallz"UFWBackend.reset: need to overrideNr� r8 r* r* r+ �reset� s zUFWBackend.reset)NNN)r: F) �__name__� __module__� __qualname__�__doc__r, r5 r1 r2 rF r r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r* r* r* r+ r s@ � ,, &p $D><r )r� rf r r^ rO r[ rW Zufw.utilr r r r r Z ufw.commonr r Zufw.applicationsr r* r* r* r+ �<module> s