OwlCyberSecurity - MANAGER
Edit File: backend_iptables.cpython-38.pyc
U �L�dh� � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z m Z m Z mZmZmZ ddlZG dd� dejj�ZdS )z-backend_iptables.py: iptables backend for ufw� N)�UFWError�UFWRule)�warn�debug�msg�cmd�cmd_pipe� _findpathc @ s� e Zd ZdZd+dd�Zdd� Zdd� Zd d � Zd,d d �Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zd-d d �Zd.d d �Zd!d"� Zd/d#d$�Zd%d&� Zd'd(� Zd)d*� ZdS )0�UFWBackendIptablesz Instance class for UFWBackendNc C s� dt jj d | _|| _|| _i }tt jj|�}tt jj|�}t j � |d�|d< t j � |d�|d< t j � |d�|d< t j � |d �|d < t j � |d �|d < t j � |d �|d< t j � |d�|d< t j j j| d||||d� g g g g d�| _dD ]�}d}|dk�r | �� �r||7 }n |dk�r q�dD ]0} dD ]$} d|| | f } | j| �| � �q(�q | jd �|d � | jd �|d � q�d d d d d!d"d#g| _d$| _d%S )&z!UFWBackendIptables initializationz# z _comment #zufw/user.rules�ruleszufw/before.rulesZ before_ruleszufw/after.rules� after_ruleszufw/user6.rules�rules6zufw/before6.rulesZ before6_ruleszufw/after6.rules� after6_ruleszufw-init�init�iptables)�rootdir�datadir)�before�user�after�misc)�4�6�ufwr )r r r ��input�output�forwardz%s-%s-logging-%sr z -logging-denyz-logging-allow�-m�limit�--limitz3/minute�-j�LOG� --log-prefixz[UFW LIMIT BLOCK]N)r �commonZ programName� comment_strr r r � config_dir� state_dir�os�path�join�backend� UFWBackend�__init__�chains�use_ipv6�append�ufw_user_limit_log�ufw_user_limit_log_text) �self�dryrunr r �filesr& r' Zver� chain_prefix�loc�target�chain� r: �6/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr- sN � �zUFWBackendIptables.__init__c C s\ t d�}| jd dkr |d7 }n8| jd dkr8|d7 }n | jd dkrP|d7 }n|d 7 }|S ) zGet current policyz New profiles:Zdefault_application_policy�acceptz allowZdropz deny�rejectz rejectz skip)�_�defaults)r3 �rstrr: r: r; � get_default_application_policyL s z1UFWBackendIptables.get_default_application_policyc C s> | j �s |dkr4|dkr4|dkr4td�| }t|��|dkr`|dkr`|dkr`td�| }t|��d }|dkrrd }n |dkr~d }d }d }|dkr�z | �| jd d| d� W n tk r� � Y nX d}d}n�|dk�rz | �| jd d| d� W n tk �r � Y nX d}d}n>z | �| jd d| d� W n tk �rJ � Y nX d}d}t�d | �}| jd | jd fD ]�}ztj � |�} W n tk �r� � Y nX | d } | d D ]8} |� | ��r�tj � | |� || �� ntj � | | � �q�ztj �| � W n tk �r � Y nX �qvtd�||d� } | td�7 } | S )z Sets default policy of firewall�allow�denyr= zUnsupported policy '%s'ZincomingZoutgoing�routedz%Unsupported policy for direction '%s'�INPUT�OUTPUT�FORWARD� r? zDEFAULT_%s_POLICYz"ACCEPT"z UFW BLOCKz UFW ALLOWz"REJECT"z"DROP"r r �tmp�origz5Default %(direction)s policy changed to '%(policy)s' )� direction�policyz*(be sure to update your rules accordingly))r4 r> r Z set_defaultr5 � Exception�re�compiler �util� open_files�search� write_to_file�sub� close_files) r3 rL rK �err_msgr9 Z old_log_strZ new_log_str�pat�f�fns�fd�liner@ r: r: r; �set_default_policyZ s� �� � � � � z%UFWBackendIptables.set_default_policyc C s� | j r&dtd� }|dtd� 7 }|S | �� ddddg}g }g }|dkrn|�d � d d d dg}d d dg}�n|d k�rdD ] }|�d| � |�d| � q|dD ] }|�d| � |�d| � q�dD ] }|�d| � |�d| � q�dD ]}|�d| � q�nx|dk�r<dD ]"}|�d| � |�d| � �q�nB|dk�r�dD ]"}|�d| � |�d | � �qJ| jd d �r�|�d � |�d � | jd d! �r~|�d"� |�d#� n�|d$k�r�dD ]"}|�d%| � |�d&| � �q�n�|d'k�r~dD ]Z}|�d(| � |�d)| � |�d*| � |�d+| � |�d,| � |�d-| � �q�|�d.� |�d/� |�d0� |�d1� d2| }|D ]�}d3|k�r�|�d3�\} }|d4| 7 }t| jg| |d | g �\} } nt| jg| |g �\} } || 7 }|dk�r|d57 }| d6k�r�t|���q�|dk�s0| � � �r�|d77 }|D ]�}d3|k�r�|�d3�\} }|d4| 7 }t| jg| |d | g �\} } nt| j g| |g �\} } || 7 }|dk�r�|d57 }| d6k�r<t|���q<|S )8z'Show current running status of firewall�> zChecking raw iptables zChecking raw ip6tables �-nz-vz-x�-L�rawz-t�filterZnatZmangle�builtins)rE rG rF z filter:%s)� PREROUTINGrE rG rF � POSTROUTINGz mangle:%s)rc rF zraw:%s)rc rd rF znat:%sr )r r r z ufw-before-%szufw6-before-%sr � ufw-user-%s� ufw6-user-%sr r zufw-user-limit-accept�ufw-user-limitr zufw6-user-limit-accept�ufw6-user-limitr z ufw-after-%sz ufw6-after-%sZloggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyz IPV4 (%s): �:z(%s) � r z IPV6: ) r4 r> �initcapsr0 �caps�splitr r r r/ � ip6tables) r3 Z rules_type�out�args�itemsZitems6�c�b�i�t�rcrI r: r: r; �get_running_raw� s� z"UFWBackendIptables.get_running_rawFc $ C s� d}| j r2dtd� }| �� r.|dtd� 7 }|S td�}dD ]�}t| jdd| d g�\}}|d krptd � S |d kr�t|d | ��| �� r>t| jdd| d g�\}}|d kr>t|d ��q>d}d} d} | j| j } d } i } | D �]L}d}i }d}d}|�sF|j dk�s|j dk�rFd}|� � }|| k�r>t d| � q�nd| |< dD �]�}d||< d}d}|dk�r�|j }|�s�|j dk�r�|j }|j�r�|dk�r�|d7 }n|j}n@|j}|�s�|j dk�r�|j }|j�r�|dk�r�|d7 }n|j}|dk�r|dk�r|||< |dk�r(|| dk�r*|||< n|| d| 7 < |�rf|jdk�rf|| d|j 7 < |�r(|dk�r�|j dk�r�|| d|j 7 < |j�r�|dk�r�|| d7 < || d 7 < |d k�r(|j dk�r(|| d|j 7 < |j�r|dk�r|| d7 < || d 7 < |dk�r�|dk�sF|dk�r�d ||< |�r�|jdk�r�|j |jk�r�|j|jk�r�|| d|j 7 < |dk�r�|| d7 < n6|�r$|jdk�r$|j|jk�r$|| d|j 7 < n>|j�r$|jdk�r$|j dk�r$d|| k�r$|| d7 < |j�r�|d k�rX|jdk�rX|| d |j 7 < |dk�r�|jdk�r�|| d |j 7 < nX|dk�r�|jdk�r�|| d |j 7 < |d k�rJ|jdk�rJ|| d |j 7 < �qJg }d}|j�s|j�� d k�rT|j�r|�|j�� � |�r8|jd k�r8|�|j� t|�d k�rTd!d"�|� }|�rf|d#| 7 }|j� � }|j�r|d$}|jd%k�r�|j�s�|�s�|�s�d}d}|j dk�r�d&|� � }|d'|d d�|j � � |g�|d ||f 7 }|�r�||7 }n0|j�r | |7 } n |jd k�r"| |7 } n||7 }| d 7 } q�|dk�sR| dk�sR| dk�rHd(}|�rd|d)7 }td*�}td+�} td,�} d-} | || | f } |�r�| d)7 } | | d.t|� d.t| � d.t| � f 7 } || 7 }|dk�r�||7 }|dk�r | dk�r |td/�7 }| dk�r|| 7 }|dk�r2| dk�r2|td/�7 }| dk�rD|| 7 }|}|�r�| � � \} }!td0�| �!� | �!d1�| �!d2d�d3� }"| �"� }#td4�|!|"|#|d5� S td6�| S d7S )8zShow ufw managed rulesrH r] zChecking iptables zChecking ip6tables �problem runningr r_ re r^ � zStatus: inactiver z iptables: %s rf � ip6tablesTFzSkipping found tuple '%s')�dst�srcr{ z::/0� (v6)z 0.0.0.0/0�any� �/z (%s�)r| ZAnywherez on %sro z (%s)z, z[%2d] ZFWD�inz # %sz%-26s %-12s%-26s%s%s z z ZToZFromZActionz%-26s %-12s%s �-rj zCDefault: %(in)s (incoming), %(out)s (outgoing), %(routed)s (routed)r r )r� ro rD z0Status: active %(log)s %(pol)s %(app)s%(status)s)�logZpolZappZstatuszStatus: active%sN)#r4 r> r/ r r r rn r r �dapp�sapp� get_app_tupler r{ �v6�dportr| �sport�protocolr � interface_in� interface_out�logtyperK �lowerr0 �lenr* �upper�commentZ get_comment�actionZ get_loglevel�_get_default_policyrA )$r3 �verboseZ show_countro rV rK rv Zout6�sZstr_outZstr_rter �count� app_rules�rZtmp_str�location�tuplZ show_protor7 ZportrI ZattribsZ attrib_strZdir_strr% Zfull_strZstr_toZstr_fromZ str_actionZrules_header_fmtZ rules_header�levelZ logging_strZ policy_strZapp_policy_strr: r: r; � get_status s~ � � � � � � �� � � �� ��� ��z UFWBackendIptables.get_statusc C s� | j rtdtd� � n�g }|�| jd � | jdk rl| jdk rl|�d� |�| j� |�d� |�| j� |�d� t|�\}}|dkr�td | �}t|��dS ) zStop the firewallr] �running ufw-initr N� --rootdir� --datadirz force-stopr �problem running ufw-init %s) r4 r r> r0 r5 r r r r �r3 rp rv ro rV r: r: r; � stop_firewall� s z UFWBackendIptables.stop_firewallc C s8 | j rtdtd� � �ng }|�| jd � | jdk rn| jdk rn|�d� |�| j� |�d� |�| j� |�d� t|�\}}|dkr�td | �}t|��d | j ks�| j d t | j � � �kr�z| � d � W n$ tk r� td �}t|��Y nX n<z| �| j d � W n& tk �r2 td �}t|��Y nX dS )zStart the firewallr] r� r Nr� r� �startr r� �loglevel�lowzCould not set LOGLEVELz Could not load logging rules)r4 r r> r0 r5 r r r r r? �list� loglevels�keysZ set_loglevelrM �update_loggingr� r: r: r; �start_firewall� s6 �z!UFWBackendIptables.start_firewallc C s� | j r dS | �� d}| j}|r*d}| j}dD ]p}|dksB|dkrl|rX| jd d sXq.n|sl| jd d slq.t|d d |d | g�\}}|d kr.td � dS q.dS )zCheck if all chains existFr �ufw6)r r r r � limit-acceptr r� r r r^ r_ z-user-r z _need_reload: forcing reloadT)r4 rk r rn rl r r )r3 r� �prefix�exer9 rv ro r: r: r; � _need_reload s& z UFWBackendIptables._need_reloadc C s� t d�}| jr(td� | �� r�td� n�| �� r�z4| jd D ]$}| �|d|g� | �|d|g� q<W n tk r� t|��Y nX t d| j d g| j d g�\}}|d kr�t|d ��| �� r�t d| j d g| j d g�\}}|d kr�t|d ��dS )zReload firewall rules filerx z> | iptables-restorez> | ip6tables-restorer �-F�-Z�catr r^ r z iptablesr rz N) r> r4 r r/ � is_enabledr. � _chain_cmdrM r r r5 Ziptables_restoreZip6tables_restore)r3 rV rr rv ro r: r: r; �_reload_user_rules6 s. � �z%UFWBackendIptables._reload_user_rulesc C s@ g }t �d�}t �d�}t �d�}|�|�r�|�|�r�|�|�r\|�|�d|�d|��� n|�|�d|�� |�|�d|�� q�|�|�d|�� n |�|� t �d�}t �d �} t �d �} d } t|�D ]�\} } |�| �r�|�d | ��� }|�� d k�r d}n|�� dk�rd}nd}d| |f }| �| ��s8d| }|�d| �|| < |�| |�d| d | | �� |�| | �d| d | |�d| ��� |�| | �d| d | |�d| | ��� q�t �d�}t|�D ]j\} } |�| ��r�|�d| �}|�d | d | �}|�d | d | �}||| < |�| |� |�| |� �q�|S ) z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z -j \1 --reject-with tcp-resetz-p udp rH z (.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10�\2r< ZALLOWr ZLIMITZBLOCKz"%s -j LOG --log-prefix "[UFW %s] "z-m conntrack --ctstate NEW z \1-j \2\4z\1-j z-user-logging-z\1 z \1-j RETURN�\1z -j LIMITz+ -m conntrack --ctstate NEW -m recent --setzL -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j z -user-limitz -j z-user-limit-accept) rN rO rR r0 rT � enumerate�stripr� �insert)r3 �fruler� �suffix�snippetsZ pat_protoZpat_portZ pat_reject�pat_logZ pat_logallZ pat_chain� limit_argsrt r� rL ZlstrZ pat_limitZtmp1Ztmp2Ztmp3r: r: r; �_get_rules_from_formattedR s� �� � ���������� ���� z,UFWBackendIptables._get_rules_from_formattedc C s� g }| � |||�}t�d�}t|�D ]p\}}|�|�d|��� � |�|�r$|| �d� || �|�d|��dd�� || |�d|��� 7 < q$|S )z_Return list of iptables rules appropriate for sending as arguments to cmd() z (.*) --log-prefix (".* ")(.*)r� r# r� �"rH z\3) r� rN rO r� r0 rT rm �match�replace) r3 r� r� r� r� Z str_snippetsrW rt r� r: r: r; �_get_lists_from_formatted� s z,UFWBackendIptables._get_lists_from_formattedc C s� | j d g}| �� r$|�| j d � |D �]v}ztj�|�}W n( tk rf td�| }t|��Y nX t � d�}t � d�}t � d�}|D �] }|} d} d|kr�|� d�\} } | � � } |� | �r�|�d| �} t � d | � � �} t| �d k s�t| �d k�rtd �| }t|� q�q�d }d}d}t| �dk�s6t| �d k�r td�| }| d � d�d }d| d k�r d| d k�r�|�| d ��r�|�| d ��r�| d � d�d �d�d }| d � d�d �d�d }nR| d �d��r�| d �d�d }n.| d �d��r| d �d�d }n t|� q��z | d }d}d|k�rHd}|� d�d }t| �dk �r�t|| d | d | d | d | d ||| � }nvt|| d | d | d | d | d ||| � }t � d �}| d d k�r�|�d!| d �|_| d d k�r�|�d!| d �|_|dk�r|�d |� |dk�r&|�d"|� W n. tk �rV td#�| }t|� Y q�Y nX || j d k�r�|�d� | j�|� q�|�d� | j�|� q�|�� q(d$S )%z$Read in rules that were added by ufwr r z Couldn't open '%s' for readingz^### tuple ###\s*zin_\w+zout_\w+rH z comment=z\s+� � z)Skipping malformed tuple (bad length): %sr� � z$Skipping malformed tuple (iface): %s���r> r �!� ry Zin_Zout_Fri T� � � � �%20r� r ro z Skipping malformed tuple: %sN) r5 r/ r0 r rP Zopen_file_readrM r> r rN rO rm r� r� rT r� r rR � partition� startswithr r� r� Z set_interface�set_v6r r �close)r3 ZrfnsrX rJ rV Z pat_tupleZ pat_iface_inZ pat_iface_outZ orig_liner[ r� �hexr� rI ZwmsgZdtyper� r� r� r �rule� pat_space�warn_msgr: r: r; � _read_rules� s� � � � ��� � � � z UFWBackendIptables._read_rulesc C s8 | j d }|r| j d }t�|tj�s:td| �}t|��ztj�|�}W n t k r` � Y nX | � � d}| j }|r�d}| j }| j r�tj�� }n|d }tj�|d� tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � |dk�r�| jd d �s|dk�r>| jd d �r>tj�|d| d � tj�|d| d � tj�|d � |D �]}|j} |j�rnd |j } |jd k�r�| d |j 7 } d } |jd k�r�|jd k�r�|j} n`|jd k�r�|jd k�r�d |j|jf } n6|jd k�r�| d!|j|jf 7 } n| d!|j|jf 7 } |jd k�rr|jd k�rrd"| |j|j |j |j |j | f } |j d k�r^| d#|j 7 } tj�|| d$ � n�t!�"d%�} d&} |j�r�| �#d'|j�} d&}|j�r�| �#d'|j�}d(| |j|j |j |j |j | || f } |j d k�r�| d#|j 7 } tj�|| d$ � d)}|j�rd*}n|jd+k�r"d,}d-||f }d.||�$� f }| �%|||�D ]}tj�||� �qL�qPtj�|d/� tj�|d0� z| �&| j'd1 �}W n t k �r� � Y nX |D ]d\}}}t(|�d2k�r�|d2 d3k�rސq�|�)|d& ��r�tj�|d%�*|��+d4d5��+d6d7�d$ � �q�tj�|d8� |dk�rB| jd d �s\|dk�r�| jd d �r�tj�|d9� | j'd1 d:k�r�tj�|d;| d< d%�*| j,� d= | j- d> � tj�|d;| d? � tj�|d;| d@ � tj�|dA� tj�|dB� z(| j �r tj�.|dC� n tj�.|� W n t k �r2 � Y nX dDS )Ez.Write out new rules to file to user chain filer r z'%s' is not writabler r� rI z*filter ri z-user-input - [0:0] z-user-output - [0:0] z-user-forward - [0:0] z -before-logging-input - [0:0] z -before-logging-output - [0:0] z -before-logging-forward - [0:0] z -user-logging-input - [0:0] z -user-logging-output - [0:0] z -user-logging-forward - [0:0] z -after-logging-input - [0:0] z -after-logging-output - [0:0] z -after-logging-forward - [0:0] z-logging-deny - [0:0] z-logging-allow - [0:0] r r r z-user-limit - [0:0] z-user-limit-accept - [0:0] z### RULES ### zroute:rH r> z in_%s!out_%sz%s_%sz# ### tuple ### %s %s %s %s %s %s %sz comment=%srj r r� r� z) ### tuple ### %s %s %s %s %s %s %s %s %sr r ro r � %s-user-%sz -A %s %s z ### END RULES ### z ### LOGGING ### r� r �-D�[z"[z] z] "z### END LOGGING ### z ### RATE LIMITING ### �offz-A z -user-limit z "z " z-user-limit -j REJECT z -user-limit-accept -j ACCEPT z### END RATE LIMITING ### zCOMMIT FN)/r5 r( �access�W_OKr> r r rP rQ rM rk r r r4 �sys�stdout�filenorS rl r� r r� r� r� rK r� r� r� r� r{ r� r| r� rN rO rT � format_ruler� �_get_logging_rulesr? r� r� r* r� r1 r2 rU )r3 r� Z rules_filerV rY r6 r rZ r� r� ZifacesZtstrr� r� r� � chain_suffixr9 �rule_strr� Zlrules_trr �qr: r: r; � _write_rules sZ �������������� ��� �� �� � ��� � �� ������z UFWBackendIptables._write_rulesTc C s� | � � d}|jrR| �� s*td�}t|��|jdkrx| jd d sxtd�|j S n&|jdkrx| jd d sxtd�|j S |jr�|jdkr�|jd kr�td �}t|��g }d }d }| j }|j } |jr�| j d k r�|j dks�|j dkr�td �S | j}| dk �s| t|�k�rtd�| }t|��| dk�r:|j�r:td�}t|��| t|�k�r\td�| }t|��z |�� W n tk �r� � Y nX d} d } d} d} |D �]p}z |�� W n tk �r� � Y nX |j|j|j |j f}| | k�rL| d dk�r| d dk�r| dk�s,|d dk�r"|d dk�s,| |k�rDd} |�|�� � d} n| d7 } |} | d7 } t�||�}|dk �rv| d7 } |dk�r�|�s�| �s�d}|j�s|�|�� � n^|dk�r�|j�r�|jdk�r�d}n:|dk �r�|j�s�| �s�d}d}|�|�� � n |�|� �q�| �r8| dk�r�td�}|j�r2|d7 }|S n~|�sT|j�sT|�|�� � |�s�|j�r�| j�s�td�}|j�r�|d7 }|S |�r�|j�s�|�s�td�}|j�r�|d7 }|S |j�r�|| _n|| _ z| �|j� W n< tk �r� � Y n& tk �r td �}t|� Y nX td �}|j�r2td �}| � � �r�| j�s�d}|�sb| � |j��sb| �r�d}| �rz|td �7 }n |td �7 }|j�r�|d7 }|�r�z | � � W n tk �r� � Y nX n |td!�7 }n�|�r<|j�r<d"}td#�}|j�r�|d7 }|�r.z | � � W n tk �r& � Y nX d}n |td!�7 }n |�s\|�s\|j�s\d$}td%�}|dk�r�| j }d&}|j�r�| j }d'}|d7 }d(}|j!�r�d)}n|j"d*k�r�d+}d,||f }td-�}t#|d.|d/g�\}}|dk�r�t|��d0|||�$� f }t%�&d1�}| �'|||�D ]�}t#|g| �\}}|dk�rDt(|t)j*� t|� |d$k�r|�+d2�,|���r|�-d3d2�,|��}t#|d"|d4d5g�\}}|dk�rt.d6| � �q|S )7aX Updates firewall with rule by: * appending the rule to the chain if new rule and firewall enabled * deleting the rule from the chain if found and firewall enabled * inserting the rule if possible and firewall enabled * updating user rules file * reloading the user rules file if rule is modified rH z)Adding IPv6 rule failed: IPv6 not enabledr r z#Skipping unsupported IPv6 '%s' ruler z#Skipping unsupported IPv4 '%s' ruleZudpZtcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4r zInvalid position '%d'z Cannot specify insert and deletez#Cannot insert rule at position '%d'ry )rH rH rH rH r� r� T���z Skipping inserting existing ruler} z"Could not delete non-existent rulez Skipping adding existing rulezCouldn't update rules filez Rules updatedzRules updated (v6)z Rule insertedz Rule updatedz (skipped reloading firewall)r� z Rule deleted�-Az Rule addedr r� r r ro r r� �!Could not update running firewallr_ r^ z%s %s %sz (-A +)(ufw6?-user-[a-z\-]+)(.*)r r� r! �RETURNzFAILOK: -D %s -j RETURN)/rk r� r/ r> r r� rl Zmultir� r �positionZiptables_versionr� r� r r� �remove� normalizerM r{ r| r0 �dup_ruler r� r� r4 r� r� r� r� r rn r rK r r� rN rO r� r r� �stderrrR r* rT r ) r3 r� Z allow_reloadr@ rV Znewrules�foundZmodifiedr r� r� ZinsertedZmatchesZlastr� ZcurrentZret�flagr� r6 r� r9 rv ro r� r� r� rr r: r: r; �set_rule� sR � & � �� � zUFWBackendIptables.set_rulec C st g }g }|r| j }n| j}|�� }|�|� |�� |�� }|D ].}|�� }|�� |�� } | |kr@|�|� q@|S )z@Return a list of UFWRules from the system based on template rule)r r r� r� r� r� r0 ) r3 �templater� r r� Znormr� r� rI Z tmp_tupler: r: r; �get_app_rules_from_system� s z,UFWBackendIptables.get_app_rules_from_systemc C sZ | j }|�d�r| j}t|g| �\}}|dkrVtd| �}|rNtd| � nt|��dS )zPerform command on chainr� r zCould not perform '%s'zFAILOK: N)r r� rn r r> r r )r3 r9 rp �fail_okr� rv ro rV r: r: r; r� � s z UFWBackendIptables._chain_cmdc C s� | j r dS | �� g }z| �|�}W n tk r: � Y nX z | jdd� | jdd� W n8 tk rn � Y n$ tk r� td�}t|� Y nX | �� s�dS td�}| jd | jd | jd | jd D ]:}z| � |d |d g� W q� tk �r t|��Y q�X q�zJ| jd | jd | jd D ]&}| � |d |g� | � |d|g� �q*W n tk �rr t|��Y nX |D ]�\}}}d}t |�dk�r�|d dk�r�d}zH|dk�r�t |�dk�r�| j |dg|dd� dd� | � |||� W n tk �r t|��Y nX �qxdD ]�}| j d d �r4|dk�sN| j d d �r|dk�r| j |d|g| j | j d g dd� | jd d k�r| j |d |g| j | j d g dd� �qdS ) z#Update loglevel of running firewallNF)r� Tz&Couldn't update rules file for loggingr� r r r r r_ r^ r� r� r r� � delete_firstry )r� )rg rh r r rg r rh r r� r� �-I)r4 rk r� rM r� r r> r� r. r� r� rl r1 r2 r? ) r3 r� �rules_trV rr r� r� r� r9 r: r: r; r� � s� ��� �� � �� � ��z!UFWBackendIptables.update_loggingc C s� g }|t | j�� �kr*td�| }t|��|dkr^| jd D ] }|�|d|ddgdg� q<|S | jd D ] }|�|d|ddgd g� qhd d d d ddg}| j| | jd k�r@g }| j| | jd k r�|}| jd D ]�}dD ]�}|�|�r�| �|�dk�s| �|�dk�r.d}|�|d|ddd|g| d g� q�| j| | jd kr�d}|�|d|ddd|g| d g� q�q�g }| j| | jd k �r�|}| jd D ]�}|�d ��r�d}nt|�d��r d}| j| | jd k �r�|�|d|d d d d ddg| d g� n(|�|d|d d d d dddd!g | d g� |�|d|ddd|g| d g� �q�| j| | jd k�r�g }| j| | jd" k �rt|}| j| | jd k �r�d d d d#g| }d$}| jd% D ]&}|�|d|ddd|g| d g� �q�|S )&z%Get rules for specified logging levelzInvalid log level '%s'r� r r� r! r� r� r� rH r r r z3/minz --limit-burstZ10r� Zhighr r r= rC z [UFW BLOCK] r� r" r# Zmediumz [UFW ALLOW] r rB Z conntrackz --ctstateZINVALIDz[UFW AUDIT INVALID] ZfullZNEWz [UFW AUDIT] r ) r� r� r� r> r r. r0 �endswithr� ) r3 r� r� rV rr r� Zlargsru r� r: r: r; r� s� � ��� ��� ��� ��� ��� ��� z%UFWBackendIptables._get_logging_rulesc C s� d}t tjj| j�}g }| jD ]d}| j| �d�s4q |�| j| � tj � |dtj � | j| ��}tj � |�s t d�| }t|��q t�d�}|D ]0}d||f }tj �|�r�t d�| }t|��q�|D ]:}d||f }|t d�tj � |�|d � 7 }t�||� q�|D ]�}d||f }t�tj � |dtj � |��tj �|�� t�||� zt�|�} | tj } W n0 tk �r� t d �| } t| � Y �qY nX | tj@ �r�|t d �| 7 }n | tj @ �r|t d �| 7 }�q|S ) zReset the firewallrH z.rulesr z Could not find '%s'. Abortingz %Y%m%d_%H%M%Sz%s.%sz '%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s' )�old�newzCouldn't stat '%s'z WARN: '%s' is world writablez WARN: '%s' is world readable) r r r$ � share_dirr r5 r� r0 r( r) r* �basename�isfiler> r �time�strftime�exists�rename�shutil�copy�dirnameZcopymode�stat�ST_MODErM r �S_IWOTH�S_IROTH) r3 �resr� Zallfilesrt �fnrV Zextr� Zstatinfo�moder� r: r: r; �resetg sZ � � � � zUFWBackendIptables.reset)NN)FF)F)T)F)�__name__� __module__� __qualname__�__doc__r- rA r\ rw r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r: r: r: r; r s. ,K] f! De * i JZr )r r( rN r r r� r Z ufw.commonr r Zufw.utilr r r r r r Z ufw.backendr r+ r, r r: r: r: r; �<module> s