OwlCyberSecurity - MANAGER
Edit File: frontend.cpython-38.pyc
U ��\l� � @ sz d Z ddlZddlZddlZddlmZ ddlZddlmZm Z m Z ddl m Z ddl Zdd� Zdd � ZG d d � d �ZdS ) z'frontend.py: frontend interface for ufw� N)�UFWError)�error�warn�msg)�UFWBackendIptablesc C s� t j�� }dD ]}|�t j�|�� qdD ]}|�t j�|�� q*dD ]}|�t j�|�� qFdD ]}|�t j�|�� qbdD ]}|�t j�|�� q~dD ]}|�t j� |�� q�ddd d d d d g}|D ](}|�t j� |�� |�t j� |�� q�t | �dk�r\d}| | � � dk�rd}| | � � dk�r\| | � � dk�r\| | � � |k�r\| �|d� t | �dk �s�d| k�r�t | �dk �r�td� z|�| dd� �}W nT tk �r� } ztd|j � W 5 d}~X Y n$ tk �r� tddd� � Y nX |S )zEParse command. Returns tuple for action, rule, ip_version and dryrun.)�enable�disable�helpz--help�versionz --version�reload�reset)�list�info�default�update)�on�offZlowZmediumZhighZfull)�allow�deny�reject)N�verboseZnumbered)�rawz before-rulesz user-rulesz after-rulesz logging-rules�builtins� listening�addedr �limitr r �insert�delete�prepend� � � --dry-runr �route�rule� znot enough argsNz%szInvalid syntaxF)Zdo_exit)�ufw�parserZ UFWParserZregister_commandZUFWCommandBasicZ UFWCommandAppZUFWCommandLoggingZUFWCommandDefaultZUFWCommandStatusZUFWCommandShow�UFWCommandRule�UFWCommandRouteRule�len�lowerr r � parse_commandr �value� Exception)�argv�p�iZ rule_commands�idx�pr�e� r4 �./usr/lib/python3/dist-packages/ufw/frontend.pyr+ sN ��� & r+ c & C s\ t dtjjdddddddd d d d d ddddddddddddddd d d d d d!d"d#d$�# �} | S )%zPrint help messagea Usage: %(progname)s %(command)s %(commands)s: %(enable)-31s enables the firewall %(disable)-31s disables the firewall %(default)-31s set default policy %(logging)-31s set logging to %(level)s %(allow)-31s add allow %(rule)s %(deny)-31s add deny %(rule)s %(reject)-31s add reject %(rule)s %(limit)-31s add limit %(rule)s %(delete)-31s delete %(urule)s %(insert)-31s insert %(urule)s at %(number)s %(route)-31s add route %(urule)s %(route-delete)-31s delete route %(urule)s %(route-insert)-31s insert route %(urule)s at %(number)s %(reload)-31s reload firewall %(reset)-31s reset firewall %(status)-31s show firewall status %(statusnum)-31s show firewall status as numbered list of %(rules)s %(statusverbose)-31s show verbose firewall status %(show)-31s show firewall report %(version)-31s display version information %(appcommands)s: %(applist)-31s list application profiles %(appinfo)-31s show information on %(profile)s %(appupdate)-31s update %(profile)s %(appdefault)-31s set default application policy ZCOMMANDZCommandsr r z default ARGz logging LEVELZLEVELz allow ARGSr# z deny ARGSz reject ARGSz limit ARGSzdelete RULE|NUMZRULEzinsert NUM RULEz prepend RULEz route RULEzroute delete RULE|NUMzroute insert NUM RULEZNUMr r �statuszstatus numberedZRULESzstatus verbosezshow ARGr z Application profile commandszapp listzapp info PROFILEZPROFILEzapp update PROFILEzapp default ARG)#ZprognameZcommandZcommandsr r r Zlogging�levelr r# r r r r Zuruler r r" z route-deletez route-insert�numberr r r6 Z statusnum�rulesZ statusverbose�showr Z appcommandsZapplistZappinfo�profileZ appupdateZ appdefault)�_r% �commonZ programName)Zhelp_msgr4 r4 r5 �get_command_help[ sN ��Br> c @ s� e Zd ZdZd,dd�Zdd� Zdd � Zd d � Zd-d d�Zd.dd�Z dd� Z dd� Z dd� Z d/dd�Z d0dd�Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd1d*d+�ZdS )2� UFWFrontendZUI�iptablesNc C sd |dkr6zt |||d�| _W qB tk r2 � Y qBX n td| ��td�| _td�| _td�| _d S )Nr@ )�rootdir�datadirz Unsupported backend type '%s'�n�y�yes)r �backendr- r r< �norE �yes_full)�self�dryrunZ backend_typerA rB r4 r4 r5 �__init__� s � zUFWFrontend.__init__c C sz d}d}|rd}d}|r"| j �� r0|s4| j �� r4d}|r�z | j �| j jd d|� W n, tk r� } zt|j� W 5 d}~X Y nX d}|�r0z| j �� W n, tk r� } z|r�|j}W 5 d}~X Y nX |dk�r&z | j �| j jd dd� W n. tk �r } zt|j� W 5 d}~X Y nX t|� td �}nFz| j � � W n. tk �rl } zt|j� W 5 d}~X Y nX td �}|S ) zlToggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or stops running firewall. � rG rE FTZconfZENABLEDNz0Firewall is active and enabled on system startupz/Firewall stopped and disabled on system startup) rF � is_enabledZ set_default�filesr r r, �start_firewallr< � stop_firewall)rI Zenabled�resZ config_strZchangedr3 Z error_strr4 r4 r5 � set_enabled� sT �� � � zUFWFrontend.set_enabledc C sf d}z0| j �||�}| j �� r2| j �� | j �� W n, tk r` } zt|j� W 5 d}~X Y nX |S )z Sets default policy of firewallrL N)rF �set_default_policyrM rP rO r r r, )rI �policy� directionrQ r3 r4 r4 r5 rS � s z UFWFrontend.set_default_policyc C sF d}z| j �|�}W n, tk r@ } zt|j� W 5 d}~X Y nX |S )zSets log level of firewallrL N)rF � set_loglevelr r r, )rI r7 rQ r3 r4 r4 r5 rV � s zUFWFrontend.set_loglevelFc C sD z| j �||�}W n, tk r> } zt|j� W 5 d}~X Y nX |S )zShows status of firewallN)rF � get_statusr r r, )rI r Z show_count�outr3 r4 r4 r5 rW s zUFWFrontend.get_statusr c C sB z| j �|�}W n, tk r< } zt|j� W 5 d}~X Y nX |S )z Shows raw output of firewallN)rF Zget_running_rawr r r, )rI Z rules_typerX r3 r4 r4 r5 � get_show_raw s zUFWFrontend.get_show_rawc C s$ d}zt j�| j�� �}W n$ tk r> td�}t|��Y nX | j�� }t |� � �}|� � |D �]�}| j�� s||dkr|qb|d| 7 }t || � � �}|� � |D �]^}|| | D �]J} | d } | � d�s�| � d�s�d} |d| 7 }| d ks�| d k�r|d 7 }d | d } n|d | 7 }t j� | �} |dtj�| d � 7 }t jjd|dd� || ddd�} | �|�d�� | dk�r�| �d| � | �� | j�| �} t| �dk�r�|d7 }| D ]D}|dk�r�|d t|�k �r�|d|t jj�||d �f 7 }�q�|d7 }q�q�qb| j�� �s t j� d� |S ) zMShows listening services and incoming rules that might affect themrL z Could not get listening status)Ztcp6Zudp6z%s: Zladdrz127.z::1z %s z0.0.0.0z::z* z%s/0z%s z(%s)Zexer Nr$ �inF)�actionZprotocolZdport�dstrU �forward�6r � r z [%2d] %s z)Skipping tcp6 and udp6 (IPv6 is disabled)) r% �utilZparse_netstat_outputrF �use_ipv6r- r< r � get_rulesr �keys�sort� startswithZget_if_from_ip�os�path�basenamer= ZUFWRule�set_v6�endswithZ set_interfaceZ normalizeZ get_matchingr) r& r' � get_command�debug)rI rQ �d�err_msgr9 Z protocols�proto�portsZport�itemZaddrZifnamer# Zmatchingr0 r4 r4 r5 �get_show_listening sl � � �� z UFWFrontend.get_show_listeningc C s� | j �� }td�}t|�dkr*|td� S g }| j �� D ]L}|jrVdtjj�|� }ntjj �|�}||krnq8|� |� |d| 7 }q8|S )z!Shows added rules to the firewallz9Added user rules (see 'ufw status' for running firewall):r z (None)�route %sz ufw %s) rF rb r< r) r] r% r& r( rk r' �append)rI r9 rX r �r�rstrr4 r4 r5 �get_show_added[ s � zUFWFrontend.get_show_addedc C s d}d}d}g }|j dkr2|jdkr2|�|� �n�g }�zt|j�r�|dkrZ| j�|d�}n�|dkrr| j�|d�}nt|dkr�| j�|d�}| j�|d�}|D ]4} |D ]*} | j} d| _| �| �s�| | _|�| � q�q�ntd�| }t |��t |�dk�rJ| jj �sJtd �}|dk�r|}n.|dk�r*|d }n|dk�rD|d | d }|W S |D ]8}|� � } |j| _| � |j� | �|j� |�| � �qNn | j�|�}|jdk�r�|�� W n tk �r� � Y nX d} d}td �}| j�d�}| j�d�}t|�D �]\}} |} | j|| k�r.|t| j�d 7 }t |���z�| j�� �r(|dk�r�| jdk�r|| dk�rl|dk�rldnd}| �|� n&| j|k�r�|t| j�d 7 }t |��| �d� | j�| �}�q�|dk�rd| jdk�r�| dk�r�|dk�r�dnd}| �|� nP| j|k�r| �| j| � n2| jdk�rJ| j|k�rJ|t| j�d 7 }t |��| �d� | j�| �}�q�|dk�r| j}| �d� |dk�r�| dk�r�|dk�r�dnd}| �|� nH| j�s�||k�r�| j� || | d�}|dk�r�| �|� n | �d� | j�| �}| j�s0|dk�r0| j�d�}| �|d � | �d� |dk�rl| dk�r\|dk�r\dnd}| �|� nT| j�s�| jdk�r�| j|k�r�| j� | jd�}|dk�r�| �|| � n | �d� |dk�r�|d 7 }| j�s | j|k�r |dk�r | �| j| � || j�| �7 }ntd�| }t |��n�| jdk�rZ| dk�rL|dk�rLdnd}| �|� |dk�sn|dk�r�| �d� | j�| �}n0|dk�r�td�}t |��ntd�| }t |��W n: t k �r� } z|j }d}W Y � �qW 5 d}~X Y nX | j �r�td�}t � |� �q�|�s"||7 }n�t |�dk�r:t!|� n�d}t"t#| d ��}|�� |D ]p}| dk�rZ|| �rZ|| � � }d|_z| �||� W n2 tk �r� d}td�| �$� }t |� Y nX �qZ|td�7 }|�r�|td�7 }n |td�7 }t |��|S )zUpdates firewall with rulerL �v4F�v6TZbothzInvalid IP version '%s'r z"Could not delete non-existent rulez (v6)r_ zInvalid position '�'���r zIPv6 support not enabledNz Rule changed after normalizationz Could not back out rule '%s'z" Error applying application rules.z# Some rules could not be unapplied.z( Attempted rules successfully unapplied.)%�dapp�sapprt �removerF Zget_app_rules_from_systemry �matchr< r r) rJ Zdup_ruleZ set_actionr[ Z set_logtypeZlogtypeZget_app_rules_from_templateZposition�reverser- Zget_rules_count� enumerate�strra Z set_positionri �set_ruleZfind_other_positionr, �updated�warningsr r r �rangeZ format_rule) rI r# � ip_versionrQ rn �tmpr9 ZtmprulesZ tmprules6�xrD Zprev6ru �countZ set_errorZ pos_err_msgZnum_v4Znum_v6r0 ZbeginZuser_posr/ r3 Zwarn_msgZ undo_errorZindexes�jZ backout_ruler4 r4 r5 r� x sX � � � � � � � � � zUFWFrontend.set_rulec C s^ z t |�}W n( tk r4 td�| }t|��Y nX | j�� }|dksT|t|�krhtd�| }t|��| j�|�}|s�td�| }t|��d|_d}|j r�d}d}|�s:|j r�dt j j �|� } nt j j�|�} td�| | j| jd � } t| tjd d � tj�� �� �� } | d k�r:| | j�� k�r:| | j�� k�r:d }d } |�rR| �||�} ntd�} | S )z Delete rulezCould not find rule '%s'r zCould not find rule '%d'Trx ry rs z=Deleting: %(rule)s Proceed with operation (%(yes)s|%(no)s)? )r# rE rG F��output�newlinerD rL �Aborted)�intr- r< r rF rb r) Zget_rule_by_numberr~ ry r] r% r& r( rk r' rE rG r �sys�stdout�stdin�readliner* �striprH r� ) rI r8 �forcerC rn r9 r# r� �proceedrv �prompt�ansrQ r4 r4 r5 � delete_ruleD sR ��� �zUFWFrontend.delete_rulec C sV d}|� d�rB|�d�}t|�dkr4| �|d �}n | �d�}�n|dkrX| �d�}�n�|� d�r�td �}|�d �}t|�d kr�t|��| �|d |d �}�n�|d kr�| �|�}�n�|dkr�| �� }�n�|dkr�| �d�}�nr|� d��r0|�d �d }|dk�r| � � }n |dk�r"| � � }n | � |�}�n"|dk�rJ| �dd�}�n|dk�rb| � d�}�n�|dk�rz| � d�}�n�|dk�r�| j �� �r�| � d� | � d� td�}ntd�}�n�|� d��r�| �|�d �d |�}�nr|d k�s|d k�s|d k�s|d k�r>|jdk�r�z0| j �|j�}||jk�rB||_|�|d � W nV tk �r� } z6|j�sjt|j� tj�|j��s�td!�}t|��W 5 d"}~X Y nX |jdk�r0z0| j �|j�}||jk�r�||_|�|d � W nV tk �r. } z6|j�s�t|j� tj�|j��s td!�}t|��W 5 d"}~X Y nX | �||�}ntd#�| }t|��|S )$z�Perform action on rule. action, rule and ip_version are usually based on return values from parse_command(). rL z logging-onr< r r z logging-offr zdefault-zUnsupported default policy�-r$ r r r6 zstatus-verboseTr: r r zstatus-numberedFr r r �Firewall reloadedz&Firewall not enabled (skipping reload)zdelete-r r r r r\ �Invalid profile nameN�Unsupported action '%s')re �splitr) rV r< r rS r rW rr rw rY rR rF rM r� r| Zfind_application_nameZset_portr~ r r, r% � applications�valid_profile_namer} r� ) rI r[ r# r� r� rQ r� rn r3 r4 r4 r5 � do_actionu s� � zUFWFrontend.do_actionc C sF d}z| j �|�}W n, tk r@ } zt|j� W 5 d}~X Y nX |S )z+Sets default application policy of firewallrL N)rF � set_default_application_policyr r r, )rI rT rQ r3 r4 r4 r5 r� � s z*UFWFrontend.set_default_application_policyc C s: t | jj�� �}|�� td�}|D ]}|d| 7 }q$|S )z*Display list of known application profileszAvailable applications:� %s)r rF �profilesrc rd r< )rI �namesrv rC r4 r4 r5 �get_application_list� s z UFWFrontend.get_application_listc C s� g }|dkr&t | jj�� �}|�� n&tj�|�sBtd�}t |��|� |� d}|D �]$}|| jjksr| jj| s�td�| }t |��tj� || jj| �s�td�}t |��|td�| 7 }|td�tj� | jj| � 7 }|td�tj� | jj| � 7 }tj�| jj| �}t|�d k�s,d |d k�r:|td �7 }n |td �7 }|D ]}|d| 7 }�qJ||t|�d krT|d7 }qTtj�|�S )z Display information on profile�allr� rL zCould not find profile '%s'zInvalid profilez Profile: %s z Title: %s zDescription: %s r �,r zPorts:zPort:r� z -- )r rF r� rc rd r% r� r� r< r rt Zverify_profileZ get_titleZget_descriptionZ get_portsr) r` � wrap_text)rI Zpnamer� rn rv �namerp r/ r4 r4 r5 �get_application_info� sL � � � �� z UFWFrontend.get_application_infoc C s d}d}d}z| j jr$tj�� r$d}W n tk r> d}Y nX |dkr�t| j j�� �}|� � |D ]4}| j � |�\}}|rd|dkr�|d7 }||7 }|}qdn | j � |�\}}|dkr�|d7 }|�r| j � � �r|�rz| j � � W n tk r� � Y nX |t d�7 }n |t d�7 }|S )�Refresh application profilerL TFr� r_ r� zSkipped reloading firewall)rF � do_checksr% r` � under_sshr- r r� rc rd Zupdate_app_rulerM Z_reload_user_rulesr< ) rI r; rv Z allow_reloadZtrigger_reloadr� r/ r� �foundr4 r4 r5 �application_update s< z UFWFrontend.application_updatec C s d}d}|dkr t d�}t|��| jjd }|dkrLtj�d||f � |S |dkrZd}n0|d krhd }n"|d krvd }nt d �| }t|��d g}| jjr�|�d� |||g7 }z t |�}W n t k r� � Y nX d|j kr�| � |j |j d |j d �}n| � |j dd�}|S )r� rL r� z%Cannot specify 'all' with '--add-new'Zdefault_application_policy�skipz'Policy is '%s', not adding profile '%s'Zacceptr Zdropr r zUnknown policy '%s'r% r! r# Ziptype)r< r rF �defaultsr% r` rl rJ rt r+ r- �datar� r[ )rI r; rv rT rn r �argsr2 r4 r4 r5 �application_add7 sB � �zUFWFrontend.application_addc C s� d}|dkr| � d�}n�|dkr,| � d�}n�|dkr@| � d�}n�|dkrT| � d �}n�|d krf| �� }nz|d krz| �|�}nf|d ks�|d kr�| �|�}d}|d kr�| �|�}|dkr�|dkr�|d7 }|| }ntd�| }t|��|S )zzPerform action on profile. action and profile are usually based on return values from parse_command(). rL z default-allowr z default-denyr zdefault-rejectr z default-skipr� r r r zupdate-with-newr_ r� )r� r� r� r� r� r< r )rI r[ r; rQ Zstr1Zstr2rn r4 r4 r5 �do_application_actiona s0 z!UFWFrontend.do_application_actionc C sr d}| j jrntj�� rntd�| j| jd� }t|t j dd� t j � � � � �� }|dkrn|| jkrn|| jkrnd}|S )z6If running under ssh, prompt the user for confirmationTzWCommand may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? �rE rG Fr� rD )rF r� r% r` r� r< rE rG r r� r� r� r� r* r� rH )rI r� r� r� r4 r4 r5 �continue_under_ssh� s � z UFWFrontend.continue_under_sshc C s� d}t d�| j| jd� }| jjrBtj�� rBt d�| j| jd� }| jjr�|s�ttj� |�t j dd� t j � � �� �� }|dkr�|| jkr�|| jkr�t d�}|S | j�� r�|| �d�7 }| j�� }|S ) zReset the firewallrL zTResetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? r� zResetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? Fr� rD r� )r< rE rG rF r� r% r` r� r r� r� r� r� r� r* r� rH rM rR r )rI r� rQ r� r� r4 r4 r5 r � s$ � � zUFWFrontend.reset)r@ NN)FF)r )F)F)F)�__name__� __module__� __qualname__�__doc__rK rR rS rV rW rY rr rw r� r� r� r� r� r� r� r� r� r� r r4 r4 r4 r5 r? � s0 � 6 H M 1 V .+* r? )r� rf r� r� Z ufw.commonr Zufw.utilr% r r r Zufw.backend_iptablesr Z ufw.parserr+ r> r? r4 r4 r4 r5 �<module> s >G