File: //usr/lib/python3/dist-packages/ufw/__pycache__/backend.cpython-310.pyc
o
�Fa7j � @ s~ d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m
Z
m Z m Z ddl
mZmZ ddlZG dd� d�ZdS )z&backend.py: interface for ufw backends� N)�error�warn�debug� _findpath)�UFWError�UFWRulec @ s� e Zd ZdZ d=dd�Zdd� Zdd� Zd d
� Zd>d
d�Zdd� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Zd5d6� Z d7d8� Z d9d:� Z d;d<� Z dS )?�
UFWBackendzInterface for backendsNc C sB d | _ || _|| _g | _g | _ttjj|�}t j
� |d�t j
� |d�t j
� |d�d�| _ |d ur6| j �
|� ddddd d
�| _tjj| _| �� | �� | �� tj�| j d �| _t j
� tjjd �| _t j
� tjjd
�| _t j
� tjjd�| _t j
� tjjd�| _z
tj� | j�| _ W n t y� t d�}t |��w d | _!d S )Nz default/ufwz ufw/ufw.confzufw/applications.d)�defaults�conf�appsr �d �� i, i� )�off�low�medium�high�fullr �iptablesziptables-restore� ip6tableszip6tables-restorez#Couldn't determine iptables version)"r �name�dryrun�rules�rules6r �ufw�common�
config_dir�os�path�join�files�update� loglevels� do_checks�
_do_checks�
_get_defaults� _read_rules� applications� get_profiles�profiles� iptables_dirr �iptables_restorer �ip6tables_restore�util�get_iptables_version�iptables_version�OSError�_r �caps)�selfr r � extra_files�rootdir�datadir�p�err_msg� r8 �-/usr/lib/python3/dist-packages/ufw/backend.py�__init__ sL � �
� � �
zUFWBackend.__init__c
C sj | j durdS i | _ i | j d< d| j d d< d| j d d< | jr�t�� dkr�| js�z tj�| j�}W n# t yU } zd| }| �
� rFt |� t |� W Y d}~dS d}~ww d |v rfd
|v rfd| j d d< nd| j d d< | �
� r�z tj�| j�}W n t y� } z t d| � W Y d}~nd}~ww d |v r�d
|v r�d| j d d< dS d| j d d< dS dS dS dS dS ) zgInitialize the capabilities database. This needs to be called
before accessing the database.N�limitT�4F�6r z initcaps
%sz
recent-setz
recent-update)r1 r" r �getuidr r r, �get_netfilter_capabilitiesr r/ �
is_enabledr r �use_ipv6r )r2 �nf_caps�e�msgr8 r8 r9 �initcapsL s@
���� �zUFWBackend.initcapsc C s d| j v r| j d dkrdS dS )z!Is firewall configured as enabled�enabled�yesTF)r �r2 r8 r8 r9 r@ x s
zUFWBackend.is_enabledc C s, d| j v r| j d dkrtj�d�rdS dS )z"Is firewall configured to use IPv6�ipv6rG z/proc/sys/net/ipv6TF)r r r �existsrH r8 r8 r9 rA s
�zUFWBackend.use_ipv6�inputFc C s� d| d }d}| j | dkrd}n | j | dkr d}nd}|rr|dkrrd }td
�}tj�d d g�\}}|d
kr<t|��d|v rBd}| �� rntj�d dg�\}}|d
krZd|v rZd}tj�d dg�\}}|d
krnd|v rnd}|srd}|S )z.Get default policy for specified primary chain�default_�_policy� �accept�allow�reject�deny�forwardFzproblem running sysctl�sysctlznet.ipv4.ip_forwardr �1Tz net.ipv6.conf.default.forwardingz net.ipv6.conf.all.forwarding�disabled)r r0 r r, �cmdr rA ) r2 �primary�
check_forward�policy�rstrrF r7 �rc�outr8 r8 r9 �_get_default_policy� s2 z UFWBackend._get_default_policyc C sL | j s
td�}t|� dS t�� t�� kr td�}t|��t�� t�� kr-td�}t|��t�� }|dkr=td�}t|��i }i }i }g }tj �
| j d �s\td�| j d }t|� n"t �
d �}t�| j d �D ]} |�| �s}|�tj �| j d | �� qit| j �� �tj �tjd �g | D ]�}
|
�d
�s�d t�� |
f }
td |
� |
| j d kr�tj �
| j d �s�n�z t�|
�} | tj } W n t y� td
�|
}t|�� t y� � w d}
d}d}zt � | j �d |
ks�t � | j �d |kr�d}W n
t!�y Y nw | j dk�r+|�s+|
|v�r+td�t"|�|
t"| j �d� }t|� d||
< | tj#@ �rD|
|v�rDtd�|
}t|� d||
< | tj$@ �rc|
|v�rc| j%dk�rctd�|
}t|� d||
< |
d
k�rin|
}tj �&|
�}
|
�s|t t'j(d| ��q�q�| j D ]"}|dk�r�tj �)| j | ��s�td�|| j | d� }t|���q�dS )a8 Perform basic security checks:
is setuid or setgid (for non-Linux systems)
checks that script is owned by root
checks that every component in absolute path are owned by root
warn if script is group writable
warn if part of script path is group writable
Doing this at the beginning causes a race condition with later
operations that don't do these checks. However, if the user running
this script is root, then need to be root to exploit the race
condition (and you are hosed anyway...)
zChecks disabledTz%ERROR: this script should not be SUIDz%ERROR: this script should not be SGIDr z&You need to be root to run this scriptr z'%s' does not existz^\.�/z%s/%sz Checking zCouldn't stat '%s'�clickpkg� snappypkgFz4uid is %(uid)s but '%(path)s' is owned by %(st_uid)s)�uidr �st_uidz%s is world writable!z%s is group writable!z Could not find parent for '%s'z&'%(f)s' file '%(name)s' does not exist)�fr N)*r" r0 r r r> �geteuidr �getgid�getegidr �isdirr �re�compile�listdir�search�appendr �list�values�abspath�sys�argv�
startswith�getcwdr �stat�ST_MODEr/ � Exception�pwd�getpwuidrc �KeyError�str�S_IWOTH�S_IWGRP�st_gid�dirname�errno�ENOENT�isfile)r2 r7 rb �warned_world_write�warned_group_write� warned_ownerr( �warn_msg�pat�profiler �statinfo�mode�
click_user� snap_user�is_unpack_user� last_pathrd r8 r8 r9 r# � s�
� ��
�
���
��
����
6 ���zUFWBackend._do_checksc
C s i | _ | jd | jd fD ]G}ztj�|�}W n ty( td�| }t|��w t� d�}|D ] }|�
|�rOt� d|� � �}|d �
� � d�| j |d �
� < q0|�� q
g d �}d
D ]+}d | | j vrntd | �}t|��| j d | } | |vr�td
| |d� �}t|��q[dS )z#Get all settings from defaults filer r
z Couldn't open '%s' for readingz ^\w+="?\w+"?�=� �"'r )rO �droprQ )rK �outputrS zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')rZ �chainN)r r r r, �open_file_readrw r0 r ri rj rl �split�strip�lower�close)
r2 rd �origr7 r� �line�tmp�policies�cr6 r8 r8 r9 r$ s8 �
�
���zUFWBackend._get_defaultsc
C s
t �d|�std�}t|��t�|tj�s td| �}t|��tj� |�}|d }d}t �
d| d �}|d D ] } |� | �rOtj� ||d | d � d
}q8tj� || � q8|sftj� ||d | d � ztj�
|� W n tyv � w |�� �d �| j|�� < d S )
z Sets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writabler� F�^r� r� �
Tr� N)ri �matchr0 r r �access�W_OKr r, �
open_filesrj rl �
write_to_file� close_filesrw r� r� r )
r2 �fn�opt�valuer7 �fns�fd�foundr� r� r8 r8 r9 � set_default: s.
� zUFWBackend.set_defaultc C s� | j sI|dkr| �| jd dd� n7|dkr!| �| jd dd� n(|dkr0| �| jd dd� n|d kr?| �| jd dd
� n
td �| }t|��td �| }|S )
z+Sets default application policy of firewallrP r �DEFAULT_APPLICATION_POLICYz"ACCEPT"rR z"DROP"rQ z"REJECT"�skipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')r r� r r0 r )r2 rZ r7 r[ r8 r8 r9 � set_default_application_policy^ s2 � � � � z)UFWBackend.set_default_application_policyc C sN g }t | j�� �}|j|v r�|j|v r�tj�| j|j �}tj�| j|j �}|D ]}|�� }d|_ |�
dd� tj � |�\}} |�
| � |�
|d� |j |_ |j|jkrud|_tj � |�\}} |�
| � |�
|d� |j|_|�|� q)|D ]0}
|�� } d| _tj � |
�\}} | �
| � | �
|d� | jdkr�| �
|j� |j| _|�| � qwq)nl|j|v r�tj�| j|j �D ]%} |�� } d| _tj � | �\}} | �
| � | �
|d� |j| _|�| � q�n6|j|v �rtj�| j|j �D ]%} |�� } d| _ tj � | �\}} | �
| � | �
|d� |j | _ |�| � q�t|�dk �r%td�}
t|
��|S )z4Return a list of UFWRules based on the template rulerN �any�src�dstr� z&No rules found for application profile)rn r( �keys�dport�sportr r& � get_ports�dup_rule�dapp�set_portr, �parse_port_proto� set_protocol�sapprm �protocol�lenr0 r )r2 �templater �
profile_names�dports�sports�ir� �port�proto�j�ruler6 r7 r8 r8 r9 �get_app_rules_from_templatey sn
��
!
�
z&UFWBackend.get_app_rules_from_templatec
C sR g }g }d}d}d}| j | j D ]e}|j|ks |j|krg|�� }||kr%q|�� } | �d� | jdkr:| �| jd� | jdkrF| �| jd� | �| �}
|
D ]} | � � | j
r\|� | � qM|� | � qM|}d}q|j
rp|� |� q|� |� q|r�|| _ || _|t d�| 7 }z| �
d� | �
d� W ||fS ty� t d�} t| ��w ||fS ) z�Update rule for profile in place. Returns result string and bool
on whether or not the profile is used in the current ruleset.
rN Fr� r� r� Tz Rules updated for profile '%s'z!Couldn't update application rules)r r r� r� �
get_app_tupler� r� r� r� � normalize�v6rm r0 � _write_rulesrw r )
r2 r� �
updated_rules�updated_rules6�
last_tupler[ �updated_profile�r�tuplr� �
new_app_rules�new_rr7 r8 r8 r9 �update_app_rule� sT
�
��zUFWBackend.update_app_rulec C s� || j v r|S d}d}t| j �� �D ]}|�� |�� kr"|}|d7 }qd||f }t|� |dkr3|S |dkrAtd�| }t|��td�| }t|��)z2Find the application profile name for profile_namerN r r� z'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s')r( rn r� r� r r0 r )r2 � profile_namer� �matches�n� debug_msgr7 r8 r8 r9 �find_application_name� s,
� ���z UFWBackend.find_application_namec C s< |r |t | j�kr t� �|s|t | j�krt� �|dk r t� �g }|r'| j}n| j}i }d}t|�D ]'\}}||kr< n d}|jdksH|jdkrY|�� }||v rU|d7 }q2d||< q2g }|rr| j}| j|d | �� } | � d� n| j}| j|d | �� } | � d� d}
|D ]}t
� || �dkr�|
S |
d7 }
q�dS )a. Return the absolute position in the other list of the rule with the
user position of the given list. For example, find_other_position(4,
True) will return the absolute position of the rule in the ipv4 list
matching the user specified '4' rule in the ipv6 list.
r� r rN TF) r� r �
ValueErrorr � enumerater� r� r� r� �set_v6r r� ) r2 �positionr� r � app_rules� tuple_offsetr� r� r� �
match_rule�countr8 r8 r9 �find_other_position sH
�
z UFWBackend.find_other_positionc C s� d}t d�}d| jvs| jd t| j�� �vr#d}|t d�7 }||fS | j| jd }|dkr7|d7 }||fS |d| jd 7 }||fS )z"Gets current log level of firewallr z Logging: �loglevel����unknownr zon (%s))r0 r rn r! r� )r2 �levelr[ r8 r8 r9 � get_loglevelO s
��zUFWBackend.get_loglevelc C s� |t | j�� �dg vrtd�| }t|��|}|dkr0d| jvs(| jd dkr+d}n| jd }| �| jd d|� | �|� |dkrGtd�S td �S )
zSets log level of firewall�onzInvalid log level '%s'r� r r r
�LOGLEVELzLogging disabledzLogging enabled) rn r! r� r0 r r r� r �update_logging)r2 r� r7 � new_levelr8 r8 r9 � set_loglevel_ s
zUFWBackend.set_loglevelc C s | j | j S )zReturn list of all rules)r r rH r8 r8 r9 � get_rulesu s zUFWBackend.get_rulesc C sr g }|r| j }n| j}d}i }|D ]%}d}|jdks |jdkr2|�� }||v r.td| � qd||< |d7 }q|S )z/Return number of ufw rules (not iptables rules)r rN �Skipping found tuple '%s'Tr� )r r r� r� r� r )r2 r� r r� r� r� r� r8 r8 r9 �get_rules_county s
zUFWBackend.get_rules_countc C sx | � � }d}i }|D ]/}d}|jdks|jdkr+|�� }||v r'td| � q
d||< |t|�kr5| S |d7 }q
dS )z:Return rule specified by number seen via "status numbered"r� rN r� TN)r� r� r� r� r �int)r2 �numr r� r� r� r� r8 r8 r9 �get_rule_by_number� s
z UFWBackend.get_rule_by_numberc C s> g }d}| � � D ]}|d7 }|�|�}|dk r |�|� q|S )zmSee if there is a matching rule in the existing ruleset. Note this
does not group rules by tuples.r r� )r� �fuzzy_dst_matchrm )r2 r� �matchedr� r� �retr8 r8 r9 � get_matching� s
�zUFWBackend.get_matchingc C � t d��)z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to override�r )r2 rZ � directionr8 r8 r9 �set_default_policy� � z UFWBackend.set_default_policyc C r� )z Get status of running firewallz,UFWBackend.get_running_raw: need to overrider� )r2 �
rules_typer8 r8 r9 �get_running_raw� r� zUFWBackend.get_running_rawc C r� )zGet managed rulesz'UFWBackend.get_status: need to overrider� )r2 �verbose�
show_countr8 r8 r9 �
get_status� r� zUFWBackend.get_statusc C r� )zUpdate firewall with rulez%UFWBackend.set_rule: need to overrider� )r2 r� � allow_reloadr8 r8 r9 �set_rule� r� zUFWBackend.set_rulec C r� )zStart the firewallz+UFWBackend.start_firewall: need to overrider� rH r8 r8 r9 �start_firewall� r� zUFWBackend.start_firewallc C r� )zStop the firewallz*UFWBackend.stop_firewall: need to overrider� rH r8 r8 r9 �
stop_firewall� r� zUFWBackend.stop_firewallc C r� )z%Get a list if rules based on templatez6UFWBackend.get_app_rules_from_system: need to overrider� )r2 r� r� r8 r8 r9 �get_app_rules_from_system� r� z$UFWBackend.get_app_rules_from_systemc C r� )z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrider� )r2 r� r8 r8 r9 r� � r� zUFWBackend.update_loggingc C r� )zReset the firewallz"UFWBackend.reset: need to overrider� rH r8 r8 r9 �reset� r� zUFWBackend.reset)NNN)rK F) �__name__�
__module__� __qualname__�__doc__r: rE r@ rA r^ r# r$ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r� r r8 r8 r8 r9 r s@
�,,
&p $D>< r )r r� r rx ri ru rq �ufw.utilr r r r r �
ufw.commonr r �ufw.applicationsr r8 r8 r8 r9 �<module> s