Current File : //proc/2/cwd/lib/python2.7/site-packages/ufw/common.pyo
�
��Xc @ s� d Z d d l Z d d l Z d d l Z d d l m Z d Z d Z d Z d Z d Z
d Z d
Z d Z
e Z d e f d
� � YZ d d d � � YZ d S( s! common.py: common classes for ufwi����N( t debugt ufws /var/lib/ufws /usr/libexec/ufws /usr/share/ufws /usr/share/locales /etcs /usrs /sbint UFWErrorc B s e Z d Z d � Z d � Z RS( s$ This class represents ufw exceptionsc C s
| | _ d S( N( t value( t selfR ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt __init__# s c C s
t | j � S( N( t reprR ( R ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt __str__& s ( t __name__t
__module__t __doc__R R ( ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR ! s t UFWRulec B s� e Z d Z d d d d d e d d � Z d � Z d � Z d � Z d � Z d
� Z d d � Z
d
� Z d � Z d � Z
d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( s$ This class represents firewall rulest anys 0.0.0.0/0t int c
C s5 t | _ t | _ t | _ d | _ d | _ d | _ d | _ d | _ t | _ d | _
d | _ d | _ d | _
d | _ d | _ d | _ d | _ | | _ d | _ yo | j | � | j | � | j | � | j | d � | j | � | j | � | j | � | j | � Wn t k
r0� n Xd S( NR i t src( t Falset removet updatedt v6t dstR t dportt sportt protocolt multit dappt sappt actiont positiont logtypet interface_int
interface_outt directiont forwardt commentt
set_actiont set_protocolt set_portt set_srct set_dstt
set_directiont set_commentR (
R R R R R R R R R! R" ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR , s<
c C s
| j � S( N( t format_rule( R ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR O s c C sS d | } t | j � } | j � x) | D]! } | d | | j | f 7} q* W| S( s Print rule to stdouts '%s's , %s=%s( t listt __dict__t sort( R t rest keyst k( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt _get_attribR s
c C s� t | j | j � } | j | _ | j | _ | j | _ | j | _ | j | _ | j | _ | j | _ | j
| _
| j | _ | j | _ | j
| _
| j | _ | j | _ | j | _ | j | _ | j | _ | j | _ | S( s Return a duplicate of a rule( R R R R R R R R R R R R R R R R R R R! R" ( R t rule( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt dup_rule[ s& c C sp d } | j d k r) | d | j 7} n | j d k rL | d | j 7} n | j d k rh | d 7} n� | d | j 7} | j r"| d 7} | j d k r� | j d k r� | d | j 7} | d 7} | d | j 7} q"| j d k r� | d | j 7} q"| j d k r"| d | j 7} q"n | j d
k rT| j d k rT| d | j 7} n | j r�| j d k r�| d
| j 7} n | j d
k r�| j d k r�| d | j 7} n | j r�| j d k r�| d | j 7} n d } | j d k rd | j } n | j d k r%| d | 7} nj | j d k ra| d | 7} | j d k r�| d 7} q�n. | j d k r�| d | 7} n | d | 7} | j
d k s�| j d k rfd } t j
d � } | j
d k r�| d | j d | j
� 7} n | j
d k r | j d k r | d 7} n | j d k rK| d | j d | j � 7} n | d 7} | d | 7} n | j � S(! s Format rule for later parsingR s -i %ss -o %sR s -p alls -p s
-m multiports
--dports s
--sports s 0.0.0.0/0s ::/0s -d s --dport s -s s --sport t _t allows -j ACCEPT%st rejects -j REJECT%st tcps --reject-with tcp-resett limits -j LIMIT%ss
-j DROP%ss -m comment --comment 't t dapp_s %20t ,t sapp_t '( R R R R R R R R R R R R t ret compilet subt strip( R t rule_strt lstrR" t pat_space( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR* r sd
c C s� | j � j d � } | d d k sE | d d k sE | d d k rU | d | _ n d | _ d } t | � d k r� | d } n | j | � d S(
s Sets action of the ruleR4 i R5 R6 R8 t denyR i N( t lowert splitR t lent set_logtype( R R t tmpR ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR# � s 0
R c C s� t d � | } | d k r nC| d k r7 | j r7 n+| d k rO | j rO nt j d | � ss t j d | � r� t | � � n�| j d � | j d � d k r� t | � � n�| j d � } t | � d
k r� t | _
n d } xs| D]k} t j d | � r�t | _
| j d � } xA | D]9 } t | � d
k sNt | � d
k r$t | � � q$q$Wt | d � t | d
� k r/t | � � q/n� t j d | � r�t | � d
k s�t | � d
k r/t | � � q/nT t j d | � r#y t j
| � } Wq/t k
r t | � � q/Xn t | � � | rL| d t | � 7} q� t | � } q� W| } | d k r�t | � | _ n t | � | _ d S( s: Sets port and location (destination or source) of the rules
Bad port '%s'R R R s ^[,:]s [,:]$R; t :i i R s ^\d+:\d+$i�� i s ^\d+$s
^\w[\w\-]+N( R4 R R R> t matchR t countRG RH t TrueR t intt sockett
getservbynamet Exceptiont strR R ( R t portt loct err_msgt portsRJ t pt rant q( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR% � sP $"
$ $
c C sE | t j j d g k r% | | _ n t d � | } t | � � d S( s Sets protocol of the ruleR s Unsupported protocol '%s'N( R t utilt supported_protocolsR R4 R ( R R RV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR$ � s c C s� | j rr | j r< | j d k s0 | j d k r< d | _ n | j r� | j d k sc | j d k r� d | _ q� nf | j r� | j d k s� | j d k r� d | _ n | j r� | j d k s� | j d k r� d | _ n d S( s Adjusts src and dst based on v6R s 0.0.0.0/0s ::/0N( R R R ( R ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt
_fix_anywhere� s ' '' 'c C s | | _ | j � d S( sX Sets whether this is ipv6 rule, and adjusts src and dst
accordingly.
N( R R] ( R R ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt set_v6 s c C s` | j � } | d k rI t j j | d � rI t d � } t | � � n | | _ | j � d S( s Sets source address of ruleR s Bad source addressN( RF R R[ t
valid_addressR4 R R R] ( R t addrRJ RV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR& s " c C s` | j � } | d k rI t j j | d � rI t d � } t | � � n | | _ | j � d S( s Sets destination address of ruleR s Bad destination addressN( RF R R[ R_ R4 R R R] ( R R` RJ RV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR' s " c C s� | d k r3 | d k r3 t d � } t | � � n d t | � k r` t d � } t | � � n t j d t | � � s� t d � } t | � � n d t | � k r� t d � } t | � � n | d k r� | | _ n | | _ d
S( s Sets an interface for ruleR
t outs Bad interface typet !s+ Bad interface name: reserved character: '!'s! ^[a-zA-Z][a-zA-Z0-9:]*[a-zA-Z0-9]s Bad interface nameRK s/ Bad interface name: can't use interface aliasesN( R4 R RS R> RL R R ( R t if_typet nameRV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt
set_interface' s c C sJ t j d t | � � s7 t d � | } t | � � n t | � | _ d S( s Sets the position of the rules ^[0-9]+s, Insert position '%s' is not a valid positionN( R> RL RS R4 R RO R ( R t numRV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt set_position> s c C sb | j � d k s0 | j � d k s0 | d k rB | j � | _ n t d � | } t | � � d S( s Sets logtype of the rulet logs log-allR s Invalid log type '%s'N( RF R R4 R ( R R RV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyRI E s
$ c C sD | d k s | d k r$ | | _ n t d � | } t | � � d S( s Sets direction of the ruleR
Ra s Unsupported direction '%s'N( R R4 R ( R R RV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR( N s c C s t j j | j � S( s Get decoded comment of the rule( R R[ t
hex_decodeR" ( R ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt get_commentV s c C s
| | _ d S( s Sets comment of the ruleN( R" ( R R" ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR) Z s c C sn t } | j rx y( t j j | j | j � \ | _ } Wn) t k
rb t d � } t | � � n X| rx | | _ qx n | j
r� y( t j j | j
| j � \ | _
} Wn) t k
r� t d � } t | � � n X| r� | | _ q� n | j r*| j j d � } t j j
| � d j | � | _ n | j rj| j j d � } t j j
| � d j | � | _ n d S( s& Normalize src and dst to standard forms" Could not normalize source addresss' Could not normalize destination addressR; N( R R R R[ t normalize_addressR RR R4 R R R R RG t
human_sortt joinR ( R t changedRV RW ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt normalize^ s6
c C s� | s | r t � � n d | | f } | j | j k rJ t | � d S| j | j k rj t | � d S| j | j k r� t | � d S| j | j k r� t | � d S| j | j k r� t | � d S| j | j k r� t | � d S| j | j k r
t | � d S| j | j k r*t | � d S| j
| j
k rJt | � d S| j | j k rjt | � d S| j | j k r�t | � d S| j
| j
k r�t | � d S| j | j k r�| j | j k r�| j | j k r�t d � } t | � d S| j | j k rJ| j | j k rJ| j | j k rJt d � } t | � d St d � i | j d 6| j d 6| j d
6| j d 6| j d 6| j d
6} t | � d S( s� Check if rules match
Return codes:
0 match
1 no match
-1 match all but action, log-type and/or comment
-2 match all but comment
s No match '%s' '%s'i s Found exact matchi s$ Found exact match, excepting commenti����sZ Found non-action/non-logtype/comment match (%(xa)s/%(ya)s/'%(xc)s' %(xl)s/%(yl)s/'%(yc)s')t xat yat xlt ylt xct yci����( t
ValueErrorR R R R R R R R R R R R R! R R R" R4 ( t xt yt dbg_msg( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyRL � sn
$
$
c C s� d � } | s | r# t � � n | j | � d k r< d Sd | | j | | j f } | j d k r} t d | d � d S| j | j k r� t | d � d S| j | j k r� | j d k r� t d
| � d S| j d k r | | j | j � r t d | � d S| j d k r�| j d k r>| j | j
� r>q6| j
| j
k rqd
| j
k rqt d | � d S| j
| j
k r6d
| j
k r6| j | j k r6t j j
| j
| j
| j � r6t d | d | j
| j
f � d SnG| j d k r6| j | j k r6t d | d | j | j f � d Sy t j j | j | j � } Wn+ t k
r�t d | d | j � d SX| j
| k r�d
| j
k r�t d | d | j
| f � d S| j
| k r6d
| j
k r6| j | j k r6t j j
| | j
| j � r6t d | d | | j
f � d S| j | j k rnt d | d | j
| j
f � d St d | | j | | j f � d S( s� This will match if x is more specific than y. Eg, for protocol if x
is tcp and y is all or for address if y is a network and x is a
subset of y (where x is either an address or network). Returns:
0 match
1 no match
-1 fuzzy match
This is a fuzzy destination match, so source ports or addresses
are not considered, and (currently) only incoming.
c S s� d | k s d | k r, | | k r( t St Sx | j d � D]n } | | k rR t Sd | k r< | j d � \ } } t | � t | � k r� t | � t | � k r� t Sq< q< Wt S( s: Returns True if p is an exact match or within a multi ruleR; RK ( RN R RG RO ( t test_pt to_matchRT t lowt high( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt _match_ports� s 0 i s( No fuzzy match '%s (v6=%s)' '%s (v6=%s)'R
s (direction) s (not incoming)i s (forward does not match)R s (protocol) s (dport) R t /s (dst) s ('%s' not in network '%s')s (interface) s (%s != %s)s %s does not exists (v6) s' (fuzzy match) '%s (v6=%s)' '%s (v6=%s)'i����( Rv RL R R R R! R R R t _is_anywhereR R R[ t
in_networkt get_ip_from_ift IOError( Rw Rx R~ Ry t if_ip( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt fuzzy_dst_match� sl !%!!3"
!
0
" c C s | d k s | d k r t St S( s Check if address is anywheres ::/0s 0.0.0.0/0( RN R ( R R` ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR� 2 s c C s� d } | j d k s$ | j d k r� d | j | j | j | j f } | j d k rz d | j | j | j | j f } n | j d k r� d | j | j | j | j f } n | j d k r� | d | j 7} n | j d k r� | d | j 7} q� n | S( s$ Returns a tuple to identify an app rule. Tuple is:
dapp dst sapp src
or
dport dst sapp src
or
dapp dst sport src
All of these might have in_eth0 out_eth0 (or similar) if an
interface is also defined.
R s %s %s %s %ss in_%ss out_%s( R R R R R R R R ( R t tupl( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt
get_app_tuple8 s "c C s� | j d k rO | j d k s- | j d k rO t d � | j } t | � � n | j t j j k r� | d k r� t d � | j } t | � � n | j t j j k r� | j d k s� | j
d k r� t d � | j } t | � � q� n d S( s Verify ruleR R s3 Improper rule syntax ('%s' specified with app rule)R s' Invalid IPv6 address with protocol '%s's Invalid port with protocol '%s'N( R R R R4 R R R[ t ipv4_only_protocolst portless_protocolsR R ( R t rule_iptypeRV ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt verifyU s
( R R R
R R R R1 R3 R* R# R% R$ R] R^ R& R' Re Rg RI R( Rj R) Ro RL R� R� R� R� ( ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyR * s6 ! C
5
# C n ( ( R
R> RP t ufw.utilR R t programNamet state_dirt libexec_dirt share_dirt trans_dirt
config_dirt
prefix_dirt iptables_dirRN t do_checksRR R R ( ( ( s. /usr/lib/python2.7/site-packages/ufw/common.pyt <module> s
Mini Shell