Current File : //proc/2/cwd/lib/python2.7/site-packages/ufw/frontend.pyc
�
V�Vc @ s� d Z d d l Z d d l Z d d l Z d d l m Z d d l Z d d l m Z m Z m
Z
d d l m Z d d l
Z d � Z d � Z d d
d � � YZ d S( s' frontend.py: frontend interface for ufwi����N( t UFWError( t errort warnt msg( t UFWBackendIptablesc C s� t j j � } x? d d d d d d d d g D] } | j t j j | � � q. Wx3 d d
d d g D] } | j t j j | � � qd Wx9 d
d d d d d g D] } | j t j j | � � q� Wx0 d d d g D] } | j t j j | � � q� Wx0 d- d d g D] } | j t j j | � � qWx? d d d d d d d d g D] } | j t j j
| � � qHWd d d d d! d" g } x@ | D]8 } | j t j j | � � | j t j j | � � q�Wt
| � d# k rUd$ } | | j � d% k r�d# } n | | j � d k rU| | j � d& k rU| | j � | k rU| j | d' � qUn t
| � d# k s�d% | k r�t
| � d( k r�t d) � n y | j | d$ � } WnG t k
r�} t d* | j � n$ t k
r�t d+ d, t �� n X| S(. sE Parse command. Returns tuple for action, rule, ip_version and dryrun.t enablet disablet helps --helpt versions --versiont reloadt resett listt infot defaultt updatet ont offt lowt mediumt hight fullt allowt denyt rejectt verboset numberedt raws before-ruless
user-ruless after-ruless
logging-rulest builtinst listeningt addedt limitt insertt deletei i s --dry-runt routet rulei s not enough argss %ss Invalid syntaxt do_exitN( t ufwt parsert UFWParsert register_commandt UFWCommandBasict
UFWCommandAppt UFWCommandLoggingt UFWCommandDefaultt Nonet UFWCommandStatust UFWCommandShowt UFWCommandRulet UFWCommandRouteRulet lent lowerR R t
parse_commandR t valuet Exceptiont False( t argvt pt it
rule_commandst idxt prt e( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR3 sJ
0
c C s t d i" t j j d 6d d 6d d 6d d 6d d 6d d
6d d 6d
d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d! 6d" d# 6d$ d% 6d& d& 6d' d' 6d( d( 6d) d* 6d+ d, 6d- d. 6d/ d0 6d1 d1 6d2 d3 6d4 d5 6d6 d7 6d8 d9 6d: d; 6d< d= 6� } | S(> s Print help messages
Usage: %(progname)s %(command)s
%(commands)s:
%(enable)-31s enables the firewall
%(disable)-31s disables the firewall
%(default)-31s set default policy
%(logging)-31s set logging to %(level)s
%(allow)-31s add allow %(rule)s
%(deny)-31s add deny %(rule)s
%(reject)-31s add reject %(rule)s
%(limit)-31s add limit %(rule)s
%(delete)-31s delete %(urule)s
%(insert)-31s insert %(urule)s at %(number)s
%(route)-31s add route %(urule)s
%(route-delete)-31s delete route %(urule)s
%(route-insert)-31s insert route %(urule)s at %(number)s
%(reload)-31s reload firewall
%(reset)-31s reset firewall
%(status)-31s show firewall status
%(statusnum)-31s show firewall status as numbered list of %(rules)s
%(statusverbose)-31s show verbose firewall status
%(show)-31s show firewall report
%(version)-31s display version information
%(appcommands)s:
%(applist)-31s list application profiles
%(appinfo)-31s show information on %(profile)s
%(appupdate)-31s update %(profile)s
%(appdefault)-31s set default application policy
t prognamet COMMANDt commandt Commandst commandsR R s default ARGR
s
logging LEVELt loggingt LEVELt levels
allow ARGSR R" s deny ARGSR s reject ARGSR s
limit ARGSR s delete RULE|NUMR t RULEt urules insert NUM RULER s
route RULER! s route delete RULE|NUMs route-deletes route insert NUM RULEs route-insertt NUMt numberR R
t statuss status numberedt statusnumt RULESt ruless status verboset
statusverboses show ARGt showR s Application profile commandst appcommandss app listt applists app info PROFILEt appinfot PROFILEt profiles app update PROFILEt appupdates app default ARGt
appdefault( t _R$ t commont programName( t help_msg( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt get_command_helpX sH t UFWFrontendc B s� e Z d Z d d d d � Z d � Z d � Z d � Z e e d � Z d d � Z
d � Z d
� Z d � Z
e d � Z e d
� Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z e d � Z RS( t UIt iptablesc C s� | d k rE y t | d | d | �| _ WqU t k
rA � qU Xn t d | � � t d � | _ t d � | _ t d � | _ d S( NR^ t rootdirt datadirs Unsupported backend type '%s't nt yt yes( R t backendR5 R RW t noRc t yes_full( t selft dryrunt backend_typeR_ R` ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt __init__� s
c C s� d } d } | r d } n t } | r7 | j j � sM | rV | j j � rV t } n | r� y$ | j j | j j d d | � Wq� t k
r� } t | j � q� Xn d } | rZy | j j � Wn% t k
r� } | r� | j } q� n X| d k rKy$ | j j | j j d d d � Wn t k
r=} t | j � n Xt | � n t
d � } n@ y | j j � Wn t k
r�} t | j � n Xt
d � } | S( sl Toggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or
stops running firewall.
t Re Rc t conft ENABLEDs0 Firewall is active and enabled on system startups/ Firewall stopped and disabled on system startup( R6 Rd t
is_enabledt Truet set_defaultt filesR R R4 t start_firewallRW t
stop_firewall( Rg t enabledt rest
config_strt changedR= t error_str( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt set_enabled� sF
c C sr d } yE | j j | | � } | j j � rJ | j j � | j j � n Wn t k
rm } t | j � n X| S( s Sets default policy of firewallRk ( Rd t set_default_policyRn Rs Rr R R R4 ( Rg t policyt directionRu R= ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyRz � s
c C sC d } y | j j | � } Wn t k
r> } t | j � n X| S( s Sets log level of firewallRk ( Rd t set_loglevelR R R4 ( Rg RE Ru R= ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR} � s c C s@ y | j j | | � } Wn t k
r; } t | j � n X| S( s Shows status of firewall( Rd t
get_statusR R R4 ( Rg R t
show_countt outR= ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR~ � s
R c C s= y | j j | � } Wn t k
r8 } t | j � n X| S( s Shows raw output of firewall( Rd t get_running_rawR R R4 ( Rg t
rules_typeR� R= ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt get_show_raw s
c C s� d } y t j j | j j � � } Wn) t k
rP t d � } t | � � n X| j j � } t | j
� � } | j � xL| D]D} | j j � r� | d k r� q� n | d | 7} t | | j
� � } | j � x�| D]�} x�| | | D]�} | d }
|
j d � r� |
j d � r� d } | d | 7} |
d
k sQ|
d k rl| d 7} d
| d }
n | d |
7} t j j
|
� } | d t j j | d � 7} t j j d d d | d d | d |
d d d t � } | j | j d � � | d k r| j d | � n | j � | j j | � }
t |
� d k r�| d 7} xa |
D]V } | d k rU| d t | � k rU| d | t j j j | | d � f 7} qUqUWn | d 7} q� q� Wq� Wq� W| j j � s�t j j d � n | S(! sM Shows listening services and incoming rules that might affect
themRk s Could not get listening statust tcp6t udp6s %s:
t laddrs 127.s ::1s %s s 0.0.0.0s ::s * s %s/0s %s s (%s)t exet actionR t protocoli t dportt dstR| t int forwardt 6i s
i s [%2d] %s
s) Skipping tcp6 and udp6 (IPv6 is disabled)( R� R� ( R$ t utilt parse_netstat_outputRd t use_ipv6R5 RW R t get_rulesR t keyst sortt
startswitht get_if_from_ipt ost patht basenameRX t UFWRuleR6 t set_v6t endswitht
set_interfacet normalizet get_matchingR1 R% R/ t get_commandt debug( Rg Ru t dt err_msgRM t protocolst protot portst portt itemt addrt ifnameR" t matchingR9 ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt get_show_listening sd
" c C s� | j j � } t d � } t | � d k r; | t d � Sg } x~ | j j � D]m } | j r| d t j j j | � } n t j j j | � } | | k r� qQ n | j
| � | d | 7} qQ W| S( s! Shows added rules to the firewalls9 Added user rules (see 'ufw status' for running firewall):i s
(None)s route %ss
ufw %s( Rd R� RW R1 R� R$ R% R0 R� R/ t append( Rg RM R� R t rt rstr( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt get_show_addedW s
c C s� d } d } d } g } | j d k rF | j d k rF | j | � n(g } y | j r(| d k r| | j j | t � } n� | d k r� | j j | t � } n� | d k r5| j j | t � } | j j | t � } xx | D]Q } xH | D]@ }
|
j } t |
_ | j |
� s� | |
_ | j |
� q� q� Wq� Wn t
d � | } t | � � t | � d k r�| j j
r�t
d � } | d k r�| } n: | d k r�| d } n! | d k r�| d | d } n | Sx� | D]K } | j � } | j | _ | j | j � | j | j � | j | � q�Wn. | j j | � } | j d k rV| j � n Wn t k
rm� n Xd }
t } t
d
� } | j j t � } | j j t � } x�t | � D]�\ } } | }
| j | | k r| t | j � d 7} t | � � n yX| j j � r�| d k rw| j | k rU| t | j � d 7} t | � � n | j t � | j j | � } qY| d k r| j | k r�| j | j | � nD | j d k r�| j | k r�| t | j � d 7} t | � � n | j t � | j j | � } qY| d k r�| j } | j t � | j r�| | k r�| j j | | |
t � } | d k r�| j | � q�| j d � n | j j | � } | j r�| d k r�| j j t � } | j | d � n | j t � | j r[| j d k r[| j | k r[| j j | j t � } | d k rK| j | |
� q[| j d � n | d k rt| d 7} n | j r�| j | k r�| j | j | � n | | j j | � 7} qYt
d � | } t | � � n} | d k s�| d k r| j t � | j j | � } nC | d k r=t
d
� } t | � � n t
d � | } t | � � Wn# t k
r} | j } t } Pn X| j r�t
d � } t! j" | � q�q�W| s�| | 7} nt | � d k r�t# | � n� t } t$ t% |
d � � } | j � x� | D]� } |
d k r| | r| | j � } t | _ y | j | | � Wq�t k
r�t } t
d � | j& � } t" | � q�XqqW| t
d � 7} | r�| t
d � 7} n | t
d � 7} t | � � | S( s Updates firewall with ruleRk t v4t v6t boths Invalid IP version '%s'i s" Could not delete non-existent rules (v6)s
s Invalid position 't 'i s IPv6 support not enableds Rule changed after normalizations Could not back out rule '%s's"
Error applying application rules.s# Some rules could not be unapplied.s( Attempted rules successfully unapplied.(' t dappt sappR� t removeRd t get_app_rules_from_systemR6 Ro R� t matchRW R R1 Rh t dup_rulet
set_actionR� t set_logtypet logtypet get_app_rules_from_templatet positiont reverseR5 t get_rules_countt enumeratet strR� R� t set_rulet set_positiont find_other_positionR4 t updatedt warningsR R R t ranget format_rule( Rg R" t
ip_versionRu R� t tmpRM t tmprulest tmprules6t xRb t prev6R� t countt set_errort pos_err_msgt num_v4t num_v6R9 t user_posR8 R= t warn_msgt
undo_errort indexest jt backout_rule( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR� t s
c
C s� y t | � } Wn- t k
r? t d � | } t | � � n X| j j � } | d k sm | t | � k r� t d � | } t | � � n | j j | � } | s� t d � | } t | � � n t | _ d } | j
r� d } n t } | s�| j rd t j
j j | � } n t j
j j | � } t d � i | d 6| j d 6| j d
6}
t |
d t j d t �t j j � j � j � } | d
k r�| | j j � k r�| | j j � k r�t } q�n d } | r�| j | | � } n t d � } | S( s Delete rules Could not find rule '%s'i s Could not find rule '%d'R� R� s route %ss= Deleting:
%(rule)s
Proceed with operation (%(yes)s|%(no)s)? R" Rc Re t outputt newlineRb Rk t Aborted( t intR5 RW R Rd R� R1 t get_rule_by_numberRo R� R� R� R$ R% R0 R� R/ Rc Re R t syst stdoutR6 t stdint readlineR2 t stripRf R� (
Rg RI t forceRa R� RM R" R� t proceedR� t promptt ansRu ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt delete_rule0 sJ
! c C sU d } | j d � r^ | j d � } t | � d k rL | j | d � } qQ| j d � } n�| d k r| | j d � } n�| j d � r� t d � } | j d
� } t | � d k r� t | � � n | j | d | d � } nm| d
k r| j | � } nO| d k r | j � } n4| d k r;| j t � } n| j d � r�| j d
� d } | d k rx| j
� } qQ| d k r�| j � } qQ| j | � } n�| d k r�| j t
t � } n�| d k r�| j t � } nm| d k r| j t
� } nO| d k rU| j j � rF| j t
� | j t � t d � } qQt d � } n�| j d � r�| j | j d
� d | � } n�| d k s�| d k s�| d k s�| d k r5| j d k rkyD | j j | j � } | | j k r| | _ | j | d � n Wqkt k
rg} | j s4t | j � n t j j | j � sht d � } t | � � qhqkXn | j d k r yD | j j | j � } | | j k r�| | _ | j | d � n Wq t k
r } | j s�t | j � n t j j | j � s t d � } t | � � q q Xn | j | | � } n t d � | } t | � � | S(! s� Perform action on rule. action, rule and ip_version are usually
based on return values from parse_command().
Rk s
logging-onRW i R s logging-offR s default-s Unsupported default policyt -i i R
RJ s status-verboseRO R R s status-numberedR R R s Firewall reloadeds& Firewall not enabled (skipping reload)s delete-R R R R R� s Invalid profile names Unsupported action '%s'( R� t splitR1 R} RW R Rz R
R~ Ro R� R� R� R6 Ry Rd Rn R� R� t find_application_namet set_portR� R R4 R$ t applicationst valid_profile_nameR� R� ( Rg R� R" R� R� Ru R� R� R= ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt do_actiona s�
"$ c C sC d } y | j j | � } Wn t k
r> } t | j � n X| S( s+ Sets default application policy of firewallRk ( Rd t set_default_application_policyR R R4 ( Rg R{ Ru R= ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR� � s c C sQ t | j j j � � } | j � t d � } x | D] } | d | 7} q5 W| S( s* Display list of known application profiless Available applications:s
%s( R Rd t profilesR� R� RW ( Rg t namesR� Ra ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt get_application_list� s
c C s# g } | d k r7 t | j j j � � } | j � n: t j j | � sd t d � } t | � � n | j
| � d } x�| D]�} | | j j k s� | j j | r� t d � | } t | � � n t j j | | j j | � s t d � } t | � � n | t d � | 7} | t d � t j j | j j | � 7} | t d � t j j
| j j | � 7} t j j | j j | � } t | � d k s�d
| d k r�| t d � 7} n | t d
� 7} x | D] } | d | 7} q�W| | t | � d k r~ | d 7} q~ q~ Wt j j | � S( s Display information on profilet alls Invalid profile nameRk s Could not find profile '%s's Invalid profiles Profile: %s
s
Title: %s
s Description: %s
i t ,i s Ports:s Port:s
%ss
--
( R Rd R� R� R� R$ R� R� RW R R� t verify_profilet get_titlet get_descriptiont get_portsR1 R� t wrap_text( Rg t pnameR� R� R� t nameR� R8 ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt get_application_info� sB
"
c C s~ d } t } t } y( | j j r9 t j j � r9 t } n Wn t k
rS t } n X| d k r� t | j j j
� � } | j � x� | D]P } | j j | � \ } } | r� | d k r� | d 7} n | | 7} | } q� q� Wn1 | j j | � \ } } | d k r| d 7} n | rz| j j
� rz| rgy | j j � Wn t k
rS� n X| t d � 7} qz| t d � 7} n | S( s Refresh application profileRk R� s
s Firewall reloadeds Skipped reloading firewall( Ro R6 Rd t do_checksR$ R� t under_sshR5 R R� R� R� t update_app_ruleRn t _reload_user_rulesRW ( Rg RT R� t allow_reloadt trigger_reloadR� R8 R� t found( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt application_update� s<
c C sx d } d } | d k r3 t d � } t | � � n | j j d } | d k rm t j j d | | f � | S| d k r� d } nF | d k r� d
} n1 | d k r� d } n t d � | } t | � � d
g } | j j r� | j d � n | | | g 7} y t | � } Wn t
k
r#� n Xd | j k r\| j | j
| j d | j d � } n | j | j
d d � } | S( s Refresh application profileRk R� s% Cannot specify 'all' with '--add-new't default_application_policyt skips' Policy is '%s', not adding profile '%s't acceptR t dropR R s Unknown policy '%s'R$ s --dry-runR" t iptype( RW R Rd t defaultsR$ R� R� Rh R� R3 R5 t dataR� R� ( Rg RT R� R{ R� R
t argsR< ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt application_add# s>
c C sT d } | d k r$ | j d � } n,| d k rB | j d � } n| d k r` | j d � } n� | d k r~ | j d � } n� | d
k r� | j � } n� | d k r� | j | � } n� | d k s� | d
k r4| j | � } d } | d
k r| j | � } n | d k r'| d k r'| d 7} n | | } n t d � | } t | � � | S( sz Perform action on profile. action and profile are usually based on
return values from parse_command().
Rk s
default-allowR s default-denyR s default-rejectR s default-skipR R R R s update-with-news
s Unsupported action '%s'( R� R� R� R R RW R ( Rg R� RT Ru t str1t str2R� ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt do_application_actionM s0
c C s� t } | j j r� t j j � r� t d � i | j d 6| j d 6} t | d t
j d t �t
j
j � j � j � } | d k r� | | j k r� | | j k r� t } q� n | S( s6 If running under ssh, prompt the user for confirmationsW Command may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? Rc Re R� R� Rb ( Ro Rd R R$ R� R RW Rc Re R R� R� R6 R� R� R2 R� Rf ( Rg R� R� R� ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt continue_under_sshm s * c C s4 d } t d � i | j d 6| j d 6} | j j rl t j j � rl t d � i | j d 6| j d 6} n | j j r� | r� t t j j | � d t
j d t �t
j
j � j � j � } | d k r� | | j k r� | | j k r� t d � } | Sn | j j � r!| | j t � 7} n | j j � } | S(
s Reset the firewallRk sT Resetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? Rc Re s Resetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? R� R� Rb R� ( RW Rc Re Rd R R$ R� R R R� R� R� R6 R� R� R2 R� Rf Rn Ry R
( Rg R� Ru R� R� ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR
{ s %* N( t __name__t
__module__t __doc__R, Rj Ry Rz R} R6 R~ R� R� R� R� R� R� R� R� R� R R R R R
( ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyR\ � s* 6
H � 1 V
. + * ( ( R R� R� R� t
ufw.commonR t ufw.utilR$ R R R t ufw.backend_iptablesR t
ufw.parserR3 R[ R\ ( ( ( s0 /usr/lib/python2.7/site-packages/ufw/frontend.pyt <module> s < F
Mini Shell