Current File : //proc/2/root/lib/python2.7/site-packages/ufw/backend.pyo
�
V�Vc @ s� d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m
Z
m Z m Z d d l
m Z m Z d d l Z d d d � � YZ d S( s& backend.py: interface for ufw backendsi����N( t errort warnt debugt _findpath( t UFWErrort UFWRulet
UFWBackendc B s e Z d Z d d d d � Z d � Z d � Z d � Z d e d � Z d � Z
d � Z d � Z d
� Z
d � Z d � Z d
� Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( s Interface for backendsc C s� d | _ | | _ | | _ g | _ g | _ t t j j | � } i t
j j | d � d 6t
j j | d � d 6t
j j | d � d 6| _
| d k r� | j
j | � n i d d 6d d
6d d 6d
d 6d d 6| _ t j j | _ | j � | j � | j � t j j | j
d � | _ t
j j t j j d � | _ t
j j t j j d � | _ t
j j t j j d � | _ t
j j t j j d � | _ y t j j | j � | _ Wn) t k
r�t d � } t! | � � n Xd | _" d S( Ns default/ufwt defaultss ufw/ufw.conft confs ufw/applications.dt appsi t offid t lowi� t mediumi, t highi� t fullt iptabless iptables-restoret ip6tabless ip6tables-restores# Couldn't determine iptables version(# t NoneR t namet dryrunt rulest rules6R t ufwt commont
config_dirt ost patht joint filest updatet loglevelst do_checkst
_do_checkst
_get_defaultst _read_rulest applicationst get_profilest profilest iptables_dirR t iptables_restoreR t ip6tables_restoret utilt get_iptables_versiont iptables_versiont OSErrort _R t caps( t selfR R t extra_filest rootdirt datadirt pt err_msg( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt __init__ sB
c C sz | j d k r d Si | _ i | j d <t | j d d <t | j d d <| j rvt j � d k rv| j rvy t j j
| j � } Wn! t k
r� } t
d | � n Xd | k r� d | k r� t | j d d <n t | j d d <| j � rvy t j j
| j � } Wn! t k
r2} t
d | � n Xd | k r_d | k r_t | j d d <qst | j d d <qvn d S( sg Initialize the capabilities database. This needs to be called
before accessing the database.Nt limitt 4t 6i s initcaps
%ss
recent-sets
recent-update( R. R t Truet FalseR R t getuidR R R) t get_netfilter_capabilitiesR R, R t use_ipv6R ( R/ t nf_capst e( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt initcapsK s,
% c C s* d | j k r& | j d d k r& t St S( s! Is firewall configured as enabledt enabledt yes( R R9 R: ( R/ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt
is_enabledr s c C s< d | j k r8 | j d d k r8 t j j d � r8 t St S( s" Is firewall configured to use IPv6t ipv6RB s /proc/sys/net/ipv6( R R R t existsR9 R: ( R/ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyR= y s
t inputc C sg d | d } d } | j | d k r0 d } n" | j | d k rL d } n d } | rc| d k rct } t d � } t j j d
d g � \ } } | d k r� t | � � n d
| k r� t } n | j � rQt j j d
d g � \ } } | d k rd
| k rt } n t j j d
d g � \ } } | d k rQd
| k rQt } qQn | scd } qcn | S( s. Get default policy for specified primary chaint default_t _policyt t acceptt allowt rejectt denyt forwards problem running sysctlt sysctls net.ipv4.ip_forwardi t 1s net.ipv6.conf.default.forwardings net.ipv6.conf.all.forwardingt disabled( R R: R- R R) t cmdR R9 R= ( R/ t primaryt
check_forwardt policyt rstrRA R4 t rct out( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt _get_default_policy� s2 c C s� | j s# t d � } t | � t St j � t j � k rV t d � } t | � � n t j � t j � k r� t d � } t | � � n t j � } | d k r� t d � } t | � � n i } i } i } g } t j
j | j d � st d � | j d } t | � ne t
j d � } xS t j | j d � D]; } | j | � s7| j t j
j | j d | � � q7q7Wx�t | j j � � t j
j t j d � g | D]|}
|
j d � s�d
t j � |
f }
n xKt r%t d |
� |
| j d k r t j
j | j d � r Pn y t j |
� } | t j } Wn@ t k
rot d � |
} t | � � n t k
r�� n Xd
}
d } t } yE t j! | j" � d |
k s�t j! | j" � d | k r�t } n Wn t# k
r�n X| j" d k r[| r[|
| k r[t d � i t$ | � d 6|
d 6t$ | j" � d 6} t | � t | |
<n | t j% @r�|
| k r�t d � |
} t | � t | |
<n | t j& @r�|
| k r�t d � |
} t | � t | |
<n |
d k r�Pn |
} t j
j' |
� }
|
s�t t( j) d | � � q�q�Wq�Wxk | j D]` } | d k r4t j
j* | j | � r4t d � i | d 6| j | d 6} t | � � q4q4Wd S( s8 Perform basic security checks:
is setuid or setgid (for non-Linux systems)
checks that script is owned by root
checks that every component in absolute path are owned by root
warn if script is group writable
warn if part of script path is group writable
Doing this at the beginning causes a race condition with later
operations that don't do these checks. However, if the user running
this script is root, then need to be root to exploit the race
condition (and you are hosed anyway...)
s Checks disableds% ERROR: this script should not be SUIDs% ERROR: this script should not be SGIDi s& You need to be root to run this scriptR s '%s' does not exists ^\.t /s %s/%ss Checking s Couldn't stat '%s't clickpkgt snappypkgs4 uid is %(uid)s but '%(path)s' is owned by %(st_uid)st uidR t st_uids %s is world writable!s %s is group writable!s Could not find parent for '%s's& '%(f)s' file '%(name)s' does not existt fR N(+ R R- R R9 R R; t geteuidR t getgidt getegidR t isdirR t ret compilet listdirt searcht appendR t listt valuest abspatht syst argvt
startswitht getcwdR t statt ST_MODER, t ExceptionR: t pwdt getpwuidR^ t KeyErrort strt S_IWOTHt S_IWGRPt dirnamet errnot ENOENTt isfile( R/ R4 R] t warned_world_writet warned_group_writet warned_ownerR% t warn_msgt patt profileR t statinfot modet
click_usert snap_usert is_unpack_usert last_pathR_ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyR � s�
*,
& c
C s� i | _ x� | j d | j d g D]� } y t j j | � } Wn- t k
ro t d � | } t | � � n Xt j d � } xb | D]Z } | j
| � r� t j d | j � � } | d j
� j d � | j | d j
� <q� q� W| j � q$ Wd d
d g } x� d d
d g D]� } d | | j k rIt d | � } t | � � n | j d | } | | k rt d i | d 6| d 6� } t | � � qqWd S( s# Get all settings from defaults fileR R s Couldn't open '%s' for readings ^\w+="?\w+"?t =i s "'i RJ t dropRL RF t outputRN s default_%s_policys Missing policy for '%s's+ Invalid policy '%(policy)s' for '%(chain)s'RU t chainN( R R R R) t open_file_readRr R- R Rd Re Rg t splitt stript lowert close(
R/ R_ t origR4 R� t linet tmpt policiest cR3 ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyR! s. !
1 c
C sr t j d | � s- t d � } t | � � n t j | t j � sa t d | � } t | � � n t j j | � } | d } t
} t j d | d � } x\ | d D]P } | j | � r� t j j
| | d | d � t } q� t j j
| | � q� W| s!t j j
| | d | d � n y t j j | � Wn t k
rK� n X| j � j d � | j | j � <d
S( s Sets option in defaults files ^[\w_]+$s Invalid options '%s' is not writableR� t ^R� R� s
s "'N( Rd t matchR- R R t accesst W_OKR R) t
open_filesR: Re Rg t
write_to_fileR9 t close_filesRr R� R� R (
R/ t fnt optt valueR4 t fnst fdt foundR� R� ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt set_default3 s,
"
c C s� | j s� | d k r2 | j | j d d d � q� | d k r[ | j | j d d d � q� | d k r� | j | j d d d � q� | d k r� | j | j d d d
� q� t d � | } t | � � n t d � | } | S(
s+ Sets default application policy of firewallRK R t DEFAULT_APPLICATION_POLICYs "ACCEPT"RM s "DROP"RL s "REJECT"t skips "SKIP"s Unsupported policy '%s's* Default application policy changed to '%s'( R R� R R- R ( R/ RU R4 RV ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt set_default_application_policyW s*
c C sV g } t | j j � � } | j | k r�| j | k r�t j j | j | j � } t j j | j | j � } x�| D]n} | j � } d | _ | j
d d � t j j | � \ } } | j
| � | j
| d � | j | _ | j | j k rPd | _ t j j | � \ } } | j
| � | j
| d � | j | _ | j | � qx x� | D]� }
| j � } d | _ t j j |
� \ } } | j
| � | j
| d � | j d k r�| j
| j � n | j | _ | j | � qWWqx Wn8| j | k r�x&t j j | j | j � D]i } | j � } d | _ t j j | � \ } } | j
| � | j
| d � | j | _ | j | � qWn� | j | k r%x� t j j | j | j � D]i } | j � } d | _ t j j | � \ } } | j
| � | j
| d � | j | _ | j | � q�Wn t | � d k rRt d � }
t |
� � n | S( s4 Return a list of UFWRules based on the template ruleRI t anyt srct dsti s& No rules found for application profile( Ri R% t keyst dportt sportR R# t get_portst dup_rulet dappt set_portR) t parse_port_protot set_protocolt sappRh t protocolt lenR- R ( R/ t templateR t
profile_namest dportst sportst iR� t portt protot jt ruleR3 R4 ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_app_rules_from_templater sh
#
#
c
C s� g } g } d } d } t } x<| j | j D]*} | j | k sS | j | k r3| j � } | | k rq q/ qY| j � } | j d � | j d k r� | j | j d � n | j d k r� | j | j d � n | j | � }
x> |
D]6 } | j
� | j r| j | � q� | j | � q� W| } t
} q/ | j rL| j | � q/ | j | � q/ W| r�| | _ | | _ | t d � | 7} y | j t � | j t
� Wq�t k
r�t d � } t | � � q�Xn | | f S( s� Update rule for profile in place. Returns result string and bool
on whether or not the profile is used in the current ruleset.
RI R� R� R� s Rules updated for profile '%s's! Couldn't update application rules( R: R R R� R� t
get_app_tupleR� R� R� R� t normalizet v6Rh R9 R- t _write_rulesRr R (
R/ R� t
updated_rulest updated_rules6t
last_tupleRV t updated_profilet rt tuplR� t
new_app_rulest new_rR4 ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt update_app_rule� sN
c C s� | | j k r | Sd } d } xH t | j j � � D]1 } | j � | j � k r5 | } | d 7} q5 q5 Wd | | f } t | � | d k r� | S| d k r� t d � | } n t d � | } t | � � d S( s2 Find the application profile name for profile_nameRI i i s '%d' matches for '%s's> Found multiple matches for '%s'. Please use exact profile names& Could not find a profile matching '%s'N( R% Ri R� R� R R- R ( R/ t profile_nameR� t matchest nt debug_msgR4 ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt find_application_name� s$
c C s� | r' | t | j � k r' t � � n | rO | t | j � k rO t � � n | d k rg t � � n g } | r | j } n | j } i } d } x� t | � D]r \ } } | | k r� Pn d } | j d k s� | j d k r� | j � } | | k r| d 7} qt | | <q� q� Wg } | rW| j } | j | d | j � } | j
t � n1 | j } | j | d | j � } | j
t � d }
x4 | D], } t j
| | � d k r�|
S|
d 7}
q�Wd S( s Return the absolute position in the other list of the rule with the
user position of the given list. For example, find_other_position(4,
True) will return the absolute position of the rule in the ipv4 list
matching the user specified '4' rule in the ipv6 list.
i i RI ( R� R t
ValueErrorR t enumerateR� R� R� R9 R� t set_v6R: R R� ( R/ t positionR� R t app_rulest tuple_offsetR� R� R� t
match_rulet count( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt find_other_position sF
c C s� d } t d � } d | j k sC | j d t | j j � � k r\ d } | t d � 7} nB | j | j d } | d k r� | d 7} n | d | j d 7} | | f S( s" Gets current log level of firewalli s Logging: t logleveli����t unknownR
s on (%s)( R- R Ri R R� ( R/ t levelRV ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_loglevelH s "
c C s� | t | j j � � d g k rA t d � | } t | � � n | } | d k r� d | j k su | j d d k r~ d } q� | j d } n | j | j d d | � | j | � | d k r� t d � St d � Sd
S( s Sets log level of firewallt ons Invalid log level '%s'R� R
R R t LOGLEVELs Logging disableds Logging enabledN( Ri R R� R- R R R� R t update_logging( R/ R� R4 t new_level( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt set_loglevelX s "
c C s | j | j S( s Return list of all rules( R R ( R/ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_rulesn s c C s� g } | r | j } n | j } d } i } xu | D]m } d } | j d k s^ | j d k r� | j � } | | k r� t d | � q4 q� t | | <n | d 7} q4 W| S( s/ Return number of ufw rules (not iptables rules)i RI s Skipping found tuple '%s'i ( R R R� R� R� R R9 ( R/ R� R R� R� R� R� ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_rules_countr s
c C s� | j � } d } i } x� | D]� } d } | j d k sI | j d k r� | j � } | | k ru t d | � q q� t | | <n | t | � k r� | S| d 7} q Wd S( s: Return rule specified by number seen via "status numbered"i RI s Skipping found tuple '%s'N( R� R� R� R� R R9 t intR ( R/ t numR R� R� R� R� ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_rule_by_number� s
c C s\ g } d } xI | j � D]; } | d 7} | j | � } | d k r | j | � q q W| S( sm See if there is a matching rule in the existing ruleset. Note this
does not group rules by tuples.i i ( R� t fuzzy_dst_matchRh ( R/ R� t matchedR� R� t ret( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_matching� s
c C s t d � � d S( s* Set default policy for specified directions/ UFWBackend.set_default_policy: need to overrideN( R ( R/ RU t direction( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt set_default_policy� s c C s t d � � d S( s Get status of running firewalls, UFWBackend.get_running_raw: need to overrideN( R ( R/ t
rules_type( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_running_raw� s c C s t d � � d S( s Get managed ruless' UFWBackend.get_status: need to overrideN( R ( R/ t verboset
show_count( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt
get_status� s c C s t d � � d S( s Update firewall with rules% UFWBackend.set_rule: need to overrideN( R ( R/ R� t allow_reload( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt set_rule� s c C s t d � � d S( s Start the firewalls+ UFWBackend.start_firewall: need to overrideN( R ( R/ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt start_firewall� s c C s t d � � d S( s Stop the firewalls* UFWBackend.stop_firewall: need to overrideN( R ( R/ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt
stop_firewall� s c C s t d d � � d S( s% Get a list if rules based on templates. UFWBackend.get_app_rules_from_system: need to t overrideN( R ( R/ R� R� ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt get_app_rules_from_system� s c C s t d � � d S( s# Update loglevel of running firewalls+ UFWBackend.update_logging: need to overrideN( R ( R/ R� ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyR� � s c C s t d � � d S( s Reset the firewalls" UFWBackend.reset: need to overrideN( R ( R/ ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt reset� s N(! t __name__t
__module__t __doc__R R5 R@ RC R= R: RY R R! R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� ( ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyR s< + ' & o $ D > < ( ( R� Rz R Rs Rd Rp Rl t ufw.utilR R R R R t
ufw.commonR R t ufw.applicationsR ( ( ( s/ /usr/lib/python2.7/site-packages/ufw/backend.pyt <module> s "
Mini Shell