Current File : //proc/2/root/lib/python2.7/site-packages/ufw/backend_iptables.pyo
�
��Xc @ s� d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z d d l
m Z m Z m
Z
m Z m Z m Z d d l Z d e j j f d � � YZ d S( s- backend_iptables.py: iptables backend for ufwi����N( t UFWErrort UFWRule( t warnt debugt msgt cmdt cmd_pipet _findpatht UFWBackendIptablesc B s� e Z d Z d d d � Z d � Z d � Z d � Z e e d � Z d � Z
d � Z d � Z d � Z
d
� Z d � Z d � Z e d
� Z e d � Z d � Z e d � Z d � Z d � Z d � Z RS( s Instance class for UFWBackendc C sq d t j j d | _ | | _ | | _ i } t t j j | � } t t j j | � } t j
j | d � | d <t j
j | d � | d <t j
j | d � | d <t j
j | d � | d
<t j
j | d � | d <t j
j | d
� | d <t j
j t t j j | � d � | d <t j
j j | d | | d | d | �i g d 6g d 6g d 6g d 6| _ x� d d g D]� } d } | d k r�| j � r�| | 7} q�| d k r�qqq�n xX d d d g D]G } x> d d d g D]- }
d | | |
f } | j | j | � q�Wq�W| j d j | d � | j d j | d � qqWd! d" d# d$ d% d& d' g | _ d( | _ d) S(* s! UFWBackendIptables initializations # s
_comment #s
user.rulest ruless ufw/before.rulest before_ruless ufw/after.rulest after_ruless user6.rulest rules6s ufw/before6.rulest
before6_ruless ufw/after6.rulest after6_ruless ufw-initt initt iptablest rootdirt datadirt beforet usert aftert misct 4t 6t ufwt inputt outputt forwards %s-%s-logging-%ss
-logging-denys -logging-allows -mt limits --limits 3/minutes -jt LOGs --log-prefixs [UFW LIMIT BLOCK]N( R t commont programNamet comment_strR R R t
config_dirt state_dirt ost patht joint libexec_dirt backendt
UFWBackendt __init__t chainst use_ipv6t appendt ufw_user_limit_logt ufw_user_limit_log_text( t selft dryrunR R t filesR" R# t vert chain_prefixt loct targett chain( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyR* sB (
%
c C sz t d � } | j d d k r, | d 7} nJ | j d d k rL | d 7} n* | j d d k rl | d 7} n
| d 7} | S(
s Get current policys
New profiles:t default_application_policyt accepts allowt drops denyt rejects rejects skip( t _t defaults( R0 t rstr( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt get_default_application_policyL s
c
C s� | j s�| d k rL | d k rL | d k rL t d � | } t | � � n | d k r� | d k r� | d k r� t d � | } t | � � n d } | d k r� d
} n | d k r� d } n d } d } | d k r y" | j | j d
d | d � Wn t k
r� n Xd } d } n� | d k rsy" | j | j d
d | d � Wn t k
rc� n Xd } d } nE y" | j | j d
d | d � Wn t k
r�� n Xd } d } t j d | � } x� | j d | j d g D]� } y t j j
| � } Wn t k
r� n X| d }
xV | d D]J } | j | � ret j j |
| j
| | � � q.t j j |
| � q.Wy t j j | � Wq�t k
r�� q�Xq�Wn t d � i | d 6| d 6} | t d � 7} | S( s Sets default policy of firewallt allowt denyR; s Unsupported policy '%s't incomingt outgoingt routeds% Unsupported policy for direction '%s't INPUTt OUTPUTt FORWARDt R= s DEFAULT_%s_POLICYs "ACCEPT"s UFW BLOCKs UFW ALLOWs "REJECT"s "DROP"R R t tmpt origs5 Default %(direction)s policy changed to '%(policy)s'
t directiont policys* (be sure to update your rules accordingly)( R1 R< R t set_defaultR2 t Exceptiont ret compileR t utilt
open_filest searcht
write_to_filet subt close_files(
R0 RL RK t err_msgR7 t old_log_strt new_log_strt patt ft fnst fdt lineR> ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt set_default_policyZ sz $
!
"
c C sT | j r1 d t d � } | d t d � 7} | S| j � d d d d g } g } g } | d k r� | j d � d
d d d g } d
d d g } n�| d
k r�x9 d d d g D]( } | j d | � | j d | � q� Wx? d d d d d g D]( } | j d | � | j d | � q� Wx6 d d g D]( } | j d | � | j d | � q-Wx+d d d g D] } | j d | � qiWn | d k r�x�d d d g D]( } | j d | � | j d | � q�Wn�| d k ryx9 d d d g D]( } | j d | � | j d | � q�W| j d d! rH| j d" � | j d# � n | j d d$ r�| j d% � | j d& � q�n| d' k r�x� d d d g D]( } | j d( | � | j d) | � q�Wn� | d* k r�x} d d d g D]l } | j d+ | � | j d, | � | j d- | � | j d. | � | j d/ | � | j d0 | � q�W| j d1 � | j d2 � | j d3 � | j d4 � n d5 | } x� | D]� } d6 | k r�| j d6 � \ } } | d7 | 7} t | j g | | d | g � \ }
} n# t | j g | | g � \ }
} | | 7} | d k r?| d8 7} n |
d9 k r�t | � � q�q�W| d k sv| j � rP| d: 7} x� | D]� } d6 | k r�| j d6 � \ } } | d7 | 7} t | j g | | d | g � \ }
} n# t | j
g | | g � \ }
} | | 7} | d k r.| d8 7} n |
d9 k r�t | � � q�q�Wn | S(; s' Show current running status of firewalls > s Checking raw iptables
s Checking raw ip6tables
s -ns -vs -xs -Lt raws -tt filtert natt manglet builtinsRE RG RF s filter:%st
PREROUTINGt POSTROUTINGs mangle:%ss raw:%ss nat:%sR R R R s
ufw-before-%ss ufw6-before-%sR s ufw-user-%ss ufw6-user-%sR R s ufw-user-limit-accepts ufw-user-limitR s ufw6-user-limit-accepts ufw6-user-limitR s ufw-after-%ss
ufw6-after-%st loggings ufw-before-logging-%ss ufw6-before-logging-%ss ufw-user-logging-%ss ufw6-user-logging-%ss ufw-after-logging-%ss ufw6-after-logging-%ss ufw-logging-allows ufw-logging-denys ufw6-logging-allows ufw6-logging-denys IPV4 (%s):
t :s (%s) s
i s
IPV6:
( R1 R< t initcapsR- t capst splitR R R R, t ip6tables( R0 t
rules_typet outt argst itemst items6t ct bt it tt rcRI ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt get_running_raw� s�
,#
,#
c $ C s+
d } | j rF d t d � } | j � rB | d t d � 7} n | St d � } x� d d d g D]� } t | j d d
| d g � \ } } | d k r� t d
� S| d k r� t | d | � � n | j � rb t | j d d | d g � \ } } | d k rt | d � � qqb qb Wd } d } d }
| j | j } d } i }
x�| D]�} d } i } d } t } | r�| j
d k s�| j d k r�t } | j
� } | |
k r�t d | � qRq�t |
| <n xmd d g D]_} d | | <d } d } | d k rb| j } | rV| j
d k rV| j
} | j r_| d k r_| d 7} q_q�| j } nV | j } | r�| j d k r�| j } | j r�| d k r�| d 7} q�n | j } | d k r�| d k r�| | | <n | d k r/| | d k r| | | <n | | c d | 7<| rI| j d k rI| | c d | j 7<n | r/| d k r�| j
d k r�| | c d | j
7<| j r�| d k r�| | c d 7<n | | c d 7<n | d k r,| j d k r,| | c d | j 7<| j r| d k r| | c d 7<n | | c d 7<q,q/n | d k r| d k sS| d k r�d | | <| r�| j d k r�| j | j k r�| j | j k r�| | c d | j 7<n | d k r| | c d 7<qq`| r`| j d k r`| j | j k r`| | c d | j 7<q`nJ | j r`| j d k r`| j d k r`d | | k r`| | c d 7<n | j r�| d k r�| j d k r�| | c d | j 7<n | d k r@| j d k r@| | c d | j 7<q@q�| d k r | j d k r | | c d | j 7<n | d k r�| j d k r�| | c d | j 7<q�q�Wg } d } | j sn| j j � d k r�| j r�| j | j j � � n | r�| j d k r�| j | j � n t | � d k r�d d! j | � } q�n | r�| d" | 7} n | j j � } | j rd# } n | j d$ k rK| j rK| rK| rKd } n d } | j d k rsd% | j � } n | d& | d d j | j! j � | g � | d | | f 7} | r�| | 7} n< | j r�|
| 7}
n& | j d k r�| | 7} n
| | 7} | d 7} qRW| d k s1| d k s1|
d k r� d' } | rJ| d( 7} n t d) � } t d* � } t d+ � } d, } | | | | f } | r�| d( 7} n | | d- t | � d- t | � d- t | � f 7} | | 7} | d k r�| | 7} n | d k r | d k r | t d. � 7} n | d k r6 | | 7} n | d k ra |
d k ra | t d. � 7} n |
d k rz | |
7} n | } n | r
| j" � \ } }! t d/ d0 d1 � i | j# � d$ 6| j# d � d 6| j# d t � d2 6}" | j$ � }# t d3 � i |! d4 6|" d5 6|# d6 6| d7 6St d8 � | Sd9 S(: s Show ufw managed rulesRH s > s Checking iptables
s Checking ip6tables
s problem runningR R R s -Ls ufw-user-%ss -ni s Status: inactivei s iptables: %s
s ufw6-user-%ss
ip6tabless Skipping found tuple '%s't dstt srcs ::/0s (v6)s 0.0.0.0/0t anyt t /s (%st )t Anywheres on %sRn s (%s)s , s [%2d] t FWDt ins # %ss %-26s %-12s%-26s%s%s
s
s t Tot Fromt Actions %-26s %-12s%s
t -s
s Default: %(in)s (incoming), s %(out)s (outgoing), s %(routed)s (routed)RD s0 Status: active
%(log)s
%(pol)s
%(app)s%(status)st logt polt appt statuss Status: active%sN(% R1 R< R, R R R Rl R R t Truet dappt sappt Falset
get_app_tupleR Rx t v6t dportRy t sportt protocolR t interface_int
interface_outt logtypeRK t lowerR- t lenR& t uppert commentt get_commentt actiont get_loglevelt _get_default_policyR? ($ R0 t verboset
show_countRn RW RK Rv t out6t st str_outt str_rteR t countt app_rulest rt tmp_strt locationt tuplt
show_protoR5 t portRI t attribst
attrib_strt dir_strR! t full_strt str_tot str_fromt
str_actiont rules_header_fmtt rules_headert levelt logging_strt
policy_strt app_policy_str( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt
get_status sT
%
$ '
$
c C s� | j r t d t d � � n� g } | j | j d � | j d k r� | j d k r� | j d � | j | j � | j d � | j | j � n | j d � t | � \ } } | d k r� t d | � } t | � � n d S(
s Stop the firewalls > s running ufw-initR s --rootdirs --datadirs
force-stopi s problem running ufw-init
%sN(
R1 R R< R- R2 R t NoneR R R ( R0 Ro Rv Rn RW ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt
stop_firewall� s
c C s� | j r t d t d � � ntg } | j | j d � | j d
k r� | j d
k r� | j d � | j | j � | j d � | j | j � n | j d � t | � \ } } | d k r� t d | � } t | � � n d | j
k s| j
d t | j j
� � k rPy | j d
� Wq�t k
rLt d � } t | � � q�XnD y | j | j
d � Wn) t k
r�t d � } t | � � n Xd
S( s Start the firewalls > s running ufw-initR s --rootdirs --datadirt starti s problem running ufw-init
%st loglevelt lows Could not set LOGLEVELs Could not load logging rulesN( R1 R R< R- R2 R R� R R R R= t listt loglevelst keyst set_loglevelRN t update_logging( R0 Ro Rv Rn RW ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt start_firewall� s4
"
c
C s� | j r
t S| j � d } | j } | r> d } | j } n x� d d d d d g D]� } | d k sr | d k r� | r� | j d d r� qT q� | r� | j d d r� qT q� n t | d
d | d | g � \ } } | d
k rT t d � t SqT Wt S( s Check if all chains existR t ufw6R R R R s limit-acceptR R s -ns -Ls -user-i s _need_reload: forcing reload( R1 R� Ri R Rl Rj R R R� ( R0 R� t prefixt exeR7 Rv Rn ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt _need_reload s&
&
c C sY t d � } | j r; t d � | j � rUt d � qUn| j � rUyH xA | j d D]2 } | j | d | g � | j | d | g � qX WWn t k
r� t | � � n Xt d | j
d g | j d g � \ } } | d
k r� t | d � � n | j � rUt d | j
d g | j d g � \ } } | d
k rRt | d
� � qRqUn d S( s Reload firewall rules files problem runnings > | iptables-restores > | ip6tables-restoreR s -Fs -Zt catR s -ni s iptablesR s
ip6tablesN(
R< R1 R R, t
is_enabledR+ t
_chain_cmdRN R R R2 t iptables_restoret ip6tables_restore( R0 RW Rr Rv Rn ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt _reload_user_rules6 s*
c C s, g } t j d � } t j d � } t j d � } | j | � r� | j | � r� | j | � r� | j | j d | j d | � � � n | j | j d | � � | j | j d | � � q� | j | j d | � � n
| j | � t j d � } t j d � } t j d
� }
d } xVt | � D]H\ } }
| j |
� r&| j d |
� j � } | j � d
k rtd } n! | j � d k r�d } n d } d | | f } | j |
� s�d | } n | j d |
� | | <| j | | j d | d | |
� � | j | |
j d | d | | j d |
� � � | j | |
j d | d | | j d | |
� � � q&q&Wt j d � } x� t | � D]� \ } }
| j |
� r�| j d |
� } | j d d d | d |
� } | j d | d |
� } | | | <| j | | � | j | | � q�q�W| S(! s5 Return list of iptables rules appropriate for sendings -p all s port s -j (REJECT(_log(-all)?)?)s -p tcp s -j \1 --reject-with tcp-resets -p udp RH s (.*)-j ([A-Z]+)_log(-all)?(.*)s -j [A-Z]+_log-alls (-A|-D) ([a-zA-Z0-9\-]+)s' -m limit --limit 3/min --limit-burst 10s \2R9 t ALLOWR t LIMITt BLOCKs" %s -j LOG --log-prefix "[UFW %s] "s -m conntrack --ctstate NEW s \1-j \2\4s \1-j s -user-logging-s \1 s \1-j RETURNs \1s -j LIMITs+ -m conntrack --ctstate NEW -m recent --sets% -m conntrack --ctstate NEW -m recents# --update --seconds 30 --hitcount 6s -j s -user-limits -user-limit-accept( RO RP RS R- RU t enumeratet stripR� t insert( R0 t fruleR� t suffixt snippetst pat_protot pat_portt
pat_rejectt pat_logt
pat_logallt pat_chaint
limit_argsRt R� RL t lstrt pat_limitt tmp1t tmp2t tmp3( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt _get_rules_from_formattedR sh
!
c C s� g } | j | | | � } t j d � } x� t | � D]� \ } } | j | j d | � j � � | j | � r7 | | j d � | | j | j d | � j d d � � | | c | j d | � j � 7<q7 q7 W| S( s_ Return list of iptables rules appropriate for sending as arguments
to cmd()
s (.*) --log-prefix (".* ")(.*)s \1s --log-prefixs \2t "RH s \3( R� RO RP R� R- RU Rk t matcht replace( R0 R� R� R� R� t str_snippetsRZ Rt R� ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt _get_lists_from_formatted� s ))c C s� | j d g } | j � r3 | j | j d � n x�| D]�} y t j j | � } Wn- t k
r� t d � | } t | � � n Xt j
d � } t j
d � } t j
d � } x | D]} | } d }
d | k r� | j d � \ } } | j � }
n | j
| � r� | j d | � } t j d | j � � }
t |
� d
k sYt |
� d k ryt d � | } t | � q� q�d
} d } d } t |
� d k s�t |
� d k r�t d � | } |
d j d � d } d |
d k r�d |
d k rg| j |
d � rg| j |
d � rg|
d j d � d j d � d } |
d j d � d j d � d } q�|
d j d � r�|
d j d � d } q�|
d j d � r�|
d j d � d } q�t | � q� q�n yf|
d } t } d | k rt } | j d � d } n t |
� d k r\t | |
d |
d |
d |
d |
d | | |
� } n� t | |
d |
d |
d |
d |
d | | |
� } t j
d � } |
d
d k r�| j d |
d
� | _ n |
d d k r�| j d |
d � | _ n | d k r| j d
| � n | d k r9| j d | � n Wn. t k
rjt d! � | } t | � q� n X| | j d k r�| j t � | j j | � q�| j t � | j j | � q� q� W| j � q: Wd" S(# s$ Read in rules that were added by ufwR R s Couldn't open '%s' for readings ^### tuple ###\s*s in_\w+s out_\w+RH s comment=s \s+i i s) Skipping malformed tuple (bad length): %sR� i s$ Skipping malformed tuple (iface): %si����R< i t !i i t in_t out_Rh i i i i s %20R� R{ Rn s Skipping malformed tuple: %sN( R2 R, R- R RQ t open_file_readRN R< R RO RP Rk R� R� RU R� R RS t partitiont
startswithR� R� R R� R� t
set_interfacet set_v6R R t close( R0 t rfnsR[ RJ RW t pat_tuplet pat_iface_int
pat_iface_outt orig_lineR^ R� t hexR� RI t wmsgt dtypeR� R� R� R t rulet pat_spacet warn_msg( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt _read_rules� s�
$
$ $'
c C s | j d } | r# | j d } n t j | t j � sW t d | � } t | � � n y t j j | � } Wn t k
r� � n X| j
� d } | j } | r� d } | j } n | j
r� t j j � } n
| d } t j j | d � t j j | d | d � t j j | d | d
� t j j | d | d � t j j | d | d � t j j | d | d
� t j j | d | d � t j j | d | d � t j j | d | d � t j j | d | d � t j j | d | d � t j j | d | d � t j j | d | d � t j j | d | d � t j j | d | d � | d k r�| j d d s�| d k r�| j d d r�t j j | d | d � t j j | d | d � n t j j | d � x�| D]�} | j } | j r d | j } n | j d k r?| d | j 7} n d }
| j d k ro| j d k ro| j }
n} | j d k r�| j d k r�d | j | j f }
nF | j d k r�|
d! | j | j f 7}
n |
d! | j | j f 7}
| j d k ru| j d k rud" | | j | j | j | j | j |
f } | j d k r[| d# | j 7} n t j j | | d$ � n� t! j" d% � } d& }
| j r�| j# d' | j � }
n d& } | j r�| j# d' | j � } n d( | | j | j | j | j | j |
| |
f } | j d k r)| d# | j 7} n t j j | | d$ � d) } | j rXd* } n | j d+ k rpd, } n d- | | f } d. | | j$ � f } x0 | j% | | | � D] } t j j | | � q�Wq�Wt j j | d/ � t j j | d0 � y | j& | j' d1 � } Wn t k
r#� n Xx� | D]� \ } } } t( | � d2 k rb| d2 d3 k rbq+n | j) | d& � r+t j j | d% j* | � j+ d4 d5 � j+ d6 d7 � d$ � q+q+Wt j j | d8 � | d k r�| j d d s| d k r�| j d d r�t j j | d9 � | j' d1 d: k rdt j j | d; | d< d% j* | j, � d= | j- d> � n t j j | d; | d? � t j j | d; | d@ � t j j | dA � n t j j | dB � y3 | j
r�t j j. | t/ � n t j j. | � Wn t k
r � n XdC S(D s. Write out new rules to file to user chain fileR R s '%s' is not writableR R� RI s *filter
Rh s -user-input - [0:0]
s -user-output - [0:0]
s -user-forward - [0:0]
s -before-logging-input - [0:0]
s -before-logging-output - [0:0]
s -before-logging-forward - [0:0]
s -user-logging-input - [0:0]
s -user-logging-output - [0:0]
s -user-logging-forward - [0:0]
s -after-logging-input - [0:0]
s -after-logging-output - [0:0]
s -after-logging-forward - [0:0]
s -logging-deny - [0:0]
s -logging-allow - [0:0]
R R R s -user-limit - [0:0]
s -user-limit-accept - [0:0]
s ### RULES ###
s route:RH R< s in_%s!out_%ss %s_%ss#
### tuple ### %s %s %s %s %s %s %ss comment=%ss
R{ R� s %20s)
### tuple ### %s %s %s %s %s %s %s %s %sR R Rn R s
%s-user-%ss -A %s %s
s
### END RULES ###
s
### LOGGING ###
R� i s -Dt [s "[s ] s ] "s ### END LOGGING ###
s
### RATE LIMITING ###
t offs -A s -user-limit s "s "
s -user-limit -j REJECT
s -user-limit-accept -j ACCEPT
s ### END RATE LIMITING ###
s COMMIT
N(0 R2 R$ t accesst W_OKR< R R RQ RR RN Ri R R R1 t syst stdoutt filenoRT Rj R� R R� R� R� RK R� R� R� R� Rx R� Ry R� RO RP RU t format_ruleR� t _get_logging_rulesR= R� R� R& R� R. R/ RV R� ( R0 R� t
rules_fileRW R\ R4 R R] R� R� t ifacest tstrR� R� R� t chain_suffixR7 t rule_strR� t lrules_tRr t q( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt _write_rules
s
!
!
" $ 1
c C sm | j � d } | j ru | j � s@ t d � } t | � � n | j d k r� | j d d r� t d � | j Sn2 | j d k r� | j d d r� t d � | j S| j r� | j d k r� | j d k r� t d
� } t | � � n g } t } t } | j
} | j } | j rY| j d k rM| j
d k sC| j d k rMt d � S| j } n | d
k sw| t | � k r�t d � | } t | � � n | d
k r�| j r�t d � } t | � � n | t | � k r�t d � | } t | � � n y | j � Wn t k
r� n Xd }
t } d
} d4 }
x�| D]�} y | j � Wn t k
re� n X| j | j | j
| j f } |
| k r|
d d k r�|
d d k r�|
d k s�| d d k r�| d d k s�|
| k r
t } | j | j � � d5 }
q| d 7} n | }
|
d 7}
t j | | � } | d k rR| d 7} n | d
k r�| r�| r�t } | j s
| j | j � � q
q;| d k r�| j r�| j d k r�t } q;| d
k r | j r | r t } t } | j | j � � q;| j | � q;W| rL| d
k r�t d � } | j rE| d 7} n | Sn� | rs| j rs| j | j � � n | r�| j r�| j r�t d � } | j r�| d 7} n | S| r�| j r�| r�t d � } | j r�| d 7} n | S| j r| | _ n | | _
y | j | j � Wn: t k
r8� n' t k
r^t d � } t | � n Xt d � } | j r�t d � } n | j � ri| j rid } | s�| j | j � s�| rCd } | r�| t d � 7} n | t d � 7} | j r| d 7} n | r0y | j � Wq@t k
r,� q@Xq�| t d � 7} nQ | rg| j rgd } t d � } n- | r�| r�| j r�d! } t d" � } n | d k ri| j! } d# } | j r�| j" } d$ } | d 7} n d% } | j# r�d& } n | j$ d' k rd( } n d) | | f } t d* � } t% | d+ | d, g � \ } } | d
k rYt | � � n d- | | | j& � f } t' j( d. � } x� | j) | | | � D]� } t% | g | � \ } } | d
k r�t* | t+ j, � t | � n | d! k r�| j- d/ j. | � � r�| j/ d0 d/ j. | � � } t% | d | d1 d2 g � \ } } | d
k r_t0 d3 | � q_q�q�Wqin | S(6 sX Updates firewall with rule by:
* appending the rule to the chain if new rule and firewall enabled
* deleting the rule from the chain if found and firewall enabled
* inserting the rule if possible and firewall enabled
* updating user rules file
* reloading the user rules file if rule is modified
RH s) Adding IPv6 rule failed: IPv6 not enabledR R s# Skipping unsupported IPv6 '%s' ruleR s# Skipping unsupported IPv4 '%s' rulet udpt tcps/ Must specify 'tcp' or 'udp' with multiple portss 1.4s: Skipping IPv6 application rule. Need at least iptables 1.4i s Invalid position '%d's Cannot specify insert and deletes# Cannot insert rule at position '%d'i i i i����s Skipping inserting existing rules (v6)s" Could not delete non-existent rules Skipping adding existing rules Couldn't update rules files
Rules updateds Rules updated (v6)s
Rule inserteds Rule updateds (skipped reloading firewall)s -Ds Rule deleteds -As
Rule addedR R� R R Rn R s
%s-user-%ss! Could not update running firewalls -Ls -ns %s %s %ss (-A +)(ufw6?-user-[a-z\-]+)(.*)R{ s \2s -jt RETURNs FAILOK: -D %s -j RETURN( RH RH RH RH ( RH RH RH RH (1 Ri R� R, R< R R� Rj t multiR� R� R t positiont iptables_versionR� R� R R� t removet normalizeRN Rx Ry R� R- t dup_ruleR R� R� R1 R R� R� R� R Rl R RK R R RO RP R� R R t stderrRS R& RU R ( R0 R� t allow_reloadR> RW t newrulest foundt modifiedR R R� t insertedt matchest lastR� t currentt rett flagR� R4 R
R7 Rv Rn R R� R� Rr ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt set_rule� s4
!!'
,
$
$! c
C s� g } g } | r | j } n | j } | j � } | j | � | j � | j � } xL | D]D } | j � } | j � | j � } | | k r] | j | � q] q] W| S( s@ Return a list of UFWRules from the system based on template rule( R R R R� R R� R- (
R0 t templateR� R R� t normR� R� RI t tmp_tuple( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt get_app_rules_from_system� s
c C s� | j } | j d � r$ | j } n t | g | � \ } } | d k r t d | � } | rp t d | � q t | � � n d S( s Perform command on chainR� i s Could not perform '%s's FAILOK: N( R R� Rl R R< R R ( R0 R7 Ro t fail_okR� Rv Rn RW ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyR� � s c C sL | j r
d S| j � g } y | j | � } Wn t k
rF � n Xy$ | j d t � | j d t � Wn: t k
r� � n' t k
r� t d � } t | � n X| j � s� d St d � } xs | j
d | j
d | j
d | j
d D]C } y | j | d | d
g � Wq� t k
r5t | � � q� Xq� Wy^ xW | j
d | j
d | j
d D]2 } | j | d | g � | j | d | g � qaWWn t k
r�t | � � n Xx� | D]� \ } } } t } t | � d
k r�| d
d k r�t } n yY | d k rDt | � d k rD| j | d g | d d t �n | j | | | � Wq�t k
rwt | � � q�Xq�Wx� d d g D]� } | j
d d r�| d k s�| j
d d r�| d k r�| j | d | g | j | j d g d t �| j d d k rD| j | d | g | j | j d g d t �qDq�q�Wd S( s# Update loglevel of running firewallNR� s& Couldn't update rules file for loggings! Could not update running firewallR R R R s -Ls -ns -Fs -Zi s -Dt delete_firsti R( s ufw-user-limits ufw6-user-limitR R R R{ R� R� s -I( R1 Ri R RN R R� R� R R< R� R+ R� R� Rj R. R/ R= ( R0 R� t rules_tRW Rr R� R
R( R7 ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyR� � sl
2
" $
c
C s� g } | t | j j � � k r@ t d � | } t | � � n | d k r� x7 | j d D]( } | j | d | d d g d g � qZ W| Sx7 | j d D]( } | j | d | d d g d g � q� Wd
d d d
d d g } | j | | j d k r8g } | j | | j d k r | } n x� | j d D]� } x� d d d g D]� } | j | � rC| j | � d k s�| j | � d k r�d } | j | d | d d d | g | d g � q | j | | j d k r d } | j | d | d d d | g | d g � q qCqCWq-Wg } | j | | j d k r:| } n x� | j d D]� } | j d � rfd } n� | j d � rd } | j | | j d k r�| j | d | d
d d! d" d d g | d g � q| j | d | d
d d! d" d d d d# g
| d g � n | j | d | d d d | g | d g � qHWn | j | | j d k r�g } | j | | j d$ k r{| } n | j | | j d k r�d
d d! d% g | } n d& } xD | j d' D]2 } | j | d | d d d | g | d g � q�Wn | S(( s% Get rules for specified logging levels Invalid log level '%s'R� R s -Is -jR R) s -DRH s -mR s --limits 3/mins
--limit-burstt 10R� t highR R R R R; RA s [UFW BLOCK] s -AR s --log-prefixt mediums [UFW ALLOW] R R@ t conntracks --ctstatet INVALIDs [UFW AUDIT INVALID] t fullt NEWs [UFW AUDIT] R ( R� R� R� R< R R+ R- t endswithR� ( R0 R� R* RW Rr R� t largsRu R� ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyR � sx && c C s� d } t t j j | j � } g } x� | j D]� } | j | j d � sP q. n | j | j | � t j j
| d t j j | j | � � } t j j | � s. t
d � | } t | � � q. q. Wt j d � } xO | D]G } d | | f } t j j | � r� t
d � | } t | � � q� q� Wx\ | D]T } d | | f } | t
d � i t j j | � d 6| d
67} t j | | � q,Wx| D]� } d | | f } t j t j j
| d t j j | � � t j j | � � t j | | � y t j | � } | t j }
Wn. t k
r;t
d � | } t | � q�n X|
t j @r`| t
d � | 7} q�|
t j @r�| t
d
� | 7} q�q�W| S( s Reset the firewallRH s .rulesR s Could not find '%s'. Abortings
%Y%m%d_%H%M%Ss %s.%ss '%s' already exists. Abortings" Backing up '%(old)s' to '%(new)s'
t oldt news Couldn't stat '%s's WARN: '%s' is world writables WARN: '%s' is world readable( R R R t share_dirR R2 R2 R- R$ R% R& t basenamet isfileR< R t timet strftimet existst renamet shutilt copyt dirnamet copymodet statt ST_MODERN R t S_IWOTHt S_IROTH( R0 t resR6 t allfilesRt t fnRW t extR4 t statinfot modeR� ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt resetY sR
"
N( t __name__t
__module__t __doc__R� R* R? R_ Rw R� R� R� R� R� R� R� R� R� R R� R# R' R� R� R RK ( ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyR s( , K ]� ! D e � �
J Z( RN R$ RO R= RA R R9 t
ufw.commonR R t ufw.utilR R R R R R t ufw.backendR R( R) R ( ( ( s8 /usr/lib/python2.7/site-packages/ufw/backend_iptables.pyt <module> s .
Mini Shell