Current File : //lib/python2.7/site-packages/ufw/util.pyc
�
V�Vc@s�dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl
Z
ddlZddlZddl
Z
ddlZddlZddlmZddlmZeZdZdddd d
ddgZdd d
ddgZddgZd
�Zd�Zd�Zd�Zd�Zdd�Z d�Z!d�Z"d�Z#d�Z$e%d�Z&d�Z'd�Z(d�Z)e%d�Z*d�Z+ej,e%d�Z-d�Z.d �Z/d!�Z0d"�Z1e j2�d#�Z3e j2�d$�Z4d%�Z5d&�Z6d'�Z7d(�Z8d)�Z9d*�Z:d+�Z;d,d-�Z<d,e%d.�Z=d/�Z>ed0�Z?d1�Z@d2�ZAd3�ZBd4�ZCd5�ZDd6�ZEd7�ZFd8�ZGdS(9s"util.py: utility functions for ufwi����(tprint_functionN(treduce(tmkstempttcptudptipv6tesptahtigmptgrecCs�d}ytj|�Wntk
r-�nXytj|d�d}Wntk
r[nXy/tj|d�|dkr�d}nd}Wntk
r�nX|S(s8Get the protocol for a specified port from /etc/servicestRRtany(tsockett
getservbynamet Exception(tporttproto((s,/usr/lib/python2.7/site-packages/ufw/util.pytget_services_proto-s$
cCs�d}d}|jd�}t|�dkr@|d}d}nlt|�dkr�|d}|d}|tkr�td|�}t|��q�ntd�}t|��||fS( sParse port or port and protocolR
t/iiRisInvalid port with protocol '%s'sBad port(tsplittlentportless_protocolst_t
ValueError(tp_strRRttmpterr_msg((s,/usr/lib/python2.7/site-packages/ufw/util.pytparse_port_protoGs
cCs�tjstd�tSt|�dks<tjd|�r@tS|jd�}ytjtj |d�Wnt
k
r~tSXt|�dkr�tSt|�dkr�t|dt�s�tSntS(sVerifies if valid IPv6 addresss"python does not have IPv6 support.i+s^[a-fA-F0-9:\./]+$Riii(
Rthas_ipv6twarntFalseRtretmatchRt inet_ptontAF_INET6Rt_valid_cidr_netmasktTrue(taddrtnet((s,/usr/lib/python2.7/site-packages/ufw/util.pytvalid_address6[s
%
cCs�t|�dks%tjd|�r)tS|jd�}y2tjtj|d�t|dt�sitSWnt k
r~tSXt|�dkr�tSt|�dkr�t
|dt�s�tSntS(sVerifies if valid IPv4 addressis^[0-9\./]+$Riii(RRR RRRR!tAF_INETt_valid_dotted_quadsRt
valid_netmaskR$(R%R&((s,/usr/lib/python2.7/site-packages/ufw/util.pytvalid_address4us%
cCst||�pt||�S(s(Verifies if valid cidr or dotted netmask(R#R)(tnmtv6((s,/usr/lib/python2.7/site-packages/ufw/util.pyR*�sRcCsX|dkrt|�S|dkr,t|�S|dkrNt|�pMt|�St�dS(sValidate IP addressest6t4RN(R'R+R(R%tversion((s,/usr/lib/python2.7/site-packages/ufw/util.pyt
valid_address�s
c
Cs�g}t}d}tj}|r3d}tj}nd|kr�|jd�}|rn|ddkrn|d=q�|r�|ddks�|ddkr�|d=q�n
|j|�|r
t|�dkr
t|d|�r
yt|d|�|d<Wq
t k
r q
Xn|d }tj
|tj||��}||d krNt}nt|�dkr�|d|d7}|s�t
|�}||kr�d
||f}t|�|}t}q�q�nt||�s�d|}t|�t�n||fS(s�Convert address to standard form. Use no netmask for IP addresses. If
netmask is specified and not all 1's, for IPv4 use cidr if possible,
otherwise dotted netmask and for IPv6, use cidr.
R/R.Rit128t32s255.255.255.255iisUsing '%s' for address '%s'sInvalid address '%s'(RRR(R"RtappendRR)t_dotted_netmask_to_cidrRt inet_ntopR!R$t_address4_to_networktdebugR1R( torigR-R&tchangedR0ts_typeR%tnetworktdbg_msg((s,/usr/lib/python2.7/site-packages/ufw/util.pytnormalize_address�sJ
'
,
cCs.yt|d�}Wntk
r)�nX|S(s"Opens the specified file read-onlytr(topenR(tfnR9((s,/usr/lib/python2.7/site-packages/ufw/util.pytopen_file_read�s
cCs{yt|�}Wntk
r&�nXyt�\}}Wntk
rZ|j��nXi|d6|d6|d6|d6S(s=Opens the specified file read-only and a tempfile read-write.R9torignameRttmpname(RBRRtclose(RAR9RRD((s,/usr/lib/python2.7/site-packages/ufw/util.pyt
open_files�s
cCs�|dkrdS|s+ttjd��ntrW|tjj�krWtj|�dSd}tjddkr�t j|t
|d��}nt j||�}|dkr�ttjd��ndS( s~Write to the file descriptor and error out of 0 bytes written. Intended
to be used with open_files() and close_files().R
NsNot a valid file descriptori����iitasciis"Could not write to file descriptor(tOSErrorterrnotENOENTt
msg_outputtsyststdouttfilenotwritetversion_infotostbytestEIO(tfdtouttrc((s,/usr/lib/python2.7/site-packages/ufw/util.pyt
write_to_file�s
cCs�|dj�tj|d�|rsy4tj|d|d�tj|d|d�Wqstk
ro�qsXnytj|d�Wntk
r��nXdS(suCloses the specified files (as returned by open_files), and update
original file with the temporary file.
R9RRCRDN(RERQtshutiltcopystattcopyRtunlinkRH(tfnstupdate((s,/usr/lib/python2.7/site-packages/ufw/util.pytclose_filess
cCs{t|�y+tj|dtjdtjdt�}Wn tk
rW}dt|�gSX|j�d}|j t|�gS(s!Try to execute the given command.RMtstderrtuniversal_newlinesii(
R8t
subprocesstPopentPIPEtSTDOUTR$RHtstrtcommunicatet
returncode(tcommandtsptexRU((s,/usr/lib/python2.7/site-packages/ufw/util.pytcmd#s
cCszy4tj|dtj�}tj|d|j�}Wn tk
rV}dt|�gSX|j�d}|jt|�gS(s#Try to pipe command1 into command2.RMtstdinii(RaRbRcRMRHReRfRg(tcommand1tcommand2tsp1tsp2RjRU((s,/usr/lib/python2.7/site-packages/ufw/util.pytcmd_pipe1scCs�y
|j}Wn
|}nXy|jdd�}Wn
|}nXtrktjtj�rk|j|�n|jt|��|j �dS(sQImplement our own print statement that will output utf-8 when
appropriate.sutf-8tignoreN(
tbuffertencodeRKtinspecttisclasstiotStringIORORRtflush(toutputtstwriterRU((s,/usr/lib/python2.7/site-packages/ufw/util.pyt_print>s
cCsFyttjd|�Wntk
r+nX|rBtjd�ndS(sPrint error message and exits
ERROR: %s
iN(R}RLR_tIOErrortexit(RUtdo_exit((s,/usr/lib/python2.7/site-packages/ufw/util.pyterrorSs
cCs0yttjd|�Wntk
r+nXdS(sPrint warning messages WARN: %s
N(R}RLR_R~(RU((s,/usr/lib/python2.7/site-packages/ufw/util.pyR^s
cCsetr|tjkrt}ny/|r;t|d|�nt|d|�Wntk
r`nXdS(s
Print messages%s
s%sN(RKRLRMR}R~(RURztnewline((s,/usr/lib/python2.7/site-packages/ufw/util.pytmsgfs
cCs9tr5yttjd|�Wq5tk
r1q5XndS(sPrint debug messages
DEBUG: %s
N(t DEBUGGINGR}RLR_R~(RU((s,/usr/lib/python2.7/site-packages/ufw/util.pyR8ts
cCst|d�|jd��S(s�
A word-wrap function that preserves existing line breaks
and most spaces in the text. Expects that existing line
breaks are posix newlines (
).
cSsLd|dt|�|jd�dt|jdd�d�|k|fS(Ns%s%s%ss
s
ii(RtrfindR(tlinetwordtwidth((s,/usr/lib/python2.7/site-packages/ufw/util.pyt<lambda>�s
4t (RR(ttextR�((s,/usr/lib/python2.7/site-packages/ufw/util.pyt word_wrap}scCs
t|d�S(sWord wrap to a specific widthiK(R�(R�((s,/usr/lib/python2.7/site-packages/ufw/util.pyt wrap_text�scs&d��|jd�fd��dS(s$Sorts list of strings into numeric order, with text case-insensitive.
Modifies list in place.
Eg:
[ '80', 'a222', 'a32', 'a2', 'b1', '443', 'telnet', '3', 'http', 'ZZZ']
sorts to:
['3', '80', '443', 'a2', 'a32', 'a222', 'b1', 'http', 'telnet', 'ZZZ']
cSs |j�rt|�S|j�S(N(tisdigittinttlower(tt((s,/usr/lib/python2.7/site-packages/ufw/util.pyR��stkeycs)gtjd|�D]}�|�^qS(Ns([0-9]+)(RR(tktc(tnorm(s,/usr/lib/python2.7/site-packages/ufw/util.pyR��sN(tsort(tlst((R�s,/usr/lib/python2.7/site-packages/ufw/util.pyt
human_sort�s
cCs�yt|�}Wntk
r/td��nXtjjdt|�d�}tjj|�sstd|��ny1t |�j
�djd�dj�d}Wntk
r��nXt|�S(sdFinds parent process id for pid based on /proc/<pid>/stat. See
'man 5 proc' for details.
spid must be an integers/proctstatsCouldn't find '%s'it)i(R�RRRQtpathtjoinRetisfileR~R@t readlinesR(tmypidtpidtnametppid((s,/usr/lib/python2.7/site-packages/ufw/util.pytget_ppid�s
1
cCsXyt|�}WnZtk
r:td�}t|�tStk
rltd�t|�}t|��nX|dks�|dkr�tStj j
dt|�d�}tj j|�s�td�|}t|��ny$t|�j
�dj�d}Wn-tk
r+td�|}t|��nXtd |�|d
krJtSt|�SdS(s1Determine if current process is running under sshs%Couldn't find pid (is /proc mounted?)s!Couldn't find parent pid for '%s'is/procR�sCouldn't find '%s'is"Could not find executable for '%s'sunder_ssh: exe is '%s's(sshd)N(R�R~RRRRReRRQR�R�R�R@R�RR8R$t under_ssh(R�R�twarn_msgRR�texe((s,/usr/lib/python2.7/site-packages/ufw/util.pyR��s0
$
cCsTd}|rd}ntjd|�sLt|�dksLt|�|krPtStS(sVerifies cidr netmasksi i�s^[0-9]+$i(RR R�RR$(R,R-tnum((s,/usr/lib/python2.7/site-packages/ufw/util.pyR#�s 7cCs�|r
tStjd|�r�tjd|�}t|�dkrDtSxD|D]5}|s|t|�dks|t|�dkrKtSqKWntStS(s.Verifies dotted quad ip addresses and netmaskss^[0-9]+\.[0-9\.]+$s\.iii�(RRR RRR�R$(R,R-tquadstq((s,/usr/lib/python2.7/site-packages/ufw/util.pyR)�s
+cCs0d}|rt�n�t||�s-t�nd}y)ttjdtj|��d�}Wn6tk
r�ttjdtj|��d�}nXt }xKt
d�D]=}||?d@dkr�t}q�|r�d}Pq�|d7}q�W|dkr|dkrtd|�}nt
||�s,t�n|S(s@Convert netmask to cidr. IPv6 dotted netmasks are not supported.R
is>Li ii����(RR)tlongtstructtunpackRt inet_atont NameErrorR�RtrangeR$ReR#(R,R-tcidrtmbitstbitst found_onetn((s,/usr/lib/python2.7/site-packages/ufw/util.pyR5s. )
) cCs�d}|rt�n�t||�s-t�nytd�}Wntk
rVd}nXx;td�D]-}|t|�krd|dd|>O}qdqdWtjtj d|��}t
||�s�t�n|S(s<Convert cidr to netmask. IPv6 dotted netmasks not supported.R
ii iis>L(RR#R�R�R�R�Rt inet_ntoaR�tpackR)(R�R-R,R�R�((s,/usr/lib/python2.7/site-packages/ufw/util.pyt_cidr_to_dotted_netmask2s
c Csrd|krtd�|S|jd�}t|�dksOt|dt�rXt�n|d}|d}|}t|t�r�t|t�}nyNtt j
dtj|��d�}tt j
dtj|��d�}Wn[t
k
r>tt j
dtj|��d�}tt j
dtj|��d�}nX||@}tjt jd|��}d||fS(s8Convert an IPv4 address and netmask to a network addressRs8_address4_to_network: skipping address without a netmaskiiis>Ls%s/%s(R8RRR)RRR#R�R�R�R�RR�R�R�R�R�( R%Rthosttorig_nmR,t host_bitstnm_bitstnetwork_bitsR<((s,/usr/lib/python2.7/site-packages/ufw/util.pyR7Os(
&
%)
%)
cCsNd�}d|kr#td�|S|jd�}t|�dksXt|dt�rat�n|d}|d}tjdtj tj
|��}ytd�}Wntk
r�d}nXxft
d�D]X}|||d �}x<t
d �D].} |dt|| �@d
| |d >O}q�Wq�Wytd�}
Wntk
rRd}
nXx;t
d�D]-}|t|�kr`|
dd|>O}
q`q`W||
@}g}xFt
d�D]8}|jt||d�|d |d d !d��q�Wtjtj
tjd|d|d|d|d|d
|d|d|d� �}
d|
|fS(s8Convert an IPv6 address and netmask to a network addresscSs>djgt|ddd�D]}t||?d@�^q�S(sDecimal to binaryR
ii����(R�R�Re(R�tcountty((s,/usr/lib/python2.7/site-packages/ufw/util.pytdec2binssRs8_address6_to_network: skipping address without a netmaskiiis>8Hiiii�iiiiis%s/%si(R8RRR*R$RR�R�RR!R"R�R�R�R�R4R6R�(R%R�Rt orig_hosttnetmasktunpackedR�tiR�tjR�R&R�R<((s,/usr/lib/python2.7/site-packages/ufw/util.pyt_address6_to_networkqsF
&
0
6c
Cs�|jd�}t|�dks5t|d|�r>t�n|d}|d}|dksj|dkrntS|}d|kr�|jd�}t|�dks�t|d|�r�t�n|d}n|dks�|dkr�tS|rt|�st|�r6t�q6n#t|�s-t|�r6t�nt||�r^|r^t||�}n|r�t d||f�jd�d}t d||f�jd�d}nFt
d||f�jd�d}t
d||f�jd�d}||kS(s&Determine if address x is in network yRiiis0.0.0.0s::s%s/%s(RRR*RR$R'R+R#R�R�R7( t
tested_addt
tested_netR-RR�R�taddresstorig_networkR<((s,/usr/lib/python2.7/site-packages/ufw/util.pyt
in_network�s@&
&
s/sbin/iptablescCsft|dg�\}}|dkr=ttjd|��ntjd|�}tjdd|d�S(sReturn iptables versions-VisError running '%s's\ss^vR
i(RkRHRIRJRRtsub(R�RVRUR((s,/usr/lib/python2.7/site-packages/ufw/util.pytget_iptables_version�s
cCscd�}|r6tj�dkr6ttjd��ng}d}|jd�rZd}nt|d|g�\}}|dkr�ttj|��n|||dd d
dddd
g�r�|jd�n|||dd d
ddddddddg�r|jd�nt|d|g�t|d|g�\}}|dkr_ttj|��n|S(s[Return capabilities set for netfilter to support new features. Callers
must be root.cSs9|d|g}t||�\}}|dkr5tStS(Ns-Ai(RkR$R(R�tchaintruletargsRVRU((s,/usr/lib/python2.7/site-packages/ufw/util.pyttest_cap�s
isMust be roots
ufw-caps-testt ip6tablessufw6-caps-tests-Ns-mt conntracks --ctstatetNEWtrecents--sets
recent-sets--updates --secondst30s
--hitcountR.s
recent-updates-Fs-X( RQtgetuidRHRItEPERMtendswithRkRJR4(R�t do_checksR�tcapsR�RVRU((s,/usr/lib/python2.7/site-packages/ufw/util.pytget_netfilter_capabilities�s. cCsut|�}t�}xY|j�D]K}|jd�rN|jd�rNq"n|j�}|d}|djd�d}t�}dj|djd�d �|d<|d|d <|d
jd�d|d<|dd
kr�|d|d<n|d
jd�d|d<||kr7t�||<g|||<n!|||krXg|||<n|||j|�q"W|S(s:Get and parse netstat the output from get_netstat_output()RRiit:i����tladdrituidiRR�t-R�(tget_netstat_outputtdictt
splitlinest
startswithRR�R4(R-tnetstat_outputtdR�RRRtitem((s,/usr/lib/python2.7/site-packages/ufw/util.pytparse_netstat_outputs,
$
cCs�d}|r d}tjj|�s=ttjd|��nx�t|�j�D]�}|j�}||dkrPdj gt
dt|d�d�D]}|d||d!^q��}|dj�d kr�d
|t
|dj�d�f}q�qPqPW|dkr�ttjd��q�n}tjtjtj�}y?tjtj|j�d
tjd|d ��dd!�}Wn#tk
r�ttjd��nXt||�dS(sGet IP address for interfaceR
s/proc/net/if_inet6s'%s' does not existiR�iiit80s%s/%sisNo such devicei�t256siii(RQR�texistsRHRIRJR@R�RR�R�RR�R�R~tENODEVRR(t
SOCK_DGRAMR�tfcntltioctlRNR�R�RR>(tifnameR-R%tprocR�RR�R{((s,/usr/lib/python2.7/site-packages/ufw/util.pytget_ip_from_if9s*A-'
c
Cs�t}d}t|�r't}d}n!t|�sHttjd��ntjj |�sst
tjd|��nd}|rrxxt|�j
�D]�}|j�}|dj�}djgtdt|d�d �D]}|d||d !^q��}|d
j�dkr7d|t|d
j�d
�f}n||ksad|kr�t||t�r�|}Pq�q�Wn�x�t|�j
�D]q}d|kr�q�n|jd�dj�}yt|t�} Wntk
r�q�nX| |kr�|}Pq�q�W|S(sGet interface for IP addresss
/proc/net/devs/proc/net/if_inet6sNo such devices'%s' does not existR
iR�iiiR�s%s/%siR(RR'R$R+R~RIR�RQR�R�RHRJR@R�RtstripR�R�RR�R�R�R�(
R%R-R�tmatchedR�RR�R�ttmp_addrtip((s,/usr/lib/python2.7/site-packages/ufw/util.pytget_if_from_ipYsD A&
c Csbtjd�}|j�tjd�}t�}x*|D]"}|j|�sSq8ntjjd|d�}tj |tj
tjB�s�q8nd}y%tjtjjd|d��}Wnt
k
r�nXytj|�}Wn
q8nXxk|D]c}y&tjtjj||��d}Wnt
k
r5q�nXd|tjj|�f||<q�Wq8W|S(sGet inodes of files in /procs/procs^[0-9]+$RTR�R�is%s/%s(RQtlistdirR�RtcompileR�R R�R�taccesstF_OKtR_OKtreadlinkRR�tbasename( t
proc_filestpattinodesR�tfd_pathtexe_pathtdirsR�tinode((s,/usr/lib/python2.7/site-packages/ufw/util.pyt_get_proc_inodes�s4
%
&
(cCs�idd6dd6dd6dd6d d
6dd6d
d6dd6dd6dd6dd6}idd6dd6dd6dd6}tjjd|�}tj|tjtjB�s�t�ng}t}t|�j �}x�|D]�}|j
�}|s�t}q�n|t||dd�} |j
d�r+d} n!|j
d�rL| dkrLq�n||dj
d �\}
}||d}||d}
|j|
t|d�||
| f�q�W|S(!s=Read /proc/net/(tcp|udp)[6] file and return a list of tuples tESTABLISHEDitSYN_SENTitSYN_RECVit FIN_WAIT1it FIN_WAIT2it TIME_WAITitCLOSEit
CLOSE_WAITitLAST_ACKi tLISTENi
tCLOSINGit
local_addrtstateR�Rs /proc/netiRtNARR�(RQR�R�R�R�R�RRR@R�RR$R�R�R4(tprotocolt
tcp_statestproc_net_fieldsRAR�t
skipped_firsttlinesR�tfieldsRR�RR�R((s,/usr/lib/python2.7/site-packages/ufw/util.pyt_read_proc_net_protocol�sH
)cCsNd}t|�dkr�d}x[tddd�D]G}|djgt|d|d�D]}||d|!^qW�7}q1Wtdjgtdt|�d�D]}|||d!j�^q��t�d}nyg}xTgtddd�D]}||d|!^q�D]"}|jtt|d ���qWtd
j|�t �d}|S(sDConvert an address from /proc/net/(tcp|udp)* to a normalized addressR
iii i����iR�iit.(
RR�R�R>R�R$R4ReR�R(tpaddrt convertedRR�R�((s,/usr/lib/python2.7/site-packages/ufw/util.pytconvert_proc_address�sE <7 c
CsIt�}ddg}|r.|ddg7}nxS|D]K}yt|�||<Wq5tk
rtd|�}t|�q5q5Xq5Wt�}t|j��}|j�d}x�|D]�}x�||D]v\}} }
}}t |�}
d}t
|�|kr|t
|�}n|d|d |
| f||
||f7}q�Wq�W|S(
s5netstat-style output, without IPv6 address truncationRRttcp6tudp6s!Could not get statistics for '%s'R
R�s%-5s %-46s %-11s %-5s %-11s %s
s%s:%s(R�RRRRRtlisttkeysR�RR�(R-t
proc_net_dataRtpR�Rt protocolsR{R�RR�RRR%R�((s,/usr/lib/python2.7/site-packages/ufw/util.pyR��s2
cCso|dkr|S|jd�rVt|�dkr:|}qktjj||d�}ntjj||�}|S(sAdd prefix to dirRiiN(tNoneR�RRQR�R�(tdirtprefixtnewdir((s,/usr/lib/python2.7/site-packages/ufw/util.pyt _findpaths cCsHtjddkr#tj|d�Stj|jddd��jd�S(s,Take a string and convert it to a hex stringiithexsutf-8terrorsRrRG(RLRPtcodecsRttbinasciithexlifytdecode(R{((s,/usr/lib/python2.7/site-packages/ufw/util.pyt
hex_encodescCsBtjddkr,|jdd�jd�Stj|�jd�S(s,Take a hex string and convert it to a stringiitencodingR+sutf-8(RLRPR0R.t unhexlify(th((s,/usr/lib/python2.7/site-packages/ufw/util.pyt
hex_decode&s(Ht__doc__t
__future__RR.R-RIR�RwRuRQRRXRR�RaRLt functoolsRttempfileRRR�R&RKtsupported_protocolsRtipv4_only_protocolsRRR'R+R*R1R>RBRFRWR$R^RkRqR}R�RRMR�R8R�R�R�tgetpidR�R�R#R)R5R�R7R�R�R�R�R�R�R�RRRR�R*R1R5(((s,/usr/lib/python2.7/site-packages/ufw/util.pyt<module>s~ 7
' . " : /
/ & / % / "