Mini Shell

�
��Xc@s�dZd
dl
Z
d
dlZd
dlZd
dlmZ
dZdZdZdZ	dZ
d	Zd
ZdZ
eZdef
d
��YZddd��YZdS(s!common.py: common classes for ufwi����N(
tdebugtufws/var/lib/ufws/usr/libexec/ufws/usr/share/ufws/usr/share/locales/etcs/usrs/sbintUFWErrorc
Bs eZ
dZd
�Zd�ZRS(s$This class represents ufw exceptionscCs
|
|_dS(
N(
tvalue(tselfR((s./usr/lib/python2.7/site-packages/ufw/common.pyt__init__#s
c

Cs
t|j
�
S(
N(treprR(
R((s./usr/lib/python2.7/site-packages/ufw/common.pyt__str__&s
(t__name__t
__module__t__doc__RR(((s./usr/lib/python2.7/site-packages/ufw/common.pyR!s

	tUFWRulecBs�eZ
dZd
dd
ddedd�Zd�Zd�Zd�Zd	�Zd
�Z	dd�
Z
d
�Zd�Zd�Z
d�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�Zd�ZRS(s$This class represents firewall rulestanys	0.0.0.0/0tintc

Cs5
t|_
t|_t|_d
|_d
|_d
|_d
|_d
|_t|_	d
|_
d
|_d
|_d|_
d
|_d
|_d
|_d
|_||_d
|_yo|j|
�

|j|�

|j|�

|j|d�
|j|�

|j|�

|j|�

|j|	�

Wntk
r0



�n
XdS(NRitsrc(tFalsetremovetupdatedtv6tdstRtdporttsporttprotocoltmultitdapptsapptactiontpositiontlogtypetinterface_int
interface_outt	directiontforwardtcommentt
set_actiontset_protocoltset_porttset_srctset_dstt
set_directiontset_commentR(
RRRRRRRR R!R"((s./usr/lib/python2.7/site-packages/ufw/common.pyR,s<	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	
	

















c


Cs
|j�S(
N(
tformat_rule(
R((s./usr/lib/python2.7/site-packages/ufw/common.pyROs
c
CsSd
|}
t|j
�
}|j�
x)|D]!}|
d||j
|f7}
q*W|
S(sPrint rule to stdouts'%s's, %s=%s(tlistt__dict__tsort(Rtrestkeyst
k((s./usr/lib/python2.7/site-packages/ufw/common.pyt_get_attribRs







c
Cs�t|j
|j�}
|j|
_|j|
_|j|
_|j|
_|j|
_|j|
_|j	|
_	|j
|
_
|j|
_|j|
_|j
|
_
|j|
_|j|
_|j|
_|j|
_|j|
_|j|
_|
S(
sReturn a duplicate of a rule(RRRRRRRRRRRRRRRRRR R!R"(Rtrule((s./usr/lib/python2.7/site-packages/ufw/common.pytdup_rule[s&
















c
Cspd
}
|jd
kr)|
d|j7}
n|j
d
krL|
d|j
7}
n|jdkrh|
d7}
n�|
d|j7}
|jr"
|
d7}
|jdkr�|jdkr�|
d|j7}
|
d7}
|
d	|j7}
q"
|jdkr�|
d|j7}
q"
|jdkr"
|
d	|j7}
q"
n|jd
krT
|jdkrT
|
d|j7}
n|jr�
|jdkr�
|
d
|j7}
n|jd
kr�
|jdkr�
|
d|j7}
n|jr�
|jdkr�
|
d|j7}
nd
}|jd
krd|j}n|j	dkr%|
d|7}
nj|j	dkra|
d|7}
|jdkr�|
d7}
q�n.|j	dkr�|
d|7}
n|
d|7}
|j
d
ks�|jd
krfd}tj
d�
}|j
d
kr�|d|jd|j
�7}n|j
d
kr|jd
kr|d7}n|jd
krK|d|jd|j�7}n|d 7}|
d|7}
n|
j�S(!sFormat rule for later parsingRs -i %ss -o %sRs -p alls -p s
 -m multiports
 --dports s
 --sports s	0.0.0.0/0s::/0s -d s	 --dport s -s s	 --sport t
_tallows -j ACCEPT%strejects -j REJECT%sttcps --reject-with tcp-resettlimits -j LIMIT%ss
 -j DROP%ss-m comment --comment 't
 tdapp_s%20t
,tsapp_t
'(RRRRRRRRRRRRtretcompiletsubtstrip(Rtrule_strtlstrR"t	pat_space((s./usr/lib/python2.7/site-packages/ufw/common.pyR*rsd




	




























 




 

cCs�|
j�j
d
�
}|ddksE|ddksE|ddkrU|d|_n	d|_d}t|�
dkr�|d}n|j|�

d	S(
sSets action of the ruleR4iR5R6R8tdenyRi
N(tlowertsplitRtlentset_logtype(RRttmpR((s./usr/lib/python2.7/site-packages/ufw/common.pyR#�s
0
	



Rc		Cs�td
�
|
}|
dkrnC|dkr7|j
r7n+|dkrO|jrOntjd|
�sstjd|
�r�t|�
�
n�
|
jd�
|
jd�
d	kr�t|�
�
n�
|
jd�
}t|�
d
kr�t	|_
nd}xs
|D]k
}tjd|�r�
t	|_
|jd�
}xA|D]9}t|�
d
ksN
t|�
d
kr$
t|�
�
q$
q$
Wt|d�
t|d
�
kr/t|�
�
q/n�tjd|�r�
t|�
d
ks�
t|�
d
kr/t|�
�
q/nTtjd|�r#ytj
|�
}Wq/tk
r


t|�
�
q/Xnt|�
�
|rL|dt|�
7}q�t|�
}q�W|}
|dkr�t|
�
|_nt|
�
|_dS(s:Sets port and location (destination or source) of the rules
Bad port '%s'RRRs^[,:]s[,:]$R;t
:ii
Rs	^\d+:\d+$i��is^\d+$s
^\w[\w\-]+N(R4RRR>tmatchRtcountRGRHtTrueRtinttsockett
getservbynamet	ExceptiontstrRR(	Rtporttlocterr_msgtportsRJt
ptrant
q((s./usr/lib/python2.7/site-packages/ufw/common.pyR%�sP






$

"




	



$

 


$








cCsE|
tj
jd
g
kr%|
|_ntd�
|
}t|�
�
dS(sSets protocol of the ruleRsUnsupported protocol '%s'N(R
tutiltsupported_protocolsRR4R(RRRV((s./usr/lib/python2.7/site-packages/ufw/common.pyR$�s

c

Cs�|jrr|j
r<|j
d
ks0|j
dkr<d|_
n|jr�|jd
ksc|jdkr�d|_q�nf|j
r�|j
d
ks�|j
dkr�d|_
n|jr�|jd
ks�|jdkr�d|_ndS(sAdjusts src and dst based on v6Rs	0.0.0.0/0s::/0N(RRR(
R((s./usr/lib/python2.7/site-packages/ufw/common.pyt
_fix_anywhere�s	
'

'
'

'
cCs|
|_|j
�
d
S(sXSets whether this is ipv6 rule, and adjusts src and dst
           accordingly.
        N(RR](RR((s./usr/lib/python2.7/site-packages/ufw/common.pytset_v6
s	
cCs`|
j�}|d
krIt
jj|d
�rItd�
}t|�
�
n||_|j�
dS(sSets source address of ruleRsBad source addressN(RFR
R[t
valid_addressR4RRR](RtaddrRJRV((s./usr/lib/python2.7/site-packages/ufw/common.pyR&
s"


	
cCs`|
j�}|d
krIt
jj|d
�rItd�
}t|�
�
n||_|j�
dS(s Sets destination address of ruleRsBad destination addressN(RFR
R[R_R4RRR](RR`RJRV((s./usr/lib/python2.7/site-packages/ufw/common.pyR'
s"


	
cCs�|
d
kr3|
dkr3td�
}t
|�
�
ndt|�
kr`td�
}t
|�
�
ntjdt|�
�s�td�
}t
|�
�
ndt|�
kr�td	�
}t
|�
�
n|
d
kr�||_n	||_d
S(sSets an interface for ruleR
toutsBad interface typet
!s+Bad interface name: reserved character: '!'s!^[a-zA-Z][a-zA-Z0-9:]*[a-zA-Z0-9]sBad interface nameRKs/Bad interface name: can't use interface aliasesN(R4RRSR>RLRR(Rtif_typetnameRV((s./usr/lib/python2.7/site-packages/ufw/common.pyt
set_interface'
s








cCsJtj
d
t|
�
�s7td�
|
}t|�
�
nt|
�
|_dS(sSets the position of the rules^[0-9]+s,Insert position '%s' is not a valid positionN(R>RLRSR4RROR(RtnumRV((s./usr/lib/python2.7/site-packages/ufw/common.pytset_position>
s


cCsb|
j�d
ks0|
j�dks0|
dkrB|
j�|_
ntd�
|
}t|�
�
dS(sSets logtype of the ruletlogslog-allRsInvalid log type '%s'N(RFRR4R(RRRV((s./usr/lib/python2.7/site-packages/ufw/common.pyRIE
s
$


cCsD|
d
ks|
dkr$|
|_nt
d�
|
}t|�
�
dS(sSets direction of the ruleR
RasUnsupported direction '%s'N(R R4R(RR RV((s./usr/lib/python2.7/site-packages/ufw/common.pyR(N
s

c

Cstj
j|j�
S(
sGet decoded comment of the rule(R
R[t
hex_decodeR"(
R((s./usr/lib/python2.7/site-packages/ufw/common.pytget_commentV
scCs
|
|_d
S(sSets comment of the ruleN(
R"(RR"((s./usr/lib/python2.7/site-packages/ufw/common.pyR)Z
sc
Csn
t}
|j
rxy(tjj|j
|j�\|_
}
Wn)tk
rb


td
�
}t|�
�
n
X|
rx|
|_	qxn|j
r�y(tjj|j
|j�\|_
}
Wn)tk
r�


td�
}t|�
�
n
X|
r�|
|_	q�n|jr*
|jjd�
}tjj
|�

dj|�
|_n|jrj
|jjd�
}tjj
|�

dj|�
|_ndS(s&Normalize src and dst to standard forms"Could not normalize source addresss'Could not normalize destination addressR;N(RRR
R[tnormalize_addressRRRR4RRRRRGt
human_sorttjoinR(RtchangedRVRW((s./usr/lib/python2.7/site-packages/ufw/common.pyt	normalize^
s6
	







	







	


	


c	Cs�|s|
rt��
nd
||
f}|j
|
j
krJt|�

dS|j|
jkrjt|�

dS|j|
jkr�t|�

dS|j|
jkr�t|�

dS|j|
jkr�t|�

dS|j|
jkr�t|�

dS|j|
jkr

t|�

dS|j	|
j	kr*
t|�

dS|j
|
j
krJ
t|�

dS|j|
jkrj
t|�

dS|j|
jkr�
t|�

dS|j
|
j
kr�
t|�

dS|j|
jkr�
|j|
jkr�
|j|
jkr�
td�
}t|�

dS|j|
jkrJ|j|
jkrJ|j|
jkrJtd�
}t|�

dStd�
i|jd6|
jd	6|jd
6|
jd6|jd6|
jd
6}t|�

dS(s�Check if rules match
        Return codes:
          0  match
          1  no match
         -1  match all but action, log-type and/or comment
         -2  match all but comment
        sNo match '%s' '%s'i
sFound exact matchis$Found exact match, excepting commenti����sZFound non-action/non-logtype/comment match (%(xa)s/%(ya)s/'%(xc)s' %(xl)s/%(yl)s/'%(yc)s')txatyatxltyltxctyci����(t
ValueErrorRRRRRRRRRRRR R!RRR"R4(t
xt
ytdbg_msg((s./usr/lib/python2.7/site-packages/ufw/common.pyRL�
sn

















































$





$




	




cCs�d
�}|s|
r#t��
n|j
|
�
dkr<dSd||j|
|
jf}|
jdkr}td|d�

dS|
j|jkr�t|d�

dS|j|
jkr�|
jd	kr�td
|�

dS|
jd	kr
||j|
j�r
td|�

dS|
jdkr�
|jdkr>
|j	|j
�
r>
q6|j
|
j
krq
d
|
j
krq
td|�

dS|j
|
j
kr6d
|
j
kr6|j|
jkr6tjj
|j
|
j
|j�r6td|d|j
|
j
f�

dSnG
|jdkr6|j|
jkr6td|d|j|
jf�

dSytjj|
j|j�}Wn+tk
r�


td|d|
j�

dSX|
j
|kr�d
|
j
kr�td|d|
j
|f�

dS|
j
|kr6d
|
j
kr6|j|
jkr6tjj
||
j
|j�r6td|d||
j
f�

dS|j|
jkrntd|d|j
|
j
f�

dStd||j|
|
jf�

dS(s�
This will match if x is more specific than y. Eg, for protocol if x
	   is tcp and y is all or for address if y is a network and x is a
           subset of y (where x is either an address or network). Returns:

            0  match
            1  no match
           -1  fuzzy match

           This is a fuzzy destination match, so source ports or addresses
           are not considered, and (currently) only incoming.
        cSs�d
|ksd|kr,||
kr(tSt
Sx|
jd
�
D]n}||krRtSd|kr<|jd�
\}}t|�
t|�
kr�t|�
t|�
k
r�tSq<q<Wt
S(s:Returns True if p is an exact match or within a multi ruleR;RK(RNRRGRO(ttest_ptto_matchRTtlowthigh((s./usr/lib/python2.7/site-packages/ufw/common.pyt_match_ports�
s







0
is(No fuzzy match '%s (v6=%s)' '%s (v6=%s)'R
s(direction) s (not incoming)i
s (forward does not match)Rs(protocol) s(dport) Rt
/s(dst) s ('%s' not in network '%s')s(interface) s (%s != %s)s %s does not exists(v6) s'(fuzzy match) '%s (v6=%s)' '%s (v6=%s)'i����(RvRLRR RR!RRRt_is_anywhereRR
R[t
in_networktget_ip_from_iftIOError(RwRxR~Rytif_ip((s./usr/lib/python2.7/site-packages/ufw/common.pytfuzzy_dst_match�
sl	






!

%

!
!


3
"



!















0





"
 
cCs |
d
ks|
dkrtSt
S(sCheck if address is anywheres::/0s	0.0.0.0/0(RNR(RR`((s./usr/lib/python2.7/site-packages/ufw/common.pyR�2s

c
Cs�d
}
|jd
ks$|j
d
kr�d|j|j|j
|jf}
|jd
krzd|j|j|j
|jf}
n|j
d
kr�d|j|j|j|jf}
n|jd
kr�|
d|j7}
n|jd
kr�|
d|j7}
q�n|
S(s$
Returns a tuple to identify an app rule. Tuple is:
             dapp dst sapp src
           or
             dport dst sapp src
           or
             dapp dst sport src

           All of these might have in_eth0 out_eth0 (or similar) if an
           interface is also defined.
        Rs%s %s %s %ss in_%ss out_%s(RRRRRRRR(Rttupl((s./usr/lib/python2.7/site-packages/ufw/common.pyt
get_app_tuple8s

"








cCs�|jd
krO|j
dks-|jdkrOtd�
|j}t|�
�
n|jtjjkr�|
dkr�td�
|j}t|�
�
n|jtjjkr�|j	d
ks�|j
d
kr�td�
|j}t|�
�
q�ndS(sVerify ruleRRs3Improper rule syntax ('%s' specified with app rule)Rs'Invalid IPv6 address with protocol '%s'sInvalid port with protocol '%s'N(RRRR4RR
R[tipv4_only_protocolstportless_protocolsRR(Rtrule_iptypeRV((s./usr/lib/python2.7/site-packages/ufw/common.pytverifyUs

	



	




	


(RR	R
RRRR1R3R*R#R%R$R]R^R&R'ReRgRIR(RjR)RoRLR�R�R�R�(((s./usr/lib/python2.7/site-packages/ufw/common.pyR*s6



!					C	
5		
		
	
								#	C	n		((R
R>RPtufw.utilR
RtprogramNamet	state_dirtlibexec_dirt	share_dirt	trans_dirt
config_dirt
prefix_dirtiptables_dirRNt	do_checksRRRR(((s./usr/lib/python2.7/site-packages/ufw/common.pyt<module>
s