
    #fd                         d Z ddlZddlZddlZddlZddlZddlZddlmZm	Z	 ddl
mZmZmZmZmZmZ ddlZ G d dej&                  j(                        Zy)z-backend_iptables.py: iptables backend for ufw    N)UFWErrorUFWRule)warndebugmsgcmdcmd_pipe	_findpathc                       e Zd ZdZddZd Zd Zd ZddZd Z	d	 Z
d
 Zd Zd Zd Zd ZddZddZd ZddZd Zd Zd Zy)UFWBackendIptableszInstance class for UFWBackendNc                    dt         j                  j                  z   dz   | _        || _        || _        i }t        t         j                  j                  |      }t        j                  j                  |d      |d<   t        j                  j                  |d      |d<   t        j                  j                  |d      |d<   t        j                  j                  |d	      |d
<   t        j                  j                  |d      |d<   t        j                  j                  |d      |d<   t        j                  j                  t        t         j                  j                  |      d      |d<   t         j                  j                  j                  | d||||       g g g g d| _        dD ]  }d}|dk(  r| j!                         r||z  }n|dk(  r&dD ]1  }dD ]*  }	|d|d|	}
| j                  |   j#                  |
       , 3 | j                  d   j#                  |dz          | j                  d   j#                  |dz           g d| _        d| _        y )!z!UFWBackendIptables initializationz# z
_comment #zufw/user.rulesruleszufw/before.rulesbefore_ruleszufw/after.rulesafter_ruleszufw/user6.rulesrules6zufw/before6.rulesbefore6_ruleszufw/after6.rulesafter6_ruleszufw-initinitiptables)rootdirdatadir)beforeuseraftermisc)46ufwr   )r   r   r   inputoutputforward-z	-logging-r   z-logging-denyz-logging-allow)-mlimit--limitz3/minute-jLOG--log-prefixz[UFW LIMIT BLOCK]N)r   commonprogramNamecomment_strr   r   r
   
config_dirospathjoin	state_dirbackend
UFWBackend__init__chainsuse_ipv6appendufw_user_limit_logufw_user_limit_log_text)selfdryrunr   r   filesr-   verchain_prefixloctargetchains              6/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr4   zUFWBackendIptables.__init__    s   #**"8"88<Gszz44g>
j2BCg "Z9K Ln!ww||J8IJm'',,z3DEh!#j:M!No "Z9K Ln
 Yszz/C/CW%M%/1f 	''j&%07 	( 	J "$R"bI 	HC Lcz==? C'LCZ2 3< 3F2>VLEKK$++E233 KK&&|o'EFKK&&|6F'FG	H"#3 (;$    c                     t        d      }| j                  d   dk(  r|dz  }|S | j                  d   dk(  r|dz  }|S | j                  d   dk(  r|dz  }|S |d	z  }|S )
zGet current policyzNew profiles:default_application_policyacceptz allowdropz denyrejectz rejectz skip)_defaults)r:   rstrs     rB   get_default_application_policyz1UFWBackendIptables.get_default_application_policyP   s    !==56(BHD  ]]78FBGOD  ]]78HDID  GODrC   c           	         | j                   s|dk7  r#|dk7  r|dk7  rt        d      |z  }t        |      |dk7  r#|dk7  r|dk7  rt        d      |z  }t        |      d	}|dk(  rd
}n|dk(  rd}d}d}|dk(  r)	 | j                  | j                  d   d|z  d       d}d}nV|dk(  r)	 | j                  | j                  d   d|z  d       d}d}n(	 | j                  | j                  d   d|z  d       d}d}t        j                  d|z         }| j                  d   | j                  d   fD ]  }	 t        j                  j                  |      }	|	d   }
|	d   D ]d  }|j                  |      r1t        j                  j                  |
|j                  ||             Et        j                  j                  |
|       f 	 t        j                  j                  |	        t        d      ||dz  }|t        d      z  }|S # t
        $ r  w xY w# t
        $ r  w xY w# t
        $ r  w xY w# t
        $ r  w xY w# t
        $ r  w xY w)zSets default policy of firewallallowdenyrH   zUnsupported policy '%s'incomingoutgoingroutedz%Unsupported policy for direction '%s'INPUTOUTPUTFORWARD rJ   zDEFAULT_%s_POLICYz"ACCEPT"z	UFW BLOCKz	UFW ALLOWz"REJECT"z"DROP"r   r   tmporigz5Default %(direction)s policy changed to '%(policy)s'
)	directionpolicyz*(be sure to update your rules accordingly))r;   rI   r   set_defaultr<   	Exceptionrecompiler   util
open_filessearchwrite_to_filesubclose_files)r:   rZ   rY   err_msgrA   old_log_strnew_log_strpatffnsfdlinerK   s                rB   set_default_policyz%UFWBackendIptables.set_default_policy^   s   {{ Vv%5&H:L56&Aw''J&9
+BH$CD&(w''EJ& h&!KK $$TZZ
%;,?5,I,8:
 *)8#$$TZZ
%;,?5,I,8:
 *)$$TZZ
%;,?5,I,68
 *) **S;./Cjj/N1KL ((--a0C ZK 9Dzz$'..r377;3MN..r48	9HH((-$ IJ )V<>>??_ !  !  !  !  ! s<   9#H '#H #H  1H.H<HH H+.H9<Ic                 2   | j                   r!dt        d      z   }|dt        d      z   z  }|S | j                          g d}g }g }|dk(  r|j                  d       g d}g d}n|d	k(  rd
D ]*  }|j                  d|z         |j                  d|z         , dD ]*  }|j                  d|z         |j                  d|z         , dD ]*  }|j                  d|z         |j                  d|z         , dD ]  }|j                  d|z          n|dk(  r1dD ]*  }|j                  d|z         |j                  d|z         , n|dk(  rdD ]*  }|j                  d|z         |j                  d|z         , | j                  d   d   r"|j                  d       |j                  d       | j                  d   d   r |j                  d       |j                  d       n|d k(  r0dD ]*  }|j                  d!|z         |j                  d"|z         , n|d#k(  rdD ]z  }|j                  d$|z         |j                  d%|z         |j                  d&|z         |j                  d'|z         |j                  d(|z         |j                  d)|z         | |j                  d*       |j                  d+       |j                  d,       |j                  d-       d.|z  }|D ]  }d/|v r?|j                  d/      \  }	}|d0|	z  z  }t        | j                  g|z   |d|	gz         \  }
}n t        | j                  g|z   |gz         \  }
}||z  }|dk7  r|d1z  }|
d2k7  s{t        |       |dk(  s| j                         r|d3z  }|D ]  }d/|v r?|j                  d/      \  }	}|d0|	z  z  }t        | j                  g|z   |d|	gz         \  }
}n t        | j                  g|z   |gz         \  }
}||z  }|dk7  r|d1z  }|
d2k7  s{t        |       |S )4z'Show current running status of firewall> zChecking raw iptables
zChecking raw ip6tables
)-nz-vz-x-Lrawz-t)filternatmanglerr   )rs   ru   rr   builtins)rS   rU   rT   z	filter:%s)
PREROUTINGrS   rU   rT   POSTROUTINGz	mangle:%s)rw   rT   zraw:%s)rw   rx   rT   znat:%sr   )r    r"   r!   zufw-before-%szufw6-before-%sr   ufw-user-%sufw6-user-%sr%   r   zufw-user-limit-acceptufw-user-limitr   zufw6-user-limit-acceptufw6-user-limitr   zufw-after-%szufw6-after-%sloggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyzIPV4 (%s):
:z(%s) 
r   z

IPV6:
)r;   rI   initcapsr7   capssplitr   r   r   r6   	ip6tables)r:   
rules_typeoutargsitemsitems6cbitrcrW   s               rB   get_running_rawz"UFWBackendIptables.get_running_raw   s\   ;;455C4!6777CJ 	'KK6E0F:%3 /[1_-kAo./% /[1_-kAo./ . ,X\*hl+, = +X\*+8#3 4_q01.234 6!3 2]Q./nq012 yy!#&45-.yy!#&67/07"3 3^a/0o123 9$3 ;4q896:;2Q674q893a7859:; LL,-LL+,MM./MM-.
+ 	$AaxAw!}$$ 6!T1 EF	S$ 6! <=	S3JCU"tQwsm#	$ $--/= C (!8WWS\FQ7a=(C #T]]Od$:aq\$I JIR #T^^$4t$;qc$A BIRs
&4KC7"3-'( 
rC   c           	         d}| j                   r1dt        d      z   }| j                         r|dt        d      z   z  }|S t        d      }dD ]  }t        | j                  dd|z  d	g      \  }}|d
k(  rt        d      c S |dk7  rt        |d|z  z         | j                         s[t        | j                  dd|z  d	g      \  }}|dk7  st        |dz          d}d}	d}
| j                  | j                  z   }d
}i }|D ]  }d}i }d}d}|sH|j                  dk7  s|j                  dk7  r*d}|j                         }||v rt        d|z         Qd||<   dD ]  }d||<   d}d}|dk(  rM|j                  }|s2|j                  dk7  r#|j                  }|j                  rd|dk(  r_|dz  }nY|j                  }nL|j                   }|s2|j                  dk7  r#|j                  }|j                  r|dk(  r|dz  }n|j"                  }|dk7  r
|dk7  r|||<   |dk7  r||   dk(  r|||<   n||xx   d|z   z  cc<   |r)|j$                  dk7  r||xx   d|j$                  z   z  cc<   |r|dk(  rT|j                  dk7  rE||xx   d|j                  z  z  cc<   |j                  r|dk(  r||xx   dz  cc<   ||xx   dz  cc<   |dk(  rT|j                  dk7  rE||xx   d|j                  z  z  cc<   |j                  r|dk(  r||xx   dz  cc<   ||xx   dz  cc<   |dk(  r|dk(  s|dk(  rud||<   |r[|j$                  dk7  rL|j                  |j                   k(  r3|j                  |j"                  k(  r||xx   d|j$                  z   z  cc<   |dk(  r||xx   dz  cc<   n|r|j$                  dk7  rr|j                  |j"                  k(  rY||xx   d|j$                  z   z  cc<   n>|j                  r2|j                   dk(  r#|j                  dk(  rd||   vr||xx   dz  cc<   |j&                  rb|dk(  r)|j(                  dk7  r||xx   d|j(                  z  z  cc<   |dk(  s|j*                  dk7  s||xx   d|j*                  z  z  cc<   1|dk(  r)|j(                  dk7  r||xx   d|j(                  z  z  cc<   |dk(  sf|j*                  dk7  sw||xx   d|j*                  z  z  cc<    g }d}|j,                  s|j.                  j1                         d k(  r|j,                  r)|j3                  |j,                  j1                                |r*|j.                  d k(  r|j3                  |j.                         t5        |      dkD  rd!d"j7                  |      z  }|r|d#|z  z  }|j.                  j9                         }|j&                  rd$}|j.                  d%k(  r|j&                  s|s|sd}d}|j:                  dk7  rd&|j=                         z  }||d   d'ddj7                  |j>                  j9                         |g      d(|d   d'||d)z  }|r||z  }n,|j&                  r|
|z  }
n|j.                  d k(  r|	|z  }	n||z  }|d
z  } |dk7  s
|	dk7  s|
dk7  rd*}|r|d+z  }t        d,      }t        d-      }t        d.      }d/}||||fz  }|r|d+z  }||d0t5        |      z  d0t5        |      z  d0t5        |      z  fz  z  }||z  }|dk7  r||z  }|dk7  r|	dk7  r|t        d)      z  }|	dk7  r||	z  }|dk7  r|
dk7  r|t        d)      z  }|
dk7  r||
z  }|}|ru| jA                         \  } }!t        d1      | jC                         | jC                  d2      | jC                  d3d      d4z  }"| jE                         }#t        d5      |!|"|#|d6z  S t        d7      |z  S )8zShow ufw managed rulesrV   ro   zChecking iptables
zChecking ip6tables
problem runningr   rq   ry   rp      zStatus: inactiver   z iptables: %s
rz   
 ip6tablesTFzSkipping found tuple '%s')dstsrcr   z::/0 (v6)z	0.0.0.0/0any /z (%s)r   Anywherez on %sr   z (%s)z, z[%2d] FWDinz # %s2612r   z

z     ToFromActionz%-26s %-12s%s
r#   zCDefault: %(in)s (incoming), %(out)s (outgoing), %(routed)s (routed)r!   r"   )r   r   rR   z0Status: active
%(log)s
%(pol)s
%(app)s%(status)s)logpolappstatuszStatus: active%s)#r;   rI   r6   r   r   r   r   r   r   dappsappget_app_tupler   r   v6dportr   sportprotocolr"   interface_ininterface_outlogtyperY   lowerr7   lenr0   uppercommentget_commentactionget_loglevel_get_default_policyrL   )$r:   verbose
show_countr   re   rY   r   out6sstr_outstr_rter   count	app_rulesrtmp_strlocationtupl
show_protor?   portrW   attribs
attrib_strdir_strr,   full_strstr_tostr_from
str_actionrules_header_fmtrules_headerlevellogging_str
policy_strapp_policy_strs$                                       rB   
get_statuszUFWBackendIptables.get_status  s   ;;011C}}ta 6777J%&7 	;IT]]D)Y7? @IRQw+,,qw):c)BBCC}} $..$!/9!=t"E F
T7"7\#9::	; 

T[[(	 T	AGHDJ"""
(9$5>?&*IdO' XF "%<%%C"qvv| vv44C6M GOD ww%%C"qvv| vv44C6M GOD ww+%#-$'HSM5=}*(, t3!ajjE&9 qzz)99%<AFFbL$SMVqvv->>M ttv ( 8$SMS0M%<AFFbL$SMVqvv->>M ttv ( 8$SMS0M5=k)SF](2 &!***=55AEE>agg.@$SMS1::-==M&=$SMW4M &!***=77agg-$SMS1::-==MTTaeevo!%%6/hsm3 SMW,M 99e|"(< Q^^)DDe|2(= Q__)EEe|"(< Q^^)DDe|2(= Q__)EEqXFt GJyyAKK--/5899NN199??#45!++"6NN1;;/w<!#!(DIIg,>!?J 8u--kk'')Gyy{{d"199:KyyB%78E?03!((..:J:A:C 1D080;	= =G W99w&G[[E)w&GLAQJEiT	l 7gmw"}HG#tWFyH8J0+vz8.LLL', 3v;. 3z?2 3x=022 2L
 $HBwABw7b=AdG#"}G#Bw7b=AdG#"}G#A#'#4#4#6 UK 1 2 &*%=%=%?&*&>&>x&H)-)A)A)BF*HIJJ "@@BNJK)*,;< < '(A..rC   c                    | j                   rt        dt        d      z          yg }|j                  | j                  d          | j
                  d| j                  X|j                  d       |j                  | j
                         |j                  d       |j                  | j                         |j                  d       t        |      \  }}|dk7  rt        d	|z        }t        |      y)
zStop the firewallro   running ufw-initr   N	--rootdir	--datadirz
force-stopr   problem running ufw-init
%s)	r;   r   rI   r7   r<   r   r   r   r   r:   r   r   r   re   s        rB   stop_firewallz UFWBackendIptables.stop_firewall  s    ;;q+,,-DKK

6*+||'DLL,DK(DLL)K(DLL)KK%D	IRQw:S@Aw'' rC   c                 V   | j                   rt        dt        d      z          yg }|j                  | j                  d          | j
                  d| j                  X|j                  d       |j                  | j
                         |j                  d       |j                  | j                         |j                  d       t        |      \  }}|dk7  rt        d	|z        }t        |      d
| j                  vs2| j                  d
   t        | j                  j                               vr	 | j                  d       y	 | j                  | j                  d
          y# t        $ r t        d      }t        |      w xY w# t        $ r t        d      }t        |      w xY w)zStart the firewallro   r   r   Nr   r   startr   r   loglevellowzCould not set LOGLEVELzCould not load logging rules)r;   r   rI   r7   r<   r   r   r   r   rJ   list	loglevelskeysset_loglevelr\   update_loggingr   s        rB   start_firewallz!UFWBackendIptables.start_firewall  sg   ;;q+,,-DKK

6*+||'DLL,DK(DLL)K(DLL)KK D	IRQw:S@Aw''.}}Z(T^^5H5H5J0KK,%%e,
,''j(AB ! , 89G"7++, ! , >?G"7++,s   3E% F % F F(c                 D   | j                   ry| j                          d}| j                  }|rd}| j                  }dD ]`  }|dk(  s|dk(  r*|r| j                  d   d   s"|s| j                  d   d   s7t        |d	d
|dz   |z   g      \  }}|dk7  sUt        d        y y)zCheck if all chains existFr   ufw6)r    r!   r"   r%   limit-acceptr%   r   r   r   rp   rq   -user-r   z_need_reload: forcing reloadT)r;   r   r   r   r   r   r   )r:   r   prefixexerA   r   r   s          rB   _need_reloadzUFWBackendIptables._need_reload  s    ;; 	mmF..CN 
	E5N#:dii05DIIg$6s$;S$fx.?%.GHIIRQw45
	 rC   c                 f   t        d      }| j                  r(t        d       | j                         rt        d       yy| j	                         r	 | j
                  d   D ]*  }| j                  |d|g       | j                  |d|g       , 	 t        d| j                  d   g| j                  d	g      \  }}|d
k7  rt        |dz         | j                         r>t        d| j                  d   g| j                  d	g      \  }}|d
k7  rt        |dz         yyy# t        $ r t        |      w xY w)zReload firewall rules filer   z> | iptables-restorez> | ip6tables-restorer   -F-Zcatr   rp   r   z	 iptablesr   r   N)rI   r;   r   r6   
is_enabledr5   
_chain_cmdr\   r   r	   r<   iptables_restoreip6tables_restore)r:   re   r   r   r   s        rB   _reload_user_rulesz%UFWBackendIptables._reload_user_rules:  s=   %&;;&'}}+, __(V, 2AOOAay1OOAay12 !%G)<!="&"7"7!>@IRQww455}}$eTZZ-A%B&*&<&<d%CE	S7"7\#9::     (w''(s   <D D0c                    g }t        j                  d      }t        j                  d      }t        j                  d      }|j                  |      r|j                  |      r|j                  |      r2|j                  |j	                  d|j	                  d|                   n!|j                  |j	                  d|             |j                  |j	                  d|             n3|j                  |j	                  d|             n|j                  |       t        j                  d      }t        j                  d	      }	t        j                  d
      }
d}t        |      D ]=  \  }}|j                  |      s|j	                  d|      j                         }|j                         dk(  rd}n|j                         dk(  rd}nd}|d|d}|	j                  |      sd|z   }|j	                  d|      ||<   |j                  ||j	                  d|z   dz   |z   |             |j                  ||
j	                  d|z   dz   |z   |j	                  d|                   |j                  ||
j	                  d|z   dz   |z   |j	                  d|z   |                   @ t        j                  d      }t        |      D ]  \  }}|j                  |      s|j	                  d|      }|j	                  d|z   dz   |      }|j	                  d|z   d z   |      }|||<   |j                  ||       |j                  ||        |S )!z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z-j \1 --reject-with tcp-resetz-p udp rV   z(.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10\2rF   ALLOWr%   LIMITBLOCKz -j LOG --log-prefix "[UFW ] "z-m conntrack --ctstate NEW z	\1-j \2\4z\1-j z-user-logging-z\1 z\1-j RETURN\1z	 -j LIMITz+ -m conntrack --ctstate NEW -m recent --setzL -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j z-user-limitz -j z-user-limit-accept)	r]   r^   ra   r7   rc   	enumeratestripr   insert)r:   fruler   suffixsnippets	pat_protopat_port
pat_rejectpat_log
pat_logall	pat_chain
limit_argsr   r   rZ   lstr	pat_limittmp1tmp2tmp3s                       rB   _get_rules_from_formattedz,UFWBackendIptables._get_rules_from_formattedV  s+    JJz*	::h'ZZ <=
E"u%$$U+OOIMM)"'G%  ! OOIMM)U$CD	i ?@	b% 89OOE" **>?ZZ 45
JJ:;	>
h' 	PDAq~~a  UA.446<<>X-$F\\^w.$F$F?I!((+84?D%kk,:7;;x&/@/?0@BH0IJK$M N9==&1A2BDJ2K18^1224$5 6 9==&1A2BDJ2K18UT\11M$O P+	P4 JJ|,	h' 
	)DAq" }}%R%&( }} &,.4&57D&EFGI !}}Vf_7K%KQO"4(4(
	) rC   c                    g }| j                  |||      }t        j                  d      }t        |      D ]  \  }}|j	                  |j                  d|      j                                |j                  |      sG||   j	                  d       ||   j	                  |j                  d|      j                  dd             ||xx   |j                  d|      j                         z  cc<    |S )z_Return list of iptables rules appropriate for sending as arguments
           to cmd()
        z(.*) --log-prefix (".* ")(.*)r   r)   r   "rV   z\3)	r  r]   r^   r   r7   rc   r   matchreplace)	r:   r   r   r   r  str_snippetsrh   r   r   s	            rB   _get_lists_from_formattedz,UFWBackendIptables._get_lists_from_formatted  s     55eVVL jj9:l+ 	9DAqOOCGGE1-3356yy|"">2""3775!#4#<#<S"#EFswwua06688	9 rC   c                    | j                   d   g}| j                         r|j                  | j                   d          |D ]  }	 t        j                  j                  |      }t        j                  d      }t        j                  d      }t        j                  d      }|D ]K  }|}	d}
d|v r$|j                  d      \  }	}|j                         }
|j                  |	      sB|j                  d|	      }t        j                  d	|j                               }t        |      d
k  st        |      dkD  rt        d      |z  }t!        |       d}d}d}t        |      dk(  st        |      dk(  rt        d      |z  }|d   j                  d      d   }d|d   v rd|d   v r{|j#                  |d         rg|j#                  |d         rS|d   j                  d      d   j%                  d      d   }|d   j                  d      d   j%                  d      d   }ne|d   j'                  d      r|d   j%                  d      d   }n9|d   j'                  d      r|d   j%                  d      d   }nt!        |       	 |d   }d}d|v rd}|j                  d      d   }t        |      dk  r#t)        ||d   |d   |d   |d   |d   |||
	      }n{t)        ||d   |d   |d   |d   |d   |||
	      }t        j                  d      }|d
   d k7  r|j                  d!|d
         |_        |d   d k7  r|j                  d!|d         |_        |dk7  r|j/                  d|       |dk7  r|j/                  d"|       || j                   d   k(  r.|j1                  d       | j2                  j                  |        |j1                  d       | j4                  j                  |       N |j7                           y$# t        $ r t        d      |z  }t        |      w xY w# t        $ r t        d#      |z  }t!        |       Y w xY w)%z$Read in rules that were added by ufwr   r   zCouldn't open '%s' for readingz^### tuple ###\s*zin_\w+zout_\w+rV   z	 comment=z\s+   	   z)Skipping malformed tuple (bad length): %sr      z$Skipping malformed tuple (iface): %srI   r   !   r   in_out_Fr~   T            %20r#   r   r   zSkipping malformed tuple: %sN)r<   r6   r7   r   r_   open_file_readr\   rI   r   r]   r^   r   r   r  rc   r   r   ra   	partition
startswithr   r   r   set_interfaceset_v6r   r   close)r:   rfnsri   rX   re   	pat_tuplepat_iface_inpat_iface_out	orig_linerl   r   hexr   rW   wmsgdtyper   r   r   r"   rule	pat_spacewarn_msgs                          rB   _read_ruleszUFWBackendIptables._read_rules  sJ   

7#$==?KK

8,- ]	A(xx..q1
 

#78I::i0LJJz2M! Q4	 )+ ) =ID#!iikG??4($==T2D((64::<8C3x!|s3x!| !LM$( *T
  !%')(*s8q=CHM#$%K#L(,$.D$'GMM#$6q$9E"c"g~#&#b'>#/#6#6s2w#?#0#7#7B#@ ),Bc(:1(=(G(G(LQ(O %1 ),Bc(:1(=(G(G(LQ(O %2%(W%7%7%>36r73D3DS3I!3LL%(W%7%7%?47G4E4Ec4J14MM$(J$,%%(VF&+G"f}*.)/c):1)="3x!|'.vs1vs1vs1v/21vs1vug/6(8 (/vs1vs1vs1v/21vs1vug/6(8 -/JJu,=	#&q6S=09c3q60JDI#&q6S=09c3q60JDI+r1 $ 2 24 F,2 $ 2 25- H 

8 44 KK- KK..t4 KK. JJ--d3cQ4f JJL{]	  (<=Cw''(\  ( %'()G'H)-(/H N$	%s   P	C;P/	#P,/"QQc                 "   | j                   d   }|r| j                   d   }t        j                  |t        j                        st	        d|z        }t        |      	 t        j                  j                  |      }| j                          d}| j                  }|rd}| j                  }| j                  rt        j                  j!                         }n|d   }t        j                  j#                  |d       t        j                  j#                  |d|z   d	z          t        j                  j#                  |d|z   d
z          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          |dk(  r| j$                  d   d   s|dk(  r^| j$                  d   d   rLt        j                  j#                  |d|z   dz          t        j                  j#                  |d|z   dz          t        j                  j#                  |d       |D ]  }|j&                  }	|j(                  rd|j&                  z   }	|j*                  dk7  r|	d|j*                  z   z  }	d}
|j,                  dk(  r|j.                  dk(  r|j0                  }
n|j,                  dk7  r,|j.                  dk7  rd |j,                  d!|j.                  }
nL|j,                  dk7  r|
|j0                  d|j,                  z  }
n|
|j0                  d|j.                  z  }
|j2                  dk(  r|j4                  dk(  rd"|	d#|j6                  d#|j8                  d#|j:                  d#|j<                  d#|j>                  d#|
}|j@                  dk7  r|d$|j@                  z  z  }t        j                  j#                  ||d%z          ntC        jD                  d#      }d&}|j2                  r|jG                  d'|j2                        }d&}|j4                  r|jG                  d'|j4                        }d"|	d#|j6                  d#|j8                  d#|j:                  d#|j<                  d#|j>                  d#|d#|d#|
}|j@                  dk7  r|d$|j@                  z  z  }t        j                  j#                  ||d%z          d(}|j(                  rd)}n|j0                  d*k(  rd+}|d,|}d-|d#|jI                         d%}| jK                  |||      D ]"  }t        j                  j#                  ||       $ " t        j                  j#                  |d.       t        j                  j#                  |d/       	 | jM                  | jN                  d0         }|D ]  \  }}}tQ        |      d1kD  r	|d1   d2k(  r|jS                  |d&z         s3t        j                  j#                  |d#jU                  |      jW                  d3d4      jW                  d5d6      d%z           t        j                  j#                  |d7       |dk(  r| j$                  d   d   s|dk(  r| j$                  d   d   rt        j                  j#                  |d8       | jN                  d0   d9k7  rUt        j                  j#                  |d-|z   d:z   d#jU                  | jX                        z   d;z   | jZ                  z   d<z          t        j                  j#                  |d-|z   d=z          t        j                  j#                  |d-|z   d>z          t        j                  j#                  |d?       t        j                  j#                  |d@       	 | j                  r!t        j                  j]                  |dA       yBt        j                  j]                  |       yB# t        $ r  w xY w# t        $ r  w xY w# t        $ r  w xY w)Cz.Write out new rules to file to user chain filer   r   z'%s' is not writabler   r   rW   z*filter
r~   z-user-input - [0:0]
z-user-output - [0:0]
z-user-forward - [0:0]
z-before-logging-input - [0:0]
z-before-logging-output - [0:0]
z -before-logging-forward - [0:0]
z-user-logging-input - [0:0]
z-user-logging-output - [0:0]
z-user-logging-forward - [0:0]
z-after-logging-input - [0:0]
z-after-logging-output - [0:0]
z-after-logging-forward - [0:0]
z-logging-deny - [0:0]
z-logging-allow - [0:0]
r%   r   r   z-user-limit - [0:0]
z-user-limit-accept - [0:0]
z### RULES ###
zroute:rV   rI   r  z!out_z
### tuple ### r   z comment=%sr   r#   r"  r    r"   r   r!   r   z-A z
### END RULES ###
z
### LOGGING ###
r   r   -D[z"[z] r   z### END LOGGING ###
z
### RATE LIMITING ###
offz-user-limit z "z "
z-user-limit -j REJECT
z-user-limit-accept -j ACCEPT
z### END RATE LIMITING ###
zCOMMIT
FN)/r<   r.   accessW_OKrI   r   r   r_   r`   r\   r   r   r   r;   sysstdoutfilenorb   r   r   r"   r   r   r   rY   r   r   r   r   r   r   r   r   r]   r^   rc   format_ruler  _get_logging_rulesrJ   r   r%  r0   r  r8   r9   rd   )r:   r   
rules_filere   rj   r>   r   rk   r   r   ifaceststrr2  r   r   chain_suffixrA   rule_strr   lrules_tr   qs                         rB   _write_ruleszUFWBackendIptables._write_rules  sV   ZZ(
H-J yyRWW-.*=>G7##	((%%j1C
 	

!LKKE;;""$BUB 	r;/r3#58O#OPr3#5)A$B 	Cr3#5)B$C 	D 	r3#5)J$K 	Lr3#5)K$L 	Mr3#5)L$M 	Nr3#5)H$I 	Jr3#5)I$J 	Kr3#5)J$K 	Lr3#5)I$J 	Kr3#5)J$K 	Lr3#5)K$L 	Mr3#5)B$C 	Dr3#5)C$D 	E E!dii&8&=F"tyy'9#'>HH""2s\'9-D(E FHH""2s\'9-K(L M 	r#45  3	.AXXFyy!AHH,yyB#		/)F~~#2(=2%!//R*?+,>>1??K>>R'annEEFaooFFFvv|"ajj!''155!''155 99?MAII55D&&r4$;7JJsO	66$==7D66$==7D

AGGQUUAGGQUUdF, 99?MAII55D&&r4$;7"Lyy(%'$0,?E',ammo>H33Hl4@B .&&r1-.c3	.l 	r#:; 	r#89	..t}}Z/HIH   	GAq!1vzaddl||L3./&&rHHQK''T2::4G		 	r#:; E!dii&8&=F"tyy'9#'>HH""2'BC}}Z(E1&&r5%,&(6,7$"9"9:,; , "&!=!=,> AH,H I HH""2u|';2(3 4HH""2u|';9(: ;HH""2'DEr:.	{{$$S%0$$S)o  		n  		B  		s*   e' e5 ,f f 'e25f fc                 d   | j                          d}|j                  r_| j                         st        d      }t	        |      |j
                  dk(  rc| j                  d   d   sQt        d      |j
                  z  S |j
                  dk(  r*| j                  d   d   st        d      |j
                  z  S |j                  r4|j                  dk7  r%|j                  d	k7  rt        d
      }t	        |      g }d}d}| j                  }|j                  }	|j                  rD| j                  dk  r)|j                  dk7  s|j                  dk7  rt        d      S | j                  }|	dk  s|	t        |      kD  rt        d      |	z  }t	        |      |	dkD  r"|j                   rt        d      }t	        |      	 |j#                          d}
d}d}d}|D ]f  }	 |j#                          |j&                  |j(                  |j                  |j                  f}|
|	k(  rS|d   dk(  r|d   dk(  r|
dkD  s|d   dk(  r|d   dk(  s||k7  r$d}|j+                  |j-                                d}n|	dz  }	|}|
dz  }
t/        j0                  ||      }|dk  r|dz  }|dk(  r3|s1|s/d}|j                   r|j+                  |j-                                |dk(  r|j                   r|j2                  dk(  rd}|dk  r3|j                   s'|s%d}d}|j+                  |j-                                V|j+                  |       i |r#|dkD  rt        d      }|j                  r|dz  }|S |s+|j                   s|j+                  |j-                                |s6|j                   r*| j4                  st        d      }|j                  r|dz  }|S |r,|j                   s |st        d      }|j                  r|dz  }|S |j                  r|| _        n|| _	        	 | j7                  |j                         t        d      }|j                  rt        d      }| j9                         rj| j4                  s]d}|s| j;                  |j                        s|rUd}|r|t        d      z  }n|t        d      z  }|j                  r|dz  }|r	 | j=                          n}|t        d       z  }nn|rO|j                   rCd!}t        d"      }|j                  r|dz  }|r	 | j=                          d}n,|t        d       z  }n|s|s|j                   sd#}t        d$      }|dk7  rs| j>                  }d%}|j                  r| j@                  }d&}|dz  }d'}|jB                  rd(}n|jD                  d)k(  rd*}|d+|}t        d,      }tG        |d-|d.g      \  }}|dk7  rt	        |      |d/|d/|jI                         }tK        jL                  d0      }| jO                  |||      D ]  }tG        |g|z         \  }}|dk7  r%tQ        |tR        jT                         t	        |       |d#k(  sE|jW                  d/jY                  |            sf|j[                  d1d/jY                  |            }tG        |d!|d2d3g      \  }}|dk7  st]        d4|z          |S # t$        $ r  w xY w# t$        $ r  w xY w# t        $ r  t$        $ r t        d      }t	        |       Y w xY w# t$        $ r  w xY w# t$        $ r  w xY w)5aX  Updates firewall with rule by:
        * appending the rule to the chain if new rule and firewall enabled
        * deleting the rule from the chain if found and firewall enabled
        * inserting the rule if possible and firewall enabled
        * updating user rules file
        * reloading the user rules file if rule is modified
        rV   z)Adding IPv6 rule failed: IPv6 not enabledr%   r   z#Skipping unsupported IPv6 '%s' ruler   z#Skipping unsupported IPv4 '%s' ruleudptcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4r   zInvalid position '%d'z Cannot specify insert and deleter   )rV   rV   rV   rV   r  r  Tz Skipping inserting existing ruler   z"Could not delete non-existent rulezSkipping adding existing rulezCouldn't update rules filezRules updatedzRules updated (v6)zRule insertedzRule updatedz (skipped reloading firewall)r6  zRule deleted-Az
Rule addedr   r   r    r"   r   r!   r   !Could not update running firewallrq   rp   r   z(-A +)(ufw6?-user-[a-z\-]+)(.*)r   r'   RETURNzFAILOK: -D %s -j RETURN)/r   r   r6   rI   r   r   r   multir   r   positioniptables_versionr   r   r   r   remove	normalizer\   r   r   r7   dup_ruler   r  r   r;   rG  r   r   r   r   r   r"   rY   r   r>  r]   r^   r  r   r;  stderrra   r0   rc   r   )r:   r1  allow_reloadrK   re   newrulesfoundmodifiedr   rP  r   insertedmatcheslastr   currentretflagr   r>   rC  rA   r   r   rD  r  r   r   s                               rB   set_rulezUFWBackendIptables.set_rule  s    	77==?GHw''{{g%dii.@.E>?4;;OO{{g%dii.@.E>?4;;OO::$--50T]]e5KIJG7##

==77$$u,$))r/26))r/UVVKKE a<8c%j0/0H=G7##a<DKK:;G7##	NN  ,	#A uuaeeQVVQVV4G  GrMd1gm	AJ"$r)97?#HOODMMO4+DMHDQJE--4(CQw1axh {{OODMMO4t{{t||r/AqX 0"Y,	#\ {;<77GOD 0 T[[=>77GODt{{88977GOD77"DK!DJ	dgg& !77)*D ??T[[D4,,TWW5Ao..DAn--D77GOD//1 A=>>D4;;( 77GOD//1 DA=>>D8DKKrzmm$77..C#)LGOD&<<#,L^^u,#+L(4lC ?@dE4 89	S7"7++)-ud6F6F6HI**%GH778D8DF CA !$SEAIIRQwC, ) t|sxx{(C#KKsxx{;$'dAtX(F$G	S7!";q"ABC [  		  T  	 	45GW	2 %   % sB   9[ [[' \ \$ [[$'(\\\!$\/c                 b   g }g }|r| j                   }n| j                  }|j                         }|j                  |       |j	                          |j                         }|D ]I  }|j                         }|j	                          |j                         }	|	|k(  s9|j                  |       K |S )z@Return a list of UFWRules from the system based on template rule)r   r   rT  r'  rS  r   r7   )
r:   templater   r   r   normr   r   rW   	tmp_tuples
             rB   get_app_rules_from_systemz,UFWBackendIptables.get_app_rules_from_system  s    	KKEJJE  "B!!# 	&A**,CMMO))+ID   %	& rC   c                     | j                   }|j                  d      r| j                  }t        |g|z         \  }}|dk7  r*t	        d|z        }|rt        d|z          yt        |      y)zPerform command on chainr   r   zCould not perform '%s'zFAILOK: N)r   r%  r   r   rI   r   r   )r:   rA   r   fail_okr   r   r   re   s           rB   r   zUFWBackendIptables._chain_cmd  sm    mmF#..C%	S70D9:Gj7*+w'' rC   c                    | j                   ry| j                          g }	 | j                  |      }	 | j	                  d       | j	                  d       | j                         syt        d      }| j                  d   | j                  d   z   | j                  d	   z   | j                  d
   z   D ]  }	 | j                  |d|dg        	 | j                  d   | j                  d	   z   | j                  d
   z   D ]*  }| j                  |d|g       | j                  |d|g       , 	 |D ]b  \  }}}d}t        |      dkD  r
|d   dk(  rd}	 |dk(  r)t        |      dkD  r| j                  |dg|dd z   d       | j                  |||       d dD ]  }| j                  d   d   r|dk(  s| j                  d   d   s-|dk(  s3| j                  |d|g| j                  z   | j                  dz   gz   d       | j                  d   dk7  sz| j                  |d|g| j                  z   | j                  dz   gz   d        y# t        $ r  w xY w# t
        $ r  t        $ r t        d      }t        |       Y 'w xY w# t        $ r t        |      w xY w# t        $ r t        |      w xY w# t        $ r t        |      w xY w)z#Update loglevel of running firewallNF)r   Tz&Couldn't update rules file for loggingrM  r   r   r   r   rq   rp   r   r   r   r6  delete_firstr   )rg  )r{   r|   r%   r   r{   r   r|   r   r   r8  -I)r;   r   r?  r\   rG  r   rI   r   r5   r   r   r   r8   r9   rJ   )	r:   r   rules_tre   r   r   rF  rg  rA   s	            rB   r   z!UFWBackendIptables.update_logging  s    ;; 		--e4G
	'&   78X&V)<<;;w "&++f"56 	(A(D!T?3	(	$[[*T[[-AA{{6"# .D!9-D!9-.  		(GAq!G1vzaddl(&3q6A:OOAv!"~tOD1g.		( ; 	2E		'"3'E5E,E		'"3'E5F,Fe} $ 7 7(8!%!=!=!C D(E )-   . ==,5OOED%=$($;$;,<%)%A%AC%G$H,I -1 $ 2	2e  		  	 	@AGW	  (w''(  	$7##	$  (w''(sB   I $I 6JAJ AJ2I(I?>I?JJ/2Kc                 &   g }|t        | j                  j                               vrt        d      |z  }t	        |      |dk(  r.| j
                  d   D ]  }|j                  |d|ddgdg        |S | j
                  d   D ]  }|j                  |d|ddgd	g        g d
}| j                  |   | j                  d   k\  rg }| j                  |   | j                  d   k  r|}| j
                  d   D ]  }dD ]  }|j                  |      s| j                  |      dk(  s| j                  |      dk(  r d}|j                  |d|ddd|g|z   d	g       ]| j                  |   | j                  d   k\  s}d}|j                  |d|ddd|g|z   d	g         g }| j                  |   | j                  d   k  r|}| j
                  d   D ]  }|j                  d      rd}ns|j                  d      rbd}| j                  |   | j                  d   k  r |j                  |d|ddddddg|z   d	g       n!|j                  |d|ddddddddg
|z   d	g       |j                  |d|dddg|z   d	g        | j                  |   | j                  d   k\  r|g }| j                  |   | j                  d   k  r|}| j                  |   | j                  d   k  rg d|z   }d }| j
                  d!   D ]  }|j                  |d|ddd|g|z   d	g       ! |S )"z%Get rules for specified logging levelzInvalid log level '%s'r8  r   rj  r'   rN  ri  r6  rV   )r$   r%   r&   z3/minz--limit-burst10r   highr   r   rH   rO   z[UFW BLOCK] rL  r(   r)   mediumz[UFW ALLOW] r   rN   r$   	conntrack	--ctstateINVALIDz[UFW AUDIT INVALID] full)r$   rp  rq  NEWz[UFW AUDIT] r   )	r   r   r   rI   r   r5   r7   endswithr   )	r:   r   rk  re   r   r  largsr   r   s	            rB   r?  z%UFWBackendIptables._get_logging_rules  s   T^^0023301U;G7##E> [[( OD!T8#<nMNON [[( CD!T8#<bABC P
 >>% DNN5$99E~~e$t~~f'=="[[) <7 <Azz!}33A6(B33A6&@%3F#NNAau0>0H050679,; < "^^E2dnnX6NN%3F#NNAau0>0H050679,; <<<  E~~e$t~~f'=="[[( J::g&+FZZ'+F~~e,t~~h/GGD!T;,7,0(,<>C,DEG(I J  D!T;,7,0%,:,B	,D
 ).,.
 02(3 4 D!T5$2F$<>C$DEG I J#J* >>% DNN8$<<E ~~e$t~~f'==" ~~e$t~~f'==?*L#F[[* JD!T5$2F$<>C$DEG I JJ rC   c           
         d}t        t        j                  j                  | j                        }g }| j
                  D ]  }| j
                  |   j                  d      s"|j                  | j
                  |          t        j                  j                  |dt        j                  j                  | j
                  |               }t        j                  j                  |      rt        d      |z  }t        |       t        j                   d      }|D ]A  }|d|}t        j                  j#                  |      s*t        d      |z  }t        |       |D ]P  }|d|}|t        d      t        j                  j                  |      |d	z  z  }t        j$                  ||       R |D ]  }|d|}t'        j(                  t        j                  j                  |dt        j                  j                  |            t        j                  j+                  |             t'        j,                  ||       	 t        j.                  |      }	|	t.        j0                     }
|
t.        j6                  z  r|t        d      |z  z  }|
t.        j8                  z  s|t        d      |z  z  } |S # t2        $ r t        d
      |z  }t5        |       Y -w xY w)zReset the firewallrV   z.rulesr   zCould not find '%s'. Abortingz%Y%m%d_%H%M%S.z'%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s'
)oldnewzCouldn't stat '%s'zWARN: '%s' is world writablezWARN: '%s' is world readable)r
   r   r*   	share_dirr   r<   ru  r7   r.   r/   r0   basenameisfilerI   r   timestrftimeexistsrenameshutilcopydirnamecopymodestatST_MODEr\   r   S_IWOTHS_IROTH)r:   resr{  allfilesr   fnre   extry  statinfomoder3  s               rB   resetzUFWBackendIptables.reseth  sp   cjj22DLLA	 	(A::a=))(3OODJJqM*i gg..tzz!}=?B77>>"%;<Cw''	( mmO,  	(As#Bww~~b!;<Cw''		(  	As#B1:;WW--a0<> >CIIa		  	?A$CKKY
%'WW%5%5a%8:*, OOC#771:- dll"q78A>>$q78A>>%	?( 
  12a8Xs   (J>>"K$#K$)NN)FF)F)T)__name__
__module____qualname____doc__r4   rL   rm   r   r   r   r   r   r   r  r  r4  rG  r`  re  r   r   r?  r   rC   rB   r   r      sx    '.;`IV[zc/J($,B8;8BH$cJgRcJ0(H2TXt8rC   r   )r  r.   r]   r  r  r;  r~  
ufw.commonr   r   ufw.utilr   r   r   r   r	   r
   ufw.backendr   r2   r3   r   r  rC   rB   <module>r     s@    3" 
 	   
  ( ? ? B// BrC   