3 \7j@s~dZddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z m Z ddl mZmZddlZGdddZdS)z&backend.py: interface for ufw backendsN)errorwarndebug _findpath)UFWErrorUFWRulec@seZdZdZd=ddZddZddZd d Zd>d dZddZ ddZ ddZ ddZ ddZ ddZddZddZdd Zd!d"Zd#d$Zd%d&Zd'd(Zd)d*Zd+d,Zd-d.Zd/d0Zd1d2Zd3d4Zd5d6Zd7d8Zd9d:Zd;d<ZdS)? UFWBackendzInterface for backendsNc CsJd|_||_||_g|_g|_ttjj|}t j j |dt j j |dt j j |dd|_ |dk rl|j j |ddddd d |_tjj|_|j|j|jtjj|j d |_t j j tjjd |_t j j tjjd |_t j j tjjd|_t j j tjjd|_ytjj|j|_Wn&tk r>td}t |YnXd|_!dS)Nz default/ufwz ufw/ufw.confzufw/applications.d)defaultsconfappsrdi,i)offlowZmediumZhighZfullr iptablesziptables-restore ip6tableszip6tables-restorez#Couldn't determine iptables version)"r namedryrunrulesrules6rufwcommonZ config_dirospathjoinfilesupdate loglevels do_checks _do_checks _get_defaultsZ _read_rules applicationsZ get_profilesprofilesZ iptables_dirrZiptables_restorerZip6tables_restoreutilZget_iptables_versionZiptables_versionOSError_rcaps)selfrrZ extra_filesZrootdirZdatadirperr_msgr*-/usr/lib/python3/dist-packages/ufw/backend.py__init__ sB       zUFWBackend.__init__cCs\|jdk rdSi|_i|jd<d|jdd<d|jdd<|joRtjdkoR|j rXytjj|j}Wn@t k r}z$d|}|j rt |t |dSd}~XnXd |krd |krd|jdd<nd|jdd<|j rXytjj|j}Wn0t k r$}zt d|WYdd}~XnXd |krJd |krJd|jdd<nd|jdd<dS) zgInitialize the capabilities database. This needs to be called before accessing the database.NlimitT4F6rz initcaps %sz recent-setz recent-update)r&rrgetuidrrr#Zget_netfilter_capabilitiesrr$ is_enabledrruse_ipv6r)r'Znf_capsemsgr*r*r+initcapsLs4   zUFWBackend.initcapscCs d|jkr|jddkrdSdS)z!Is firewall configured as enabledenabledyesTF)r )r'r*r*r+r1xs zUFWBackend.is_enabledcCs,d|jkr(|jddkr(tjjdr(dSdS)z"Is firewall configured to use IPv6Zipv6r7z/proc/sys/net/ipv6TF)r rrexists)r'r*r*r+r2s   zUFWBackend.use_ipv6inputFc Csd|d}d}|j|dkr$d}n|j|dkr8d}nd}|r|dkrd }td }tjjd d g\}}|d krxt|d|krd}|jrtjjd dg\}}|d krd|krd}tjjd dg\}}|d krd|krd}|sd}|S)z.Get default policy for specified primary chainZdefault_Z_policyacceptallowrejectdenyforwardFzproblem running sysctlZsysctlznet.ipv4.ip_forwardr1Tz net.ipv6.conf.default.forwardingznet.ipv6.conf.all.forwardingZdisabled)r r%rr#cmdrr2) r'ZprimaryZ check_forwardpolicyrstrr6r)Zrcoutr*r*r+_get_default_policys2  zUFWBackend._get_default_policycCs|jstd}t|dStjtjkr:td}t|tjtjkrZtd}t|tj}|dkrztd}t|i}i}i}g}tj j |j dstd|j d}t|nHt j d }x}|j |rjtj d|j }|dj j d|j|dj <qjW|jqWd d d g}x^dD]V}d||jkrtd|}t||jd|} | |krtd| |d}t|qWdS)z#Get all settings from defaults filer r zCouldn't open '%s' for readingz ^\w+="?\w+"?=z"'rr;Zdropr=r9outputr?zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')rBchainN)r9rmr?)r rrr#Zopen_file_readr\r%rrNrOrQsplitstriplowerclose) r'rIorigr)rhlinetmpZpoliciescr(r*r*r+r s.    $    zUFWBackend._get_defaultsc Cstjd|std}t|tj|tjs>td|}t|tjj |}|d}d}tj d|d}xH|dD]<} |j | rtjj ||d|d d }qrtjj || qrW|stjj ||d|d ytjj |Wntk rYnX|jjd |j|j<d S) zSets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writableruF^rkrs Tz"'N)rNmatchr%rraccessW_OKrr#Z open_filesrOrQZ write_to_fileZ close_filesr\rqrpr ) r'fnZoptvaluer)Zfnsfdfoundrhrtr*r*r+ set_default:s,    zUFWBackend.set_defaultcCs|js|dkr$|j|jdddnn|dkrB|j|jdddnP|dkr`|j|jdddn2|d kr~|j|jddd ntd |}t|td |}|S) z+Sets default application policy of firewallr<r ZDEFAULT_APPLICATION_POLICYz"ACCEPT"r>z"DROP"r=z"REJECT"skipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')rrrr%r)r'rBr)rCr*r*r+set_default_application_policy^s*      z)UFWBackend.set_default_application_policycCslg}t|jj}|j|ko$|j|krdtjj|j|j}tjj|j|j}x|D]}|j}d|_ |j ddtj j |\}} |j | |j |d|j |_ |j|jkrd|_tj j |\}} |j | |j |d|j|_|j|qXxj|D]b} |j} d| _tj j | \}} | j | | j |d| jdkrH| j |j|j| _|j| qWqXWn|j|krxtjj|j|jD]L} |j} d| _tj j | \}} | j | | j |d|j| _|j| qWnr|j|krJxdtjj|j|jD]L} |j} d| _ tj j | \}} | j | | j |d|j | _ |j| qWt|dkrhtd} t| |S)z4Return a list of UFWRules based on the template ruler:anysrcdstrlz&No rules found for application profile)rSr"keysZdportZsportrr!Z get_portsdup_ruledappset_portr#Zparse_port_proto set_protocolsapprRZprotocollenr%r)r'templaterZ profile_namesZdportsZsportsiruZportprotojruler(r)r*r*r+get_app_rules_from_templateysh                  z&UFWBackend.get_app_rules_from_templatec Cs`g}g}d}d}d}x|j|jD]}|j|ks:|j|kr|j}||krNq"q|j} | jd| jdkrx| j| jd| jdkr| j| jd|j| } x0| D](} | j | j r|j | q|j | qW|}d}q"|j r|j |q"|j |q"W|rX||_||_|t d|7}y|j d|j dWn&tk rVt d} t| YnX||fS) zUpdate rule for profile in place. Returns result string and bool on whether or not the profile is used in the current ruleset. r:FrrrTzRules updated for profile '%s'z!Couldn't update application rules)rrrr get_app_tuplerrrrZ normalizev6rRr%Z _write_rulesr\r) r'riZ updated_rulesZupdated_rules6Z last_tuplerCZupdated_profilertuplrZ new_app_rulesZnew_rr)r*r*r+update_app_rulesN       zUFWBackend.update_app_rulecCs||jkr|Sd}d}x2t|jjD] }|j|jkr&|}|d7}q&Wd||f}t||dkrj|S|dkrtd|}n td|}t|dS)z2Find the application profile name for profile_namer:rrlz'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s'N)r"rSrrqrr%r)r'Z profile_nameryZmatchesnZ debug_msgr)r*r*r+find_application_names$   z UFWBackend.find_application_namec CsD|r|t|jkrt| r2|t|jkr2t|dkr@tg}|rP|j}n|j}i}d}xXt|D]L\}}||krzPd}|jdks|jdkrh|j}||kr|d7}qhd||<qhWg}|r|j}|j|d|j} | j dn&|j}|j|d|j} | j dd} x,|D]$}t j || dkr2| S| d7} qWdS)a.Return the absolute position in the other list of the rule with the user position of the given list. For example, find_other_position(4, True) will return the absolute position of the rule in the ipv4 list matching the user specified '4' rule in the ipv6 list. rlrr:TF) rr ValueErrorr enumeraterrrrZset_v6rry) r'Zpositionrr app_rulesZ tuple_offsetrrrZ match_rulecountr*r*r+find_other_positionsF     zUFWBackend.find_other_positioncCs|d}td}d|jks.|jdt|jjkr@d}|td7}n4|j|jd}|dkrb|d7}n|d|jd7}||fS) z"Gets current log level of firewallrz Logging: loglevelrlunknownrzon (%s))r%r rSrr)r'levelrCr*r*r+ get_loglevelOs  zUFWBackend.get_loglevelcCs|t|jjdgkr,td|}t||}|dkr`d|jksP|jddkrVd}n |jd}|j|jdd||j||dkrtdStd Sd S) zSets log level of firewallZonzInvalid log level '%s'rrrr ZLOGLEVELzLogging disabledzLogging enabledN) rSrrr%rr rrupdate_logging)r'rr)Z new_levelr*r*r+ set_loglevel_s    zUFWBackend.set_loglevelcCs |j|jS)zReturn list of all rules)rr)r'r*r*r+ get_rulesuszUFWBackend.get_rulescCsxg}|r|j}n|j}d}i}xT|D]L}d}|jdks@|jdkrh|j}||kr`td|q$nd||<|d7}q$W|S)z/Return number of ufw rules (not iptables rules)rr:zSkipping found tuple '%s'Trl)rrrrrr)r'rrrrrrr*r*r+get_rules_countys    zUFWBackend.get_rules_countcCsz|j}d}i}xd|D]\}d}|jdks2|jdkrZ|j}||krRtd|qnd||<|t|krj|S|d7}qWdS)z:Return rule specified by number seen via "status numbered"rlr:zSkipping found tuple '%s'TN)rrrrrint)r'Znumrrrrrr*r*r+get_rule_by_numbers    zUFWBackend.get_rule_by_numbercCsBg}d}x4|jD](}|d7}|j|}|dkr|j|qW|S)zmSee if there is a matching rule in the existing ruleset. Note this does not group rules by tuples.rrl)rZfuzzy_dst_matchrR)r'rZmatchedrrZretr*r*r+ get_matchings zUFWBackend.get_matchingcCs tddS)z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to overrideN)r)r'rB directionr*r*r+set_default_policyszUFWBackend.set_default_policycCs tddS)zGet status of running firewallz,UFWBackend.get_running_raw: need to overrideN)r)r'Z rules_typer*r*r+get_running_rawszUFWBackend.get_running_rawcCs tddS)zGet managed rulesz'UFWBackend.get_status: need to overrideN)r)r'verboseZ show_countr*r*r+ get_statusszUFWBackend.get_statuscCs tddS)zUpdate firewall with rulez%UFWBackend.set_rule: need to overrideN)r)r'rZ allow_reloadr*r*r+set_ruleszUFWBackend.set_rulecCs tddS)zStart the firewallz+UFWBackend.start_firewall: need to overrideN)r)r'r*r*r+start_firewallszUFWBackend.start_firewallcCs tddS)zStop the firewallz*UFWBackend.stop_firewall: need to overrideN)r)r'r*r*r+ stop_firewallszUFWBackend.stop_firewallcCs tddS)z%Get a list if rules based on templatez.UFWBackend.get_app_rules_from_system: need to overrideNz6UFWBackend.get_app_rules_from_system: need to override)r)r'rrr*r*r+get_app_rules_from_systemsz$UFWBackend.get_app_rules_from_systemcCs tddS)z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrideN)r)r'rr*r*r+rszUFWBackend.update_loggingcCs tddS)zReset the firewallz"UFWBackend.reset: need to overrideN)r)r'r*r*r+resetszUFWBackend.reset)NNN)r9F) __name__ __module__ __qualname____doc__r,r5r1r2rErr rrrrrrrrrrrrrrrrrrrrrr*r*r*r+rs< +, &p$D><r)rrerr]rNrZrVZufw.utilrrrrrZ ufw.commonrrZufw.applicationsrr*r*r*r+s