File: //usr/lib/python3/dist-packages/ufw/__pycache__/common.cpython-39.pyc
a
���_X � @ sj d Z ddlZddlZddlZddlmZ dZdZdZeZ dZ
dZ d Z d
Z
G d d � d e�ZG d
d� d�ZdS )z!common.py: common classes for ufw� N)�debug�ufwz/lib/ufwz/usr/share/ufwz/etcz/usrz /usr/sbinTc @ s e Zd ZdZdd� Zdd� ZdS )�UFWErrorz$This class represents ufw exceptionsc C s
|| _ d S �N)�value)�selfr � r �,/usr/lib/python3/dist-packages/ufw/common.py�__init__# s zUFWError.__init__c C s
t | j�S r )�reprr �r r r r �__str__& s zUFWError.__str__N)�__name__�
__module__� __qualname__�__doc__r
r
r r r r r ! s r c @ s� e Zd ZdZd9dd�Zd d
� Zd d � Zd
d� Zdd� Zdd� Z d:dd�Z
dd� Z dd� Z dd� Z
d d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Zd8S );�UFWRulez$This class represents firewall rules�any� 0.0.0.0/0�inF� c
C s� d| _ d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _|| _d| _zV| �|� | �|� | �|� | �|d� | �|� | �|� | �|� | �| � W n ty� � Y n0 d S )NFr r �src)�remove�updated�v6�dstr �dport�sport�protocol�multi�dapp�sapp�action�position�logtype� interface_in�
interface_out� direction�forward�comment�
set_action� set_protocol�set_port�set_src�set_dst�
set_direction� set_commentr )
r r" r r r r r r' r( r) r r r r
, s<
zUFWRule.__init__c C s | � � S r )� format_ruler r r r r
O s zUFWRule.__str__c C s> d| }t | j�}|�� |D ]}|d|| j| f 7 }q |S )zPrint rule to stdoutz'%s'z, %s=%s)�list�__dict__�sort)r �res�keys�kr r r � _get_attribR s
zUFWRule._get_attribc C s� t | j| j�}| j|_| j|_| j|_| j|_| j|_| j|_| j |_ | j
|_
| j |_ | j |_ | j
|_
| j|_| j|_| j|_| j|_| j|_| j|_|S )z Return a duplicate of a rule)r r" r r r r r r r r r r r! r# r$ r% r& r' r( r) )r �ruler r r �dup_rule[ s& zUFWRule.dup_rulec C s� d}| j dkr |d| j 7 }| jdkr4|d| j 7 }| jdkrH|d7 }n�|d| j 7 }| jr�|d7 }| jdkr�| jdkr�|d| j 7 }|d7 }|d | j 7 }n2| jdkr�|d| j 7 }n| jdkr�|d | j 7 }| jd
kr�| jd kr�|d | j 7 }| j�s| jdk�r|d
| j 7 }| jd
k�r:| jd k�r:|d| j 7 }| j�s\| jdk�r\|d| j 7 }d}| jdk�rvd| j }| j dk�r�|d| 7 }nT| j dk�r�|d| 7 }| jdk�r�|d7 }n&| j dk�r�|d| 7 }n |d| 7 }| j
dk�s�| j dk�r�d}t �
d�}| j
dk�r,|d |�d | j
� 7 }| j
dk�rL| j dk�rL|d 7 }| j dk�rn|d |�d | j � 7 }|d 7 }|d| 7 }|�� S )!z Format rule for later parsingr z -i %sz -o %sr z -p allz -p z
-m multiportz
--dports z
--sports r �::/0z -d z --dport z -s z --sport �_�allowz -j ACCEPT%s�rejectz -j REJECT%sZtcpz --reject-with tcp-reset�limitz -j LIMIT%sz
-j DROP%sz-m comment --comment '� Zdapp_z%20�,Zsapp_�')r% r& r r r r r r r$ r" r r! �re�compileZsub�strip)r Zrule_strZlstrr) Z pat_spacer r r r1 r sd
zUFWRule.format_rulec C sj |� � �d�}|d dks2|d dks2|d dkr>|d | _nd| _d}t|�dkr\|d }| �|� d S )
zSets action of the ruler< r r= r> r? �denyr � N)�lower�splitr" �len� set_logtype)r r" �tmpr$ r r r r* � s $ zUFWRule.set_actionr c C s� t d�| }|dkr�n�|dkr*| jr*�n�|dkr<| jr<�n|t�d|�sTt�d|�r`t|���nX|�d�|�d� d kr�t|���n4|�d�}t|�d
kr�d | _ d }|D �]}t�d
|��rd | _ |�d�}|D ]$}t
|�d
k s�t
|�dkr�t|��q�t
|d �t
|d
�k�r�t|��nxt�d|��rNt
|�d
k �sDt
|�dk�r�t|��nDt�d|��r�zt � |�}W n t
�y� t|��Y n0 nt|��|�r�|dt|� 7 }q�t|�}q�|}|dk�r�t|�| _n
t|�| _dS )z:Sets port and location (destination or source) of the rulez
Bad port '%s'r r r z^[,:]z[,:]$rA �:� rG Tr z ^\d+:\d+$i�� r z^\d+$z
^\w[\w\-]+N)r< r r! rC �matchr �countrI rJ r �int�socketZ
getservbyname� Exception�strr r ) r �portZloc�err_msg�portsrL �pZran�qr r r r, � sP
zUFWRule.set_portc C s2 |t jjdg v r|| _ntd�| }t|��dS )zSets protocol of the ruler zUnsupported protocol '%s'N)r �utilZsupported_protocolsr r< r )r r rV r r r r+ � s zUFWRule.set_protocolc C s� | j rH| jr&| jdks | jdkr&d| _| jr�| jdks@| jdkr�d| _n@| jrh| jdksb| jdkrhd| _| jr�| jdks�| jdkr�d| _dS )z Adjusts src and dst based on v6r r r; N)r r r r r r r �
_fix_anywhere� s zUFWRule._fix_anywherec C s || _ | �� dS )zXSets whether this is ipv6 rule, and adjusts src and dst
accordingly.
N)r r[ )r r r r r �set_v6 s zUFWRule.set_v6c C s@ |� � }|dkr.tj�|d�s.td�}t|��|| _| �� dS )zSets source address of ruler zBad source addressN)rH r rZ �
valid_addressr< r r r[ �r �addrrL rV r r r r- s zUFWRule.set_srcc C s@ |� � }|dkr.tj�|d�s.td�}t|��|| _| �� dS )z Sets destination address of ruler zBad destination addressN)rH r rZ r] r< r r r[ r^ r r r r. s zUFWRule.set_dstc C s� |dkr |dkr t d�}t|��dt|�v r<t d�}t|��dt|�v rXt d�}t|��t|�dkspt|�d kr�t d
�}t|��tt|��d kr�t d �}t|��tt|��d
kr�t d�}t|��t�dt|��s�t d�}t|��|dkr�|| _n|| _dS )zSets an interface for ruler �outzBad interface type�!z+Bad interface name: reserved character: '!'rM z/Bad interface name: can't use interface aliases�.z..z)Bad interface name: can't use '.' or '..'r z+Bad interface name: interface name is empty� z+Bad interface name: interface name too longz^[a-zA-Z0-9_\-\.\+,=%@]+$zBad interface nameN)r< r rT rJ rC rO r% r& )r Zif_type�namerV r r r �
set_interface' s0
zUFWRule.set_interfacec C s> t |�dkr0t�dt |��s0td�| }t|��t|�| _dS )z Sets the position of the rulez-1z^[0-9]+z,Insert position '%s' is not a valid positionN)rT rC rO r< r rQ r# )r ZnumrV r r r � set_positionW s zUFWRule.set_positionc C sD |� � dks |� � dks |dkr,|� � | _ntd�| }t|��dS )zSets logtype of the rule�logzlog-allr zInvalid log type '%s'N)rH r$ r< r )r r$ rV r r r rK a s � zUFWRule.set_logtypec C s0 |dks|dkr|| _ ntd�| }t|��dS )zSets direction of the ruler r` zUnsupported direction '%s'N)r' r< r )r r' rV r r r r/ j s zUFWRule.set_directionc C s t j�| j�S )z Get decoded comment of the rule)r rZ Z
hex_decoder) r r r r � get_commentr s zUFWRule.get_commentc C s
|| _ dS )zSets comment of the ruleN)r) )r r) r r r r0 v s zUFWRule.set_commentc C s� d}| j rTz tj�| j | j�\| _ }W n" tyH td�}t|��Y n0 |rT|| _| j r�z tj�| j | j�\| _ }W n" ty� td�}t|��Y n0 |r�|| _| j
r�| j
� d�}tj� |� d�
|�| _
| jr�| j� d�}tj� |� d�
|�| _dS )z&Normalize src and dst to standard formFz"Could not normalize source addressz'Could not normalize destination addressrA N)r r rZ Znormalize_addressr rS r< r r r r rI Z
human_sort�joinr )r �changedrV rW r r r � normalizez s:
�
� zUFWRule.normalizec C s� | r|st � �d| |f }| j|jkr2t|� dS | j|jkrJt|� dS | j|jkrbt|� dS | j|jkrzt|� dS | j|jkr�t|� dS | j|jkr�t|� dS | j|jkr�t|� dS | j |j kr�t|� dS | j
|j
kr�t|� dS | j |j k�r t|� dS | j |j k�r&t|� dS | j
|j
k�r@t|� dS | j|jk�r~| j|jk�r~| j|jk�r~td�}t|� dS | j|jk�r�| j|jk�r�| j|jk�r�td�}t|� dS td�| j|j| j|j| j|jd� }t|� d S )
z�Check if rules match
Return codes:
0 match
1 no match
-1 match all but action, log-type and/or comment
-2 match all but comment
zNo match '%s' '%s'rG zFound exact matchr z$Found exact match, excepting comment���zZFound non-action/non-logtype/comment match (%(xa)s/%(ya)s/'%(xc)s' %(xl)s/%(yl)s/'%(yc)s'))ZxaZyaZxlZylZxcZyc���)�
ValueErrorr r r r r r r r r! r% r& r' r( r" r$ r) r< )�x�y�dbg_msgr r r rO � sv
�
���z
UFWRule.matchc C s� dd� }| r|st � �| �|�dkr(dS d| | j||jf }|jdkrZtd| d � dS |j| jkrvt|d � dS | j|jkr�|jd
kr�td | � dS |jd
kr�|| j|j�s�td | � dS |jd
k�rv| jd
kr�| � | j
�r�n�| j
|j
k�rd|j
v�rtd| � dS | j
|j
k�r�d|j
v �r�| j|jk�r�t j �
| j
|j
| j��s�td| d| j
|j
f � dS �n| jd
k�r�| j|jk�r�td| d| j|jf � dS zt j �|j| j�}W n, t�y� td| d|j � Y dS 0 |j
|k�r*d|j
v�r*td| d|j
|f � dS |j
|k�r�d|j
v �r�| j|jk�r�t j �
||j
| j��s�td| d||j
f � dS | j|jk�r�td| d| j
|j
f � dS td| | j||jf � dS )a� This will match if x is more specific than y. Eg, for protocol if x
is tcp and y is all or for address if y is a network and x is a
subset of y (where x is either an address or network). Returns:
0 match
1 no match
-1 fuzzy match
This is a fuzzy destination match, so source ports or addresses
are not considered, and (currently) only incoming.
c S s~ d| v sd| v r | |kr dS dS |� d�D ]N}| |kr< dS d|v r*|� d�\}}t| �t|�kr*t| �t|�kr* dS q*dS )z:Returns True if p is an exact match or within a multi rulerA rM TF)rI rQ )Ztest_pZto_matchrU �low�highr r r � _match_ports� s z-UFWRule.fuzzy_dst_match.<locals>._match_portsr z(No fuzzy match '%s (v6=%s)' '%s (v6=%s)'r z (direction) z (not incoming)rG z (forward does not match)r z (protocol) z(dport) r �/z(dst) z ('%s' not in network '%s')z (interface) z (%s != %s)z %s does not existz(v6) z'(fuzzy match) '%s (v6=%s)' '%s (v6=%s)'rm )rn rO r r' r r( r r r% � _is_anywherer r rZ Z
in_networkZget_ip_from_if�IOError)ro rp rt rq Zif_ipr r r �fuzzy_dst_match� s| �
(�
�
�
�
�&� � zUFWRule.fuzzy_dst_matchc C s |dks|dkrdS dS )z Check if address is anywherer; r TFr )r r_ r r r rv N s zUFWRule._is_anywherec C s� d}| j dks| jdkr�d| j | j| j| jf }| j dkrRd| j| j| j| jf }| jdkrtd| j | j| j| jf }| jdkr�| jdkr�|d| j 7 }n0| jdkr�|d| j 7 }| jdkr�|d| j 7 }|S )a� Returns a tuple to identify an app rule. Tuple is:
dapp dst sapp src direction_iface|direction
or
dport dst sapp src direction_iface|direction
or
dapp dst sport src direction_iface|direction
where direction_iface is of form 'in_eth0', 'out_eth0' or
'in_eth0 out_eth0' (ie, both interfaces used). If no interfaces are
specified, then tuple ends with the direction instead.
r z %s %s %s %sz %sz in_%sz out_%s) r r! r r r r r% r& r' )r Ztuplr r r �
get_app_tupleT s$
�
�
zUFWRule.get_app_tuplec C s� | j dkr4| jdks | jdkr4td�| j }t|��| j tjjv r`|dkr`td�| j }t|��| j tjjv r�| j dks�| j
dkr�td�| j }t|��dS )z Verify ruler r z3Improper rule syntax ('%s' specified with app rule)r z'Invalid IPv6 address with protocol '%s'z Invalid port with protocol '%s'N) r r! r r< r r rZ Zipv4_only_protocolsZportless_protocolsr r )r Z rule_iptyperV r r r �verifyv s,
������zUFWRule.verifyN)r r r r r Fr )r ) r r r r r
r
r8 r: r1 r* r, r+ r[ r\ r- r. re rf rK r/ rh r0 rk rO rx rv ry rz r r r r r * s8 �
# C
5
0
#Cn"r )r rC rR �ufw.utilr r � programName� state_dirZ share_dir� trans_dirZ
config_dirZ
prefix_dirZ iptables_dir� do_checksrS r r r r r r �<module> s