File: //usr/lib/python3/dist-packages/ufw/__pycache__/frontend.cpython-39.pyc
a
���_�� � @ sz d Z ddlZddlZddlZddlmZ ddlZddlmZm Z m
Z
ddl m Z ddl
Zdd� Zdd � ZG d
d � d �ZdS ) z'frontend.py: frontend interface for ufw� N)�UFWError)�error�warn�msg)�UFWBackendIptablesc
C s� t j�� }dD ]}|�t j�|�� qdD ]}|�t j�|�� q*dD ]}|�t j�|�� qFdD ]}|�t j�|�� qbdD ]}|�t j�|�� q~dD ]}|�t j� |�� q�g d�}|D ](}|�t j�
|�� |�t j� |�� q�t | �dk�rRd }| | �
� d
k�rd}| | �
� d k�rR| | �
� d k�rR| | �
� |v �rR| �|d
� t | �dk �sxd
| v �r�t | �dk �r�td� z|�| d d� �}W nT t�y� } ztd|j � W Y d}~n*d}~0 t�y� tddd� � Y n0 |S )zEParse command. Returns tuple for action, rule, ip_version and dryrun.)�enable�disable�helpz--help�versionz --version�reload�reset)�list�info�default�update)�on�offZlowZmediumZhighZfull)�allow�deny�reject)N�verboseZnumbered)�rawz before-rulesz
user-rulesz after-rulesz
logging-rules�builtins� listening�added)r �limitr r �insert�delete�prepend� � � --dry-runr �route�rule� znot enough argsNz%szInvalid syntaxF)Zdo_exit)�ufw�parserZ UFWParserZregister_commandZUFWCommandBasicZ
UFWCommandAppZUFWCommandLoggingZUFWCommandDefaultZUFWCommandStatusZUFWCommandShow�UFWCommandRule�UFWCommandRouteRule�len�lowerr r �
parse_commandr �value� Exception)�argv�p�iZ
rule_commands�idx�pr�e� r4 �./usr/lib/python3/dist-packages/ufw/frontend.pyr+ sJ
�� &" r+ c & C s\ t dtjjdddddddd d
d d d
ddddddddddddddd d d d d d!d"d#d$�# �} | S )%zPrint help messagea+
Usage: %(progname)s %(command)s
%(commands)s:
%(enable)-31s enables the firewall
%(disable)-31s disables the firewall
%(default)-31s set default policy
%(logging)-31s set logging to %(level)s
%(allow)-31s add allow %(rule)s
%(deny)-31s add deny %(rule)s
%(reject)-31s add reject %(rule)s
%(limit)-31s add limit %(rule)s
%(delete)-31s delete %(urule)s
%(insert)-31s insert %(urule)s at %(number)s
%(prepend)-31s prepend %(urule)s
%(route)-31s add route %(urule)s
%(route-delete)-31s delete route %(urule)s
%(route-insert)-31s insert route %(urule)s at %(number)s
%(reload)-31s reload firewall
%(reset)-31s reset firewall
%(status)-31s show firewall status
%(statusnum)-31s show firewall status as numbered list of %(rules)s
%(statusverbose)-31s show verbose firewall status
%(show)-31s show firewall report
%(version)-31s display version information
%(appcommands)s:
%(applist)-31s list application profiles
%(appinfo)-31s show information on %(profile)s
%(appupdate)-31s update %(profile)s
%(appdefault)-31s set default application policy
ZCOMMANDZCommandsr r z default ARGz
logging LEVELZLEVELz
allow ARGSr# z deny ARGSz reject ARGSz
limit ARGSzdelete RULE|NUMZRULEzinsert NUM RULEz prepend RULEz
route RULEzroute delete RULE|NUMzroute insert NUM RULEZNUMr r �statuszstatus numberedZRULESzstatus verbosezshow ARGr
z Application profile commandszapp listzapp info PROFILEZPROFILEzapp update PROFILEzapp default ARG)#ZprognameZcommandZcommandsr r r Zlogging�levelr r# r r r r Zuruler r r" z route-deletez route-insert�numberr r r6 Z statusnum�rulesZ
statusverbose�showr
Z appcommandsZapplistZappinfo�profileZ appupdateZ
appdefault)�_r% �common� programName)Zhelp_msgr4 r4 r5 �get_command_help[ sN ��Cr? c @ s� e Zd ZdZd,dd�Zdd� Zdd � Zd
d � Zd-d
d�Zd.dd�Z dd� Z
dd� Z dd� Z d/dd�Z
d0dd�Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd1d*d+�ZdS )2� UFWFrontendZUI�iptablesNc C sb |dkr4zt |||d�| _W q@ ty0 � Y q@0 n td| ��td�| _td�| _td�| _d S )NrA )�rootdir�datadirz Unsupported backend type '%s'�n�y�yes)r �backendr- r r< �norF �yes_full)�self�dryrunZ backend_typerB rC r4 r4 r5 �__init__� s �
zUFWFrontend.__init__c
C s� d}d}|rd}d}|r"| j �� r0|s4| j �� r4d}|r�z | j �| j jd d|� W n. ty� } zt|j� W Y d}~n
d}~0 0 d}|�r6z| j �� W n. ty� } z|r�|j}W Y d}~n
d}~0 0 |dk�r,z | j �| j jd dd� W n0 t�y" } zt|j� W Y d}~n
d}~0 0 t|� td �}nHz| j � � W n0 t�yt } zt|j� W Y d}~n
d}~0 0 td
�}|S ) zlToggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or
stops running firewall.
� rH rF FTZconfZENABLEDNz0Firewall is active and enabled on system startupz/Firewall stopped and disabled on system startup)
rG �
is_enabledZ set_default�filesr r r, �start_firewallr< �
stop_firewall)rJ Zenabled�resZ
config_strZchangedr3 Z error_strr4 r4 r5 � set_enabled� sP ���
�
zUFWFrontend.set_enabledc
C sh d}z0| j �||�}| j �� r2| j �� | j �� W n. tyb } zt|j� W Y d}~n
d}~0 0 |S )z Sets default policy of firewallrM N)rG �set_default_policyrN rQ rP r r r, )rJ �policy� directionrR r3 r4 r4 r5 rT � s
z UFWFrontend.set_default_policyc
C sH d}z| j �|�}W n. tyB } zt|j� W Y d}~n
d}~0 0 |S )zSets log level of firewallrM N)rG � set_loglevelr r r, )rJ r7 rR r3 r4 r4 r5 rW � s zUFWFrontend.set_loglevelFc
C sF z| j �||�}W n. ty@ } zt|j� W Y d}~n
d}~0 0 |S )zShows status of firewallN)rG �
get_statusr r r, )rJ r Z
show_count�outr3 r4 r4 r5 rX s
zUFWFrontend.get_statusr c
C sD z| j �|�}W n. ty> } zt|j� W Y d}~n
d}~0 0 |S )z Shows raw output of firewallN)rG Zget_running_rawr r r, )rJ Z
rules_typerY r3 r4 r4 r5 � get_show_raw s
zUFWFrontend.get_show_rawc C s" d}zt j�| j�� �}W n" ty< td�}t|��Y n0 | j�� }t |�
� �}|� � |D �]�}| j�� sz|dv rzq`|d| 7 }t || �
� �}|� � |D �]^}|| | D �]J} | d }
|
� d�s�|
� d�s�d} |d| 7 }|
d ks�|
d
k�r|d 7 }d | d }
n|d
|
7 }t j�
|
�} |dtj�| d � 7 }t jjd|dd� ||
ddd�} | �|�d�� | dk�r�| �d| � | �� | j�| �}
t|
�dk�r�|d7 }|
D ]D}|dk�r�|d t|�k �r�|d|t jj�||d �f 7 }�q�|d7 }q�q�q`| j�� �s t j� d� |S ) zMShows listening services and incoming rules that might affect
themrM z Could not get listening status)Ztcp6Zudp6z%s:
Zladdrz127.z::1z %s z0.0.0.0z::z* z%s/0z%s z(%s)Zexer Nr$ ZinF)�actionZprotocolZdport�dstrV �forward�6r �
r z [%2d] %s
z)Skipping tcp6 and udp6 (IPv6 is disabled)) r% �utilZparse_netstat_outputrG �use_ipv6r- r< r � get_rulesr
�keys�sort�
startswithZget_if_from_ip�os�path�basenamer= ZUFWRule�set_v6�endswithZ
set_interfaceZ normalizeZ get_matchingr) r& r' � get_command�debug)rJ rR �d�err_msgr9 Z protocolsZproto�portsZport�itemZaddrZifnamer# Zmatchingr0 r4 r4 r5 �get_show_listening sl
�
�
�� z UFWFrontend.get_show_listeningc C s� | j �� }td�}t|�dkr*|td� S g }| j �� D ]L}|jrVdtjj�|� }ntjj �|�}||v rnq8|�
|� |d| 7 }q8|S )z!Shows added rules to the firewallz9Added user rules (see 'ufw status' for running firewall):r z
(None)�route %sz
ufw %s) rG rb r< r) r] r% r& r( rk r' �append)rJ r9 rY r �r�rstrr4 r4 r5 �get_show_added\ s
�
zUFWFrontend.get_show_addedc C s d}d}d}g }|j dkr2|jdkr2|�|� �n�g }�zt|j�r�|dkrZ| j�|d�}n�|dkrr| j�|d�}nt|dkr�| j�|d�}| j�|d�}|D ]4} |D ]*}
|
j} d|
_| �|
�s�| |
_|�|
� q�q�ntd�| }t |��t
|�dk�rJ| jj �sJtd �}|dk�r|}n.|dk�r*|d
}n|dk�rD|d | d
}|W S |D ]8}|� � } |j| _| �
|j� | �|j� |�| � �qNn | j�|�}|jdk�r�|�� W n t�y� � Y n0 d}
d}td �}| j�d�}| j�d�}t|�D �] \}} |}
| j|| k�r,|t| j�d
7 }t |���z�| j�� �r&|dk�r�| jdk�rz|
dk�rj|dk�rjdnd}| �|� n&| j|k�r�|t| j�d
7 }t |��| �d� | j�| �}�q�|dk�rb| jdk�r�|
dk�r�|dk�r�dnd}| �|� nP| j|k�r| �| j| � n2| jdk�rH| j|k�rH|t| j�d
7 }t |��| �d� | j�| �}�q�|dk�r| j}| �d� |dk�r�|
dk�r�|dk�r�dnd}| �|� nH| j�s�||k�r�| j� || |
d�}|dk�r�| �|� n
| �d� | j�| �}| j�s.|dk�r.| j�d�}| �|d � | �d� |dk�rj|
dk�rZ|dk�rZdnd}| �|� nT| j�s�| jdk�r�| j|k�r�| j� | jd�}|dk�r�| �||
� n
| �d� |dk�r�|d 7 }| j�s�| j|k�r�|dk�r�| �| j| � || j�| �7 }ntd�| }t |��n�| jdk�rX|
dk�rJ|dk�rJdnd}| �|� |dk�sl|dk�r�| �d� | j�| �}n0|dk�r�td�}t |��ntd�| }t |��W n@ t �y� } z&|j }d}W Y d}~ �qW Y d}~n
d}~0 0 | j �r�td�}t � |� �q�|�s&||7 }n�t
|�dk�r>t!|� n�d}t"t#|
d ��}|�� |D ]n}|
dk�r^|| �r^|| � � }d|_z| �||� W n0 t�y� d}td�| �$� }t |� Y n0 �q^|td�7 }|�r�|td�7 }n |td�7 }t |��|S )zUpdates firewall with rulerM �v4F�v6TZbothzInvalid IP version '%s'r z"Could not delete non-existent rulez (v6)r_ zInvalid position '�'���r zIPv6 support not enabledNz Rule changed after normalizationz Could not back out rule '%s'z"
Error applying application rules.z# Some rules could not be unapplied.z( Attempted rules successfully unapplied.)%�dapp�sapprs �removerG Zget_app_rules_from_systemrx Zmatchr< r r) rK Zdup_ruleZ
set_actionr[ Z set_logtypeZlogtypeZget_app_rules_from_templateZposition�reverser- Zget_rules_count� enumerate�strra Z set_positionri �set_ruleZfind_other_positionr, Zupdated�warningsr r r
�rangeZ format_rule) rJ r# �
ip_versionrR rn �tmpr9 ZtmprulesZ tmprules6�xrE Zprev6rt �countZ set_errorZ pos_err_msgZnum_v4Znum_v6r0 ZbeginZuser_posr/ r3 Zwarn_msgZ
undo_errorZindexes�jZ backout_ruler4 r4 r5 r� y sN ����
�
�
�
�
&
� zUFWFrontend.set_rulec
C s\ z t |�}W n& ty2 td�| }t|��Y n0 | j�� }|dksR|t|�krftd�| }t|��| j�|�}|s�td�| }t|��d|_d}|j r�d}d}|�s8|j
r�dt j j
�|� } nt j j�|�} td�| | j| jd � }
t|
tjd
d � tj�� �� �� } | d k�r8| | j�� k�r8| | j�� k�r8d
}d
} |�rP| �||�} ntd�} | S )z Delete rulezCould not find rule '%s'r zCould not find rule '%d'Trw rx rr z=Deleting:
%(rule)s
Proceed with operation (%(yes)s|%(no)s)? )r# rF rH F��outputZnewlinerE rM �Aborted)�intr- r< r rG rb r) Zget_rule_by_numberr} rx r] r% r& r( rk r' rF rH r �sys�stdout�stdin�readliner* �striprI r� )
rJ r8 �forcerD rn r9 r# r� �proceedru �prompt�ansrR r4 r4 r5 � delete_ruleE sR
��� �zUFWFrontend.delete_rulec
C sZ d}|� d�rB|�d�}t|�dkr4| �|d �}n
| �d�}�n|dkrX| �d�}�n�|� d�r�td �}|�d
�}t|�d kr�t|��| �|d |d �}�n�|d
kr�| �|�}�n�|dkr�| �� }�n�|dkr�| �d�}�nv|� d��r0|�d
�d }|dk�r| � � }n |dk�r"| �
� }n
| � |�}�n&|dk�rJ| �dd�}�n |dk�rb| � d�}�n�|dk�rz| � d�}�n�|dk�r�| j
�� �r�| � d� | � d� td�}ntd�}�n�|� d��r�| �|�d
�d |�}�nv|d k�s|d k�s|d k�s|d k�rB|jdk�r�z0| j
�|j�}||jk�rB||_|�|d � W nX t�y� } z>|j�sht|j� tj�|j��s�td!�}t|��W Y d"}~n
d"}~0 0 |jdk�r4z0| j
�|j�}||jk�r�||_|�|d � W nX t�y2 } z>|j�s�t|j� tj�|j��s td!�}t|��W Y d"}~n
d"}~0 0 | �||�}ntd#�| }t|��|S )$z�Perform action on rule. action, rule and ip_version are usually
based on return values from parse_command().
rM z
logging-onr< r r z logging-offr zdefault-zUnsupported default policy�-r$ r r r6 zstatus-verboseTr: r r zstatus-numberedFr r r �Firewall reloadedz&Firewall not enabled (skipping reload)zdelete-r r r r r\ �Invalid profile nameN�Unsupported action '%s')re �splitr) rW r< r rT r rX rq rv rZ rS rG rN r� r{ Zfind_application_nameZset_portr} r r, r% � applications�valid_profile_namer| r� ) rJ r[ r# r� r� rR r� rn r3 r4 r4 r5 � do_actionv s�
�
zUFWFrontend.do_actionc
C sH d}z| j �|�}W n. tyB } zt|j� W Y d}~n
d}~0 0 |S )z+Sets default application policy of firewallrM N)rG � set_default_application_policyr r r, )rJ rU rR r3 r4 r4 r5 r� � s z*UFWFrontend.set_default_application_policyc C s: t | jj�� �}|�� td�}|D ]}|d| 7 }q$|S )z*Display list of known application profileszAvailable applications:�
%s)r
rG �profilesrc rd r< )rJ �namesru rD r4 r4 r5 �get_application_list� s z UFWFrontend.get_application_listc C s� g }|dkr&t | jj�� �}|�� n&tj�|�sBtd�}t |��|�
|� d}|D �]$}|| jjvsr| jj| s�td�| }t |��tj� || jj| �s�td�}t |��|td�| 7 }|td�tj� | jj| � 7 }|td�tj�
| jj| � 7 }tj�| jj| �}t|�d k�s,d
|d v �r:|td �7 }n |td
�7 }|D ]}|d| 7 }�qJ||t|�d krT|d7 }qTtj�|�S )z Display information on profile�allr� rM zCould not find profile '%s'zInvalid profilez Profile: %s
z
Title: %s
zDescription: %s
r �,r zPorts:zPort:r� z
--
)r
rG r� rc rd r% r� r� r< r rs Zverify_profileZ get_titleZget_descriptionZ get_portsr) r` � wrap_text)rJ Zpnamer� rn ru �namero r/ r4 r4 r5 �get_application_info� sL
�
�
�
��
z UFWFrontend.get_application_infoc C s d}d}d}z| j jr$tj�� r$d}W n ty< d}Y n0 |dkr�t| j j�� �}|� � |D ]4}| j �
|�\}}|rb|dkr�|d7 }||7 }|}qbn | j �
|�\}}|dkr�|d7 }|�r| j � � �r|�rz| j � � W n ty� � Y n0 |t
d�7 }n |t
d�7 }|S )�Refresh application profilerM TFr� r_ r� zSkipped reloading firewall)rG � do_checksr% r` � under_sshr- r
r� rc rd Zupdate_app_rulerN Z_reload_user_rulesr< ) rJ r; ru Z allow_reloadZtrigger_reloadr� r/ r� Zfoundr4 r4 r5 �application_update
s<
z UFWFrontend.application_updatec C s d}d}|dkr t d�}t|��| jjd }|dkrLtj�d||f � |S |dkrZd}n0|d krhd
}n"|d krvd }nt d �| }t|��d
g}| jjr�|�d� |||g7 }z t |�}W n t
y� � Y n0 d|j v r�| � |j
|j d |j d �}n| � |j
dd�}|S )r� rM r� z%Cannot specify 'all' with '--add-new'Zdefault_application_policy�skipz'Policy is '%s', not adding profile '%s'Zacceptr Zdropr r zUnknown policy '%s'r% r! r# �iptype)r< r rG �defaultsr% r` rl rK rs r+ r- �datar� r[ )rJ r; ru rU rn r �argsr2 r4 r4 r5 �application_add8 sB �
�zUFWFrontend.application_addc C s� d}|dkr| � d�}n�|dkr,| � d�}n�|dkr@| � d�}n�|dkrT| � d �}n�|d
krf| �� }nz|d krz| �|�}nf|d ks�|d
kr�| �|�}d}|d
kr�| �|�}|dkr�|dkr�|d7 }|| }ntd�| }t|��|S )zzPerform action on profile. action and profile are usually based on
return values from parse_command().
rM z
default-allowr z default-denyr zdefault-rejectr z default-skipr� r
r r zupdate-with-newr_ r� )r� r� r� r� r� r< r )rJ r[ r; rR Zstr1Zstr2rn r4 r4 r5 �do_application_actionb s0
z!UFWFrontend.do_application_actionc C sr d}| j jrntj�� rntd�| j| jd� }t|t j
dd� t j � � �
� �� }|dkrn|| jkrn|| jkrnd}|S )z6If running under ssh, prompt the user for confirmationTzWCommand may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? �rF rH Fr� rE )rG r� r% r` r� r< rF rH r r� r� r� r� r* r� rI )rJ r� r� r� r4 r4 r5 �continue_under_ssh� s � z UFWFrontend.continue_under_sshc C s� d}t d�| j| jd� }| jjrBtj�� rBt d�| j| jd� }| jjr�|s�ttj� |�t
j dd� t
j �
� �� �� }|dkr�|| jkr�|| jkr�t d�}|S | j�� r�|| �d�7 }| j�� }|S ) zReset the firewallrM zTResetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? r� zResetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? Fr� rE r� )r< rF rH rG r� r% r` r� r r� r� r� r� r� r* r� rI rN rS r )rJ r� rR r� r� r4 r4 r5 r � s$ � �
zUFWFrontend.reset)rA NN)FF)r )F)F)F)�__name__�
__module__� __qualname__�__doc__rL rS rT rW rX rZ rq rv r� r� r� r� r� r� r� r� r� r� r r4 r4 r4 r5 r@ � s. �
6
H M
1
V
.+* r@ )r� rf r� r� �
ufw.commonr �ufw.utilr% r r r Zufw.backend_iptablesr Z
ufw.parserr+ r? r@ r4 r4 r4 r5 �<module> s >H