
    #fd                         d Z ddlZddlZddlZddlZddlZddlZddlmZm	Z	 ddl
mZmZmZmZmZmZ ddlZ G d dej        j                  ZdS )z-backend_iptables.py: iptables backend for ufw    N)UFWErrorUFWRule)warndebugmsgcmdcmd_pipe	_findpathc                       e Zd ZdZddZd Zd Zd ZddZd	 Z	d
 Z
d Zd Zd Zd Zd ZddZddZd ZddZd Zd Zd ZdS )UFWBackendIptableszInstance class for UFWBackendNc                    dt           j        j        z   dz   | _        || _        || _        i }t          t           j        j        |          }t          j	        
                    |d          |d<   t          j	        
                    |d          |d<   t          j	        
                    |d          |d<   t          j	        
                    |d	          |d
<   t          j	        
                    |d          |d<   t          j	        
                    |d          |d<   t          j	        
                    t          t           j        j        |          d          |d<   t           j        j                            | d||||           g g g g d| _        dD ]}d}|dk    r!|                                 r||z  }n|dk    r+dD ]1}dD ],}	|d|d|	}
| j        |                             |
           -2| j        d                             |dz              | j        d                             |dz              g d| _        d| _        d S )!z!UFWBackendIptables initializationz# z
_comment #zufw/user.rulesruleszufw/before.rulesbefore_ruleszufw/after.rulesafter_ruleszufw/user6.rulesrules6zufw/before6.rulesbefore6_ruleszufw/after6.rulesafter6_ruleszufw-initinitiptables)rootdirdatadir)beforeuseraftermisc)46ufwr   )r   r   r   inputoutputforward-z	-logging-r   z-logging-denyz-logging-allow)-mlimit--limitz3/minute-jLOG--log-prefixz[UFW LIMIT BLOCK]N)r   commonprogramNamecomment_strr   r   r
   
config_dirospathjoin	state_dirbackend
UFWBackend__init__chainsuse_ipv6appendufw_user_limit_logufw_user_limit_log_text)selfdryrunr   r   filesr-   verchain_prefixloctargetchains              6/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr4   zUFWBackendIptables.__init__    s`   #*"88<Gsz4g>>
j2BCCg "Z9K L Ln!w||J8IJJm',,z3DEEh!#j:M!N!No "Z9K L Ln
 Ysz/CW%M%M%/1 1f 	''j&%07 	( 	J 	J 	J "$R"bII 	H 	HC Lczz==??  C'LLCZZ2 3 3< 3 3F2>,,VVLEK$++E22223 K&&|o'EFFFK&&|6F'FGGGG#3 #3 #3 (;$$$    c                     t          d          }| j        d         dk    r|dz  }n3| j        d         dk    r|dz  }n| j        d         dk    r|dz  }n|d	z  }|S )
zGet current policyzNew profiles:default_application_policyacceptz allowdropz denyrejectz rejectz skip)_defaults)r:   rstrs     rB   get_default_application_policyz1UFWBackendIptables.get_default_application_policyP   sy    !!=56(BBHDD]78FBBGODD]78HDDIDDGODrC   c           	         | j         sI|dk    r-|dk    r'|dk    r!t          d          |z  }t          |          |dk    r-|dk    r'|dk    r!t          d          |z  }t          |          d	}|dk    rd
}n|dk    rd}d}d}|dk    r;	 |                     | j        d         d|z  d           n# t
          $ r  w xY wd}d}n{|dk    r;	 |                     | j        d         d|z  d           n# t
          $ r  w xY wd}d}n:	 |                     | j        d         d|z  d           n# t
          $ r  w xY wd}d}t          j        d|z             }| j        d         | j        d         fD ]}	 t          j	        
                    |          }	n# t
          $ r  w xY w|	d         }
|	d         D ]l}|                    |          r5t          j	                            |
|                    ||                     Lt          j	                            |
|           m	 t          j	                            |	           # t
          $ r  w xY wt          d          ||dz  }|t          d          z  }|S )zSets default policy of firewallallowdenyrH   zUnsupported policy '%s'incomingoutgoingroutedz%Unsupported policy for direction '%s'INPUTOUTPUTFORWARD rJ   zDEFAULT_%s_POLICYz"ACCEPT"z	UFW BLOCKz	UFW ALLOWz"REJECT"z"DROP"r   r   tmporigz5Default %(direction)s policy changed to '%(policy)s'
)	directionpolicyz*(be sure to update your rules accordingly))r;   rI   r   set_defaultr<   	Exceptionrecompiler   util
open_filessearchwrite_to_filesubclose_files)r:   rZ   rY   err_msgrA   old_log_strnew_log_strpatffnsfdlinerK   s                rB   set_default_policyz%UFWBackendIptables.set_default_policy^   sV   { A	  Vv%5%5&H:L:L566&Aw'''J&&9
+B+BH$$CDD&(w'''EJ&& h&&!KK  $$TZ
%;,?5,I,8: : : : !   ))8##$$TZ
%;,?5,I,8: : : : !   ))$$TZ
%;,?5,I,68 8 8 8 !   )) *S;.//Cj/N1KL  (--a00CC    ZK 9 9Dzz$'' 9..r377;3M3MNNNN..r48888H((----     IJJ )V<<>>???s<   %B3 3B?%C4 4D 	%D/ /D;6FF"#IIc                 2	   | j         r)dt          d          z   }|dt          d          z   z  }|S |                                  g d}g }g }|dk    r|                    d           g d}g d}n|d	k    rd
D ]2}|                    d|z             |                    d|z             3dD ]2}|                    d|z             |                    d|z             3dD ]2}|                    d|z             |                    d|z             3dD ]}|                    d|z             n|dk    r7dD ]2}|                    d|z             |                    d|z             3n|dk    rdD ]2}|                    d|z             |                    d|z             3| j        d         d         r*|                    d           |                    d           | j        d         d         r*|                    d           |                    d           n+|d k    r6dD ]2}|                    d!|z             |                    d"|z             3n|d#k    rdD ]}|                    d$|z             |                    d%|z             |                    d&|z             |                    d'|z             |                    d(|z             |                    d)|z             |                    d*           |                    d+           |                    d,           |                    d-           d.|z  }|D ]}d/|v rB|                    d/          \  }	}|d0|	z  z  }t          | j        g|z   |d|	gz             \  }
}nt          | j        g|z   |gz             \  }
}||z  }|dk    r|d1z  }|
d2k    rt          |          |dk    s| 	                                r|d3z  }|D ]}d/|v rB|                    d/          \  }	}|d0|	z  z  }t          | j        g|z   |d|	gz             \  }
}nt          | j
        g|z   |gz             \  }
}||z  }|dk    r|d1z  }|
d2k    rt          |          |S )4z'Show current running status of firewall> zChecking raw iptables
zChecking raw ip6tables
)-nz-vz-x-Lrawz-t)filternatmanglerr   )rs   ru   rr   builtins)rS   rU   rT   z	filter:%s)
PREROUTINGrS   rU   rT   POSTROUTINGz	mangle:%s)rw   rT   zraw:%s)rw   rx   rT   znat:%sr   )r    r"   r!   zufw-before-%szufw6-before-%sr   ufw-user-%sufw6-user-%sr%   r   zufw-user-limit-acceptufw-user-limitr   zufw6-user-limit-acceptufw6-user-limitr   zufw-after-%szufw6-after-%sloggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyzIPV4 (%s):
:z(%s) 
r   z

IPV6:
)r;   rI   initcapsr7   capssplitr   r   r   r6   	ip6tables)r:   
rules_typeoutargsitemsitems6cbitrcrW   s               rB   get_running_rawz"UFWBackendIptables.get_running_raw   s   ; 	4555C4!67777CJ 	'''KK666E000FF:%%3 / /[1_---kAo....% / /[1_---kAo....- , ,X\***hl++++< + +X\****+8##3 4 4_q0111.233334 6!!3 2 2]Q.///nq01111y!#& /4555-...y!#& 16777/0007""3 3 3^a/000o122223 9$$3 ; ;4q89996:;;;2Q67774q89993a788859::::LL,---LL+,,,MM.///MM-...
+ 	$ 	$AaxxAw!}$$ 6!T1 EFF	SS$ 6! <==	S3JCU""tQwwsmm#  $--//= C ( (!88WWS\\FQ7a=(C #T]Od$:aq\$I J JIR #T^$4t$;qc$A B BIRs
&&4KC77"3--'  
rC   Fc           	      d   d}| j         r=dt          d          z   }|                                 r|dt          d          z   z  }|S t          d          }dD ]}t          | j        dd|z  d	g          \  }}|d
k    rt          d          c S |dk    rt          |d|z  z             |                                 r6t          | j        dd|z  d	g          \  }}|dk    rt          |dz             d}d}	d}
| j        | j        z   }d
}i }|D ]}d}i }d}d}|sH|j	        dk    s|j
        dk    r2d}|                                }||v rt          d|z             Pd||<   dD ]}d||<   d}d}|dk    r6|j        }|s%|j	        dk    r|j	        }|j        r|dk    r|dz  }n=|j        }n5|j        }|s%|j
        dk    r|j
        }|j        r|dk    r|dz  }n|j        }|dk    r|dk    r|||<   |dk    r||         dk    r|||<   n||xx         d|z   z  cc<   |r#|j        dk    r||xx         d|j        z   z  cc<   |r|dk    rP|j	        dk    rE||xx         d|j	        z  z  cc<   |j        r|dk    r||xx         dz  cc<   ||xx         dz  cc<   |dk    rP|j
        dk    rE||xx         d|j
        z  z  cc<   |j        r|dk    r||xx         dz  cc<   ||xx         dz  cc<   |dk    r|dk    s|dk    rad||<   |rC|j        dk    r8|j        |j        k    r(|j        |j        k    r||xx         d|j        z   z  cc<   |dk    r||xx         dz  cc<   nm|r3|j        dk    r(|j        |j        k    r||xx         d|j        z   z  cc<   n7|j        r0|j        dk    r%|j        dk    rd||         vr||xx         dz  cc<   |j        rT|dk    r#|j        dk    r||xx         d|j        z  z  cc<   |dk    r#|j        dk    r||xx         d|j        z  z  cc<   |dk    r#|j        dk    r||xx         d|j        z  z  cc<   |dk    r#|j        dk    r||xx         d|j        z  z  cc<   g }d}|j        s|j                                        d k    r|j        r,|                    |j                                                   |r%|j        d k    r|                    |j                   t5          |          dk    rd!d"                    |          z  }|r|d#|z  z  }|j                                        }|j        rd$}|j        d%k    r|j        s|s|sd}d}|j        dk    rd&|                                z  }||d         d'dd                    |j                                        |g          d(|d         d'||d)z  }|r||z  }n#|j        r|
|z  }
n|j        d k    r|	|z  }	n||z  }|d
z  }|dk    s|	dk    s|
dk    rd*}|r|d+z  }t          d,          }t          d-          }t          d.          }d/}||||fz  }|r|d+z  }||d0t5          |          z  d0t5          |          z  d0t5          |          z  fz  z  }||z  }|dk    r||z  }|dk    r|	dk    r|t          d)          z  }|	dk    r||	z  }|dk    r|
dk    r|t          d)          z  }|
dk    r||
z  }|}|r|                                  \  } }!t          d1          | !                                | !                    d2          | !                    d3d          d4z  }"| "                                }#t          d5          |!|"|#|d6z  S t          d7          |z  S )8zShow ufw managed rulesrV   ro   zChecking iptables
zChecking ip6tables
problem runningr   rq   ry   rp      zStatus: inactiver   z iptables: %s
rz   
 ip6tablesTFzSkipping found tuple '%s')dstsrcr   z::/0 (v6)z	0.0.0.0/0any /z (%s)r   Anywherez on %sr   z (%s)z, z[%2d] FWDinz # %s2612r   z

z     ToFromActionz%-26s %-12s%s
r#   zCDefault: %(in)s (incoming), %(out)s (outgoing), %(routed)s (routed)r!   r"   )r   r   rR   z0Status: active
%(log)s
%(pol)s
%(app)s%(status)s)logpolappstatuszStatus: active%s)#r;   rI   r6   r   r   r   r   r   r   dappsappget_app_tupler   r   v6dportr   sportprotocolr"   interface_ininterface_outlogtyperY   lowerr7   lenr0   uppercommentget_commentactionget_loglevel_get_default_policyrL   )$r:   verbose
show_countr   re   rY   r   out6sstr_outstr_rter   count	app_rulesrtmp_strlocationtupl
show_protor?   portrW   attribs
attrib_strdir_strr,   full_strstr_tostr_from
str_actionrules_header_fmtrules_headerlevellogging_str
policy_strapp_policy_strs$                                       rB   
get_statuszUFWBackendIptables.get_status  s	   ; 	0111C}} 8ta 67777J%&&7 	; 	;IT]D)Y7? @ @IRQww+,,,,,qw):c)BBCCC}} ; $.$!/9!=t"E F F
T77"7\#9:::
T[(	 T	 T	AGHDJ +"""
((9$$5>???&*IdO' XF XF "%<<%C" 'qv|| v4 ,C6MM GOD w%C" 'qv|| v4 ,C6MM GOD w+%%#--$'HSM5==}**(, t3! :ajE&9&9 qz)99 
1%<<AFbLL$SMMMVqv->>MMM t 9v ( 8$SMMMS0MMM%<<AFbLL$SMMMVqv->>MMM t 9v ( 8$SMMMS0MMM5==k))SF]](2 & >!**=*=5AE>>ag.@.@$SMMMS1:-==MMM&==$SMMMW4MMM & >!**=*=7ag--$SMMMS1:-==MMMT -aevoo!%6//hsm33 SMMMW,MMM 9 	Fe||"(<(< Q^)DDe||2(=(= Q_)EEe||"(<(< Q^)DDe||2(=(= Q_)EEGJy @AK--//5889 6NN19??#4#4555 0!+"6"6NN1;///w<<!##!(DIIg,>,>!?J  .8u--k''))Gy  {d""19" ##- #KyB%78E????03!(..:J:J:A:C 1D 1D 1D 1D080;	= =G  !W9 !w&GG[E))w&GGLAQJEE77gmmw"}}H $G#tWWFyyH8J0+vz8.LLL (', 3v;;. 3z??2 3x==022 2L
 $HBwwABww7b==AdGG#"}}G#Bww7b==AdGG#"}}G#A 	/#'#4#4#6#6 UK 1 2 2 &*%=%=%?%?&*&>&>x&H&H)-)A)A)BF*H *HI IJJ "@@BBNJKK)*,; ;< < '((A..rC   c                    | j         r!t          dt          d          z              dS g }|                    | j        d                    | j        e| j        ^|                    d           |                    | j                   |                    d           |                    | j                   |                    d           t          |          \  }}|dk    r!t          d	|z            }t          |          dS )
zStop the firewallro   running ufw-initr   N	--rootdir	--datadirz
force-stopr   problem running ufw-init
%s)	r;   r   rI   r7   r<   r   r   r   r   r:   r   r   r   re   s        rB   stop_firewallz UFWBackendIptables.stop_firewall  s    ; 	(q+,,,-----DKK
6*+++|'DL,DK(((DL)))K(((DL)))KK%%%D		IRQww:S@AAw''' wrC   c                    | j         r!t          dt          d          z              dS g }|                    | j        d                    | j        e| j        ^|                    d           |                    | j                   |                    d           |                    | j                   |                    d           t          |          \  }}|dk    r!t          d	|z            }t          |          d
| j	        vs3| j	        d
         t          | j                                                  vrD	 |                     d           dS # t          $ r t          d          }t          |          w xY w	 |                     | j	        d
                    dS # t          $ r t          d          }t          |          w xY w)zStart the firewallro   r   r   Nr   r   startr   r   loglevellowzCould not set LOGLEVELzCould not load logging rules)r;   r   rI   r7   r<   r   r   r   r   rJ   list	loglevelskeysset_loglevelr\   update_loggingr   s        rB   start_firewallz!UFWBackendIptables.start_firewall  s   ; 	,q+,,,-----DKK
6*+++|'DL,DK(((DL)))K(((DL)))KK   D		IRQww:S@AAw'''..}Z(T^5H5H5J5J0K0KKK,%%e,,,,,  , , , 899G"7+++,,''j(ABBBBB  , , , >??G"7+++,s   E )F F( ()Gc                 J   | j         rdS |                                  d}| j        }|r	d}| j        }dD ]n}|dk    s|dk    r,|r| j        d         d         s$|s| j        d         d         s:t          |d	d
|dz   |z   g          \  }}|dk    rt          d            dS odS )zCheck if all chains existFr   ufw6)r    r!   r"   r%   limit-acceptr%   r   r   r   rp   rq   -user-r   z_need_reload: forcing reloadT)r;   r   r   r   r   r   r   )r:   r   prefixexerA   r   r   s          rB   _need_reloadzUFWBackendIptables._need_reload  s    ; 	5 	m 	!F.CN 
	 
	E5N#:#: di05  DIg$6s$; S$fx.?%.GHIIIRQww4555tt  urC   c                    t          d          }| j        r6t          d           |                                 rt          d           dS dS |                                 r	 | j        d         D ]2}|                     |d|g           |                     |d|g           3n# t          $ r t          |          w xY wt          d| j
        d         g| j        d	g          \  }}|d
k    rt          |dz             |                                 rAt          d| j
        d         g| j        d	g          \  }}|d
k    rt          |dz             dS dS dS )zReload firewall rules filer   z> | iptables-restorez> | ip6tables-restorer   -F-Zcatr   rp   r   z	 iptablesr   r   N)rI   r;   r   r6   
is_enabledr5   
_chain_cmdr\   r   r	   r<   iptables_restoreip6tables_restore)r:   re   r   r   r   s        rB   _reload_user_rulesz%UFWBackendIptables._reload_user_rules:  s   %&&; 	;&'''}} -+,,,,,- -__ 	;(V, 2 2AOOAay111OOAay11112  ( ( (w'''( !%G)<!="&"7!>@ @IRQwww4555}} ;$eTZ-A%B&*&<d%CE E	S77"7\#9:::'	; 	;; ; 7s   "A B# #B=c                    g }t          j        d          }t          j        d          }t          j        d          }|                    |          r|                    |          r|                    |          r>|                    |                    d|                    d|                               n)|                    |                    d|                     |                    |                    d|                     n?|                    |                    d|                     n|                    |           t          j        d          }t          j        d	          }	t          j        d
          }
d}t          |          D ]{\  }}|                    |          r_|                    d|                                          }|                                dk    rd}n|                                dk    rd}nd}|d|d}|	                    |          sd|z   }|                    d|          ||<   |                    ||                    d|z   dz   |z   |                     |                    ||
                    d|z   dz   |z   |                    d|                               |                    ||
                    d|z   dz   |z   |                    d|z   |                               }t          j        d          }t          |          D ]\  }}|                    |          r|                    d|          }|                    d|z   dz   |          }|                    d|z   d z   |          }|||<   |                    ||           |                    ||           |S )!z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z-j \1 --reject-with tcp-resetz-p udp rV   z(.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10\2rF   ALLOWr%   LIMITBLOCKz -j LOG --log-prefix "[UFW ] "z-m conntrack --ctstate NEW z	\1-j \2\4z\1-j z-user-logging-z\1 z\1-j RETURN\1z	 -j LIMITz+ -m conntrack --ctstate NEW -m recent --setzL -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j z-user-limitz -j z-user-limit-accept)	r]   r^   ra   r7   rc   	enumeratestripr   insert)r:   fruler   suffixsnippets	pat_protopat_port
pat_rejectpat_log
pat_logall	pat_chain
limit_argsr   r   rZ   lstr	pat_limittmp1tmp2tmp3s                       rB   _get_rules_from_formattedz,UFWBackendIptables._get_rules_from_formattedV  s    Jz**	:h''Z <==
E"" 	#u%% 	:$$U++ EOOIMM)"'G %  %  ! ! ! ! OOIMM)U$C$CDDD	i ? ?@@@@	b% 8 89999OOE""" *>??Z 455
J:;;	>
h'' 	P 	PDAq~~a   P UA..4466<<>>X--$FF\\^^w..$FF$F?Izzvv!((++ @84?D%kk,::7;;x&/@/?0@BH0IJK$M $M N N N9==&1A2BDJ2K18^1224 24$5 $5 6 6 6 9==&1A2BDJ2K18UT\11M1M$O $O P P P
 J|,,	h'' 
	) 
	)DAq"" 	) }}%R%&( ( }} &,.4&57D&EFGI I !}}Vf_7K%KQOO"4(((4(((rC   c                 R   g }|                      |||          }t          j        d          }t          |          D ]\  }}|                    |                    d|                                                     |                    |          r||                             d           ||                             |                    d|                              dd                     ||xx         |                    d|                                          z  cc<   |S )z_Return list of iptables rules appropriate for sending as arguments
           to cmd()
        z(.*) --log-prefix (".* ")(.*)r   r)   r   "rV   z\3)	r  r]   r^   r   r7   rc   r   matchreplace)	r:   r   r   r   r  str_snippetsrh   r   r   s	            rB   _get_lists_from_formattedz,UFWBackendIptables._get_lists_from_formatted  s    55eVVLL j9::l++ 	9 	9DAqOOCGGE1--3355666yy|| 9"">222""3775!#4#4#<#<S"#E#EFFFswwua0066888rC   c                 
   | j         d         g}|                                 r |                    | j         d                    |D ]}	 t          j                            |          }n/# t          $ r" t          d          |z  }t          |          w xY wt          j
        d          }t          j
        d          }t          j
        d          }|D ]q}|}	d}
d|v r,|                    d          \  }	}|                                }
|                    |	          r$|                    d|	          }t          j        d	|                                          }t          |          d
k     st          |          dk    r"t          d          |z  }t!          |           d}d}d}t          |          dk    st          |          dk    r~t          d          |z  }|d                             d          d         }d|d         v r@d|d         v r|                    |d                   r|                    |d                   ru|d                             d          d                             d          d         }|d                             d          d                             d          d         }n|d                             d          r"|d                             d          d         }nN|d                             d          r"|d                             d          d         }nt!          |           }	 |d         }d}d|v rd}|                    d          d         }t          |          dk     r6t)          ||d         |d         |d         |d         |d         |||
	  	        }nt)          ||d         |d         |d         |d         |d         |||
	  	        }t          j
        d          }|d
         d k    r!|                    d!|d
                   |_        |d         d k    r!|                    d!|d                   |_        |dk    r|                    d|           |dk    r|                    d"|           n2# t          $ r% t          d#          |z  }t!          |           Y w xY w|| j         d         k    r1|                    d           | j                            |           B|                    d           | j                            |           s|                                 d$S )%z$Read in rules that were added by ufwr   r   zCouldn't open '%s' for readingz^### tuple ###\s*zin_\w+zout_\w+rV   z	 comment=z\s+   	   z)Skipping malformed tuple (bad length): %sr      z$Skipping malformed tuple (iface): %srI   r   !   r   in_out_Fr~   T            %20r#   r   r   zSkipping malformed tuple: %sN)r<   r6   r7   r   r_   open_file_readr\   rI   r   r]   r^   r   r   r  rc   r   r   ra   	partition
startswithr   r   r   set_interfaceset_v6r   r   close)r:   rfnsri   rX   re   	pat_tuplepat_iface_inpat_iface_out	orig_linerl   r   hexr   rW   wmsgdtyper   r   r   r"   rule	pat_spacewarn_msgs                          rB   _read_ruleszUFWBackendIptables._read_rules  sJ   
7#$==?? 	.KK
8,--- ]	 ]	A(x..q11 ( ( (<==Cw'''( 
#788I:i00LJz22M! Q4 Q4	 )++ ) = =ID#!iikkG??4(( H4$==T22D(64::<<88C3xx!||s3xx!|| !LMM$( *T


  !%')(*s88q==CHHMM#$%K#L#L(,$.D$'GMM#$6$6q$9E"c"g~~#&#b'>>#/#6#6s2w#?#? $2#0#7#7B#@#@ $2
 ),Bc(:(:1(=(G(G(L(LQ(O %1 ),Bc(:(:1(=(G(G(L(LQ(O %2M%(W%7%7%>%> !-36r73D3DS3I3I!3LLL%(W%7%7%?%? !-47G4E4Ec4J4J14MMM$(JJJ$,%%(VF&+G"f}}*.)/c):):1)="3xx!||'.vs1vs1vs1v/21vs1vug/6(8 (8 (/vs1vs1vs1v/21vs1vug/6(8 (8 -/Ju,=,=	#&q6S==09c3q60J0JDI#&q6S==09c3q60J0JDI+r11 $ 2 24 F F F,22 $ 2 25- H H H' % % %'()G'H'H)-(/H NNN$H	%
 
8 444 KK--- K..t4444 KK... J--d333JJLLLL{]	 ]	s   	A)),BER$$+SSc                    | j         d         }|r| j         d         }t          j        |t          j                  s!t	          d|z            }t          |          	 t          j                            |          }n# t          $ r  w xY w| 
                                 d}| j        }|r	d}| j        }| j        rt          j                                        }n|d         }t          j                            |d           t          j                            |d|z   d	z              t          j                            |d|z   d
z              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d|z   dz              |dk    r| j        d         d         s|dk    r_| j        d         d         rLt          j                            |d|z   dz              t          j                            |d|z   dz              t          j                            |d           |D ]t}|j        }	|j        r
d|j        z   }	|j        dk    r|	d|j        z   z  }	d}
|j        dk    r|j        dk    r|j        }
n]|j        dk    r|j        dk    rd |j        d!|j        }
n4|j        dk    r|
|j        d|j        z  }
n|
|j        d|j        z  }
|j        dk    rw|j        dk    rld"|	d#|j        d#|j        d#|j        d#|j        d#|j        d#|
}|j         dk    r|d$|j         z  z  }t          j                            ||d%z              ntC          j"        d#          }d&}|j        r|#                    d'|j                  }d&}|j        r|#                    d'|j                  }d"|	d#|j        d#|j        d#|j        d#|j        d#|j        d#|d#|d#|
}|j         dk    r|d$|j         z  z  }t          j                            ||d%z              d(}|j        rd)}n|j        d*k    rd+}|d,|}d-|d#|$                                d%}| %                    |||          D ]"}t          j                            ||           #vt          j                            |d.           t          j                            |d/           	 | &                    | j'        d0                   }n# t          $ r  w xY w|D ]\  }}}tQ          |          d1k    r|d1         d2k    r&|)                    |d&z             r^t          j                            |d#*                    |          +                    d3d4          +                    d5d6          d%z              t          j                            |d7           |dk    r| j        d         d         s|dk    r| j        d         d         rt          j                            |d8           | j'        d0         d9k    rOt          j                            |d-|z   d:z   d#*                    | j,                  z   d;z   | j-        z   d<z              t          j                            |d-|z   d=z              t          j                            |d-|z   d>z              t          j                            |d?           t          j                            |d@           	 | j        r"t          j        .                    |dA           dBS t          j        .                    |           dBS # t          $ r  w xY w)Cz.Write out new rules to file to user chain filer   r   z'%s' is not writabler   r   rW   z*filter
r~   z-user-input - [0:0]
z-user-output - [0:0]
z-user-forward - [0:0]
z-before-logging-input - [0:0]
z-before-logging-output - [0:0]
z -before-logging-forward - [0:0]
z-user-logging-input - [0:0]
z-user-logging-output - [0:0]
z-user-logging-forward - [0:0]
z-after-logging-input - [0:0]
z-after-logging-output - [0:0]
z-after-logging-forward - [0:0]
z-logging-deny - [0:0]
z-logging-allow - [0:0]
r%   r   r   z-user-limit - [0:0]
z-user-limit-accept - [0:0]
z### RULES ###
zroute:rV   rI   r  z!out_z
### tuple ### r   z comment=%sr   r#   r"  r    r"   r   r!   r   z-A z
### END RULES ###
z
### LOGGING ###
r   r   -D[z"[z] r   z### END LOGGING ###
z
### RATE LIMITING ###
offz-user-limit z "z "
z-user-limit -j REJECT
z-user-limit-accept -j ACCEPT
z### END RATE LIMITING ###
zCOMMIT
FN)/r<   r.   accessW_OKrI   r   r   r_   r`   r\   r   r   r   r;   sysstdoutfilenorb   r   r   r"   r   r   r   rY   r   r   r   r   r   r   r   r   r]   r^   rc   format_ruler  _get_logging_rulesrJ   r   r%  r0   r  r8   r9   rd   )r:   r   
rules_filere   rj   r>   r   rk   r   r   ifaceststrr2  r   r   chain_suffixrA   rule_strr   lrules_tr   qs                         rB   _write_ruleszUFWBackendIptables._write_rules  s
   Z(
 	.H-J yRW-- 	$.*=>>G7###	(%%j11CC 	 	 		 	
 	 !LKE; 	""$$BBUB 	r;///r3#58O#OPPPr3#5)A$B 	C 	C 	Cr3#5)B$C 	D 	D 	D 	r3#5)J$K 	L 	L 	Lr3#5)K$L 	M 	M 	Mr3#5)L$M 	N 	N 	Nr3#5)H$I 	J 	J 	Jr3#5)I$J 	K 	K 	Kr3#5)J$K 	L 	L 	Lr3#5)I$J 	K 	K 	Kr3#5)J$K 	L 	L 	Lr3#5)K$L 	M 	M 	Mr3#5)B$C 	D 	D 	Dr3#5)C$D 	E 	E 	E E!!di&8&=!F""ty'9#'>"H""2s\'9-D(E F F FH""2s\'9-K(L M M M 	r#4555  3	. 3	.AXFy -!AH,yB#	/)F~##2(=(=2%%!/R*?*?*?+,>>>1??K>R''annEEFFaooFFFv||"ffajjj!'''1555!'''1555f 9??MAI55D&&r4$;7777JsOO	6 8$==77D6 8$==77D


AGGGQUUUAGGGQUUUdddFF, 9??MAI55D&&r4$;777"Ly ((%%'$0LL,,?EE',uuammoooo>H33Hl4@B B . .&&r1----.
 	r#:;;; 	r#8999	..t}Z/HIIHH 	 	 		 	 	GAq!1vvzzaddll||L3.// &&rHHQKK''T22::4GG   	r#:;;; E!!di&8&=!F""ty'9#'>"H""2'BCCC}Z(E11&&r5%,&(6,7$"9::,; , "&!=,> AH,H I I I H""2u|';2(3 4 4 4H""2u|';9(: ; ; ;H""2'DEEEr:...	{ *$$S%00000$$S))))) 	 	 		s*   A> >B
. Z Z'c& c& &c2Tc                    |                                   d}|j        rh|                                 st          d          }t	          |          |j        dk    r*| j        d         d         st          d          |j        z  S n5|j        dk    r*| j        d         d         st          d          |j        z  S |j        r4|j        dk    r)|j        d	k    rt          d
          }t	          |          g }d}d}| j	        }|j
        }	|j        r7| j        dk     r%|j        dk    s|j        dk    rt          d          S | j        }|	dk     s|	t          |          k    r!t          d          |	z  }t	          |          |	dk    r%|j        rt          d          }t	          |          	 |                                 n# t$          $ r  w xY wd}
d}d}d}|D ]}	 |                                 n# t$          $ r  w xY w|j        |j        |j        |j        f}|
|	k    rm|d         dk    r|d         dk    r|
dk    s|d         dk    r|d         dk    s||k    r,d}|                    |                                           d}n|	dz  }	|}|
dz  }
t/          j        ||          }|dk     r|dz  }|dk    r6|s4|s2d}|j        s'|                    |                                           |dk    r|j        r|j        dk    rd}4|dk     r6|j        s/|s-d}d}|                    |                                           p|                    |           |r$|dk    rt          d          }|j        r|dz  }|S n|s.|j        s'|                    |                                           |s+|j        r$| j        st          d          }|j        r|dz  }|S |r&|j        s|st          d          }|j        r|dz  }|S |j        r|| _        n|| _	        	 |                     |j                   n8# t          $ r  t$          $ r! t          d          }t	          |           Y nw xY wt          d          }|j        rt          d          }|                                 r| j        sd}|s|                     |j                  s|rod}|r|t          d          z  }n|t          d          z  }|j        r|dz  }|r%	 |                                  n# t$          $ r  w xY w|t          d           z  }n|ra|j        rZd!}t          d"          }|j        r|dz  }|r(	 |                                  n# t$          $ r  w xY wd}n/|t          d           z  }n|s|s|j        sd#}t          d$          }|dk    r| j        }d%}|j        r| j         }d&}|dz  }d'}|j!        rd(}n|j"        d)k    rd*}|d+|}t          d,          }tG          |d-|d.g          \  }}|dk    rt	          |          |d/|d/|$                                }tK          j&        d0          }| '                    |||          D ]}tG          |g|z             \  }}|dk    r)tQ          |tR          j*                   t	          |           |d#k    r|+                    d/,                    |                    rX|-                    d1d/,                    |                    }tG          |d!|d2d3g          \  }}|dk    rt]          d4|z             |S )5aX  Updates firewall with rule by:
        * appending the rule to the chain if new rule and firewall enabled
        * deleting the rule from the chain if found and firewall enabled
        * inserting the rule if possible and firewall enabled
        * updating user rules file
        * reloading the user rules file if rule is modified
        rV   z)Adding IPv6 rule failed: IPv6 not enabledr%   r   z#Skipping unsupported IPv6 '%s' ruler   z#Skipping unsupported IPv4 '%s' ruleudptcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4r   zInvalid position '%d'z Cannot specify insert and deleter   )rV   rV   rV   rV   r  r  Tz Skipping inserting existing ruler   z"Could not delete non-existent rulezSkipping adding existing rulezCouldn't update rules filezRules updatedzRules updated (v6)zRule insertedzRule updatedz (skipped reloading firewall)r6  zRule deleted-Az
Rule addedr   r   r    r"   r   r!   r   !Could not update running firewallrq   rp   r   z(-A +)(ufw6?-user-[a-z\-]+)(.*)r   r'   RETURNzFAILOK: -D %s -j RETURN)/r   r   r6   rI   r   r   r   multir   r   positioniptables_versionr   r   r   r   remove	normalizer\   r   r   r7   dup_ruler   r  r   r;   rG  r   r   r   r   r   r"   rY   r   r>  r]   r^   r  r   r;  stderrra   r0   rc   r   )r:   r1  allow_reloadrK   re   newrulesfoundmodifiedr   rP  r   insertedmatcheslastr   currentretflagr   r>   rC  rA   r   r   rD  r  r   r   s                               rB   set_rulezUFWBackendIptables.set_rule  s    	7 
	P==?? (GHHw'''{g%%di.@.E%>??4;OO{g%%di.@.E%>??4;OO: 	$$-500T]e5K5KIJJG7###
=7 	 $u,,$)r//26)r//UVVVKE a<<8c%jj00/00H=G7###a<<DK<:;;G7###	NN 	 	 		  ,	# ,	#A    uaeQVQV4G   GrMMd1gmm		AJ"$$r)9)97??#HOODMMOO444+DDMHDQJE-4((CQww1axxxhx { 5OODMMOO444t{t|r/A/AqX 0000"""" 	{{;<<7 $GOD	   1 1000  	T[ 	 	=>>7 $GOD t{ 8 8997 $GOD7 	""DKK!DJ	dg&&&& 	 	 	 	 	 	455GW	 !!7 	+)**D ?? J	CT[ J	CD #'4,,TW55 #' #' .Ao...DDAn---D7 $GOD ?//1111$    A=>>>DD '4; '(( 7 $GOD ?//1111$   DDA=>>>DD '8 'DK 'rzzm$7 $.C#)LGOD&< ,#,LL^u,,#+L(4llC ?@@dE4 899	S77"7+++)-uuud6F6F6H6H6HI*%GHH778D8DF F C CA !$SEAIIRQwwC,,, ))) t||sxx{{(C(C|#KKsxx{{;;$'dAtX(F$G$G	S77!";q"ABBBsB   .G G G55H%Q   2Q54Q5T' 'T32V Vc                    g }g }|r| j         }n| j        }|                                }|                    |           |                                 |                                }|D ]Y}|                                }|                                 |                                }	|	|k    r|                    |           Z|S )z@Return a list of UFWRules from the system based on template rule)r   r   rT  r'  rS  r   r7   )
r:   templater   r   r   normr   r   rW   	tmp_tuples
             rB   get_app_rules_from_systemz,UFWBackendIptables.get_app_rules_from_system  s    	 	KEEJE  ""B!!## 	& 	&A**,,CMMOOO))++ID    %%%rC   c                     | j         }|                    d          r| j        }t          |g|z             \  }}|dk    r7t	          d|z            }|rt          d|z              dS t          |          dS )zPerform command on chainr   r   zCould not perform '%s'zFAILOK: N)r   r%  r   r   rI   r   r   )r:   rA   r   fail_okr   r   r   re   s           rB   r   zUFWBackendIptables._chain_cmd  s    mF## 	!.C%%	S770D9::G (j7*+++++w''' 7rC   c                    | j         rdS |                                  g }	 |                     |          }n# t          $ r  w xY w	 |                     d           |                     d           n8# t
          $ r  t          $ r! t          d          }t          |           Y nw xY w|                                 sdS t          d          }| j        d         | j        d         z   | j        d	         z   | j        d
         z   D ]9}	 | 	                    |d|dg           # t          $ r t          |          w xY w	 | j        d         | j        d	         z   | j        d
         z   D ]2}| 	                    |d|g           | 	                    |d|g           3n# t          $ r t          |          w xY w|D ]\  }}}d}t          |          dk    r|d         dk    rd}	 |dk    r7t          |          dk    r$| 	                    |dg|dd         z   d           | 	                    |||           # t          $ r t          |          w xY wdD ]}| j        d         d         r|dk    s| j        d         d         rs|dk    rm| 	                    |d|g| j        z   | j        dz   gz   d           | j        d         dk    r.| 	                    |d|g| j        z   | j        dz   gz   d           dS )z#Update loglevel of running firewallNF)r   Tz&Couldn't update rules file for loggingrM  r   r   r   r   rq   rp   r   r   r   r6  delete_firstr   )rg  )r{   r|   r%   r   r{   r   r|   r   r   r8  -I)r;   r   r?  r\   rG  r   rI   r   r5   r   r   r   r8   r9   rJ   )	r:   r   rules_tre   r   r   rF  rg  rA   s	            rB   r   z!UFWBackendIptables.update_logging  s   ; 	F 		--e44GG 	 	 			'''&&&& 	 	 	 	 	 	@AAGW	
    	F 788X&V)<<;w "&+f"56 	( 	(A(D!T?3333 ( ( (w'''(	$[*T[-AA{6"# . .D!9---D!9----.  	$ 	$ 	$7###	$  		( 		(GAq!G1vvzzaddll(&&3q66A::OOAv!""~tODDD1g.... ( ( (w'''(
 ; 	2 	2E	'"3' 
2E5E,E,E	'"3' -F,15F,F,Fe} $ 7(8!%!=!C D(E )-   . . . =,55OOED%=$($;,<%)%AC%G$H,I -1 $ 2 2 2	2 	2sA   7 A,A4 42B)(B)D%%D?AF   F:)AH>>Ic                 J   g }|t          | j                                                  vr!t          d          |z  }t	          |          |dk    r.| j        d         D ]}|                    |d|ddgdg           |S | j        d         D ]}|                    |d|ddgd	g           g d
}| j        |         | j        d         k    rg }| j        |         | j        d         k     r|}| j        d         D ]}dD ]}|                    |          r|                     |          dk    s|                     |          dk    r$d}|                    |d|ddd|g|z   d	g           m| j        |         | j        d         k    r#d}|                    |d|ddd|g|z   d	g           g }| j        |         | j        d         k     r|}| j        d         D ]}|                    d          rd}n||                    d          rgd}| j        |         | j        d         k     r$|                    |d|ddddddg|z   d	g           n%|                    |d|ddddddddg
|z   d	g           |                    |d|ddd|g|z   d	g           | j        |         | j        d         k    rvg }| j        |         | j        d         k     r|}| j        |         | j        d         k     rg d|z   }d }| j        d!         D ]#}|                    |d|ddd|g|z   d	g           $|S )"z%Get rules for specified logging levelzInvalid log level '%s'r8  r   rj  r'   rN  ri  r6  rV   )r$   r%   r&   z3/minz--limit-burst10r   highr   r   rH   rO   z[UFW BLOCK] rL  r(   r)   mediumz[UFW ALLOW] r   rN   r$   	conntrack	--ctstateINVALIDz[UFW AUDIT INVALID] full)r$   rp  rq  NEWz[UFW AUDIT] r   )	r   r   r   rI   r   r5   r7   endswithr   )	r:   r   rk  re   r   r  largsr   r   s	            rB   r?  z%UFWBackendIptables._get_logging_rules  sh   T^00223333011U;G7###E>> [( O OD!T8#<nMNNNNN [( C CD!T8#<bABBBBOOO
 >% DN5$999E~e$t~f'==="[) < <7 < <Azz!}} <33A66(BB33A66&@@%3F#NNAau0>0H050679,; < < < < "^E2dnX6NNN%3F#NNAau0>0H050679,; < < << E~e$t~f'==="[( J J::g&& 4+FFZZ'' 4+F~e,t~h/GGGD!T;,7,0(,<>C,DEG(I J J J J  D!T;,7,0%,:,B	,D
 ).,.
 02(3 4 4 4 D!T5$2F$<>C$DEG I J J J J >% DN8$<<<E ~e$t~f'===" ~e$t~f'===???*L#F[* J JD!T5$2F$<>C$DEG I J J J J rC   c           
         d}t          t          j        j        | j                  }g }| j        D ]}| j        |                             d          s#|                    | j        |                    t          j	        
                    |dt          j	                            | j        |                             }t          j	                            |          s!t          d          |z  }t          |          t          j        d          }|D ]I}|d|}t          j	                            |          r!t          d          |z  }t          |          J|D ]S}|d|}|t          d          t          j	                            |          |d	z  z  }t          j        ||           T|D ]0}|d|}t'          j        t          j	        
                    |dt          j	                            |                    t          j	                            |                     t'          j        ||           	 t          j        |          }	|	t.          j                 }
n1# t2          $ r$ t          d
          |z  }t5          |           Y w xY w|
t.          j        z  r|t          d          |z  z  }|
t.          j        z  r|t          d          |z  z  }2|S )zReset the firewallrV   z.rulesr   zCould not find '%s'. Abortingz%Y%m%d_%H%M%S.z'%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s'
)oldnewzCouldn't stat '%s'zWARN: '%s' is world writablezWARN: '%s' is world readable)r
   r   r*   	share_dirr   r<   ru  r7   r.   r/   r0   basenameisfilerI   r   timestrftimeexistsrenameshutilcopydirnamecopymodestatST_MODEr\   r   S_IWOTHS_IROTH)r:   resr{  allfilesr   fnre   extry  statinfomoder3  s               rB   resetzUFWBackendIptables.reseth  s   cj2DLAA	 	( 	(A:a=))(33 OODJqM***i g..tz!}==? ?B7>>"%% (;<<Cw'''( mO,,  	( 	(AAAss#Bw~~b!! (;<<Cw'''(
  	 	AAAss#B1:;;W--a00<<> >CIa  	? 	?AQQ$CKY
%'W%5%5a%8%8: :**, , , OC###71::-   122a8X
 dl" ?q788A>>$ ?q788A>>
s   &I**+JJ)NN)FF)F)T)__name__
__module____qualname____doc__r4   rL   rm   r   r   r   r   r   r   r  r  r4  rG  r`  re  r   r   r?  r   rC   rB   r   r      sy       ''.; .; .; .;`  I I IV[ [ [zc/ c/ c/ c/J( ( ($, , ,B  8; ; ;8B B BH  $c c cJg g g gRc c c cJ  0( ( ( (H2 H2 H2TX X Xt8 8 8 8 8rC   r   )r  r.   r]   r  r  r;  r~  
ufw.commonr   r   ufw.utilr   r   r   r   r	   r
   ufw.backendr   r2   r3   r   r  rC   rB   <module>r     s    3 3" 
			 				   



  ( ( ( ( ( ( ( ( ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?    B B B B B/ B B B B BrC   