
    #fd                         S r SSKrSSKrSSKrSSKrSSKrSSKrSSKJrJ	r	  SSK
JrJrJrJrJrJr  SSKr " S S\R&                  R(                  5      rg)z-backend_iptables.py: iptables backend for ufw    N)UFWErrorUFWRule)warndebugmsgcmdcmd_pipe	_findpathc                       \ rS rSrSrSS jrS rS rS rSS jr	S	 r
S
 rS rS rS rS rS rSS jrSS jrS rSS jrS rS rS rSrg)UFWBackendIptables   zInstance class for UFWBackendNc           	         S[         R                  R                  -   S-   U l        X l        X0l        0 n[        [         R                  R                  U5      n[        R                  R                  US5      US'   [        R                  R                  US5      US'   [        R                  R                  US5      US'   [        R                  R                  US	5      US
'   [        R                  R                  US5      US'   [        R                  R                  US5      US'   [        R                  R                  [        [         R                  R                  U5      S5      US'   [         R                  R                  R                  U SXX#S9  / / / / S.U l        S H  nSnUS:X  a"  U R!                  5       (       a  Xv-  nOUS:X  a  M-  S H7  nS H.  n	U< SU< SU	< 3n
U R                  U   R#                  U
5        M0     M9     U R                  S   R#                  US-   5        U R                  S   R#                  US-   5        M     / SQU l        SU l        g )!z!UFWBackendIptables initializationz# z
_comment #zufw/user.rulesruleszufw/before.rulesbefore_ruleszufw/after.rulesafter_ruleszufw/user6.rulesrules6zufw/before6.rulesbefore6_ruleszufw/after6.rulesafter6_ruleszufw-initinitiptables)rootdirdatadir)beforeuseraftermisc)46ufwr   )r   r   r   inputoutputforward-z	-logging-r   z-logging-denyz-logging-allow)-mlimit--limitz3/minute-jLOG--log-prefixz[UFW LIMIT BLOCK]N)r   commonprogramNamecomment_strr   r   r
   
config_dirospathjoin	state_dirbackend
UFWBackend__init__chainsuse_ipv6appendufw_user_limit_logufw_user_limit_log_text)selfdryrunr   r   filesr.   verchain_prefixloctargetchains              6/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr5   UFWBackendIptables.__init__    s   #**"8"88<Gszz44g>
j2BCg "Z9K Ln!ww||J8IJm'',,z3DEh!#j:M!No "Z9K Ln
 Yszz/C/CW%M%/1f 	''j&07 	( 	J "$R"bIC Lcz==?? 'LCZ2<F2>VLEKK$++E2 = 3 KK&&|o'EFKK&&|6F'FG "#3 (;$    c                     [        S5      nU R                  S   S:X  a  US-  nU$ U R                  S   S:X  a  US-  nU$ U R                  S   S:X  a  US-  nU$ US	-  nU$ )
zGet current policyzNew profiles:default_application_policyacceptz allowdropz denyrejectz rejectz skip)_defaults)r;   rstrs     rC   get_default_application_policy1UFWBackendIptables.get_default_application_policyP   s    !==56(BHD  ]]78FBGOD  ]]78HDID  GODrE   c           	         U R                   (       Gd  US:w  a%  US:w  a  US:w  a  [        S5      U-  n[        U5      eUS:w  a%  US:w  a  US:w  a  [        S5      U-  n[        U5      eS	nUS:X  a  S
nOUS:X  a  SnSnSnUS:X  a)   U R                  U R                  S   SU-  S5        SnSnOWUS:X  a)   U R                  U R                  S   SU-  S5        SnSnO( U R                  U R                  S   SU-  S5        SnSn[        R                  " SU-   5      nU R                  S   U R                  S   4 H  n [        R                  R                  U5      n	U	S   n
U	S    Hh  nUR                  U5      (       a0  [        R                  R                  XR                  Xk5      5        MI  [        R                  R                  X5        Mj      [        R                  R                  U	5        M     [        S5      X!S.-  nU[        S5      -  nU$ ! [
         a    e f = f! [
         a    e f = f! [
         a    e f = f! [
         a    e f = f! [
         a    e f = f)zSets default policy of firewallallowdenyrJ   zUnsupported policy '%s'incomingoutgoingroutedz%Unsupported policy for direction '%s'INPUTOUTPUTFORWARD rL   zDEFAULT_%s_POLICYz"ACCEPT"z	UFW BLOCKz	UFW ALLOWz"REJECT"z"DROP"r   r   tmporigz5Default %(direction)s policy changed to '%(policy)s'
)	directionpolicyz*(be sure to update your rules accordingly))r<   rK   r   set_defaultr=   	Exceptionrecompiler   util
open_filessearchwrite_to_filesubclose_files)r;   r]   r\   err_msgrB   old_log_strnew_log_strpatffnsfdlinerM   s                rC   set_default_policy%UFWBackendIptables.set_default_policy^   s   {{{ Vv%5&H:L56&Aw''J&9
+BH$CD&(w''EJ& h&!KK $$TZZ
%;,?5,I,8:
 *)8#$$TZZ
%;,?5,I,8:
 *)$$TZZ
%;,?5,I,68
 *) **S;./Cjj/N1KL((--a0C ZKDzz$''..r77;3MN..r8	 (HH((- M$ IJ )<>>??_ !  !  !  !  ! s<   #H 6#H) #H8 IIH&)H58III"c                    U R                   (       a!  S[        S5      -   nUS[        S5      -   -  nU$ U R                  5         / SQn/ n/ nUS:X  a  UR                  S5        / SQn/ SQnGOUS	:X  a  S
 H+  nUR                  SU-  5        UR                  SU-  5        M-     S H+  nUR                  SU-  5        UR                  SU-  5        M-     S H+  nUR                  SU-  5        UR                  SU-  5        M-     S H  nUR                  SU-  5        M     GOUS:X  a3  S H+  nUR                  SU-  5        UR                  SU-  5        M-     GOUS:X  a  S H+  nUR                  SU-  5        UR                  SU-  5        M-     U R                  S   S   (       a"  UR                  S5        UR                  S5        U R                  S   S   (       a"  UR                  S5        UR                  S5        GOUS :X  a2  S H+  nUR                  S!U-  5        UR                  S"U-  5        M-     OUS#:X  a  S H{  nUR                  S$U-  5        UR                  S%U-  5        UR                  S&U-  5        UR                  S'U-  5        UR                  S(U-  5        UR                  S)U-  5        M}     UR                  S*5        UR                  S+5        UR                  S,5        UR                  S-5        S.U-  nU H  nS/U;   a=  UR                  S/5      u  pUS0U	-  -  n[        U R                  /U-   USU	/-   5      u  pO[        U R                  /U-   U/-   5      u  pX+-  nUS:w  a  US1-  nU
S2:w  d  M|  [        U5      e   US:X  d  U R                  5       (       a  US3-  nU H  nS/U;   a=  UR                  S/5      u  pUS0U	-  -  n[        U R                  /U-   USU	/-   5      u  pO[        U R                  /U-   U/-   5      u  pX+-  nUS:w  a  US1-  nU
S2:w  d  M|  [        U5      e   U$ )4z'Show current running status of firewall> zChecking raw iptables
zChecking raw ip6tables
)-nz-vz-x-Lrawz-t)filternatmanglerv   )rw   ry   rv   builtins)rV   rX   rW   z	filter:%s)
PREROUTINGrV   rX   rW   POSTROUTINGz	mangle:%s)r{   rW   zraw:%s)r{   r|   rW   znat:%sr   )r!   r#   r"   zufw-before-%szufw6-before-%sr   ufw-user-%sufw6-user-%sr&   r   zufw-user-limit-acceptufw-user-limitr   zufw6-user-limit-acceptufw6-user-limitr   zufw-after-%szufw6-after-%sloggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyzIPV4 (%s):
:z(%s) 
r   z

IPV6:
)r<   rK   initcapsr8   capssplitr   r   r   r7   	ip6tables)r;   
rules_typeoutargsitemsitems6cbitrcrZ   s               rC   get_running_raw"UFWBackendIptables.get_running_raw   s!   ;;455C4!6777CJ 	'KK6E0F:%3[1_-kAo. 4%[1_-kAo.% .X\*hl+ . =X\* =8#3_q01.23 4 6!3]Q./nq01 4 yy!#&45-.yy!#&67/07"3^a/0o12 4 9$34q896:;2Q674q893a7859: 4 LL,-LL+,MM./MM-.
+Aaxw!}$$ 6!T1 EF	S$ 6! <=	JCU"tQwsm#  $--//= C!8WWS\FQ7a=(C #T]]Od$:aq\$I JIR #T^^$4t$;qc$A BIR
&4KC7"3-'  
rE   c           	         SnU R                   (       a6  S[        S5      -   nU R                  5       (       a  US[        S5      -   -  nU$ [        S5      nS H  n[        U R                  SSU-  S	/5      u  pcUS
:X  a  [        S5      s  $ US:w  a  [        USU-  -   5      eU R                  5       (       d  Mb  [        U R                  SSU-  S	/5      u  pgUS:w  d  M  [        US-   5      e   SnSn	Sn
U R                  U R                  -   nS
n0 nU GH;  nSn0 nSnSnU(       dM  UR                  S:w  d  UR                  S:w  a-  SnUR                  5       nUU;   a  [        SU-  5        M[  SUU'   S GH  nSUU'   SnSnUS:X  aY  UR                  nU(       d9  UR                  S:w  a)  UR                  nUR                  (       a  US:X  a  US-  nOeUR                  nOXUR                   nU(       d9  UR                  S:w  a)  UR                  nUR                  (       a  US:X  a  US-  nOUR"                  nUS:w  a  US:w  a  UUU'   US:w  Ga  UU   S:X  a  UUU'   OUU==   SU-   -  ss'   U(       a*  UR$                  S:w  a  UU==   SUR$                  -   -  ss'   U(       a  US:X  a[  UR                  S:w  aK  UU==   SUR                  -  -  ss'   UR                  (       a  US:X  a  UU==   S-  ss'   UU==   S-  ss'   US:X  a[  UR                  S:w  aK  UU==   SUR                  -  -  ss'   UR                  (       a  US:X  a  UU==   S-  ss'   UU==   S-  ss'   US:X  a  US:X  d  US:X  a~  SUU'   U(       a^  UR$                  S:w  aN  UR                  UR                   :X  a4  UR                  UR"                  :X  a  UU==   SUR$                  -   -  ss'   US:X  a  UU==   S-  ss'   OU(       aD  UR$                  S:w  a4  UR                  UR"                  :X  a  UU==   SUR$                  -   -  ss'   OGUR                  (       a6  UR                   S:X  a&  UR                  S:X  a  SUU   ;  a  UU==   S-  ss'   UR&                  (       ai  US:X  a*  UR(                  S:w  a  UU==   SUR(                  -  -  ss'   US:X  a0  UR*                  S:w  a  UU==   SUR*                  -  -  ss'   GM  GM  GM  US:X  a*  UR(                  S:w  a  UU==   SUR(                  -  -  ss'   US:X  d  GM  UR*                  S:w  d  GM  UU==   SUR*                  -  -  ss'   GM     / nSnUR,                  (       d  UR.                  R1                  5       S :X  a  UR,                  (       a)  UR3                  UR,                  R1                  5       5        U(       a+  UR.                  S :X  a  UR3                  UR.                  5        [5        U5      S:  a  S!S"R7                  U5      -  nU(       a  US#U-  -  nUR.                  R9                  5       nUR&                  (       a  S$nUR.                  S%:X  a!  UR&                  (       d  U(       d	  U(       d  SnSnUR:                  S:w  a  S&UR=                  5       -  nUUS   <S' SSR7                  UR>                  R9                  5       U/5      <S( US   <S' U< U< S)3-  nU(       a  X-  nO/UR&                  (       a  X-  n
OUR.                  S :X  a  X-  n	OX-  nUS
-  nGM>     US:w  d  U	S:w  d  U
S:w  a  S*nU(       a  US+-  n[        S,5      n[        S-5      n[        S.5      nS/nUUUU4-  nU(       a  US+-  nUUS0[5        U5      -  S0[5        U5      -  S0[5        U5      -  4-  -  nUU-  nUS:w  a  UU-  nUS:w  a  U	S:w  a  U[        S)5      -  nU	S:w  a  UU	-  nUS:w  a  U
S:w  a  U[        S)5      -  nU
S:w  a  UU
-  nUnU(       au  U RA                  5       u  n n![        S15      U RC                  5       U RC                  S25      U RC                  S3S5      S4.-  n"U RE                  5       n#[        S55      U!U"U#US6.-  $ [        S75      U-  $ )8zShow ufw managed rulesrY   rs   zChecking iptables
zChecking ip6tables
problem runningr    ru   r}   rt      zStatus: inactiver   z iptables: %s
r~   
 ip6tablesTFzSkipping found tuple '%s')dstsrcr   z::/0 (v6)z	0.0.0.0/0any /z (%s)r   Anywherez on %sr   z (%s)z, z[%2d] FWDinz # %s2612r   z

z     ToFromActionz%-26s %-12s%s
r$   zCDefault: %(in)s (incoming), %(out)s (outgoing), %(routed)s (routed)r"   r#   )r   r   rU   z0Status: active
%(log)s
%(pol)s
%(app)s%(status)s)logpolappstatuszStatus: active%s)#r<   rK   r7   r   r   r   r   r   r   dappsappget_app_tupler   r   v6dportr   sportprotocolr#   interface_ininterface_outlogtyper\   lowerr8   lenr1   uppercommentget_commentactionget_loglevel_get_default_policyrN   )$r;   verbose
show_countr   rh   r\   r   out6sstr_outstr_rter   count	app_rulesrtmp_strlocationtupl
show_protor@   portrZ   attribs
attrib_strdir_strr-   full_strstr_tostr_from
str_actionrules_header_fmtrules_headerlevellogging_str
policy_strapp_policy_strs$                                       rC   
get_statusUFWBackendIptables.get_status  s   ;;011C}}ta 6777J%&7IT]]D)Y7? @IRQw+,,qw):c)BBCC}} $..$!/9!=t"E F
7"7\#9:: 8 

T[[(	AGHDJ"""
(9$5>?&*IdO' "%<%%C"qvv| vv44C6M GOD ww%%C"qvv| vv44C6M GOD ww+%#-$'HSM5=}*(, t3!ajjE&9 qzz)99%<AFFbL$SMVqvv->>M ttv ( 8$SMS0M%<AFFbL$SMVqvv->>M ttv ( 8$SMS0M5=k)SF](2 &!***=55AEE>agg.@$SMS1::-==M&=$SMW4M &!***=77agg-$SMS1::-==MTTaeevo!%%6/hsm3 SMW,M 99e|"(< Q^^)DDe|2(= Q__)EE )>| e|"(< Q^^)DDe|2(= Q__)EEq (t GJyyAKK--/5899NN199??#45!++"6NN1;;/w<!#!(DIIg,>!?J 8u--kk'')Gyy{{d"199:KyyB%78E?03!((..:J:A:C 1D080;	= =G 99&G[[E)&GLAQJEi l 7gmw"}HG#tWFyH8J0+vz8.LLL', 3v;. 3z?2 3x=022 2L
 $HBwABw7b=AdG#"}G#Bw7b=AdG#"}G#A#'#4#4#6 UK 1 2 &*%=%=%?&*&>&>x&H)-)A)A)BF*HIJJ "@@BNJK)*,;< < '(A..rE   c                    U R                   (       a  [        S[        S5      -   5        g/ nUR                  U R                  S   5        U R
                  be  U R                  bX  UR                  S5        UR                  U R
                  5        UR                  S5        UR                  U R                  5        UR                  S5        [        U5      u  p#US:w  a  [        S	U-  5      n[        U5      eg)
zStop the firewallrs   running ufw-initr   N	--rootdir	--datadirz
force-stopr   problem running ufw-init
%s)	r<   r   rK   r8   r=   r   r   r   r   r;   r   r   r   rh   s        rC   stop_firewall UFWBackendIptables.stop_firewall  s    ;;q+,,-DKK

6*+||'DLL,DK(DLL)K(DLL)KK%D	IRQw:S@Aw'' rE   c                 p   U R                   (       a  [        S[        S5      -   5        g/ nUR                  U R                  S   5        U R
                  be  U R                  bX  UR                  S5        UR                  U R
                  5        UR                  S5        UR                  U R                  5        UR                  S5        [        U5      u  p#US:w  a  [        S	U-  5      n[        U5      eS
U R                  ;  d4  U R                  S
   [        U R                  R                  5       5      ;  a   U R                  S5        g U R                  U R                  S
   5        g! [         a    [        S5      n[        U5      ef = f! [         a    [        S5      n[        U5      ef = f)zStart the firewallrs   r   r   Nr   r   startr   r   loglevellowzCould not set LOGLEVELzCould not load logging rules)r<   r   rK   r8   r=   r   r   r   r   rL   list	loglevelskeysset_loglevelr_   update_loggingr   s        rC   start_firewall!UFWBackendIptables.start_firewall  se   ;;q+,,-DKK

6*+||'DLL,DK(DLL)K(DLL)KK D	IRQw:S@Aw''.}}Z(T^^5H5H5J0KK,%%e,
,''j(AB ! , 89G"7++, ! , >?G"7++,s   >E0 F 0!F!F5c                    U R                   (       a  gU R                  5         SnU R                  nU(       a  SnU R                  nS Hy  nUS:X  d  US:X  a@  U(       a  U R                  S   S   (       d  M/  U(       d  U R                  S   S   (       d  MO  [        US	S
US-   U-   /5      u  pVUS:w  d  Mn  [        S5          g   g)zCheck if all chains existFr   ufw6)r!   r"   r#   r&   limit-acceptr&   r   r   r   rt   ru   -user-r   z_need_reload: forcing reloadT)r<   r   r   r   r   r   r   )r;   r   prefixexerB   r   r   s          rC   _need_reloadUFWBackendIptables._need_reload  s    ;; 	mmF..CNE5N#:dii05DIIg$6s$;S$fx.?%.GHIIRQw45 O rE   c                    [        S5      nU R                  (       a-  [        S5        U R                  5       (       a  [        S5        ggU R	                  5       (       a   U R
                  S    H+  nU R                  USU/5        U R                  USU/5        M-     [        SU R                  S   /U R                  S	/5      u  p4US
:w  a  [        US-   5      eU R                  5       (       a>  [        SU R                  S   /U R                  S	/5      u  p4US
:w  a  [        US-   5      eggg! [         a    [        U5      ef = f)zReload firewall rules filer   z> | iptables-restorez> | ip6tables-restorer   -F-Zcatr   rt   r   z	 iptablesr   r   N)rK   r<   r   r7   
is_enabledr6   
_chain_cmdr_   r   r	   r=   iptables_restoreip6tables_restore)r;   rh   r   r   r   s        rC   _reload_user_rules%UFWBackendIptables._reload_user_rules:  s;   %&;;&'}}+, __(V,AOOAay1OOAay1 - !%G)<!="&"7"7!>@IRQww455}}$eTZZ-A%B&*&<&<d%CE	7"7\#9::     (w''(s    >D0 0Ec                    / n[         R                  " S5      n[         R                  " S5      n[         R                  " S5      nUR                  U5      (       a  UR                  U5      (       a  UR                  U5      (       a2  UR                  UR	                  SUR	                  SU5      5      5        O!UR                  UR	                  SU5      5        UR                  UR	                  SU5      5        O3UR                  UR	                  SU5      5        OUR                  U5        [         R                  " S5      n[         R                  " S	5      n	[         R                  " S
5      n
Sn[        U5       GHH  u  pUR                  U5      (       d  M  UR	                  SU5      R                  5       nUR                  5       S:X  a  SnOUR                  5       S:X  a  SnOSnU< SU< S3nU	R                  U5      (       d  SU-   nUR	                  SU5      XL'   UR                  XR	                  SU-   S-   U-   U5      5        UR                  XR	                  SU-   S-   U-   UR	                  SU5      5      5        UR                  XR	                  SU-   S-   U-   UR	                  SU-   U5      5      5        GMK     [         R                  " S5      n[        U5       H  u  pUR                  U5      (       d  M  UR	                  SU5      nUR	                  SU-   S-   U5      nUR	                  SU-   S -   U5      nUXL'   UR                  UU5        UR                  UU5        M     U$ )!z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z-j \1 --reject-with tcp-resetz-p udp rY   z(.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10\2rH   ALLOWr&   LIMITBLOCKz -j LOG --log-prefix "[UFW ] "z-m conntrack --ctstate NEW z	\1-j \2\4z\1-j z-user-logging-z\1 z\1-j RETURN\1z	 -j LIMITz+ -m conntrack --ctstate NEW -m recent --setzL -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j z-user-limitz -j z-user-limit-accept)	r`   ra   rd   r8   rf   	enumeratestripr   insert)r;   fruler   suffixsnippets	pat_protopat_port
pat_rejectpat_log
pat_logall	pat_chain
limit_argsr   r   r]   lstr	pat_limittmp1tmp2tmp3s                       rC   _get_rules_from_formatted,UFWBackendIptables._get_rules_from_formattedV  s#    JJz*	::h'ZZ <=
E""u%%$$U++OOIMM)"'G%  ! OOIMM)U$CD	i ?@	b% 89OOE" **>?ZZ 45
JJ:;	>
h'DA~~a   UA.446<<>X-$F\\^w.$F$F?I!((++84?D%kk,:;;x&/@/?0@BH0IJK$M N==&1A2BDJ2K18^1224$5 6 ==&1A2BDJ2K18UT\11M$O P+ (4 JJ|,	h'DA"" }}%R%&( }} &,.4&57D&EFGI !}}Vf_7K%KQO"4(4( ( rE   c                    / nU R                  XU5      n[        R                  " S5      n[        U5       H  u  pxUR	                  UR                  SU5      R                  5       5        UR                  U5      (       d  ML  XG   R	                  S5        XG   R	                  UR                  SU5      R                  SS5      5        XG==   UR                  SU5      R                  5       -  ss'   M     U$ )zLReturn list of iptables rules appropriate for sending as arguments
to cmd()
z(.*) --log-prefix (".* ")(.*)r  r*   r   "rY   z\3)	r  r`   ra   r  r8   rf   r   matchreplace)	r;   r	  r   r
  r  str_snippetsrk   r   r   s	            rC   _get_lists_from_formatted,UFWBackendIptables._get_lists_from_formatted  s     55eVL jj9:l+DAOOCGGE1-3356yy||"">2""3775!#4#<#<S"#EFswwua06688 , rE   c                 ,	   U R                   S   /nU R                  5       (       a  UR                  U R                   S   5        U GH  n [        R                  R                  U5      n[        R                  " S5      n[        R                  " S5      n[        R                  " S5      nU GH{  nUn	Sn
SU;   a#  UR                  S5      u  pUR                  5       n
UR                  U	5      (       d  MI  UR                  SU	5      n[        R                  " S	UR                  5       5      n[        U5      S
:  d  [        U5      S:  a  [        S5      U-  n[!        U5        M  SnSnSn[        U5      S:X  d  [        U5      S:X  Ga,  [        S5      U-  nUS   R                  S5      S   nSUS   ;   a  SUS   ;   a  UR#                  US   5      (       al  UR#                  US   5      (       aS  US   R                  S5      S   R%                  S5      S   nUS   R                  S5      S   R%                  S5      S   nOpUS   R'                  S5      (       a  US   R%                  S5      S   nO?US   R'                  S5      (       a  US   R%                  S5      S   nO[!        U5        GM
   US   nSnSU;   a  SnUR                  S5      S   n[        U5      S:  a#  [)        UUS   US   US   US   US   UUU
5	      nO~[)        UUS   US   US   US   US   UUU
5	      n[        R                  " S5      nUS
   S :w  a  UR                  S!US
   5      Ul        US   S :w  a  UR                  S!US   5      Ul        US:w  a  UR/                  SU5        US:w  a  UR/                  S"U5        X R                   S   :X  a/  UR1                  S5        U R2                  R                  U5        GMO  UR1                  S5        U R4                  R                  U5        GM~     UR7                  5         GM     g$! [         a    [        S5      U-  n[        U5      ef = f! [         a    [        S#5      U-  n[!        U5         GM  f = f)%z$Read in rules that were added by ufwr   r   zCouldn't open '%s' for readingz^### tuple ###\s*zin_\w+zout_\w+rY   z	 comment=z\s+   	   z)Skipping malformed tuple (bad length): %sr      z$Skipping malformed tuple (iface): %srK   r   !   r   in_out_Fr   T            %20r$   r   r   zSkipping malformed tuple: %sN)r=   r7   r8   r   rb   open_file_readr_   rK   r   r`   ra   r   r  r  rf   r   r   rd   	partition
startswithr   r   r   set_interfaceset_v6r   r   close)r;   rfnsrl   r[   rh   	pat_tuplepat_iface_inpat_iface_out	orig_linero   r   hexr   rZ   wmsgdtyper   r   r   r#   rule	pat_spacewarn_msgs                          rC   _read_rulesUFWBackendIptables._read_rules  sI   

7#$==??KK

8,-A(xx..q1
 

#78I::i0LJJz2M!	 )+ ) =ID!iikG??4(($==T2D((64::<8C3x!|s3x!| !LM$( *T
  !%')(*s8q=CHM#$%K#L(,$.D$'GMM#$6q$9E"c"g~#&#b'>#/#6#6s2w#?#?#0#7#7B#@#@ ),Bc(:1(=(G(G(LQ(O %1 ),Bc(:1(=(G(G(LQ(O %2%(W%7%7%>%>36r73D3DS3I!3LL%(W%7%7%?%?47G4E4Ec4J14MM$(J$,%%(VF&+G"f}*.)/c):1)="3x!|'.vs1vs1vs1v/21vs1vug/6(8 (/vs1vs1vs1v/21vs1vug/6(8 -/JJu,=	#&q6S=09c3q60JDI#&q6S=09c3q60JDI+r1 $ 2 24 F,2 $ 2 25- H 

8 44 KK- KK..t4 KK. JJ--d3c "f JJL{   (<=Cw''(\  ( %'()G'H)-(/H N$	%s   Q9DQ+$Q(+#RRc                    U R                   S   nU(       a  U R                   S   n[        R                  " U[        R                  5      (       d  [	        SU-  5      n[        U5      e [        R                  R                  U5      nU R                  5         SnU R                  nU(       a  SnU R                  nU R                  (       a  [        R                  R!                  5       nOUS   n[        R                  R#                  US5        [        R                  R#                  USU-   S	-   5        [        R                  R#                  USU-   S
-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        US:X  a  U R$                  S   S   (       d  US:X  ac  U R$                  S   S   (       aL  [        R                  R#                  USU-   S-   5        [        R                  R#                  USU-   S-   5        [        R                  R#                  US5        U GHY  nUR&                  n	UR(                  (       a  SUR&                  -   n	UR*                  S:w  a  U	SUR*                  -   -  n	Sn
UR,                  S:X  a  UR.                  S:X  a  UR0                  n
OUR,                  S:w  a/  UR.                  S:w  a  S UR,                  < S!UR.                  < 3n
OOUR,                  S:w  a   XR0                  < SUR,                  < 3-  n
OXR0                  < SUR.                  < 3-  n
UR2                  S:X  a  UR4                  S:X  a  S"U	< S#UR6                  < S#UR8                  < S#UR:                  < S#UR<                  < S#UR>                  < S#U
< 3nUR@                  S:w  a  US$UR@                  -  -  n[        R                  R#                  X{S%-   5        GO[B        RD                  " S#5      nS&nUR2                  (       a  URG                  S'UR2                  5      nS&nUR4                  (       a  URG                  S'UR4                  5      nS"U	< S#UR6                  < S#UR8                  < S#UR:                  < S#UR<                  < S#UR>                  < S#U< S#U< S#U
< 3nUR@                  S:w  a  US$UR@                  -  -  n[        R                  R#                  X{S%-   5        S(nUR(                  (       a  S)nOUR0                  S*:X  a  S+nU< S,U< 3nS-U< S#URI                  5       < S%3nU RK                  UUU5       H#  n[        R                  R#                  UU5        M%     GM\     [        R                  R#                  US.5        [        R                  R#                  US/5         U RM                  U RN                  S0   5      nU H  u  nnn[Q        U5      S1:  a  US1   S2:X  a  M!  URS                  US&-   5      (       d  M<  [        R                  R#                  US#RU                  U5      RW                  S3S45      RW                  S5S65      S%-   5        M     [        R                  R#                  US75        US:X  a  U R$                  S   S   (       d  US:X  Ga  U R$                  S   S   (       a  [        R                  R#                  US85        U RN                  S0   S9:w  aU  [        R                  R#                  US-U-   S:-   S#RU                  U RX                  5      -   S;-   U RZ                  -   S<-   5        [        R                  R#                  US-U-   S=-   5        [        R                  R#                  US-U-   S>-   5        [        R                  R#                  US?5        [        R                  R#                  US@5         U R                  (       a!  [        R                  R]                  USA5        gB[        R                  R]                  U5        gB! [         a    e f = f! [         a    e f = f! [         a    e f = f)Cz.Write out new rules to file to user chain filer   r   z'%s' is not writabler   r   rZ   z*filter
r   z-user-input - [0:0]
z-user-output - [0:0]
z-user-forward - [0:0]
z-before-logging-input - [0:0]
z-before-logging-output - [0:0]
z -before-logging-forward - [0:0]
z-user-logging-input - [0:0]
z-user-logging-output - [0:0]
z-user-logging-forward - [0:0]
z-after-logging-input - [0:0]
z-after-logging-output - [0:0]
z-after-logging-forward - [0:0]
z-logging-deny - [0:0]
z-logging-allow - [0:0]
r&   r   r   z-user-limit - [0:0]
z-user-limit-accept - [0:0]
z### RULES ###
zroute:rY   rK   r(  z!out_z
### tuple ### r   z comment=%sr   r$   r.  r!   r#   r   r"   r   z-A z
### END RULES ###
z
### LOGGING ###
r   r   -D[z"[z] r  z### END LOGGING ###
z
### RATE LIMITING ###
offz-user-limit z "z "
z-user-limit -j REJECT
z-user-limit-accept -j ACCEPT
z### END RATE LIMITING ###
zCOMMIT
FN)/r=   r/   accessW_OKrK   r   r   rb   rc   r_   r   r   r   r<   sysstdoutfilenore   r   r   r#   r   r   r   r\   r   r   r   r   r   r   r   r   r`   ra   rf   format_ruler  _get_logging_rulesrL   r   r1  r1   r  r9   r:   rg   )r;   r   
rules_filerh   rm   r?   r   rn   r   r   ifaceststrr>  r   r   chain_suffixrB   rule_strr   lrules_tr   qs                         rC   _write_rulesUFWBackendIptables._write_rules  sF   ZZ(
H-J yyRWW--.*=>G7##	((%%j1C
 	

!LKKE;;""$BUB 	r;/r3#58O#OPr3#5)A$B 	Cr3#5)B$C 	D 	r3#5)J$K 	Lr3#5)K$L 	Mr3#5)L$M 	Nr3#5)H$I 	Jr3#5)I$J 	Kr3#5)J$K 	Lr3#5)I$J 	Kr3#5)J$K 	Lr3#5)K$L 	Mr3#5)B$C 	Dr3#5)C$D 	E E!dii&8&=F"tyy'9#'>HH""2s\'9-D(E FHH""2s\'9-K(L M 	r#45 AXXFyy!AHH,yyB#		/)F~~#2(=2%!//R*?+,>>1??K>>R'annEEFaooFFFvv|"ajj!''155!''155 99?MAII55D&&r$;7JJsO	66$==7D66$==7D

AGGQUUAGGQUUdF, 99?MAII55D&&r$;7"Lyy(%'$0,?E',ammo>H33Hl4@B&&r1-Bc l 	r#:; 	r#89	..t}}Z/HIH  GAq!1vzaddl||L3.//&&rHHQK''T2::4G	   	r#:; E!dii&8&=F"tyy'9#'>HH""2'BC}}Z(E1&&r5%,&(6,7$"9"9:,; , "&!=!=,> AH,H I HH""2u|';2(3 4HH""2u|';9(: ;HH""2'DEr:.	{{$$S%0$$S)o  		n  		B  		s*   *g  ,g/ 1g>  g>  g,/g;>h
c                    U R                  5         SnUR                  (       ak  U R                  5       (       d  [        S5      n[	        U5      eUR
                  S:X  a/  U R                  S   S   (       d  [        S5      UR
                  -  $ O?UR
                  S:X  a/  U R                  S   S   (       d  [        S5      UR
                  -  $ UR                  (       a6  UR                  S:w  a&  UR                  S	:w  a  [        S
5      n[	        U5      e/ nSnSnU R                  nUR                  n	UR                  (       aG  U R                  S:  a+  UR                  S:w  d  UR                  S:w  a  [        S5      $ U R                  nU	S:  d  U	[        U5      :  a  [        S5      U	-  n[	        U5      eU	S:  a'  UR                   (       a  [        S5      n[	        U5      e UR#                  5         Sn
SnSnSnU GH  n UR#                  5         UR&                  UR(                  UR                  UR                  4nX:X  aX  US   S:X  a  US   S:X  a  U
S:  d  US   S:X  a	  US   S:X  d  X:w  a$  SnUR+                  UR-                  5       5        SnOU	S-  n	UnU
S-  n
[.        R0                  " X5      nUS:  a  US-  nUS:X  aF  U(       d?  U(       d8  SnUR                   (       d"  UR+                  UR-                  5       5        GM  GM  US:X  a&  UR                   (       a  UR2                  S:X  a  SnGM@  US:  a>  UR                   (       d-  U(       d&  SnSnUR+                  UR-                  5       5        GM  UR+                  U5        GM     U(       a*  US:  a#  [        S5      nUR                  (       a  US-  nU$ OU(       d0  UR                   (       d  UR+                  UR-                  5       5        U(       dE  UR                   (       a4  U R4                  (       d#  [        S5      nUR                  (       a  US-  nU$ U(       a;  UR                   (       d*  U(       d#  [        S5      nUR                  (       a  US-  nU$ UR                  (       a  XPl        OXPl	         U R7                  UR                  5        [        S5      nUR                  (       a  [        S5      nU R9                  5       (       Ga  U R4                  (       Gd  SnU(       d'  U R;                  UR                  5      (       d  U(       ad  SnU(       a  U[        S5      -  nOU[        S5      -  nUR                  (       a  US-  nU(       a   U R=                  5         OU[        S 5      -  nOU(       a^  UR                   (       aM  S!n[        S"5      nUR                  (       a  US-  nU(       a   U R=                  5         SnO;U[        S 5      -  nO,U(       d%  U(       d  UR                   (       d  S#n[        S$5      nUS:w  Ga  U R>                  nS%nUR                  (       a  U R@                  nS&nUS-  nS'nURB                  (       a  S(nOURD                  S):X  a  S*nU< S+U< 3n[        S,5      n[G        US-US./5      u  nnUS:w  a  [	        U5      eU< S/U< S/URI                  5       < 3n[J        RL                  " S05      nU RO                  UUU5       H  n[G        U/U-   5      u  nnUS:w  a%  [Q        U[R        RT                  5        [	        U5        US#:X  d  MH  URW                  S/RY                  U5      5      (       d  Mo  UR[                  S1S/RY                  U5      5      n[G        US!US2S3/5      u  nnUS:w  d  M  []        S4U-  5        M     U$ ! [$         a    e f = f! [$         a    e f = f! [         a    e [$         a    [        S5      n[	        U5         GNZf = f! [$         a    e f = f! [$         a    e f = f)5a(  Updates firewall with rule by:
* appending the rule to the chain if new rule and firewall enabled
* deleting the rule from the chain if found and firewall enabled
* inserting the rule if possible and firewall enabled
* updating user rules file
* reloading the user rules file if rule is modified
rY   z)Adding IPv6 rule failed: IPv6 not enabledr&   r   z#Skipping unsupported IPv6 '%s' ruler   z#Skipping unsupported IPv4 '%s' ruleudptcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4r   zInvalid position '%d'z Cannot specify insert and deleter   )rY   rY   rY   rY   r'  r+  Tz Skipping inserting existing ruler   z"Could not delete non-existent rulezSkipping adding existing rulezCouldn't update rules filezRules updatedzRules updated (v6)zRule insertedzRule updatedz (skipped reloading firewall)rC  zRule deleted-Az
Rule addedr   r   r!   r#   r   r"   r   !Could not update running firewallru   rt   r   z(-A +)(ufw6?-user-[a-z\-]+)(.*)r   r(   RETURNzFAILOK: -D %s -j RETURN)/r   r   r7   rK   r   r   r   multir   r   positioniptables_versionr   r   r   r   remove	normalizer_   r   r   r8   dup_ruler   r  r   r<   rT  r   r   r   r   r   r#   r\   r   rK  r`   ra   r  r   rH  stderrrd   r1   rf   r   )r;   r=  allow_reloadrM   rh   newrulesfoundmodifiedr   r^  r   insertedmatcheslastr   currentretflagr   r?   rP  rB   r   r   rQ  r  r   r   s                               rC   set_ruleUFWBackendIptables.set_rule  s    	77==??GHw''{{g%dii.@.E>?4;;OO{{g%dii.@.E>?4;;OO::$--50T]]e5KIJG7##

==77$$u,$))r/26))r/UVVKKE a<8c%j0/0H=G7##a<DKK:;G7##	NN A uuaeeQVVQVV4G  GrMd1gm	AJ"$r)9?#HOODMMO4+DMHDQJE--(CQw1axh {{OODMMO4 #t{{t||r/AqX 0"Y \ {;<77GOD	  0 T[[=>77GODt{{88977GOD77"K!J	dgg& !77)*D ??T[[[D4,,TWW55Ao..DAn--D77GOD//1 A=>>D4;;( 77GOD//1 DA=>>D8DKKrzmm$77..C#)LGOD&<<#,L^^u,#+L(4lC ?@dE4 89	S7"7++)-ud6F6F6HI**%GH778D8DFA !$SEAIIRQwC, ) t|sxx{(C(C#KKsxx{;$'dAtX(F$G	S7!";q"ABF [  		  T  	 	45GW	2 %   % sB   '_ _)0_8 `) 1`8 _&)_58*`&%`&)`58ac                 r   / n/ nU(       a  U R                   nOU R                  nUR                  5       nUR                  U5        UR	                  5         UR                  5       nU HK  nUR                  5       nUR	                  5         UR                  5       n	X:X  d  M:  UR                  U5        MM     U$ )z@Return a list of UFWRules from the system based on template rule)r   r   rb  r3  ra  r   r8   )
r;   templater   r   r   normr   r   rZ   	tmp_tuples
             rC   get_app_rules_from_system,UFWBackendIptables.get_app_rules_from_system  s    	KKEJJE  "B!!#A**,CMMO))+I   %  rE   c                     U R                   nUR                  S5      (       a  U R                  n[        U/U-   5      u  pVUS:w  a/  [	        SU-  5      nU(       a  [        SU-   5        g[        U5      eg)zPerform command on chainr   r   zCould not perform '%s'zFAILOK: N)r   r1  r   r   rK   r   r   )r;   rB   r   fail_okr   r   r   rh   s           rC   r   UFWBackendIptables._chain_cmd  sn    mmF##..C%	70D9:Gj7*+w'' rE   c                    U R                   (       a  gU R                  5         / n U R                  U5      n U R	                  SS9  U R	                  SS9  U R                  5       (       d  g[        S5      nU R                  S   U R                  S   -   U R                  S	   -   U R                  S
   -    H  n U R                  USUS/5        M      U R                  S   U R                  S	   -   U R                  S
   -    H+  nU R                  USU/5        U R                  USU/5        M-     U Hb  u  pEnSn[        U5      S:  a  US   S:X  a  Sn US:X  a'  [        U5      S:  a  U R                  US/USS -   SS9  U R                  XEU5        Md     S H  nU R                  S   S   (       a  US:X  d!  U R                  S   S   (       d  M9  US:X  d  MA  U R                  USU/U R                  -   U R                  S-   /-   SS9  U R                  S   S:w  d  M  U R                  USU/U R                  -   U R                  S-   /-   SS9  M     g! [         a    e f = f! [
         a    e [         a    [        S5      n[        U5         GN?f = f! [         a    [        U5      ef = f! [         a    [        U5      ef = f! [         a    [        U5      ef = f)z#Update loglevel of running firewallNF)r   Tz&Couldn't update rules file for loggingr[  r   r   r   r   ru   rt   r   r   r   rC  delete_firstr   )rw  )r   r   r&   r   r   r   r   r   r   rE  -I)r<   r   rL  r_   rT  r   rK   r   r6   r   r   r   r9   r:   rL   )	r;   r   rules_trh   r   r   rS  rw  rB   s	            rC   r   !UFWBackendIptables.update_logging  s   ;; 		--e4G
	'&    78X&V)<<;;w "&++f"56A(D!T?36	$[[*T[[-AA{{6"#D!9-D!9-# GA!G1vzaddl(&3q6A:OOAv!"~tODg.  ;E		'"3'E5E,E		'"3''E5F,Fe} $ 7 7(8!%!=!=!C D(E )-   . ==,5OOED%=$($;$;,<%)%A%AC%G$H,I -1 $ 2 ;e  		  	 	@AGW	  (w''(  	$7##	$  (w''(sA   I I( :JAJ2 ?KI%(*JJJ/2KK!c                 |   / nU[        U R                  R                  5       5      ;  a  [        S5      U-  n[	        U5      eUS:X  a0  U R
                  S    H  nUR                  USUSS/S/5        M     U$ U R
                  S    H  nUR                  USUSS/S	/5        M     / S
QnU R                  U   U R                  S   :  Ga  / nU R                  U   U R                  S   :  a  UnU R
                  S    H  nS H  nUR                  U5      (       d  M  U R                  U5      S:X  d  U R                  U5      S:X  a!  SnUR                  USUSSSU/U-   S	/5        Mf  U R                  U   U R                  S   :  d  M  SnUR                  USUSSSU/U-   S	/5        M     M     / nU R                  U   U R                  S   :  a  UnU R
                  S    H  nUR                  S5      (       a  SnOyUR                  S5      (       ac  SnU R                  U   U R                  S   :  a   UR                  USUSSSSSS/U-   S	/5        O!UR                  USUSSSSSSSS/
U-   S	/5        UR                  USUSSSW/U-   S	/5        M     U R                  U   U R                  S   :  a  / nU R                  U   U R                  S   :  a  UnU R                  U   U R                  S   :  a  / SQU-   nS nU R
                  S!    H   nUR                  USUSSSU/U-   S	/5        M"     U$ )"z%Get rules for specified logging levelzInvalid log level '%s'rE  r   r{  r(   r\  rz  rC  rY   )r%   r&   r'   z3/minz--limit-burst10r   highr   r    rJ   rR   z[UFW BLOCK] rZ  r)   r*   mediumz[UFW ALLOW] r   rQ   r%   	conntrack	--ctstateINVALIDz[UFW AUDIT INVALID] full)r%   r  r  NEWz[UFW AUDIT] r   )	r   r   r   rK   r   r6   r8   endswithr   )	r;   r   r|  rh   r   r  largsr   r   s	            rC   rL  %UFWBackendIptables._get_logging_rules  s   T^^0023301U;G7##E> [[(D!T8#<nMN )N [[(D!T8#<bAB ) P
 >>% DNN5$99E~~e$t~~f'=="[[)7Azz!}}33A6(B33A6&@%3F#NNAau0>0H050679,; < "^^E2dnnX6NN%3F#NNAau0>0H050679,; < 8 *  E~~e$t~~f'=="[[(::g&&+FZZ''+F~~e,t~~h/GGD!T;,7,0(,<>C,DEG(I J  D!T;,7,0%,:,B	,D
 ).,.
 02(3 4 D!T5$2F$<>C$DEG I J# )* >>% DNN8$<<E ~~e$t~~f'==" ~~e$t~~f'==?*L#F[[*D!T5$2F$<>C$DEG I J + rE   c           
      .   Sn[        [        R                  R                  U R                  5      n/ nU R
                   H  nU R
                  U   R                  S5      (       d  M(  UR                  U R
                  U   5        [        R                  R                  US[        R                  R                  U R
                  U   5      5      n[        R                  R                  U5      (       a  M  [        S5      U-  n[        U5      e   [        R                   " S5      nU HI  nU< SU< 3n[        R                  R#                  U5      (       d  M2  [        S5      U-  n[        U5      e   U HS  nU< SU< 3nU[        S5      [        R                  R                  U5      US	.-  -  n[        R$                  " XE5        MU     U GH  nU< SU< 3n[&        R(                  " [        R                  R                  US[        R                  R                  U5      5      [        R                  R+                  U5      5        [&        R,                  " X5         [        R.                  " U5      n	U	[.        R0                     n
U
[.        R6                  -  (       a  U[        S5      U-  -  nM  U
[.        R8                  -  (       d  GM  U[        S5      U-  -  nGM     U$ ! [2         a    [        S
5      U-  n[5        U5         GMB  f = f)zReset the firewallrY   z.rulesr   zCould not find '%s'. Abortingz%Y%m%d_%H%M%S.z'%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s'
)oldnewzCouldn't stat '%s'zWARN: '%s' is world writablezWARN: '%s' is world readable)r
   r   r+   	share_dirr   r=   r  r8   r/   r0   r1   basenameisfilerK   r   timestrftimeexistsrenameshutilcopydirnamecopymodestatST_MODEr_   r   S_IWOTHS_IROTH)r;   resr  allfilesr   fnrh   extr  statinfomoder?  s               rC   resetUFWBackendIptables.reseth  sd   cjj22DLLA	A::a=))(33OODJJqM*i gg..tzz!}=?B77>>"%%;<Cw''  mmO, As#Bww~~b!!;<Cw''	  As#B1:;WW--a0<> >CIIa	  A$CKKY
%'WW%5%5a%8:*, OOC#771:- dll"q78A>>$$q78A>>% ( 
  12a8Xs   %)K,,#LL)r6   r-   r   r   r   r   r9   r:   )NN)FF)F)T)__name__
__module____qualname____firstlineno____doc__r5   rN   rp   r   r   r   r   r   r   r  r  r@  rT  rn  rt  r   r   rL  r  __static_attributes__ rE   rC   r   r      sx    '.;`IV[zc/J($,B8;8BH$cJgRcJ0(H2TXt8rE   r   )r  r/   r`   r  r  rH  r  
ufw.commonr   r   ufw.utilr   r   r   r   r	   r
   ufw.backendr   r3   r4   r   r  rE   rC   <module>r     s@    3" 
 	   
  ( ? ? B// BrE   