U
    ³õ\7j  ã                   @   s~   d Z ddlZddlZddlZddlZddlZddlZddlZddlm	Z	m
Z
mZmZ ddlmZmZ ddlZG dd„ dƒZdS )z&backend.py: interface for ufw backendsé    N)ÚerrorÚwarnÚdebugÚ	_findpath)ÚUFWErrorÚUFWRulec                   @   sô   e Zd ZdZd=dd„Zdd„ Zdd„ Zd	d
„ Zd>dd„Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd „ Zd!d"„ Zd#d$„ Zd%d&„ Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Zd1d2„ Zd3d4„ Zd5d6„ Zd7d8„ Zd9d:„ Zd;d<„ ZdS )?Ú
UFWBackendzInterface for backendsNc                 C   sJ  d | _ || _|| _g | _g | _ttjj|ƒ}t	j
 |d¡t	j
 |d¡t	j
 |d¡dœ| _|d k	rl| j |¡ ddddd	d
œ| _tjj| _|  ¡  |  ¡  |  ¡  tj | jd ¡| _t	j
 tjjd¡| _t	j
 tjjd¡| _t	j
 tjjd¡| _t	j
 tjjd¡| _ztj | j¡| _W n& tk
r>   tdƒ}t |ƒ‚Y nX d | _!d S )Nzdefault/ufwzufw/ufw.confzufw/applications.d)ÚdefaultsÚconfÚappsr   éd   éÈ   i,  i  )ÚoffÚlowZmediumZhighZfullr   Úiptablesziptables-restoreÚ	ip6tableszip6tables-restorez#Couldn't determine iptables version)"r	   ÚnameÚdryrunÚrulesÚrules6r   ÚufwÚcommonZ
config_dirÚosÚpathÚjoinÚfilesÚupdateÚ	loglevelsÚ	do_checksÚ
_do_checksÚ_get_defaultsZ_read_rulesÚapplicationsZget_profilesÚprofilesZiptables_dirr   Ziptables_restorer   Zip6tables_restoreÚutilZget_iptables_versionZiptables_versionÚOSErrorÚ_r   Úcaps)Úselfr   r   Zextra_filesZrootdirZdatadirÚpÚerr_msg© r*   ú-/usr/lib/python3/dist-packages/ufw/backend.pyÚ__init__    sJ    þü
ÿÿzUFWBackend.__init__c              
   C   sf  | j dk	rdS i | _ i | j d< d| j d d< d| j d d< | jrbt ¡ dkrb| jsbztj | j¡}W nH t	k
r² } z*d| }|  
¡ r”t|ƒ t|ƒ W Y ¢dS d}~X Y nX d	|krÔd
|krÔd| j d d< nd| j d d< |  ¡ rbztj | j¡}W n0 t	k
r. } ztd| ƒ W 5 d}~X Y nX d	|krTd
|krTd| j d d< nd| j d d< dS )zgInitialize the capabilities database. This needs to be called
           before accessing the database.NÚlimitTÚ4FÚ6r   zinitcaps
%sz
recent-setzrecent-update)r&   r   r   Úgetuidr   r   r#   Zget_netfilter_capabilitiesr   r$   Ú
is_enabledr   r   Úuse_ipv6r   )r'   Znf_capsÚeÚmsgr*   r*   r+   ÚinitcapsL   s4    


zUFWBackend.initcapsc                 C   s    d| j kr| j d dkrdS dS )z!Is firewall configured as enabledÚenabledÚyesTF)r	   ©r'   r*   r*   r+   r1   x   s
    
ÿzUFWBackend.is_enabledc                 C   s,   d| j kr(| j d dkr(tj d¡r(dS dS )z"Is firewall configured to use IPv6Zipv6r7   z/proc/sys/net/ipv6TF)r	   r   r   Úexistsr8   r*   r*   r+   r2      s    
ÿ
þzUFWBackend.use_ipv6ÚinputFc           	      C   sè   d| d }d}| j | dkr$d}n| j | dkr8d}nd}|rä|dkräd	}td
ƒ}tj ddg¡\}}|dkrxt|ƒ‚d|kr„d}|  ¡ rÜtj ddg¡\}}|dkr´d|kr´d}tj ddg¡\}}|dkrÜd|krÜd}|säd}|S )z.Get default policy for specified primary chainZdefault_Z_policyÚ ÚacceptÚallowÚrejectÚdenyÚforwardFzproblem running sysctlZsysctlznet.ipv4.ip_forwardr   Ú1Tz net.ipv6.conf.default.forwardingznet.ipv6.conf.all.forwardingZdisabled)r	   r%   r   r#   Úcmdr   r2   )	r'   ZprimaryZcheck_forwardÚpolicyÚrstrr6   r)   ZrcÚoutr*   r*   r+   Ú_get_default_policy‡   s2    zUFWBackend._get_default_policyc              	   C   sp  | j stdƒ}t|ƒ dS t ¡ t ¡ kr:tdƒ}t|ƒ‚t ¡ t ¡ krZtdƒ}t|ƒ‚t ¡ }|dkrztdƒ}t|ƒ‚i }i }i }g }tj	 
| jd ¡s¸tdƒ| jd  }t|ƒ nDt d	¡}t | jd ¡D ](}	| |	¡sÒ| tj	 | jd |	¡¡ qÒt| j ¡ ƒtj	 tjd ¡g | D ]ú}
|
 d
¡sDdt ¡ |
f }
td|
 ƒ |
| jd krxtj	 
| jd ¡sxq"zt |
¡}|tj }W n@ tk
rº   tdƒ|
 }t|ƒ‚Y n tk
rÐ   ‚ Y nX d}d}d}z4t |j ¡d |kst |j ¡d |krd}W n t!k
r(   Y nX |j dkrt|st|
|krttdƒt"|ƒ|
t"|j ƒdœ }t|ƒ d||
< |tj#@ r¦|
|kr¦tdƒ|
 }t|ƒ d||
< |tj$@ rä|
|krä|j%dkrätdƒ|
 }t|ƒ d||
< |
d
kròq"|
}tj	 &|
¡}
|
sDtt'j(d| ƒ‚qDq"| jD ]D}|dkr&tj	 )| j| ¡s&tdƒ|| j| dœ }t|ƒ‚q&dS )a8  Perform basic security checks:
        is setuid or setgid (for non-Linux systems)
        checks that script is owned by root
        checks that every component in absolute path are owned by root
        warn if script is group writable
        warn if part of script path is group writable

        Doing this at the beginning causes a race condition with later
        operations that don't do these checks.  However, if the user running
        this script is root, then need to be root to exploit the race
        condition (and you are hosed anyway...)
        zChecks disabledTz%ERROR: this script should not be SUIDz%ERROR: this script should not be SGIDr   z&You need to be root to run this scriptr   z'%s' does not existz^\.ú/z%s/%sz	Checking zCouldn't stat '%s'ZclickpkgZ	snappypkgFz4uid is %(uid)s but '%(path)s' is owned by %(st_uid)s)Úuidr   Úst_uidz%s is world writable!z%s is group writable!zCould not find parent for '%s'z&'%(f)s' file '%(name)s' does not exist)Úfr   N)*r   r%   r   r   r0   Úgeteuidr   ÚgetgidÚgetegidr   Úisdirr   ÚreÚcompileÚlistdirÚsearchÚappendr   ÚlistÚvaluesÚabspathÚsysÚargvÚ
startswithÚgetcwdr   ÚstatÚST_MODEr$   Ú	ExceptionÚpwdÚgetpwuidrI   ÚKeyErrorÚstrÚS_IWOTHÚS_IWGRPÚst_gidÚdirnameÚerrnoZENOENTÚisfile)r'   r)   rH   Zwarned_world_writeZwarned_group_writeZwarned_ownerr"   Zwarn_msgÚpatÚprofiler   ZstatinfoÚmodeZ
click_userZ	snap_userZis_unpack_userZ	last_pathrJ   r*   r*   r+   r   ­   s¸    


ÿþ
ÿ
ÿÿþÿÿ
ÿÿ
ÿzUFWBackend._do_checksc           
   	   C   s  i | _ | jd | jd fD ]”}ztj |¡}W n( tk
rV   tdƒ| }t|ƒ‚Y nX t 	d¡}|D ]>}| 
|¡rft d| ¡ ¡}|d  ¡  d¡| j |d  ¡ < qf| ¡  qd	d
dg}dD ]V}d| | j krätd| ƒ}t|ƒ‚| j d|  }	|	|kr¾td|	|dœ ƒ}t|ƒ‚q¾dS )z#Get all settings from defaults filer	   r
   zCouldn't open '%s' for readingz^\w+="?\w+"?ú=é   ú"'r   r<   Zdropr>   )r:   Úoutputr@   zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')rC   ÚchainN)r	   r   r   r#   Zopen_file_readr]   r%   r   rO   rP   rR   ÚsplitÚstripÚlowerÚclose)
r'   rJ   Úorigr)   rh   ÚlineÚtmpZpoliciesÚcr(   r*   r*   r+   r      s0    

"

ÿzUFWBackend._get_defaultsc           
      C   s  t  d|¡stdƒ}t|ƒ‚t |tj¡s>td| ƒ}t|ƒ‚tj 	|¡}|d }d}t  
d| d ¡}|d D ]<}	| |	¡ržtj ||d | d	 ¡ d
}qptj ||	¡ qp|sÌtj ||d | d	 ¡ ztj |¡ W n tk
rò   ‚ Y nX | ¡  d¡| j| ¡ < dS )zSets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writablerv   Fú^rk   rt   Ú
Trm   N)rO   Úmatchr%   r   r   ÚaccessÚW_OKr   r#   Z
open_filesrP   rR   Zwrite_to_fileZclose_filesr]   rr   rq   r	   )
r'   ÚfnZoptÚvaluer)   ZfnsÚfdÚfoundrh   ru   r*   r*   r+   Úset_default:  s,    
zUFWBackend.set_defaultc                 C   s¢   | j s’|dkr$|  | jd dd¡ nn|dkrB|  | jd dd¡ nP|dkr`|  | jd dd¡ n2|d	kr~|  | jd dd
¡ ntdƒ| }t|ƒ‚tdƒ| }|S )z+Sets default application policy of firewallr=   r	   ZDEFAULT_APPLICATION_POLICYz"ACCEPT"r?   z"DROP"r>   z"REJECT"Úskipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')r   r   r   r%   r   )r'   rC   r)   rD   r*   r*   r+   Úset_default_application_policy^  s2    þþþþz)UFWBackend.set_default_application_policyc                 C   s\  g }t | j ¡ ƒ}|j|kr\|j|kr\tj | j|j ¡}tj | j|j ¡}|D ] }| ¡ }d|_	| 
dd¡ tj |¡\}}	| |	¡ | 
|d¡ |j	|_	|j|jkrðd|_tj |¡\}}	| |	¡ | 
|d¡ |j|_| |¡ qV|D ]b}
| ¡ }d|_tj |
¡\}}	| |	¡ | 
|d¡ |jdkrD| |j¡ |j|_| |¡ qôqVnÞ|j|krÌtj | j|j ¡D ]L}| ¡ }d|_tj |¡\}}	| |	¡ | 
|d¡ |j|_| |¡ q|nn|j|kr:tj | j|j ¡D ]L}| ¡ }d|_	tj |¡\}}	| |	¡ | 
|d¡ |j	|_	| |¡ qìt|ƒdk rXtdƒ}t|ƒ‚|S )z4Return a list of UFWRules based on the template ruler;   ÚanyÚsrcÚdstrl   z&No rules found for application profile)rT   r"   ÚkeysZdportZsportr   r!   Z	get_portsÚdup_ruleÚdappÚset_portr#   Zparse_port_protoÚset_protocolÚsapprS   ZprotocolÚlenr%   r   )r'   Útemplater   Zprofile_namesZdportsZsportsÚirv   ZportÚprotoÚjÚruler(   r)   r*   r*   r+   Úget_app_rules_from_templatey  sh    





z&UFWBackend.get_app_rules_from_templatec                 C   sX  g }g }d}d}d}| j | j D ]Ì}|j|ks8|j|krÐ| ¡ }||krLq qì| ¡ }	|	 d¡ |	jdkrv|	 |	jd¡ |	jdkrŽ|	 |	jd¡ |  |	¡}
|
D ](}| 	¡  |j
rº| |¡ qœ| |¡ qœ|}d}q |j
râ| |¡ q | |¡ q |rP|| _ || _|tdƒ| 7 }z|  d¡ |  d¡ W n& tk
rN   tdƒ}t|ƒ‚Y nX ||fS )	z’Update rule for profile in place. Returns result string and bool
           on whether or not the profile is used in the current ruleset.
        r;   Fr„   r†   r…   TzRules updated for profile '%s'z!Couldn't update application rules)r   r   r‰   rŒ   Úget_app_tuplerˆ   r‹   rŠ   r“   Z	normalizeÚv6rS   r%   Z_write_rulesr]   r   )r'   ri   Zupdated_rulesZupdated_rules6Z
last_tuplerD   Zupdated_profileÚrÚtuplrŽ   Znew_app_rulesZnew_rr)   r*   r*   r+   Úupdate_app_rule½  sP    


ÿ
zUFWBackend.update_app_rulec                 C   s”   || j kr|S d}d}t| j  ¡ ƒD ] }| ¡ | ¡ kr$|}|d7 }q$d||f }t|ƒ |dkrf|S |dkr|tdƒ| }ntdƒ| }t|ƒ‚dS )z2Find the application profile name for profile_namer;   r   rl   z'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s'N)r"   rT   r‡   rr   r   r%   r   )r'   Zprofile_namerz   ZmatchesÚnZ	debug_msgr)   r*   r*   r+   Úfind_application_nameû  s(    

ÿÿz UFWBackend.find_application_namec                 C   s@  |r|t | jƒkrtƒ ‚|s0|t | jƒkr0tƒ ‚|dk r>tƒ ‚g }|rN| j}n| j}i }d}t|ƒD ]N\}}||krx q´d}|jdks|jdkrd| ¡ }||krª|d7 }qdd||< qdg }|rä| j}| j|d |   ¡ }	|	 	d¡ n&| j}| j|d |   ¡ }	|	 	d¡ d}
|D ](}t
 ||	¡dkr0|
  S |
d7 }
qdS )a.  Return the absolute position in the other list of the rule with the
           user position of the given list. For example, find_other_position(4,
           True) will return the absolute position of the rule in the ipv4 list
           matching the user specified '4' rule in the ipv6 list.
        rl   r   r;   TF)r   r   Ú
ValueErrorr   Ú	enumerater‰   rŒ   r”   rˆ   Zset_v6r   rz   )r'   Zpositionr•   r   Ú	app_rulesZtuple_offsetr   r–   r—   Z
match_ruleÚcountr*   r*   r+   Úfind_other_position  sF    


zUFWBackend.find_other_positionc                 C   s|   d}t dƒ}d| jks.| jd t| j ¡ ƒkr@d}|t dƒ7 }n4| j| jd  }|dkrb|d7 }n|d| jd  7 }||fS )z"Gets current log level of firewallr   z	Logging: ÚlogleveléÿÿÿÿÚunknownr   zon (%s))r%   r	   rT   r   r‡   )r'   ÚlevelrD   r*   r*   r+   Úget_loglevelO  s    
ÿ
zUFWBackend.get_loglevelc                 C   sš   |t | j ¡ ƒdg kr,tdƒ| }t|ƒ‚|}|dkr`d| jksP| jd dkrVd}n
| jd }|  | jd d|¡ |  |¡ |dkrŽtdƒS td	ƒS d
S )zSets log level of firewallZonzInvalid log level '%s'r    r   r   r
   ZLOGLEVELzLogging disabledzLogging enabledN)	rT   r   r‡   r%   r   r	   r   r   Úupdate_logging)r'   r£   r)   Z	new_levelr*   r*   r+   Úset_loglevel_  s    
ÿ

zUFWBackend.set_loglevelc                 C   s   | j | j S )zReturn list of all rules)r   r   r8   r*   r*   r+   Ú	get_rulesu  s    zUFWBackend.get_rulesc                 C   st   g }|r| j }n| j}d}i }|D ]L}d}|jdks>|jdkrf| ¡ }||kr^td| ƒ q"nd||< |d7 }q"|S )z/Return number of ufw rules (not iptables rules)r   r;   úSkipping found tuple '%s'Trl   )r   r   r‰   rŒ   r”   r   )r'   r•   r   rž   r   r–   r—   r*   r*   r+   Úget_rules_county  s     
zUFWBackend.get_rules_countc                 C   sz   |   ¡ }d}i }|D ]`}d}|jdks0|jdkrX| ¡ }||krPtd| ƒ qnd||< |t|ƒkrl|  S |d7 }qdS )z:Return rule specified by number seen via "status numbered"rl   r;   r¨   TN)r§   r‰   rŒ   r”   r   Úint)r'   Znumr   rž   r   r–   r—   r*   r*   r+   Úget_rule_by_number‘  s    
zUFWBackend.get_rule_by_numberc                 C   s>   g }d}|   ¡ D ](}|d7 }| |¡}|dk r| |¡ q|S )zmSee if there is a matching rule in the existing ruleset. Note this
           does not group rules by tuples.r   rl   )r§   Zfuzzy_dst_matchrS   )r'   r’   Zmatchedrž   r–   Zretr*   r*   r+   Úget_matching§  s    
zUFWBackend.get_matchingc                 C   s   t dƒ‚dS )z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to overrideN©r   )r'   rC   Ú	directionr*   r*   r+   Úset_default_policyµ  s    zUFWBackend.set_default_policyc                 C   s   t dƒ‚dS )zGet status of running firewallz,UFWBackend.get_running_raw: need to overrideNr­   )r'   Z
rules_typer*   r*   r+   Úget_running_raw¹  s    zUFWBackend.get_running_rawc                 C   s   t dƒ‚dS )zGet managed rulesz'UFWBackend.get_status: need to overrideNr­   )r'   ÚverboseZ
show_countr*   r*   r+   Ú
get_status½  s    zUFWBackend.get_statusc                 C   s   t dƒ‚dS )zUpdate firewall with rulez%UFWBackend.set_rule: need to overrideNr­   )r'   r’   Zallow_reloadr*   r*   r+   Úset_ruleÁ  s    zUFWBackend.set_rulec                 C   s   t dƒ‚dS )zStart the firewallz+UFWBackend.start_firewall: need to overrideNr­   r8   r*   r*   r+   Ústart_firewallÅ  s    zUFWBackend.start_firewallc                 C   s   t dƒ‚dS )zStop the firewallz*UFWBackend.stop_firewall: need to overrideNr­   r8   r*   r*   r+   Ústop_firewallÉ  s    zUFWBackend.stop_firewallc                 C   s   t dƒ‚dS )z%Get a list if rules based on templatez6UFWBackend.get_app_rules_from_system: need to overrideNr­   )r'   rŽ   r•   r*   r*   r+   Úget_app_rules_from_systemÍ  s    z$UFWBackend.get_app_rules_from_systemc                 C   s   t dƒ‚dS )z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrideNr­   )r'   r£   r*   r*   r+   r¥   Ò  s    zUFWBackend.update_loggingc                 C   s   t dƒ‚dS )zReset the firewallz"UFWBackend.reset: need to overrideNr­   r8   r*   r*   r+   ÚresetÖ  s    zUFWBackend.reset)NNN)r:   F) Ú__name__Ú
__module__Ú__qualname__Ú__doc__r,   r5   r1   r2   rF   r   r    r   rƒ   r“   r˜   rš   rŸ   r¤   r¦   r§   r©   r«   r¬   r¯   r°   r²   r³   r´   rµ   r¶   r¥   r·   r*   r*   r*   r+   r      s@       ÿ
,,
&p$D><r   )r»   rf   r   r^   rO   r[   rW   Zufw.utilr   r   r   r   r   Z
ufw.commonr   r   Zufw.applicationsr   r*   r*   r*   r+   Ú<module>   s   