/usr/lib/python3/dist-packages/ufw/__pycache__
Edit: /usr/lib/python3/dist-packages/ufw/__pycache__/common.cpython-310.pyc (14446B)
o
MHdX @ sj d Z ddlZddlZddlZddlmZ dZdZdZeZ dZ
dZ d Z d
Z
G d d d eZG d
d dZdS )z!common.py: common classes for ufw N)debugufwz/lib/ufwz/usr/share/ufwz/etcz/usrz /usr/sbinTc @ s e Zd ZdZdd Zdd ZdS )UFWErrorz$This class represents ufw exceptionsc C s
|| _ d S N)value)selfr r ,/usr/lib/python3/dist-packages/ufw/common.py__init__#
zUFWError.__init__c C s
t | jS r )reprr r r r r __str__& r zUFWError.__str__N)__name__
__module__ __qualname____doc__r
r r r r r r ! s r c @ s e Zd ZdZ d9ddZd d
Zd d Zd
d Zdd Zdd Z d:ddZ
dd Z dd Z dd Z
d d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2d3 Zd4d5 Zd6d7 Zd8S );UFWRulez$This class represents firewall rulesany 0.0.0.0/0inF c
C s d| _ d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _|| _d| _z,| | | | | | | |d | | | | | | | | W d S tym w )NFr r src)removeupdatedv6dstr dportsportprotocolmultidappsappactionpositionlogtype interface_in
interface_out directionforwardcomment
set_action set_protocolset_portset_srcset_dst
set_direction set_commentr )
r r# r r r r r r( r) r* r r r r
, s>
zUFWRule.__init__c C s | S r ) format_ruler
r r r r O s zUFWRule.__str__c C s> d| }t | j}| |D ]
}|d|| j| f 7 }q|S )zPrint rule to stdoutz'%s'z, %s=%s)list__dict__sort)r reskeyskr r r _get_attribR s
zUFWRule._get_attribc C s t | j| j}| j|_| j|_| j|_| j|_| j|_| j|_| j |_ | j
|_
| j |_ | j |_ | j
|_
| j|_| j|_| j|_| j|_| j|_| j|_|S )z Return a duplicate of a rule)r r# r r r r r r r r r r! r" r$ r% r& r' r( r) r* )r ruler r r dup_rule[ s& zUFWRule.dup_rulec C sr d}| j dkr|d| j 7 }| jdkr|d| j 7 }| jdkr$|d7 }nD|d| j 7 }| jrh|d7 }| jdkrO| jdkrO|d| j 7 }|d7 }|d | j 7 }n| jdkr\|d| j 7 }n | jdkrh|d | j 7 }| jd
kry| jd kry|d | j 7 }| js| jdkr|d
| j 7 }| jd
kr| jd kr|d| j 7 }| js| jdkr|d| j 7 }d}| jdkrd| j }| j dkr|d| 7 }n'| j dkr|d| 7 }| jdkr|d7 }n| j dkr|d| 7 }n|d| 7 }| j
dks| j dkr5d}t
d}| j
dkr
|d |d | j
7 }| j
dkr| j dkr|d 7 }| j dkr+|d |d | j 7 }|d 7 }|d| 7 }| S )!z Format rule for later parsingr z -i %sz -o %sr z -p allz -p z
-m multiportz
--dports z
--sports r ::/0z -d z --dport z -s z --sport _allowz -j ACCEPT%srejectz -j REJECT%stcpz --reject-with tcp-resetlimitz -j LIMIT%sz
-j DROP%sz-m comment --comment ' dapp_z%20,sapp_')r& r' r r r r r r r% r# r! r" recompilesubstrip)r rule_strlstrr* pat_spacer r r r2 r sf
zUFWRule.format_rulec C sj | d}|d dks|d dks|d dkr |d | _nd| _d}t|dkr.|d }| | d S )
zSets action of the ruler= r r> r? rA denyr N)lowersplitr# len set_logtype)r r# tmpr% r r r r+ s $ zUFWRule.set_actionr c C s t d| }|dkr n|dkr| jrn|dkr| jrntd|s'td|r+t||d|d d kr;t||d}t|d
krId | _ d }|D ]y}td
|rd | _ |d}|D ]}t
|d
k smt
|dkrqt|q_t
|d t
|d
krt|n4td|rt
|d
k st
|dkrt|n td|rzt |}W n t
y t|w t||r|dt| 7 }qMt|}qM|}|dkrt|| _dS t|| _dS )z:Sets port and location (destination or source) of the rulez
Bad port '%s'r r r z^[,:]z[,:]$rD : rO Tr z ^\d+:\d+$i r z^\d+$z
^\w[\w\-]+N)r= r! r" rG matchr countrQ rR r intsocket
getservbyname Exceptionstrr r ) r portlocerr_msgportsrT pranqr r r r- sX
zUFWRule.set_portc C s0 |t jjdg v r|| _dS td| }t|)zSets protocol of the ruler zUnsupported protocol '%s'N)r utilsupported_protocolsr r= r )r r r` r r r r, s
zUFWRule.set_protocolc C s | j r)| jr| jdks| jdkrd| _| jr%| jdks | jdkr'd| _dS dS dS | jr9| jdks6| jdkr9d| _| jrK| jdksF| jdkrMd| _dS dS dS )z Adjusts src and dst based on v6r r r< N)r r r r
r r r
_fix_anywhere s
zUFWRule._fix_anywherec C s || _ | dS )zXSets whether this is ipv6 rule, and adjusts src and dst
accordingly.
N)r rg )r r r r r set_v6 s zUFWRule.set_v6c C @ | }|dkrtj|dstd}t||| _| dS )zSets source address of ruler zBad source addressN)rP r re
valid_addressr= r r rg r addrrT r` r r r r. zUFWRule.set_srcc C ri )z Sets destination address of ruler zBad destination addressN)rP r re rj r= r r rg rk r r r r/ rm zUFWRule.set_dstc C s |dkr|dkrt d}t|dt|v r t d}t|dt|v r,t d}t|t|dks8t|d kr@t d
}t|tt|d krPt d }t|tt|d
kr`t d}t|tdt|spt d}t||dkry|| _dS || _dS )zSets an interface for ruler outzBad interface type!z+Bad interface name: reserved character: '!'rU z/Bad interface name: can't use interface aliases.z..z)Bad interface name: can't use '.' or '..'r z+Bad interface name: interface name is empty z+Bad interface name: interface name too longz^[a-zA-Z0-9_\-\.\+,=%@]+$zBad interface nameN)r= r r] rR rG rW r& r' )r if_typenamer` r r r
set_interface' s0
zUFWRule.set_interfacec C s> t |dkrtdt |std| }t|t|| _dS )z Sets the position of the rulez-1z^[0-9]+z,Insert position '%s' is not a valid positionN)r] rG rW r= r rY r$ )r numr` r r r set_positionW s zUFWRule.set_positionc C sB | dks| dks|dkr| | _dS td| }t|)zSets logtype of the rulelogzlog-allr zInvalid log type '%s'N)rP r% r= r )r r% r` r r r rS a s
zUFWRule.set_logtypec C s. |dks|dkr
|| _ dS td| }t|)zSets direction of the ruler rn zUnsupported direction '%s'N)r( r= r )r r( r` r r r r0 j s
zUFWRule.set_directionc C s t j| jS )z Get decoded comment of the rule)r re
hex_decoder* r
r r r get_commentr s zUFWRule.get_commentc C s
|| _ dS )zSets comment of the ruleN)r* )r r* r r r r1 v s
zUFWRule.set_commentc C s d}| j r(ztj| j | j\| _ }W n ty" td}t|w |r(|| _| j rNztj| j | j\| _ }W n tyH td}t|w |rN|| _| j
rc| j
d}tj | d
|| _
| jrz| j d}tj | d
|| _dS dS )z&Normalize src and dst to standard formFz"Could not normalize source addressz'Could not normalize destination addressrD N)r r re normalize_addressr r\ r= r r r r rQ
human_sortjoinr )r changedr` ra r r r normalizez s@
zUFWRule.normalizec C s | r|st d| |f }| j|jkrt| dS | j|jkr%t| dS | j|jkr1t| dS | j|jkr=t| dS | j|jkrIt| dS | j|jkrUt| dS | j|jkrat| dS | j |j krmt| dS | j
|j
kryt| dS | j |j krt| dS | j |j krt| dS | j
|j
krt| dS | j|jkr| j|jkr| j|jkrtd}t| dS | j|jkr| j|jkr| j|jkrtd}t| dS td| j|j| j|j| j|jd }t| d S )
zCheck if rules match
Return codes:
0 match
1 no match
-1 match all but action, log-type and/or comment
-2 match all but comment
zNo match '%s' '%s'rO zFound exact matchr z$Found exact match, excepting commentzZFound non-action/non-logtype/comment match (%(xa)s/%(ya)s/'%(xc)s' %(xl)s/%(yl)s/'%(yc)s'))xayaxlylxcyc)
ValueErrorr r r r r r r r! r" r& r' r( r) r# r% r* r= )xydbg_msgr r r rW sr z
UFWRule.matchc C s dd }| r|s t | |dkrdS d| | j||jf }|jdkr-td| d dS |j| jkr;t|d dS | j|jkrN|jd
krNtd | dS |jd
krb|| j|jsbtd | dS |jd
kr| jd
krs| | j
rsn| j
|j
krd|j
vrtd| dS | j
|j
krd|j
v r| j|jkrt j
| j
|j
| jstd| d| j
|j
f dS n| jd
kr| j|jkrtd| d| j|jf dS z t j |j| j}W n ty td| d|j Y dS w |j
|kr
d|j
vr
td| d|j
|f dS |j
|kr7d|j
v r7| j|jkr7t j
||j
| js7td| d||j
f dS | j|jkrNtd| d| j
|j
f dS td| | j||jf dS )a This will match if x is more specific than y. Eg, for protocol if x
is tcp and y is all or for address if y is a network and x is a
subset of y (where x is either an address or network). Returns:
0 match
1 no match
-1 fuzzy match
This is a fuzzy destination match, so source ports or addresses
are not considered, and (currently) only incoming.
c S s~ d| v sd| v r| |krdS dS | dD ]'}| |kr dS d|v r<| d\}}t| t|kr
._match_portsr z(No fuzzy match '%s (v6=%s)' '%s (v6=%s)'r z (direction) z (not incoming)rO z (forward does not match)r z (protocol) z(dport) r /z(dst) z ('%s' not in network '%s')z (interface) z (%s != %s)z %s does not existz(v6) z'(fuzzy match) '%s (v6=%s)' '%s (v6=%s)'r )r rW r r( r r) r r r& _is_anywherer r re
in_networkget_ip_from_ifIOError)r r r r if_ipr r r fuzzy_dst_match s
"
& zUFWRule.fuzzy_dst_matchc C s |dks|dkr
dS dS )z Check if address is anywherer< r TFr )r rl r r r r N s zUFWRule._is_anywherec C s d}| j dks | jdkred| j | j| j| jf }| j dkr)d| j| j| j| jf }| jdkr:d| j | j| j| jf }| jdkrM| jdkrM|d| j 7 }|S | jdkrY|d| j 7 }| jdkre|d| j 7 }|S )a Returns a tuple to identify an app rule. Tuple is:
dapp dst sapp src direction_iface|direction
or
dport dst sapp src direction_iface|direction
or
dapp dst sport src direction_iface|direction
where direction_iface is of form 'in_eth0', 'out_eth0' or
'in_eth0 out_eth0' (ie, both interfaces used). If no interfaces are
specified, then tuple ends with the direction instead.
r z %s %s %s %sz %sz in_%sz out_%s) r! r" r r r r r& r' r( )r tuplr r r
get_app_tupleT s&
zUFWRule.get_app_tuplec C s | j dkr| jdks| jdkrtd| j }t|| j tjjv r0|dkr0td| j }t|| j tjjv rL| j dksA| j
dkrNtd| j }t|dS dS )z Verify ruler r z3Improper rule syntax ('%s' specified with app rule)r z'Invalid IPv6 address with protocol '%s'z Invalid port with protocol '%s'N) r r" r! r= r r re ipv4_only_protocolsportless_protocolsr r )r rule_iptyper` r r r verifyv s(
zUFWRule.verifyN)r r r r r Fr )r ) r r r r r
r r9 r; r2 r+ r- r, rg rh r. r/ rt rv rS r0 ry r1 r~ rW r r r r r r r r r * s:
# C
5
0
#Cn "r )r rG rZ ufw.utilr r programName state_dir share_dir trans_dir
config_dir
prefix_dir iptables_dir do_checksr\ r r r r r r s