CasperSecurity
o
MH�dX � @ sj d Z ddlZddlZddlZddlmZ dZdZdZeZ dZ
dZ d Z d
Z
G d d � d e�ZG d
d� d�ZdS )z!common.py: common classes for ufw� N)�debug�ufwz/lib/ufwz/usr/share/ufwz/etcz/usrz /usr/sbinTc @ s e Zd ZdZdd� Zdd� ZdS )�UFWErrorz$This class represents ufw exceptionsc C s
|| _ d S �N)�value)�selfr � r �,/usr/lib/python3/dist-packages/ufw/common.py�__init__# �
zUFWError.__init__c C s
t | j�S r )�reprr �r r r r �__str__& r zUFWError.__str__N)�__name__�
__module__� __qualname__�__doc__r
r r r r r r ! s r c @ s� e Zd ZdZ d9dd�Zd d
� Zd d � Zd
d� Zdd� Zdd� Z d:dd�Z
dd� Z dd� Z dd� Z
d d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Zd8S );�UFWRulez$This class represents firewall rules�any� 0.0.0.0/0�inF� c
C s� d| _ d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _
d| _ d| _ d| _
d| _d| _d| _|| _d| _z,| �|� | �|� | �|� | �|d� | �|� | �|� | �|� | �| � W d S tym � w )NFr r �src)�remove�updated�v6�dstr �dport�sport�protocol�multi�dapp�sapp�action�position�logtype� interface_in�
interface_out� direction�forward�comment�
set_action� set_protocol�set_port�set_src�set_dst�
set_direction� set_commentr )
r r# r r r r r r( r) r* r r r r
, s>
�zUFWRule.__init__c C s | � � S r )� format_ruler
r r r r O s zUFWRule.__str__c C s> d| }t | j�}|�� |D ]
}|d|| j| f 7 }q|S )zPrint rule to stdoutz'%s'z, %s=%s)�list�__dict__�sort)r �res�keys�kr r r � _get_attribR s
zUFWRule._get_attribc C s� t | j| j�}| j|_| j|_| j|_| j|_| j|_| j|_| j |_ | j
|_
| j |_ | j |_ | j
|_
| j|_| j|_| j|_| j|_| j|_| j|_|S )z Return a duplicate of a rule)r r# r r r r r r r r r r! r" r$ r% r& r' r( r) r* )r �ruler r r �dup_rule[ s& zUFWRule.dup_rulec C sr d}| j dkr|d| j 7 }| jdkr|d| j 7 }| jdkr$|d7 }nD|d| j 7 }| jrh|d7 }| jdkrO| jdkrO|d| j 7 }|d7 }|d | j 7 }n| jdkr\|d| j 7 }n | jdkrh|d | j 7 }| jd
kry| jd kry|d | j 7 }| js�| jdkr�|d
| j 7 }| jd
kr�| jd kr�|d| j 7 }| js�| jdkr�|d| j 7 }d}| jdkr�d| j }| j dkr�|d| 7 }n'| j dkr�|d| 7 }| jdkr�|d7 }n| j dkr�|d| 7 }n|d| 7 }| j
dks�| j dk�r5d}t �
d�}| j
dk�r
|d |�d | j
� 7 }| j
dk�r| j dk�r|d 7 }| j dk�r+|d |�d | j � 7 }|d 7 }|d| 7 }|�� S )!z Format rule for later parsingr z -i %sz -o %sr z -p allz -p z
-m multiportz
--dports z
--sports r �::/0z -d z --dport z -s z --sport �_�allowz -j ACCEPT%s�rejectz -j REJECT%s�tcpz --reject-with tcp-reset�limitz -j LIMIT%sz
-j DROP%sz-m comment --comment '� �dapp_z%20�,�sapp_�')r& r' r r r r r r r% r# r! r" �re�compile�sub�strip)r �rule_str�lstrr* � pat_spacer r r r2 r sf
�
zUFWRule.format_rulec C sj |� � �d�}|d dks|d dks|d dkr |d | _nd| _d}t|�dkr.|d }| �|� d S )
zSets action of the ruler= r r> r? rA �denyr � N)�lower�splitr# �len� set_logtype)r r# �tmpr% r r r r+ � s $ zUFWRule.set_actionr c C s� t d�| }|dkr n�|dkr| jrn�|dkr| jrn�t�d|�s't�d|�r+t|��|�d�|�d� d kr;t|��|�d�}t|�d
krId | _ d }|D ]y}t�d
|�r�d | _ |�d�}|D ]}t
|�d
k smt
|�dkrqt|��q_t
|d �t
|d
�kr�t|��n4t�d|�r�t
|�d
k s�t
|�dkr�t|��n t�d|�r�zt � |�}W n t
y� t|��w t|��|r�|dt|� 7 }qMt|�}qM|}|dkr�t|�| _dS t|�| _dS )z:Sets port and location (destination or source) of the rulez
Bad port '%s'r r r z^[,:]z[,:]$rD �:� rO Tr z ^\d+:\d+$i�� r z^\d+$z
^\w[\w\-]+N)r= r! r" rG �matchr �countrQ rR r �int�socket�
getservbyname� Exception�strr r ) r �port�loc�err_msg�portsrT �p�ran�qr r r r- � sX
�� � �
zUFWRule.set_portc C s0 |t jjdg v r|| _dS td�| }t|��)zSets protocol of the ruler zUnsupported protocol '%s'N)r �util�supported_protocolsr r= r )r r r` r r r r, � s
zUFWRule.set_protocolc C s� | j r)| jr| jdks| jdkrd| _| jr%| jdks | jdkr'd| _dS dS dS | jr9| jdks6| jdkr9d| _| jrK| jdksF| jdkrMd| _dS dS dS )z Adjusts src and dst based on v6r r r< N)r r r r
r r r �
_fix_anywhere� s
�
�zUFWRule._fix_anywherec C s || _ | �� dS )zXSets whether this is ipv6 rule, and adjusts src and dst
accordingly.
N)r rg )r r r r r �set_v6 s zUFWRule.set_v6c C �@ |� � }|dkrtj�|d�std�}t|��|| _| �� dS )zSets source address of ruler zBad source addressN)rP r re �
valid_addressr= r r rg �r �addrrT r` r r r r. � zUFWRule.set_srcc C ri )z Sets destination address of ruler zBad destination addressN)rP r re rj r= r r rg rk r r r r/ rm zUFWRule.set_dstc C s� |dkr|dkrt d�}t|��dt|�v r t d�}t|��dt|�v r,t d�}t|��t|�dks8t|�d kr@t d
�}t|��tt|��d krPt d �}t|��tt|��d
kr`t d�}t|��t�dt|��spt d�}t|��|dkry|| _dS || _dS )zSets an interface for ruler �outzBad interface type�!z+Bad interface name: reserved character: '!'rU z/Bad interface name: can't use interface aliases�.z..z)Bad interface name: can't use '.' or '..'r z+Bad interface name: interface name is empty� z+Bad interface name: interface name too longz^[a-zA-Z0-9_\-\.\+,=%@]+$zBad interface nameN)r= r r] rR rG rW r& r' )r �if_type�namer` r r r �
set_interface' s0
zUFWRule.set_interfacec C s> t |�dkrt�dt |��std�| }t|��t|�| _dS )z Sets the position of the rulez-1z^[0-9]+z,Insert position '%s' is not a valid positionN)r] rG rW r= r rY r$ )r �numr` r r r � set_positionW s zUFWRule.set_positionc C sB |� � dks|� � dks|dkr|� � | _dS td�| }t|��)zSets logtype of the rule�logzlog-allr zInvalid log type '%s'N)rP r% r= r )r r% r` r r r rS a s
zUFWRule.set_logtypec C s. |dks|dkr
|| _ dS td�| }t|��)zSets direction of the ruler rn zUnsupported direction '%s'N)r( r= r )r r( r` r r r r0 j s
zUFWRule.set_directionc C s t j�| j�S )z Get decoded comment of the rule)r re �
hex_decoder* r
r r r � get_commentr s zUFWRule.get_commentc C s
|| _ dS )zSets comment of the ruleN)r* )r r* r r r r1 v s
zUFWRule.set_commentc C s� d}| j r(ztj�| j | j�\| _ }W n ty" td�}t|��w |r(|| _| j rNztj�| j | j�\| _ }W n tyH td�}t|��w |rN|| _| j
rc| j
� d�}tj� |� d�
|�| _
| jrz| j� d�}tj� |� d�
|�| _dS dS )z&Normalize src and dst to standard formFz"Could not normalize source addressz'Could not normalize destination addressrD N)r r re �normalize_addressr r\ r= r r r r rQ �
human_sort�joinr )r �changedr` ra r r r � normalizez s@
� �
� � �zUFWRule.normalizec C s� | r|st � �d| |f }| j|jkrt|� dS | j|jkr%t|� dS | j|jkr1t|� dS | j|jkr=t|� dS | j|jkrIt|� dS | j|jkrUt|� dS | j|jkrat|� dS | j |j krmt|� dS | j
|j
kryt|� dS | j |j kr�t|� dS | j |j kr�t|� dS | j
|j
kr�t|� dS | j|jkr�| j|jkr�| j|jkr�td�}t|� dS | j|jkr�| j|jkr�| j|jkr�td�}t|� dS td�| j|j| j|j| j|jd� }t|� d S )
z�Check if rules match
Return codes:
0 match
1 no match
-1 match all but action, log-type and/or comment
-2 match all but comment
zNo match '%s' '%s'rO zFound exact matchr z$Found exact match, excepting comment���zZFound non-action/non-logtype/comment match (%(xa)s/%(ya)s/'%(xc)s' %(xl)s/%(yl)s/'%(yc)s'))�xa�ya�xl�yl�xc�yc���)�
ValueErrorr r r r r r r r! r" r& r' r( r) r# r% r* r= )�x�y�dbg_msgr r r rW � sr ��z
UFWRule.matchc C s� dd� }| r|s t � �| �|�dkrdS d| | j||jf }|jdkr-td| d � dS |j| jkr;t|d � dS | j|jkrN|jd
krNtd | � dS |jd
krb|| j|j�sbtd | � dS |jd
kr�| jd
krs| � | j
�rsn�| j
|j
kr�d|j
vr�td| � dS | j
|j
kr�d|j
v r�| j|jkr�t j �
| j
|j
| j�s�td| d| j
|j
f � dS n�| jd
kr�| j|jkr�td| d| j|jf � dS z t j �|j| j�}W n ty� td| d|j � Y dS w |j
|k�r
d|j
v�r
td| d|j
|f � dS |j
|k�r7d|j
v �r7| j|jk�r7t j �
||j
| j��s7td| d||j
f � dS | j|jk�rNtd| d| j
|j
f � dS td| | j||jf � dS )a� This will match if x is more specific than y. Eg, for protocol if x
is tcp and y is all or for address if y is a network and x is a
subset of y (where x is either an address or network). Returns:
0 match
1 no match
-1 fuzzy match
This is a fuzzy destination match, so source ports or addresses
are not considered, and (currently) only incoming.
c S s~ d| v sd| v r| |krdS dS |� d�D ]'}| |kr dS d|v r<|� d�\}}t| �t|�kr<t| �t|�kr< dS qdS )z:Returns True if p is an exact match or within a multi rulerD rU TF)rQ rY )�test_p�to_matchr^ �low�highr r r � _match_ports� s �z-UFWRule.fuzzy_dst_match.<locals>._match_portsr z(No fuzzy match '%s (v6=%s)' '%s (v6=%s)'r z (direction) z (not incoming)rO z (forward does not match)r z (protocol) z(dport) r �/z(dst) z ('%s' not in network '%s')z (interface) z (%s != %s)z %s does not existz(v6) z'(fuzzy match) '%s (v6=%s)' '%s (v6=%s)'r� )r� rW r r( r r) r r r& � _is_anywherer r re �
in_network�get_ip_from_if�IOError)r� r� r� r� �if_ipr r r �fuzzy_dst_match� s� �
"�
��
�
��
�&� � zUFWRule.fuzzy_dst_matchc C s |dks|dkr
dS dS )z Check if address is anywherer< r TFr )r rl r r r r� N s zUFWRule._is_anywherec C s� d}| j dks | jdkred| j | j| j| jf }| j dkr)d| j| j| j| jf }| jdkr:d| j | j| j| jf }| jdkrM| jdkrM|d| j 7 }|S | jdkrY|d| j 7 }| jdkre|d| j 7 }|S )a� Returns a tuple to identify an app rule. Tuple is:
dapp dst sapp src direction_iface|direction
or
dport dst sapp src direction_iface|direction
or
dapp dst sport src direction_iface|direction
where direction_iface is of form 'in_eth0', 'out_eth0' or
'in_eth0 out_eth0' (ie, both interfaces used). If no interfaces are
specified, then tuple ends with the direction instead.
r z %s %s %s %sz %sz in_%sz out_%s) r! r" r r r r r& r' r( )r �tuplr r r �
get_app_tupleT s&
�
�
�
zUFWRule.get_app_tuplec C s� | j dkr| jdks| jdkrtd�| j }t|��| j tjjv r0|dkr0td�| j }t|��| j tjjv rL| j dksA| j
dkrNtd�| j }t|��dS dS )z Verify ruler r z3Improper rule syntax ('%s' specified with app rule)r z'Invalid IPv6 address with protocol '%s'z Invalid port with protocol '%s'N) r r" r! r= r r re �ipv4_only_protocols�portless_protocolsr r )r � rule_iptyper` r r r �verifyv s(
����zUFWRule.verifyN)r r r r r Fr )r ) r r r r r
r r9 r; r2 r+ r- r, rg rh r. r/ rt rv rS r0 ry r1 r~ rW r� r� r� r� r r r r r * s:
�# C
5
0
#Cn "r )r rG rZ �ufw.utilr r � programName� state_dir� share_dir� trans_dir�
config_dir�
prefix_dir� iptables_dir� do_checksr\ r r r r r r �<module> s