CasperSecurity
o
�Fa�� � @ sz d Z ddlZddlZddlZddlmZ ddlZddlmZm Z m
Z
ddl m Z ddl
Zdd� Zdd � ZG d
d � d �ZdS ) z'frontend.py: frontend interface for ufw� N)�UFWError)�error�warn�msg)�UFWBackendIptablesc
C s� t j�� }dD ] }|�t j�|�� qdD ] }|�t j�|�� qdD ] }|�t j�|�� q#dD ] }|�t j�|�� q1dD ] }|�t j�|�� q?dD ] }|�t j� |�� qMg d�}|D ]}|�t j�
|�� |�t j� |�� q_t | �dkr�d }| | �
� d
kr�d}| | �
� d kr�| | �
� d kr�| | �
� |v r�| �|d
� t | �dk s�d
| v r�t | �dk r�td� z |�| d d� �}W |S ty� } ztd|j � W Y d}~|S d}~w ty� tddd� � w )zEParse command. Returns tuple for action, rule, ip_version and dryrun.)�enable�disable�helpz--help�versionz --version�reload�reset)�list�info�default�update)�on�off�low�medium�high�full)�allow�deny�reject)N�verbose�numbered)�rawz before-rulesz
user-rulesz after-rulesz
logging-rules�builtins� listening�added)r �limitr r �insert�delete�prepend� � � --dry-runr �route�rule� znot enough argsNz%szInvalid syntaxF)�do_exit)�ufw�parser� UFWParser�register_command�UFWCommandBasic�
UFWCommandApp�UFWCommandLogging�UFWCommandDefault�UFWCommandStatus�UFWCommandShow�UFWCommandRule�UFWCommandRouteRule�len�lowerr! r �
parse_commandr �value� Exception)�argv�p�i�
rule_commands�idx�pr�e� rC �./usr/lib/python3/dist-packages/ufw/frontend.pyr9 sL
�� � �r9 c C s� t di dtjj�dd�dd�dd�dd�d d
�d d �d
d�dd�dd�dd�dd�dd�dd�dd�d d �d d �i d d!�d"d#�d$d%�d&d'�d(d(�d)d)�d*d*�d+d,�d-d.�d/d0�d1d2�d3d3�d4d5�d6d7�d8d9�d:d;�d<d=��d>d?i� �} | S )@zPrint help messagea+
Usage: %(progname)s %(command)s
%(commands)s:
%(enable)-31s enables the firewall
%(disable)-31s disables the firewall
%(default)-31s set default policy
%(logging)-31s set logging to %(level)s
%(allow)-31s add allow %(rule)s
%(deny)-31s add deny %(rule)s
%(reject)-31s add reject %(rule)s
%(limit)-31s add limit %(rule)s
%(delete)-31s delete %(urule)s
%(insert)-31s insert %(urule)s at %(number)s
%(prepend)-31s prepend %(urule)s
%(route)-31s add route %(urule)s
%(route-delete)-31s delete route %(urule)s
%(route-insert)-31s insert route %(urule)s at %(number)s
%(reload)-31s reload firewall
%(reset)-31s reset firewall
%(status)-31s show firewall status
%(statusnum)-31s show firewall status as numbered list of %(rules)s
%(statusverbose)-31s show verbose firewall status
%(show)-31s show firewall report
%(version)-31s display version information
%(appcommands)s:
%(applist)-31s list application profiles
%(appinfo)-31s show information on %(profile)s
%(appupdate)-31s update %(profile)s
%(appdefault)-31s set default application policy
�progname�command�COMMAND�commands�Commandsr r r z default ARG�loggingz
logging LEVEL�level�LEVELr z
allow ARGSr( r z deny ARGSr z reject ARGSr z
limit ARGSr" zdelete RULE|NUM�urule�RULEr! zinsert NUM RULEr# z prepend RULEr' z
route RULEz route-deletezroute delete RULE|NUMz route-insertzroute insert NUM RULE�number�NUMr r �status� statusnumzstatus numbered�rules�RULES�
statusverbosezstatus verbose�showzshow ARGr
� appcommandsz Application profile commands�applistzapp list�appinfozapp info PROFILE�profile�PROFILE� appupdatezapp update PROFILE�
appdefaultzapp default ARG)�_r+ �common� programName)�help_msgrC rC rD �get_command_help[ s� �������� �
� � �
��������������� � � � � �!�"��Crb c @ s� e Zd ZdZ d,dd�Zdd� Zdd � Zd
d � Zd-d
d�Zd.dd�Z dd� Z
dd� Z dd� Z d/dd�Z
d/dd�Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd/d*d+�ZdS )0� UFWFrontend�UI�iptablesNc C s\ |dkrz
t |||d�| _W n ty � w td| ��td�| _td�| _td�| _d S )Nre )�rootdir�datadirz Unsupported backend type '%s'�n�y�yes)r �backendr; r r^ �norj �yes_full)�self�dryrun� backend_typerf rg rC rC rD �__init__� s � �
zUFWFrontend.__init__c
C s| d}d}|rd}d}|r| j �� r|s| j �� rd}|rBz| j �| j jd d|� W n tyA } z t|j� W Y d}~nd}~ww d}|r�z| j �� W n tyd } z |rZ|j}W Y d}~nd}~ww |dkr�z| j �| j jd dd� W n ty� } z t|j� W Y d}~nd}~ww t|� td �}|S z| j � � W n ty� } z t|j� W Y d}~nd}~ww td
�}|S ) zlToggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or
stops running firewall.
� rl rj FT�conf�ENABLEDNz0Firewall is active and enabled on system startupz/Firewall stopped and disabled on system startup)
rk �
is_enabled� set_default�filesr r r: �start_firewallr^ �
stop_firewall)rn �enabled�res�
config_str�changedrB � error_strrC rC rD � set_enabled� sb ���������� ���zUFWFrontend.set_enabledc
C sn d}z | j �||�}| j �� r | j �� | j �� W |S W |S ty6 } z t|j� W Y d}~|S d}~ww )z Sets default policy of firewallrr N)rk �set_default_policyru ry rx r r r: )rn �policy� directionr{ rB rC rC rD r� � s
����z UFWFrontend.set_default_policyc
C �H d}z | j �|�}W |S ty# } z t|j� W Y d}~|S d}~ww )zSets log level of firewallrr N)rk � set_loglevelr r r: )rn rK r{ rB rC rC rD r� � � ���zUFWFrontend.set_loglevelFc
C sF z
| j �||�}W |S ty" } z t|j� W Y d}~|S d}~ww )zShows status of firewallN)rk �
get_statusr r r: )rn r �
show_count�outrB rC rC rD r� s ���zUFWFrontend.get_statusr c
C sD z | j �|�}W |S ty! } z t|j� W Y d}~|S d}~ww )z Shows raw output of firewallN)rk �get_running_rawr r r: )rn �
rules_typer� rB rC rC rD � get_show_raw s ���zUFWFrontend.get_show_rawc C s d}z t j�| j�� �}W n ty td�}t|��w | j�� }t |�
� �}|� � |D ]�}| j�� s:|dv r:q.|d| 7 }t || �
� �}|� � |D ]�}|| | D ]�} | d }
|
� d�s�|
� d�s�d} |d| 7 }|
d ksv|
d
kr�|d 7 }d | d }
n |d
|
7 }t j�
|
�} |dtj�| d � 7 }t jjd|dd� ||
ddd�} | �|�d�� | dkr�| �d| � | �� | j�| �}
t|
�dkr�|d7 }|
D ] }|dkr�|d t|�k r�|d|t jj�||d �f 7 }q�|d7 }qVqNq.| j�� �st j� d� |S ) zMShows listening services and incoming rules that might affect
themrr z Could not get listening status)�tcp6�udp6z%s:
�laddrz127.z::1z %s z0.0.0.0z::z* z%s/0z%s z(%s)�exer Nr) �inF)�action�protocol�dport�dstr� �forward�6r �
r% z [%2d] %s
z)Skipping tcp6 and udp6 (IPv6 is disabled)) r+ �util�parse_netstat_outputrk �use_ipv6r; r^ r � get_rulesr
�keys�sort�
startswith�get_if_from_ip�os�path�basenamer_ �UFWRule�set_v6�endswith�
set_interface� normalize� get_matchingr7 r, r5 � get_command�debug)rn r{ �d�err_msgrS � protocols�proto�ports�port�item�addr�ifnamer( �matchingr> rC rC rD �get_show_listening sv �
�
�
������ / z UFWFrontend.get_show_listeningc C s� | j �� }td�}t|�dkr|td� S g }| j �� D ]&}|jr+dtjj�|� }ntjj �|�}||v r7q |�
|� |d| 7 }q |S )z!Shows added rules to the firewallz9Added user rules (see 'ufw status' for running firewall):r z
(None)�route %sz
ufw %s) rk r� r^ r7 r� r+ r, r6 r� r5 �append)rn rS r� r �r�rstrrC rC rD �get_show_added\ s
�
zUFWFrontend.get_show_addedc C s� d}d}d}g }|j dkr|jdkr|�|� n�g }z�|jr�|dkr*| j�|d�}nF|dkr6| j�|d�}n:|dkrf| j�|d�}| j�|d�}|D ]} |D ]}
|
j} d|
_| �|
�sc| |
_|�|
� qNqJn
td�| }t |��t
|�dkr�| jj s�td �}|dkr�|}|W S |dkr�|d
}|W S |dkr�|d | d
}|W S |D ]}|� � } |j| _| �
|j� | �|j� |�| � q�n| j�|�}|jdkr�|�� W n ty� � w d}
d}td �}| j�d�}| j�d�}t|�D �]\}} |}
| j|| k�r
|t| j�d
7 }t |���z�| j�� �r�|dk�rT| jdk�r4|
dk�r,|dk�r,dnd}| �|� n| j|k�rG|t| j�d
7 }t |��| �d� | j�| �}�n{|dk�r�| jdk�rs|
dk�rk|dk�rkdnd}| �|� n(| j|k�r�| �| j| � n| jdk�r�| j|k�r�|t| j�d
7 }t |��| �d� | j�| �}�n'|dk�r| j}| �d� |dk�r�|
dk�r�|dk�r�dnd}| �|� n$| j�s�||k�r�| j� || |
d�}|dk�r�| �|� n| �d� | j�| �}| j�s|dk�r| j�d�}| �|d � | �d� |dk�r,|
dk�r$|dk�r$dnd}| �|� n*| j�sV| jdk�rV| j|k�rV| j� | jd�}|dk�rQ| �||
� n| �d� |dk�r_|d 7 }| j�sv| j|k�rv|dk�rv| �| j| � || j�| �7 }nPtd�| }t |��| jdk�r�|
dk�r�|dk�r�dnd}| �|� |dk�s�|dk�r�| �d� | j�| �}n|dk�r�td�}t |��td�| }t |��W n t �y� } z |j }d}W Y d}~ nd}~ww | j �r�td�}t � |� q�|�s||7 }|S t
|�dk�rt!|� |S d}t"t#|
d ��}|�� |D ]9}|
dk�rV|| �rV|| � � }d|_z | �||� W �q t�yU d}td�| �$� }t |� Y �q w �q |td�7 }|�rk|td�7 }t |��|td�7 }t |��)zUpdates firewall with rulerr �v4F�v6T�bothzInvalid IP version '%s'r z"Could not delete non-existent rulez (v6)r� zInvalid position '�'���r% zIPv6 support not enabledNz Rule changed after normalizationz Could not back out rule '%s'z"
Error applying application rules.z# Some rules could not be unapplied.z( Attempted rules successfully unapplied.)%�dapp�sappr� �removerk �get_app_rules_from_systemr� �matchr^ r r7 ro �dup_rule�
set_actionr� � set_logtype�logtype�get_app_rules_from_template�position�reverser; �get_rules_count� enumerate�strr� � set_positionr� �set_rule�find_other_positionr: �updated�warningsr r r
�range� format_rule) rn r( �
ip_versionr{ r� �tmprS �tmprules� tmprules6�xri �prev6r� �count� set_error� pos_err_msg�num_v4�num_v6r> �begin�user_posr= rB �warn_msg�
undo_error�indexes�j� backout_rulerC rC rD r� y sj ����
��� �� �
� �
�
�
���
� � � ��� �zUFWFrontend.set_rulec
C sP zt |�}W n ty td�| }t|��w | j�� }|dks'|t|�kr1td�| }t|��| j�|�}|sCtd�| }t|��d|_d}|j rMd}d}|s�|j
r^dt j j
�|� } nt j j�|�} td�| | j| jd � }
t|
tjd
d � tj�� �� �� } | d kr�| | j�� kr�| | j�� kr�d
}d
} |r�| �||�} | S td�} | S )z Delete rulezCould not find rule '%s'r zCould not find rule '%d'Tr� r� r� z=Deleting:
%(rule)s
Proceed with operation (%(yes)s|%(no)s)? )r( rj rl F��output�newlineri rr �Aborted)�intr; r^ r rk r� r7 �get_rule_by_numberr� r� r� r+ r, r6 r� r5 rj rl r �sys�stdout�stdin�readliner8 �striprm r� )
rn rO �forcerh r� rS r( r� �proceedr� �prompt�ansr{ rC rC rD � delete_ruleE sT �
��� �zUFWFrontend.delete_rulec
C sH d}|� d�r"|�d�}t|�dkr| �|d �}|S | �d�}|S |dkr-| �d�}|S |� d�rQtd �}|�d
�}t|�d krEt|��| �|d |d �}|S |d
kr\| �|�}|S |dkrf| �� }|S |dkrq| �d�}|S |� d�r�|�d
�d }|dkr�| � � }|S |dkr�| �
� }|S | � |�}|S |dkr�| �dd�}|S |dkr�| � d�}|S |dkr�| � d�}|S |dkr�| j
�� r�| � d� | � d� td�}|S td�}|S |� d�r�| �|�d
�d |�}|S |d ks�|d ks�|d ks�|d k�r�|jdk�rGz| j
�|j�}||jk�r||_|�|d � W n, t�yF } z |j�s,t|j� tj�|j��s<td!�}t|��W Y d"}~nd"}~ww |jdk�r�z| j
�|j�}||jk�rd||_|�|d � W n, t�y� } z |j�swt|j� tj�|j��s�td!�}t|��W Y d"}~nd"}~ww | �||�}|S td#�| }t|��)$z�Perform action on rule. action, rule and ip_version are usually
based on return values from parse_command().
rr z
logging-onr^ r% r z logging-offr zdefault-zUnsupported default policy�-r) r$ r rQ zstatus-verboseTrV r r zstatus-numberedFr r r �Firewall reloadedz&Firewall not enabled (skipping reload)zdelete-r r r r r� �Invalid profile nameN�Unsupported action '%s')r� �splitr7 r� r^ r r� r r� r� r� r� r rk ru r� r� �find_application_name�set_portr� r r: r+ � applications�valid_profile_namer� r� ) rn r� r( r� r� r{ r� r� rB rC rC rD � do_actionv s�
L
�J�
H
�
B�
@�>�
<
�8�6
�4� 2�
0�
.�
)�'
�%�
�
��� �
��� �zUFWFrontend.do_actionc
C r� )z+Sets default application policy of firewallrr N)rk � set_default_application_policyr r r: )rn r� r{ rB rC rC rD r � r� z*UFWFrontend.set_default_application_policyc C s: t | jj�� �}|�� td�}|D ]}|d| 7 }q|S )z*Display list of known application profileszAvailable applications:�
%s)r
rk �profilesr� r� r^ )rn �namesr� rh rC rC rD �get_application_list� s z UFWFrontend.get_application_listc C s� g }|dkrt | jj�� �}|�� ntj�|�s!td�}t |��|�
|� d}|D ]�}|| jjvs8| jj| sBtd�| }t |��tj� || jj| �sUtd�}t |��|td�| 7 }|td�tj� | jj| � 7 }|td�tj�
| jj| � 7 }tj�| jj| �}t|�d ks�d
|d v r�|td �7 }n|td
�7 }|D ]}|d| 7 }q�||t|�d kr�|d7 }q*tj�|�S )z Display information on profile�allr� rr zCould not find profile '%s'zInvalid profilez Profile: %s
z
Title: %s
zDescription: %s
r% �,r zPorts:zPort:r z
--
)r
rk r r� r� r+ r� r r^ r r� �verify_profile� get_title�get_description� get_portsr7 r� � wrap_text)rn �pnamer r� r� �namer� r= rC rC rD �get_application_info� sN
�
�
�
�� � z UFWFrontend.get_application_infoc C s d}d}d}z
| j jrtj�� rd}W n ty d}Y nw |dkrMt| j j�� �}|� � |D ]}| j �
|�\}}|rK|dkrE|d7 }||7 }|}q1n| j �
|�\}}|dkr]|d7 }|r�| j � � r�|r~z| j � � W n tyu � w |t
d�7 }|S |t
d�7 }|S )�Refresh application profilerr TFr r� r� zSkipped reloading firewall)rk � do_checksr+ r� � under_sshr; r
r r� r� �update_app_ruleru �_reload_user_rulesr^ ) rn rZ r� � allow_reload�trigger_reloadr r= r� �foundrC rC rD �application_update
sH � ��� � �z UFWFrontend.application_updatec C s
d}d}|dkrt d�}t|��| jjd }|dkr&tj�d||f � |S |dkr-d}n|d kr4d
}n|d kr;d }n
t d �| }t|��d
g}| jjrQ|�d� |||g7 }zt |�}W n t
ye � w d|j v r{| � |j
|j d |j d �}|S | � |j
dd�}|S )r rr r z%Cannot specify 'all' with '--add-new'�default_application_policy�skipz'Policy is '%s', not adding profile '%s'�acceptr �dropr r zUnknown policy '%s'r+ r& r( �iptype)r^ r rk �defaultsr+ r� r� ro r� r9 r; �datar r� )rn rZ r� r� r� r �argsrA rC rC rD �application_add8 sF �
�
��zUFWFrontend.application_addc C s� d}|dkr
| � d�}|S |dkr| � d�}|S |dkr#| � d�}|S |dkr.| � d �}|S |d
kr8| �� }|S |d krC| �|�}|S |d ksK|d
krm| �|�}d}|d
kr[| �|�}|dkrg|dkrg|d7 }|| }|S td�| }t|��)zzPerform action on profile. action and profile are usually based on
return values from parse_command().
rr z
default-allowr z default-denyr zdefault-rejectr z default-skipr r
r r zupdate-with-newr� r� )r r r r r" r^ r )rn r� rZ r{ �str1�str2r� rC rC rD �do_application_actionb s<
�
�
�
��
�
�z!UFWFrontend.do_application_actionc C sr d}| j jr7tj�� r7td�| j| jd� }t|t j
dd� t j � � �
� �� }|dkr7|| jkr7|| jkr7d}|S )z6If running under ssh, prompt the user for confirmationTzWCommand may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? �rj rl Fr� ri )rk r r+ r� r r^ rj rl r r� r� r� r� r8 r� rm )rn r� r� r� rC rC rD �continue_under_ssh� s � z UFWFrontend.continue_under_sshc C s� d}t d�| j| jd� }| jjr!tj�� r!t d�| j| jd� }| jjrP|sPttj� |�t
j dd� t
j �
� �� �� }|dkrP|| jkrP|| jkrPt d�}|S | j�� r\|| �d�7 }| j�� }|S ) zReset the firewallrr zTResetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? r& zResetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? Fr� ri r� )r^ rj rl rk r r+ r� r r r
r� r� r� r� r8 r� rm ru r r )rn r� r{ r� r� rC rC rD r � s$ � �
zUFWFrontend.reset)re NN)FF)r )F)�__name__�
__module__� __qualname__�__doc__rq r r� r� r� r� r� r� r� r� r r r r r r" r% r' r rC rC rC rD rc � s0
�6
H
M
1V
.+* rc )r+ r� r� r� �
ufw.commonr �ufw.utilr+ r r r �ufw.backend_iptablesr �
ufw.parserr9 rb rc rC rC rC rD �<module> s >H