Linux tsuru-no-tsurugi 5.15.0-186-generic #196-Ubuntu SMP Sat Jun 20 16:09:34 UTC 2026 x86_64
Apache/2.4.52 (Ubuntu)
Server IP : 192.168.0.18 & Your IP : 216.73.216.68
Domains :
Cant Read [ /etc/named.conf ]
User : www-data
Terminal
Auto Root
Create File
Create Folder
Localroot Suggester
Backdoor Destroyer
Readme
/
usr /
lib /
python3 /
dist-packages /
ufw /
__pycache__ /
Delete
Unzip
Name
Size
Permission
Date
Action
__init__.cpython-310.pyc
139
B
-rw-r--r--
2024-02-17 03:50
applications.cpython-310.pyc
4.15
KB
-rw-r--r--
2024-02-17 03:50
backend.cpython-310.pyc
16.2
KB
-rw-r--r--
2024-02-17 03:50
backend_iptables.cpython-310.pyc
27.54
KB
-rw-r--r--
2024-02-17 03:50
common.cpython-310.pyc
14.11
KB
-rw-r--r--
2024-02-17 03:50
frontend.cpython-310.pyc
19.38
KB
-rw-r--r--
2024-02-17 03:50
parser.cpython-310.pyc
15.84
KB
-rw-r--r--
2024-02-17 03:50
util.cpython-310.pyc
22.93
KB
-rw-r--r--
2024-02-17 03:50
Save
Rename
o �Faj� � @ s� d Z ddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z m Z m Z mZmZmZ ddlZG dd� dejj�ZdS )z-backend_iptables.py: iptables backend for ufw� N)�UFWError�UFWRule)�warn�debug�msg�cmd�cmd_pipe� _findpathc @ s� e Zd ZdZd+dd�Zdd� Zdd� Zd d � Zd,d d �Zdd� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zd-d d �Zd.d d �Zd!d"� Zd-d#d$�Zd%d&� Zd'd(� Zd)d*� ZdS )/�UFWBackendIptablesz Instance class for UFWBackendNc C s� dt jj d | _|| _|| _i }tt jj|�}tj � |d�|d< tj � |d�|d< tj � |d�|d< tj � |d �|d < tj � |d �|d < tj � |d �|d< tj � tt jj |�d�|d< t j j j| d||||d� g g g g d�| _dD ]C}d}|dkr�| �� r�||7 }n|dkr�qsdD ]}dD ]} d||| f } | j| �| � q�q�| jd �|d � | jd �|d � qsg d �| _d | _d S ) z!UFWBackendIptables initializationz# z _comment #zufw/user.rules�ruleszufw/before.rules� before_ruleszufw/after.rules� after_ruleszufw/user6.rules�rules6zufw/before6.rules� before6_ruleszufw/after6.rules� after6_ruleszufw-init�init�iptables)�rootdir�datadir)�before�user�after�misc)�4�6�ufwr )r r r ��input�output�forwardz%s-%s-logging-%sr z -logging-denyz-logging-allow)�-m�limit�--limitz3/minute�-j�LOG� --log-prefixz[UFW LIMIT BLOCK]N)r �common� programName� comment_strr r r � config_dir�os�path�join� state_dir�backend� UFWBackend�__init__�chains�use_ipv6�append�ufw_user_limit_log�ufw_user_limit_log_text) �self�dryrunr r �filesr) �ver� chain_prefix�loc�target�chain� r> �6/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr0 sD �� � zUFWBackendIptables.__init__c C sb t d�}| jd dkr|d7 }|S | jd dkr |d7 }|S | jd dkr+|d7 }|S |d 7 }|S ) zGet current policyz New profiles:�default_application_policy�acceptz allow�dropz deny�rejectz rejectz skip)�_�defaults)r6 �rstrr> r> r? � get_default_application_policyP s ���z1UFWBackendIptables.get_default_application_policyc C s | j s�|dkr|dkr|dkrtd�| }t|��|dkr/|dkr/|dkr/td�| }t|��d }|dkr8d }n|dkr>d }d }d }|dkrbz| �| jd d| d� W n ty\ � w d}d}n;|dkr�z| �| jd d| d� W n ty| � w d}d}nz| �| jd d| d� W n ty� � w d}d}t�d | �}| jd | jd fD ]F}ztj � |�} W n ty� � w | d } | d D ]} |� | �r�tj � | |� || �� q�tj � | | � q�ztj �| � W q� ty� � w td�||d� } | td�7 } | S )z Sets default policy of firewall�allow�denyrC zUnsupported policy '%s'�incoming�outgoing�routedz%Unsupported policy for direction '%s'�INPUT�OUTPUT�FORWARD� rE zDEFAULT_%s_POLICYz"ACCEPT"z UFW BLOCKz UFW ALLOWz"REJECT"z"DROP"r r �tmp�origz5Default %(direction)s policy changed to '%(policy)s' )� direction�policyz*(be sure to update your rules accordingly))r7 rD r � set_defaultr8 � Exception�re�compiler �util� open_files�search� write_to_file�sub� close_files) r6 rT rS �err_msgr= � old_log_str� new_log_str�pat�f�fns�fd�linerF r> r> r? �set_default_policy^ s� � � � � � � � � �� z%UFWBackendIptables.set_default_policyc C s� | j rdtd� }|dtd� 7 }|S | �� g d�}g }g }|dkr1|�d� g d�}g d�}n�|d kr{d D ]}|�d | � |�d | � q7d D ]}|�d | � |�d | � qJdD ]}|�d| � |�d| � q]dD ] }|�d| � qpn�|dkr�dD ]}|�d| � |�d| � q�n�|dkr�dD ]}|�d| � |�d| � q�| jd d r�|�d� |�d � | jd d r�|�d � |�d � n`|d kr�dD ]}|�d!| � |�d"| � q�nH|d#k�r-dD ],}|�d$| � |�d%| � |�d&| � |�d'| � |�d(| � |�d)| � q�|�d*� |�d+� |�d,� |�d-� d.| }|D ]H}d/|v �rW|�d/�\} }|d0| 7 }t| jg| |d| g �\} } n t| jg| |g �\} } || 7 }|dk�rq|d17 }| d2k�rzt|���q3|dk�s�| � � �r�|d37 }|D ]H}d/|v �r�|�d/�\} }|d0| 7 }t| jg| |d| g �\} } n t| j g| |g �\} } || 7 }|dk�r�|d17 }| d2k�r�t|���q�|S )4z'Show current running status of firewall�> zChecking raw iptables zChecking raw ip6tables )�-nz-vz-x�-L�rawz-t)�filter�nat�manglerk )rl rn rk �builtins)rM rO rN z filter:%s)� PREROUTINGrM rO rN � POSTROUTINGz mangle:%s)rp rN zraw:%s)rp rq rN znat:%sr )r r r z ufw-before-%szufw6-before-%sr � ufw-user-%s� ufw6-user-%sr! r zufw-user-limit-accept�ufw-user-limitr zufw6-user-limit-accept�ufw6-user-limitr z ufw-after-%sz ufw6-after-%s�loggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyz IPV4 (%s): �:z(%s) � r z IPV6: ) r7 rD �initcapsr3 �caps�splitr r r r2 � ip6tables) r6 � rules_type�out�args�items�items6�c�b�i�t�rcrQ r> r> r? �get_running_raw� s� �� �� � �z"UFWBackendIptables.get_running_rawFc $ C s� d}| j rdtd� }| �� r|dtd� 7 }|S td�}dD ]@}t| jdd| d g�\}}|d kr8td � S |d krDt|d | ��| �� r_t| jdd| d g�\}}|d kr_t|d ��q d}d} d} | j| j } d } i } | D �]�}d}i }d}d}|s�|j dks�|j dkr�d}|� � }|| v r�t d| � qrd| |< dD �]�}d||< d}d}|dkr�|j }|s�|j dkr�|j }|jr�|dkr�|d7 }n |j}n |j}|s�|j dkr�|j }|jr�|dkr�|d7 }n|j}|dkr�|dkr�|||< |dk�r�|| dk�r|||< n || d| 7 < |�r#|jdk�r#|| d|j 7 < |�r�|dk�rU|j dk�rU|| d|j 7 < |j�rM|dk�rM|| d7 < || d 7 < |d k�r�|j dk�r�|| d|j 7 < |j�r||dk�r||| d7 < || d 7 < |dk�r�|dk�s�|dk�r�d ||< |�r�|jdk�r�|j |jk�r�|j|jk�r�|| d|j 7 < |dk�r�|| d7 < n;|�r�|jdk�r�|j|jk�r�|| d|j 7 < n |j�r|jdk�r|j dk�rd|| v�r|| d7 < |j�r3|d k�r |jdk�r || d |j 7 < |dk�r2|jdk�r2|| d |j 7 < q�|dk�rI|jdk�rI|| d |j 7 < |d k�r_|jdk�r_|| d |j 7 < q�g }d}|j�sp|j�� d k�r�|j�r||�|j�� � |�r�|jd k�r�|�|j� t|�d k�r�d!d"�|� }|�r�|d#| 7 }|j� � }|j�r�d$}|jd%k�r�|j�s�|�s�|�s�d}d}|j dk�r�d&|� � }|d'|d d�|j � � |g�|d ||f 7 }|�r�||7 }n|j�r�| |7 } n|jd k�r | |7 } n||7 }| d 7 } qr|dk�s| dk�s| dk�r�d(}|�r!|d)7 }td*�}td+�} td,�} d-} | || | f } |�r=| d)7 } | | d.t|� d.t| � d.t| � f 7 } || 7 }|dk�r_||7 }|dk�ro| dk�ro|td/�7 }| dk�rx|| 7 }|dk�r�| dk�r�|td/�7 }| dk�r�|| 7 }|}|�r�| � � \} }!td0�| �!� | �!d1�| �!d2d�d3� }"| �"� }#td4�|!|"|#|d5� S td6�| S )7zShow ufw managed rulesrP rh zChecking iptables zChecking ip6tables �problem runningr rj rr ri � zStatus: inactiver z iptables: %s rs � ip6tablesTFzSkipping found tuple '%s')�dst�srcr� z::/0� (v6)z 0.0.0.0/0�any� �/z (%s�)r� �Anywherez on %sr~ z (%s)z, z[%2d] �FWD�inz # %sz%-26s %-12s%-26s%s%s z z �To�From�Actionz%-26s %-12s%s �-rx zCDefault: %(in)s (incoming), %(out)s (outgoing), %(routed)s (routed)r r )r� r~ rL z0Status: active %(log)s %(pol)s %(app)s%(status)s)�log�pol�app�statuszStatus: active%s)#r7 rD r2 r r r r| r r �dapp�sapp� get_app_tupler r� �v6�dportr� �sport�protocolr � interface_in� interface_out�logtyperS �lowerr3 �lenr, �upper�comment� get_comment�action� get_loglevel�_get_default_policyrG )$r6 �verbose� show_countr~ r_ rS r� �out6�s�str_out�str_rter �count� app_rules�r�tmp_str�location�tupl� show_protor; �portrQ �attribs� attrib_str�dir_strr( �full_str�str_to�str_from� str_action�rules_header_fmt� rules_header�level� logging_str� policy_str�app_policy_strr> r> r? � get_status sz � � � �� �� �� �� �� �� ����� z UFWBackendIptables.get_statusc C s� | j r tdtd� � dS g }|�| jd � | jdur7| jdur7|�d� |�| j� |�d� |�| j� |�d� t|�\}}|dkrPtd | �}t|��dS ) zStop the firewallrh �running ufw-initr N� --rootdir� --datadirz force-stopr �problem running ufw-init %s) r7 r rD r3 r8 r r r r �r6 r r� r~ r_ r> r> r? � stop_firewall� s �z UFWBackendIptables.stop_firewallc C s( | j r tdtd� � dS g }|�| jd � | jdur7| jdur7|�d� |�| j� |�d� |�| j� |�d� t|�\}}|dkrPtd | �}t|��d | j vsa| j d t | j � � �vryz| � d � W dS tyx td �}t|��w z | �| j d � W dS ty� td �}t|��w )zStart the firewallrh r� r Nr� r� �startr r� �loglevel�lowzCould not set LOGLEVELz Could not load logging rules)r7 r rD r3 r8 r r r r rE �list� loglevels�keys� set_loglevelrV �update_loggingr� r> r> r? �start_firewall� s8 � �z!UFWBackendIptables.start_firewallc C s� | j rdS | �� d}| j}|rd}| j}dD ]7}|dks!|dkr5|r+| jd d s+q|s5| jd d s5qt|d d |d | g�\}}|d krNtd � dS qdS )zCheck if all chains existFr �ufw6)r r r r! � limit-acceptr! r� r r ri rj z-user-r z _need_reload: forcing reloadT)r7 ry r r| rz r r )r6 r� �prefix�exer= r� r~ r> r> r? � _need_reload s( �z UFWBackendIptables._need_reloadc C s� t d�}| jrtd� | �� rtd� dS dS | �� rwz| jd D ]}| �|d|g� | �|d|g� q!W n ty@ t|��w t d| j d g| j d g�\}}|d krZt|d ��| �� ryt d| j d g| j d g�\}}|d kr{t|d ��dS dS dS )zReload firewall rules filer� z> | iptables-restorez> | ip6tables-restorer �-F�-Z�catr ri r z iptablesr r� N) rD r7 r r2 � is_enabledr1 � _chain_cmdrV r r r8 �iptables_restore�ip6tables_restore)r6 r_ r� r� r~ r> r> r? �_reload_user_rules: s: �� �� � �z%UFWBackendIptables._reload_user_rulesc C s8 g }t �d�}t �d�}t �d�}|�|�rK|�|�rA|�|�r.|�|�d|�d|��� n |�|�d|�� |�|�d|�� n|�|�d|�� n|�|� t �d�}t �d �} t �d �} d } t|�D ]v\} } |�| �r�|�d | ��� }|�� d krd}n |�� dkr�d}nd}d| |f }| �| �s�d| }|�d| �|| < |�| |�d| d | | �� |�| | �d| d | |�d| ��� |�| | �d| d | |�d| | ��� qet �d�}t|�D ]4\} } |�| ��r|�d| �}|�d | d | �}|�d | d | �}||| < |�| |� |�| |� q�|S ) z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z -j \1 --reject-with tcp-resetz-p udp rP z (.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10�\2rA �ALLOWr! �LIMIT�BLOCKz"%s -j LOG --log-prefix "[UFW %s] "z-m conntrack --ctstate NEW z \1-j \2\4z\1-j z-user-logging-z\1 z \1-j RETURN�\1z -j LIMITz+ -m conntrack --ctstate NEW -m recent --setzL -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j z -user-limitz -j z-user-limit-accept) rW rX r[ r3 r] � enumerate�stripr� �insert)r6 �fruler� �suffix�snippets� pat_proto�pat_port� pat_reject�pat_log� pat_logall� pat_chain� limit_argsr� r� rT �lstr� pat_limit�tmp1�tmp2�tmp3r> r> r? �_get_rules_from_formattedV s� �� � ����������� ���� �z,UFWBackendIptables._get_rules_from_formattedc C s� g }| � |||�}t�d�}t|�D ]8\}}|�|�d|��� � |�|�rJ|| �d� || �|�d|��dd�� || |�d|��� 7 < q|S )z_Return list of iptables rules appropriate for sending as arguments to cmd() z (.*) --log-prefix (".* ")(.*)r� r% r� �"rP z\3) r� rW rX r� r3 r] r{ �match�replace) r6 r� r� r� r� � str_snippetsrb r� r� r> r> r? �_get_lists_from_formatted� s �z,UFWBackendIptables._get_lists_from_formattedc C s� | j d g}| �� r|�| j d � |D �]�}ztj�|�}W n ty0 td�| }t|��w t � d�}t � d�}t � d�}|D �]z}|} d} d|v rX|� d�\} } | � � } |� | ��r�|�d| �} t � d | � � �} t| �d k sxt| �d kr�td �| }t|� qBd }d}d}t| �dks�t| �d k�rtd�| }| d � d�d }d| d v �rd| d v r�|�| d �r�|�| d �r�| d � d�d �d�d }| d � d�d �d�d }n'| d �d�r�| d �d�d }n| d �d�r�| d �d�d }nt|� qBz�| d }d}d|v �rd}|� d�d }t| �dk �r7t|| d | d | d | d | d ||| � }n;t|| d | d | d | d | d ||| � }t � d �}| d d k�rb|�d!| d �|_| d d k�rr|�d!| d �|_|dk�r}|�d |� |dk�r�|�d"|� W n t�y� td#�| }t|� Y qBw || j d k�r�|�d� | j�|� qB|�d� | j�|� qB|�� qd$S )%z$Read in rules that were added by ufwr r z Couldn't open '%s' for readingz^### tuple ###\s*zin_\w+zout_\w+rP z comment=z\s+� � z)Skipping malformed tuple (bad length): %sr� � z$Skipping malformed tuple (iface): %s���rD r �!� r� �in_�out_Frw T� � � � �%20r� r� r~ z Skipping malformed tuple: %sN) r8 r2 r3 r rY �open_file_readrV rD r rW rX r{ r� r r] r� r r[ � partition� startswithr r� r� � set_interface�set_v6r r �close)r6 �rfnsrc rR r_ � pat_tuple� pat_iface_in� pat_iface_out� orig_linerf r� �hexr� rQ �wmsg�dtyper� r� r� r �rule� pat_space�warn_msgr> r> r? � _read_rules� s� � �� � ��� �� ��� � �z UFWBackendIptables._read_rulesc C s& | j d }|r | j d }t�|tj�s td| �}t|��ztj�|�}W n t y- � w | � � d}| j }|r>d}| j }| j rGtj�� }n|d }tj�|d� tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � tj�|d| d � |dkr�| jd d �s|dk�r| jd d �rtj�|d| d � tj�|d| d � tj�|d � |D �] }|j} |j�r3d |j } |jd k�r@| d |j 7 } d } |jd k�rR|jd k�rR|j} n0|jd k�rg|jd k�rgd |j|jf } n|jd k�rx| d!|j|jf 7 } n | d!|j|jf 7 } |jd k�r�|jd k�r�d"| |j|j |j |j |j | f } |j d k�r�| d#|j 7 } tj�|| d$ � nGt!�"d%�} d&} |j�r�| �#d'|j�} d&}|j�r�| �#d'|j�}d(| |j|j |j |j |j | || f } |j d k�r�| d#|j 7 } tj�|| d$ � d)}|j�rd*}n|jd+k�r d,}d-||f }d.||�$� f }| �%|||�D ] }tj�||� �q"�q$tj�|d/� tj�|d0� z | �&| j'd1 �}W n t �yP � w |D ]2\}}}t(|�d2k�rh|d2 d3k�rh�qS|�)|d& ��r�tj�|d%�*|��+d4d5��+d6d7�d$ � �qStj�|d8� |dk�r�| jd d �s�|dk�r�| jd d �r�tj�|d9� | j'd1 d:k�r�tj�|d;| d< d%�*| j,� d= | j- d> � tj�|d;| d? � tj�|d;| d@ � tj�|dA� tj�|dB� z| j �rtj�.|dC� W dDS tj�.|� W dDS t �y � w )Ez.Write out new rules to file to user chain filer r z'%s' is not writabler r� rQ z*filter rw z-user-input - [0:0] z-user-output - [0:0] z-user-forward - [0:0] z -before-logging-input - [0:0] z -before-logging-output - [0:0] z -before-logging-forward - [0:0] z -user-logging-input - [0:0] z -user-logging-output - [0:0] z -user-logging-forward - [0:0] z -after-logging-input - [0:0] z -after-logging-output - [0:0] z -after-logging-forward - [0:0] z-logging-deny - [0:0] z-logging-allow - [0:0] r! r r z-user-limit - [0:0] z-user-limit-accept - [0:0] z### RULES ### zroute:rP rD z in_%s!out_%sz%s_%sz# ### tuple ### %s %s %s %s %s %s %sz comment=%srx r� r� r z) ### tuple ### %s %s %s %s %s %s %s %s %sr r r~ r � %s-user-%sz -A %s %s z ### END RULES ### z ### LOGGING ### r� r �-D�[z"[z] z] "z### END LOGGING ### z ### RATE LIMITING ### �offz-A z -user-limit z "z " z-user-limit -j REJECT z -user-limit-accept -j ACCEPT z### END RATE LIMITING ### zCOMMIT FN)/r8 r* �access�W_OKrD r r rY rZ rV ry r r r7 �sys�stdout�filenor\ rz r� r r� r� r� rS r� r� r� r� r� r� r� r� rW rX r] � format_ruler� �_get_logging_rulesrE r� r r, r r4 r5 r^ )r6 r� � rules_filer_ rd r: r re r� r� �ifaces�tstrr r� r� � chain_suffixr= �rule_strr� �lrules_tr� �qr> r> r? � _write_rules sT � ��������������� �� �� ��� ��� �� �������z UFWBackendIptables._write_rulesTc C sn | � � d}|jr)| �� std�}t|��|jdkr(| jd d s(td�|j S n|jdkr<| jd d s<td�|j S |jrQ|jdkrQ|jd krQtd �}t|��g }d }d }| j }|j } |jrv| j d k rs|j dkso|j dkrstd �S | j}| dk s�| t|�kr�td�| }t|��| dkr�|jr�td�}t|��| t|�kr�td�| }t|��z|�� W n ty� � w d} d } d} d} |D ]�}z|�� W n ty� � w |j|j|j |j f}| | k�r| d dkr�| d dkr�| dk�s|d dk�r|d dk�s| |k�rd} |�|�� � d} n| d7 } |} | d7 } t�||�}|dk �r+| d7 } |dk�rD|�sD| �sDd}|j�sC|�|�� � q�|dk�rV|j�rV|jdk�rVd}q�|dk �rn|j�sn| �snd}d}|�|�� � q�|�|� q�| �r�| dk�r�td�}|j�r�|d7 }|S n?|�s�|j�s�|�|�� � |�s�|j�r�| j�s�td�}|j�r�|d7 }|S |�r�|j�s�|�s�td�}|j�r�|d7 }|S |j�r�|| _n|| _ z| �|j� W n t�y� � t�y� td �}t|� Y nw td �}|j�rtd �}| � � �r5| j�s5d}|�s | � |j��s | �rPd}| �r(|td �7 }n|td �7 }|j�r6|d7 }|�rIz| � � W nR t�yH � w |td!�7 }nB|�r�|j�r�d"}td#�}|j�re|d7 }|�r{z| � � W n t�yw � w d}n|td!�7 }n|�s�|�s�|j�s�d$}td%�}|dk�r5| j }d&}|j�r�| j }d'}|d7 }d(}|j!�r�d)}n|j"d*k�r�d+}d,||f }td-�}t#|d.|d/g�\}}|dk�r�t|��d0|||�$� f }t%�&d1�}| �'|||�D ]H}t#|g| �\}}|dk�rt(|t)j*� t|� |d$k�r3|�+d2�,|���r3|�-d3d2�,|��}t#|d"|d4d5g�\}}|dk�r3t.d6| � �q�|S )7aX Updates firewall with rule by: * appending the rule to the chain if new rule and firewall enabled * deleting the rule from the chain if found and firewall enabled * inserting the rule if possible and firewall enabled * updating user rules file * reloading the user rules file if rule is modified rP z)Adding IPv6 rule failed: IPv6 not enabledr! r z#Skipping unsupported IPv6 '%s' ruler z#Skipping unsupported IPv4 '%s' rule�udp�tcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4r zInvalid position '%d'z Cannot specify insert and deletez#Cannot insert rule at position '%d'r� )rP rP rP rP r r T���z Skipping inserting existing ruler� z"Could not delete non-existent rulez Skipping adding existing rulezCouldn't update rules filez Rules updatedzRules updated (v6)z Rule insertedz Rule updatedz (skipped reloading firewall)r$ z Rule deleted�-Az Rule addedr r� r r r~ r r# �!Could not update running firewallrj ri z%s %s %sz (-A +)(ufw6?-user-[a-z\-]+)(.*)r� r� r# �RETURNzFAILOK: -D %s -j RETURN)/ry r� r2 rD r r� rz �multir� r �position�iptables_versionr� r� r r� �remove� normalizerV r� r� r3 �dup_ruler r r� r7 r5 r� r� r� r r| r rS r r, rW rX r r r) �stderrr[ r, r] r ) r6 r � allow_reloadrF r_ �newrules�found�modifiedr r= r� �inserted�matches�lastr� �current�ret�flagr� r: r1 r= r� r~ r2 r� r� r� r> r> r? �set_rule� sZ � � � " � � � � � � �zUFWBackendIptables.set_rulec C st g }g }|r | j }n| j}|�� }|�|� |�� |�� }|D ]}|�� }|�� |�� } | |kr7|�|� q |S )z@Return a list of UFWRules from the system based on template rule)r r rA r r@ r� r3 ) r6 �templater� r r� �normr� r� rQ � tmp_tupler> r> r? �get_app_rules_from_system� s" �z,UFWBackendIptables.get_app_rules_from_systemc C s\ | j }|�d�r | j}t|g| �\}}|dkr,td| �}|r(td| � dS t|��dS )zPerform command on chainr� r zCould not perform '%s'zFAILOK: N)r r r| r rD r r )r6 r= r �fail_okr� r� r~ r_ r> r> r? r� � s �z UFWBackendIptables._chain_cmdc C sx | j rdS | �� g }z| �|�}W n ty � w z| jdd� | jdd� W n ty1 � tyA td�}t|� Y nw | �� sHdS td�}| jd | jd | jd | jd D ]}z | � |d |d g� W q` tyx t|��w z$| jd | jd | jd D ]}| � |d |g� | � |d|g� q�W n ty� t|��w |D ]B\}}}d}t |�dkr�|d dkr�d}z"|dkr�t |�dkr�| j |dg|dd� dd� | � |||� W q� ty� t|��w dD ]I}| j d d r�|dk�s | j d d �r9|dk�r9| j |d|g| j | j d g dd� | jd d k�r9| j |d |g| j | j d g dd� q�dS ) z#Update loglevel of running firewallNF)r� Tz&Couldn't update rules file for loggingr: r r r r rj ri r� r� r r$ � delete_firstr� )rR )rt ru r! r rt r ru r� r� r& �-I)r7 ry r- rV r5 r rD r� r1 r� r� rz r4 r5 rE ) r6 r� �rules_tr_ r� r� r4 rR r= r> r> r? r� � s� � ��� ��� � � � � �� � ����z!UFWBackendIptables.update_loggingc C s� g }|t | j�� �vrtd�| }t|��|dkr/| jd D ]}|�|d|ddgdg� q |S | jd D ]}|�|d|ddgd g� q4g d �}| j| | jd k�rg }| j| | jd k r`|}| jd D ]I}dD ]D}|�|�r�| �|�dks~| �|�dkr�d}|�|d|ddd|g| d g� qi| j| | jd kr�d}|�|d|ddd|g| d g� qiqeg }| j| | jd k r�|}| jd D ]S}|�d�r�d}n9|�d��rd}| j| | jd k r�|�|d|dddd ddg| d g� n|�|d|dddd dddd g | d g� |�|d|ddd|g| d g� q�| j| | jd k�r\g }| j| | jd k �r0|}| j| | jd k �rAg d �| }d }| jd! D ]}|�|d|ddd|g| d g� �qH|S )"z%Get rules for specified logging levelzInvalid log level '%s'r& r rT r# r; rS r$ rP )r r! r" z3/minz --limit-burst�10r� �highr r rC rI z [UFW BLOCK] r9 r$ r% �mediumz [UFW ALLOW] r rH r � conntrack� --ctstate�INVALIDz[UFW AUDIT INVALID] �full)r rY rZ �NEWz [UFW AUDIT] r ) r� r� r� rD r r1 r3 �endswithr� ) r6 r� rU r_ r� r� �largsr� r� r> r> r? r- s� �������� ��������� �� �z%UFWBackendIptables._get_logging_rulesc C s� d}t tjj| j�}g }| jD ]2}| j| �d�sq|�| j| � tj � |dtj � | j| ��}tj � |�sAt d�| }t|��qt�d�}|D ]}d||f }tj �|�rat d�| }t|��qI|D ] }d||f }|t d�tj � |�|d � 7 }t�||� qd|D ]]}d||f }t�tj � |dtj � |��tj �|�� t�||� z t�|�} | tj } W n ty� t d �| } t| � Y q�w | tj@ r�|t d �| 7 }q�| tj @ r�|t d �| 7 }q�|S ) zReset the firewallrP z.rulesr z Could not find '%s'. Abortingz %Y%m%d_%H%M%Sz%s.%sz '%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s' )�old�newzCouldn't stat '%s'z WARN: '%s' is world writablez WARN: '%s' is world readable) r r r& � share_dirr r8 r^ r3 r* r+ r, �basename�isfilerD r �time�strftime�exists�rename�shutil�copy�dirname�copymode�stat�ST_MODErV r �S_IWOTH�S_IROTH) r6 �resrb �allfilesr� �fnr_ �extr` �statinfo�moder! r> r> r? �resetk sb � � � � � � � �zUFWBackendIptables.reset)NN)FF)F)T)�__name__� __module__� __qualname__�__doc__r0 rG rg r� r� r� r� r� r� r� r r" r5 rM rQ r� r� r- rw r> r> r> r? r s0 0K ] f! D e * i J Zr )r{ r* rW ri rm r) re � ufw.commonr r �ufw.utilr r r r r r � ufw.backendr r. r/ r r> r> r> r? �<module> s