VV @sdZddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z m Z m Z mZmZmZddlZGdddejjZdS)z-backend_iptables.py: iptables backend for ufwN)UFWErrorUFWRule)warndebugmsgcmdcmd_pipe _findpathc@seZdZdZddddZddZddZd d Zd d d d ZddZ ddZ ddZ ddZ ddZ ddZddZd ddZddd Zd!d"Zd d#d$Zd%d&Zd'd(Zd)d*ZdS)+UFWBackendIptableszInstance class for UFWBackendNc Csadtjjd|_||_||_i}ttjj|}ttjj|}t j j |d|ddddgD]-} d|| | f} |j| j| qWqW|jdj|d|jdj|d qgWd!d"d#d$d%d&d'g|_d(|_d)S)*z!UFWBackendIptables initializationz# z _comment #zufw/user.rulesruleszufw/before.rulesZ before_ruleszufw/after.rules after_ruleszufw/user6.rulesrules6zufw/before6.rulesZ before6_ruleszufw/after6.rules after6_ruleszufw-initinitiptablesrootdirdatadirbeforeuseraftermisc46ufwinputoutputforwardz%s-%s-logging-%sz -logging-denyz-logging-allowz-mlimitz--limitz3/minutez-jLOGz --log-prefixz[UFW LIMIT BLOCK]N)rcommonZ programName comment_strrrr config_dir state_dirospathjoinbackend UFWBackend__init__chainsuse_ipv6appendufw_user_limit_logufw_user_limit_log_text) selfdryrunrrfilesr!r"Zver chain_prefixloctargetchainr56/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr( sB  " !      zUFWBackendIptables.__init__cCsztd}|jddkr,|d7}nJ|jddkrL|d7}n*|jddkrl|d7}n |d 7}|S) zGet current policyz New profiles:Zdefault_application_policyacceptz allowZdropz denyrejectz rejectz skip)_defaults)r.rstrr5r5r6get_default_application_policyLs     z1UFWBackendIptables.get_default_application_policyc Cs|js|dkrI|dkrI|dkrItd|}t||dkr|dkr|dkrtd|}t|d }|dkrd }n|dkrd }d }d }|dkry"|j|jd d|dWntk rYnXd}d}n|dkrly"|j|jd d|dWntk r\YnXd}d}nFy"|j|jd d|dWntk rYnXd}d}tjd |}x|jd|jdgD]}ytj j |} Wntk rYnX| d} xV| dD]J} |j | r`tj j | |j || q)tj j | | q)Wytj j| Wqtk rYqXqWtdd|d|i} | td7} | S)zSets default policy of firewallallowdenyr8zUnsupported policy '%s'ZincomingZoutgoingroutedz%Unsupported policy for direction '%s'INPUTOUTPUTFORWARDr:zDEFAULT_%s_POLICYz"ACCEPT"z UFW BLOCKz UFW ALLOWz"REJECT"z"DROP"r rtmporigz5Default %(direction)s policy changed to '%(policy)s' directionpolicyz*(be sure to update your rules accordingly))r/r9rZ set_defaultr0 Exceptionrecompilerutil open_filessearch write_to_filesub close_files) r.rGrFerr_msgr4Z old_log_strZ new_log_strpatffnsfdliner;r5r5r6set_default_policyZsz $                 !  "   z%UFWBackendIptables.set_default_policyc Cs<|jr1dtd}|dtd7}|S|jddddg}g}g}|dkr|jd d d d dg}d d dg}n|d krx9dddgD](}|jd||jd|qWx?dddddgD](}|jd||jd|qWx6ddgD](}|jd||jd|q-Wx"dddgD]}|jd|qiWn|dkrxdddgD](}|jd||jd|qWn|dkrsx9dddgD](}|jd||jd|qW|jd d!rE|jd"|jd#|jd d$r~|jd%|jd&n |d'krxdddgD](}|jd(||jd)|qWn|d*kr~x}dddgD]l}|jd+||jd,||jd-||jd.||jd/||jd0|qW|jd1|jd2|jd3|jd4d5|}x|D]}d6|kr|jd6\} }|d7| 7}t|jg||d | g\} } n#t|jg||g\} } || 7}|dkr3|d87}| d9krt|qW|dksg|j r8|d:7}x|D]}d6|kr|jd6\} }|d7| 7}t|jg||d | g\} } n#t|j g||g\} } || 7}|dkr|d87}| d9krxt|qxW|S);z'Show current running status of firewallz> zChecking raw iptables zChecking raw ip6tables z-nz-vz-xz-Lrawz-tfilterZnatZmanglebuiltinsr@rBrAz filter:%sZ PREROUTINGZ POSTROUTINGz mangle:%szraw:%sznat:%srrrrz ufw-before-%szufw6-before-%srz ufw-user-%sz ufw6-user-%srrzufw-user-limit-acceptzufw-user-limitrzufw6-user-limit-acceptzufw6-user-limitrz ufw-after-%sz ufw6-after-%sZloggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyz IPV4 (%s): :z(%s)  rz IPV6: ) r/r9initcapsr+capssplitrrrr* ip6tables) r.Z rules_typeoutargsitemsZitems6cbitrcrDr5r5r6get_running_raws                    ,#       ,#    z"UFWBackendIptables.get_running_rawFc$ Cs d}|jrCdtd}|jr?|dtd7}|Std}xdddgD]}t|jd d |d g\}}|d krtd S|dkrt|d||jr_t|jd d|d g\}}|dkr_t|dq_Wd}d} d} |j|j} d } i} xN| D]F}d}i}d}d}| r|j dks|j dkrd}|j }|| krt d|qFn d| | zChecking iptables zChecking ip6tables zproblem runningrrrz-Lz ufw-user-%sz-nzStatus: inactiverz iptables: %s z ufw6-user-%sz ip6tablesTFzSkipping found tuple '%s'dstsrcz::/0z (v6)z 0.0.0.0/0any /z (%s)ZAnywherez on %sraz (%s)z, z[%2d] ZFWDinz # %sz%-26s %-12s%-26s%s%s z z ZToZFromZActionz%-26s %-12s%s -r\zDefault: %(in)s (incoming), z%(out)s (outgoing), z%(routed)s (routed)r?z0Status: active %(log)s %(pol)s %(app)s%(status)slogZpolZappZstatuszStatus: active%sN)#r/r9r*rrrr`r r dappsapp get_app_tuplerrkv6dportrlsportprotocolr interface_in interface_outlogtyperFlowerr+lenr%uppercommentZ get_commentactionZ get_loglevel_get_default_policyr<)$r.verboseZ show_countrarQrFrhZout6sZstr_outZstr_rter count app_rulesrZtmp_strlocationtuplZ show_protor2ZportrDZattribsZ attrib_strZdir_strr Zfull_strZstr_toZstr_fromZ str_actionZrules_header_fmtZ rules_headerlevelZ logging_strZ policy_strZapp_policy_strr5r5r6 get_statussT           %                  $ '            $                    zUFWBackendIptables.get_statuscCs|jr tdtdng}|j|jd|jdk r|jdk r|jd|j|j|jd|j|j|jdt|\}}|dkrtd |}t|dS) zStop the firewallz> zrunning ufw-initrNz --rootdirz --datadirz force-stoprzproblem running ufw-init %s) r/rr9r+r0rrrr)r.rbrhrarQr5r5r6 stop_firewalls     z UFWBackendIptables.stop_firewallc Cs|jr tdtdnpg}|j|jd|jdk r|jdk r|jd|j|j|jd|j|j|jdt|\}}|dkrtd |}t|d |j ks |j d t |j j krKy|j d Wqtk rGtd }t|YqXnEy|j|j d Wn*tk rtd }t|YnXdS)zStart the firewallz> zrunning ufw-initrNz --rootdirz --datadirstartrzproblem running ufw-init %sloglevellowzCould not set LOGLEVELzCould not load logging rules)r/rr9r+r0rrrrr:list loglevelskeysZ set_loglevelrHupdate_logging)r.rbrhrarQr5r5r6start_firewalls4      "    z!UFWBackendIptables.start_firewallcCs|jr dS|jd}|j}|r;d}|j}xdddddgD]}|dkso|dkr|r|jdd  rqQn| r|jdd  rqQt|d d |d |g\}}|dkrQtddSqQWdS)zCheck if all chains existFrufw6rrrrz limit-acceptrrz-nz-Lz-user-rz_need_reload: forcing reloadT)r/r]rr`r^rr)r.rwprefixexer4rhrar5r5r6 _need_reloads&    &  zUFWBackendIptables._need_reloadc CsKtd}|jr8td|jrGtdn|jrGyHxA|jdD]2}|j|d|g|j|d|gqUWWntk rt|YnXt d|j dg|j d g\}}|d krt|d |jrGt d|j d g|j d g\}}|d krGt|d dS)zReload firewall rules filezproblem runningz> | iptables-restorez> | ip6tables-restorerz-Fz-Zcatr z-nrz iptablesr z ip6tablesN) r9r/rr* is_enabledr) _chain_cmdrHrrr0Ziptables_restoreZip6tables_restore)r.rQrdrhrar5r5r6_reload_user_rules6s*          z%UFWBackendIptables._reload_user_rulescCs#g}tjd}tjd}tjd}|j|r|j|r|j|r|j|jd|jd|n|j|jd||j|jd|q|j|jd|n |j|tjd}tjd } tjd } d } xPt|D]B\} } |j| r&|jd | j}|jd krtd}n!|jdkrd}nd}d| |f}| j| sd|}|jd| || <|j| |jd|d|| |j| | jd|d||jd| |j| | jd|d||jd|| q&Wtjd}xt|D]\} } |j| r|jd| }|jddd|d| }|jd|d | }||| <|j| ||j| |qW|S)!z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z-j \1 --reject-with tcp-resetz-p udp rCz(.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10z\2r7ZALLOWrZLIMITZBLOCKz"%s -j LOG --log-prefix "[UFW %s] "z-m conntrack --ctstate NEW z \1-j \2\4z\1-j z-user-logging-z\1 z \1-j RETURNz\1z -j LIMITz+ -m conntrack --ctstate NEW -m recent --setz% -m conntrack --ctstate NEW -m recentz# --update --seconds 30 --hitcount 6z -j z -user-limitz-user-limit-accept) rIrJrMr+rO enumeratestripr~insert)r.frulersuffixsnippetsZ pat_protoZpat_portZ pat_rejectpat_logZ pat_logallZ pat_chain limit_argsrfrrGZlstrZ pat_limitZtmp1Ztmp2Ztmp3r5r5r6_get_rules_from_formattedRsh           z,UFWBackendIptables._get_rules_from_formattedc Csg}|j|||}tjd}xt|D]\}}|j|jd|j|j|r7||jd||j|jd|jdd|||jd|j7tjj|d;|d?tjj|d;|d@tjj|dAtjj|dBy3|j rtjj.|dCntjj.|Wnt k rYnXdDS)Ez.Write out new rules to file to user chain filer r z'%s' is not writablerrrDz*filter r[z-user-input - [0:0] z-user-output - [0:0] z-user-forward - [0:0] z-before-logging-input - [0:0] z-before-logging-output - [0:0] z -before-logging-forward - [0:0] z-user-logging-input - [0:0] z-user-logging-output - [0:0] z-user-logging-forward - [0:0] z-after-logging-input - [0:0] z-after-logging-output - [0:0] z-after-logging-forward - [0:0] z-logging-deny - [0:0] z-logging-allow - [0:0] rrrz-user-limit - [0:0] z-user-limit-accept - [0:0] z### RULES ### zroute:rCr9z in_%s!out_%sz%s_%sz# ### tuple ### %s %s %s %s %s %s %sz comment=%sr\rnrrz%20z) ### tuple ### %s %s %s %s %s %s %s %s %srrrarz %s-user-%sz -A %s %s z ### END RULES ### z ### LOGGING ### rrz-D[z"[z] z] "z### END LOGGING ### z ### RATE LIMITING ### offz-A z -user-limit z "z " z-user-limit -j REJECT z-user-limit-accept -j ACCEPT z### END RATE LIMITING ### zCOMMIT FN)/r0r#accessW_OKr9rrrKrLrHr]r r r/sysstdoutfilenorNr^rrr}r{r|rFrtrurzrxrkryrlrrIrJrO format_ruler_get_logging_rulesr:rrr%rr,r-rP)r.rwZ rules_filerQrTr1r rUrrZifacesZtstrrrtru chain_suffixr4rule_strrZlrules_trdqr5r5r6 _write_rules s              !   !    " $  .  zUFWBackendIptables._write_rulesTcCs*|jd}|jrr|js=td}t||jdkr|jdd rtd|jSn2|jdkr|jdd rtd|jS|jr|jdkr|jd krtd }t|g}d }d }|j }|j } |jrP|j d krG|j dks=|j dkrGtd S|j}| dksn| t|krtd| }t|| dkr|jrtd}t|| t|krtd| }t|y|jWntk r YnXd} d } d} d5} x|D]}y|jWntk rUYnX|j|j|j |j f}| | kr| ddkr| ddkr| dks|ddkr|ddks| |krd} |j|jd6} n | d7} |} | d7} tj||}|dkr<| d7} |dkr{| r{| r{d}|js|j|jq*|d7kr|jr|jdkrd}q*|dkr|j r| rd}d}|j|jq*|j|q*W| r0| dkrtd}|jr)|d7}|Sn| rT|j rT|j|j| r|jr|j rtd}|jr|d7}|S|r|j r| rtd}|jr|d7}|S|jr||_n ||_ y|j|jWn<tk rYn(tk r;td}t|YnXtd}|jr]td}|jr&|j r&d}|s|j|js| rd}| r|td7}n|td7}|jr|d7}|ry|jWqtk rYqXqi|td7}nN|r?|jr?d }td!}n*| ri| ri|j rid"}td#}|dkr&|j}d$}|jr|j }d%}|d7}d&}|j!rd'}n|j"d(krd)}d*||f}td+}t#|d,|d-g\}}|dkr%t|d.|||j$f}t%j&d/}x|j'|||D]}t#|g|\}}|dkrt(|t)j*t||d"krc|j+d0j,|rc|j-d1d0j,|}t#|d |d2d3g\}}|dkrct.d4|qcW|S)8aXUpdates firewall with rule by: * appending the rule to the chain if new rule and firewall enabled * deleting the rule from the chain if found and firewall enabled * inserting the rule if possible and firewall enabled * updating user rules file * reloading the user rules file if rule is modified rCz)Adding IPv6 rule failed: IPv6 not enabledrrz#Skipping unsupported IPv6 '%s' rulerz#Skipping unsupported IPv4 '%s' ruleZudpZtcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4rzInvalid position '%d'z Cannot specify insert and deletez#Cannot insert rule at position '%d'rjrrTz Skipping inserting existing rulez (v6)z"Could not delete non-existent rulezSkipping adding existing rulezCouldn't update rules filez Rules updatedzRules updated (v6)z Rule insertedz Rule updatedz (skipped reloading firewall)z-Dz Rule deletedz-Az Rule addedrrrrrarz %s-user-%sz!Could not update running firewallz-Lz-nz%s %s %sz(-A +)(ufw6?-user-[a-z\-]+)(.*)rnz\2z-jRETURNzFAILOK: -D %s -j RETURN)rCrCrCrC)rCrCrCrC)/r]rwr*r9rrr^Zmultirzr positionZiptables_versionrtrur rremove normalizerHrkrlr+dup_rulerrrr/rrrrrr`rrFrrrIrJrrrstderrrMr%rOr)r.rZ allow_reloadr;rQZnewrulesfoundZmodifiedr rrZinsertedZmatchesZlastrZcurrentZretZflagrr1rr4rhrarrrrdr5r5r6set_rules4     !!'               ,        $                                       $! zUFWBackendIptables.set_rulec Csg}g}|r|j}n |j}|j}|j||j|j}xI|D]A}|j}|j|j} | |kr]|j|q]W|S)z@Return a list of UFWRules from the system based on template rule)r r rrrrvr+) r.templaterwr rZnormrrrDZ tmp_tupler5r5r6get_app_rules_from_systems            z,UFWBackendIptables.get_app_rules_from_systemcCs}|j}|jdr!|j}t|g|\}}|dkrytd|}|rmtd|n t|dS)zPerform command on chainrrzCould not perform '%s'zFAILOK: N)rrr`rr9rr)r.r4rbfail_okrrhrarQr5r5r6rs   zUFWBackendIptables._chain_cmdc %CsL|jr dS|jg}y|j|}Wntk rGYnXy$|jdd|jddWn<tk rYn(tk rtd}t|YnX|jsdStd}xt|jd|jd|jd |jd D]D}y|j |d |d gWqtk r9t|YqXqWy^xW|jd|jd |jd D]2}|j |d |g|j |d|gqeWWntk rt|YnXx|D]\}}}d}t |dkr|ddkrd}y\|dkrIt |dkrI|j |dg|dddd|j |||Wqtk r}t|YqXqWxddgD]}|j ddr|dks|j ddr|dkr|j |d|g|j |j dgdd|jddkr|j |d|g|j |j dgddqWdS)z#Update loglevel of running firewallNrwFTz&Couldn't update rules file for loggingz!Could not update running firewallrrrrz-Lz-nz-Fz-Zrz-D delete_firstrjrzufw-user-limitzufw6-user-limitrrrrnrrz-I)r/r]rrHrrr9rr)rrr^r,r-r:) r.rrules_trQrdrrrr4r5r5r6rsl        2  "'   z!UFWBackendIptables.update_loggingc Csg}|t|jjkr=td|}t||dkrx7|jdD](}|j|d|ddgdgqWW|Sx7|jdD](}|j|d|ddgd gqWd d d d ddg}|j||jdkr#g}|j||jdkr|}x|jdD]}xdddgD]}|j|r=|j|dks||j|dkrd}|j|d|ddd|g|d gq=|j||jdkr=d}|j|d|ddd|g|d gq=Wq'Wg}|j||jdkr+|}x|jdD]}|jdrWd}n|jdrd}|j||jdkr|j|d|d d d!d"ddg|d gn8|j|d|d d d!d"dddd#g |d g|j|d|ddd|g|d gq9W|j||jdkrg}|j||jd$krc|}|j||jdkrd d d!d%g|}d&}xA|jd'D]2}|j|d|ddd|g|d gqW|S)(z%Get rules for specified logging levelzInvalid log level '%s'rrz-Iz-jrrz-DrCz-mrz--limitz3/minz --limit-burstZ10rZhighrrrrr8r>z [UFW BLOCK] z-Arz --log-prefixZmediumz [UFW ALLOW] rr=Z conntrackz --ctstateZINVALIDz[UFW AUDIT INVALID] ZfullZNEWz [UFW AUDIT] r) rrrr9rr)r+endswithr) r.rrrQrdrZlargsrgrr5r5r6rsx  &&   z%UFWBackendIptables._get_logging_rulesc Csd}ttjj|j}g}x|jD]}|j|jdsMq.|j|j|tj j |dtj j |j|}tj j |s.t d|}t|q.Wtjd}xL|D]D}d||f}tj j|rt d|}t|qWxZ|D]R}d||f}|t dd tj j |d |i7}tj||q#Wx|D]}d||f}tjtj j |dtj j |tj j|tj||y tj|} | tj} Wn/tk r1t d |} t| wYnX| tj@rV|t d |7}q| tj@r|t d |7}qW|S)zReset the firewallrCz.rulesrzCould not find '%s'. Abortingz %Y%m%d_%H%M%Sz%s.%sz'%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s' oldnewzCouldn't stat '%s'zWARN: '%s' is world writablezWARN: '%s' is world readable)r rr share_dirrr0rr+r#r$r%basenameisfiler9rtimeZstrftimeexistsrenameshutilcopydirnameZcopymodestatST_MODErHrS_IWOTHS_IROTH) r.resrZallfilesrffnrQZextrZstatinfomoderr5r5r6resetYsR         zUFWBackendIptables.reset)__name__ __module__ __qualname____doc__r(r<rWrirrrrrrrrrrrrrrrr5r5r5r6r s( ,  K ]  !   D  e  J Zr )rr#rIrrrrZ ufw.commonrrZufw.utilrrrrrr Z ufw.backendrr&r'r r5r5r5r6s      .