Website : rimsha.abasa.com
backdoor
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
proc
/
self
/
root
/
lib
/
python3
/
dist-packages
/
ufw
/
__pycache__
/
Filename :
common.cpython-310.pyc
back
Copy
o MH�dX � @ sj d Z ddlZddlZddlZddlmZ dZdZdZeZ dZ dZ d Z d Z G d d � d e�ZG d d� d�ZdS )z!common.py: common classes for ufw� N)�debug�ufwz/lib/ufwz/usr/share/ufwz/etcz/usrz /usr/sbinTc @ s e Zd ZdZdd� Zdd� ZdS )�UFWErrorz$This class represents ufw exceptionsc C s || _ d S �N)�value)�selfr � r �,/usr/lib/python3/dist-packages/ufw/common.py�__init__# � zUFWError.__init__c C s t | j�S r )�reprr �r r r r �__str__& r zUFWError.__str__N)�__name__� __module__� __qualname__�__doc__r r r r r r r ! s r c @ s� e Zd ZdZ d9dd�Zd d � Zd d � Zd d� Zdd� Zdd� Z d:dd�Z dd� Z dd� Z dd� Z d d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� Zd6d7� Zd8S );�UFWRulez$This class represents firewall rules�any� 0.0.0.0/0�inF� c C s� d| _ d| _d| _d| _d| _d| _d| _d| _d| _d| _ d| _ d| _ d| _ d| _ d| _d| _d| _|| _d| _z,| �|� | �|� | �|� | �|d� | �|� | �|� | �|� | �| � W d S tym � w )NFr r �src)�remove�updated�v6�dstr �dport�sport�protocol�multi�dapp�sapp�action�position�logtype� interface_in� interface_out� direction�forward�comment� set_action� set_protocol�set_port�set_src�set_dst� set_direction� set_commentr ) r r# r r r r r r( r) r* r r r r , s> �zUFWRule.__init__c C s | � � S r )� format_ruler r r r r O s zUFWRule.__str__c C s> d| }t | j�}|�� |D ] }|d|| j| f 7 }q|S )zPrint rule to stdoutz'%s'z, %s=%s)�list�__dict__�sort)r �res�keys�kr r r � _get_attribR s zUFWRule._get_attribc C s� t | j| j�}| j|_| j|_| j|_| j|_| j|_| j|_| j |_ | j |_ | j |_ | j |_ | j |_ | j|_| j|_| j|_| j|_| j|_| j|_|S )z Return a duplicate of a rule)r r# r r r r r r r r r r! r" r$ r% r& r' r( r) r* )r �ruler r r �dup_rule[ s& zUFWRule.dup_rulec C sr d}| j dkr|d| j 7 }| jdkr|d| j 7 }| jdkr$|d7 }nD|d| j 7 }| jrh|d7 }| jdkrO| jdkrO|d| j 7 }|d7 }|d | j 7 }n| jdkr\|d| j 7 }n | jdkrh|d | j 7 }| jd kry| jd kry|d | j 7 }| js�| jdkr�|d | j 7 }| jd kr�| jd kr�|d| j 7 }| js�| jdkr�|d| j 7 }d}| jdkr�d| j }| j dkr�|d| 7 }n'| j dkr�|d| 7 }| jdkr�|d7 }n| j dkr�|d| 7 }n|d| 7 }| j dks�| j dk�r5d}t � d�}| j dk�r |d |�d | j � 7 }| j dk�r| j dk�r|d 7 }| j dk�r+|d |�d | j � 7 }|d 7 }|d| 7 }|�� S )!z Format rule for later parsingr z -i %sz -o %sr z -p allz -p z -m multiportz --dports z --sports r �::/0z -d z --dport z -s z --sport �_�allowz -j ACCEPT%s�rejectz -j REJECT%s�tcpz --reject-with tcp-reset�limitz -j LIMIT%sz -j DROP%sz-m comment --comment '� �dapp_z%20�,�sapp_�')r& r' r r r r r r r% r# r! r" �re�compile�sub�strip)r �rule_str�lstrr* � pat_spacer r r r2 r sf � zUFWRule.format_rulec C sj |� � �d�}|d dks|d dks|d dkr |d | _nd| _d}t|�dkr.|d }| �|� d S ) zSets action of the ruler= r r> r? rA �denyr � N)�lower�splitr# �len� set_logtype)r r# �tmpr% r r r r+ � s $ zUFWRule.set_actionr c C s� t d�| }|dkr n�|dkr| jrn�|dkr| jrn�t�d|�s't�d|�r+t|��|�d�|�d� d kr;t|��|�d�}t|�d krId | _ d }|D ]y}t�d |�r�d | _ |�d�}|D ]}t |�d k smt |�dkrqt|��q_t |d �t |d �kr�t|��n4t�d|�r�t |�d k s�t |�dkr�t|��n t�d|�r�zt � |�}W n t y� t|��w t|��|r�|dt|� 7 }qMt|�}qM|}|dkr�t|�| _dS t|�| _dS )z:Sets port and location (destination or source) of the rulez Bad port '%s'r r r z^[,:]z[,:]$rD �:� rO Tr z ^\d+:\d+$i�� r z^\d+$z ^\w[\w\-]+N)r= r! r" rG �matchr �countrQ rR r �int�socket� getservbyname� Exception�strr r ) r �port�loc�err_msg�portsrT �p�ran�qr r r r- � sX �� � � zUFWRule.set_portc C s0 |t jjdg v r|| _dS td�| }t|��)zSets protocol of the ruler zUnsupported protocol '%s'N)r �util�supported_protocolsr r= r )r r r` r r r r, � s zUFWRule.set_protocolc C s� | j r)| jr| jdks| jdkrd| _| jr%| jdks | jdkr'd| _dS dS dS | jr9| jdks6| jdkr9d| _| jrK| jdksF| jdkrMd| _dS dS dS )z Adjusts src and dst based on v6r r r< N)r r r r r r r � _fix_anywhere� s � �zUFWRule._fix_anywherec C s || _ | �� dS )zXSets whether this is ipv6 rule, and adjusts src and dst accordingly. N)r rg )r r r r r �set_v6 s zUFWRule.set_v6c C �@ |� � }|dkrtj�|d�std�}t|��|| _| �� dS )zSets source address of ruler zBad source addressN)rP r re � valid_addressr= r r rg �r �addrrT r` r r r r. � zUFWRule.set_srcc C ri )z Sets destination address of ruler zBad destination addressN)rP r re rj r= r r rg rk r r r r/ rm zUFWRule.set_dstc C s� |dkr|dkrt d�}t|��dt|�v r t d�}t|��dt|�v r,t d�}t|��t|�dks8t|�d kr@t d �}t|��tt|��d krPt d �}t|��tt|��d kr`t d�}t|��t�dt|��spt d�}t|��|dkry|| _dS || _dS )zSets an interface for ruler �outzBad interface type�!z+Bad interface name: reserved character: '!'rU z/Bad interface name: can't use interface aliases�.z..z)Bad interface name: can't use '.' or '..'r z+Bad interface name: interface name is empty� z+Bad interface name: interface name too longz^[a-zA-Z0-9_\-\.\+,=%@]+$zBad interface nameN)r= r r] rR rG rW r& r' )r �if_type�namer` r r r � set_interface' s0 zUFWRule.set_interfacec C s> t |�dkrt�dt |��std�| }t|��t|�| _dS )z Sets the position of the rulez-1z^[0-9]+z,Insert position '%s' is not a valid positionN)r] rG rW r= r rY r$ )r �numr` r r r � set_positionW s zUFWRule.set_positionc C sB |� � dks|� � dks|dkr|� � | _dS td�| }t|��)zSets logtype of the rule�logzlog-allr zInvalid log type '%s'N)rP r% r= r )r r% r` r r r rS a s zUFWRule.set_logtypec C s. |dks|dkr || _ dS td�| }t|��)zSets direction of the ruler rn zUnsupported direction '%s'N)r( r= r )r r( r` r r r r0 j s zUFWRule.set_directionc C s t j�| j�S )z Get decoded comment of the rule)r re � hex_decoder* r r r r � get_commentr s zUFWRule.get_commentc C s || _ dS )zSets comment of the ruleN)r* )r r* r r r r1 v s zUFWRule.set_commentc C s� d}| j r(ztj�| j | j�\| _ }W n ty" td�}t|��w |r(|| _| j rNztj�| j | j�\| _ }W n tyH td�}t|��w |rN|| _| j rc| j � d�}tj� |� d� |�| _ | jrz| j� d�}tj� |� d� |�| _dS dS )z&Normalize src and dst to standard formFz"Could not normalize source addressz'Could not normalize destination addressrD N)r r re �normalize_addressr r\ r= r r r r rQ � human_sort�joinr )r �changedr` ra r r r � normalizez s@ � � � � �zUFWRule.normalizec C s� | r|st � �d| |f }| j|jkrt|� dS | j|jkr%t|� dS | j|jkr1t|� dS | j|jkr=t|� dS | j|jkrIt|� dS | j|jkrUt|� dS | j|jkrat|� dS | j |j krmt|� dS | j |j kryt|� dS | j |j kr�t|� dS | j |j kr�t|� dS | j |j kr�t|� dS | j|jkr�| j|jkr�| j|jkr�td�}t|� dS | j|jkr�| j|jkr�| j|jkr�td�}t|� dS td�| j|j| j|j| j|jd� }t|� d S ) z�Check if rules match Return codes: 0 match 1 no match -1 match all but action, log-type and/or comment -2 match all but comment zNo match '%s' '%s'rO zFound exact matchr z$Found exact match, excepting comment���zZFound non-action/non-logtype/comment match (%(xa)s/%(ya)s/'%(xc)s' %(xl)s/%(yl)s/'%(yc)s'))�xa�ya�xl�yl�xc�yc���)� ValueErrorr r r r r r r r! r" r& r' r( r) r# r% r* r= )�x�y�dbg_msgr r r rW � sr ��z UFWRule.matchc C s� dd� }| r|s t � �| �|�dkrdS d| | j||jf }|jdkr-td| d � dS |j| jkr;t|d � dS | j|jkrN|jd krNtd | � dS |jd krb|| j|j�sbtd | � dS |jd kr�| jd krs| � | j �rsn�| j |j kr�d|j vr�td| � dS | j |j kr�d|j v r�| j|jkr�t j � | j |j | j�s�td| d| j |j f � dS n�| jd kr�| j|jkr�td| d| j|jf � dS z t j �|j| j�}W n ty� td| d|j � Y dS w |j |k�r d|j v�r td| d|j |f � dS |j |k�r7d|j v �r7| j|jk�r7t j � ||j | j��s7td| d||j f � dS | j|jk�rNtd| d| j |j f � dS td| | j||jf � dS )a� This will match if x is more specific than y. Eg, for protocol if x is tcp and y is all or for address if y is a network and x is a subset of y (where x is either an address or network). Returns: 0 match 1 no match -1 fuzzy match This is a fuzzy destination match, so source ports or addresses are not considered, and (currently) only incoming. c S s~ d| v sd| v r| |krdS dS |� d�D ]'}| |kr dS d|v r<|� d�\}}t| �t|�kr<t| �t|�kr< dS qdS )z:Returns True if p is an exact match or within a multi rulerD rU TF)rQ rY )�test_p�to_matchr^ �low�highr r r � _match_ports� s �z-UFWRule.fuzzy_dst_match.<locals>._match_portsr z(No fuzzy match '%s (v6=%s)' '%s (v6=%s)'r z (direction) z (not incoming)rO z (forward does not match)r z (protocol) z(dport) r �/z(dst) z ('%s' not in network '%s')z (interface) z (%s != %s)z %s does not existz(v6) z'(fuzzy match) '%s (v6=%s)' '%s (v6=%s)'r� )r� rW r r( r r) r r r& � _is_anywherer r re � in_network�get_ip_from_if�IOError)r� r� r� r� �if_ipr r r �fuzzy_dst_match� s� � "� �� � �� �&� � zUFWRule.fuzzy_dst_matchc C s |dks|dkr dS dS )z Check if address is anywherer< r TFr )r rl r r r r� N s zUFWRule._is_anywherec C s� d}| j dks | jdkred| j | j| j| jf }| j dkr)d| j| j| j| jf }| jdkr:d| j | j| j| jf }| jdkrM| jdkrM|d| j 7 }|S | jdkrY|d| j 7 }| jdkre|d| j 7 }|S )a� Returns a tuple to identify an app rule. Tuple is: dapp dst sapp src direction_iface|direction or dport dst sapp src direction_iface|direction or dapp dst sport src direction_iface|direction where direction_iface is of form 'in_eth0', 'out_eth0' or 'in_eth0 out_eth0' (ie, both interfaces used). If no interfaces are specified, then tuple ends with the direction instead. r z %s %s %s %sz %sz in_%sz out_%s) r! r" r r r r r& r' r( )r �tuplr r r � get_app_tupleT s& � � � zUFWRule.get_app_tuplec C s� | j dkr| jdks| jdkrtd�| j }t|��| j tjjv r0|dkr0td�| j }t|��| j tjjv rL| j dksA| j dkrNtd�| j }t|��dS dS )z Verify ruler r z3Improper rule syntax ('%s' specified with app rule)r z'Invalid IPv6 address with protocol '%s'z Invalid port with protocol '%s'N) r r" r! r= r r re �ipv4_only_protocols�portless_protocolsr r )r � rule_iptyper` r r r �verifyv s( ����zUFWRule.verifyN)r r r r r Fr )r ) r r r r r r r9 r; r2 r+ r- r, rg rh r. r/ rt rv rS r0 ry r1 r~ rW r� r� r� r� r r r r r * s: �# C 5 0 #Cn "r )r rG rZ �ufw.utilr r � programName� state_dir� share_dir� trans_dir� config_dir� prefix_dir� iptables_dir� do_checksr\ r r r r r r �<module> s