⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
ufw
/
__pycache__
/
View File Name :
backend.cpython-312.pyc
#fdk d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z m Z ddl mZmZ ddlZ G d d Zy)z&backend.py: interface for ufw backends N)errorwarndebug _findpath)UFWErrorUFWRulec e Zd ZdZ d!dZd Zd Zd Zd"dZd Z d Z d Z d Z d Z d Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Zd Z d Z d Z d Z d Z d Z!y)# UFWBackendzInterface for backendsNc J d | _ || _ || _ g | _ g | _ t t j j | }t j j |d t j j |d t j j |d d| _ || j j | ddddd d | _ t j j | _ | j! | j# | j% t j& j) | j d | _ t j j t j j, d | _ t j j t j j, d | _ t j j t j j, d | _ t j j t j j, d | _ t j6 j9 | j. | _ d | _! y # t< $ r t? d }tA | w xY w)Nz default/ufwz ufw/ufw.confzufw/applications.d)defaultsconfappsr d i, i )offlowmediumhighfullr iptablesziptables-restore ip6tableszip6tables-restorez#Couldn't determine iptables version)"r namedryrunrulesrules6r ufwcommon config_dirospathjoinfilesupdate loglevels do_checks _do_checks _get_defaults _read_rules applications get_profilesprofiles iptables_dirr iptables_restorer ip6tables_restoreutilget_iptables_versioniptables_versionOSError_r caps)selfr r extra_filesrootdirdatadirperr_msgs -/usr/lib/python3/dist-packages/ufw/backend.py__init__zUFWBackend.__init__ s cjj++W 5"$'',,q-"@ ggll1n = ggll1.B CF " JJ k *!"!$$'"%"% ( -- ((55djj6HI SZZ%<%<jI " SZZ-D-D-?!A cjj&=&={K!# cjj.E.E.A"C $$'HH$A$A$--$PD ! $=>G7# # $s .J J"c > | j yi | _ i | j d< d| j d d< d| j d d< | j rt j dk( r| j s t j j | j }d |v rd |v rd| j d d< nd| j d d< | j rX t j j | j }d |v rd |v rd| j d d< yd| j d d< yyyyy# t $ r5}d|z }| j r t | t | Y d}~yd}~ww xY w# t $ r}t d|z Y d}~d}~ww xY w) zgInitialize the capabilities database. This needs to be called before accessing the database.NlimitT4F6r z initcaps %sz recent-setz recent-update)r4 r% r getuidr r r/ get_netfilter_capabilitiesr r2 is_enabledr r use_ipv6r )r5 nf_capsemsgs r; initcapszUFWBackend.initcapsL s 99 ' #' '3 "' '3 >>biikQ .t{{ ((==dmmL w&?g+E*. '"3'*/ '"3' }}. !hh A A$.. QG 7*'/I.2DIIg&s+.3DIIg&s+ % 8C .> $q(??$#JS " ..1,--.s0 8)D: )E; : E8+E33E8; F FF c F d| j v r| j d dk( ryy)z!Is firewall configured as enabledenabledyesTF)r r5 s r; rC zUFWBackend.is_enabledx s% % == #u , c d| j v r2| j d dk( r t j j d ryy)z"Is firewall configured to use IPv6ipv6rK z/proc/sys/net/ipv6TF)r r r existsrL s r; rD zUFWBackend.use_ipv6 s6 T]] " == E ) 77>>. /rM c d|z dz }d}| j | dk( rd}n| j | dk( rd}nd}|r|dk( rd }t d }t j j d d g \ }}|d k7 r t | d|v rd}| j r^t j j d dg \ }}|d k( rd|v rd}t j j d dg \ }}|d k( rd|v rd}|sd}|S )z.Get default policy for specified primary chaindefault__policy acceptallowrejectdenyforwardFzproblem running sysctlsysctlznet.ipv4.ip_forwardr 1Tz net.ipv6.conf.default.forwardingz net.ipv6.conf.all.forwardingdisabled)r r3 r r/ cmdr rD ) r5 primary check_forwardpolicyrstrrJ r: rcouts r; _get_default_policyz UFWBackend._get_default_policy s g% 1 == H ,D ]]6 "h .DD W 1G01G h0E%FGIRQw w''cz }} HHLL(4V)W X S7scz "G HHLL(4R)S T S7scz "G! rM c | j st d }t | yt j t j k7 rt d }t | t j t j k7 rt d }t | t j }|dk7 rt d }t | i }i }i }g }t j j | j d s't d | j d z }t | nt j d }t j | j d D ]P } |j | r|j! t j j# | j d | R t% | j j' t j j) t* j, d gz |z D ] } | j/ d st j0 d | } t3 d | z | | j d k( r-t j j | j d s| t j4 | } | t4 j6 } d } d}d} t= j> | j@ d | k( s%t= j> | j@ d |k( rd}| j@ dk7 rD|sB| |vr>t d tE | | tE | j@ dz }t | d|| < | t4 jF z r"| |vr t d | z }t | d|| < | t4 jH z r1| |vr-| jJ dk7 r t d | z }t | d|| < | d k( r| }t j jM | } | s t9 tN jP d|z | j D ]] }|dk7 s t j jS | j | r6t d || j | dz }t | y# t8 $ r t d | z }t | t: $ r w xY w# tB $ r Y w xY w)a8 Perform basic security checks: is setuid or setgid (for non-Linux systems) checks that script is owned by root checks that every component in absolute path are owned by root warn if script is group writable warn if part of script path is group writable Doing this at the beginning causes a race condition with later operations that don't do these checks. However, if the user running this script is root, then need to be root to exploit the race condition (and you are hosed anyway...) zChecks disabledTz%ERROR: this script should not be SUIDz%ERROR: this script should not be SGIDr z&You need to be root to run this scriptr z'%s' does not existz^\./z Checking zCouldn't stat '%s'clickpkg snappypkgFz4uid is %(uid)s but '%(path)s' is owned by %(st_uid)s)uidr st_uidz%s is world writable!z%s is group writable!z Could not find parent for '%s'z&'%(f)s' file '%(name)s' does not exist)fr N)*r% r3 r r rA geteuidr getgidgetegidr isdirr" recompilelistdirsearchappendr! listvaluesabspathsysargv startswithgetcwdr statST_MODEr2 Exceptionpwdgetpwuidrj KeyErrorstrS_IWOTHS_IWGRPst_giddirnameerrnoENOENTisfile)r5 r: ri warned_world_writewarned_group_write warned_ownerr+ warn_msgpatprofiler statinfomode click_user snap_useris_unpack_user last_pathrk s r; r& zUFWBackend._do_checks s ~~)*G M 99;"**, &?@G7# # 99;"**, &?@G7# #iik !8@AG7# # ww}}TZZ /0./4::f3EFH N**V$C ::djj&89zz'* OOBGGLLF1CW$MN : **,-''//#((1+.01D ??3'"$))+t4kD()4::f-- !ww}}TZZ-? @ !wwt}H#DLL1D ( ' !&||HOO4Q7:E LL 9! < I)- ??a' L0 ". /:=c(7;9<X__9M3O PH N)-L&$,,&47I+I !8 9T BHN/3&t,$,,&47I+I 1, !8 9T BHN/3&t,3; wwt,!%,,"B#,#./ /e v AF{277>>$**Q-#@ DE"#TZZ] ;= w'' [ , 4 5 >G"7++ s (R :A R8 ,R58 SSc i | _ | j d | j d fD ] } t j j | }t j d }|D ]x }|j | st j d|j }|d j j d | j |d j < z |j g d }d D ]^ }d |z | j vrt d |z }t | | j d |z } | |vsDt d | |dz }t | y# t $ r t d |z }t | w xY w)z#Get all settings from defaults filer r z Couldn't open '%s' for readingz ^\w+="?\w+"?= "'r )rU droprW )inputoutputrY zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')r` chainN)r r" r r/ open_file_readr~ r3 r rp rq rs splitstriplowerclose) r5 rk origr: r linetmppoliciescr9 s r; r' zUFWBackend._get_defaults sa **Z($**V*<=A (xx..q1 **_-C ::d# ((4 6C47FLLN4H4H4ODMM#a&,,.1 JJL > 01A"a( = 5 ;< w'' 1Q 78A I()A 6 8 9 w'' 2 ( <=C w'' (s E#E8c L t j d| st d }t | t j |t j st d|z }t | t j j | }|d }d}t j d|z dz }|d D ]_ } |j | r,t j j ||dz |z d z d }@t j j || a |s)t j j ||dz |z d z t j j | |j j! d | j" |j < y # t $ r w xY w) z Sets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writabler F^r r Tr N)rp matchr3 r r accessW_OKr r/ open_filesrq rs write_to_file close_filesr~ r r r ) r5 fnoptvaluer: fnsfdfoundr r s r; set_defaultzUFWBackend.set_default: s\ xx S)()G7# # yyRWW%."56G7# #hh!!"% Zjjc)*KDzz$ &&r39u+<t+CD &&r40 HH " "2sSy5'84'? @ HH % &+[[]%8%8%? ciik" s > F F#c | j s|dk( r!| j | j d dd n|dk( r!| j | j d dd ne|dk( r!| j | j d dd n?|d k( r!| j | j d dd nt d |z }t | t d |z }|S ) z+Sets default application policy of firewallrV r DEFAULT_APPLICATION_POLICYz"ACCEPT"rX z"DROP"rW z"REJECT"skipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')r r r" r3 r )r5 r` r: ra s r; set_default_application_policyz)UFWBackend.set_default_application_policy^ s {{ J!7(D(46 6! J!7(D(24 8# J!7(D(46 6! J!7(D(24 56&A w''=>&I rM c N g }t | j j }|j |v r=|j |v r.t j j | j |j }t j j | j |j }|D ] }|j }d|_ |j dd t j j | \ }} |j | |j |d |j |_ |j |j k( rpd|_ t j j | \ }} |j | |j |d |j |_ |j | |D ] } |j } d| _ t j j | \ }} | j | | j |d | j dk( r| j |j |j | _ |j | n|j |v rt j j | j |j D ] } |j } d| _ t j j | \ }} | j | | j |d |j | _ |j | n|j |v rt j j | j |j D ] } |j } d| _ t j j | \ }} | j | | j |d |j | _ |j | t# | dk rt% d } t' | |S )z4Return a list of UFWRules based on the template rulerT anysrcdstr z&No rules found for application profile)ru r+ keysdportsportr r) get_portsdup_ruledappset_portr/ parse_port_proto set_protocolsapprt protocollenr3 r )r5 templater profile_namesdportssportsir portprotojruler9 r: s r; get_app_rules_from_templatez&UFWBackend.get_app_rules_from_templatey s' T]] / / 12 >>] *x~~ /N%%// hnn0MNF%%// hnn0MNF '') UE* # 9 9! < u ' T5)#==>>X^^3 "CH$'HH$=$=a$@MT5$$U+LLu- '}}CHLL% # "||~$& (+(A(A!(D u ))%0 dE2 ==E1 - -cll ;$,MM T* $+ B ^^} ,%%// hnn0MN ((* # 9 9! < u!!%( dE* $MM T" O ^^} ,%%// hnn0MN ((* # 9 9! < u!!%( dE* $MM T" O u:>@AG7# # rM c g }g }d}d}d}| j | j z D ]; }|j |k( s|j |k( r|j }||k( r8|j } | j d | j dk7 r | j | j d | j dk7 r | j | j d | j | } | D ]A } | j | j r|j | 1|j | C |}d} |j r|j | +|j | > |rF|| _ || _ |t d |z z } | j d | j d ||fS ||fS # t $ r t d } t | w xY w) zUpdate rule for profile in place. Returns result string and bool on whether or not the profile is used in the current ruleset. rT Fr r r Tz Rules updated for profile '%s'z!Couldn't update application rules)r r r r get_app_tupler r r r normalizev6rt r3 _write_rulesr~ r ) r5 r updated_rulesupdated_rules6 last_tuplera updated_profilertuplr new_app_rulesnew_rr: s r; update_app_rulezUFWBackend.update_app_rule s dkk)Avv AFFg$5 (:% !zz|H ))%0 }}* ))(--? }}* ))(--?$($D$D*2%4M "/ ) 88 * 1 1% 8 ) 0 0 7 "/ "&J&*O44"))!,!((+E *H &DJ(DK A677C CD (!!%(!!$' o&&o&& ( ?@ w'' (s "F/ / Gc l || j v r|S d}d}t | j j D ]+ }|j |j k( s%|}|dz }- d||fz }t | |dk( r|S |dkD rt d |z }t | t d |z }t | )z2Find the application profile name for profile_namerT r r z'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s')r+ ru r r r r3 r )r5 profile_namer matchesn debug_msgr: s r; find_application_namez UFWBackend.find_application_name s 4== ( dmm((*+AwwyL . . 001 , ,w .EE i a<L q[XY%'G w @A%'Gw rM c |r"|t | j kD r t |s"|t | j kD r t |dk r t g }|r | j }n | j }i }d}t | D ]L \ }}||k\ r nBd}|j dk7 s|j dk7 s.|j }||v r|dz }Hd||< N g }|rA| j }| j |dz |z j } | j d n@| j }| j |dz |z j } | j d d} |D ]$ }t j || dk( r| c S | dz } & y)a. Return the absolute position in the other list of the rule with the user position of the given list. For example, find_other_position(4, True) will return the absolute position of the rule in the ipv4 list matching the user specified '4' rule in the ipv6 list. r r rT TF) r r ValueErrorr enumerater r r r set_v6r r ) r5 positionr r app_rules tuple_offsetr r r match_rulecounts r; find_other_positionz UFWBackend.find_other_position s{ (S -- , hTZZ 0 , a< , KKEJJE e$DAqH}Dvv|qvv|(9$ A%L&*IdO % JJE X\L%@AJJLJ e $KKE HqL<$?@IIKJ d #A}}Q +q0 QJE rM c J d}t d }d| j vs2| j d t | j j vrd}|t d z }||fS | j | j d }|dk( r |dz }||fS |d| j d z z }||fS )z"Gets current log level of firewallr z Logging: loglevelunknownr zon (%s))r3 r ru r$ r )r5 levelra s r; get_loglevelzUFWBackend.get_loglevelO s ~ T]] * == $D 1D1D1F,G GE AiL D t} NN4==#<=Ez t} T]]:%>??t} rM c |t | j j dgz vrt d |z }t | |}|dk( r2d| j vs| j d dk( rd}n| j d }| j | j d d| | j | |dk( r t d S t d S ) zSets log level of firewallonzInvalid log level '%s'r r r r LOGLEVELzLogging disabledzLogging enabled) ru r$ r r3 r r r r" update_logging)r5 r r: new_levels r; set_loglevelzUFWBackend.set_loglevel_ s T^^ 0 0 23tf< <01U;G7# # D= .}}Z(E1 ! MM* 5 F+ZC I& '( (&' 'rM c D | j | j z S )zReturn list of all rules)get_rules_ipv4get_rules_ipv6rL s r; get_ruleszUFWBackend.get_rulesu s ""$t':':'<<<rM c | j S )zReturn list of IPv4 rules)r rL s r; r zUFWBackend.get_rules_ipv4y s zzrM c | j S )zReturn list of IPv6 rules)r rL s r; r zUFWBackend.get_rules_ipv6} s {{rM c g }|r | j }n | j }d}i }|D ]O }d}|j dk7 s|j dk7 r(|j }||v rt d|z Fd||< |dz }Q |S )z/Return number of ufw rules (not iptables rules)r rT Skipping found tuple '%s'Tr )r r r r r r )r5 r r r r r r s r; get_rules_countzUFWBackend.get_rules_count s KKEJJE ADvv|qvv|(9$5>? &*IdO QJE rM c | j }d}i }|D ]a }d}|j dk7 s|j dk7 r(|j }||v rt d|z Fd||< |t | k( r|c S |dz }c y)z:Return rule specified by number seen via "status numbered"r rT r TN)r r r r r int)r5 numr r r r r s r; get_rule_by_numberz UFWBackend.get_rule_by_number s ADvv|qvv|(9$5>? &*IdOC QJE rM c g }d}| j D ]/ }|dz }|j | }|dk s |j | 1 |S )zmSee if there is a matching rule in the existing ruleset. Note this does not group rules by tuples.r r )r fuzzy_dst_matchrt )r5 r matchedr r rets r; get_matchingzUFWBackend.get_matching sR !A QJE&&q)CQwu% " rM c t d )z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to overrider )r5 r` directions r; set_default_policyz UFWBackend.set_default_policy s HIIrM c t d )z Get status of running firewallz,UFWBackend.get_running_raw: need to overrider )r5 rules_types r; get_running_rawzUFWBackend.get_running_raw s EFFrM c t d )zGet managed rulesz'UFWBackend.get_status: need to overrider )r5 verbose show_counts r; get_statuszUFWBackend.get_status s @AArM c t d )zUpdate firewall with rulez%UFWBackend.set_rule: need to overrider )r5 r allow_reloads r; set_rulezUFWBackend.set_rule s >??rM c t d )zStart the firewallz+UFWBackend.start_firewall: need to overrider rL s r; start_firewallzUFWBackend.start_firewall DEErM c t d )zStop the firewallz*UFWBackend.stop_firewall: need to overrider rL s r; stop_firewallzUFWBackend.stop_firewall s CDDrM c t d )z%Get a list if rules based on templatez6UFWBackend.get_app_rules_from_system: need to overrider )r5 r r s r; get_app_rules_from_systemz$UFWBackend.get_app_rules_from_system s " # #rM c t d )z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrider )r5 r s r; r zUFWBackend.update_logging r" rM c t d )zReset the firewallz"UFWBackend.reset: need to overrider rL s r; resetzUFWBackend.reset s ;<<rM )NNN)r F)"__name__ __module__ __qualname____doc__r< rH rC rD rd r& r' r r r r r r r r r r r r r r r r r r r! r$ r& r r) rM r; r r s 15'+*X*4X#Ln(`(:"@H6BH<'| 0:x (,=0, JGB@FE# F=rM r )r- r r r rp r| rx ufw.utilr r r r r ufw.commonr r ufw.applicationsr r. rM r; <module>r2 s7 ," 2 2 ( B = B =rM