⚝
One Hat Cyber Team
⚝
Your IP:
216.73.217.4
Server IP:
41.128.143.86
Server:
Linux host.raqmix.cloud 6.8.0-1025-azure #30~22.04.1-Ubuntu SMP Wed Mar 12 15:28:20 UTC 2025 x86_64
Server Software:
Apache
PHP Version:
8.3.23
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
ufw
/
__pycache__
/
View File Name :
backend.cpython-310.pyc
o Fa7j @ s~ d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z m Z ddl mZmZ ddlZG dd dZdS )z&backend.py: interface for ufw backends N)errorwarndebug _findpath)UFWErrorUFWRulec @ s e Zd ZdZ d=ddZdd Zdd Zd d Zd>d dZdd Z dd Z dd Z dd Z dd Z dd Zdd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, Zd-d. Zd/d0 Zd1d2 Zd3d4 Zd5d6 Z d7d8 Z d9d: Z d;d< Z dS )? UFWBackendzInterface for backendsNc C sB d | _ || _|| _g | _g | _ttjj|}t j |dt j |dt j |dd| _ |d ur6| j | ddddd d | _tjj| _| | | tj| j d | _t j tjjd | _t j tjjd | _t j tjjd| _t j tjjd| _z tj | j| _ W n t y t d}t |w d | _!d S )Nz default/ufwz ufw/ufw.confzufw/applications.d)defaultsconfappsr d i, i )offlowmediumhighfullr iptablesziptables-restore ip6tableszip6tables-restorez#Couldn't determine iptables version)"r namedryrunrulesrules6r ufwcommon config_dirospathjoinfilesupdate loglevels do_checks _do_checks _get_defaults _read_rules applications get_profilesprofiles iptables_dirr iptables_restorer ip6tables_restoreutilget_iptables_versioniptables_versionOSError_r caps)selfr r extra_filesrootdirdatadirperr_msg r8 -/usr/lib/python3/dist-packages/ufw/backend.py__init__ sL zUFWBackend.__init__c C sj | j durdS i | _ i | j d< d| j d d< d| j d d< | jrt dkr| jsz tj| j}W n# t yU } zd| }| rFt | t | W Y d}~dS d}~ww d |v rfd |v rfd| j d d< nd| j d d< | rz tj| j}W n t y } z t d| W Y d}~nd}~ww d |v rd |v rd| j d d< dS d| j d d< dS dS dS dS dS ) zgInitialize the capabilities database. This needs to be called before accessing the database.NlimitT4F6r z initcaps %sz recent-setz recent-update)r1 r" r getuidr r r, get_netfilter_capabilitiesr r/ is_enabledr r use_ipv6r )r2 nf_capsemsgr8 r8 r9 initcapsL s@ zUFWBackend.initcapsc C s d| j v r| j d dkrdS dS )z!Is firewall configured as enabledenabledyesTF)r r2 r8 r8 r9 r@ x s zUFWBackend.is_enabledc C s, d| j v r| j d dkrtjdrdS dS )z"Is firewall configured to use IPv6ipv6rG z/proc/sys/net/ipv6TF)r r r existsrH r8 r8 r9 rA s zUFWBackend.use_ipv6inputFc C s d| d }d}| j | dkrd}n | j | dkr d}nd}|rr|dkrrd }td }tjd d g\}}|d kr<t|d|v rBd}| rntjd dg\}}|d krZd|v rZd}tjd dg\}}|d krnd|v rnd}|srd}|S )z.Get default policy for specified primary chaindefault__policy acceptallowrejectdenyforwardFzproblem running sysctlsysctlznet.ipv4.ip_forwardr 1Tz net.ipv6.conf.default.forwardingz net.ipv6.conf.all.forwardingdisabled)r r0 r r, cmdr rA ) r2 primary check_forwardpolicyrstrrF r7 rcoutr8 r8 r9 _get_default_policy s2 z UFWBackend._get_default_policyc C sL | j s td}t| dS t t kr td}t|t t kr-td}t|t }|dkr=td}t|i }i }i }g }tj | j d s\td| j d }t| n"t d }t| j d D ]} || s}|tj | j d | qit| j tj tjd g | D ]} | d sd t | f } td | | | j d krtj | j d snz t| } | tj } W n t y td | }t| t y w d} d}d}zt | j d | kst | j d |krd}W n t!y Y nw | j dkr+|s+| |vr+tdt"|| t"| j d }t| d|| < | tj#@ rD| |vrDtd| }t| d|| < | tj$@ rc| |vrc| j%dkrctd| }t| d|| < | d krin| }tj &| } | s|t t'j(d| qq| j D ]"}|dkrtj )| j | std|| j | d }t|qdS )a8 Perform basic security checks: is setuid or setgid (for non-Linux systems) checks that script is owned by root checks that every component in absolute path are owned by root warn if script is group writable warn if part of script path is group writable Doing this at the beginning causes a race condition with later operations that don't do these checks. However, if the user running this script is root, then need to be root to exploit the race condition (and you are hosed anyway...) zChecks disabledTz%ERROR: this script should not be SUIDz%ERROR: this script should not be SGIDr z&You need to be root to run this scriptr z'%s' does not existz^\./z%s/%sz Checking zCouldn't stat '%s'clickpkg snappypkgFz4uid is %(uid)s but '%(path)s' is owned by %(st_uid)s)uidr st_uidz%s is world writable!z%s is group writable!z Could not find parent for '%s'z&'%(f)s' file '%(name)s' does not exist)fr N)*r" r0 r r r> geteuidr getgidgetegidr isdirr recompilelistdirsearchappendr listvaluesabspathsysargv startswithgetcwdr statST_MODEr/ Exceptionpwdgetpwuidrc KeyErrorstrS_IWOTHS_IWGRPst_giddirnameerrnoENOENTisfile)r2 r7 rb warned_world_writewarned_group_write warned_ownerr( warn_msgpatprofiler statinfomode click_user snap_useris_unpack_user last_pathrd r8 r8 r9 r# s 6 zUFWBackend._do_checksc C s i | _ | jd | jd fD ]G}ztj|}W n ty( td| }t|w t d}|D ] }| |rOt d| }|d d| j |d < q0| q g d }d D ]+}d | | j vrntd | }t|| j d | } | |vrtd | |d }t|q[dS )z#Get all settings from defaults filer r z Couldn't open '%s' for readingz ^\w+="?\w+"?= "'r )rO droprQ )rK outputrS zdefault_%s_policyzMissing policy for '%s'z+Invalid policy '%(policy)s' for '%(chain)s')rZ chainN)r r r r, open_file_readrw r0 r ri rj rl splitstriplowerclose) r2 rd origr7 r linetmppoliciescr6 r8 r8 r9 r$ s8 zUFWBackend._get_defaultsc C s t d|std}t|t|tjs td| }t|tj |}|d }d}t d| d }|d D ] } | | rOtj ||d | d d }q8tj || q8|sftj ||d | d ztj | W n tyv w | d | j| < d S ) z Sets option in defaults filez^[\w_]+$zInvalid optionz'%s' is not writabler F^r r Tr N)ri matchr0 r r accessW_OKr r, open_filesrj rl write_to_file close_filesrw r r r ) r2 fnoptvaluer7 fnsfdfoundr r r8 r8 r9 set_default: s. zUFWBackend.set_defaultc C s | j sI|dkr| | jd dd n7|dkr!| | jd dd n(|dkr0| | jd dd n|d kr?| | jd dd n td | }t|td | }|S ) z+Sets default application policy of firewallrP r DEFAULT_APPLICATION_POLICYz"ACCEPT"rR z"DROP"rQ z"REJECT"skipz"SKIP"zUnsupported policy '%s'z*Default application policy changed to '%s')r r r r0 r )r2 rZ r7 r[ r8 r8 r9 set_default_application_policy^ s2 z)UFWBackend.set_default_application_policyc C sN g }t | j }|j|v r|j|v rtj| j|j }tj| j|j }|D ]}| }d|_ | dd tj |\}} | | | |d |j |_ |j|jkrud|_tj |\}} | | | |d |j|_|| q)|D ]0} | } d| _tj | \}} | | | |d | jdkr| |j |j| _|| qwq)nl|j|v rtj| j|j D ]%} | } d| _tj | \}} | | | |d |j| _|| qn6|j|v rtj| j|j D ]%} | } d| _ tj | \}} | | | |d |j | _ || qt|dk r%td} t| |S )z4Return a list of UFWRules based on the template rulerN anysrcdstr z&No rules found for application profile)rn r( keysdportsportr r& get_portsdup_ruledappset_portr, parse_port_proto set_protocolsapprm protocollenr0 r )r2 templater profile_namesdportssportsir portprotojruler6 r7 r8 r8 r9 get_app_rules_from_templatey sn ! z&UFWBackend.get_app_rules_from_templatec C sR g }g }d}d}d}| j | j D ]e}|j|ks |j|krg| }||kr%q| } | d | jdkr:| | jd | jdkrF| | jd | | } | D ]} | | j r\| | qM| | qM|}d}q|j rp| | q| | q|r|| _ || _|t d| 7 }z| d | d W ||fS ty t d} t| w ||fS ) zUpdate rule for profile in place. Returns result string and bool on whether or not the profile is used in the current ruleset. rN Fr r r Tz Rules updated for profile '%s'z!Couldn't update application rules)r r r r get_app_tupler r r r normalizev6rm r0 _write_rulesrw r ) r2 r updated_rulesupdated_rules6 last_tupler[ updated_profilertuplr new_app_rulesnew_rr7 r8 r8 r9 update_app_rule sT zUFWBackend.update_app_rulec C s || j v r|S d}d}t| j D ]}| | kr"|}|d7 }qd||f }t| |dkr3|S |dkrAtd| }t|td| }t|)z2Find the application profile name for profile_namerN r r z'%d' matches for '%s'z>Found multiple matches for '%s'. Please use exact profile namez&Could not find a profile matching '%s')r( rn r r r r0 r )r2 profile_namer matchesn debug_msgr7 r8 r8 r9 find_application_name s, z UFWBackend.find_application_namec C s< |r |t | jkr t |s|t | jkrt |dk r t g }|r'| j}n| j}i }d}t|D ]'\}}||kr< n d}|jdksH|jdkrY| }||v rU|d7 }q2d||< q2g }|rr| j}| j|d | } | d n| j}| j|d | } | d d} |D ]}t || dkr| S | d7 } qdS )a. Return the absolute position in the other list of the rule with the user position of the given list. For example, find_other_position(4, True) will return the absolute position of the rule in the ipv4 list matching the user specified '4' rule in the ipv6 list. r r rN TF) r r ValueErrorr enumerater r r r set_v6r r ) r2 positionr r app_rules tuple_offsetr r r match_rulecountr8 r8 r9 find_other_position sH z UFWBackend.find_other_positionc C s d}t d}d| jvs| jd t| j vr#d}|t d7 }||fS | j| jd }|dkr7|d7 }||fS |d| jd 7 }||fS )z"Gets current log level of firewallr z Logging: loglevelunknownr zon (%s))r0 r rn r! r )r2 levelr[ r8 r8 r9 get_loglevelO s zUFWBackend.get_loglevelc C s |t | j dg vrtd| }t||}|dkr0d| jvs(| jd dkr+d}n| jd }| | jd d| | | |dkrGtdS td S ) zSets log level of firewallonzInvalid log level '%s'r r r r LOGLEVELzLogging disabledzLogging enabled) rn r! r r0 r r r r update_logging)r2 r r7 new_levelr8 r8 r9 set_loglevel_ s zUFWBackend.set_loglevelc C s | j | j S )zReturn list of all rules)r r rH r8 r8 r9 get_rulesu s zUFWBackend.get_rulesc C sr g }|r| j }n| j}d}i }|D ]%}d}|jdks |jdkr2| }||v r.td| qd||< |d7 }q|S )z/Return number of ufw rules (not iptables rules)r rN Skipping found tuple '%s'Tr )r r r r r r )r2 r r r r r r r8 r8 r9 get_rules_county s zUFWBackend.get_rules_countc C sx | }d}i }|D ]/}d}|jdks|jdkr+| }||v r'td| q d||< |t|kr5| S |d7 }q dS )z:Return rule specified by number seen via "status numbered"r rN r TN)r r r r r int)r2 numr r r r r r8 r8 r9 get_rule_by_number s z UFWBackend.get_rule_by_numberc C s> g }d}| D ]}|d7 }||}|dk r || q|S )zmSee if there is a matching rule in the existing ruleset. Note this does not group rules by tuples.r r )r fuzzy_dst_matchrm )r2 r matchedr r retr8 r8 r9 get_matching s zUFWBackend.get_matchingc C t d)z*Set default policy for specified directionz/UFWBackend.set_default_policy: need to overrider )r2 rZ directionr8 r8 r9 set_default_policy z UFWBackend.set_default_policyc C r )z Get status of running firewallz,UFWBackend.get_running_raw: need to overrider )r2 rules_typer8 r8 r9 get_running_raw r zUFWBackend.get_running_rawc C r )zGet managed rulesz'UFWBackend.get_status: need to overrider )r2 verbose show_countr8 r8 r9 get_status r zUFWBackend.get_statusc C r )zUpdate firewall with rulez%UFWBackend.set_rule: need to overrider )r2 r allow_reloadr8 r8 r9 set_rule r zUFWBackend.set_rulec C r )zStart the firewallz+UFWBackend.start_firewall: need to overrider rH r8 r8 r9 start_firewall r zUFWBackend.start_firewallc C r )zStop the firewallz*UFWBackend.stop_firewall: need to overrider rH r8 r8 r9 stop_firewall r zUFWBackend.stop_firewallc C r )z%Get a list if rules based on templatez6UFWBackend.get_app_rules_from_system: need to overrider )r2 r r r8 r8 r9 get_app_rules_from_system r z$UFWBackend.get_app_rules_from_systemc C r )z#Update loglevel of running firewallz+UFWBackend.update_logging: need to overrider )r2 r r8 r8 r9 r r zUFWBackend.update_loggingc C r )zReset the firewallz"UFWBackend.reset: need to overrider rH r8 r8 r9 reset r zUFWBackend.reset)NNN)rK F) __name__ __module__ __qualname____doc__r: rE r@ rA r^ r# r$ r r r r r r r r r r r r r r r r r r r r r r8 r8 r8 r9 r s@ ,, &p $D>< r )r r r rx ri ru rq ufw.utilr r r r r ufw.commonr r ufw.applicationsr r8 r8 r8 r9 <module> s