Your IP : 172.28.240.42
^Oc @ s d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m Z m
Z
m Z d d l m
Z
m Z m Z m Z m Z d d l Z d e j j f d YZ d S( s- backend_iptables.py: iptables backend for ufwiN( t UFWErrort UFWRulet
config_dirt state_dir( t warnt debugt msgt cmdt cmd_pipet UFWBackendIptablesc B s e Z d Z d Z d Z d Z d Z e e d Z d Z d Z
d Z d Z d
Z
d Z d Z e d
Z e d Z d Z e d Z d Z d Z d Z RS( s Instance class for UFWBackendc C s d t j j d | _ i } t j j t d | d <t j j t d | d <t j j t d | d <t j j t d | d
<t j j t d | d <t j j t d
| d <t j j t d | d <t j j
j | d | | i g d 6g d 6g d 6g d 6| _ x d d g D] } d } | d k r`| j
rK| | 7} q`| d k r`qq`n xX d d d g D]G } x> d d d g D]- } d | | | f } | j | j | qWqpW| j d j | d | j d j | d qWd d d! d" d# d$ d% d& g | _ d' | _ d( S() s! UFWBackendIptables initializations # s
_comment #s
user.rulest ruless ufw/before.rulest before_ruless ufw/after.rulest after_ruless user6.rulest rules6s ufw/before6.rulest
before6_ruless ufw/after6.rulest after6_ruless ufw-initt initt iptablest beforet usert aftert misct 4t 6t ufwt inputt outputt forwards %s-%s-logging-%ss
-logging-denys -logging-allows ufw-user-limits -mt limits --limits 3/minutes -jt LOGs --log-prefixs [UFW LIMIT BLOCK]N( R t commont programNamet comment_strt ost patht joinR R t backendt
UFWBackendt __init__t chainst use_ipv6t appendt ufw_user_limit_logt ufw_user_limit_log_text( t selft dryrunt filest vert chain_prefixt loct targett chain( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR& s8 %
c C sz t d } | j d d k r, | d 7} nJ | j d d k rL | d 7} n* | j d d k rl | d 7} n
| d 7} | S(
s Get current policys
New profiles:t default_application_policyt accepts allowt drops denyt rejects rejects skip( t _t defaults( R, t rstr( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt get_default_application_policyE s
c
C s | j s| d k rL | d k rL | d k rL t d | } t | n | d k r | d k r t d | } t | n d } | d k r d } n d
} d
} | d k r y" | j | j d d | d
Wn t k
r n Xd } d } n | d k rRy" | j | j d d | d Wn t k
rB n Xd } d } nE y" | j | j d d | d Wn t k
r n Xd } d } t j d
| } x | j d | j d g D] } y t j j
| } Wn t k
r n X| d }
xV | d D]J } | j | rDt j j |
| j
| | q
t j j |
| q
Wy t j j | Wqt k
r qXqWn t d i | d 6| d 6} | t d 7} | S( s Sets default policy of firewallt allowt denyR7 s Unsupported policy '%s't incomingt outgoings% Unsupported policy for direction '%s't INPUTt OUTPUTt R9 s DEFAULT_%s_POLICYs "ACCEPT"s UFW BLOCKs UFW ALLOWs "REJECT"s "DROP"R R t tmpt origs5 Default %(direction)s policy changed to '%(policy)s'
t directiont policys* (be sure to update your rules accordingly)( R- R8 R t set_defaultR. t Exceptiont ret compileR t utilt
open_filest searcht
write_to_filet subt close_files(
R, RF RE t err_msgR3 t old_log_strt new_log_strt patt ft fnst fdt lineR: ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt set_default_policyS st $
!
"
c C s | j r1 d t d } | d t d 7} | Sd d d d g } g } g } | d k r | j d d
d d d g } d
d d g } n| d
k r}x9 d d d g D]( } | j d | | j d | q Wx? d d d d d g D]( } | j d | | j d | q Wx6 d d g D]( } | j d | | j d | q#Wxd d d g D] } | j d | q_Wn| d k rxd d d g D]( } | j d | | j d | qWns| d k r-x9 d d d g D]( } | j d | | j d | qW| j d | j d! n| d" k rxx d d d g D]( } | j d# | | j d$ | qIWn | d% k r;x} d d d g D]l } | j d& | | j d' | | j d( | | j d) | | j d* | | j d+ | qW| j d, | j d- | j d. | j d/ n d0 | } x | D] } d1 | k r| j d1 \ } } | d2 | 7} t | j g | | d | g \ }
} n# t | j g | | g \ }
} | | 7} | d k r| d3 7} n |
d4 k rLt | qLqLW| d k s*| j r| d5 7} x | D] } d1 | k r| j d1 \ } } | d2 | 7} t | j g | | d | g \ }
} n# t | j g | | g \ }
} | | 7} | d k r| d3 7} n |
d4 k r;t | q;q;Wn | S(6 s' Show current running status of firewalls > s Checking raw iptables
s Checking raw ip6tables
s -ns -vs -xs -Lt raws -tt filtert natt manglet builtinsR@ t FORWARDRA s filter:%st
PREROUTINGt POSTROUTINGs mangle:%ss raw:%ss nat:%sR R R R s
ufw-before-%ss ufw6-before-%sR s ufw-user-%ss ufw6-user-%ss ufw-user-limit-accepts ufw-user-limitR s ufw-after-%ss
ufw6-after-%st loggings ufw-before-logging-%ss ufw6-before-logging-%ss ufw-user-logging-%ss ufw6-user-logging-%ss ufw-after-logging-%ss ufw6-after-logging-%ss ufw-logging-allows ufw-logging-denys ufw6-logging-allows ufw6-logging-denys IPV4 (%s):
t :s (%s) s
i s
IPV6:
( R- R8 R) t splitR R R R( t ip6tables( R, t
rules_typet outt argst itemst items6t ct bt it tt rcRC ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt get_running_raw s
,#
,#
c ! C s d } | j rF d t d } | j rB | d t d 7} n | St d } x d d g D] } t | j d d | d
g \ } } | d k r t d S| d
k r t | d | n | j r_ t | j d d | d
g \ } } | d
k rt | d qq_ q_ Wd } d } | j | j }
d } i } x|
D]}
d } i } d } t } | r|
j
d k s|
j d k rt } |
j
} | j | rt d | qIqt | | <n xd d g D]} d | | <d } d } | d k r\|
j } | rP|
j
d k rP|
j
} |
j rY| d k rY| d 7} qYq|
j } nV |
j } | r|
j d k r|
j } |
j r| d k r| d 7} qn |
j } | d k r| d k r| | | <n | d k r)| | d k r | | | <n | | c d | 7<| rC|
j d k rC| | c d |
j 7<n | r)| d k r|
j
d k r| | c d |
j
7<|
j r| d k r| | c d 7<n | | c d 7<n | d k r&|
j d k r&| | c d |
j 7<|
j r| d k r| | c d 7<n | | c d 7<q&q)n | d k r| d k sM| d k rd | | <| r|
j d k r|
j |
j k r|
j |
j k r| | c d |
j 7<n | d k r
| | c d 7<q
q| r|
j d k r|
j |
j k r| | c d |
j 7<qn | d k rE|
j d k rE| | c d |
j 7<n | d k r|
j d k r| | c d |
j 7<qqWg } d } |
j s|
j j d k r |
j r| j |
j j n | r|
j d k r| j |
j n t | d
k r d d j | } q n | r4| d! | 7} n |
j j } |
j d" k ri| ri| rid } n | d# | d d j |
j j | g | d | f 7} | r| | 7} n& |
j d k r| | 7} n
| | 7} | d 7} qIW| d k s| d k r^d$ } | r| d% 7} n t d& } t d' } t d( } d) | j d* d+ | j d* d+ | j d* d+ f } | r| d% 7} n | d) d, t | j d* d+ d, t | j d* d+ d, t | j d* d+ f 7} | | j! d* d+ 7} | d k r| | 7} n | d k r<| d k r<| t d- 7} n | d k rU| | 7} n | } n | r| j" \ } } t d. i | j# d" 6| j# d d 6} | j$ } t d/ i | d0 6| d1 6| d2 6| d3 6St d4 | Sd5 S(6 s Show ufw managed rulesRB s > s Checking iptables
s Checking ip6tables
s problem runningR R s -Ls ufw-user-%ss -ni s Status: inactivei s iptables: %s
s ufw6-user-%ss
ip6tabless Skipping found tuple '%s't dstt srcs ::/0s (v6)s 0.0.0.0/0t anyt t /s (%st )t Anywheres on %sRg s (%s)s , s [%2d] t ins %-26s %-12s%s%s
s
s t Tot Fromt Actions %-26s %-12s%s
s utf-8t ignoret -s
s. Default: %(in)s (incoming), %(out)s (outgoing)s0 Status: active
%(log)s
%(pol)s
%(app)s%(status)st logt polt appt statuss Status: active%sN(% R- R8 R( R R R Re R
R
t Truet dappt sappt Falset
get_app_tuplet has_keyR Rq t v6t dportRr t sportt protocolt interface_int
interface_outt logtypeRE t lowerR) t lenR# t uppert actiont decodet encodet get_loglevelt _get_default_policyR; (! R, t verboset
show_countRg RQ RE Ro t out6t st str_outR
t countt app_rulest rt tmp_strt locationt tuplt
show_protoR1 t portRC t attribst
attrib_strt dir_strt full_strt str_tot str_fromt
str_actiont rules_headert levelt logging_strt
policy_strt app_policy_str( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt
get_status s$
%
$
!
c C sx t d } | j r, t d t d nH t | j d d g \ } } | d k rt t | t | d n d S( s Stop the firewalls problem runnings > s running ufw-initR s
force-stopi s ufw-initN( R8 R- R R R. R R ( R, RQ Ro Rg ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt
stop_firewall s
c C s+ t d } | j r, t d t d n t | j d d g \ } } | d k rt t | t | d n | j j d s | j d | j j
k r y | j d Wq't k
r t d
} t | q'XnD y | j
| j d Wn) t k
r&t d } t | n Xd S(
s Start the firewalls problem runnings > s running ufw-initR t starti s ufw-initt loglevelt lows Could not set LOGLEVELs Could not load logging rulesN( R8 R- R R R. R R R9 R t loglevelst keyst set_loglevelRH t update_logging( R, RQ Ro Rg ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt start_firewall s&
c C s | j r
t Sd } | j } | r4 d } | j } n x d d d d d g D]j } | rt | d k sJ | d k rt qJ n t | d d | d
| g \ } } | d k rJ t d t SqJ Wt S(
s Check if all chains existR t ufw6R R R R s limit-accepts -ns -Ls -user-i s _need_reload: forcing reload( R- R R Re R R R ( R, R t prefixt exeR3 Ro Rg ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt _need_reload s &
c C sY t d } | j r; t d | j rUt d qUn| j rUyH xA | j d D]2 } | j | d | g | j | d | g qX WWn t k
r t | n Xt d | j
d g | j d g \ } } | d
k r t | d n | j rUt d | j
d g | j d g \ } } | d
k rRt | d
qRqUn d S( s Reload firewall rules files problem runnings > | iptables-restores > | ip6tables-restoreR s -Fs -Zt catR
s -ni s iptablesR
s
ip6tablesN(
R8 R- R R( t
is_enabledR' t
_chain_cmdRH R R R. t iptables_restoret ip6tables_restore( R, RQ Rk Ro Rg ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt _reload_user_rules s*
c C s, g } t j d } t j d } t j d } | j | r | j | r | j | r | j | j d | j d | n | j | j d | | j | j d | q | j | j d | n
| j | t j d } t j d } t j d
}
d } xVt | D]H\ } }
| j |
r&| j d |
j } | j d
k rtd } n! | j d k rd } n d } d | | f } | j |
sd | } n | j d |
| | <| j | | j d | d | |
| j | |
j d | d | | j d |
| j | |
j d | d | | j d | |
q&q&Wt j d } x t | D] \ } }
| j |
r| j d |
} | j d d d | d |
} | j d | d |
} | | | <| j | | | j | | qqW| S(! s5 Return list of iptables rules appropriate for sendings -p all s port s -j (REJECT(_log(-all)?)?)s -p tcp s -j \1 --reject-with tcp-resets -p udp RB s (.*)-j ([A-Z]+)_log(-all)?(.*)s -j [A-Z]+_log-alls (-A|-D) ([a-zA-Z0-9\-]+)s' -m limit --limit 3/min --limit-burst 10s \2R5 t ALLOWR t LIMITt BLOCKs" %s -j LOG --log-prefix "[UFW %s] "s -m state --state NEW s \1-j \2\4s \1-j s -user-logging-s \1 s \1-j RETURNs \1s -j LIMITs% -m state --state NEW -m recent --sets -m state --state NEW -m recents# --update --seconds 30 --hitcount 6s -j s -user-limits -user-limit-accept( RI RJ RM R) RO t enumeratet stripR t insert( R, t fruleR t suffixt snippetst pat_protot pat_portt
pat_rejectt pat_logt
pat_logallt pat_chaint
limit_argsRm R RF t lstrt pat_limitt tmp1t tmp2t tmp3( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt _get_rules_from_formatted sh
!
c C s g } | j | | | } t j d } x t | D] \ } } | j | j d | j | j | r7 | | j d | | j | j d | j d d | | c | j d | j 7<q7 q7 W| S( s_ Return list of iptables rules appropriate for sending as arguments
to cmd()
s (.*) --log-prefix (".* ")(.*)s \1s --log-prefixs \2t "RB s \3( R RI RJ R R) RO Rd t matcht replace( R, R R R R t str_snippetsRT Rm R ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt _get_lists_from_formattedF s ))c C s- | j d g } | j r3 | j | j d n x| D]} y t j j | } Wn- t k
r t d | } t | n Xt j
d } x| D]{} | j | r | j d | } t j
d | j } t | d k s t | d k r t d | } t | q qd
}
d } t | d k sOt | d k rd | d
k r{| d
j
d \ }
} q| d
}
n y t | d k rt | d | d | d | d | d | d |
} n t | d | d | d | d | d | d |
} t j
d }
| d d k rG|
j d | d | _ n | d d k rs|
j d | d | _ n | d k r| j |
| n Wn. t k
rt d | } t | q n X| | j d k r| j t | j j | q| j t | j j | q q W| j q: Wd S( s$ Read in rules that were added by ufwR
R
s Couldn't open '%s' for readings ^### tuple ###\s*RB s \s+i i s) Skipping malformed tuple (bad length): %sRx i R8 ii i i i i i i s %20R} Rt s Skipping malformed tuple: %sN( R. R( R) R RK t open_file_readRH R8 R RI RJ R RO Rd R R R R R R t
set_interfacet set_v6R R
R R
t close( R, t rfnsRU RD RQ t pat_tupleRX R RC t wmsgt dtypet interfacet rulet pat_spacet warn_msg( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt _read_rulesX sb
$
$
c C s | j d } | r# | j d } n t j | t j sW t d | } t | n y t j j | } Wn t k
r n Xd } | j
} | r d } | j } n | j r t
j j } n
| d } t j j | d t j j | d | d t j j | d | d
t j j | d | d t j j | d | d t j j | d | d
t j j | d | d t j j | d | d t j j | d | d t j j | d | d t j j | d | d t j j | d | d t j j | d | d t j j | d | d t j j | d | d | d k rt j j | d | d t j j | d | d n t j j | d xQ| D]I} | j } | j d k r| d | j 7} n | j d k r| j d k rd | | j | j | j | j | j | j f }
| j d k r`|
d | j 7}
n | j d k r|
d | j 7}
n t j j | |
d n t j d } d } | j r| j d! | j } n d }
| j r| j d! | j }
n d" | | j | j | j | j | j | |
| j f }
| j d k rT|
d | j 7}
n | j d k rw|
d | j 7}
n t j j | |
d d# } | j d$ k rd% } n d& | | f } d' | | j f } x0 | j! | | | D] } t j j | | qWqWt j j | d( t j j | d) y | j" | j# d* } Wn t k
r_ n Xx | D] \ } } } t$ | d+ k r| d+ d, k rqgn | j% | d rgt j j | d j& | j' d- d. j' d/ d0 d qgqgWt j j | d1 | d k rt j j | d2 | j# d* d3 k rjt j j | d4 d j& | j( d5 | j) d6 n t j j | d4 | d7 t j j | d4 | d8 t j j | d9 n t j j | d: y3 | j rt j j* | t+ n t j j* | Wn t k
r n Xd; S(< s. Write out new rules to file to user chain fileR
R
s '%s' is not writableR R RC s *filter
Rc s -user-input - [0:0]
s -user-output - [0:0]
s -user-forward - [0:0]
s -before-logging-input - [0:0]
s -before-logging-output - [0:0]
s -before-logging-forward - [0:0]
s -user-logging-input - [0:0]
s -user-logging-output - [0:0]
s -user-logging-forward - [0:0]
s -after-logging-input - [0:0]
s -after-logging-output - [0:0]
s -after-logging-forward - [0:0]
s -logging-deny - [0:0]
s -logging-allow - [0:0]
s -user-limit - [0:0]
s -user-limit-accept - [0:0]
s ### RULES ###
RB R8 s#
### tuple ### %s %s %s %s %s %s %ss _%ss
Rt R} s %20s)
### tuple ### %s %s %s %s %s %s %s %s %sR Rg R s
%s-user-%ss -A %s %s
s
### END RULES ###
s
### LOGGING ###
R i s -Dt [s "[s ] s ] "s ### END LOGGING ###
s
### RATE LIMITING ###
t offs -A s "s "
s -user-limit -j REJECT
s -user-limit-accept -j ACCEPT
s ### END RATE LIMITING ###
s COMMIT
N(, R. R! t accesst W_OKR8 R R RK RL RH R
R
R- t syst stdoutt filenoRN R R R R R R Rq R Rr RE R R RI RJ RO t format_ruleR t _get_logging_rulesR9 R t
startswithR# R R* R+ RP R ( R, R t
rules_fileRQ RV R0 R
RW R R t tstrR R R t chain_suffixR3 t rule_strR t lrules_tRk t q( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt _write_rules s
!
!
" $ )
c C s d } | j rY | j s6 t d } t | n | j d k rY t d | j Sn | j r | j d k r | j d k r t d } t | n g } t } t } | j } | j } | j r | j
d k r | j d k s | j d k r t d S| j
} n | d
k s)| t | k rHt d | } t | n | d
k rx| j rxt d } t | n | t | k rt d
| } t | n y | j Wn t k
r n Xd }
t } d
} d/ }
x| D]} y | j Wn t k
r n X| j | j | j | j f } |
| k r|
d d k rn|
d d k rn|
d k s| d d k r| d d k s|
| k rt } | j | j d0 }
q| d 7} n | }
|
d 7}
t j | | } | d k r| d 7} n | d
k rF| rF| rFt } | j s| j | j qq| d
k r| j r| rt } t } | j | j q| j | qW| r| d
k rut d } | j r| d 7} n | Sn | r| j r| j | j n | r8| j r8| j r8t d } | j r4| d 7} n | S| ru| j ru| rut d } | j rq| d 7} n | S| j r| | _
n | | _ y | j | j Wn: t k
r n' t k
rt d } t | n Xt d } | j rt d } n | j r| j rd } | sB| j | j sB| rd } | ra| t d 7} n | t d 7} | j r| d 7} n | ry | j Wqt k
r qXq| t d 7} nQ | r| j rd } t d } n- | r| r| j rd } t d } n | d k r| j } d } | j rY| j } d } | d 7} n d! } | j d" k rwd# } n d$ | | f } t d% } t! | d& | d' g \ } } | d
k rt | n d( | | | j" f } t# j$ d) } x | j% | | | D] } t! | g | \ } } | d
k rRt& | t' j( t | n | d k r
| j) d* j* | r
| j+ d+ d* j* | } t! | d | d, d- g \ } } | d
k rt, d. | qq
q
Wqn | S(1 sX Updates firewall with rule by:
* appending the rule to the chain if new rule and firewall enabled
* deleting the rule from the chain if found and firewall enabled
* inserting the rule if possible and firewall enabled
* updating user rules file
* reloading the user rules file if rule is modified
RB s) Adding IPv6 rule failed: IPv6 not enabledR s# Skipping unsupported IPv6 '%s' rulet udpt tcps/ Must specify 'tcp' or 'udp' with multiple portss 1.4s: Skipping IPv6 application rule. Need at least iptables 1.4i s Invalid position '%d's Cannot specify insert and deletes# Cannot insert rule at position '%d'i i i s Skipping inserting existing rules (v6)s" Could not delete non-existent rules Skipping adding existing rules Couldn't update rules files
Rules updateds Rules updated (v6)s
Rule inserteds Rule updateds (skipped reloading firewall)s -Ds Rule deleteds -As
Rule addedR R R Rg R s
%s-user-%ss! Could not update running firewalls -Ls -ns %s %s %ss (-A +)(ufw6?-user-[a-z\-]+)(.*)Rt s \2s -jt RETURNs FAILOK: -D %s -j RETURN( RB RB RB RB ( RB RB RB RB (- R R( R8 R R t multiR R R
t positiont iptables_versionR R R
R t removet normalizeRH Rq Rr R R) t dup_ruleR R R- R R R R R Re RE R R RI RJ R R R t stderrRM R# RO R ( R, R t allow_reloadR: RQ t newrulest foundt modifiedR
R R t insertedt matchest lastR t currentt rett flagR R0 R R3 Ro Rg R R R Rk ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt set_rule/ s& '
,
$! c
C s g } g } | r | j } n | j } | j } | j | | j | j } xL | D]D } | j } | j | j } | | k r] | j | q] q] W| S( s@ Return a list of UFWRules from the system based on template rule( R
R
R R R R R) (
R, t templateR R
R t normR R RC t tmp_tuple( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt get_app_rules_from_system s
c C s | j } | j d r$ | j } n t | g | \ } } | d k r t d | } | rp t d | q t | n d S( s Perform command on chainR i s Could not perform '%s's FAILOK: N( R R Re R R8 R R ( R, R3 Rh t fail_okR Ro Rg RQ ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR s c C s | j r
d Sg } y | j | } Wn t k
r< n Xy$ | j d t | j d t Wn: t k
rw n' t k
r t d } t | n X| j s d St d } xs | j d | j d | j d | j d D]C } y | j
| d | d
g Wq t k
r+t | q Xq Wy^ xW | j d | j d | j d D]2 } | j
| d | g | j
| d | g qWWWn t k
rt | n Xx | D] \ } } } t } t | d
k r| d
d k rt } n yY | d k r:t | d k r:| j
| d g | d d t n | j
| | | Wqt k
rmt | qXqW| j
d d g | j | j
d g d t | j d d k r| j
d d g | j | j
d g d t n d S( s# Update loglevel of running firewallNR s& Couldn't update rules file for loggings! Could not update running firewallR R R R s -Ls -ns -Fs -Zi s -Dt delete_firsti R s ufw-user-limitRt R R s -I( R- R RH R R R R R8 R R' R R R* R+ R9 ( R, R t rules_tRQ Rk R R R ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR ! sb
2
" $
c
C s g } | | j j k r: t d | } t | n | d k r x7 | j d D]( } | j | d | d d g d g qT W| Sx7 | j d D]( } | j | d | d d g d g q Wd
d d d
d d g } | j | | j d k r2g } | j | | j d k r| } n x | j d D] } x d d d g D] } | j | r=| j | d k s|| j | d k rd } | j | d | d d d | g | d g q| j | | j d k rd } | j | d | d d d | g | d g qq=q=Wq'Wg } | j | | j d k r4| } n x | j d D] } | j d r`d } n | j d rd } | j | | j d k r| j | d | d
d d! d" d d g | d g q| j | d | d
d d! d" d d d d# g
| d g n | j | d | d d d | g | d g qBWn | j | | j d k rg } | j | | j d$ k ru| } n | j | | j d k rd
d d! d% g | } n d& } xD | j d' D]2 } | j | d | d d d | g | d g qWn | S(( s% Get rules for specified logging levels Invalid log level '%s'R R s -Is -jR R s -DRB s -mR s --limits 3/mins
--limit-burstt 10R t highR R R R R7 R= s [UFW BLOCK] s -AR s --log-prefixt mediums [UFW ALLOW] R R< t states --statet INVALIDs [UFW AUDIT INVALID] t fullt NEWs [UFW AUDIT] R ( R R R8 R R' R) t endswithR ( R, R R RQ Rk R t largsRn R ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR d sx && c C s d } g } x | j D] } | j | j d s8 q n | j | j | t j j t j j d t j j | j | } t j j
| s t d | } t | q q Wt
j d } xO | D]G } d | | f } t j j | r t d | } t | q q Wx\ | D]T } d | | f } | t d i t j j | d 6| d
67} t j | | qWx| D] } d | | f } t j t j j t j j d t j j | t j j | t j | | y t j | } | t j } Wn. t k
r/t d | }
t |
qyn X| t j @rT| t d | 7} qy| t j @ry| t d
| 7} qyqyW| S( s Reset the firewallRB s .rulesR s Could not find '%s'. Abortings
%Y%m%d_%H%M%Ss %s.%ss '%s' already exists. Abortings" Backing up '%(old)s' to '%(new)s'
t oldt news Couldn't stat '%s's WARN: '%s' is world writables WARN: '%s' is world readable( R. R R) R! R" R# R R t share_dirt basenamet isfileR8 R t timet strftimet existst renamet shutilt copyt dirnamet copymodet statt ST_MODERH R t S_IWOTHt S_IROTH( R, t rest allfilesRm t fnRQ t extR" t statinfot modeR ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt reset sP
"
( t __name__t
__module__t __doc__R& R; RY Rp R R R R R R R R R R R R R R R R R9 ( ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR s( % H V D ?
C Z( R< R! RI R+ R/ R R' t
ufw.commonR R R R t ufw.utilR R R R R t ufw.backendR R$ R% R ( ( ( s8 /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt <module> s "(