+ 4iXxRt^RIt^RIt^RIt^RIHtRtRtRt]t Rt Rt Rt R t !R R ]4t!R R 4tR#)z!common.py: common classes for ufwN)debugufwz/lib/ufwz/usr/share/ufwz/etcz/usrz /usr/sbinTc0a]tRt^!toRtRtRtRtVtR#)UFWErrorz$This class represents ufw exceptionscWnR#Nvalue)selfr s&&,/usr/lib/python3/dist-packages/ufw/common.py__init__UFWError.__init__#s c,\VP4#r)reprr r s&r __str__UFWError.__str__&sDJJrrN) __name__ __module__ __qualname____firstlineno____doc__r r__static_attributes____classdictcell__ __classdict__s@r rr!s.  rrca]tRt^*toRtRRltRtRtRtRt Rt RRlt R t R t R tR tR tRtRtRtRtRtRtRtRtRtRtRtRtRtVtR#)UFWRulez$This class represents firewall rulesc BRVnRVnRVnRVnRVnRVnRVnRVnRVnRVn RVn RVn ^Vn RVn RVnRVnRVnWnRVnVP'V4VP)V4VP+V4VP+VR4VP-V4VP/V4VP1V4VP3V 4R# \4dhi;i)FsrcN)removeupdatedv6dstr!dportsportprotocolmultidappsappactionpositionlogtype interface_in interface_out directionforwardcomment set_action set_protocolset_portset_srcset_dst set_direction set_commentr) r r,r(r&r%r'r!r1r2r3s &&&&&&&&&&r r UFWRule.__init__,s               OOF #   h ' MM% MM% ' LL  LL    y )   W %   s B D Dc"VP4#r) format_rulers&r rUFWRule.__str__Os!!rc RV,p\VP4pVP4VF%pVRV: RVPV,: 2, pK' V#)zPrint rule to stdoutz'%s'z, =)list__dict__sort)r reskeysks& r _get_attribUFWRule._get_attribRsIoDMM" A 4==#34 4C rc \VPVP4pVPVnVPVnVP VnVP VnVPVnVPVnVPVn VPVn VPVn VPVn VPVn VPVnVPVnVP VnVP"VnVP$VnVP&VnV#)zReturn a duplicate of a rule)rr,r(r"r#r$r%r!r&r'r)r*r+r-r.r/r0r1r2r3)r rules& r dup_ruleUFWRule.dup_rule[st{{DMM2kk || ''8888ZZ ZZ ZZ II II   ||  --!//|| ||  rc RpVPR8wdVRVP,, pVPR8wdVRVP,, pVPR8Xd VR, pMVRVP,, pVP'dVR, pVPR8wdPVP R8wd?VRVP,, pVR, pVR VP ,, pMWVPR8wdVRVP,, pM+VP R8wdVR VP ,, pVP R 8wd,VP R 8wdVR VP ,, pVP'g,VPR8wdVR VP,, pVPR 8wd,VPR 8wdVRVP,, pVP'g,VP R8wdVRVP ,, pRpVPR8wdRVP,pVPR8XdVRV,, pMnVPR8Xd,VRV,, pVPR8Xd VR, pM2VPR8XdVRV,, pMVRV,, pVPR8wgVPR8wdRp\P!R4pVPR8wd+VRVPRVP4,, pVPR8wdVPR8wd VR, pVPR8wd+VRVPRVP4,, pVR , pVRV,, pVP4#)!zFormat rule for later parsingr z -i %sz -o %sanyz -p allz -p z -m multiportz --dports z --sports 0.0.0.0/0::/0z -d z --dport z -s z --sport _allowz -j ACCEPT%srejectz -j REJECT%stcpz --reject-with tcp-resetlimitz -j LIMIT%sz -j DROP%sz-m comment --comment ' dapp_z%20,sapp_')r/r0r(r)r&r'r%r!r.r,r*r+recompilesubstrip)r rule_strlstrr3 pat_spaces& r r=UFWRule.format_rulers    " D$5$56 6H    # D$6$67 7H ==E !  !H . .HzzzO+::&4::+> tzz 99H/H tzz 99HZZ5( tzz 99HZZ5( tzz 99H 88{ "txx6'9 ) )HzzzdjjE1  djj0 0H 88{ "txx6'9 ) )HzzzdjjE1  djj0 0H <<2 %D ;;' ! $/ /H [[H $ $/ /H}}%66 [[G #  . .H  - -H 99?dii2o.G 3IyyB7Y]]5$))%DDDyyB499?3yyB7Y]]5$))%DDD sNG g %H~~rc VP4PR4pV^,R8XgV^,R8XgV^,R8XdV^,VnMRVnRp\V4^8d V^,pVP V4R#)zSets action of the rulerQrRrSrUdenyr N)lowersplitr,len set_logtype)r r,tmpr.s&& r r4UFWRule.set_actionsslln""3' q6W A( 2c!f6Ga&DK DK s8a<!fG !rc <\R4V,pVR8XdEM=VR8XdVP'dEM"VR8XdVP'dEM\P!RV4'g\P!RV4'd \ V4hVP R4VP R4,^8d \ V4hVPR4p\V4^8dR Vn R pVEFXp\P!R V4'dR Vn VPR4pVF.p\V4^8g\V4R 8gK%\ V4h \V^,4\V^,48d \ V4hM\P!R V4'd-\V4^8g\V4R 8d \ V4hM@\P!RV4'd\P!V4pM \ V4hV'dVR\V4,, pEKM\V4pEK[ TpVR8Xd\V4VnR#\V4VnR# \d \ T4hi;i)z:Sets port and location (destination or source) of the rulez Bad port '%s'rNr%r!z^[,:]z[,:]$rX:Tr z ^\d+:\d+$iz^\d+$z ^\w[\w\-]+N)rQr*r+r[matchrcountrfrgr)intsocket getservbyname Exceptionstrr'r&) r portlocerr_msgportsripranqs &&& r r6UFWRule.set_portsO$- 5=  E\diii  E\diii  XXh % %(D)A)A7# #jjo 3/2 57# #JJsOE5zA~! C88L!,,!%DJ''#,C q6A:Q%"*7"33!3q6{c#a&k1&w//2XXh**1vzSVe^&w//&4XXmQ//0"003#7++3Q<'Ca&C14D %<TDJTDJ%0&w//0s JJc V\PPR.,9d WnR#\ R4V,p\ V4h)zSets protocol of the rulerNzUnsupported protocol '%s'N)rutilsupported_protocolsr(rQr)r r(rvs&& r r5UFWRule.set_protocols; sxx33ug= =$M34AG7# #rc VP'd}VP'd*VPR8XgVPR8XdRVnVP'd.VPR8XgVPR8Xd RVnR#R#R#VP'd*VPR8XgVPR8XdRVnVP'd.VPR8XgVPR8Xd RVnR#R#R#)zAdjusts src and dst based on v6rNrOrPN)r$r%r!rs&r _fix_anywhereUFWRule._fix_anywheres 777xxxTXX.$((k2I!xxxTXX.$((k2I!3JxxxxTXX.$((f2D&xxxTXX.$((f2D&3Exrc 2WnVP4R#)zESets whether this is ipv6 rule, and adjusts src and dst accordingly. N)r$r)r r$s&&r set_v6UFWRule.set_v6 s rc VP4pVR8wd=\PPVR4'g\ R4p\ V4hW nVP4R#)zSets source address of rulerNzBad source addressN)rerr} valid_addressrQrr!rr addrrirvs&& r r7UFWRule.set_srcsQjjl %< 6 6sE B B,-G7# # rc VP4pVR8wd=\PPVR4'g\ R4p\ V4hW nVP4R#)z Sets destination address of rulerNzBad destination addressN)rerr}rrQrr%rrs&& r r8UFWRule.set_dstsQjjl %< 6 6sE B B12G7# # rc VR8wdVR8wd\R4p\V4hR\V49d\R4p\V4hR\V49d\R4p\V4h\V4R8Xg\V4R 8Xd\R 4p\V4h\\V44^8Xd\R 4p\V4h\\V44^8d\R 4p\V4h\P !R \V44'g\R4p\V4hVR8Xd W nR#W nR#)zSets an interface for ruleinoutzBad interface type!z+Bad interface name: reserved character: '!'rlz/Bad interface name: can't use interface aliases.z..z)Bad interface name: can't use '.' or '..'z+Bad interface name: interface name is emptyz+Bad interface name: interface name too longz^[a-zA-Z0-9_\-\.\+,=%@]+$zBad interface nameN)rQrrsrgr[rmr/r0)r if_typenamervs&&& r set_interfaceUFWRule.set_interface's( d?w%/,-G7# # #d) EFG7# # #d) IJG7# # t9 s4yD0CDG7# # D Na EFG7# # D NR EFG7# #xx4c$i@@,-G7# # d? $ !% rc \V4R8wdD\P!R\V44'g\R4V,p\ V4h\ V4VnR#)zSets the position of the rulez-1z^[0-9]+z,Insert position '%s' is not a valid positionN)rsr[rmrQrror-)r numrvs&& r set_positionUFWRule.set_positionWsJ s8t BHHZS$B$BFG3OG7# #C rc VP4R8XgVP4R8XgVR8XdVP4VnR#\R4V,p\V4h)zSets logtype of the rulelogzlog-allr zInvalid log type '%s'N)rer.rQr)r r.rvs&& r rhUFWRule.set_logtypeasL ==?e #w}})'C b="==?DL/0G 'N 55AEE> 'N 44144< 'N 66QVV  'N 66QVV  'N >>Q^^ + 'N ??aoo - 'N ;;!++ % 'N 99 ! 'N 88qxx AII$: QYY&+,G 'N 88qxx AII$: QYY&>?G 'NIFGAHHdAHHAIItQYYAIItQYY89 g rc  RpV'd V'g \4hVPV4^8Xd^#RV: RVP: RV: RVP: R2 pVPR8wd\ RV,R,4^#VP VP 8wd\ VR ,4^#VP VP 8wd&VP R 8wd\ R V,4^#VPR 8wd8V!VPVP4'g\ R V,4^#VPR 8XEd;VPR 8Xd$VPVP4'dEMVPVP8wd&RVP9d\ RV,4^#VPVP8wdRVP9dVPVP8Xd~\PPVPVPVP4'g9\ RV,RVP: RVP: R2,4^#EMVPR 8wdTVPVP8wd9\ RV,RVP: RVP: R2,4^#\PPVPVP4pTPT8wd@RTP9d/\ RT,RTP: RT: R2,4^#TPT8wdRTP9dTPTP8Xdi\PPYAPTP4'g/\ RT,RT: RTP: R2,4^#VPVP8wd9\ RV,RVP: RVP: R2,4^#\ RV: RVP: RV: RVP: R2 4R# \d/\ RT,RTP,,4^#i;i)a`This will match if x is more specific than y. Eg, for protocol if x is tcp and y is all or for address if y is a network and x is a subset of y (where x is either an address or network). Returns: 0 match 1 no match -1 fuzzy match This is a fuzzy destination match, so source ports or addresses are not considered, and (currently) only incoming. cRV9gRV9d W8XdR#R#VPR4F_pW8XdR#RV9gKVPR4wr4\V4\V48gKC\V4\V48:gK^R# R#)z:Returns True if p is an exact match or within a multi rulerXrlTF)rfro)test_pto_matchrtlowhighs&& r _match_ports-UFWRule.fuzzy_dst_match.._match_portsssf}v % s+>$;"&**S/KS6{c#h.3v;#d)3K# ,rzNo fuzzy match 'z (v6=z)' 'z)'rz (direction) z (not incoming)z (forward does not match)rNz (protocol) z(dport) r /z(dst) z ('z' not in network 'z')z (interface) z (z != )z %s does not existz(v6) z(fuzzy match) 'r)rrmr$r1rr2r(r&r/ _is_anywherer%rr} in_networkget_ip_from_ifIOError)rrrrif_ips&& r fuzzy_dst_matchUFWRule.fuzzy_dst_matchsU ",  771:? qttQ& ;;$  .7*->> ? 99 ! '77 8 :: # e(; -') * 77e L!''$B$B *w& ' >>R ~~#quu(=(=!%%Cquu$4h()!%%C155LQTTQTT\88&&quuaeeQTT::h(uuaee,%%& ~~#!..(Hnw.~~q~~2778 //E uu~#QUU"2nw.uue2%%&%C155LQTTQTT\88&&ueeQTT::nw.7T[0rc RpVPR8wgVPR8wEdbVP: RVP: RVP: RVP: 2pVPR8Xd:VP: RVP: RVP: RVP: 2pVPR8Xd:VP: RVP: RVP : RVP: 2pVP R8Xd.VPR8XdVRVP,, pV#VP R8wdVRVP ,, pVPR8wdVRVP,, pV#)a{Returns a tuple to identify an app rule. Tuple is: dapp dst sapp src direction_iface|direction or dport dst sapp src direction_iface|direction or dapp dst sport src direction_iface|direction where direction_iface is of form 'in_eth0', 'out_eth0' or 'in_eth0 out_eth0' (ie, both interfaces used). If no interfaces are specified, then tuple ends with the direction instead. r rVz %sz in_%sz out_%s) r*r+r%r!r&r'r/r0r1)r tupls& r get_app_tupleUFWRule.get_app_tupleTs 99?dii2o$(IItxxDHHMDyyB(, DHHdii)-3yyB(, 488TZZ)-3  B&4+=+=+C00 $$*H(9(9::D%%+I););<!]],w''': 8r)r,r3r*r1r&r%r2r/r0r.r)r-r(r"r+r'r!r#r$N)rNrOrNrOrFr )r%)rrrrrr rrGrKr=r4r6r5rrr7r8rrrhr9rr:rrmrrrrrrrs@r rr*s.!F".A F "3#j$ '.&`!$$1!)FAFl\ D((rr)rr[rpufw.utilrr programName state_dir share_dir trans_dir config_dir prefix_dir iptables_dir do_checksrrrrrrr rsV'"          y ` (` (r