+
    4i                     H   R t ^ RIHt ^ RIt^ RIt^ RIt^ RIt^ RIt^ RIt^ RI	t	^ RI
t
^ RIt^ RIt^ RIt^ RIt^ RIt^ RIHt ^ RIHtHt RtRt. R6Ot. R7OtRR.tR tR	 tR
 tR tR tR8R ltR t R t!R t"R t#R9R lt$R t%R t&R t'R9R lt(R t)]PT                  R3R lt+R t,R t-R t.R t/]	P`                  ! 4       3R lt1]	P`                  ! 4       3R lt2R  t3R! t4R" t5R# t6R$ t7R% t8R& t9R' t:R:R( lt;R;R) lt<R* t=R<R+ lt>R, t?R- t@R. tAR/ tBR0 tCR1 tDR2 tER3 tFR=R4 ltGR5 tHR# )>z"util.py: utility functions for ufw)print_functionN)reduce)mkstempmktempFipv6igmpc                   Rp \         P                  ! V 4        \         P                  ! T R4       Rp \         P                  ! T R4       TR8X  d   RpT# Rp T#   \         d    h i ; i  \         d     LEi ; i  \         d     T# i ; i)z8Get the protocol for a specified port from /etc/services tcpudpany)socketgetservbyname	Exception)portprotos   & */usr/lib/python3/dist-packages/ufw/util.pyget_services_protor   .   s    ET"T5)T5)E>E L	 E L%      Ls3   A A,  A= A= A),A:9A:=BBc                0   RpRpV P                  R4      p\        V4      ^8X  d   V^ ,          pRpW3# \        V4      ^8X  d?   V^ ,          pV^,          pV\        9   d   \        RV,          4      p\	        V4      h W3# \        R4      p\	        V4      h)zParse port or port and protocolr	   /r   zInvalid port with protocol '%s'zBad port)splitlenportless_protocols_
ValueError)p_strr   r   tmperr_msgs   &    r   parse_port_protor   H   s    DE
++c
C
3x1}1v = 
SQ1vA&&9EABGW%% ' = J-!!    c                   \         P                  '       g   \        R4       R# \        V 4      ^+8  g   \        P
                  ! RV 4      '       g   R# V P                  R4      p \         P                  ! \         P                  V^ ,          4       \        T4      ^8  d   R# \        T4      ^8X  d   \        T^,          R4      '       g   R# R#   \         d     R# i ; i)zVerifies if valid IPv6 addressz"python does not have IPv6 support.Fz^[a-fA-F0-9:\./]+$r   T)r   has_ipv6warnr   rematchr   	inet_ptonAF_INET6r   _valid_cidr_netmaskaddrnets   & r   valid_address6r+   \   s    ???12 4y2~RXX&;TBB
**S/C#a&1 3x!|	SQ"3q6400  s   %,C CCc                   \        V 4      ^8  g   \        P                  ! RV 4      '       g   R# V P                  R4      p \        P
                  ! \        P                  V^ ,          4       \        V^ ,          R4      '       g   R#  \        T4      ^8  d   R# \        T4      ^8X  d   \        T^,          R4      '       g   R# R#   \         d     R# i ; i)zVerifies if valid IPv4 addressz^[0-9\./]+$Fr   T)
r   r#   r$   r   r   r%   AF_INET_valid_dotted_quadsr   valid_netmaskr(   s   & r   valid_address4r0   v   s     4y2~RXXnd;;
**S/CQ0"3q6511 2
 3x!|	SQSVU++  s   AC	 	CCc                >    \        W4      ;'       g    \        W4      # )z(Verifies if valid cidr or dotted netmask)r'   r.   )nmv6s   &&r   r/   r/      s    r&EE*=b*EEr   c                    VR8X  d   \        V 4      # VR8X  d   \        V 4      # VR8X  d   \        V 4      ;'       g    \        V 4      # \        h)zValidate IP addresses64r   )r+   r0   r   )r)   versions   &&r   valid_addressr8      sL    #~d##	Cd##	E	d#;;~d';;
r   c                   . pRpRp\         P                  pV'       d   Rp\         P                  pRV 9   dT   V P                  R4      pV'       d   V^,          R8X  d   V^ M9V'       g    V^,          R8X  g   V^,          R8X  d   V^ MVP	                  V 4       V'       gA   \        V4      ^8X  d1   \        V^,          V4      '       d    \        V^,          V4      V^&   V^ ,          p\         P                  ! V\         P                  ! WV4      4      pWb^ ,          8w  d   Rp\        V4      ^8X  dK   VRV^,          ,           ,          pV'       g,   \        V4      pWv8w  d   R	V: R
V: R2p\        V4       TpRp\        Wd4      '       g   RV,          p\        V4       \        hWc3#   \         d     Li ; i)zConvert address to standard form. Use no netmask for IP addresses. If
netmask is specified and not all 1's, for IPv4 use cidr if possible,
otherwise dotted netmask and for IPv6, use cidr.
Fr6   r5   r   12832z255.255.255.255TzUsing 'z' for address ''zInvalid address '%s')r   r-   r&   r   appendr   r.   _dotted_netmask_to_cidrr   	inet_ntopr%   _address4_to_networkdebugr8   r   )	origr3   r*   changedr7   s_typer)   networkdbg_msgs	   &&       r   normalize_addressrG      sy   
 CGG^^F	
d{jjo#a&E/AQ43q65F+FA

4#c(a-$7A$C$C	,SVR8CF
 q6D FF$4$4V$BCD1v~
3x1}c!f*40G;BDIg''(D1g?5  		s   F/ /F=<F=c                    \        V R4      # )z"Opens the specified file read-onlyr)open)fns   &r   open_file_readrL      s    C=r   c                    \        V 4      p \        4       w  r#RTRT RTRT/#   \         d    TP                  4        h i ; i)z=Opens the specified file read-only and a tempfile read-write.rB   orignamer   tmpname)rL   r   r   close)rK   rB   r   rO   s   &   r   
open_filesrQ      sP    "D 
 T:r5#y'KK	  

s	   # A c                   VR8X  d   R# V '       g   \        \        P                  R4      h\        '       d;   V \        P
                  P                  4       8X  d   \        P                  V4       R# Rp\        P                  ^ ,          ^8  d#   \        P                  ! V \        VR4      4      pM\        P                  ! W4      pV^ 8:  d   \        \        P                  R4      hR# )zwWrite to the file descriptor and error out of 0 bytes written. Intended
to be used with open_files() and close_files().r	   NzNot a valid file descriptorasciiz"Could not write to file descriptor)OSErrorerrnoENOENT
msg_outputsysstdoutfilenowriteversion_infoosbytesEIO)fdoutrcs   && r   write_to_filerd      s     byell$ABB zbCJJ--//	B
aXXb%W-.XXb	Qweii!EFF r   Tc                L   V R,          P                  4        \        P                   ! V R,          4       V'       dK   \        P                  ! V R,          V R,          4       \        P                  ! V R,          V R,          4       \        P
                  ! V R,          4       R# )zjCloses the specified files (as returned by open_files), and update
original file with the temporary file.
rB   r   rN   rO   N)rP   r^   shutilcopystatcopyunlink)fnsupdates   &&r   close_filesrl     sc     KHHSZJY8C	NC
O4IIc)nr   c                ,   \        V 4        \        P                  ! V \        P                  \        P                  RR7      pTP                  4       ^ ,          pTP                  \        T4      .#   \
         d   p^\        T4      .u Rp?# Rp?ii ; i)z!Try to execute the given command.T)rZ   stderruniversal_newlinesN)	rA   
subprocessPopenPIPESTDOUTrU   strcommunicate
returncode)commandspexrb   s   &   r   cmdrz     sx    	'Ngjoo%/%6%6157 ..
1
CMM3s8$$	  SW~s   6A1 1B<BBBc                8    \         P                  ! V \         P                  R7      p\         P                  ! WP                  R7      pTP                  4       ^ ,          pTP                  \        T4      .#   \         d   p^\        T4      .u Rp?# Rp?ii ; i)z#Try to pipe command1 into command2.)rZ   )stdinN)rp   rq   rr   rZ   rU   rt   ru   rv   )command1command2sp1sp2ry   rb   s   &&    r   cmd_piper   $  sw    x
@xzz: //
A
CNNCH%%	  SW~s   AA7 7BBBBc                v    V P                   p VP                  RR4      p\        '       d=   \        P
                  ! \        P                  4      '       d   VP                  V4       MVP                  \        V4      4       V P                  4        R#   \         d    T p Li ; i  \         d    Tp Li ; i)zJImplement our own print statement that will output utf-8 when
appropriate.utf-8ignoreN)bufferr   encoderX   inspectisclassioStringIOr\   r_   flush)outputswriterrb   s   &&  r   _printr   2  s    hhw)
 zgoobkk22QU3Z 
LLN    s"   B B( B%$B%(B87B8c                     \        \        P                  RV ,          4       V'       d   \        P                  ! ^4       R# R#   \         d     L/i ; i)zPrint error message and exitz
ERROR: %s
N)r   rY   rn   IOErrorexit)rb   do_exits   &&r   errorr   G  sC    szz=3./    s   !A AAc                n     \        \        P                  RV ,          4       R#   \         d     R# i ; i)zPrint warning messagez	WARN: %s
N)r   rY   rn   r   rb   s   &r   r"   r"   R  s,    szz<#-. s   !% 44c                    \         '       d   V\        P                  8X  d   \         p V'       d   \        VRV ,          4       R# \        VRV ,          4       R#   \         d     R# i ; i)zPrint messagez%s
%sN)rX   rY   rZ   r   r   )rb   r   newlines   &&&r   msgr   Z  sM    zf

*66C<(64#:& s   A A A A*)A*c                    \         '       d%    \        \        P                  RV ,          4       R# R#   \         d     R# i ; i)zPrint debug messagez
DEBUG: %s
N)	DEBUGGINGr   rY   rn   r   r   s   &r   rA   rA   h  s8    y	3::}s23   		s   !3 AAc                @    \        V3R lV P                  R4      4      # )z
    A word-wrap function that preserves existing line breaks
    and most spaces in the text. Expects that existing line
    breaks are posix newlines (
).
    c           	          V : R \        V 4      V P                  R4      ,
          ^,
          \        VP                  R^4      ^ ,          4      ,           V8  ,          : V: 2# )z 

)r   rfindr   )linewordwidths   &&&r   <lambda>word_wrap.<locals>.<lambda>w  sT    #d)DJJt$44q8djjq1!4569>? A	3r    )r   r   )textr   s   &&r   	word_wrapr   q  s%     5 
 **S/ r   c                    \        V ^K4      # )zWord wrap to a specific width)r   )r   s   &r   	wrap_textr     s    T2r   c                :   a R oV P                  V3R lR7       R# )zSorts list of strings into numeric order, with text case-insensitive.
Modifies list in place.

Eg:
[ '80', 'a222', 'a32', 'a2', 'b1', '443', 'telnet', '3', 'http', 'ZZZ']

sorts to:
['3', '80', '443', 'a2', 'a32', 'a222', 'b1', 'http', 'telnet', 'ZZZ']
c                 d    V P                  4       '       d   \        V 4      # V P                  4       # N)isdigitintlower)ts   &r   r   human_sort.<locals>.<lambda>  s     qyy{{SV9	9r   c                 h   < \         P                  ! R V 4       Uu. uF  pS! V4      NK  	  up# u upi )z([0-9]+))r#   r   )kcnorms   & r   r   r     s(    bhhz1.EF.ET!W.EFFs   /)keyN)sort)lstr   s   &@r   
human_sortr     s     :DHHFHGr   c                    \        V 4      p\        P                  P                  R\        T4      R4      p\        P                  P                  T4      '       g   \        RT,          4      h\        T4      P                  4       ^ ,          P                  R^4      ^,          P                  4       ^,          p\        T4      #   \         d    \        R4      hi ; i)zYFinds parent process id for pid based on /proc/<pid>/stat. See
'man 5 proc' for details.
zpid must be an integer/procstatCouldn't find '%s'))r   r   r   r^   pathjoinrt   isfiler   rJ   	readlinesrsplitr   )mypidpidnameppids   &   r   get_ppidr     s    3%j 77<<S62D77>>$*d344 :!!$++C3A6<<>qADt9  31223s   C Cc                    \        V 4      pT ^8X  g   T^8:  d   R# \        P                  P                  R\        T4      R4      p\        P                  P                  T4      '       g   \        R4      T,          p\        T4      h \        T4      P                  4       ^ ,          P                  4       ^,          p\        RT,          4       TR	8X  d   R
# \        T4      #   \         d    \        R4      p\        T4        R# \         d(    \        R4      \        T 4      ,          p\        T4      hi ; i  \         d    \        R4      T,          p\        T4      hi ; i)z1Determine if current process is running under sshz%Couldn't find pid (is /proc mounted?)Fz!Couldn't find parent pid for '%s'r   r   r   z"Could not find executable for '%s'zunder_ssh: exe is '%s'z(sshd)T)r   r   r   r"   r   rt   r   r^   r   r   r   rJ   r   r   rA   	under_ssh)r   r   warn_msgr   r   exes   &     r   r   r     s2   "} ax41977<<TF3D77>>$()T2!!"4j""$Q'--/2 

"c
*+ h;  <=X "78CHE!!"   "89TB!!"s#   C% 
5D= %!D:	D:(D:=)E&c                    ^ pV'       d   ^p\         P                  ! RV 4      '       d!   \        V 4      ^ 8  g   \        V 4      V8  d   R# R# )zVerifies cidr netmasks^[0-9]+$FT)r#   r$   r   )r2   r3   nums   && r   r'   r'     s:    
C	88K$$B!s2w}r   c                   V'       d   R# \         P                  ! RV 4      '       dZ   V P                  R4      p\        V4      ^8w  d   R# V F.  pV'       d#   \	        V4      ^ 8  g   \	        V4      ^8  g   K-   R# 	  R# R# )z.Verifies dotted quad ip addresses and netmasksFz^[0-9]+\.[0-9\.]+$.T)r#   r$   r   r   r   )r2   r3   quadsqs   &&  r   r.   r.     sc    	88)2..HHSME5zQCFQJ#a&3,    r   c           	     X   RpV'       d   \         h\        W4      '       g   \         h^ p \        \        P                  ! R\
        P                  ! V 4      4      ^ ,          4      pRp\        ^ 4       F0  pWF,	          ^,          ^8X  d   RpK  V'       d   Rp MV^,          pK2  	  V^ 8  d   V^ 8:  d   \        ^ V,
          4      p\        W!4      '       g   \         hV#   \         d?    \        \        P                  ! R\
        P                  ! T 4      4      ^ ,          4      p Li ; i)z@Convert netmask to cidr. IPv6 dotted netmasks are not supported.r	   >LFTrT   )r   r.   longstructunpackr   	inet_aton	NameErrorr   rangert   r'   )r2   r3   cidrmbitsbits	found_onens   &&     r   r>   r>     s    D	"2**
	EdF,<,<R,@A!DED 	rA	Q!# 	EQJE  A:%2+rEz?Dt((K)  	Ev}}T6+;+;B+?@CDD	Es   ;C   AD)(D)c                   RpV'       d   \         h\        W4      '       g   \         h \        ^ 4      p\	        ^ 4       F,  pV\        V 4      8  g   K  V^^V,
          ,          ,          pK.  	  \        P                  ! \        P                  ! RV4      4      p\        W!4      '       g   \         hV#   \         d    ^ p Li ; i)z<Convert cidr to netmask. IPv6 dotted netmasks not supported.r	   r   )r   r'   r   r   r   r   r   	inet_ntoar   packr.   )r   r3   r2   r   r   s   &&   r   _cidr_to_dotted_netmaskr   $  s    	B	"4,,
	7D rA3t9}R!V#  fkk$56 r&&I  	D	s   B3 3CCc           	        RV 9  d   \        R4       V # V P                  R4      p\        V4      ^8w  g   \        V^ ,          R4      '       g   \        hV^ ,          pV^,          pTp\        VR4      '       d   \        VR4      p \        \        P                  ! R\        P                  ! V4      4      ^ ,          4      p\        \        P                  ! R\        P                  ! V4      4      ^ ,          4      pWV,          p\        P                  ! \        P                  ! RV4      4      pV: RV: 2#   \         dz    \        \        P                  ! R\        P                  ! T4      4      ^ ,          4      p\        \        P                  ! R\        P                  ! T4      4      ^ ,          4      p Li ; i)z8Convert an IPv4 address and netmask to a network addressr   z8_address4_to_network: skipping address without a netmaskFr   )rA   r   r   r.   r   r'   r   r   r   r   r   r   r   r   r   r   )	r)   r   hostorig_nmr2   	host_bitsnm_bitsnetwork_bitsrE   s	   &        r   r@   r@   A  sS   
$HI
**S/C
3x1}/A>>q6D!fG	B2u%%$R/DtV-=-=d-CDQGH	v}}T6+;+;B+?@CD
 &Lv{{4>?Gw''  DdF,<,<T,BCAFG	fmmD&*:*:2*>?BCDs   A6D: :BF>=F>c                   R pRV 9  d   \        R4       V # V P                  R4      p\        V4      ^8w  g   \        V^,          R4      '       g   \        hV^ ,          pV^,          p\
        P                  ! R\        P                  ! \        P                  V4      4      p \        ^ 4      p\        ^4       F_  pV! WW,          ^4      p\        ^4       F>  p	V^\        W,          4      ,          ^V	,
          V^,          ,
          ,          ,          pK@  	  Ka  	   \        ^ 4      p
\        ^4       F,  pV\        V4      8  g   K  V
^^V,
          ,          ,          p
K.  	  Wj,          p. p\        ^4       F=  pVP                  \        V! V^4      V^,          V^,          ^,            ^4      4       K?  	  \        P                  ! \        P                  \
        P                   ! RV^ ,          V^,          V^,          V^,          V^,          V^,          V^,          V^,          4	      4      pV: RV: 2#   \         d    ^ p ELi ; i  \         d    ^ p
 EL7i ; i)z8Convert an IPv6 address and netmask to a network addressc           	         RP                  \        V^,
          RR4       Uu. uF  p\        W,	          ^,          4      NK  	  up4      # u upi )zDecimal to binaryr	   rT   )r   r   rt   )r   countys   && r   dec2bin%_address6_to_network.<locals>.dec2binf  s=    wwU57B5KL5KSXN+5KLMMLs   !A
r   z8_address6_to_network: skipping address without a netmaskTz>8H)rA   r   r   r/   r   r   r   r   r%   r&   r   r   r   r   r=   r?   r   )r)   r   r   	orig_hostnetmaskunpackedr   ir   jr   r*   r   rE   s   &             r   _address6_to_networkr   d  s   N $HI
**S/C
3x1}M#a&$77AI!fG}}UF$4$4V__5>%@ AHG	 1XHK$rA!c!$i-SU1R4Z88I  q' 3Zs7|qWM))G 
 
C C1X

3wsC(2ad2g6:;  v%{{5#a&#a&+.q63q63q6+.q63q63q6 CDG
 w''A  	  s$   %H= I =III"!I"c                   VP                  R4      p\        V4      ^8w  g   \        V^,          V4      '       g   \        hV^ ,          pV^,          pVR8X  g   VR8X  d   R# T pRV9   dJ   VP                  R4      p\        V4      ^8w  g   \        V^,          V4      '       g   \        hV^ ,          pVR8X  g   VR8X  d   R# V'       d*   \	        V4      '       d   \	        V4      '       g   \        hM(\        V4      '       d   \        V4      '       g   \        h\        WR4      '       d   V'       g   \        WR4      pV'       dU   \        V: RV: 24      P                  R4      ^ ,          p\        V: RV: 24      P                  R4      ^ ,          pW8H  # \        V: RV: 24      P                  R4      ^ ,          p\        V: RV: 24      P                  R4      ^ ,          pW8H  # )z&Determine if address x is in network yr   z0.0.0.0z::T)
r   r   r/   r   r+   r0   r'   r   r   r@   )	
tested_add
tested_netr3   r   r   r   addressorig_networkrE   s	   &&&      r   
in_networkr     s   


3
C
3x1}M#a&"55AI!fGId!2G
g~mmC s8q=c!fb 9 9a&)w$	g&&nY.G.G /H g&&nY.G.G7'')'6 
+-6-A BBG%*QP&(/(: ;;@5:aI "" ,-6-A BBG%*QP&(/(: ;;@5:aI ""r   c                      R p R FL  p\         P                  P                  VR4      p \         P                  P                  V 4      '       d    MR p KN  	  V R 8X  d   \	        \
        P                  R4      hV # )r	   iptableszCould not find iptables)z/sbinz/binz	/usr/sbinz/usr/binz/usr/local/sbinz/usr/local/bin)r^   r   r   existsrU   rV   rW   )r   ds     r   _find_system_iptablesr    sd    
C3 ggll1j)77>>#C3 byell$=>>Jr   c                    V f   \        4       p \        V R.4      w  rV^ 8w  d"   \        \        P                  RV ,          4      hVP                  4       p\        P                  ! RRV^,          4      # )zReturn iptables versionz-VzError running '%s'z^vr	   )r  rz   rU   rV   rW   r   r#   sub)r   rc   rb   r   s   &   r   get_iptables_versionr    s_    
{#%S$K IR	Qwell$8C$@AA
))+C66$CF##r   c                j   R pV'       d5   \         P                  ! 4       ^ 8w  d   \        \        P                  R4      hV f   \        4       p . pRpV P                  R4      '       d   RpV\        RRR7      ,          p\        V RV.4      w  rVV^ 8w  d   \        \        P                  V4      hV! W. RO4      '       d   VP                  R	4       V! W. RO4      '       d   VP                  R
4       \        V RV.4       \        V RV.4      w  rVV^ 8w  d   \        \        P                  V4      hV# )zTReturn capabilities set for netfilter to support new features. Callers
must be root.c                 H    V R V.p\        W2,           4      w  rEV^ 8X  d   R# R# )z-ATF)rz   )r   chainruleargsrc   rb   s   &&&   r   test_cap,get_netfilter_capabilities.<locals>.test_cap  s)    T5!$	7r   zMust be rootzufw-caps-test	ip6tableszufw6-caps-testr	   )prefixdirz-Nz
recent-setzrecent-updatez-Fz-X)-m	conntrack	--ctstateNEWr  recentz--set)r  r  r  r  r  r  z--updatez	--seconds30z
--hitcountr5   )r^   getuidrU   rV   EPERMr  endswithr   rz   rW   r=   )r   	do_checksr  capsr  rc   rb   s   &&     r   get_netfilter_capabilitiesr    s    RYY[A%ekk>22
{#%DE
||K    
V22&&E S$&'IR	QwellC((  6 7 7L!  0 1 1 	O$ dES$&'IR	QwellC((Kr   c                   \        V 4      p\        4       pVP                  4        EFb  pVP                  R4      '       g   VP                  R4      '       g   K4  VP	                  4       pV^ ,          pV^,          P	                  R4      R,          p\        4       pRP                  V^,          P	                  R4      RR 4      VR&   V^,          VR&   V^,          P	                  R4      ^ ,          VR&   VR,          R	8X  d   VR,          VR
&   M"V^,          P	                  R4      ^,          VR
&   WR9  d   \        4       W%&   . W%,          V&   MWbV,          9  d   . W%,          V&   W%,          V,          P                  V4       EKe  	  V# )z:Get and parse netstat the output from get_netstat_output()r
   r   :Nladdruidr   r   -r   rT   )get_netstat_outputdict
splitlines
startswithr   r   r=   )r3   netstat_outputr  r   r   r   r   items   &       r   parse_netstat_outputr'  '  sE    (+NA))+u%%dooe.D.DjjlA1v||C $vQc!23B!78W!fU!fll3'*U;#u+DKa&,,s+A.DK>vAHAHTNU8#!#	d#1 ,4 Hr   c                .   RpV'       Ed;   Rp\         P                  P                  V4      '       g"   \        \        P
                  RV,          4      h\        V4      P                  4        F  pVP                  4       pW^,          8X  g   K"  RP                  \        ^ \        V^ ,          4      ^4       Uu. uF  qe^ ,          Wf^,            NK  	  up4      pV^,          P                  4       R8w  g   K  V: R\        V^,          P                  4       ^4      : 2pK  	  VR8X  d   \        \        P                  R4      hM\         P                   ! \         P"                  \         P$                  4      p \         P&                  ! \(        P*                  ! VP-                  4       R\.        P0                  ! R	V R
,          4      4      R,          4      p\5        W!4      ^ ,          # u upi   \2         d    \        \        P                  R4      hi ; i)zGet IP address for interfacer	   /proc/net/if_inet6'%s' does not existr  80r   No such devicei  256s:N   N:      N)r^   r   r   rU   rV   rW   rJ   r   r   r   r   r   r   r   r   ENODEVr   r-   
SOCK_DGRAMr   fcntlioctlr[   r   r   r   rG   )ifnamer3   r)   procr   r   r   r   s   &&      r   get_ip_from_ifr7  M  s   D 
r#ww~~d##%,,(=(DEEJ((*D**,CQxx38CAK3KL3KaF1qSM3KLN q6<<>T)&*CA,CDD + 2:%,,(899  MM&..&*;*;<	:##EKK
F$*KKs$D%FFK%M ND
 T&q)) M  	:%,,(899	:s   9G)
:AG. .&Hc           
     ,   RpRp\        V 4      '       d   RpRpM+\        V 4      '       g   \        \        P                  R4      h\
        P                  P                  V4      '       g"   \        \        P                  RV,          4      hRpV'       Ed    \        V4      P                  4        F  pVP                  4       pV^,          P                  4       pRP                  \        ^ \!        V^ ,          4      ^4       Uu. uF  qu^ ,          Ww^,            NK  	  up4      pV^,          P#                  4       R	8w  d)   V: R
\%        V^,          P#                  4       ^4      : 2pW8X  g   R
V9   g   K  \'        WR4      '       g   K  Tp V# 	   V# \        V4      P                  4        FJ  pRV9  d   K  VP                  R4      ^ ,          P                  4       p \)        VR4      p	Y8X  g   KG  Tp T# 	  V# u upi   \         d     Kc  i ; i)zGet interface for IP addressFz/proc/net/devTr)  r,  r*  r	   r  r+  r   )r+   r0   r   rV   r1  r^   r   r   rU   rW   rJ   r   r   stripr   r   r   r   r   r   r7  )
r)   r3   r6  matchedr   r   r5  r   tmp_addrips
   &         r   get_if_from_ipr=  m  s   	BDd#D!!ell$45577>>$ell$9D$@AAG	rJ((*D**,CV\\^Fxx38CAK3KL3KaF1qSM3KLNH1v||~%&.CFLLNB0GHxJtt$D$D   N9 +8 N J((*D$ZZ_Q'--/F#FE2 z N + N/ M   s   G?
"HHHc                    \         P                  ! R4      p V P                  4        \        P                  ! R4      p\        4       pV  EF;  pVP                  V4      '       g   K  \         P                  P                  RVR4      p\         P                  ! V\         P                  \         P                  ,          4      '       g   K  Rp \         P                  ! \         P                  P                  RVR4      4      p \         P                  ! V4      pT Ff  p \         P                  ! \         P                  P                  YG4      4      ^,          pT: R\         P                  P                  T4      : 2Y(&   Kh  	  EK>  	  V#   \         d     Li ; i  \         d     EKb  i ; i  \         d     K  i ; i)zGet inodes of files in /procr   r   ra   r   r   r   )r^   listdirr   r#   compiler"  r$   r   r   accessF_OKR_OKreadlinkr   r   basename)	
proc_filespatinodesr   fd_pathexe_pathdirsr   inodes	            r   _get_proc_inodesrM    sM   G$JOO
**[
!CVFyy||'',,w40 yy"''BGG"344	{{277<<E#BCH	::g&D AW 89!< ()"''*:*:8*DEFM + 8 M  		
  		  s6   5FF:F/FFF,+F,/F>=F>c                   ^R^R^R^R^R^R^R^R^	R	^
R
^R/pR^R^R^R^	/p\         P                  P                  RV 4      p\         P                  ! V\         P                  \         P
                  ,          4      '       g   \        h. pRp\        V4      P                  4       pV F  pVP                  4       pV'       g   RpK  V\        WR,          ,          ^4      ,          p	V P                  R4      '       d   Rp	M V P                  R4      '       d
   V	R
8w  d   Ky  WR,          ,          P                  R4      w  rWR,          ,          pWR,          ,          pVP                  V
\        V^4      WV	34       K  	  V# )z=Read /proc/net/(tcp|udp)[6] file and return a list of tuples ESTABLISHEDSYN_SENTSYN_RECV	FIN_WAIT1	FIN_WAIT2	TIME_WAITCLOSE
CLOSE_WAITLAST_ACKLISTENCLOSING
local_addrstater  rL  z	/proc/netFTr   NAr
   r  )r^   r   r   rA  rB  rC  r   rJ   r   r   r   r$  r=   )protocol
tcp_statesproc_net_fieldsrK   r   skipped_firstlinesr   fieldsr[  r  r   r  rL  s   &             r   _read_proc_net_protocolrc    ss   mjjkkkgljxyJ %aqO 
k8	,B99R277*++
CMH E M3vg&>?DEu%%E  ''EX,=\:;AA#FU+,w/0

E3tR=#e<=  Jr   c                   Rp\        V 4      ^8  d   Rp\        ^ ^ ^4       FF  pTRP                  \        V^,           VR4       Uu. uF  q@V^,
          V NK  	  up4      ,          pKH  	  \        RP                  \        ^ \        V4      ^4       Uu. uF  qBWD^,            P	                  4       NK  	  up4      R4      ^ ,          pV# . p\        ^^ R4       Uu. uF  q@V^,
          V NK  	  up F'  pVP                  \        \        V^4      4      4       K)  	  \        RP                  V4      R4      ^ ,          pV# u upi u upi u upi )zDConvert an address from /proc/net/(tcp|udp)* to a normalized addressr	   r  Tr   F)r   r   r   rG   r   r=   rt   r   )paddr	convertedr   r   r   s   &    r   convert_proc_addressrh    s.   I
5zA~q"aA27751a3DF3Da1Q3q\3DFGGC !%chh,1!SXq,AB,AqAc
  ",AB'D	  ).q!R:A1Q<:AJJs3q":' ;%chhsmU;A>	 GB ;s   E!EEc                ,   \        4       pRR.pV '       d   VRR.,          pV F  p \        V4      W&   K  	  \        4       p\        VP                  4       4      pVP                  4        RpV Fq  pW,           Fb  w  rrp\        V4      pRp\        V4      V9   d   V\        V4      ,          pWs:R R	V: R
V	: 2:R R	V:R R	V
:R R	V:R R	V: R2,          pKd  	  Ks  	  V#   \         d"    \        RT,          4      p\	        T4        K  i ; i)z5netstat-style output, without IPv6 address truncationr
   r   tcp6udp6z!Could not get statistics for '%s'r	   r   5r   r  4611r   )r"  rc  r   r   r"   rM  listkeysr   rh  r   )r3   proc_net_datar   pr   rH  	protocolsr   r  r   r  rL  r[  r)   r   s   &              r   r!  r!    s   FMENE	&&!!	6q9M  F]'')*INN
A0=0@0@,U#e'.DC5zV#SZ(qBF7M7<c5#O OA 1A  H/  	<BCHN	s   C''(DDc                    Vf   V # V P                  R4      '       d>   \        V 4      ^8  d   TpV# \        P                  P	                  WR,          4      p V# \        P                  P	                  W4      pV# )zAdd prefix to dirr   :   NN)r$  r   r^   r   r   )r  r  newdirs   && r   	_findpathrw  &  sj    ~

~~cs8a<F
 M WW\\&b'2F M f*Mr   c                    \         P                  ^ ,          ^8  d   \        P                  ! V R4      # \        P
                  ! V P                  RRR7      4      P                  R4      # )z,Take a string and convert it to a hex stringhexr   r   )errorsrS   )rY   r]   codecsr   binasciihexlifydecode)r   s   &r   
hex_encoder  4  sQ    
Q}}Q&& AHHWXH>?FFwOOr   c                   \         P                  ^ ,          ^8  d"   V P                  RR7      P                  R4      # \        P                  ! R\        V 4      ^,          '       d   V RR MT ,          4      P                  RR4      # )z,Take a hex string and convert it to a stringry  )encodingr   r   NbackslashreplacerT   )rY   r]   r~  r|  	unhexlifyr   )hs   &r   
hex_decoder  =  sp    
Qxxx'..w77 dA

afBCJJ# r   c                |    RpV'       g2   \        V R4      p\        P                  ! V\        P                  4       V# )zCreate a blocking lockfileNw)rJ   r3  lockfLOCK_EX)lockfiledryrunlocks   && r   create_lockr  L  s-    DHc"D%--(Kr   c                    V f   R#  \         P                  ! V \         P                  4       V P                  4        R#   \         d     R# i ; i)z(Free lockfile created with create_lock()N)r3  r  LOCK_UNrP   r   )r  s   &r   release_lockr  U  s>    |D%--(

  	s   5? AA)r
   r   r   espahr   grevrrp)r   r  r  r   r  r  )r   )Tr   )NT)F)z/run/ufw.lockF)I__doc__
__future__r   r|  r{  rV   r3  r   r   r^   r#   rf   r   r   rp   rY   	functoolsr   tempfiler   r   r   rX   supported_protocolsr   ipv4_only_protocolsr   r   r+   r0   r/   r8   rG   rL   rQ   rd   rl   rz   r   r   r   r"   rZ   r   rA   r   r   r   getpidr   r   r'   r.   r>   r   r@   r   r   r  r  r  r'  r7  r=  rM  rc  rh  r!  rw  r  r  r  r   r   r   <module>r     sr   (" &     	  	 	     
  $	
 Q A v& 4(42F	4n

LG2%	&* JJ 
H 99; . ))+ !N	2$\: (F7(t,#h	$6r#L*@,^"J,^& FP
r   