
^Oc           @   s   d  Z  d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m	 Z	 d d l
 m Z m Z m Z m Z d d l Z d d d     YZ d S(   s&   backend.py: interface for ufw backendsiN(   t   warnt   debug(   t   UFWErrort
   config_dirt   iptables_dirt   UFWRulet
   UFWBackendc           B   s  e  Z d  Z d d  Z d   Z d   Z d d  Z d   Z d   Z	 d   Z
 d	   Z d
   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z RS(   s   Interface for backendsc         C   s  d  |  _ | |  _ | |  _ g  |  _ g  |  _ i t j j t	 d  d 6t j j t	 d  d 6t j j t	 d  d 6|  _
 | d  k r |  j
 j |  n  i d d 6d	 d
 6d d 6d d 6d d 6|  _ t |  _ y" |  j   |  j   |  j   Wn t k
 r  n Xt j j |  j
 d  |  _ t j j t d  |  _ t j j t d  |  _ t j j t d  |  _ t j j t d  |  _ t j j |  j  |  _ d  S(   Ns   default/ufwt   defaultss   ufw/ufw.conft   confs   ufw/applications.dt   appsi    t   offid   t   lowi   t   mediumi,  t   highi  t   fullt   iptabless   iptables-restoret	   ip6tabless   ip6tables-restore(   t   NoneR   t   namet   dryrunt   rulest   rules6t   ost   patht   joinR   t   filest   updatet	   loglevelst   Truet	   do_checkst
   _do_checkst   _get_defaultst   _read_rulest	   Exceptiont   ufwt   applicationst   get_profilest   profilesR   R   t   iptables_restoreR   t   ip6tables_restoret   utilt   get_iptables_versiont   iptables_version(   t   selfR   R   t   extra_files(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   __init__   s:    					
	

c         C   s-   |  j  j d  r) |  j  d d k r) t St S(   s!   Is firewall configured as enabledt   enabledt   yes(   R   t   has_keyR   t   False(   R+   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt
   is_enabledC   s    c         C   s?   |  j  j d  r; |  j  d d k r; t j j d  r; t St S(   s"   Is firewall configured to use IPv6t   ipv6R/   s   /proc/sys/net/ipv6(   R   R0   R   R   t   existsR   R1   (   R+   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   use_ipv6J   s
    t   inputc         C   sr   d | d } d } |  j  | d k r0 d } n> |  j  | d k rL d } n" |  j  | d k rh d } n d	 } | S(
   s.   Get default policy for specified primary chaint   default_t   _policyt    t   acceptt   allowt   accept_no_tracks   allow-without-trackingt   rejectt   deny(   R   (   R+   t   primaryt   policyt   rstr(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   _get_default_policyR   s    			c      	   C   s  |  j  s# t d  } t |  t St j   t j   k rV t d  } t |   n  t j   t j	   k r t d  } t |   n  t j   } | d k r t d  } t |   n  i  } i  } i  } g  } t j
 j |  j d  st d  |  j d } t |  ne t j d  } xS t j |  j d  D]; }	 | j |	  s7| j t j
 j |  j d |	   q7q7Wx|  j j   t j
 j t j d  g | D]}
 xt rt d	 |
  |
 |  j d k rt j
 j |  j d  rPn  y  t j |
  } | t j } Wn@ t k
 rAt d
  |
 } t |   n t k
 rT  n X| j d k r| j |
  rt d  i t |  d 6|
 d 6t | j  d 6} t |  t | |
 <n  | t j @r| j |
  rt d  |
 } t |  t | |
 <n  | t j  @rG| j |
  rGt d  |
 } t |  t | |
 <n  |
 d k rWPn  t j
 j! |
  }
 |
 st t" j# d |
   qqWqWxk |  j D]` } | d k rt j
 j$ |  j |  rt d  i | d 6|  j | d 6} t |   qqWd S(   s8  Perform basic security checks:
        is setuid or setgid (for non-Linux systems)
        checks that script is owned by root
        checks that every component in absolute path are owned by root
        warn if script is group writable
        warn if part of script path is group writable

        Doing this at the beginning causes a race condition with later
        operations that don't do these checks.  However, if the user running
        this script is root, then need to be root to exploit the race
        condition (and you are hosed anyway...)
        s   Checks disableds%   ERROR: this script should not be SUIDs%   ERROR: this script should not be SGIDi    s&   You need to be root to run this scriptR	   s   '%s' does not exists   ^\.s	   Checking s   Couldn't stat '%s's4   uid is %(uid)s but '%(path)s' is owned by %(st_uid)st   uidR   t   st_uids   %s is world writable!s   %s is group writable!t   /s   Could not find '%s's&   '%(f)s' file '%(name)s' does not existt   fR   N(%   R   t   _R    R   R   t   getuidt   geteuidR   t   getgidt   getegidR   t   isdirR   t   ret   compilet   listdirt   searcht   appendR   t   valuest   abspatht   syst   argvR   t   statt   ST_MODEt   OSErrorR!   RD   R0   t   strt   S_IWOTHt   S_IWGRPt   dirnamet   errnot   ENOENTt   isfile(   R+   t   err_msgRC   t   warned_world_writet   warned_group_writet   warned_ownerR%   t   warn_msgt   patt   profileR   t   statinfot   modeRF   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyR   b   s    	
*)		


!&	c   
      C   s  i  |  _  x |  j d |  j d g D] } y t j j |  } Wn- t k
 ro t d  | } t |   n Xt j	 d  } xb | D]Z } | j
 |  r t j d | j    } | d j   j d  |  j  | d j   <q q W| j   q$ Wd	 d
 d d g } x d d d g D] } |  j  j d |  sOt d |  } t |   n  |  j  d | }	 |	 | k s|	 d
 k r| d k rt d i |	 d 6| d 6 } t |   qqWd S(   s#   Get all settings from defaults fileR   R   s   Couldn't open '%s' for readings   ^\w+="?\w+"?t   =i   s   "'i    R:   R<   t   dropR=   R6   t   outputt   forwards   default_%s_policys   Missing policy for '%s's+   Invalid policy '%(policy)s' for '%(chain)s'R@   t   chainN(   R   R   R"   R(   t   open_file_readR!   RG   R   RM   RN   RP   t   splitt   stript   lowert   closeR0   (
   R+   RF   t   origR`   Re   t   linet   tmpt   policiest   ct   p(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyR      s0    	!1c   
      C   s  t  j d |  s- t d  } t |   n  t j | t j  sa t d |  } t |   n  y t j j	 |  } Wn t
 k
 r   n X| d } t } t  j d | d  } x\ | d D]P }	 | j |	  r t j j | | d | d  t } q t j j | |	  q W| s<t j j | | d | d  n  y t j j |  Wn t
 k
 rf  n X| j   j d	  |  j | j   <d
 S(   s   Sets option in defaults files   ^[\w_]+$s   Invalid options   '%s' is not writableRu   t   ^Ri   Rs   s   
s   "'N(   RM   t   matchRG   R   R   t   accesst   W_OKR"   R(   t
   open_filesR!   R1   RN   RP   t   write_to_fileR   t   close_filesRq   Rp   R   (
   R+   t   fnt   optt   valueR`   t   fnst   fdt   foundRe   Rt   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   set_default   s2    
	"c         C   sL  |  j  s8| d k rM y |  j |  j d d d  Wq5t k
 rI   q5Xq8| d k r y |  j |  j d d d  Wq5t k
 r   q5Xq8| d k r y |  j |  j d d d  Wq5t k
 r   q5Xq8| d	 k ry |  j |  j d d d
  Wq5t k
 r  q5Xq8t d  | } t |   n  t d  | } | S(   s+   Sets default application policy of firewallR;   R   t   DEFAULT_APPLICATION_POLICYs   "ACCEPT"R>   s   "DROP"R=   s   "REJECT"t   skips   "SKIP"s   Unsupported policy '%s's*   Default application policy changed to '%s'(   R   R   R   R!   RG   R   (   R+   R@   R`   RA   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   set_default_application_policy  sB    	



c         C   s  g  } |  j  j   } | j | k r8| j | k r8t j j |  j  | j  } t j j |  j  | j  } x8| D]} | j   } d | _ | j	 d d  y9 t j
 j |  \ } }	 | j |	  | j	 | d  Wn t k
 r   n X| j | _ | j | j k rd | _ y9 t j
 j |  \ } }	 | j |	  | j	 | d  Wn t k
 rc  n X| j | _ | j |  qr x | D] }
 | j   } d | _ y9 t j
 j |
  \ } }	 | j |	  | j	 | d  Wn t k
 r  n X| j d k r| j | j  n  | j | _ | j |  qWqr Wnn| j | k rx\t j j |  j  | j  D] } | j   } d | _ y9 t j
 j |  \ } }	 | j |	  | j	 | d  Wn t k
 r  n X| j | _ | j |  qdWn | j | k rx t j j |  j  | j  D] } | j   } d | _ y9 t j
 j |  \ } }	 | j |	  | j	 | d  Wn t k
 r  n X| j | _ | j |  qWn  t |  d k  rt d  } t |   n  | S(   s4   Return a list of UFWRules based on the template ruleR9   t   anyt   srct   dsti   s&   No rules found for application profile(   R%   t   keyst   dportt   sportR"   R#   t	   get_portst   dup_rulet   dappt   set_portR(   t   parse_port_protot   set_protocolR!   t   sappRQ   t   protocolt   lenRG   R   (   R+   t   templateR   t   profile_namest   dportst   sportst   iRu   t   portt   protot   jt   ruleRx   R`   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_app_rules_from_template+  s    			#	#	c         C   s  g  } g  } d } d } t  } xW|  j |  j D]E} | j | k sS | j | k rN| j   } | | k rq q/ qt| j   }	 |	 j d  |	 j d k r |	 j |	 j d  n  |	 j d k r |	 j |	 j d  n  y |  j	 |	  }
 Wn t
 k
 r   n Xx> |
 D]6 } | j   | j r.| j |  q| j |  qW| } t } q/ | j rg| j |  q/ | j |  q/ W| r| |  _ | |  _ | t d  | 7} y |  j t   |  j t  Wqt
 k
 rt d  } t |   qXn  | | f S(   s   Update rule for profile in place. Returns result string and bool
           on whether or not the profile is used in the current ruleset.
        R9   R   R   R   s   Rules updated for profile '%s's!   Couldn't update application rules(   R1   R   R   R   R   t   get_app_tupleR   R   R   R   R!   t	   normalizet   v6RQ   R   RG   t   _write_rulesR   (   R+   Rf   t   updated_rulest   updated_rules6t
   last_tupleRA   t   updated_profilet   rt   tuplR   t   new_app_rulest   new_rR`   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   update_app_rule~  sT    
					c         C   s   |  j  j |  r | Sd } d } xB |  j  j   D]1 } | j   | j   k r2 | } | d 7} q2 q2 Wd | | f } t |  | d k r | S| d k r t d  | } n  t d  | } t |   d S(   s2   Find the application profile name for profile_nameR9   i    i   s   '%d' matches for '%s's>   Found multiple matches for '%s'. Please use exact profile names&   Could not find a profile matching '%s'N(   R%   R0   R   Rq   R   RG   R   (   R+   t   profile_nameRz   t   matchest   nt	   debug_msgR`   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   find_application_name  s"    
	
c         C   s  | r' | t  |  j  k r' t    n  | rO | t  |  j  k rO t    n  | d k  rg t    n  g  } | r |  j } n	 |  j } i  } d } x t |  D]u \ } } | | k r Pn  d } | j d k s | j d k r | j   } | j |  r	| d 7} qt	 | | <q q Wg  } | rZ|  j } |  j | d | j
   }	 |	 j t  n1 |  j } |  j | d | j
   }	 |	 j t	  d }
 x4 | D], } t j | |	  d k r|
 S|
 d 7}
 qWd S(   s   Return the absolute position in the other list of the rule with the
	   user position of the given list. For example, find_other_position(4,
	   True) will return the absolute position of the rule in the ipv4 list
           matching the user specified '4' rule in the ipv6 list.
        i   i    R9   (   R   R   t
   ValueErrorR   t	   enumerateR   R   R   R0   R   R   t   set_v6R1   R   Rz   (   R+   t   positionR   R   t	   app_rulest   tuple_offsetR   R   R   t
   match_rulet   count(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   find_other_position  sF    			c         C   s   d } t  d  } |  j j d  sA |  j d |  j j   k rZ d } | t  d  7} nB |  j |  j d } | d k r | d 7} n | d |  j d 7} | | f S(   s"   Gets current log level of firewalli    s	   Logging: t   loglevelit   unknownR
   s   on (%s)(   RG   R   R0   R   R   (   R+   t   levelRA   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_loglevel  s    c         C   s   | |  j  j   d g k r; t d  | } t |   n  | } | d k r |  j j d  ss |  j d d k r| d } q |  j d } n  y+ |  j |  j d d |  |  j |  Wn t	 k
 r   n X| d k r t d  St d	  Sd
 S(   s   Sets log level of firewallt   ons   Invalid log level '%s'R   R
   R   R   t   LOGLEVELs   Logging disableds   Logging enabledN(
   R   R   RG   R   R   R0   R   R   t   update_loggingR!   (   R+   R   R`   t	   new_level(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   set_loglevel!  s"    	
c         C   s   |  j  |  j S(   s   Return list of all rules(   R   R   (   R+   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt	   get_rules:  s    c         C   s   g  } | r |  j  } n	 |  j } d } i  } xx | D]p } d } | j d k s^ | j d k r | j   } | j |  r t d |  q4 q t | | <n  | d 7} q4 W| S(   s/   Return number of ufw rules (not iptables rules)i    R9   s   Skipping found tuple '%s'i   (   R   R   R   R   R   R0   R   R   (   R+   R   R   R   R   R   R   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_rules_count>  s     	c         C   s   |  j    } d } i  } x | D] } d } | j d k sI | j d k r | j   } | j |  rx t d |  q q t | | <n  | t |  k r | S| d 7} q Wd S(   s:   Return rule specified by number seen via "status numbered"i   R9   s   Skipping found tuple '%s'N(	   R   R   R   R   R0   R   R   t   intR   (   R+   t   numR   R   R   R   R   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_rule_by_numberV  s    c         C   s\   g  } d } xI |  j    D]; } | d 7} | j |  } | d k  r | j |  q q W| S(   sm   See if there is a matching rule in the existing ruleset. Note this
           does not group rules by tuples.i    i   (   R   t   fuzzy_dst_matchRQ   (   R+   R   t   matchedR   R   t   ret(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_matchingl  s    
c         C   s   t  d   d S(   s*   Set default policy for specified directions/   UFWBackend.set_default_policy: need to overrideN(   R   (   R+   R@   t	   direction(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   set_default_policyz  s    c         C   s   t  d   d S(   s   Get status of running firewalls,   UFWBackend.get_running_raw: need to overrideN(   R   (   R+   t
   rules_type(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_running_raw~  s    c         C   s   t  d   d S(   s   Get managed ruless'   UFWBackend.get_status: need to overrideN(   R   (   R+   t   verboset
   show_count(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt
   get_status  s    c         C   s   t  d   d S(   s   Update firewall with rules%   UFWBackend.set_rule: need to overrideN(   R   (   R+   R   t   allow_reload(    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   set_rule  s    c         C   s   t  d   d S(   s   Start the firewalls+   UFWBackend.start_firewall: need to overrideN(   R   (   R+   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   start_firewall  s    c         C   s   t  d   d S(   s   Stop the firewalls*   UFWBackend.stop_firewall: need to overrideN(   R   (   R+   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   stop_firewall  s    c         C   s   t  d d   d S(   s%   Get a list if rules based on templates.   UFWBackend.get_app_rules_from_system: need to t   overrideN(   R   (   R+   R   R   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   get_app_rules_from_system  s    c         C   s   t  d   d S(   s#   Update loglevel of running firewalls+   UFWBackend.update_logging: need to overrideN(   R   (   R+   R   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyR     s    c         C   s   t  d   d S(   s   Reset the firewalls"   UFWBackend.reset: need to overrideN(   R   (   R+   (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   reset  s    N(   t   __name__t
   __module__t   __doc__R   R-   R2   R5   RB   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   R   (    (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyR      s8   %			]		'	'	S	A		<														(    (   R   R]   R   RM   RV   RT   t   ufw.utilR"   R    R   t
   ufw.commonR   R   R   R   t   ufw.applicationsR   (    (    (    s/   /usr/lib/python2.7/dist-packages/ufw/backend.pyt   <module>   s   "