
^Oc           @   s   d  Z  d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m	 Z	 m
 Z
 m Z d d l m Z m Z m Z m Z m Z d d l Z d e j j f d     YZ d S(   s-   backend_iptables.py: iptables backend for ufwiN(   t   UFWErrort   UFWRulet
   config_dirt	   state_dir(   t   warnt   debugt   msgt   cmdt   cmd_pipet   UFWBackendIptablesc           B   s   e  Z d  Z d   Z d   Z d   Z d   Z e e d  Z d   Z	 d   Z
 d   Z d	   Z d
   Z d   Z d   Z e d  Z e d  Z d   Z e d  Z d   Z d   Z d   Z RS(   s   Instance class for UFWBackendc         C   s  d t  j j d |  _ i  } t j j t d  | d <t j j t d  | d <t j j t d  | d <t j j t d	  | d
 <t j j t d  | d <t j j t d  | d <t j j t d  | d <t  j	 j
 j |  d | |  i g  d 6g  d 6g  d 6g  d 6|  _ x d d g D] } d } | d k r`|  j   rK| | 7} q`| d k r`qq`n  xX d d d g D]G } x> d d d g D]- } d | | | f } |  j | j |  qWqpW|  j d j | d  |  j d j | d  qWd d  d! d" d# d$ d% d& g |  _ d' |  _ d( S()   s!   UFWBackendIptables initializations   # s
   _comment #s
   user.rulest   ruless   ufw/before.rulest   before_ruless   ufw/after.rulest   after_ruless   user6.rulest   rules6s   ufw/before6.rulest   before6_ruless   ufw/after6.rulest   after6_ruless   ufw-initt   initt   iptablest   beforet   usert   aftert   misct   4t   6t   ufwt   inputt   outputt   forwards   %s-%s-logging-%ss   -logging-denys   -logging-allows   ufw-user-limits   -mt   limits   --limits   3/minutes   -jt   LOGs   --log-prefixs   [UFW LIMIT BLOCK]N(   R   t   commont   programNamet   comment_strt   ost   patht   joinR   R   t   backendt
   UFWBackendt   __init__t   chainst   use_ipv6t   appendt   ufw_user_limit_logt   ufw_user_limit_log_text(   t   selft   dryrunt   filest   vert   chain_prefixt   loct   targett   chain(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR&       s8    %		c         C   sz   t  d  } |  j d d k r, | d 7} nJ |  j d d k rL | d 7} n* |  j d d k rl | d 7} n
 | d	 7} | S(
   s   Get current policys   New profiles:t   default_application_policyt   accepts    allowt   drops    denyt   rejects    rejects    skip(   t   _t   defaults(   R,   t   rstr(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   get_default_application_policyE   s    
c      
   C   s  |  j  s| d k rL | d k rL | d k rL t d  | } t |   n  | d k r | d k r t d  | } t |   n  d } | d k r d	 } n  d
 } d
 } | d k r y" |  j |  j d d | d  Wn t k
 r   n Xd } d } n | d k rRy" |  j |  j d d | d  Wn t k
 rB  n Xd } d } nE y" |  j |  j d d | d  Wn t k
 r  n Xd } d } t j d
 |  } x |  j d |  j d g D] } y t j	 j
 |  }	 Wn t k
 r  n X|	 d }
 xV |	 d D]J } | j |  rDt j	 j |
 | j | |   qt j	 j |
 |  qWy t j	 j |	  Wqt k
 r  qXqWn  t d  i | d 6| d 6} | t d  7} | S(   s   Sets default policy of firewallt   allowt   denyR7   s   Unsupported policy '%s't   incomingt   outgoings%   Unsupported policy for direction '%s't   INPUTt   OUTPUTt    R9   s   DEFAULT_%s_POLICYs   "ACCEPT"s	   UFW BLOCKs	   UFW ALLOWs   "REJECT"s   "DROP"R   R   t   tmpt   origs5   Default %(direction)s policy changed to '%(policy)s'
t	   directiont   policys*   (be sure to update your rules accordingly)(   R-   R8   R    t   set_defaultR.   t	   Exceptiont   ret   compileR   t   utilt
   open_filest   searcht   write_to_filet   subt   close_files(   R,   RF   RE   t   err_msgR3   t   old_log_strt   new_log_strt   patt   ft   fnst   fdt   lineR:   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   set_default_policyS   st    	$				!
"	c         C   s  |  j  r1 d t d  } | d t d  7} | Sd d d d g } g  } g  } | d k r | j d	  d
 d d d g } d
 d d g } n| d k r}x9 d d d g D]( } | j d |  | j d |  q Wx? d d d d d g D]( } | j d |  | j d |  q Wx6 d d g D]( } | j d |  | j d |  q#Wxd d d g D] } | j d |  q_Wn| d k rxd d d g D]( } | j d |  | j d |  qWns| d k r-x9 d d d g D]( } | j d |  | j d |  qW| j d   | j d!  n| d" k rxx d d d g D]( } | j d# |  | j d$ |  qIWn | d% k r;x} d d d g D]l } | j d& |  | j d' |  | j d( |  | j d) |  | j d* |  | j d+ |  qW| j d,  | j d-  | j d.  | j d/  n  d0 | } x | D] } d1 | k r| j d1  \ }	 } | d2 |	 7} t |  j g | | d	 |	 g  \ }
 } n# t |  j g | | g  \ }
 } | | 7} | d k r| d3 7} n  |
 d4 k rLt |   qLqLW| d k s*|  j   r| d5 7} x | D] } d1 | k r| j d1  \ }	 } | d2 |	 7} t |  j g | | d	 |	 g  \ }
 } n# t |  j g | | g  \ }
 } | | 7} | d k r| d3 7} n  |
 d4 k r;t |   q;q;Wn  | S(6   s'   Show current running status of firewalls   > s   Checking raw iptables
s   Checking raw ip6tables
s   -ns   -vs   -xs   -Lt   raws   -tt   filtert   natt   manglet   builtinsR@   t   FORWARDRA   s	   filter:%st
   PREROUTINGt   POSTROUTINGs	   mangle:%ss   raw:%ss   nat:%sR   R   R   R   s   ufw-before-%ss   ufw6-before-%sR   s   ufw-user-%ss   ufw6-user-%ss   ufw-user-limit-accepts   ufw-user-limitR   s   ufw-after-%ss   ufw6-after-%st   loggings   ufw-before-logging-%ss   ufw6-before-logging-%ss   ufw-user-logging-%ss   ufw6-user-logging-%ss   ufw-after-logging-%ss   ufw6-after-logging-%ss   ufw-logging-allows   ufw-logging-denys   ufw6-logging-allows   ufw6-logging-denys   IPV4 (%s):
t   :s   (%s) s   
i    s   

IPV6:
(	   R-   R8   R)   t   splitR   R   R    R(   t	   ip6tables(   R,   t
   rules_typet   outt   argst   itemst   items6t   ct   bt   it   tt   rcRC   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   get_running_raw   s    	
,#

,#
c   !      C   s  d } |  j  rF d t d  } |  j   rB | d t d  7} n  | St d  } x d d g D] } t |  j d d	 | d
 g  \ } } | d k r t d  S| d k r t | d |   n  |  j   r_ t |  j d d | d
 g  \ } } | d k rt | d   qq_ q_ Wd } d }	 |  j |  j }
 d } i  } x|
 D]} d } i  } d } t	 } | r| j
 d k s| j d k rt } | j   } | j |  rt d |  qIqt	 | | <n  xd d g D]} d | | <d } d } | d k r\| j } | rP| j
 d k rP| j
 } | j rY| d k rY| d 7} qYq| j } nV | j } | r| j d k r| j } | j r| d k r| d 7} qn	 | j } | d k r| d k r| | | <n  | d k r)| | d k r | | | <n | | c d | 7<| rC| j d k rC| | c d | j 7<n  | r)| d k r| j
 d k r| | c d | j
 7<| j r| d k r| | c d 7<n  | | c d 7<n  | d k r&| j d k r&| | c d | j 7<| j r| d k r| | c d 7<n  | | c d 7<q&q)n  | d k r| d k sM| d k rd | | <| r| j d k r| j | j k r| j | j k r| | c d | j 7<n  | d k r| | c d 7<qq| r| j d k r| j | j k r| | c d | j 7<qn  | d k rE| j d k rE| | c d | j 7<n  | d k r| j d k r| | c d | j 7<qqWg  } d } | j s| j j   d k r| j r| j | j j    n  | r| j d k r| j | j  n  t |  d k rd d  j |  } qn  | r4| d! | 7} n  | j j   } | j d" k ri| ri| rid } n  | d# | d d j | j j   | g  | d | f 7} | r| | 7} n& | j d k r|	 | 7}	 n
 | | 7} | d 7} qIW| d k s|	 d k r^d$ } | r| d% 7} n  t d&  } t d'  } t d(  } d) | j  d* d+  | j  d* d+  | j  d* d+  f } | r| d% 7} n  | d) d, t | j  d* d+   d, t | j  d* d+   d, t | j  d* d+   f 7} | | j! d* d+  7} | d k r| | 7} n  | d k r<|	 d k r<| t d-  7} n  |	 d k rU| |	 7} n  | } n  | r|  j"   \ } } t d.  i |  j#   d" 6|  j# d  d 6} |  j$   }  t d/  i | d0 6| d1 6|  d2 6| d3 6St d4  | Sd5 S(6   s   Show ufw managed rulesRB   s   > s   Checking iptables
s   Checking ip6tables
s   problem runningR   R   s   -Ls   ufw-user-%ss   -ni   s   Status: inactivei    s    iptables: %s
s   ufw6-user-%ss
    ip6tabless   Skipping found tuple '%s't   dstt   srcs   ::/0s    (v6)s	   0.0.0.0/0t   anyt    t   /s    (%st   )t   Anywheres    on %sRg   s    (%s)s   , s   [%2d] t   ins   %-26s %-12s%s%s
s   

s        t   Tot   Fromt   Actions   %-26s %-12s%s
s   utf-8t   ignoret   -s   
s.   Default: %(in)s (incoming), %(out)s (outgoing)s0   Status: active
%(log)s
%(pol)s
%(app)s%(status)st   logt   polt   appt   statuss   Status: active%sN(%   R-   R8   R(   R   R   R    Re   R
   R   t   Truet   dappt   sappt   Falset   get_app_tuplet   has_keyR   Rq   t   v6t   dportRr   t   sportt   protocolt   interface_int   interface_outt   logtypeRE   t   lowerR)   t   lenR#   t   uppert   actiont   decodet   encodet   get_loglevelt   _get_default_policyR;   (!   R,   t   verboset
   show_countRg   RQ   RE   Ro   t   out6t   st   str_outR
   t   countt	   app_rulest   rt   tmp_strt   locationt   tuplt
   show_protoR1   t   portRC   t   attribst
   attrib_strt   dir_strt   full_strt   str_tot   str_fromt
   str_actiont   rules_headert   levelt   logging_strt
   policy_strt   app_policy_str(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt
   get_status   s$   	
%
					
$			
!			c         C   sx   t  d  } |  j r, t d t  d   nH t |  j d d g  \ } } | d k rt t |  t | d   n  d S(	   s   Stop the firewalls   problem runnings   > s   running ufw-initR   s
   force-stopi    s	    ufw-initN(   R8   R-   R   R   R.   R   R    (   R,   RQ   Ro   Rg   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   stop_firewall  s    	
c         C   s+  t  d  } |  j r, t d t  d   n t |  j d d g  \ } } | d k rt t |  t | d   n  |  j j d  s |  j d |  j	 j
   k r y |  j d	  Wq't k
 r t  d
  } t |   q'XnD y |  j |  j d  Wn) t k
 r&t  d  } t |   n Xd S(   s   Start the firewalls   problem runnings   > s   running ufw-initR   t   starti    s	    ufw-initt   loglevelt   lows   Could not set LOGLEVELs   Could not load logging rulesN(   R8   R-   R   R   R.   R   R    R9   R   t	   loglevelst   keyst   set_loglevelRH   t   update_logging(   R,   RQ   Ro   Rg   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   start_firewall  s&    	
c      	   C   s   |  j  r t Sd } |  j } | r4 d } |  j } n  x d d d d d g D]j } | rt | d k sJ | d k rt qJ n  t | d d	 | d
 | g  \ } } | d k rJ t d  t SqJ Wt S(   s   Check if all chains existR   t   ufw6R   R   R   R   s   limit-accepts   -ns   -Ls   -user-i    s   _need_reload: forcing reload(   R-   R   R   Re   R   R   R   (   R,   R   t   prefixt   exeR3   Ro   Rg   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   _need_reload  s    		&
c         C   sY  t  d  } |  j r; t d  |  j   rUt d  qUn|  j   rUyH xA |  j d D]2 } |  j | d | g  |  j | d | g  qX WWn t k
 r t |   n Xt	 d |  j
 d g |  j d	 g  \ } } | d
 k r t | d   n  |  j   rUt	 d |  j
 d g |  j d	 g  \ } } | d
 k rRt | d   qRqUn  d S(   s   Reload firewall rules files   problem runnings   > | iptables-restores   > | ip6tables-restoreR   s   -Fs   -Zt   catR
   s   -ni    s	    iptablesR   s
    ip6tablesN(   R8   R-   R   R(   t
   is_enabledR'   t
   _chain_cmdRH   R    R   R.   t   iptables_restoret   ip6tables_restore(   R,   RQ   Rk   Ro   Rg   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   _reload_user_rules  s*    	
c         C   s,  g  } t  j d  } t  j d  } t  j d  } | j |  r | j |  r | j |  r | j | j d | j d |    n | j | j d |   | j | j d |   q | j | j d |   n | j |  t  j d  } t  j d	  }	 t  j d
  }
 d } xVt |  D]H\ } } | j |  r&| j d |  j   } | j   d k rtd } n! | j   d k rd } n d } d | | f } |	 j |  sd | } n  | j d |  | | <| j | | j d | d | |   | j | |
 j d | d | | j d |    | j | |
 j d | d | | j d | |    q&q&Wt  j d  } x t |  D] \ } } | j |  r| j d |  } | j d d d | d |  } | j d | d  |  } | | | <| j | |  | j | |  qqW| S(!   s5   Return list of iptables rules appropriate for sendings   -p all s   port s   -j (REJECT(_log(-all)?)?)s   -p tcp s   -j \1 --reject-with tcp-resets   -p udp RB   s   (.*)-j ([A-Z]+)_log(-all)?(.*)s   -j [A-Z]+_log-alls   (-A|-D) ([a-zA-Z0-9\-]+)s'   -m limit --limit 3/min --limit-burst 10s   \2R5   t   ALLOWR   t   LIMITt   BLOCKs"   %s -j LOG --log-prefix "[UFW %s] "s   -m state --state NEW s	   \1-j \2\4s   \1-j s   -user-logging-s   \1 s   \1-j RETURNs   \1s	    -j LIMITs%    -m state --state NEW -m recent --sets    -m state --state NEW -m recents#    --update --seconds 30 --hitcount 6s    -j s   -user-limits   -user-limit-accept(	   RI   RJ   RM   R)   RO   t	   enumeratet   stripR   t   insert(   R,   t   fruleR   t   suffixt   snippetst	   pat_protot   pat_portt
   pat_rejectt   pat_logt
   pat_logallt	   pat_chaint
   limit_argsRm   R   RF   t   lstrt	   pat_limitt   tmp1t   tmp2t   tmp3(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   _get_rules_from_formatted  sh    			
	!		
c   	      C   s   g  } |  j  | | |  } t j d  } x t |  D] \ } } | j | j d |  j    | j |  r7 | | j d  | | j | j d |  j d d   | | c | j d |  j   7<q7 q7 W| S(   s_   Return list of iptables rules appropriate for sending as arguments
           to cmd()
        s   (.*) --log-prefix (".* ")(.*)s   \1s   --log-prefixs   \2t   "RB   s   \3(	   R   RI   RJ   R   R)   RO   Rd   t   matcht   replace(	   R,   R   R   R   R   t   str_snippetsRT   Rm   R   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   _get_lists_from_formattedF  s    ))c         C   s-  |  j  d g } |  j   r3 | j |  j  d  n  x| D]} y t j j |  } Wn- t k
 r t d  | } t |   n Xt	 j
 d  } x| D]{} | j |  r | j d |  } t	 j d | j    } t |  d k  s t |  d k rt d	  | }	 t |	  q qd
 }
 d } t |  d k sOt |  d k rd | d k r{| d j d  \ }
 } q| d }
 n  yt |  d k  rt | d | d | d | d | d | d |
  } n t | d | d | d | d | d | d |
  } t	 j
 d  } | d d k rG| j d | d  | _ n  | d d k rs| j d | d  | _ n  | d k r| j |
 |  n  Wn. t k
 rt d  | } t |  q n X| |  j  d k r| j t  |  j j |  q| j t  |  j j |  q q W| j   q: Wd S(   s$   Read in rules that were added by ufwR
   R   s   Couldn't open '%s' for readings   ^### tuple ###\s*RB   s   \s+i   i	   s)   Skipping malformed tuple (bad length): %sRx   i   R8   ii   i    i   i   i   i   i   s   %20R}   Rt   s   Skipping malformed tuple: %sN(   R.   R(   R)   R   RK   t   open_file_readRH   R8   R    RI   RJ   R   RO   Rd   R   R   R   R   R   R   t   set_interfacet   set_v6R   R   R   R
   t   close(   R,   t   rfnsRU   RD   RQ   t	   pat_tupleRX   R   RC   t   wmsgt   dtypet	   interfacet   rulet	   pat_spacet   warn_msg(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   _read_rulesX  sb    $	
$	
c         C   s  |  j  d } | r# |  j  d } n  t j | t j  sW t d |  } t |   n  y t j j |  } Wn t	 k
 r   n Xd } |  j
 } | r d } |  j } n  |  j r t j j   } n
 | d } t j j | d  t j j | d | d	  t j j | d | d
  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  t j j | d | d  | d k rt j j | d | d  t j j | d | d  n  t j j | d  xQ| D]I} | j }	 | j d k r|	 d | j 7}	 n  | j d k r| j d k rd |	 | j | j | j | j | j | j f }
 | j d k r`|
 d | j 7}
 n  | j d k r|
 d | j 7}
 n  t j j | |
 d  n t j d  } d  } | j r| j d! | j  } n  d  } | j r| j d! | j  } n  d" |	 | j | j | j | j | j | | | j f	 }
 | j d k rT|
 d | j 7}
 n  | j d k rw|
 d | j 7}
 n  t j j | |
 d  d# } | j d$ k rd% } n  d& | | f } d' | | j    f } x0 |  j! | | |  D] } t j j | |  qWqWt j j | d(  t j j | d)  y |  j" |  j# d*  } Wn t	 k
 r_  n Xx | D] \ } } } t$ |  d+ k r| d+ d, k rqgn  | j% | d   rgt j j | d j& |  j' d- d.  j' d/ d0  d  qgqgWt j j | d1  | d k rt j j | d2  |  j# d* d3 k rjt j j | d4 d j& |  j(  d5 |  j) d6  n  t j j | d4 | d7  t j j | d4 | d8  t j j | d9  n  t j j | d:  y3 |  j rt j j* | t+  n t j j* |  Wn t	 k
 r  n Xd; S(<   s.   Write out new rules to file to user chain fileR
   R   s   '%s' is not writableR   R   RC   s   *filter
Rc   s   -user-input - [0:0]
s   -user-output - [0:0]
s   -user-forward - [0:0]
s   -before-logging-input - [0:0]
s   -before-logging-output - [0:0]
s    -before-logging-forward - [0:0]
s   -user-logging-input - [0:0]
s   -user-logging-output - [0:0]
s   -user-logging-forward - [0:0]
s   -after-logging-input - [0:0]
s   -after-logging-output - [0:0]
s   -after-logging-forward - [0:0]
s   -logging-deny - [0:0]
s   -logging-allow - [0:0]
s   -user-limit - [0:0]
s   -user-limit-accept - [0:0]
s   ### RULES ###
RB   R8   s#   
### tuple ### %s %s %s %s %s %s %ss   _%ss   
Rt   R}   s   %20s)   
### tuple ### %s %s %s %s %s %s %s %s %sR   Rg   R   s
   %s-user-%ss	   -A %s %s
s   
### END RULES ###
s   
### LOGGING ###
R   i    s   -Dt   [s   "[s   ] s   ] "s   ### END LOGGING ###
s   
### RATE LIMITING ###
t   offs   -A s    "s    "
s   -user-limit -j REJECT
s   -user-limit-accept -j ACCEPT
s   ### END RATE LIMITING ###
s   COMMIT
N(,   R.   R!   t   accesst   W_OKR8   R    R   RK   RL   RH   R
   R   R-   t   syst   stdoutt   filenoRN   R   R   R   R   R   R   Rq   R   Rr   RE   R   R   RI   RJ   RO   t   format_ruleR   t   _get_logging_rulesR9   R   t
   startswithR#   R   R*   R+   RP   R   (   R,   R   t
   rules_fileRQ   RV   R0   R
   RW   R   R   t   tstrR   R   R   t   chain_suffixR3   t   rule_strR   t   lrules_tRk   t   q(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   _write_rules  s    		
	!		!	"$)	c         C   s  d } | j  rY |  j   s6 t d  } t |   n  | j d k rY t d  | j Sn  | j r | j d k r | j d k r t d  } t |   n  g  } t } t } |  j } | j	 }	 | j  r|  j
 d k  r | j d k s | j d k r t d	  S|  j } n  |	 d
 k  s)|	 t |  k rHt d  |	 } t |   n  |	 d
 k rx| j rxt d  } t |   n  |	 t |  k rt d  |	 } t |   n  y | j   Wn t k
 r  n Xd }
 t } d
 } d/ } x| D]} y | j   Wn t k
 r  n X| j | j | j | j f } |
 |	 k r| d d k rn| d d k rn|
 d k s| d d k r| d d k s| | k rt } | j | j    d0 } q|	 d 7}	 n  | } |
 d 7}
 t j | |  } | d k  r| d 7} n  | d
 k rF| rF| rFt } | j s| j | j    qq| d
 k  r| j r| rt } t } | j | j    q| j |  qW| r| d
 k rut d  } | j  r| d 7} n  | Sn | r| j r| j | j    n  | r8| j r8|  j r8t d  } | j  r4| d 7} n  | S| ru| j ru| rut d  } | j  rq| d 7} n  | S| j  r| |  _ n	 | |  _ y |  j | j   Wn: t k
 r  n' t k
 rt d  } t |  n Xt d  } | j  rt d  } n  |  j   r|  j rd } | sB|  j | j   sB| rd } | ra| t d  7} n | t d  7} | j  r| d 7} n  | ry |  j   Wqt k
 r  qXq| t d  7} nQ | r| j rd } t d  } n- | r| r| j rd } t d  } n  | d k r|  j } d } | j  rY|  j } d  } | d 7} n  d! } | j  d" k rwd# } n  d$ | | f } t d%  } t! | d& | d' g  \ } } | d
 k rt |   n  d( | | | j"   f } t# j$ d)  } x |  j% | | |  D] } t! | g |  \ } } | d
 k rRt& | t' j(  t |  n  | d k r
| j) d* j* |   r
| j+ d+ d* j* |   } t! | d | d, d- g  \ } } | d
 k rt, d. |  qq
q
Wqn  | S(1   sX  Updates firewall with rule by:
        * appending the rule to the chain if new rule and firewall enabled
        * deleting the rule from the chain if found and firewall enabled
        * inserting the rule if possible and firewall enabled
        * updating user rules file
        * reloading the user rules file if rule is modified
        RB   s)   Adding IPv6 rule failed: IPv6 not enabledR   s#   Skipping unsupported IPv6 '%s' rulet   udpt   tcps/   Must specify 'tcp' or 'udp' with multiple portss   1.4s:   Skipping IPv6 application rule. Need at least iptables 1.4i    s   Invalid position '%d's    Cannot specify insert and deletes#   Cannot insert rule at position '%d'i   i   i   s    Skipping inserting existing rules    (v6)s"   Could not delete non-existent rules   Skipping adding existing rules   Couldn't update rules files   Rules updateds   Rules updated (v6)s   Rule inserteds   Rule updateds    (skipped reloading firewall)s   -Ds   Rule deleteds   -As
   Rule addedR   R   R   Rg   R   s
   %s-user-%ss!   Could not update running firewalls   -Ls   -ns   %s %s %ss   (-A +)(ufw6?-user-[a-z\-]+)(.*)Rt   s   \2s   -jt   RETURNs   FAILOK: -D %s -j RETURN(   RB   RB   RB   RB   (   RB   RB   RB   RB   (-   R   R(   R8   R    R   t   multiR   R   R
   t   positiont   iptables_versionR   R   R   R   t   removet	   normalizeRH   Rq   Rr   R   R)   t   dup_ruleR   R   R-   R   R   R   R   R   Re   RE   R   R   RI   RJ   R   R   R   t   stderrRM   R#   RO   R   (   R,   R   t   allow_reloadR:   RQ   t   newrulest   foundt   modifiedR
   R  R   t   insertedt   matchest   lastR   t   currentt   rett   flagR   R0   R   R3   Ro   Rg   R   R   R   Rk   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   set_rule/  s&   	'			
, 	
								
				$!c   
      C   s   g  } g  } | r |  j  } n	 |  j } | j   } | j |  | j   | j   } xL | D]D } | j   } | j   | j   }	 |	 | k r] | j |  q] q] W| S(   s@   Return a list of UFWRules from the system based on template rule(   R   R
   R  R   R  R   R)   (
   R,   t   templateR   R
   R   t   normR   R   RC   t	   tmp_tuple(    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   get_app_rules_from_system  s     	

c         C   s   |  j  } | j d  r$ |  j } n  t | g |  \ } } | d k r t d  | } | rp t d |  q t |   n  d S(   s   Perform command on chainR   i    s   Could not perform '%s's   FAILOK: N(   R   R   Re   R   R8   R   R    (   R,   R3   Rh   t   fail_okR   Ro   Rg   RQ   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR     s    	c         C   s  |  j  r d Sg  } y |  j |  } Wn t k
 r<   n Xy$ |  j d t  |  j d t  Wn: t k
 rw   n' t k
 r t d  } t |  n X|  j   s d St d  } xs |  j	 d |  j	 d |  j	 d |  j	 d D]C } y |  j
 | d	 | d
 g  Wq t k
 r+t |   q Xq Wy^ xW |  j	 d |  j	 d |  j	 d D]2 } |  j
 | d | g  |  j
 | d | g  qWWWn t k
 rt |   n Xx | D] \ } } } t } t |  d k r| d d k rt } n  yY | d k r:t |  d k r:|  j
 | d g | d d t n  |  j
 | | |  Wqt k
 rmt |   qXqW|  j
 d d g |  j |  j d g d t |  j d d k r|  j
 d d g |  j |  j d g d t n  d S(   s#   Update loglevel of running firewallNR   s&   Couldn't update rules file for loggings!   Could not update running firewallR   R   R   R   s   -Ls   -ns   -Fs   -Zi    s   -Dt   delete_firsti   R  s   ufw-user-limitRt   R   R   s   -I(   R-   R   RH   R   R   R   R    R8   R   R'   R   R   R*   R+   R9   (   R,   R   t   rules_tRQ   Rk   R   R   R  (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR   !  sb    	2"	$	c   	      C   s  g  } | |  j  j   k r: t d  | } t |   n  | d k r x7 |  j d D]( } | j | d | d d g d g  qT W| Sx7 |  j d D]( } | j | d | d d g d	 g  q Wd
 d d d d d g } |  j  | |  j  d k r2g  } |  j  | |  j  d k  r| } n  x |  j d D] } x d d d g D] } | j |  r=|  j |  d k s||  j |  d k rd } | j | d | d d d | g | d	 g  q|  j  | |  j  d k rd } | j | d | d d d | g | d	 g  qq=q=Wq'Wg  } |  j  | |  j  d k  r4| } n  x |  j d D] } | j d  r`d } n | j d  rd } |  j  | |  j  d k  r| j | d | d
 d  d! d" d d g | d	 g  q| j | d | d
 d  d! d" d d d d# g
 | d	 g  n  | j | d | d d d | g | d	 g  qBWn  |  j  | |  j  d k rg  } |  j  | |  j  d$ k  ru| } n  |  j  | |  j  d k  rd
 d  d! d% g | } n  d& } xD |  j d' D]2 } | j | d | d d d | g | d	 g  qWn  | S((   s%   Get rules for specified logging levels   Invalid log level '%s'R   R   s   -Is   -jR   R  s   -DRB   s   -mR   s   --limits   3/mins   --limit-burstt   10R   t   highR   R   R   R   R7   R=   s   [UFW BLOCK] s   -AR   s   --log-prefixt   mediums   [UFW ALLOW] R   R<   t   states   --statet   INVALIDs   [UFW AUDIT INVALID] t   fullt   NEWs   [UFW AUDIT] R   (   R   R   R8   R    R'   R)   t   endswithR   (	   R,   R   R  RQ   Rk   R   t   largsRn   R   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR   d  sx    &&						c         C   s  d } g  } x |  j  D] } |  j  | j d  s8 q n  | j |  j  |  t j j t j j d t j j	 |  j  |   } t j j
 |  s t d  | } t |   q q Wt j d  } xO | D]G } d | | f } t j j |  r t d  | } t |   q q Wx\ | D]T } d | | f } | t d  i t j j	 |  d	 6| d
 67} t j | |  qWx| D] } d | | f } t j t j j t j j d t j j	 |   t j j |   t j | |  y  t j |  } | t j }	 Wn. t k
 r/t d  | }
 t |
  qyn X|	 t j @rT| t d  | 7} qy|	 t j @ry| t d  | 7} qyqyW| S(   s   Reset the firewallRB   s   .rulesR   s   Could not find '%s'. Abortings   %Y%m%d_%H%M%Ss   %s.%ss   '%s' already exists. Abortings"   Backing up '%(old)s' to '%(new)s'
t   oldt   news   Couldn't stat '%s's   WARN: '%s' is world writables   WARN: '%s' is world readable(   R.   R   R)   R!   R"   R#   R   R   t	   share_dirt   basenamet   isfileR8   R    t   timet   strftimet   existst   renamet   shutilt   copyt   dirnamet   copymodet   statt   ST_MODERH   R   t   S_IWOTHt   S_IROTH(   R,   t   rest   allfilesRm   t   fnRQ   t   extR"  t   statinfot   modeR   (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   reset  sP    "
(   t   __name__t
   __module__t   __doc__R&   R;   RY   Rp   R   R   R   R   R   R   R   R   R   R   R   R  R  R   R   R   R9  (    (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyR	      s(   	%		H	V					D		?		C	Z(   R<  R!   RI   R+  R/  R   R'  t
   ufw.commonR    R   R   R   t   ufw.utilR   R   R   R   R   t   ufw.backendR   R$   R%   R	   (    (    (    s8   /usr/lib/python2.7/dist-packages/ufw/backend_iptables.pyt   <module>   s   "(