
^Oc           @   s   d  Z  d d l Z d d l Z d d l Z d d l m Z d d l Z d d l m Z m	 Z	 d d l
 m Z d d l Z d   Z d   Z d d
 d	     YZ d S(   s'   frontend.py: frontend interface for ufwiN(   t   UFWError(   t   errort   warn(   t   UFWBackendIptablesc         C   s  t  j j   } x? d d d d d d d d g D] } | j t  j j |   q. Wx3 d	 d
 d d g D] } | j t  j j |   qd Wx9 d d d d d d g D] } | j t  j j |   q Wx0 d d d g D] } | j t  j j |   q Wx0 d* d d g D] } | j t  j j	 |   qWx< d d d d d d d g D] } | j t  j j
 |   qEWd d d d d  d! g } x' | D] } | j t  j j |   qWt |   d" k r#d# } |  | j   d$ k rd" } n  |  | j   d k r#|  | j   | k r#|  j | d%  q#n  t |   d" k  sSd$ |  k rpt |   d& k  rpt j d' IJt j d#  n  y | j |  d#  } WnT t k
 r} t j d( | j IJt j d#  n! t k
 rt j d) IJ  n X| S(+   sE   Parse command. Returns tuple for action, rule, ip_version and dryrun.t   enablet   disablet   helps   --helpt   versions	   --versiont   reloadt   resett   listt   infot   defaultt   updatet   ont   offt   lowt   mediumt   hight   fullt   allowt   denyt   rejectt   verboset   numberedt   raws   before-ruless
   user-ruless   after-ruless   logging-rulest   builtinst	   listeningt   limitt   insertt   deletei   i   s	   --dry-runt   rulei   s   ERROR: not enough argss	   ERROR: %ss   Invalid syntaxN(   t   ufwt   parsert	   UFWParsert   register_commandt   UFWCommandBasict   UFWCommandAppt   UFWCommandLoggingt   UFWCommandDefaultt   Nonet   UFWCommandStatust   UFWCommandShowt   UFWCommandRulet   lent   lowerR   t   syst   stderrt   exitt   parse_commandR    t   valuet	   Exception(   t   argvt   pt   it   rule_commandst   idxt   prt   e(    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyR1      sJ    	0c          C   s   t  d i t j j d 6d d 6d d 6d d 6d d 6d	 d
 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d  d  6d! d! 6d" d# 6d$ d% 6d& d' 6d( d) 6d* d* 6d+ d, 6d- d. 6d/ d0 6d1 d2 6d3 d4 6d5 d6 6 }  |  S(7   s   Print help messagesb  
Usage: %(progname)s %(command)s

%(commands)s:
 %(enable)-31s enables the firewall
 %(disable)-31s disables the firewall
 %(default)-31s set default policy
 %(logging)-31s set logging to %(level)s
 %(allow)-31s add allow %(rule)s
 %(deny)-31s add deny %(rule)s
 %(reject)-31s add reject %(rule)s
 %(limit)-31s add limit %(rule)s
 %(delete)-31s delete %(urule)s
 %(insert)-31s insert %(urule)s at %(number)s
 %(reset)-31s reset firewall
 %(status)-31s show firewall status
 %(statusnum)-31s show firewall status as numbered list of %(rules)s
 %(statusverbose)-31s show verbose firewall status
 %(show)-31s show firewall report
 %(version)-31s display version information

%(appcommands)s:
 %(applist)-31s list application profiles
 %(appinfo)-31s show information on %(profile)s
 %(appupdate)-31s update %(profile)s
 %(appdefault)-31s set default application policy
t   prognamet   COMMANDt   commandt   Commandst   commandsR   R   s   default ARGR   s   logging LEVELt   loggingt   LEVELt   levels
   allow ARGSR   R   s	   deny ARGSR   s   reject ARGSR   s
   limit ARGSR   s   delete RULE|NUMR   t   RULEt   urules   insert NUM RULER   t   NUMt   numberR	   t   statuss   status numberedt	   statusnumt   RULESt   ruless   status verboset   statusverboses   show ARGt   showR   s   Application profile commandst   appcommandss   app listt   applists   app info PROFILEt   appinfot   PROFILEt   profiles   app update PROFILEt	   appupdates   app default ARGt
   appdefault(   t   _R    t   commont   programName(   t   msg(    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   get_command_helpX   s@    t   UFWFrontendc           B   s   e  Z d  Z d d  Z d   Z d   Z d   Z e e d  Z d d  Z	 d	   Z
 d
   Z e d  Z e d  Z d   Z d   Z d   Z d   Z d   Z d   Z d   Z e d  Z RS(   t   UIt   iptablesc         C   sz   | d k r9 y t  |  |  _ WqI t k
 r5   qI Xn t d |   t d  |  _ t d  |  _ t d  |  _ d  S(   NR[   s   Unsupported backend type '%s't   nt   yt   yes(   R   t   backendR3   R    RT   t   noR^   t   yes_full(   t   selft   dryrunt   backend_type(    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   __init__   s    
c         C   s  d } d } | r d } n  t  } | r7 |  j j   sM | rV |  j j   rV t } n  | r y$ |  j j |  j j d d |  Wq t k
 r } t | j  q Xn  d } | rZy |  j j	   Wn% t k
 r } | r | j } q n X| d k rKy$ |  j j |  j j d d d  Wn  t k
 r=} t | j  n Xt |  n  t
 d  } n@ y |  j j   Wn  t k
 r} t | j  n Xt
 d  } | S(   sl   Toggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or
           stops running firewall.
        t    R`   R^   t   conft   ENABLEDs0   Firewall is active and enabled on system startups/   Firewall stopped and disabled on system startup(   t   FalseR_   t
   is_enabledt   Truet   set_defaultt   filesR    R   R2   t   start_firewallRT   t   stop_firewall(   Rb   t   enabledt   rest
   config_strt   changedR:   t	   error_str(    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   set_enabled   sF    		c         C   sr   d } yE |  j  j | |  } |  j  j   rJ |  j  j   |  j  j   n  Wn  t k
 rm } t | j  n X| S(   s   Sets default policy of firewallRf   (   R_   t   set_default_policyRj   Ro   Rn   R    R   R2   (   Rb   t   policyt	   directionRq   R:   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyRv      s    c         C   sC   d } y |  j  j |  } Wn  t k
 r> } t | j  n X| S(   s   Sets log level of firewallRf   (   R_   t   set_loglevelR    R   R2   (   Rb   RB   Rq   R:   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyRy      s    c         C   s@   y |  j  j | |  } Wn  t k
 r; } t | j  n X| S(   s   Shows status of firewall(   R_   t
   get_statusR    R   R2   (   Rb   R   t
   show_countt   outR:   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyRz      s
    R   c         C   s=   y |  j  j |  } Wn  t k
 r8 } t | j  n X| S(   s   Shows raw output of firewall(   R_   t   get_running_rawR    R   R2   (   Rb   t
   rules_typeR|   R:   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   get_show_raw   s
    c         C   s  d } y t  j j |  j j    } Wn) t k
 rP t d  } t |   n X|  j j   } | j	   } | j
   x.| D]&} |  j j   r | d k r q} n  | d | 7} | | j	   } | j
   x| D]} x| | | D]}	 |	 d }
 |
 j d  r |
 j d  r d } | d	 | 7} |
 d
 k sE|
 d k r`| d 7} d |	 d }
 n  | d |
 7} t  j j |
  } | d t j j |	 d  7} t  j j d | d  | |
  } | j | j d   | d k r| j d |  n  | j   |  j j |  } t |  d k r| d 7} xa | D]V } | d k r1| d t |  k  r1| d | t  j j j | | d  f 7} q1q1Wn  | d 7} q q Wq Wq} W|  j j   st  j j d  n  | S(   s   Shows listening servicesRf   s   Could not get listening statust   tcp6t   udp6s   %s:
t   laddrs   127.s   ::1s     %s s   0.0.0.0s   ::s   * s   %s/0s   %s s   (%s)t   exeR   i   t   6t   ini    s   
i   s      [%2d] %s
s)   Skipping tcp6 and udp6 (IPv6 is disabled)(   R   R   (   R    t   utilt   parse_netstat_outputR_   t   use_ipv6R3   RT   R    t	   get_rulest   keyst   sortt
   startswitht   get_if_from_ipt   ost   patht   basenameRU   t   UFWRulet   set_v6t   endswitht   set_interfacet	   normalizet   get_matchingR,   R!   R+   t   get_commandt   debug(   Rb   Rq   t   dt   err_msgRJ   t	   protocolst   protot   portst   portt   itemt   addrt   ifnameR   t   matchingR6   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   get_show_listening  s\    



	

"	 c         C   s  d } d } d } g  } | j  d k rF | j d k rF | j |  n(g  } y| j r(| d k r| |  j j | t  } n | d k r |  j j | t  } n | d k r5|  j j | t  } |  j j | t  } xx | D]Q }	 xH | D]@ }
 |
 j } t |
 _ |	 j	 |
  s | |
 _ | j |
  q q Wq Wn t
 d  | } t |   t |  d k r|  j j rt
 d  } | d k r| } n: | d k r| d } n! | d k r| d	 | d } n  | Sx | D]K } | j   } | j | _ | j | j  | j | j  | j |  qWn. |  j j |  } | j d k rV| j   n  Wn t k
 rm  n Xd } t } t
 d
  } |  j j t  } |  j j t  } xt |  D]\ } } | } | j | | k r| t | j  d 7} t |   n  yX|  j j   r| d k rw| j | k rU| t | j  d 7} t |   n  | j t  |  j j |  } qY| d k r| j | k r| j | j |  nD | j d k r| j | k r| t | j  d 7} t |   n  | j t  |  j j |  } qY| d k r| j } | j t  | j r| | k r|  j j | | | t  } | d k r| j |  q| j d  n  |  j j |  } | j r| d k r|  j j t  } | j | d  n  | j t  | j r[| j d k r[| j | k r[|  j j | j t  } | d k rK| j | |  q[| j d  n  | d k rt| d	 7} n  | j r| j | k r| j | j |  n  | |  j j |  7} qYt
 d  | } t |   n} | d k s| d k r| j t  |  j j |  } nC | d k r=t
 d  } t |   n t
 d  | } t |   Wn# t k
 r} | j } t } Pn X| j  rt
 d  } t! j" |  qqW| s| | 7} nt |  d k rt# |  n t } t$ | d  } | j   x | D] } | d k r| | r| | j   } t | _ y |  j | |  Wqt k
 rt } t
 d  | j%   } t" |  qXqqW| t
 d  7} | r| t
 d  7} n | t
 d  7} t |   | S(   s   Updates firewall with ruleRf   t   v4t   v6t   boths   Invalid IP version '%s'i    s"   Could not delete non-existent rules    (v6)s   
s   Invalid position 't   'i   s   IPv6 support not enableds    Rule changed after normalizations   Could not back out rule '%s's"   
Error applying application rules.s#    Some rules could not be unapplied.s(    Attempted rules successfully unapplied.(&   t   dappt   sappt   appendt   removeR_   t   get_app_rules_from_systemRi   Rk   R   t   matchRT   R    R,   Rc   t   dup_rulet
   set_actiont   actiont   set_logtypet   logtypet   get_app_rules_from_templatet   positiont   reverseR3   t   get_rules_countt	   enumeratet   strR   R   t   set_rulet   set_positiont   find_other_positionR2   t   updatedt   warningsR   R   t   ranget   format_rule(   Rb   R   t
   ip_versionRq   R   t   tmpRJ   t   tmprulest	   tmprules6t   xR]   t   prev6t   rt   countt	   set_errort   pos_err_msgt   num_v4t   num_v6R6   t   user_posR5   R:   t   warn_msgt
   undo_errort   indexest   jt   backout_rule(    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyR   D  s   														
		c         C   s  y t  |  } Wn- t k
 r? t d  | } t |   n X|  j j   } | d k sm | t |  k r t d  | } t |   n  |  j j |  } | s t d  | } t |   n  t | _	 d } | j
 r d } n  t } | st j j j |  }	 t d  i |	 d 6|  j d 6|  j d	 6}
 t j t j j   |
  t j j   j   j   } | d
 k r| |  j k r| |  j k rt } qn  d } | r|  j | |  } n t d  } | S(   s   Delete rules   Could not find rule '%s'i    s   Could not find rule '%d'R   R   s=   Deleting:
 %(rule)s
Proceed with operation (%(yes)s|%(no)s)? R   R^   R`   R]   Rf   t   Aborted(   t   intR3   RT   R    R_   R   R,   t   get_rule_by_numberRk   R   R   R    R!   R+   R   R^   R`   R   t   writeR.   t   stdoutt   filenot   stdint   readlineR-   t   stripRa   Ri   R   (   Rb   RF   t   forceR\   R   RJ   R   R   t   proceedt   rstrt   promptt   ansRq   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   delete_rule   sB    				

*c   	      C   s:  d } | j  d  r^ | j d  } t |  d k rL |  j | d  } q6|  j d  } n| d k r| |  j d  } n| j  d  r t d	  } | j d
  } t |  d k r t |   n  |  j | d | d  } nR| d k r|  j |  } n4| d k r|  j   } n| d k r;|  j t	  } n| j  d  r| j d
  d } | d k rx|  j
   } q6|  j |  } n| d k r|  j t t	  } n| d k r|  j t	  } nm| d k r|  j t  } nO| d k r:|  j j   r+|  j t  |  j t	  t d  } q6t d  } n| j  d  rk|  j | j d
  d |  } n| d k s| d k s| d k s| d k r| j d k rPyD |  j j | j  } | | j k r| | _ | j | d  n  WqPt k
 rL} | j st | j  n  t j j | j  sMt d  } t |   qMqPXn  | j d k ryD |  j j | j  } | | j k r| | _ | j | d  n  Wqt k
 r} | j st | j  n  t j j | j  st d  } t |   qqXn  |  j | |  } n t d  | } t |   | S(    s   Perform action on rule. action, rule and ip_version are usually
           based on return values from parse_command().
        Rf   s
   logging-onRT   i   R   s   logging-offR   s   default-s   Unsupported default policyt   -i   i   R	   RG   s   status-verboseRL   R   s   status-numberedR   R   R   s   Firewall reloadeds&   Firewall not enabled (skipping reload)s   delete-R   R   R   R   t   dsts   Invalid profile names   Unsupported action '%s'(   R   t   splitR,   Ry   RT   R    Rv   R	   Rz   Rk   R   R   Ri   Ru   R_   Rj   R   R   t   find_application_namet   set_portR   R   R2   R    t   applicationst   valid_profile_nameR   R   (	   Rb   R   R   R   R   Rq   R   R   R:   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt	   do_action,  s    "$				c         C   sC   d } y |  j  j |  } Wn  t k
 r> } t | j  n X| S(   s+   Sets default application policy of firewallRf   (   R_   t   set_default_application_policyR    R   R2   (   Rb   Rw   Rq   R:   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyR     s    c         C   sK   |  j  j j   } | j   t d  } x | D] } | d | 7} q/ W| S(   s*   Display list of known application profiless   Available applications:s   
  %s(   R_   t   profilesR   R   RT   (   Rb   t   namesR   R\   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   get_application_list  s    
c         C   s!  g  } | d k r1 |  j  j j   } | j   n: t j j |  s^ t d  } t |   n  | j	 |  d } x| D]} |  j  j j
 |  s |  j  j | r t d  | } t |   n  t j j | |  j  j |  s t d  } t |   n  | t d  | 7} | t d  t j j |  j  j |  7} | t d  t j j |  j  j |  7} t j j |  j  j |  } t |  d	 k sd
 | d k r| t d  7} n | t d  7} x | D] } | d | 7} qW| | t |  d	 k rx | d 7} qx qx Wt j j |  S(   s   Display information on profilet   alls   Invalid profile nameRf   s   Could not find profile '%s's   Invalid profiles   Profile: %s
s
   Title: %s
s   Description: %s

i   t   ,i    s   Ports:s   Port:s   
  %ss   

--

(   R_   R   R   R   R    R   R   RT   R    R   t   has_keyt   verify_profilet	   get_titlet   get_descriptiont	   get_portsR,   R   t	   wrap_text(   Rb   t   pnameR   R   R   t   nameR   R5   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   get_application_info  sB    	"c   	      C   sx  d } t  } t } y( |  j j r9 t j j   r9 t } n  Wn t k
 rS t } n X| d k r |  j j j	   } | j
   x | D]P } |  j j |  \ } } | r | d k r | d 7} n  | | 7} | } q q Wn1 |  j j |  \ } } | d k r| d 7} n  | rt|  j j   rt| ray |  j j   Wn t k
 rM  n X| t d  7} qt| t d  7} n  | S(   s   Refresh application profileRf   R   s   
s   Firewall reloadeds   Skipped reloading firewall(   Rk   Ri   R_   t	   do_checksR    R   t	   under_sshR3   R   R   R   t   update_app_ruleRj   t   _reload_user_rulesRT   (	   Rb   RQ   R   t   allow_reloadt   trigger_reloadR   R5   R   t   found(    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   application_update  s<    


c         C   s{  d } d } | d k r3 t  d  } t |   n  |  j j d } | d k rm t j j d | | f  | S| d k r d } nF | d	 k r d
 } n1 | d k r d } n t  d  | } t |   d g } |  j j r | j d  n  | | | g 7} y t	 |  } Wn t
 k
 r#  n X| j j d  r_|  j | j | j d | j d  } n |  j | j d d  } | S(   s   Refresh application profileRf   R   s%   Cannot specify 'all' with '--add-new't   default_application_policyt   skips'   Policy is '%s', not adding profile '%s't   acceptR   t   dropR   R   s   Unknown policy '%s'R    s	   --dry-runR   t   iptype(   RT   R    R_   t   defaultsR    R   R   Rc   R   R1   R3   t   dataR   R   R   (   Rb   RQ   R   Rw   R   R   t   argsR9   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   application_add  s>    				c         C   sT  d } | d k r$ |  j  d  } n,| d k rB |  j  d  } n| d k r` |  j  d  } n | d k r~ |  j  d	  } n | d
 k r |  j   } n | d k r |  j |  } n | d k s | d k r4|  j |  } d } | d k r|  j |  } n  | d k r'| d k r'| d 7} n  | | } n t d  | } t |   | S(   sz   Perform action on profile. action and profile are usually based on
           return values from parse_command().
        Rf   s   default-allowR   s   default-denyR   s   default-rejectR   s   default-skipR  R
   R   R   s   update-with-news   
s   Unsupported action '%s'(   R   R   R   R   R  RT   R    (   Rb   R   RQ   Rq   t   str1t   str2R   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   do_application_action  s0    c         C   s   t  } |  j j r t j j   r t d  i |  j d 6|  j d 6} t	 j
 t j j   |  t j j   j   j   } | d k r | |  j k r | |  j k r t } q n  | S(   s6   If running under ssh, prompt the user for confirmationsW   Command may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? R^   R`   R]   (   Rk   R_   R   R    R   R   RT   R^   R`   R   R   R.   R   R   R   R   R-   R   Ra   Ri   (   Rb   R   R   R   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   continue_under_ssh6  s    	*c         C   s4  d } t  d  i |  j d 6|  j d 6} |  j j rl t j j   rl t  d  i |  j d 6|  j d 6} n  |  j j r | r t j	 t
 j j   t j j |   t
 j j   j   j   } | d k r | |  j k r | |  j k r t  d  } | Sn  |  j j   r!| |  j t  7} n  |  j j   } | S(   s   Reset the firewallRf   sT   Resetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? R^   R`   s   Resetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? R]   R   (   RT   R^   R`   R_   R   R    R   R   R   R   R.   R   R   R   R   R   R-   R   Ra   Rj   Ru   Ri   R	   (   Rb   R   Rq   R   R   (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyR	   D  s     		%*(   t   __name__t
   __module__t   __doc__Re   Ru   Rv   Ry   Ri   Rz   R   R   R   R   R   R   R   R   R   R  R  R  R	   (    (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyRY      s&   	6		
			?	,T	
			.	+	*	 	(    (   R  R   R.   R   t
   ufw.commonR    t   ufw.utilR    R   R   t   ufw.backend_iptablesR   t
   ufw.parserR1   RX   RY   (    (    (    s0   /usr/lib/python2.7/dist-packages/ufw/frontend.pyt   <module>   s   	<	>