
VV                 @   s   d  Z  d d l Z d d l Z d d l Z d d l m Z d d l Z d d l m Z m	 Z	 m
 Z
 d d l m Z d d l Z d d   Z d d	   Z Gd
 d   d  Z d S)z'frontend.py: frontend interface for ufw    N)UFWError)errorwarnmsg)UFWBackendIptablesc             C   s  t  j j   } x? d d d d d d d d g D] } | j t  j j |   q. Wx3 d	 d
 d d g D] } | j t  j j |   qd Wx9 d d d d d d g D] } | j t  j j |   q Wx0 d d d g D] } | j t  j j |   q Wx0 d d d g D] } | j t  j j |   qWx? d d d d d d d d  g D] } | j t  j j	 |   qHWd d! d d d" d# g } x@ | D]8 } | j t  j j
 |   | j t  j j |   qWt |   d$ k rLd% } |  | j   d& k rd$ } |  | j   d k rL|  | j   d' k rL|  | j   | k rL|  j | d(  t |   d$ k  s|d& |  k rt |   d) k  rt d*  y | j |  d% d   } WnZ t k
 r} z t d+ | j  WYd d } ~ Xn% t k
 rt d, d- d.   Yn X| S)/zEParse command. Returns tuple for action, rule, ip_version and dryrun.enabledisablehelpz--helpversionz	--versionreloadresetlistinfodefaultupdateonoffZlowZmediumZhighZfullallowdenyrejectNverboseZnumberedrawzbefore-rulesz
user-ruleszafter-ruleszlogging-rulesbuiltins	listeningaddedlimitinsertdelete      z	--dry-runrouterule   znot enough argsz%szInvalid syntaxZdo_exitF)ufwparserZ	UFWParserZregister_commandZUFWCommandBasicZUFWCommandAppZUFWCommandLoggingZUFWCommandDefaultZUFWCommandStatusZUFWCommandShowUFWCommandRuleUFWCommandRouteRulelenlowerr   r   parse_commandr   value	Exception)argvpiZrule_commandsidxpre r2   ./usr/lib/python3/dist-packages/ufw/frontend.pyr)      sJ    0
#r)   c           F   C   s   t  d d t j j d d d d d d d d d	 d
 d d d d d d d d d d d d d d d d d d d d d d d  d! d" d# d$ d% d& d& d' d' d( d( d) d* d+ d, d- d. d/ d0 d1 d1 d2 d3 d4 d5 d6 d7 d8 d9 d: d; d< d= i"  }  |  S)>zPrint help messagea	  
Usage: %(progname)s %(command)s

%(commands)s:
 %(enable)-31s enables the firewall
 %(disable)-31s disables the firewall
 %(default)-31s set default policy
 %(logging)-31s set logging to %(level)s
 %(allow)-31s add allow %(rule)s
 %(deny)-31s add deny %(rule)s
 %(reject)-31s add reject %(rule)s
 %(limit)-31s add limit %(rule)s
 %(delete)-31s delete %(urule)s
 %(insert)-31s insert %(urule)s at %(number)s
 %(route)-31s add route %(urule)s
 %(route-delete)-31s delete route %(urule)s
 %(route-insert)-31s insert route %(urule)s at %(number)s
 %(reload)-31s reload firewall
 %(reset)-31s reset firewall
 %(status)-31s show firewall status
 %(statusnum)-31s show firewall status as numbered list of %(rules)s
 %(statusverbose)-31s show verbose firewall status
 %(show)-31s show firewall report
 %(version)-31s display version information

%(appcommands)s:
 %(applist)-31s list application profiles
 %(appinfo)-31s show information on %(profile)s
 %(appupdate)-31s update %(profile)s
 %(appdefault)-31s set default application policy
ZprognameZcommandZCOMMANDZcommandsZCommandsr   r   r   zdefault ARGZloggingzlogging LEVELlevelZLEVELr   z
allow ARGSr!   r   z	deny ARGSr   zreject ARGSr   z
limit ARGSr   zdelete RULE|NUMZuruleZRULEr   zinsert NUM RULEr    z
route RULEzroute-deletezroute delete RULE|NUMzroute-insertzroute insert NUM RULEnumberZNUMr   r   statusZ	statusnumzstatus numberedrulesZRULESZstatusverbosezstatus verboseshowzshow ARGr
   ZappcommandszApplication profile commandsZapplistzapp listZappinfozapp info PROFILEprofileZPROFILEZ	appupdatezapp update PROFILEZ
appdefaultzapp default ARG)_r#   commonZprogramName)Zhelp_msgr2   r2   r3   get_command_helpX   sH    r<   c               @   s  e  Z d  Z d Z d d d d d  Z d d   Z d d	   Z d
 d   Z d d d d  Z d d d  Z	 d d   Z
 d d   Z d d   Z d d d  Z d d d  Z d d   Z d d   Z d  d!   Z d" d#   Z d$ d%   Z d& d'   Z d( d)   Z d d* d+  Z d S),UFWFrontendZUIiptablesNc             C   s   | d k rF y t  | d | d | |  _ WqV t k
 rB   YqV Xn t d |   t d  |  _ t d  |  _ t d  |  _ d  S)Nr>   rootdirdatadirzUnsupported backend type '%s'nyyes)r   backendr+   r   r:   norC   yes_full)selfdryrunZbackend_typer?   r@   r2   r2   r3   __init__   s    zUFWFrontend.__init__c          ,   C   s  d } d } | r d } d } | r4 |  j  j   sJ | rP |  j  j   rP d } | r y$ |  j  j |  j  j d d |  Wn2 t k
 r } z t | j  WYd d } ~ Xn Xd } | ry |  j  j   Wn4 t k
 r} z | r | j } WYd d } ~ Xn X| d k rry$ |  j  j |  j  j d d d  Wn2 t k
 rg} z t | j  WYd d } ~ Xn Xt |  t d	  } nR y |  j  j	   Wn2 t k
 r} z t | j  WYd d } ~ Xn Xt d
  } | S)zlToggles ENABLED state in <config_dir>/ufw/ufw.conf and starts or
           stops running firewall.
         rE   rC   FTconfZENABLEDNz0Firewall is active and enabled on system startupz/Firewall stopped and disabled on system startup)
rD   
is_enabledZset_defaultfilesr   r   r*   start_firewallr:   stop_firewall)rG   enabledresZ
config_strZchangedr1   Z	error_strr2   r2   r3   set_enabled   sF      
 zUFWFrontend.set_enabledc             C   s   d } yB |  j  j | |  } |  j  j   rG |  j  j   |  j  j   Wn2 t k
 r| } z t | j  WYd d } ~ Xn X| S)zSets default policy of firewallrJ   N)rD   set_default_policyrL   rO   rN   r   r   r*   )rG   policy	directionrQ   r1   r2   r2   r3   rS      s     zUFWFrontend.set_default_policyc             C   sU   d } y |  j  j |  } Wn2 t k
 rP } z t | j  WYd d } ~ Xn X| S)zSets log level of firewallrJ   N)rD   set_loglevelr   r   r*   )rG   r4   rQ   r1   r2   r2   r3   rV      s     zUFWFrontend.set_loglevelFc             C   sR   y |  j  j | |  } Wn2 t k
 rM } z t | j  WYd d } ~ Xn X| S)zShows status of firewallN)rD   
get_statusr   r   r*   )rG   r   Z
show_countoutr1   r2   r2   r3   rW      s
     zUFWFrontend.get_statusr   c             C   sO   y |  j  j |  } Wn2 t k
 rJ } z t | j  WYd d } ~ Xn X| S)zShows raw output of firewallN)rD   Zget_running_rawr   r   r*   )rG   Z
rules_typerX   r1   r2   r2   r3   get_show_raw  s
     zUFWFrontend.get_show_rawc             C   s  d } y t  j j |  j j    } Wn* t k
 rQ t d  } t |   Yn X|  j j   } t	 | j
    } | j   xC| D];} |  j j   r | d" k r q | d | 7} t	 | | j
    } | j   x| D]} x| | | D]}	 |	 d }
 |
 j d  r |
 j d  r d } | d	 | 7} |
 d
 k sO|
 d k rj| d 7} d |	 d }
 n  | d |
 7} t  j j |
  } | d t j j |	 d  7} t  j j d d d | d d  d | d |
 d d d d  } | j | j d   | d k r| j d |  | j   |  j j |  } t |  d k r| d 7} x[ | D]S } | d k rV| d t |  k  rV| d  | t  j j j | | d  f 7} qVW| d 7} q Wq Wq W|  j j   st  j j d!  | S)#zMShows listening services and incoming rules that might affect
           themrJ   zCould not get listening statustcp6udp6z%s:
Zladdrz127.z::1z  %s z0.0.0.0z::z* z%s/0z%s z(%s)exeactionr   ZprotocolNr"   ZdportdstrU   inforwardF6r   
r   z   [%2d] %s
z)Skipping tcp6 and udp6 (IPv6 is disabled))rZ   r[   )r#   utilZparse_netstat_outputrD   use_ipv6r+   r:   r   	get_rulesr   keyssort
startswithZget_if_from_ipospathbasenamer;   ZUFWRuleset_v6endswithZset_interfaceZ	normalizeZget_matchingr'   r$   r%   get_commanddebug)rG   rQ   derr_msgr7   Z	protocolsprotoportsZportitemZaddrZifnamer!   Zmatchingr.   r2   r2   r3   get_show_listening  sd    



	

"	zUFWFrontend.get_show_listeningc             C   s   |  j  j   } t d  } t |  d k r; | t d  Sg  } x{ |  j  j   D]j } | j r| d t j j j |  } n t j j	 j |  } | | k r qQ | j
 |  | d | 7} qQ W| S)z!Shows added rules to the firewallz9Added user rules (see 'ufw status' for running firewall):r   z
(None)zroute %sz
ufw %s)rD   re   r:   r'   r`   r#   r$   r&   rn   r%   append)rG   r7   rX   r   rrstrr2   r2   r3   get_show_addedW  s    	zUFWFrontend.get_show_addedc             C   s  d } d } d } g  } | j  d k rF | j d k rF | j |  n g  } y| j r"| d k r| |  j j | d  } n | d k r |  j j | d  } n | d k r2|  j j | d  } |  j j | d  } xu | D]N }	 xE | D]= }
 |
 j } d |
 _ |	 j |
  s | |
 _ | j |
  q Wq Wn t d  | } t	 |   t
 |  d k r|  j j rt d	  } | d k r| } n7 | d k r| d
 } n | d k r| d | d
 } | Sx | D]K } | j   } | j | _ | j | j  | j | j  | j |  qWn+ |  j j |  } | j d k rM| j   Wn t k
 re  Yn Xd } d } t d  } |  j j d  } |  j j d  } xt |  D]\ } } | } | j | | k r| t | j  d 7} t	 |   yC|  j j   r| d k ri| j | k rG| t | j  d 7} t	 |   | j d  |  j j |  } q9| d k r| j | k r| j | j |  nA | j d k r| j | k r| t | j  d 7} t	 |   | j d  |  j j |  } q9| d k r| j } | j d  | j r|| | k r||  j j | | | d  } | d k ro| j |  n | j d  |  j j |  } | j r| d k r|  j j d  } | j | d  | j d  | j rA| j d k rA| j | k rA|  j j | j d  } | d k r4| j | |  n | j d  | d k rW| d 7} | j r| j | k r| j | j |  | |  j j |  7} q9t d  | } t	 |   n} | d k s| d k r| j d  |  j j |  } nC | d k rt d  } t	 |   n t d  | } t	 |   Wn5 t	 k
 rq} z | j } d } PWYd d } ~ Xn X| j rt d  } t j  |  qW| s| | 7} nt
 |  d k rt! |  n d } t" t# | d   } | j   x | D] } | d k r| | r| | j   } d | _ y |  j | |  Wqt k
 rzd } t d  | j$   } t  |  YqXqW| t d  7} | r| t d  7} n | t d  7} t	 |   | S)zUpdates firewall with rulerJ   v4Fv6TZbothzInvalid IP version '%s'r   z"Could not delete non-existent rulez (v6)rb   zInvalid position ''r   zIPv6 support not enabledNz Rule changed after normalizationzCould not back out rule '%s'z"
Error applying application rules.z# Some rules could not be unapplied.z( Attempted rules successfully unapplied.)%dappsapprv   removerD   Zget_app_rules_from_systemr{   matchr:   r   r'   rH   Zdup_ruleZ
set_actionr]   Zset_logtypeZlogtypeZget_app_rules_from_templateZpositionreverser+   Zget_rules_count	enumeratestrrd   rl   set_ruleZset_positionZfind_other_positionr*   updatedwarningsr   r   r   rangeZformat_rule)rG   r!   
ip_versionrQ   rq   tmpr7   ZtmprulesZ	tmprules6xrB   Zprev6rw   countZ	set_errorZpos_err_msgZnum_v4Znum_v6r.   Zuser_posr-   r1   Zwarn_msgZ
undo_errorZindexesjZbackout_ruler2   r2   r3   r   t  s   												
		
		zUFWFrontend.set_rulec             C   s  y t  |  } Wn. t k
 r@ t d  | } t |   Yn X|  j j   } | d k sn | t |  k r t d  | } t |   |  j j |  } | s t d  | } t |   d | _ d } | j	 r d } d } | s| j
 rd t j j j |  }	 n t j j j |  }	 t d  d	 |	 d
 |  j d |  j i }
 t |
 d t j d d t j j   j   j   } | d k r| |  j j   k r| |  j j   k rd } d } | r|  j | |  } n t d  } | S)zDelete rulezCould not find rule '%s'r   zCould not find rule '%d'Trz   r{   zroute %sz=Deleting:
 %(rule)s
Proceed with operation (%(yes)s|%(no)s)? r!   rC   rE   outputnewlineFrB   rJ   Aborted)intr+   r:   r   rD   re   r'   Zget_rule_by_numberr   r{   r`   r#   r$   r&   rn   r%   rC   rE   r   sysstdoutstdinreadliner(   striprF   r   )rG   r5   forcerA   rq   r7   r!   r   proceedrx   promptansrQ   r2   r2   r3   delete_rule0  sJ    					!zUFWFrontend.delete_rulec       	      C   s^  d } | j  d  r^ | j d  } t |  d k rL |  j | d  } qZ|  j d  } n| d k r| |  j d  } n| j  d  r t d	  } | j d
  } t |  d k r t |   |  j | d | d  } ny| d k r |  j |  } n[| d k r|  j   } n@| d k r8|  j d  } n"| j  d  r| j d
  d } | d k ru|  j	   } qZ| d k r|  j
   } qZ|  j |  } n| d k r|  j d d  } n| d k r|  j d  } ny| d k r|  j d  } n[| d k rR|  j j   rC|  j d  |  j d  t d  } qZt d  } n| j  d  r|  j | j d
  d |  } n| d k s| d k s| d k s| d k r>| j d k rnyA |  j j | j  } | | j k r| | _ | j | d   Wnh t k
 rm} zH | j s.t | j  t j j | j  s[t d!  } t |   WYd" d" } ~ Xn X| j d k r)yA |  j j | j  } | | j k r| | _ | j | d   Wnh t k
 r(} zH | j st | j  t j j | j  st d!  } t |   WYd" d" } ~ Xn X|  j | |  } n t d#  | } t |   | S)$zPerform action on rule. action, rule and ip_version are usually
           based on return values from parse_command().
        rJ   z
logging-onr:   r   r   zlogging-offr   zdefault-zUnsupported default policy-r"   r   r   r6   zstatus-verboseTr8   r   r   zstatus-numberedFr   r   r   zFirewall reloadedz&Firewall not enabled (skipping reload)zdelete-r   r   r   r   r^   zInvalid profile nameNzUnsupported action '%s')rh   splitr'   rV   r:   r   rS   r   rW   ru   ry   rY   rR   rD   rL   r   r}   Zfind_application_nameZset_portr   r   r*   r#   applicationsvalid_profile_namer~   r   )	rG   r]   r!   r   r   rQ   r   rq   r1   r2   r2   r3   	do_actiona  s    "$				zUFWFrontend.do_actionc             C   sU   d } y |  j  j |  } Wn2 t k
 rP } z t | j  WYd d } ~ Xn X| S)z+Sets default application policy of firewallrJ   N)rD   set_default_application_policyr   r   r*   )rG   rT   rQ   r1   r2   r2   r3   r     s     z*UFWFrontend.set_default_application_policyc             C   sQ   t  |  j j j    } | j   t d  } x | D] } | d | 7} q5 W| S)z*Display list of known application profileszAvailable applications:z
  %s)r   rD   profilesrf   rg   r:   )rG   namesrx   rA   r2   r2   r3   get_application_list  s    
z UFWFrontend.get_application_listc             C   s  g  } | d k r7 t  |  j j j    } | j   n7 t j j |  sa t d  } t	 |   | j
 |  d } x| D]} | |  j j k s |  j j | r t d  | } t	 |   t j j | |  j j |  s t d  } t	 |   | t d  | 7} | t d  t j j |  j j |  7} | t d  t j j |  j j |  7} t j j |  j j |  } t |  d	 k sd
 | d k r| t d  7} n | t d  7} x | D] } | d | 7} qW| | t |  d	 k r{ | d 7} q{ Wt j j |  S)zDisplay information on profileallzInvalid profile namerJ   zCould not find profile '%s'zInvalid profilezProfile: %s
z
Title: %s
zDescription: %s

r   ,r   zPorts:zPort:z
  %sz

--

)r   rD   r   rf   rg   r#   r   r   r:   r   rv   Zverify_profileZ	get_titleZget_descriptionZ	get_portsr'   rc   	wrap_text)rG   Zpnamer   rq   rx   namers   r-   r2   r2   r3   get_application_info  sB    	"z UFWFrontend.get_application_infoc       	      C   sq  d } d } d } y% |  j  j r6 t j j   r6 d } Wn t k
 rQ d } Yn X| d k r t |  j  j j    } | j	   x | D]J } |  j  j
 |  \ } } | r | d k r | d 7} | | 7} | } q Wn. |  j  j
 |  \ } } | d k r| d 7} | rm|  j  j   rm| r]y |  j  j   Wn t k
 rI  Yn X| t d  7} n | t d  7} | S)zRefresh application profilerJ   TFr   rb   zFirewall reloadedzSkipped reloading firewall)rD   	do_checksr#   rc   	under_sshr+   r   r   rf   rg   Zupdate_app_rulerL   Z_reload_user_rulesr:   )	rG   r9   rx   Zallow_reloadZtrigger_reloadr   r-   r   foundr2   r2   r3   application_update  s<    




zUFWFrontend.application_updatec             C   ss  d } d } | d k r0 t  d  } t |   |  j j d } | d k rj t j j d | | f  | S| d k r d } nF | d	 k r d
 } n1 | d k r d } n t  d  | } t |   d g } |  j j r | j d  | | | g 7} y t	 |  } Wn t
 k
 r  Yn Xd | j k rW|  j | j | j d | j d  } n |  j | j d d  } | S)zRefresh application profilerJ   r   z%Cannot specify 'all' with '--add-new'Zdefault_application_policyskipz'Policy is '%s', not adding profile '%s'Zacceptr   Zdropr   r   zUnknown policy '%s'r#   z	--dry-runr!   Ziptype)r:   r   rD   Zdefaultsr#   rc   ro   rH   rv   r)   r+   datar   r]   )rG   r9   rx   rT   rq   r   argsr0   r2   r2   r3   application_add#  s>    				zUFWFrontend.application_addc             C   sN  d } | d k r$ |  j  d  } n&| d k rB |  j  d  } n| d k r` |  j  d  } n | d k r~ |  j  d	  } n | d
 k r |  j   } n | d k r |  j |  } n | d k s | d k r.|  j |  } d } | d k r |  j |  } | d k r!| d k r!| d 7} | | } n t d  | } t |   | S)zzPerform action on profile. action and profile are usually based on
           return values from parse_command().
        rJ   zdefault-allowr   zdefault-denyr   zdefault-rejectr   zdefault-skipr   r   r   r   zupdate-with-newrb   zUnsupported action '%s')r   r   r   r   r   r:   r   )rG   r]   r9   rQ   Zstr1Zstr2rq   r2   r2   r3   do_application_actionM  s0    
z!UFWFrontend.do_application_actionc             C   s   d } |  j  j r t j j   r t d  d |  j d |  j i } t | d t	 j
 d d t	 j j   j   j   } | d k r | |  j k r | |  j k r d } | S)	z6If running under ssh, prompt the user for confirmationTzWCommand may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? rC   rE   r   r   FrB   )rD   r   r#   rc   r   r:   rC   rE   r   r   r   r   r   r(   r   rF   )rG   r   r   r   r2   r2   r3   continue_under_sshm  s    	*zUFWFrontend.continue_under_sshc             C   s'  d } t  d  d |  j d |  j i } |  j j re t j j   re t  d  d |  j d |  j i } |  j j r | r t t j j	 |  d t
 j d d t
 j j   j   j   } | d	 k r | |  j k r | |  j k r t  d
  } | S|  j j   r| |  j d  7} |  j j   } | S)zReset the firewallrJ   zTResetting all rules to installed defaults. Proceed with operation (%(yes)s|%(no)s)? rC   rE   zResetting all rules to installed defaults. This may disrupt existing ssh connections. Proceed with operation (%(yes)s|%(no)s)? r   r   FrB   r   )r:   rC   rE   rD   r   r#   rc   r   r   r   r   r   r   r   r(   r   rF   rL   rR   r   )rG   r   rQ   r   r   r2   r2   r3   r   {  s     		%*zUFWFrontend.reset)__name__
__module____qualname____doc__rI   rR   rS   rV   rW   rY   ru   ry   r   r   r   r   r   r   r   r   r   r   r   r2   r2   r2   r3   r=      s*   6
		H1V
	.+* r=   )r   ri   r   r   Z
ufw.commonr   Zufw.utilr#   r   r   r   Zufw.backend_iptablesr   Z
ufw.parserr)   r<   r=   r2   r2   r2   r3   <module>   s   <F