U
    Ldh                     @   s   d Z ddlZddlZddlZddlZddlZddlZddlmZm	Z	 ddl
mZmZmZmZmZmZ ddlZG dd dejjZdS )z-backend_iptables.py: iptables backend for ufw    N)UFWErrorUFWRule)warndebugmsgcmdcmd_pipe	_findpathc                   @   s   e Zd ZdZd+ddZdd Zdd Zd	d
 Zd,ddZdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zd-ddZd.dd Zd!d" Zd/d#d$Zd%d& Zd'd( Zd)d* ZdS )0UFWBackendIptableszInstance class for UFWBackendNc                 C   s  dt jj d | _|| _|| _i }tt jj|}tt jj|}t	j
|d|d< t	j
|d|d< t	j
|d|d< t	j
|d	|d
< t	j
|d|d< t	j
|d|d< t	j
|d|d< t jjj| d||||d g g g g d| _dD ]}d}|dkr|  r||7 }n|dkrqdD ]0}	dD ]$}
d||	|
f }| j|	 | q(q | jd |d  | jd |d  qdddd d!d"d#g| _d$| _d%S )&z!UFWBackendIptables initializationz# z
_comment #zufw/user.rulesruleszufw/before.rulesZbefore_ruleszufw/after.rulesafter_ruleszufw/user6.rulesrules6zufw/before6.rulesZbefore6_ruleszufw/after6.rulesafter6_ruleszufw-initinitiptables)rootdirdatadir)beforeuseraftermisc)46ufwr   )r   r   r   inputoutputforwardz%s-%s-logging-%sr   z-logging-denyz-logging-allow-mlimit--limitz3/minute-jLOG--log-prefixz[UFW LIMIT BLOCK]N)r   commonZprogramNamecomment_strr   r   r	   
config_dir	state_dirospathjoinbackend
UFWBackend__init__chainsuse_ipv6appendufw_user_limit_logufw_user_limit_log_text)selfdryrunr   r   filesr&   r'   Zverchain_prefixloctargetchain r:   6/usr/lib/python3/dist-packages/ufw/backend_iptables.pyr-       sN     



   zUFWBackendIptables.__init__c                 C   s\   t d}| jd dkr |d7 }n8| jd dkr8|d7 }n | jd dkrP|d7 }n|d	7 }|S )
zGet current policyzNew profiles:Zdefault_application_policyacceptz allowZdropz denyrejectz rejectz skip)_defaults)r3   rstrr:   r:   r;   get_default_application_policyL   s    


z1UFWBackendIptables.get_default_application_policyc              	   C   s>  | j s|dkr4|dkr4|dkr4td| }t||dkr`|dkr`|dkr`td| }t|d	}|dkrrd
}n|dkr~d}d}d}|dkrz| | jd d| d W n tk
r    Y nX d}d}n|dkrz| | jd d| d W n tk
r
    Y nX d}d}n>z| | jd d| d W n tk
rJ    Y nX d}d}td| }| jd | jd fD ]}ztj	
|}	W n tk
r    Y nX |	d }
|	d D ]8}||rtj	|
||| ntj	|
| qztj	|	 W n tk
r    Y nX qvtd||d }|td7 }|S )zSets default policy of firewallallowdenyr=   zUnsupported policy '%s'ZincomingZoutgoingroutedz%Unsupported policy for direction '%s'INPUTOUTPUTFORWARD r?   zDEFAULT_%s_POLICYz"ACCEPT"z	UFW BLOCKz	UFW ALLOWz"REJECT"z"DROP"r   r   tmporigz5Default %(direction)s policy changed to '%(policy)s'
)	directionpolicyz*(be sure to update your rules accordingly))r4   r>   r   Zset_defaultr5   	Exceptionrecompiler   util
open_filessearchwrite_to_filesubclose_files)r3   rL   rK   err_msgr9   Zold_log_strZnew_log_strpatffnsfdliner@   r:   r:   r;   set_default_policyZ   s    
z%UFWBackendIptables.set_default_policyc                 C   s  | j r&dtd }|dtd 7 }|S |   ddddg}g }g }|dkrn|d	 d
dddg}d
ddg}n|dkrdD ] }|d|  |d|  q|dD ] }|d|  |d|  qdD ] }|d|  |d|  qdD ]}|d|  qnx|dkr<dD ]"}|d|  |d|  qnB|dkrdD ]"}|d|  |d|  qJ| jd d r|d |d  | jd d! r~|d" |d# n|d$krdD ]"}|d%|  |d&|  qn|d'kr~dD ]Z}|d(|  |d)|  |d*|  |d+|  |d,|  |d-|  q|d. |d/ |d0 |d1 d2| }|D ]}d3|kr|d3\}	}|d4|	 7 }t| jg| |d	|	g \}
}nt| jg| |g \}
}||7 }|dkr|d57 }|
d6krt|q|dks0| 	 r|d77 }|D ]}d3|kr|d3\}	}|d4|	 7 }t| jg| |d	|	g \}
}nt| j
g| |g \}
}||7 }|dkr|d57 }|
d6kr<t|q<|S )8z'Show current running status of firewall> zChecking raw iptables
zChecking raw ip6tables
-nz-vz-x-Lrawz-tfilterZnatZmanglebuiltins)rE   rG   rF   z	filter:%s)
PREROUTINGrE   rG   rF   POSTROUTINGz	mangle:%s)rc   rF   zraw:%s)rc   rd   rF   znat:%sr   )r   r   r   zufw-before-%szufw6-before-%sr   ufw-user-%sufw6-user-%sr   r   zufw-user-limit-acceptufw-user-limitr   zufw6-user-limit-acceptufw6-user-limitr   zufw-after-%szufw6-after-%sZloggingzufw-before-logging-%szufw6-before-logging-%szufw-user-logging-%szufw6-user-logging-%szufw-after-logging-%szufw6-after-logging-%szufw-logging-allowzufw-logging-denyzufw6-logging-allowzufw6-logging-denyzIPV4 (%s):
:z(%s) 
r   z

IPV6:
)r4   r>   initcapsr0   capssplitr   r   r   r/   	ip6tables)r3   Z
rules_typeoutargsitemsZitems6cbitrcrI   r:   r:   r;   get_running_raw   s    













 


 

z"UFWBackendIptables.get_running_rawFc           $      C   s  d}| j r2dtd }|  r.|dtd 7 }|S td}dD ]}t| jdd| d	g\}}|d
krptd  S |dkrt|d|  |  r>t| jdd| d	g\}}|dkr>t|d q>d}d}	d}
| j| j }d
}i }|D ]L}d}i }d}d}|sF|j	dks|j
dkrFd}| }||kr>td|  qnd||< dD ]}d||< d}d}|dkr|j}|s|j	dkr|j	}|jr|dkr|d7 }n|j}n@|j}|s|j
dkr|j
}|jr|dkr|d7 }n|j}|dkr|dkr|||< |dkr(|| dkr*|||< n||  d| 7  < |rf|jdkrf||  d|j 7  < |r(|dkr|j	dkr||  d|j	 7  < |jr|dkr||  d7  < ||  d7  < |dkr(|j
dkr(||  d|j
 7  < |jr|dkr||  d7  < ||  d7  < |dkr|dksF|dkrd||< |r|jdkr|j|jkr|j|jkr||  d|j 7  < |dkr||  d7  < n6|r$|jdkr$|j|jkr$||  d|j 7  < n>|jr$|jdkr$|jdkr$d|| kr$||  d7  < |jr|dkrX|jdkrX||  d|j 7  < |dkr|jdkr||  d|j 7  < nX|dkr|jdkr||  d|j 7  < |dkrJ|jdkrJ||  d|j 7  < qJg }d}|js|j d krT|jr||j  |r8|jd kr8||j t|dkrTd!d"| }|rf|d#| 7 }|j }|jr|d$}|jd%kr|js|s|sd}d}|jdkrd&|  }|d'|d d|j |g|d ||f 7 }|r||7 }n0|jr|
|7 }
n|jd kr"|	|7 }	n||7 }|d
7 }q|dksR|	dksR|
dkrHd(}|rd|d)7 }td*}td+}td,}d-}||||f }|r|d)7 }||d.t| d.t| d.t| f 7 }||7 }|dkr||7 }|dkr |	dkr |td/7 }|	dkr||	7 }|dkr2|
dkr2|td/7 }|
dkrD||
7 }|}|r|   \} }!td0| ! | !d1| !d2dd3 }"| " }#td4|!|"|#|d5 S td6| S d7S )8zShow ufw managed rulesrH   r]   zChecking iptables
zChecking ip6tables
problem runningr   r_   re   r^      zStatus: inactiver   z iptables: %s
rf   
 ip6tablesTFzSkipping found tuple '%s')dstsrcr{   z::/0 (v6)z	0.0.0.0/0any /z (%s)r|   ZAnywherez on %sro   z (%s)z, z[%2d] ZFWDinz # %sz%-26s %-12s%-26s%s%s
z

z     ZToZFromZActionz%-26s %-12s%s
-rj   zCDefault: %(in)s (incoming), %(out)s (outgoing), %(routed)s (routed)r   r   )r   ro   rD   z0Status: active
%(log)s
%(pol)s
%(app)s%(status)s)logZpolZappZstatuszStatus: active%sN)#r4   r>   r/   r   r   r   rn   r   r   dappsappget_app_tupler   r{   v6dportr|   sportprotocolr   interface_ininterface_outlogtyperK   lowerr0   lenr*   uppercommentZget_commentactionZget_loglevel_get_default_policyrA   )$r3   verboseZ
show_countro   rV   rK   rv   Zout6sZstr_outZstr_rter   count	app_rulesrZtmp_strlocationtuplZ
show_protor7   ZportrI   ZattribsZ
attrib_strZdir_strr%   Zfull_strZstr_toZstr_fromZ
str_actionZrules_header_fmtZrules_headerlevelZlogging_strZ
policy_strZapp_policy_strr:   r:   r;   
get_status  s~    
 













 


 









 zUFWBackendIptables.get_statusc                 C   s   | j rtdtd  ng }|| jd  | jdk	rl| jdk	rl|d || j |d || j |d t|\}}|dkrtd	| }t|dS )
zStop the firewallr]   running ufw-initr   N	--rootdir	--datadirz
force-stopr   problem running ufw-init
%s)	r4   r   r>   r0   r5   r   r   r   r   r3   rp   rv   ro   rV   r:   r:   r;   stop_firewall  s    


z UFWBackendIptables.stop_firewallc                 C   s8  | j rtdtd  ng }|| jd  | jdk	rn| jdk	rn|d || j |d || j |d t|\}}|dkrtd	| }t|d
| j	ks| j	d
 t
| j krz| d W n$ tk
r   td}t|Y nX n<z| | j	d
  W n& tk
r2   td}t|Y nX dS )zStart the firewallr]   r   r   Nr   r   startr   r   loglevellowzCould not set LOGLEVELzCould not load logging rules)r4   r   r>   r0   r5   r   r   r   r   r?   list	loglevelskeysZset_loglevelrM   update_loggingr   r:   r:   r;   start_firewall  s6    



z!UFWBackendIptables.start_firewallc                 C   s   | j r
dS |   d}| j}|r*d}| j}dD ]p}|dksB|dkrl|rX| jd d sXq.n|sl| jd d slq.t|d	d
|d | g\}}|dkr.td  dS q.dS )zCheck if all chains existFr   ufw6)r   r   r   r   limit-acceptr   r   r   r   r^   r_   z-user-r   z_need_reload: forcing reloadT)r4   rk   r   rn   rl   r   r   )r3   r   prefixexer9   rv   ro   r:   r:   r;   _need_reload  s&    zUFWBackendIptables._need_reloadc                 C   s   t d}| jr(td |  rtd n|  rz4| jd D ]$}| |d|g | |d|g q<W n tk
r   t|Y nX t	d| j
d g| jd	g\}}|d
krt|d |  rt	d| j
d g| jd	g\}}|d
krt|d dS )zReload firewall rules filerx   z> | iptables-restorez> | ip6tables-restorer   -F-Zcatr   r^   r   z	 iptablesr   rz   N)r>   r4   r   r/   
is_enabledr.   
_chain_cmdrM   r   r   r5   Ziptables_restoreZip6tables_restore)r3   rV   rr   rv   ro   r:   r:   r;   _reload_user_rules6  s.    
z%UFWBackendIptables._reload_user_rulesc                 C   s@  g }t d}t d}t d}||r||r||r\||d|d| n||d| ||d| q||d| n
|| t d}t d	}	t d
}
d}t|D ]\}}||r|d| }| dkr d}n| dkrd}nd}d||f }|	|s8d| }|d|||< |||d| d | | |||
d| d | |d| |||
d| d | |d| | qt d}t|D ]j\}}||r|d|}|d| d |}|d| d |}|||< ||| ||| q|S ) z5Return list of iptables rules appropriate for sendingz-p all zport z-j (REJECT(_log(-all)?)?)z-p tcp z-j \1 --reject-with tcp-resetz-p udp rH   z(.*)-j ([A-Z]+)_log(-all)?(.*)z-j [A-Z]+_log-allz(-A|-D) ([a-zA-Z0-9\-]+)z'-m limit --limit 3/min --limit-burst 10\2r<   ZALLOWr   ZLIMITZBLOCKz"%s -j LOG --log-prefix "[UFW %s] "z-m conntrack --ctstate NEW z	\1-j \2\4z\1-j z-user-logging-z\1 z\1-j RETURN\1z	 -j LIMITz+ -m conntrack --ctstate NEW -m recent --setzL -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j z-user-limitz -j z-user-limit-accept)	rN   rO   rR   r0   rT   	enumeratestripr   insert)r3   fruler   suffixsnippetsZ	pat_protoZpat_portZ
pat_rejectpat_logZ
pat_logallZ	pat_chain
limit_argsrt   r   rL   ZlstrZ	pat_limitZtmp1Ztmp2Ztmp3r:   r:   r;   _get_rules_from_formattedR  s    












z,UFWBackendIptables._get_rules_from_formattedc           	      C   s   g }|  |||}td}t|D ]p\}}||d|  ||r$|| d || |d|dd ||  |d| 7  < q$|S )z_Return list of iptables rules appropriate for sending as arguments
           to cmd()
        z(.*) --log-prefix (".* ")(.*)r   r#   r   "rH   z\3)	r   rN   rO   r   r0   rT   rm   matchreplace)	r3   r   r   r   r   Zstr_snippetsrW   rt   r   r:   r:   r;   _get_lists_from_formatted  s    

z,UFWBackendIptables._get_lists_from_formattedc                 C   s  | j d g}|  r$|| j d  |D ]v}ztj|}W n( tk
rf   td| }t|Y nX t	
d}t	
d}t	
d}|D ]
}|}	d}
d|kr|d\}	}| }
||	r|d|	}t	d	| }t|d
k st|dkrtd| }t| qqd}d}d}t|dks6t|dkrtd| }|d dd }d|d krd|d kr||d r||d r|d dd dd }|d dd dd }nR|d dr|d dd }n.|d dr|d dd }n
t| qz
|d }d}d|krHd}|dd }t|dk rt||d |d |d |d |d |||
	}nvt||d |d |d |d |d |||
	}t	
d}|d
 d kr|d!|d
 |_|d d kr|d!|d |_|dkr|d| |dkr&|d"| W n. tk
rV   td#| }t| Y qY nX || j d kr|d | j| q|d | j| q|  q(d$S )%z$Read in rules that were added by ufwr   r   zCouldn't open '%s' for readingz^### tuple ###\s*zin_\w+zout_\w+rH   z	 comment=z\s+   	   z)Skipping malformed tuple (bad length): %sr      z$Skipping malformed tuple (iface): %sr>   r   !   ry   Zin_Zout_Fri   T            %20r   r   ro   zSkipping malformed tuple: %sN)r5   r/   r0   r   rP   Zopen_file_readrM   r>   r   rN   rO   rm   r   r   rT   r   r   rR   	partition
startswithr   r   r   Zset_interfaceset_v6r   r   close)r3   ZrfnsrX   rJ   rV   Z	pat_tupleZpat_iface_inZpat_iface_outZ	orig_liner[   r   hexr   rI   ZwmsgZdtyper   r   r   r   rule	pat_spacewarn_msgr:   r:   r;   _read_rules  s    






      





zUFWBackendIptables._read_rulesc                 C   s8  | j d }|r| j d }t|tjs:td| }t|ztj|}W n t	k
r`    Y nX | 
  d}| j}|rd}| j}| jrtj }n|d }tj|d tj|d| d	  tj|d| d
  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  tj|d| d  |dkr| jd d s|dkr>| jd d r>tj|d| d  tj|d| d  tj|d |D ]}|j}	|jrnd|j }	|jdkr|	d|j 7 }	d}
|jdkr|jdkr|j}
n`|jdkr|jdkrd |j|jf }
n6|jdkr|
d!|j|jf 7 }
n|
d!|j|jf 7 }
|jdkrr|jdkrrd"|	|j|j|j|j|j|
f }|j dkr^|d#|j  7 }tj||d$  nt!"d%}d&}|jr|#d'|j}d&}|jr|#d'|j}d(|	|j|j|j|j|j|||
f	 }|j dkr|d#|j  7 }tj||d$  d)}|jrd*}n|jd+kr"d,}d-||f }d.||$ f }| %|||D ]}tj|| qLqPtj|d/ tj|d0 z| &| j'd1 }W n t	k
r    Y nX |D ]d\}}}t(|d2kr|d2 d3krސq|)|d& rtj|d%*|+d4d5+d6d7d$  qtj|d8 |dkrB| jd d s\|dkr| jd d rtj|d9 | j'd1 d:krtj|d;| d< d%*| j, d= | j- d>  tj|d;| d?  tj|d;| d@  tj|dA tj|dB z(| jrtj.|dC ntj.| W n t	k
r2    Y nX dDS )Ez.Write out new rules to file to user chain filer   r   z'%s' is not writabler   r   rI   z*filter
ri   z-user-input - [0:0]
z-user-output - [0:0]
z-user-forward - [0:0]
z-before-logging-input - [0:0]
z-before-logging-output - [0:0]
z -before-logging-forward - [0:0]
z-user-logging-input - [0:0]
z-user-logging-output - [0:0]
z-user-logging-forward - [0:0]
z-after-logging-input - [0:0]
z-after-logging-output - [0:0]
z-after-logging-forward - [0:0]
z-logging-deny - [0:0]
z-logging-allow - [0:0]
r   r   r   z-user-limit - [0:0]
z-user-limit-accept - [0:0]
z### RULES ###
zroute:rH   r>   zin_%s!out_%sz%s_%sz#
### tuple ### %s %s %s %s %s %s %sz comment=%srj   r   r   r   z)
### tuple ### %s %s %s %s %s %s %s %s %sr   r   ro   r   
%s-user-%sz	-A %s %s
z
### END RULES ###
z
### LOGGING ###
r   r   -D[z"[z] z] "z### END LOGGING ###
z
### RATE LIMITING ###
offz-A z-user-limit z "z "
z-user-limit -j REJECT
z-user-limit-accept -j ACCEPT
z### END RATE LIMITING ###
zCOMMIT
FN)/r5   r(   accessW_OKr>   r   r   rP   rQ   rM   rk   r   r   r4   sysstdoutfilenorS   rl   r   r   r   r   r   rK   r   r   r   r   r{   r   r|   r   rN   rO   rT   format_ruler   _get_logging_rulesr?   r   r   r*   r   r1   r2   rU   )r3   r   Z
rules_filerV   rY   r6   r   rZ   r   r   ZifacesZtstrr   r   r   chain_suffixr9   rule_strr   Zlrules_trr   qr:   r:   r;   _write_rules  sZ   




  

zUFWBackendIptables._write_rulesTc              	   C   s  |    d}|jrR|  s*td}t||jdkrx| jd d sxtd|j S n&|jdkrx| jd d sxtd|j S |jr|jdkr|jd	krtd
}t|g }d}d}| j	}|j
}	|jr| jdk r|jdks|jdkrtdS | j}|	dk s|	t|krtd|	 }t||	dkr:|jr:td}t||	t|kr\td|	 }t|z|  W n tk
r    Y nX d}
d}d}d}|D ]p}z|  W n tk
r    Y nX |j|j|j|jf}|
|	krL|d dkr|d dkr|
dks,|d dkr"|d dks,||krDd}||  d}n|	d7 }	|}|
d7 }
t||}|dk rv|d7 }|dkr|s|sd}|js||  n^|dkr|jr|jdkrd}n:|dk r|js|sd}d}||  n
|| q|r8|dkrtd}|jr2|d7 }|S n~|sT|jsT||  |s|jr| jstd}|jr|d7 }|S |r|js|std}|jr|d7 }|S |jr|| _n|| _	z| |j W n< tk
r    Y n& tk
r   td}t| Y nX td}|jr2td}|  r| jsd}|sb| |jsb|rd}|rz|td7 }n|td 7 }|jr|d7 }|rz|   W n tk
r    Y nX n|td!7 }n|r<|jr<d"}td#}|jr|d7 }|r.z|   W n tk
r&    Y nX d}n|td!7 }n |s\|s\|js\d$}td%}|dkr| j}d&}|jr| j }d'}|d7 }d(}|j!rd)}n|j"d*krd+}d,||f }td-}t#|d.|d/g\}}|dkrt|d0|||$ f }t%&d1}| '|||D ]}t#|g| \}}|dkrDt(|t)j* t| |d$kr|+d2,|r|-d3d2,|}t#|d"|d4d5g\}}|dkrt.d6|  q|S )7aX  Updates firewall with rule by:
        * appending the rule to the chain if new rule and firewall enabled
        * deleting the rule from the chain if found and firewall enabled
        * inserting the rule if possible and firewall enabled
        * updating user rules file
        * reloading the user rules file if rule is modified
        rH   z)Adding IPv6 rule failed: IPv6 not enabledr   r   z#Skipping unsupported IPv6 '%s' ruler   z#Skipping unsupported IPv4 '%s' ruleZudpZtcpz/Must specify 'tcp' or 'udp' with multiple portsFz1.4z:Skipping IPv6 application rule. Need at least iptables 1.4r   zInvalid position '%d'z Cannot specify insert and deletez#Cannot insert rule at position '%d'ry   )rH   rH   rH   rH   r   r   Tz Skipping inserting existing ruler}   z"Could not delete non-existent rulezSkipping adding existing rulezCouldn't update rules filezRules updatedzRules updated (v6)zRule insertedzRule updatedz (skipped reloading firewall)r   zRule deleted-Az
Rule addedr   r   r   r   ro   r   r   !Could not update running firewallr_   r^   z%s %s %sz(-A +)(ufw6?-user-[a-z\-]+)(.*)r   r   r!   RETURNzFAILOK: -D %s -j RETURN)/rk   r   r/   r>   r   r   rl   Zmultir   r   positionZiptables_versionr   r   r   r   remove	normalizerM   r{   r|   r0   dup_ruler   r   r   r4   r   r   r   r   r   rn   r   rK   r   r   rN   rO   r   r   r   stderrrR   r*   rT   r   )r3   r   Zallow_reloadr@   rV   ZnewrulesfoundZmodifiedr   r   r   ZinsertedZmatchesZlastr   ZcurrentZretflagr   r6   r   r9   rv   ro   r   r   r   rr   r:   r:   r;   set_rule  sR   


&









zUFWBackendIptables.set_rulec           
      C   st   g }g }|r| j }n| j}| }|| |  | }|D ].}| }|  | }	|	|kr@|| q@|S )z@Return a list of UFWRules from the system based on template rule)r   r   r   r   r   r   r0   )
r3   templater   r   r   Znormr   r   rI   Z	tmp_tupler:   r:   r;   get_app_rules_from_system  s     
z,UFWBackendIptables.get_app_rules_from_systemc                 C   sZ   | j }|dr| j}t|g| \}}|dkrVtd| }|rNtd|  nt|dS )zPerform command on chainr   r   zCould not perform '%s'zFAILOK: N)r   r   rn   r   r>   r   r   )r3   r9   rp   fail_okr   rv   ro   rV   r:   r:   r;   r     s    
zUFWBackendIptables._chain_cmdc           	   	   C   s  | j r
dS |   g }z| |}W n tk
r:    Y nX z| jdd | jdd W n8 tk
rn    Y n$ tk
r   td}t| Y nX |  sdS td}| jd | jd  | jd	  | jd
  D ]:}z| 	|d|dg W q tk
r   t|Y qX qzJ| jd | jd	  | jd
  D ]&}| 	|d|g | 	|d|g q*W n tk
rr   t|Y nX |D ]\}}}d}t
|dkr|d dkrd}zH|dkrt
|dkr| j	|dg|dd  dd | 	||| W n tk
r   t|Y nX qxdD ]}| jd d r4|dksN| jd d r|dkr| j	|d|g| j | jd g dd | jd dkr| j	|d|g| j | jd g dd qdS )z#Update loglevel of running firewallNF)r   Tz&Couldn't update rules file for loggingr   r   r   r   r   r_   r^   r   r   r   r   delete_firstry   )r   )rg   rh   r   r   rg   r   rh   r   r   r   -I)r4   rk   r   rM   r   r   r>   r   r.   r   r   rl   r1   r2   r?   )	r3   r   rules_trV   rr   r   r   r   r9   r:   r:   r;   r     s    

z!UFWBackendIptables.update_loggingc           	      C   s  g }|t | j kr*td| }t||dkr^| jd D ]}||d|ddgdg q<|S | jd D ]}||d|ddgd	g qhd
dddddg}| j| | jd kr@g }| j| | jd k r|}| jd D ]}dD ]}||r| |dks| |dkr.d}||d|ddd|g| d	g q| j| | jd krd}||d|ddd|g| d	g qqg }| j| | jd k r|}| jd D ]}|drd}nt|drd}| j| | jd k r||d|d
ddd ddg| d	g n(||d|d
ddd dddd!g
| d	g ||d|ddd|g| d	g q| j| | jd krg }| j| | jd" k rt|}| j| | jd k rd
ddd#g| }d$}| jd% D ]&}||d|ddd|g| d	g q|S )&z%Get rules for specified logging levelzInvalid log level '%s'r   r   r   r!   r   r   r   rH   r   r   r    z3/minz--limit-burstZ10r   Zhighr   r   r=   rC   z[UFW BLOCK] r   r"   r#   Zmediumz[UFW ALLOW] r   rB   Z	conntrackz	--ctstateZINVALIDz[UFW AUDIT INVALID] ZfullZNEWz[UFW AUDIT] r   )	r   r   r   r>   r   r.   r0   endswithr   )	r3   r   r   rV   rr   r   Zlargsru   r   r:   r:   r;   r     s    
  
     
 
z%UFWBackendIptables._get_logging_rulesc              
   C   s  d}t tjj| j}g }| jD ]d}| j| ds4q|| j|  tj	
|dtj	| j| }tj	|std| }t|qtd}|D ]0}d||f }tj	|rtd| }t|q|D ]:}d||f }|tdtj	||d	 7 }t|| q|D ]}d||f }ttj	
|dtj	|tj	| t|| zt|}	|	tj }
W n0 tk
r   td
| }t| Y qY nX |
tj@ r|td| 7 }n|
tj@ r|td| 7 }q|S )zReset the firewallrH   z.rulesr   zCould not find '%s'. Abortingz%Y%m%d_%H%M%Sz%s.%sz'%s' already exists. Abortingz"Backing up '%(old)s' to '%(new)s'
)oldnewzCouldn't stat '%s'zWARN: '%s' is world writablezWARN: '%s' is world readable)r	   r   r$   	share_dirr   r5   r   r0   r(   r)   r*   basenameisfiler>   r   timestrftimeexistsrenameshutilcopydirnameZcopymodestatST_MODErM   r   S_IWOTHS_IROTH)r3   resr   Zallfilesrt   fnrV   Zextr   Zstatinfomoder   r:   r:   r;   resetg  sZ    







zUFWBackendIptables.reset)NN)FF)F)T)F)__name__
__module____qualname____doc__r-   rA   r\   rw   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r:   r:   r:   r;   r
      s.   
,K]
 f!De
 *
 i
JZr
   )r  r(   rN   r  r  r   r  Z
ufw.commonr   r   Zufw.utilr   r   r   r   r   r	   Zufw.backendr   r+   r,   r
   r:   r:   r:   r;   <module>   s    