<s> from __future__ import print_function <EOL> import sys <EOL> pytver = sys . version_info <EOL> if pytver [ <NUM_LIT:0> ] == <NUM_LIT:2> and pytver [ <NUM_LIT:1> ] >= <NUM_LIT:7> : <EOL> pass <EOL> else : <EOL> print ( "<STR_LIT>" ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> import argparse , logging , re , sys , struct , socket , subprocess , signal , time , json , os <EOL> from Queue import Queue , PriorityQueue <EOL> from threading import Thread <EOL> import config , rfwconfig , cmdparse , iputil , rfwthreads , iptables <EOL> from sslserver import SSLServer , PlainServer , BasicAuthRequestHandler , CommonRequestHandler <EOL> from iptables import Iptables <EOL> log = logging . getLogger ( '<STR_LIT>' ) <EOL> def perr ( msg ) : <EOL> print ( msg , file = sys . stderr ) <EOL> def create_requesthandlers ( rfwconf , cmd_queue , expiry_queue ) : <EOL> """<STR_LIT>""" <EOL> ver = '<STR_LIT>' <EOL> try : <EOL> version_file = os . path . join ( os . path . dirname ( __file__ ) , '<STR_LIT>' ) <EOL> with open ( version_file ) as f : <EOL> verline = f . read ( ) . strip ( ) <EOL> VSRE = r"<STR_LIT>" <EOL> mo = re . search ( VSRE , verline , re . M ) <EOL> if mo : <EOL> ver = mo . group ( <NUM_LIT:1> ) <EOL> else : <EOL> log . error ( '<STR_LIT>' . format ( version_file ) ) <EOL> except IOError , e : <EOL> log . error ( '<STR_LIT>' . format ( version_file , e . strerror , e . filename ) ) <EOL> server_ver = '<STR_LIT>' . format ( ver ) <EOL> def check_whitelist_conflict ( ip , whitelist ) : <EOL> if ip != '<STR_LIT>' and iputil . ip_in_list ( ip , whitelist ) : <EOL> msg = '<STR_LIT>' <EOL> log . warn ( msg ) <EOL> raise Exception ( msg ) <EOL> def process ( handler , modify , urlpath ) : <EOL> assert modify in [ '<STR_LIT:D>' , '<STR_LIT:I>' , '<STR_LIT:L>' ] <EOL> log . debug ( '<STR_LIT>' . format ( modify , urlpath ) ) <EOL> try : <EOL> action , rule , directives = cmdparse . parse_command ( urlpath ) <EOL> log . debug ( '<STR_LIT>' . format ( action , rule , directives ) ) <EOL> if modify == '<STR_LIT:L>' : <EOL> if action == '<STR_LIT>' : <EOL> resp = '<STR_LIT>' <EOL> return handler . http_resp ( <NUM_LIT:200> , resp ) <EOL> elif action == '<STR_LIT:list>' : <EOL> chain = rule <EOL> rules = Iptables . read_simple_rules ( chain ) <EOL> log . debug ( '<STR_LIT>' , rules ) <EOL> list_of_dict = map ( iptables . Rule . _asdict , rules ) <EOL> resp = json . dumps ( list_of_dict ) <EOL> return handler . http_resp ( <NUM_LIT:200> , resp ) <EOL> elif rfwconf . is_non_restful ( ) : <EOL> mod = directives . get ( '<STR_LIT>' ) <EOL> if not mod : <EOL> raise Exception ( '<STR_LIT>' . format ( action ) ) <EOL> if mod == '<STR_LIT>' : <EOL> modify = '<STR_LIT:I>' <EOL> elif mod == '<STR_LIT>' : <EOL> modify = '<STR_LIT:D>' <EOL> else : <EOL> raise Exception ( '<STR_LIT>' ) <EOL> else : <EOL> raise Exception ( '<STR_LIT>' ) <EOL> if modify in [ '<STR_LIT:D>' , '<STR_LIT:I>' ] and action . upper ( ) in iptables . RULE_TARGETS : <EOL> check_whitelist_conflict ( rule . source , rfwconf . whitelist ( ) ) <EOL> check_whitelist_conflict ( rule . destination , rfwconf . whitelist ( ) ) <EOL> ctup = ( modify , rule , directives ) <EOL> log . debug ( '<STR_LIT>' . format ( ctup ) ) <EOL> cmd_queue . put_nowait ( ctup ) <EOL> return handler . http_resp ( <NUM_LIT:200> , ctup ) <EOL> else : <EOL> raise Exception ( '<STR_LIT>' ) <EOL> except Exception , e : <EOL> msg = '<STR_LIT>' . format ( e . message ) <EOL> log . info ( msg ) <EOL> return handler . http_resp ( <NUM_LIT> , msg ) <EOL> class LocalRequestHandler ( CommonRequestHandler ) : <EOL> def version_string ( self ) : <EOL> return server_ver <EOL> def go ( self , modify , urlpath , remote_addr ) : <EOL> process ( self , modify , urlpath ) <EOL> def do_modify ( self , modify ) : <EOL> self . go ( modify , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> def do_PUT ( self ) : <EOL> self . go ( '<STR_LIT:I>' , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> def do_DELETE ( self ) : <EOL> self . go ( '<STR_LIT:D>' , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> def do_GET ( self ) : <EOL> self . go ( '<STR_LIT:L>' , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> class OutwardRequestHandler ( BasicAuthRequestHandler ) : <EOL> def version_string ( self ) : <EOL> return server_ver <EOL> def creds_check ( self , user , password ) : <EOL> return user == rfwconf . auth_username ( ) and password == rfwconf . auth_password ( ) <EOL> def go ( self , modify , urlpath , remote_addr ) : <EOL> if not iputil . ip_in_list ( remote_addr , rfwconf . whitelist ( ) ) : <EOL> log . error ( '<STR_LIT>' . format ( remote_addr ) ) <EOL> return self . http_resp ( <NUM_LIT> , '<STR_LIT>' ) <EOL> process ( self , modify , urlpath ) <EOL> def do_PUT ( self ) : <EOL> self . go ( '<STR_LIT:I>' , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> def do_DELETE ( self ) : <EOL> self . go ( '<STR_LIT:D>' , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> def do_GET ( self ) : <EOL> self . go ( '<STR_LIT:L>' , self . path , self . client_address [ <NUM_LIT:0> ] ) <EOL> return LocalRequestHandler , OutwardRequestHandler <EOL> def create_args_parser ( ) : <EOL> CONFIG_FILE = '<STR_LIT>' <EOL> LOG_LEVEL = '<STR_LIT>' <EOL> LOG_FILE = '<STR_LIT>' <EOL> parser = argparse . ArgumentParser ( description = '<STR_LIT>' ) <EOL> parser . add_argument ( '<STR_LIT>' , default = CONFIG_FILE , metavar = '<STR_LIT>' , dest = '<STR_LIT>' , help = '<STR_LIT>' . format ( CONFIG_FILE ) ) <EOL> parser . add_argument ( '<STR_LIT>' , default = LOG_LEVEL , help = '<STR_LIT>' . format ( LOG_LEVEL ) , choices = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> parser . add_argument ( '<STR_LIT>' , default = LOG_FILE , help = '<STR_LIT>' . format ( LOG_FILE ) ) <EOL> parser . add_argument ( '<STR_LIT>' , help = '<STR_LIT>' , action = '<STR_LIT:store_true>' ) <EOL> return parser <EOL> def parse_args ( ) : <EOL> parser = create_args_parser ( ) <EOL> args = parser . parse_args ( ) <EOL> args . loglevelnum = getattr ( logging , args . loglevel ) <EOL> return args <EOL> def startup_sanity_check ( ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> Iptables . verify_install ( ) <EOL> Iptables . verify_permission ( ) <EOL> Iptables . verify_original ( ) <EOL> except Exception , e : <EOL> log . critical ( e ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> def __sigTERMhandler ( signum , frame ) : <EOL> log . debug ( "<STR_LIT>" . format ( signum ) ) <EOL> perr ( '<STR_LIT>' ) <EOL> stop ( ) <EOL> def stop ( ) : <EOL> logging . shutdown ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> def rfw_init_rules ( rfwconf ) : <EOL> """<STR_LIT>""" <EOL> rfw_port = rfwconf . outward_server_port ( ) <EOL> ipt = Iptables . load ( ) <EOL> log . info ( '<STR_LIT>' ) <EOL> drop_input = ipt . find ( { '<STR_LIT:target>' : [ '<STR_LIT>' ] , '<STR_LIT>' : [ '<STR_LIT>' ] , '<STR_LIT>' : [ '<STR_LIT>' ] , '<STR_LIT>' : [ '<STR_LIT>' + rfw_port ] } ) <EOL> log . info ( drop_input ) <EOL> log . info ( '<STR_LIT>' . format ( rfw_port , '<STR_LIT:\n>' . join ( map ( str , drop_input ) ) ) ) <EOL> for r in drop_input : <EOL> Iptables . exe_rule ( '<STR_LIT:D>' , r ) <EOL> drop_output = ipt . find ( { '<STR_LIT:target>' : [ '<STR_LIT>' ] , '<STR_LIT>' : [ '<STR_LIT>' ] , '<STR_LIT>' : [ '<STR_LIT>' ] , '<STR_LIT>' : [ '<STR_LIT>' + rfw_port ] } ) <EOL> log . info ( '<STR_LIT>' . format ( rfw_port , '<STR_LIT:\n>' . join ( map ( str , drop_output ) ) ) ) <EOL> for r in drop_output : <EOL> Iptables . exe_rule ( '<STR_LIT:D>' , r ) <EOL> log . info ( '<STR_LIT>' ) <EOL> Iptables . exe ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , rfw_port , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> Iptables . exe ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , rfw_port , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> log . info ( '<STR_LIT>' ) <EOL> for ip in rfwconf . whitelist ( ) : <EOL> try : <EOL> Iptables . exe ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , rfw_port , '<STR_LIT>' , ip , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> Iptables . exe ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , rfw_port , '<STR_LIT>' , ip , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> except subprocess . CalledProcessError , e : <EOL> pass <EOL> Iptables . exe ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , rfw_port , '<STR_LIT>' , ip , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> Iptables . exe ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , rfw_port , '<STR_LIT>' , ip , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> def main ( ) : <EOL> args = parse_args ( ) <EOL> try : <EOL> config . set_logging ( log , args . loglevelnum , args . logfile , args . v ) <EOL> except config . ConfigError , e : <EOL> perr ( e . message ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> if args . v : <EOL> log . info ( '<STR_LIT>' ) <EOL> log . info ( "<STR_LIT>" . format ( args . logfile ) ) <EOL> log . info ( "<STR_LIT>" . format ( args . loglevel ) ) <EOL> try : <EOL> rfwconf = rfwconfig . RfwConfig ( args . configfile ) <EOL> except IOError , e : <EOL> perr ( e . message ) <EOL> create_args_parser ( ) . print_usage ( ) <EOL> sys . exit ( <NUM_LIT:1> ) <EOL> Iptables . ipt_path = rfwconf . iptables_path ( ) <EOL> startup_sanity_check ( ) <EOL> signal . signal ( signal . SIGTERM , __sigTERMhandler ) <EOL> signal . signal ( signal . SIGINT , __sigTERMhandler ) <EOL> rules = Iptables . load ( ) . rules <EOL> log . debug ( "<STR_LIT>" . format ( "<STR_LIT:\n>" . join ( map ( str , rules ) ) ) ) <EOL> log . info ( "<STR_LIT>" ) <EOL> log . info ( "<STR_LIT>" ) <EOL> for a in rfwconf . whitelist ( ) : <EOL> log . info ( '<STR_LIT>' . format ( a ) ) <EOL> rfw_init_rules ( rfwconf ) <EOL> expiry_queue = PriorityQueue ( ) <EOL> cmd_queue = Queue ( ) <EOL> rfwthreads . CommandProcessor ( cmd_queue , <EOL> rfwconf . whitelist ( ) , <EOL> expiry_queue , <EOL> rfwconf . default_expire ( ) ) . start ( ) <EOL> rfwthreads . ExpiryManager ( cmd_queue , expiry_queue ) . start ( ) <EOL> LocalHandlerClass , OutwardHandlerClass = create_requesthandlers ( rfwconf , cmd_queue , expiry_queue ) <EOL> if rfwconf . is_outward_server ( ) : <EOL> server_address = ( rfwconf . outward_server_ip ( ) , int ( rfwconf . outward_server_port ( ) ) ) <EOL> httpd = SSLServer ( <EOL> server_address , <EOL> OutwardHandlerClass , <EOL> rfwconf . outward_server_certfile ( ) , <EOL> rfwconf . outward_server_keyfile ( ) ) <EOL> rfwthreads . ServerRunner ( httpd ) . start ( ) <EOL> if rfwconf . is_local_server ( ) : <EOL> server_address = ( '<STR_LIT:127.0.0.1>' , int ( rfwconf . local_server_port ( ) ) ) <EOL> httpd = PlainServer ( <EOL> server_address , <EOL> LocalHandlerClass ) <EOL> rfwthreads . ServerRunner ( httpd ) . start ( ) <EOL> time . sleep ( <NUM_LIT> ) <EOL> if __name__ == "<STR_LIT:__main__>" : <EOL> main ( ) </s>
