Implemented new, simplified firewall rules editor.

- Select firewall default action to accept or deny
- Add host exceptions to above rules
- New "Add address" window validates inputs and allow only correct
- Use service names instead port numbers
- Working "Edit" button

qubesmanager/firewall.py

@@ -21,6 +21,7 @@
 
 import sys
 import os
+import re
 import xml.etree.ElementTree
 
 from PyQt4.QtCore import *
@@ -28,10 +29,7 @@ from PyQt4.QtGui import *
 
 from qubes.qubes import QubesVmCollection
 from qubes.qubes import QubesException
-from qubes.qubes import qubes_store_filename
-from qubes.qubes import QubesVmLabels
 from qubes.qubes import dry_run
-from qubes.qubes import qubes_guid_path
 
 import ui_editfwrulesdlg
 import ui_newfwruledlg
@@ -41,70 +39,130 @@ class EditFwRulesDlg (QDialog, ui_editfwrulesdlg.Ui_EditFwRulesDlg):
         super (EditFwRulesDlg, self).__init__(parent)
         self.setupUi(self)
         self.newRuleButton.clicked.connect(self.new_rule_button_pressed)
+        self.editRuleButton.clicked.connect(self.edit_rule_button_pressed)
         self.deleteRuleButton.clicked.connect(self.delete_rule_button_pressed)
+        self.policyAllowRadioButton.toggled.connect(self.policy_radio_toggled)
+        self.dnsCheckBox.toggled.connect(self.dns_checkbox_toggled)
 
     def set_model(self, model):
         self.__model = model
         self.rulesTreeView.setModel(model)
         self.rulesTreeView.header().setResizeMode(QHeaderView.ResizeToContents)
         self.rulesTreeView.header().setResizeMode(0, QHeaderView.Stretch)
+        self.set_allow(model.allow)
+        self.dnsCheckBox.setChecked(model.allowDns)
+        self.setWindowTitle(model.get_vm_name() + " firewall")
+
+    def set_allow(self, allow):
+        self.policyAllowRadioButton.setChecked(allow)
+        self.policyDenyRadioButton.setChecked(not allow)
+
+    def policy_radio_toggled(self, on):
+        self.__model.allow = self.policyAllowRadioButton.isChecked()
+
+    def dns_checkbox_toggled(self, on):
+        self.__model.allowDns = on
 
     def new_rule_button_pressed(self):
         dialog = NewFwRuleDlg()
+        self.run_rule_dialog(dialog)
 
+    def edit_rule_button_pressed(self):
+        dialog = NewFwRuleDlg()
+        row = self.rulesTreeView.selectedIndexes().pop().row()
+        item = self.__model.children[row]
+        dialog.addressEdit.setText(item.address)
+        service = self.__model.get_service_name(item.portBegin)
+        dialog.serviceComboBox.insertItem(0, service)
+        dialog.serviceComboBox.setCurrentIndex(0)
+        self.run_rule_dialog(dialog, row)
+
+    def run_rule_dialog(self, dialog, row = None):
         if dialog.exec_():
-            name = dialog.nameEdit.text()
-            allow = dialog.allowCheckBox.isChecked()
             address = dialog.addressEdit.text()
-            netmask = dialog.netmasks[dialog.netmaskComboBox.currentIndex()]
+            service = dialog.serviceComboBox.currentText()
-            portBegin = dialog.portBeginSpinBox.value()
+            port = None
-            portEnd   = dialog.portEndSpinBox.value()
-            if portEnd <= portBegin:
-                portEnd = None
 
-            if portBegin == 0 and portEnd is None:
+            try:
-                return
+                port = int(service)
+            except (TypeError, ValueError) as ex:
+                port = self.__model.get_service_port(service)
 
-            if name == "":
+            if port is not None:
-                QMessageBox.warning(None, "Incorrect name", "You need to name the rule.")
+                item = QubesFirewallRuleItem(address, 32, port, None)
-                return
+                if row is not None:
-
+                    self.__model.setChild(row, item)
-            if address == "":
+                else:
-                QMessageBox.warning(None, "Incorrect address", "Pleas give an address for the rule.")
+                    self.__model.appendChild(item)
-                return
+            else:
-
+                QMessageBox.warning(None, "Invalid service name", "Service '{0} is unknown.".format(service))
-            self.__model.appendChild(QubesFirewallRuleItem(name, allow, address, netmask, portBegin, portEnd))
 
     def delete_rule_button_pressed(self):
         for i in set([index.row() for index in self.rulesTreeView.selectedIndexes()]):
             self.__model.removeChild(i)
 
+class QIPAddressValidator(QValidator):
+    def __init__(self, parent = None):
+        super (QIPAddressValidator, self).__init__(parent)
+
+    def validate(self, input, pos):
+        hostname = input
+
+        if len(hostname) > 255 or len(hostname) == 0:
+            return (QValidator.Intermediate, pos)
+
+        if hostname[-1:] == ".":
+            hostname = hostname[:-1]
+
+        if hostname[-1:] == "-":
+            return (QValidator.Intermediate, pos)
+
+        allowed = re.compile("(?!-)[A-Z\d-]{1,63}(?<!-)$", re.IGNORECASE)
+        if all(allowed.match(x) for x in hostname.split(".")):
+            return (QValidator.Acceptable, pos)
+
+        return (QValidator.Invalid, pos)
+
 class NewFwRuleDlg (QDialog, ui_newfwruledlg.Ui_NewFwRuleDlg):
     def __init__(self, parent = None):
         super (NewFwRuleDlg, self).__init__(parent)
         self.setupUi(self)
 
-        self.netmasks = [ 32, 24, 16, 0 ]
+        self.set_ok_enabled(False)
-        for mask in self.netmasks:
+        self.addressEdit.setValidator(QIPAddressValidator())
-            self.netmaskComboBox.addItem(str(mask))
+        self.addressEdit.editingFinished.connect(self.address_editing_finished)
+        self.serviceComboBox.setValidator(QRegExpValidator(QRegExp("[a-z][a-z0-9-]+|[0-9]+", Qt.CaseInsensitive), None))
+
+        self.serviceComboBox.setInsertPolicy(QComboBox.InsertAtBottom)
+        self.populate_services_combo()
+        self.serviceComboBox.setInsertPolicy(QComboBox.InsertAtTop)
+
+    def populate_services_combo(self):
+        displayed_services = [
+                'http', 'https', 'ftp', 'ftps',
+                'smtp', 'pop3', 'pop3s', 'imap', 'imaps', 'nntp', 'nntps',
+                'ssh', 'telnet', 'telnets', 'ntp', 'snmp',
+                'ldap', 'ldaps', 'irc', 'ircs', 'xmpp-client',
+                'syslog', 'printer', 'nfs', 'x11',
+            ]
+        for service in displayed_services:
+            self.serviceComboBox.addItem(service)
+
+    def address_editing_finished(self):
+        self.set_ok_enabled(True)
+
+    def set_ok_enabled(self, on):
+        ok_button = self.buttonBox.button(QDialogButtonBox.Ok)
+        if ok_button is not None:
+            ok_button.setEnabled(on)
 
 class QubesFirewallRuleItem(object):
-    def __init__(self, name = str(), allow = bool(), address = str(), netmask = 32, portBegin = 0, portEnd = None):
+    def __init__(self, address = str(), netmask = 32, portBegin = 0, portEnd = None):
-        self.__name = name
-        self.__allow = allow
         self.__address = address
         self.__netmask = netmask
         self.__portBegin = portBegin
         self.__portEnd = portEnd
 
-    @property
-    def name(self):
-        return self.__name
-
-    @property
-    def allow(self):
-        return self.__allow
-
     @property
     def address(self):
         return self.__address
@@ -129,43 +187,63 @@ class QubesFirewallRulesModel(QAbstractItemModel):
         QAbstractItemModel.__init__(self, parent)
 
         self.__columnValues = {
-                0: lambda x: self.children[x].name,
+                0: lambda x: self.children[x].address,
-                1: lambda x: self.children[x].address,
+                1: lambda x: "{0}-{1}".format(self.children[x].portBegin, self.children[x].portEnd) if self.children[x].portEnd is not None \
-                2: lambda x: "/{0}".format(self.children[x].netmask),
+                        else self.get_service_name(self.children[x].portBegin),
-                3: lambda x: "{0}-{1}".format(self.children[x].portBegin, self.children[x].portEnd) if self.children[x].portEnd is not None \
-                        else self.children[x].portBegin,
-                4: lambda x: "ALLOW" if self.children[x].allow else "DENY",
         }
         self.__columnNames = {
-                0: "Name",
+                0: "Address",
-                1: "Address",
+                1: "Service",
-                2: "Mask",
-                3: "Port(s)",
-                4: "Allow",
         }
 
+        self.__services = list()
+        pattern = re.compile("(?P<name>[a-z][a-z0-9-]+)\s+(?P<port>[0-9]+)/(?P<protocol>[a-z]+)", re.IGNORECASE)
+        f = open('/etc/services', 'r')
+        for line in f:
+            match = pattern.match(line)
+            if match is not None:
+                service = match.groupdict()
+                self.__services.append( (service["name"], int(service["port"]), service["protocol"]) )
+        f.close()
+
+    def get_service_name(self, port):
+        for service in self.__services:
+            if service[1] == port:
+                return service[0]
+        return str(port)
+
+    def get_service_port(self, name):
+        for service in self.__services:
+            if service[0] == name:
+                return service[1]
+        return None
+
     def set_vm(self, vm):
         self.__vm = vm
 
         self.clearChildren()
 
         conf = vm.get_firewall_conf()
+
+        self.allow = conf["allow"]
+        self.allowDns = conf["allowDns"]
+
         for rule in conf["rules"]:
             self.appendChild(QubesFirewallRuleItem(
-                rule["name"], rule["allow"], rule["address"],
+                rule["address"], rule["netmask"], rule["portBegin"], rule["portEnd"]
-                rule["netmask"], rule["portBegin"], rule["portEnd"]
                 ))
 
+    def get_vm_name(self):
+        return self.__vm.name
+
     def apply_rules(self):
         assert self.__vm is not None
 
-        conf = { "allow": True, "rules": list() }
+        conf = { "allow": self.allow, "allowDns": self.allowDns, "rules": list() }
 
         for rule in self.children:
             conf["rules"].append(
                     {
-                        "allow": rule.allow,
-                        "name": rule.name,
                         "address": rule.address,
                         "netmask": rule.netmask,
                         "portBegin": rule.portBegin,
@@ -241,6 +319,11 @@ class QubesFirewallRulesModel(QAbstractItemModel):
         index = self.createIndex(i, 0)
         self.dataChanged.emit(index, index)
 
+    def setChild(self, i, child):
+        self.children[i] = child
+        index = self.createIndex(i, 0, child)
+        self.dataChanged.emit(index, index)
+
     def clearChildren(self):
         self.__children = list()