3
Yjq2 @ s d Z dddgZddlZddlZddlmZ ddlmZ ddl m
Z
dd l m Z dd
l
mZmZ dd lmZ d Zd
ddddddddddg ZdddddZd d d d ZG d d deZd!d Zd"d Zd#d$ Zd%d& Zd'd( Z dS ))zThe ipset command wrapperipsetcheck_ipset_name remove_default_create_options N)errors)
FirewallError)runProg)log)tempFilereadfile)COMMANDS zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6valuez
value in secs)familyhashsizemaxelemtimeoutZinetZ1024Z65536)r r r c @ s e Zd ZdZdd Zdd Zdd Zdd Zd
d Zd'd
dZ dd Z
dd Z dd Z d(ddZ
d)ddZdd Zd*dd Zd+d d Zd d Zd!d" Zd#d$ Zd%d& Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r _commandname)self r /usr/lib/python3.6/ipset.py__init__K s
zipset.__init__c C s^ dd |D }t jd| j| jdj| t| j|\}}|dkrZtd| jdj||f |S )zCall ipset with argsc S s g | ] }d | qS )z%sr ).0itemr r r
R s z ipset.__run..z %s: %s %s r z'%s %s' failed: %s)r debug2 __class__r joinr
ValueError)r argsZ_argsstatusretr r r Z__runO s z ipset.__runc C s t |tkr ttjd| dS )zCheck ipset namez ipset name '%s' is not validN)lenIPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r
check_nameZ s zipset.check_namec C s g }d}y| j dg}W n0 tk
rH } ztjd| W Y dd}~X nX |j }d}xT|D ]L}|r|j jdd}|d |kr|d tkr|j|d |j dr\d }q\W |S )
z?Return types that are supported by the ipset command and kernel z--helpzipset error: %sNF r zSupported set types:T)
_ipset__runr r Zdebug1
splitlinesstripsplit IPSET_TYPESappend
startswith)r r" outputZexlinesZin_typeslinesplitsr r r set_supported_types` s
zipset.set_supported_typesc C s( t |tks|tkr$ttjd| dS )zCheck ipset typez!ipset type name '%s' is not validN)r# r$ r, r r Z INVALID_TYPE)r type_namer r r
check_typeu s zipset.check_typeNc C sd | j | | j| d||g}t|trZx0|j D ]$\}}|j| |dkr2|j| q2W | j|S )z+Create an ipset with name, type and optionscreater& )r% r5
isinstancedictitemsr- r( )r set_namer4 optionsr keyvalr r r
set_create{ s
zipset.set_createc C s | j | | jd|gS )NZdestroy)r% r( )r r: r r r set_destroy s
zipset.set_destroyc C s d||g}| j |S )Nadd)r( )r r: entryr r r r set_add s
z
ipset.set_addc C s d||g}| j |S )Ndel)r( )r r: rA r r r r
set_delete s
zipset.set_deletec C s, d||g}|r"|j ddj| | j|S )Ntestz%sr )r- r r( )r r: rA r; r r r r rE s
z
ipset.testc C s2 dg}|r|j | |r"|j| | j|jdS )Nlist
)r- extendr( r+ )r r: r; r r r r set_list s
zipset.set_listc C s< | j dgd}i }d }}i }x|D ] }t|dk r:q&dd |jddD }t|dkr`q&q&|d d
krv|d }q&|d d kr|d }q&|d d kr&|d j }d } x^| t|k r|| }
|
dk rt|| kr| d7 } || ||
< ntjd| i S | d7 } qW |r$|r$|t|f||< d }}|j q&W |S )z" Get active ipsets (only headers) z-terse)r; N c S s g | ] }|j qS r )r* )r xr r r r s z.ipset.set_get_active_terse..:r' r NameZTypeZHeaderr r r r netmaskz&Malformed ipset list -terse output: %s)r r r r rN )rI r# r+ r errorr clear) r r0 r" _nameZ_type_optionsr1 Zpairr2 ioptr r r set_get_active_terse sD
zipset.set_get_active_tersec C s dg}|r|j | | j|S )Nsave)r- r( )r r: r r r r rV s
z
ipset.savec C s | j | | j| t }d|kr*d| }d||dg}|rlx0|j D ]$\}} |j| | dkrD|j| qDW |jddj| |jd| xN|D ]F}
d|
krd|
}
|r|jd||
dj|f q|jd ||
f qW |j tj |j
} t j d
| j
| jd |j
| jf d g}t| j||j
d
\} }
t j dkryt|j
W n tk
r` Y nVX d}xNt|j
D ]@}t jd||f ddd |jdst jddd |d7 }qrW tj|j
| dkrtd| jdj||
f |
S )Nr z'%s'r6 z-existr& z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %dZrestore)stdinr' rJ z%8d: %sr )nofmtnlrG )rX z'%s %s' failed: %s)r% r5 r r9 r- writer closeosstatr r r r r st_sizer ZgetDebugLogLevelr
ExceptionZdebug3endswithunlinkr )r r: r4 entriesZcreate_optionsZ
entry_optionsZ temp_filer r< r= rA r] r! r" rS r1 r r r set_restore sV
zipset.set_restorec C s dg}|r|j | | j|S )Nflush)r- r( )r r: r r r r set_flush s
zipset.set_flushc C s | j d||gS )Nrename)r( )r Z old_set_nameZ new_set_namer r r rf
s z ipset.renamec C s | j d||gS )Nswap)r( )r Z
set_name_1Z
set_name_2r r r rg s z
ipset.swapc C s | j dgS )Nversion)r( )r r r r rh s z
ipset.version)N)N)NN)N)NN)__name__
__module__ __qualname____doc__r r( r% r3 r5 r> r? rB rD rE rI rU rV rc re rf rg rh r r r r r H s&
'
7c C s t | tkrdS dS )z"Return true if ipset name is validFT)r# r$ )r r r r r s c C s8 | j }x*tD ]"}||krt| || kr||= qW |S )z( Return only non default create options )copy IPSET_DEFAULT_CREATE_OPTIONS)r; rR rT r r r r s
c
C sh g }xX| j dD ]J}y&|jd |jttj|dd W q tk
rX |j| Y qX qW dj|S )z! Normalize IP addresses in entry ,/F)strict)r+ indexr- str ipaddress
ip_networkr r )rA Z_entryZ_partr r r normalize_ipset_entry& s
rv c C sx t | jddkrdS ytj| dd}W n tk
r< dS X x4|D ],}|jtj|ddrDttjdj | |qDW dS )z: Check if entry overlaps any entry in the list of entries ro rJ NF)rq z,Entry '{}' overlaps with existing entry '{}')
r# r+ rt ru r overlapsr r
INVALID_ENTRYformat)rA rb Z
entry_networkZitrr r r check_entry_overlaps_existing2 s
rz c C s~ ydd | D } W n t k
r& dS X t| dkr8dS | j | jd}x.| D ]&}|j|rrttjdj|||}qPW dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d dqS )F)rq )rt ru )r rK r r r r E s z1check_for_overlapping_entries..Nr z Entry '{}' overlaps entry '{}') r r# sortpoprw r r rx ry )rb Z prev_networkZcurrent_networkr r r check_for_overlapping_entriesB s 2
r} ) rl __all__Zos.pathr\ rt Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r
Zfirewall.configr r$ r, ZIPSET_CREATE_OPTIONSrn objectr r r rv rz r} r r r r sF
P