File: //lib/python3.9/site-packages/firewall/core/__pycache__/ipset.cpython-39.pyc
a
� i�/ � @ s� d Z g d�ZddlZddlZddlmZ ddlmZ ddl m
Z
ddl m Z ddl
mZmZ dd lmZ d
Zg d �Zd d
d
dd�Zdddd�ZG dd� de�Zdd� Zdd� Zdd� Zd d � Zd d � Z dS ) zThe ipset command wrapper)�ipset�check_ipset_name� remove_default_create_options� N)�errors)�
FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6�valuez
value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd%d d �Zd
d� Z dd� Z
dd� Z d&dd�Z d'dd�Z
dd� Zd(dd�Zd)dd �Zd d � Zd d � Zd!d"� Zd#d$� Zd
S )*r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name��self� r �7/usr/lib/python3.9/site-packages/firewall/core/ipset.py�__init__K s
zipset.__init__c C s^ dd� |D �}t �d| j| jd�|�� t| j|�\}}|dkrZtd| jd�|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )�%sr )�.0�itemr r r �
<listcomp>R � z ipset.__run.<locals>.<listcomp>z %s: %s %s� r �'%s %s' failed: %s)r �debug2� __class__r �joinr �
ValueError)r �args�_args�status�retr r r Z__runO s
�z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r �
check_nameZ s �zipset.check_namec C s( t |�tks|tvr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r( r) � IPSET_TYPESr r Z INVALID_TYPE)r � type_namer r r �
check_type` s �zipset.check_typeNc C s` | � |� | �|� d||g}t|t�rV|�� D ]$\}}|�|� |dkr0|�|� q0| �|�S )z+Create an ipset with name, type and options�create� )r* r- �
isinstance�dict�items�append� _ipset__run)r �set_namer, �optionsr$ �key�valr r r �
set_createf s
zipset.set_createc C s | � |� | �d|g�S )NZdestroy)r* r4 )r r5 r r r � set_destroys s
zipset.set_destroyc C s d||g}| � |�S )N�add�r4 �r r5 �entryr$ r r r �set_addw s
z
ipset.set_addc C s d||g}| � |�S )N�delr< r= r r r �
set_delete{ s
zipset.set_deletec C s, d||g}|r"|� dd�|� � | �|�S )N�testr r )r3 r" r4 )r r5 r> r6 r$ r r r rB s
z
ipset.testc C s2 dg}|r|� |� |r"|�|� | �|��d�S )N�list�
)r3 �extendr4 �split)r r5 r6 r$ r r r �set_list� s
zipset.set_listc C s4 | j dgd�}i }d }}i }|D �]
}t|�dk r6q"dd� |�dd�D �}t|�dkr\q"q"|d d
krr|d }q"|d d kr�|d }q"|d d kr"|d �� }d } | t|�k �r|| }
|
d
v r�t|�| kr�| d7 } || ||
< nt�d|� i S | d7 } q�|�r |�r |t|�f||< d }}|�� q"|S )z" Get active ipsets (only headers) z-terse)r6 N� c S s g | ] }|� � �qS r )�strip�r �xr r r r � r z.ipset.set_get_active_terse.<locals>.<listcomp>�:� r �Name�TypeZHeader)r r r r �netmaskz&Malformed ipset list -terse output: %s)rG r( rF r �errorr �clear) r �linesr' �_nameZ_type�_options�lineZpairZsplits�i�optr r r �set_get_active_terse� sF
�
�
zipset.set_get_active_tersec C s dg}|r|� |� | �|�S )N�save�r3 r4 �r r5 r$ r r r rZ � s
z
ipset.savec C s� | � |� | �|� t� }d|v r*d| }d||dg}|rh|�� D ]$\}} |�|� | dkrB|�| � qB|�dd�|� � |�d| � |D ]F}
d|
v r�d|
}
|r�|�d||
d�|�f � q�|�d ||
f � q�|�� t� |j
�} t � d
| j
| jd |j
| jf � d g}t| j||j
d
�\} }
t �� dk�r�zt|j
� W n t�yV Y nR0 d}t|j
�D ]@}t jd||f ddd� |�d��s�t jddd� |d7 }�qft�|j
� | dk�r�td| jd�|�|
f ��|
S )Nr z'%s'r. z-existr/ z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %dZrestore)�stdinrM rH z%8d: %sr )�nofmt�nlrD )r^ r )r* r- r r2 r3 �writer" �close�os�statr r r r! r �st_sizer ZgetDebugLogLevelr
� ExceptionZdebug3�endswith�unlinkr# )r r5 r, �entriesZcreate_optionsZ
entry_optionsZ temp_filer$ r7 r8 r> rc r& r' rW rV r r r � set_restore� s^
� ��
�zipset.set_restorec C s dg}|r|� |� | �|�S )N�flushr[ r\ r r r � set_flush� s
zipset.set_flushc C s | � d||g�S )N�renamer< )r Z old_set_nameZ new_set_namer r r rl � s z ipset.renamec C s | � d||g�S )N�swapr< )r Z
set_name_1Z
set_name_2r r r rm � s z
ipset.swapc C s | � dg�S )N�versionr< r r r r rn � s z
ipset.version)N)N)NN)N)NN)�__name__�
__module__� __qualname__�__doc__r r4 r* r- r9 r: r? rA rB rG rY rZ ri rk rl rm rn r r r r r H s&
'
�
8r c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r( r) )r r r r r s r c C s4 | � � }tD ]"}||v r t| || kr ||= q |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)r6 rU rX r r r r s �r c C sb g }| � d�D ]H}z&|�d� |�ttj|dd��� W q tyT |�|� Y q0 qd�|�S )z! Normalize IP addresses in entry �,�/F��strict)rF �indexr3 �str� ipaddress�
ip_networkr# r" )r> Z_entryZ_partr r r �normalize_ipset_entry s
r} c C st t | �d��dkrdS ztj| dd�}W n ty< Y dS 0 |D ],}|�tj|dd��rBttjd� | |���qBdS )z: Check if entry overlaps any entry in the list of entries ru rH NFrw z,Entry '{}' overlaps with existing entry '{}')
r( rF r{ r| r# �overlapsr r �
INVALID_ENTRY�format)r> rh Z
entry_network�itrr r r � check_entry_overlaps_existing s r� c C sz zdd� | D �} W n t y& Y dS 0 t| �dkr8dS | �� | �d�}| D ]&}|�|�rpttjd�||���|}qNdS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )Frw )r{ r| rJ r r r r 0 r z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r# r( �sort�popr~ r r r r� )rh Z prev_networkZcurrent_networkr r r � check_for_overlapping_entries- s 2
r� ) rr �__all__Zos.pathrb r{ Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r
Zfirewall.configr r) r+ ZIPSET_CREATE_OPTIONSrt �objectr r r r} r� r� r r r r �<module> s6 � � ;