관리-도구
편집 파일: ipset.cpython-39.pyc
a ���gq2 � @ s� d Z g d�ZddlZddlZddlmZ ddlmZ ddl m Z ddl m Z ddl mZmZ dd lmZ d Zg d �Zd d d dd�Zdddd�ZG dd� de�Zdd� Zdd� Zdd� Zd d � Zd d � Z dS ) zThe ipset command wrapper)�ipset�check_ipset_name� remove_default_create_options� N)�errors)� FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz inet|inet6�valuez value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd'd d�Z dd� Z dd� Z dd� Z d(dd�Z d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name��self� r �7/usr/lib/python3.9/site-packages/firewall/core/ipset.py�__init__K s zipset.__init__c C s^ dd� |D �}t �d| j| jd�|�� t| j|�\}}|dkrZtd| jd�|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )�%sr )�.0�itemr r r � <listcomp>R � z ipset.__run.<locals>.<listcomp>z %s: %s %s� r �'%s %s' failed: %s)r �debug2� __class__r �joinr � ValueError)r �args�_args�status�retr r r Z__runO s �z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r � check_nameZ s �zipset.check_namec C s� g }d}z| � dg�}W n2 tyJ } zt�d| � W Y d}~n d}~0 0 |�� }d}|D ]L}|r�|�� �dd�}|d |vr�|d tv r�|�|d � |� d�r\d }q\|S ) z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T) � _ipset__runr# r Zdebug1� splitlines�strip�split� IPSET_TYPES�append� startswith)r r' �output�ex�linesZin_types�line�splitsr r r �set_supported_types` s $ zipset.set_supported_typesc C s( t |�tks|tvr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r( r) r1 r r Z INVALID_TYPE)r � type_namer r r � check_typeu s �zipset.check_typeNc C s` | � |� | �|� d||g}t|t�rV|�� D ]$\}}|�|� |dkr0|�|� q0| �|�S )z+Create an ipset with name, type and options�creater+ )r* r; � isinstance�dict�itemsr2 r- )r �set_namer: �optionsr$ �key�valr r r � set_create{ s zipset.set_createc C s | � |� | �d|g�S )NZdestroy)r* r- )r r@ r r r � set_destroy� s zipset.set_destroyc C s d||g}| � |�S )N�add�r- �r r@ �entryr$ r r r �set_add� s z ipset.set_addc C s d||g}| � |�S )N�delrG rH r r r � set_delete� s zipset.set_deletec C s, d||g}|r"|� dd�|� � | �|�S )N�testr r )r2 r" r- )r r@ rI rA r$ r r r rM � s z ipset.testc C s2 dg}|r|� |� |r"|�|� | �|��d�S )N�list� )r2 �extendr- r0 )r r@ rA r$ r r r �set_list� s zipset.set_listc C s4 | j dgd�}i }d }}i }|D �] }t|�dk r6q"dd� |�dd�D �}t|�dkr\q"q"|d d krr|d }q"|d d kr�|d }q"|d d kr"|d �� }d } | t|�k �r|| } | d v r�t|�| kr�| d7 } || || < nt�d|� i S | d7 } q�|�r |�r |t|�f||< d }}|�� q"|S )z" Get active ipsets (only headers) z-terse)rA N� c S s g | ] }|� � �qS r )r/ �r �xr r r r � r z.ipset.set_get_active_terse.<locals>.<listcomp>�:r, r �Name�TypeZHeader)r r r r �netmaskz&Malformed ipset list -terse output: %s)rQ r( r0 r �errorr �clear) r r6 r' �_nameZ_type�_optionsr7 Zpairr8 �i�optr r r �set_get_active_terse� sF � � zipset.set_get_active_tersec C s dg}|r|� |� | �|�S )N�save�r2 r- �r r@ r$ r r r r` � s z ipset.savec C s� | � |� | �|� t� }d|v r*d| }d||dg}|rh|�� D ]$\}} |�|� | dkrB|�| � qB|�dd�|� � |�d| � |D ]F} d| v r�d| } |r�|�d|| d�|�f � q�|�d || f � q�|�� t� |j �} t � d | j | jd |j | jf � d g}t| j||j d �\} } t �� dk�r�zt|j � W n t�yV Y nR0 d}t|j �D ]@}t jd||f ddd� |�d��s�t jddd� |d7 }�qft�|j � | dk�r�td| jd�|�| f ��| S )Nr z'%s'r< z-existr+ z%s z flush %s z add %s %s %s z add %s %s z%s: %s restore %sz%s: %dZrestore)�stdinr, rR z%8d: %sr )�nofmt�nlrO )rd r )r* r; r r? r2 �writer" �close�os�statr r r r! r �st_sizer ZgetDebugLogLevelr � ExceptionZdebug3�endswith�unlinkr# )r r@ r: �entriesZcreate_optionsZ entry_optionsZ temp_filer$ rB rC rI ri r& r' r] r7 r r r � set_restore� s^ � �� �zipset.set_restorec C s dg}|r|� |� | �|�S )N�flushra rb r r r � set_flush s zipset.set_flushc C s | � d||g�S )N�renamerG )r Z old_set_nameZ new_set_namer r r rr s z ipset.renamec C s | � d||g�S )N�swaprG )r Z set_name_1Z set_name_2r r r rs s z ipset.swapc C s | � dg�S )N�versionrG r r r r rt s z ipset.version)N)N)NN)N)NN)�__name__� __module__� __qualname__�__doc__r r- r* r9 r; rD rE rJ rL rM rQ r_ r` ro rq rr rs rt r r r r r H s( ' � 8r c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r( r) )r r r r r s r c C s4 | � � }tD ]"}||v r t| || kr ||= q |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)rA r\ r^ r r r r s �r c C sb g }| � d�D ]H}z&|�d� |�ttj|dd��� W q tyT |�|� Y q0 qd�|�S )z! Normalize IP addresses in entry �,�/F��strict)r0 �indexr2 �str� ipaddress� ip_networkr# r" )rI Z_entryZ_partr r r �normalize_ipset_entry& s r� c C st t | �d��dkrdS ztj| dd�}W n ty< Y dS 0 |D ],}|�tj|dd��rBttjd� | |���qBdS )z: Check if entry overlaps any entry in the list of entries r{ rR NFr} z,Entry '{}' overlaps with existing entry '{}') r( r0 r� r� r# �overlapsr r � INVALID_ENTRY�format)rI rn Z entry_network�itrr r r � check_entry_overlaps_existing2 s r� c C sz zdd� | D �} W n t y& Y dS 0 t| �dkr8dS | �� | �d�}| D ]&}|�|�rpttjd�||���|}qNdS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )Fr} )r� r� rS r r r r E r z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r# r( �sort�popr� r r r� r� )rn Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2 r� ) rx �__all__Zos.pathrh r� Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r Zfirewall.configr r) r1 ZIPSET_CREATE_OPTIONSrz �objectr r r r� r� r� r r r r �<module> s6 � � P