3
Yj% @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl
m Z ddl m
Z
ddlmZ G dd deZd S )
z
ipset backend
FirewallIPSet )log) remove_default_create_optionsnormalize_ipset_entry check_entry_overlaps_existing check_for_overlapping_entries)IPSet)errors)
FirewallErrorc @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z d4ddZ
dd Z dd Z d5ddZ
dd Zdd Zd d Zd6d d Zd!d" Zd#d$ Zd%d& Zd7d'd(Zd)d* Zd+d, Zd-d. Zd/d0 Zd1d2 Zd3S )8r c C s || _ i | _d S )N)_fw_ipsets)selffw r /usr/lib/python3.6/fw_ipset.py__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r)) __class__r )r
r r r __repr__' s zFirewallIPSet.__repr__c C s | j j d S )N)r clear)r
r r r cleanup, s zFirewallIPSet.cleanupc C s || j krttj|d S )N)
get_ipsetsr
r Z
INVALID_IPSET)r
namer r r check_ipset/ s zFirewallIPSet.check_ipsetc C s || j kS )N)r )r
r r r r query_ipset3 s zFirewallIPSet.query_ipsetc C s t | jj S )N)sortedr keys)r
r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | jdkS )Nr )lenr )r
r r r
has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | j | | j| }|r"| j| |S )N)r r check_applied_obj)r
r appliedobjr r r get_ipset< s
zFirewallIPSet.get_ipsetc C s4 g }| j jr|j| j j | j jr0|j| j j |S )N)r Znftables_enabledappendZnftables_backendZ
ipset_enabledZ
ipset_backend)r
backendsr r r r# C s zFirewallIPSet.backendsc C s0 |j | jjkr ttjd|j || j|j< d S )Nz '%s' is not supported by ipset.)typer Zipset_supported_typesr
r Z INVALID_TYPEr r )r
r r r r add_ipsetK s zFirewallIPSet.add_ipsetc C s | j | }|jrh| rhy x| j D ]}|j| q"W W qt tk
rd } zttj|W Y d d }~X qtX n tj d| | j |= d S )Nz,Keeping ipset '%s' because of timeout option)
r r r# set_destroy Exceptionr
r COMMAND_FAILEDr debug1)r
r Zkeepr backendmsgr r r remove_ipsetQ s
zFirewallIPSet.remove_ipsetc < C s$ | j | }x| j D ]}|jdkr|j }||krd|jksv|jd dksv|j|| d ksvt|j|| d kry|j| W n. tk
r } zt t
j |W Y d d }~X nX | j j
ry|j|j|j|j W n0 tk
r } zt t
j |W Y d d }~X n&X d|_d|jkr,|jd dkr,qy|j|j W n0 tk
rl } zt t
j |W Y d d }~X nX x|jD ]J}y|j|j| W n0 tk
r } zt t
j |W Y d d }~X nX qvW qy |j|j|j|j|jd W n0 tk
r } zt t
j |W Y d d }~X qX d|_qW d S )Nipsettimeout0r T)r r# r Zset_get_active_terseoptionsr$ rm_def_cr_optsr& r' r
r r( r _individual_callsZ
set_creater set_flushentriesset_add set_restore)r
r r r* Zactiver+ entryr r r apply_ipset] sL
&
zFirewallIPSet.apply_ipsetc C s> x8| j D ],}| j| }d|_tjd| | j| q
W d S )NFzApplying ipset '%s')r r r r r) r9 )r
r r r r r apply_ipsets s
zFirewallIPSet.apply_ipsetsc C s xz| j D ]n}|jdkrq
x\| j D ]P}y| j| |j| W q$ tk
rr } z|jtjkrb|W Y d d }~X q$X q$W q
W d S )NZnftables) r# r r
check_appliedr& r
coder NOT_APPLIED)r
r* r- r+ r r r flush s
zFirewallIPSet.flushTc C s | j ||djS )N)r )r! r$ )r
r r r r r get_type s zFirewallIPSet.get_typec C s t | j|ddjjdS )NT)r ,)r r! r$ split)r
r r r r
get_dimension s zFirewallIPSet.get_dimensionc C s | j |}| j| d S )N)r! r )r
r r r r r r; s
zFirewallIPSet.check_appliedc C s |j sttj|jd S )N)r r
r r= r )r
r r r r r s z FirewallIPSet.check_applied_objc C s. | j ||d}d|jkr*|jd dkr*dS dS )N)r ZfamilyZinet6Zipv6Zipv4)r! r1 )r
r r r r r r
get_family s
zFirewallIPSet.get_familyc C s | j |dd}t|}tj||j|j ||jkrFttj d||f t
||j y$x | j D ]}|j |j
| q^W W n. tk
r } zttj|W Y d d }~X n&X d|jks|jd dkr|jj| d S )NT)r z'%s' already is in '%s'r. r/ )r! r r check_entryr1 r$ r5 r
r ZALREADY_ENABLEDr r# r6 r r' r( r" )r
r r8 r r* r+ r r r add_entry s
zFirewallIPSet.add_entryc C s | j |dd}t|}||jkr4ttjd||f y$x | j D ]}|j|j| q@W W n. t k
r } zttj
|W Y d d }~X n&X d|j ks|j d dkr|jj | d S )NT)r z'%s' not in '%s'r. r/ )
r! r r5 r
r Z NOT_ENABLEDr# Z
set_deleter r' r( r1 remove)r
r r8 r r* r+ r r r remove_entry s
zFirewallIPSet.remove_entryc C sD | j |dd}t|}d|jkr:|jd dkr:ttj|||jkS )NT)r r. r/ )r! r r1 r
r ZIPSET_WITH_TIMEOUTr5 )r
r r8 r r r r query_entry s
zFirewallIPSet.query_entryc C s | j |dd}|jS )NT)r )r! r5 )r
r r r r r get_entries s zFirewallIPSet.get_entriesc C s@ | j |dd}t| x |D ]}tj||j|j q W d|jksN|jd dkrT||_y"x | j D ]}|j|j q`W W n. t
k
r } zt t j
|W Y d d }~X nX d|_yXxR| j D ]F}| jjrx8|jD ]}|j|j | qW q|j|j |j|j|jd qW W n0 t
k
r4 } zt t j
|W Y d d }~X nX d|_d S )NT)r r. r/ )r! r r rD r1 r$ r5 r# r4 r r' r
r r( r r r3 r6 r7 )r
r r5 r r8 r* r+ r r r set_entries s.
zFirewallIPSet.set_entriesN)F)F)T)T)__name__
__module__ __qualname__r r r r r r r r! r# r% r, r9 r: r> r? rB r; r rC rE rG rH rI rJ r r r r r " s0
1
N)__doc____all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r2 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr
objectr r r r r s