File: //lib/python3/dist-packages/firewall/core/__pycache__/ipset.cpython-310.pyc
o
bhAbG2 � @ s� d Z g d�ZddlZddlZddlmZ ddlmZ ddl m
Z
ddl m Z ddl
mZmZ dd lmZ d
Zg d �Zd d
d
dd�Zdddd�ZG dd� de�Zdd� Zdd� Zdd� Zd d � Zd d � Z dS ) zThe ipset command wrapper)�ipset�check_ipset_name� remove_default_create_options� N)�errors)�
FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6�valuez
value in secs)�family�hashsize�maxelem�timeout�inet�1024�65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd'd
d�Z dd� Z
dd� Z dd� Z d'dd�Z
d(dd�Zdd� Zd'dd �Z d(d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ))r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name��self� r �5/usr/lib/python3/dist-packages/firewall/core/ipset.py�__init__K �
zipset.__init__c C s^ dd� |D �}t �d| j| jd�|�� t| j|�\}}|dkr-td| jd�|�|f ��|S )zCall ipset with argsc S s g | ]}d | �qS )�%sr )�.0�itemr r r �
<listcomp>R � z ipset.__run.<locals>.<listcomp>z %s: %s %s� r �'%s %s' failed: %s)r �debug2� __class__r �joinr �
ValueError)r �args�_args�status�retr r r �__runO s
�z ipset.__runc C s t |�tkrttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r � INVALID_NAME)r r r r r �
check_nameZ s
��zipset.check_namec
C s� g }d}z| � dg�}W n ty% } z
t�d| � W Y d}~nd}~ww |�� }d}|D ]&}|rM|�� �dd�}|d |vrM|d tv rM|�|d � |� d�rTd }q.|S )
z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T)
� _ipset__runr' r �debug1�
splitlines�strip�split� IPSET_TYPES�append�
startswith)r r+ �output�ex�lines�in_types�line�splitsr r r �set_supported_types` s& ��
�zipset.set_supported_typesc C s( t |�tks
|tvrttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r- r. r8 r r � INVALID_TYPE)r � type_namer r r �
check_typeu s
��zipset.check_typeNc C s` | � |� | �|� d||g}t|t�r+|�� D ]\}}|�|� |dkr*|�|� q| �|�S )z+Create an ipset with name, type and options�creater1 )r0 rD �
isinstance�dict�itemsr9 r3 )r �set_namerC �optionsr( �key�valr r r �
set_create{ s
�
zipset.set_createc C s | � |� | �d|g�S )N�destroy)r0 r3 )r rI r r r � set_destroy� s
zipset.set_destroyc C � d||g}| � |�S )N�add�r3 �r rI �entryr( r r r �set_add� r z
ipset.set_addc C rP )N�delrR rS r r r �
set_delete� r zipset.set_deletec C s, d||g}|r|� dd�|� � | �|�S )N�testr r" )r9 r& r3 )r rI rT rJ r( r r r rX � s
z
ipset.testc C s2 dg}|r
|� |� |r|�|� | �|��d�S )N�list�
)r9 �extendr3 r7 )r rI rJ r( r r r �set_list� s
zipset.set_listc C s4 | j dgd�}i }d }}i }|D ]�}t|�dk rqdd� |�dd�D �}t|�dkr,q|d d
kr7|d }q|d d krB|d }q|d d kr�|d �� }d } | t|�k r�|| }
|
d
v ryt|�| kro| d7 } || ||
< n
t�d|� i S | d7 } | t|�k sV|r�|r�|t|�f||< d }}|�� q|S )z" Get active ipsets (only headers) z-terse)rJ N� c S s g | ]}|� � �qS r )r6 �r �xr r r r � r! z.ipset.set_get_active_terse.<locals>.<listcomp>�:r2 r �Name�Type�Header)r r r r �netmaskz&Malformed ipset list -terse output: %s)r\ r- r7 r �errorr �clear) r r= r+ �_name�_type�_optionsr? �pairr@ �i�optr r r �set_get_active_terse� sJ
� � ��zipset.set_get_active_tersec C � dg}|r
|� |� | �|�S )N�save�r9 r3 �r rI r( r r r ro � �
z
ipset.savec C s� | � |� | �|� t� }d|v rd| }d||dg}|r4|�� D ]\}} |�|� | dkr3|�| � q!|�dd�|� � |�d| � |D ]#}
d|
v rQd|
}
|ra|�d||
d�|�f � qG|�d ||
f � qG|�� t� |j
�} t � d
| j
| jd |j
| jf � d g}t| j||j
d
�\} }
t �� dkr�zt|j
� W n ty� Y n'w d}t|j
�D ] }t jd||f ddd� |�d�s�t jddd� |d7 }q�t�|j
� | dkr�td| jd�|�|
f ��|
S )Nr" z'%s'rE z-existr1 z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %d�restore)�stdinr2 r] z%8d: %sr )�nofmt�nlrZ )ru r# )r0 rD r rH r9 �writer& �close�os�statr r r$ r% r �st_sizer �getDebugLogLevelr
� Exception�debug3�endswith�unlinkr' )r rI rC �entries�create_options�
entry_options� temp_filer( rK rL rT rz r* r+ rk r? r r r � set_restore� sb
�� �
� �
�zipset.set_restorec C rn )N�flushrp rq r r r � set_flush rr zipset.set_flushc C � | � d||g�S )N�renamerR )r � old_set_name� new_set_namer r r r�
� z ipset.renamec C r� )N�swaprR )r �
set_name_1�
set_name_2r r r r� r� z
ipset.swapc C s | � dg�S )N�versionrR r r r r r� s z
ipset.version)N)NN)�__name__�
__module__� __qualname__�__doc__r r3 r0 rA rD rM rO rU rW rX r\ rm ro r� r� r� r� r� r r r r r H s*
'
�8 r c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r- r. )r r r r r s r c C s4 | � � }tD ]}||v rt| || kr||= q|S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)rJ ri rl r r r r s �r c C s` g }| � d�D ]#}z|�d� |�ttj|dd��� W q ty* |�|� Y qw d�|�S )z! Normalize IP addresses in entry �,�/F��strict)r7 �indexr9 �str� ipaddress�
ip_networkr' r& )rT �_entry�_partr r r �normalize_ipset_entry& s
�
r� c C st t | �d��dkr dS z tj| dd�}W n
ty Y dS w |D ]}|�tj|dd��r7ttjd� | |���q!dS )z: Check if entry overlaps any entry in the list of entries r� r] NFr� z,Entry '{}' overlaps with existing entry '{}')
r- r7 r� r� r' �overlapsr r �
INVALID_ENTRY�format)rT r� �
entry_network�itrr r r � check_entry_overlaps_existing2 s ���r� c C sj z dd� | D �} W n
t y Y dS w | �� | �d�}| D ]}|�|�r0ttjd�||���|}q dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ] }t j|d d��qS )Fr� )r� r� r^ r r r r E s z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}')r' �sort�popr� r r r� r� )r� � prev_network�current_networkr r r � check_for_overlapping_entriesB s �4
�r� ) r� �__all__�os.pathry r� �firewallr �firewall.errorsr �firewall.core.progr �firewall.core.loggerr �firewall.functionsr r
�firewall.configr r. r8 �IPSET_CREATE_OPTIONSr� �objectr r r r� r� r� r r r r �<module> s8 � � P