a
«°iµ/ ã @ sÊ d Z g d¢ZddlZddlZddlmZ ddlmZ ddl m
Z
ddl m Z ddl
mZmZ dd lmZ d
Zg d ¢Zd d
d
ddœZddddœZG dd„ deƒZdd„ Zdd„ Zdd„ Zd d „ Zd d „ Z dS ) zThe ipset command wrapper)ÚipsetÚcheck_ipset_nameÚ remove_default_create_optionsé N)Úerrors)Ú
FirewallError)ÚrunProg)Úlog)ÚtempFileÚreadfile)ÚCOMMANDSé ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6Úvaluez
value in secs)ÚfamilyÚhashsizeÚmaxelemÚtimeoutZinetZ1024Z65536)r r r c @ s¢ e Zd ZdZdd„ Zdd„ Zdd„ Zdd „ Zd%d d „Zd
d„ Z dd„ Z
dd„ Z d&dd„Z d'dd„Z
dd„ Zd(dd„Zd)dd „Zd d „ Zd d „ Zd!d"„ Zd#d$„ Zd
S )*r zipset command wrapper classc C s t d | _d| _d S )Nr )r Ú_commandÚname©Úself© r ú7/usr/lib/python3.9/site-packages/firewall/core/ipset.pyÚ__init__K s
zipset.__init__c C s^ dd„ |D ƒ}t d| j| jd |¡¡ t| j|ƒ\}}|dkrZtd| jd |¡|f ƒ‚|S )zCall ipset with argsc S s g | ] }d | ‘qS )ú%sr )Ú.0Úitemr r r Ú
R ó z ipset.__run..z %s: %s %sú r ú'%s %s' failed: %s)r Údebug2Ú __class__r Újoinr Ú
ValueError)r ÚargsÚ_argsÚstatusÚretr r r Z__runO s
ÿz ipset.__runc C s t |ƒtkr ttjd| ƒ‚dS )zCheck ipset namez ipset name '%s' is not validN)ÚlenÚIPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r Ú
check_nameZ s ÿzipset.check_namec C s( t |ƒtks|tvr$ttjd| ƒ‚dS )zCheck ipset typez!ipset type name '%s' is not validN)r( r) Ú IPSET_TYPESr r Z INVALID_TYPE)r Ú type_namer r r Ú
check_type` s ÿzipset.check_typeNc C s` | |¡ | |¡ d||g}t|tƒrV| ¡ D ]$\}}| |¡ |dkr0| |¡ q0| |¡S )z+Create an ipset with name, type and optionsÚcreateÚ )r* r- Ú
isinstanceÚdictÚitemsÚappendÚ _ipset__run)r Úset_namer, Úoptionsr$ ÚkeyÚvalr r r Ú
set_createf s
zipset.set_createc C s | |¡ | d|g¡S )NZdestroy)r* r4 )r r5 r r r Ú set_destroys s
zipset.set_destroyc C s d||g}| |¡S )NÚadd©r4 ©r r5 Úentryr$ r r r Úset_addw s
z
ipset.set_addc C s d||g}| |¡S )NÚdelr< r= r r r Ú
set_delete{ s
zipset.set_deletec C s, d||g}|r"| dd |¡ ¡ | |¡S )NÚtestr r )r3 r" r4 )r r5 r> r6 r$ r r r rB s
z
ipset.testc C s2 dg}|r| |¡ |r"| |¡ | |¡ d¡S )NÚlistÚ
)r3 Úextendr4 Úsplit)r r5 r6 r$ r r r Úset_list… s
zipset.set_listc C s4 | j dgd}i }d }}i }|D ]
}t|ƒdk r6q"dd„ | dd¡D ƒ}t|ƒdkr\q"q"|d d
krr|d }q"|d d krˆ|d }q"|d d kr"|d ¡ }d } | t|ƒk r|| }
|
d
v røt|ƒ| krä| d7 } || ||
< nt d|¡ i S | d7 } q¤|r |r |t|ƒf||< d }}| ¡ q"|S )z" Get active ipsets (only headers) z-terse)r6 Né c S s g | ] }| ¡ ‘qS r )Ústrip©r Úxr r r r — r z.ipset.set_get_active_terse..ú:é r ÚNameÚTypeZHeader)r r r r Únetmaskz&Malformed ipset list -terse output: %s)rG r( rF r Úerrorr Úclear) r Úlinesr' Ú_nameZ_typeÚ_optionsÚlineZpairZsplitsÚiÚoptr r r Úset_get_active_terse sF
ÿ
ÿ
zipset.set_get_active_tersec C s dg}|r| |¡ | |¡S )NÚsave©r3 r4 ©r r5 r$ r r r rZ ´ s
z
ipset.savec C sÜ | |¡ | |¡ tƒ }d|v r*d| }d||dg}|rh| ¡ D ]$\}} | |¡ | dkrB| | ¡ qB| dd |¡ ¡ | d| ¡ |D ]F}
d|
v r¢d|
}
|rÂ| d||
d |¡f ¡ qŽ| d ||
f ¡ qŽ| ¡ t |j
¡} t d
| j
| jd |j
| jf ¡ d g}t| j||j
d
\} }
t ¡ dkr¨zt|j
ƒ W n tyV Y nR0 d}t|j
ƒD ]@}t jd||f ddd | d¡sœt jddd |d7 }qft |j
¡ | dkrØtd| jd |¡|
f ƒ‚|
S )Nr z'%s'r. z-existr/ z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %dZrestore)ÚstdinrM rH z%8d: %sr )ÚnofmtÚnlrD )r^ r )r* r- r r2 r3 Úwriter" ÚcloseÚosÚstatr r r r! r Úst_sizer ZgetDebugLogLevelr
Ú ExceptionZdebug3ÚendswithÚunlinkr# )r r5 r, ÚentriesZcreate_optionsZ
entry_optionsZ temp_filer$ r7 r8 r> rc r& r' rW rV r r r Ú set_restoreº s^
ÿ ÿÿ
ÿzipset.set_restorec C s dg}|r| |¡ | |¡S )NÚflushr[ r\ r r r Ú set_flushò s
zipset.set_flushc C s | d||g¡S )NÚrenamer< )r Z old_set_nameZ new_set_namer r r rl ø s z ipset.renamec C s | d||g¡S )NÚswapr< )r Z
set_name_1Z
set_name_2r r r rm û s z
ipset.swapc C s | dg¡S )NÚversionr< r r r r rn þ s z
ipset.version)N)N)NN)N)NN)Ú__name__Ú
__module__Ú __qualname__Ú__doc__r r4 r* r- r9 r: r? rA rB rG rY rZ ri rk rl rm rn r r r r r H s&
'
ÿ
8r c C s t | ƒtkrdS dS )z"Return true if ipset name is validFT)r( r) )r r r r r s r c C s4 | ¡ }tD ]"}||v r t| || kr ||= q |S )z( Return only non default create options )ÚcopyÚ IPSET_DEFAULT_CREATE_OPTIONS)r6 rU rX r r r r s ÿr c C sb g }| d¡D ]H}z&| d¡ | ttj|ddƒ¡ W q tyT | |¡ Y q0 qd |¡S )z! Normalize IP addresses in entry ú,ú/F©Ústrict)rF Úindexr3 ÚstrÚ ipaddressÚ
ip_networkr# r" )r> Z_entryZ_partr r r Únormalize_ipset_entry s
r} c C st t | d¡ƒdkrdS ztj| dd}W n ty< Y dS 0 |D ],}| tj|dd¡rBttjd | |¡ƒ‚qBdS )z: Check if entry overlaps any entry in the list of entries ru rH NFrw z,Entry '{}' overlaps with existing entry '{}')
r( rF r{ r| r# Úoverlapsr r Ú
INVALID_ENTRYÚformat)r> rh Z
entry_networkÚitrr r r Ú check_entry_overlaps_existing s r‚ c C sz zdd„ | D ƒ} W n t y& Y dS 0 t| ƒdkr8dS | ¡ | d¡}| D ]&}| |¡rpttjd ||¡ƒ‚|}qNdS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d‘qS )Frw )r{ r| rJ r r r r 0 r z1check_for_overlapping_entries..Nr z Entry '{}' overlaps entry '{}') r# r( ÚsortÚpopr~ r r r r€ )rh Z prev_networkZcurrent_networkr r r Ú check_for_overlapping_entries- s 2
r… ) rr Ú__all__Zos.pathrb r{ Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r
Zfirewall.configr r) r+ ZIPSET_CREATE_OPTIONSrt Úobjectr r r r} r‚ r… r r r r Ú s6 ü ý ;