a
® jAN ã @ sD d dl Z d dlT d dlZd dlZdZG dd„ dƒZG dd„ dƒZdS )é N)Ú*z0.1c @ s e Zd ZdZdd„ Zdd„ ZdS )ÚSchemaValidatorz+Libnftables JSON validator using jsonschemac C s^ t j t j t¡d¡}t|dƒ }t |¡| _W d ƒ n1 sB0 Y dd l }|| _ d S )Nz schema.jsonÚrr )
ÚosÚpathÚjoinÚdirnameÚ__file__ÚopenÚjsonÚloadÚschemaÚ
jsonschema)ÚselfZ schema_pathZ schema_filer © r ú5/usr/lib/python3.9/site-packages/nftables/nftables.pyÚ__init__ s
*zSchemaValidator.__init__c C s | j j|| jd d S )N)Úinstancer
)r Úvalidater
)r r r r r r " s zSchemaValidator.validateN)Ú__name__Ú
__module__Ú __qualname__Ú__doc__r r r r r r r s r c
@ s² e Zd ZdZdddœZddddddd d
œZddddddd d d d
dddœ ZdZdkdd„Zdd„ Z dd„ Z
dd„ Z dd „ Z d d „ Z
d d „ Zd!d"„ Zd#d$„ Zd%d&„ Zd'd(„ Zd)d*„ Zd+d,„ Zd-d.„ Zd/d0„ Zd1d2„ Zd3d4„ Zd5d6„ Zd7d8„ Zd9d:„ Zd;d<„ Z d=d>„ Z d?d@„ Z dAdB„ Z dCdD„ Z dEdF„ Z!dGdH„ Z"dIdJ„ Z#dKdL„ Z$dMdN„ Z%dOdP„ Z&dQdR„ Z'dSdT„ Z(dUdV„ Z)dWdX„ Z*dYdZ„ Z+d[d\„ Z,d]d^„ Z-d_d`„ Z.dadb„ Z/dcdd„ Z0dedf„ Z1dgdh„ Z2didj„ Z3dS )lÚNftablesz*A class representing libnftables interfaceé é )zno-dnsr é é é é é@ )ÚscannerÚparserÚevalZnetlinkZmnlz proto-ctxZsegtreeé€ é i i i ) Ú
reversednsÚserviceÚ statelessÚhandler ÚechoÚguidÚ
numeric_protoÚ numeric_prioÚnumeric_symbolÚ numeric_timeÚterseNúlibnftables.so.1c C s d| _ t |¡}|j| _t| j_tg| j_|j| _t | j_tg| j_|j
| _
t | j
_tt g| j
_|j | _ t | j _tg| j _|j | _ tt g| j _|j
| _
t| j
_tg| j
_|j| _ttg| j_|j| _t| j_tg| j_|j| _t| j_tg| j_|j| _t| j_tg| j_|j| _t| j_tg| j_|j| _t| j_ttg| j_|j| _t| j_ttg| j_|j| _t| j_ttg| j_|j| _tg| j_|j| _t| j_tg| j_|j| _ttg| j_|j| _t| j_ttg| j_|j | _ tg| j _|j | _ tg|j _| d¡| _ | | j ¡ | | j ¡ dS )al Instantiate a new Nftables class object.
Accepts a shared object file to open, by default standard search path
is searched for a file named 'libnftables.so'.
After loading the library using ctypes module, a new nftables context
is requested from the library and buffering of output and error streams
is turned on.
Nr ) Ú_Nftables__ctxZcdllZ LoadLibraryZ nft_ctx_newZc_void_pZrestypeZc_intÚargtypesÚnft_ctx_input_get_flagsZc_uintÚnft_ctx_input_set_flagsÚnft_ctx_output_get_flagsÚnft_ctx_output_set_flagsÚnft_ctx_output_get_debugÚnft_ctx_output_set_debugZnft_ctx_buffer_outputÚnft_ctx_get_output_bufferZc_char_pZnft_ctx_buffer_errorÚnft_ctx_get_error_bufferÚnft_run_cmd_from_bufferÚnft_run_cmd_from_filenameÚnft_ctx_add_include_pathÚnft_ctx_clear_include_pathsÚnft_ctx_get_dry_runZc_boolÚnft_ctx_set_dry_runÚnft_ctx_add_varÚnft_ctx_clear_varsÚ nft_ctx_free)r ZsofileÚlibr r r r H sv
zNftables.__init__c C s | j d ur | | j ¡ d | _ d S ©N)r2 rD ©r r r r Ú__del__§ s
zNftables.__del__c C sD g }| ¡ D ]$\}}||@ r | |¡ || M }q |r@| |¡ |S rF )ÚitemsÚappend)r Ú
flags_dictÚvalÚnamesÚnÚvr r r Ú_flags_from_numeric¬ s
z Nftables._flags_from_numericc C s€ t |ttfƒr|f}d}|D ]^}t |tƒrF| |¡}|d u rrtdƒ‚n,t |tƒrj|dk s`|dkrrtdƒ‚ntdƒ‚||O }q |S )Nr zInvalid argumentl ÿÿ zNot a valid flag)Ú
isinstanceÚstrÚintÚgetÚ
ValueErrorÚ TypeError)r rK ÚvaluesrL rO r r r Ú_flags_to_numeric¶ s
zNftables._flags_to_numericc C s | | j¡}| | j|¡S )zsGet currently active input flags.
Returns a set of flag names. See set_input_flags() for details.
)r4 r2 rP Ú input_flags©r rL r r r Úget_input_flagsÉ s zNftables.get_input_flagsc C s* | | j|¡}| | j|¡}| | j|¡S )a Set input flags.
Resets all input flags to values. Accepts either a single flag or a list
of flags. Each flag might be given either as string or integer value as
shown in the following table:
Name | Value (hex)
-----------------------
"no-dns" | 0x1
"json" | 0x2
"no-dns" disables blocking address lookup.
"json" enables JSON mode for input.
Returns a set of previously active input flags, as returned by
get_input_flags() method.
)rX rY r5 r2 rP ©r rW rL Úoldr r r Úset_input_flagsÑ s zNftables.set_input_flagsc C s | j | }| | j¡|@ dkS ©Nr )Ú output_flagsr6 r2 )r ÚnameÚflagr r r Z__get_output_flagç s
zNftables.__get_output_flagc C sH | j | }| | j¡}|r$||B }n
|| @ }| | j|¡ ||@ dkS r_ )r` r6 r2 r7 )r ra rL rb ÚflagsZ new_flagsr r r Z__set_output_flagë s
zNftables.__set_output_flagc C s
| d¡S )z©Get the current state of reverse DNS output.
Returns a boolean indicating whether reverse DNS lookups are performed
for IP addresses in output.
r& ©Ú_Nftables__get_output_flagrG r r r Úget_reversedns_outputõ s z Nftables.get_reversedns_outputc C s | d|¡S )zŸEnable or disable reverse DNS output.
Accepts a boolean turning reverse DNS lookups in output on or off.
Returns the previous value.
r& ©Ú_Nftables__set_output_flagrZ r r r Úset_reversedns_outputý s z Nftables.set_reversedns_outputc C s
| d¡S )z¦Get the current state of service name output.
Returns a boolean indicating whether service names are used for port
numbers in output or not.
r' rd rG r r r Úget_service_output s zNftables.get_service_outputc C s | d|¡S )z³Enable or disable service name output.
Accepts a boolean turning service names for port numbers in output on
or off.
Returns the previous value.
r' rg rZ r r r Úset_service_output s zNftables.set_service_outputc C s
| d¡S )z„Get the current state of stateless output.
Returns a boolean indicating whether stateless output is active or not.
r( rd rG r r r Úget_stateless_output s z Nftables.get_stateless_outputc C s | d|¡S )z—Enable or disable stateless output.
Accepts a boolean turning stateless output either on or off.
Returns the previous value.
r( rg rZ r r r Úset_stateless_output s z Nftables.set_stateless_outputc C s
| d¡S )z~Get the current state of handle output.
Returns a boolean indicating whether handle output is active or not.
r) rd rG r r r Úget_handle_output( s zNftables.get_handle_outputc C s | d|¡S )zŠEnable or disable handle output.
Accepts a boolean turning handle output on or off.
Returns the previous value.
r) rg rZ r r r Úset_handle_output/ s zNftables.set_handle_outputc C s
| d¡S )zzGet the current state of JSON output.
Returns a boolean indicating whether JSON output is active or not.
r rd rG r r r Úget_json_output8 s zNftables.get_json_outputc C s | d|¡S )zEnable or disable JSON output.
Accepts a boolean turning JSON output either on or off.
Returns the previous value.
r rg rZ r r r Úset_json_output? s zNftables.set_json_outputc C s
| d¡S )zzGet the current state of echo output.
Returns a boolean indicating whether echo output is active or not.
r* rd rG r r r Úget_echo_outputH s zNftables.get_echo_outputc C s | d|¡S )z†Enable or disable echo output.
Accepts a boolean turning echo output on or off.
Returns the previous value.
r* rg rZ r r r Úset_echo_outputO s zNftables.set_echo_outputc C s
| d¡S )z›Get the current state of GID/UID output.
Returns a boolean indicating whether names for group/user IDs are used
in output or not.
r+ rd rG r r r Úget_guid_outputX s zNftables.get_guid_outputc C s | d|¡S )z–Enable or disable GID/UID output.
Accepts a boolean turning names for group/user IDs on or off.
Returns the previous value.
r+ rg rZ r r r Úset_guid_output` s zNftables.set_guid_outputc C s
| d¡S )ztGet current status of numeric protocol output flag.
Returns a boolean value indicating the status.
r, rd rG r r r Úget_numeric_proto_outputi s z!Nftables.get_numeric_proto_outputc C s | d|¡S )zœSet numeric protocol output flag.
Accepts a boolean turning numeric protocol output either on or off.
Returns the previous value.
r, rg rZ r r r Úset_numeric_proto_outputp s z!Nftables.set_numeric_proto_outputc C s
| d¡S )zzGet current status of numeric chain priority output flag.
Returns a boolean value indicating the status.
r- rd rG r r r Úget_numeric_prio_outputy s z Nftables.get_numeric_prio_outputc C s | d|¡S )z°Set numeric chain priority output flag.
Accepts a boolean turning numeric chain priority output either on or
off.
Returns the previous value.
r- rg rZ r r r Úset_numeric_prio_output€ s z Nftables.set_numeric_prio_outputc C s
| d¡S )zsGet current status of numeric symbols output flag.
Returns a boolean value indicating the status.
r. rd rG r r r Úget_numeric_symbol_outputŠ s z"Nftables.get_numeric_symbol_outputc C s | d|¡S )zÂSet numeric symbols output flag.
Accepts a boolean turning numeric representation of symbolic constants
in output either on or off.
Returns the previous value.
r. rg rZ r r r Úset_numeric_symbol_output‘ s z"Nftables.set_numeric_symbol_outputc C s
| d¡S )zqGet current status of numeric times output flag.
Returns a boolean value indicating the status.
r/ rd rG r r r Úget_numeric_time_output› s z Nftables.get_numeric_time_outputc C s | d|¡S )z¹Set numeric times output flag.
Accepts a boolean turning numeric representation of time values
in output either on or off.
Returns the previous value.
r/ rg rZ r r r Úset_numeric_time_output¢ s z Nftables.set_numeric_time_outputc C s
| d¡S )z|Get the current state of terse output.
Returns a boolean indicating whether terse output is active or not.
r0 rd rG r r r Úget_terse_output¬ s zNftables.get_terse_outputc C s | d|¡S )zEnable or disable terse output.
Accepts a boolean turning terse output either on or off.
Returns the previous value.
r0 rg rZ r r r Úset_terse_output³ s zNftables.set_terse_outputc C s | | j¡}| | j|¡S )zmGet currently active debug flags.
Returns a set of flag names. See set_debug() for details.
)r8 r2 rP Ú debug_flagsrZ r r r Ú get_debug¼ s zNftables.get_debugc C s( | | j|¡}| ¡ }| | j|¡ |S )a Set debug output flags.
Accepts either a single flag or a set of flags. Each flag might be
given either as string or integer value as shown in the following
table:
Name | Value (hex)
-----------------------
scanner | 0x1
parser | 0x2
eval | 0x4
netlink | 0x8
mnl | 0x10
proto-ctx | 0x20
segtree | 0x40
Returns a set of previously active debug flags, as returned by
get_debug() method.
)rX r€ r r9 r2 r\ r r r Ú set_debugÄ s zNftables.set_debugc C sd d}t |tƒs d}| d¡}| | j|¡}| | j¡}| | j¡}|rZ| d¡}| d¡}|||fS )aÁ Run a simple nftables command via libnftables.
Accepts a string containing an nftables command just like what one
would enter into an interactive nftables (nft -i) session.
Returns a tuple (rc, output, error):
rc -- return code as returned by nft_run_cmd_from_buffer() fuction
output -- a string containing output written to stdout
error -- a string containing output written to stderr
FTúutf-8)rQ ÚbytesÚencoder< r2 r: r; Údecode)r ZcmdlineZcmdline_is_unicodeÚrcÚoutputÚerrorr r r ÚcmdÝ s
z Nftables.cmdc C sJ | d¡}| t |¡¡\}}}|s.| |¡ t|ƒr@t |¡}|||fS )ai Run an nftables command in JSON syntax via libnftables.
Accepts a hash object as input.
Returns a tuple (rc, output, error):
rc -- return code as returned by nft_run_cmd_from_buffer() function
output -- a hash object containing library standard output
error -- a string containing output written to stderr
T)rq rŠ r ÚdumpsÚlenÚloads)r Ú json_rootZ json_out_oldr‡ rˆ r‰ r r r Újson_cmdõ s
zNftables.json_cmdc C s | j stƒ | _ | j |¡ dS )z©Validate JSON object against libnftables schema.
Accepts a hash object as input.
Returns True if JSON is valid, raises an exception otherwise.
T)Ú validatorr r )r rŽ r r r Ú
json_validate s zNftables.json_validatec C sl d}t |tƒs$d}t|ƒ}| d¡}| | j|¡}| | j¡}| | j¡}|rb| d¡}| d¡}|||fS )aV Run a nftables command set from a file
filename can be a str or a Path
Returns a tuple (rc, output, error):
rc -- return code as returned by nft_run_cmd_from_filename() function
output -- a string containing output written to stdout
error -- a string containing output written to stderr
FTrƒ ) rQ r„ rR r… r= r2 r: r; r† )r ÚfilenameZfilename_is_unicoder‡ rˆ r‰ r r r Ú
cmd_from_file s
zNftables.cmd_from_filec C s2 t |tƒs t|ƒ}| d¡}| | j|¡}|dkS )zªAdd a path to the include file list
The default list includes the built-in default one
Returns True on success, False if memory allocation fails
rƒ r )rQ r„ rR r… r> r2 )r r’ r‡ r r r Úadd_include_path+ s
zNftables.add_include_pathc C s | | j¡ dS )zSClear include path list
Will also remove the built-in default one
N)r? r2 rG r r r Úclear_include_paths7 s z Nftables.clear_include_pathsc C s | | j¡S )zHGet dry run state
Returns True if set, False otherwise
)r@ r2 rG r r r Ú get_dry_run> s zNftables.get_dry_runc C s | ¡ }| | j|¡ |S )zG Set dry run state
Returns the previous dry run state
)r– rA r2 )r Zonoffr] r r r Ú set_dry_runE s zNftables.set_dry_runc C s* t |tƒs| d¡}| | j|¡}|dkS )z\Add a variable to the variable list
Returns True if added, False otherwise
rƒ r )rQ r„ r… rB r2 )r Úvarr‡ r r r Úadd_varO s
zNftables.add_varc C s | | j¡ dS )z Clear variable list
N)rC r2 rG r r r Ú
clear_varsY s zNftables.clear_vars)r1 )4r r r r rY r€ r` r r rH rP rX r[ r^ re rh rf ri rj rk rl rm rn ro rp rq rr rs rt ru rv rw rx ry rz r{ r| r} r~ r r r‚ rŠ r r‘ r“ r” r• r– r— r™ rš r r r r r % sŒ þù ô
_
r )r ZctypesÚsysr ZNFTABLES_VERSIONr r r r r r Ú s