3 Y�j�%�@sfdZdgZddlmZddlmZmZmZm Z ddl mZddlm Z ddlmZGdd�de�Zd S) z ipset backend� FirewallIPSet�)�log)�remove_default_create_options�normalize_ipset_entry�check_entry_overlaps_existing�check_for_overlapping_entries)�IPSet)�errors)� FirewallErrorc@s�eZdZdd�Zdd�Zdd�Zdd�Zd d �Zdd�Zd d�Z d4dd�Z dd�Zdd�Zd5dd�Z dd�Zdd�Zdd�Zd6dd �Zd!d"�Zd#d$�Zd%d&�Zd7d'd(�Zd)d*�Zd+d,�Zd-d.�Zd/d0�Zd1d2�Zd3S)8rcCs||_i|_dS)N)�_fw�_ipsets)�self�fw�r�/usr/lib/python3.6/fw_ipset.py�__init__#szFirewallIPSet.__init__cCsd|j|jfS)Nz%s(%r))� __class__r)r rrr�__repr__'szFirewallIPSet.__repr__cCs|jj�dS)N)r�clear)r rrr�cleanup,szFirewallIPSet.cleanupcCs||j�krttj|��dS)N)� get_ipsetsr r Z INVALID_IPSET)r �namerrr�check_ipset/szFirewallIPSet.check_ipsetcCs||j�kS)N)r)r rrrr�query_ipset3szFirewallIPSet.query_ipsetcCst|jj��S)N)�sortedr�keys)r rrrr6szFirewallIPSet.get_ipsetscCst|j�dkS)Nr)�lenr)r rrr� has_ipsets9szFirewallIPSet.has_ipsetsFcCs&|j|�|j|}|r"|j|�|S)N)rr�check_applied_obj)r r�applied�objrrr� get_ipset<s zFirewallIPSet.get_ipsetcCs4g}|jjr|j|jj�|jjr0|j|jj�|S)N)rZnftables_enabled�appendZnftables_backendZ ipset_enabledZ ipset_backend)r �backendsrrrr#CszFirewallIPSet.backendscCs0|j|jjkr ttjd|j��||j|j<dS)Nz'%s' is not supported by ipset.)�typerZipset_supported_typesr r ZINVALID_TYPErr)r r rrr� add_ipsetKszFirewallIPSet.add_ipsetcCs�|j|}|jrh|rhy x|j�D]}|j|�q"WWqttk rd}zttj|��WYdd}~XqtXntj d|�|j|=dS)Nz,Keeping ipset '%s' because of timeout option) rrr#�set_destroy� Exceptionr r �COMMAND_FAILEDr�debug1)r rZkeepr �backend�msgrrr�remove_ipsetQs zFirewallIPSet.remove_ipsetc<Cs$|j|}�x|j�D�]}|jdkr�|j�}||kr�d|jksv|jddksv|j||dksvt|j�||dkr�y|j|�Wn.tk r�}zt t j|��WYdd}~XnX|jj �r�y|j|j|j|j�Wn0tk �r}zt t j|��WYdd}~Xn&Xd|_d|jk�r,|jddk�r,qy|j|j�Wn0tk �rl}zt t j|��WYdd}~XnXx�|jD]J}y|j|j|�Wn0tk �r�}zt t j|��WYdd}~XnX�qvWqy|j|j|j|j|jd�Wn0tk �r}zt t j|��WYdd}~XqXd|_qWdS)N�ipset�timeout�0r�T)rr#rZset_get_active_terse�optionsr$�rm_def_cr_optsr&r'r r r(r�_individual_callsZ set_creater� set_flush�entries�set_add�set_restore)r rr r*Zactiver+�entryrrr�apply_ipset]sL & zFirewallIPSet.apply_ipsetcCs>x8|j�D],}|j|}d|_tjd|�|j|�q WdS)NFzApplying ipset '%s')rrrrr)r9)r rr rrr�apply_ipsets�s zFirewallIPSet.apply_ipsetscCs�xz|j�D]n}|jdkrq x\|j�D]P}y|j|�|j|�Wq$tk rr}z|jtjkrb|�WYdd}~Xq$Xq$Wq WdS)NZnftables) r#rr� check_appliedr&r �coder �NOT_APPLIED)r r*r-r+rrr�flush�s zFirewallIPSet.flushTcCs|j||d�jS)N)r)r!r$)r rrrrr�get_type�szFirewallIPSet.get_typecCst|j|dd�jjd��S)NT)r�,)rr!r$�split)r rrrr� get_dimension�szFirewallIPSet.get_dimensioncCs|j|�}|j|�dS)N)r!r)r rr rrrr;�s zFirewallIPSet.check_appliedcCs|jsttj|j��dS)N)rr r r=r)r r rrrr�szFirewallIPSet.check_applied_objcCs.|j||d�}d|jkr*|jddkr*dSdS)N)rZfamilyZinet6Zipv6Zipv4)r!r1)r rrr rrr� get_family�s zFirewallIPSet.get_familycCs�|j|dd�}t|�}tj||j|j�||jkrFttj d||f��t ||j�y$x|j�D]}|j|j |�q^WWn.tk r�}zttj|��WYdd}~Xn&Xd|jks�|jddkr�|jj|�dS)NT)rz'%s' already is in '%s'r.r/)r!rr�check_entryr1r$r5r r ZALREADY_ENABLEDrr#r6rr'r(r")r rr8r r*r+rrr� add_entry�s zFirewallIPSet.add_entrycCs�|j|dd�}t|�}||jkr4ttjd||f��y$x|j�D]}|j|j|�q@WWn.t k r�}zttj |��WYdd}~Xn&Xd|jks�|jddkr�|jj|�dS)NT)rz'%s' not in '%s'r.r/) r!rr5r r ZNOT_ENABLEDr#Z set_deleterr'r(r1�remove)r rr8r r*r+rrr�remove_entry�s zFirewallIPSet.remove_entrycCsD|j|dd�}t|�}d|jkr:|jddkr:ttj|��||jkS)NT)rr.r/)r!rr1r r ZIPSET_WITH_TIMEOUTr5)r rr8r rrr�query_entry�s zFirewallIPSet.query_entrycCs|j|dd�}|jS)NT)r)r!r5)r rr rrr�get_entries�szFirewallIPSet.get_entriescCs@|j|dd�}t|�x|D]}tj||j|j�qWd|jksN|jddkrT||_y"x|j�D]}|j|j �q`WWn.t k r�}zttj |��WYdd}~XnXd|_yXxR|j�D]F}|jjr�x8|jD]}|j|j |�q�Wq�|j|j |j|j|jd�q�WWn0t k �r4}zttj |��WYdd}~XnXd|_dS)NT)rr.r/)r!rrrDr1r$r5r#r4rr'r r r(rrr3r6r7)r rr5r r8r*r+rrr�set_entries�s. zFirewallIPSet.set_entriesN)F)F)T)T)�__name__� __module__�__qualname__rrrrrrrr!r#r%r,r9r:r>r?rBr;rrCrErGrHrIrJrrrrr"s0 1 N)�__doc__�__all__Zfirewall.core.loggerrZfirewall.core.ipsetrr2rrrZfirewall.core.io.ipsetrZfirewallr Zfirewall.errorsr �objectrrrrr�s