관리-도구
편집 파일: fw_ipset.cpython-36.pyc
3 @)�f�% � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl m Z ddl m Z ddlmZ G dd� de�Zd S ) z ipset backend� FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z d4dd�Z dd� Z dd� Z d5dd�Z dd� Zdd� Zd d � Zd6d d �Zd!d"� Zd#d$� Zd%d&� Zd7d'd(�Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3S )8r c C s || _ i | _d S )N)�_fw�_ipsets)�self�fw� r � /usr/lib/python3.6/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r r r r �__repr__' s zFirewallIPSet.__repr__c C s | j j� d S )N)r �clear)r r r r �cleanup, s zFirewallIPSet.cleanupc C s || j � krttj|��d S )N)� get_ipsetsr r Z INVALID_IPSET)r �namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || j � kS )N)r )r r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | jj� �S )N)�sortedr �keys)r r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr )r r r r � has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | j |� | j| }|r"| j|� |S )N)r r �check_applied_obj)r r �applied�objr r r � get_ipset< s zFirewallIPSet.get_ipsetc C s4 g }| j jr|j| j j� | j jr0|j| j j� |S )N)r Znftables_enabled�appendZnftables_backendZ ipset_enabledZ ipset_backend)r �backendsr r r r# C s zFirewallIPSet.backendsc C s0 |j | jjkr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr r Z INVALID_TYPEr r )r r r r r � add_ipsetK s zFirewallIPSet.add_ipsetc C s� | j | }|jrh| rhy x| j� D ]}|j|� q"W W qt tk rd } zttj|��W Y d d }~X qtX n tj d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option) r r r# � set_destroy� Exceptionr r �COMMAND_FAILEDr �debug1)r r Zkeepr �backend�msgr r r � remove_ipsetQ s zFirewallIPSet.remove_ipsetc < C s$ | j | }�x| j� D �]}|jdkr�|j� }||kr�d|jksv|jd dksv|j|| d ksvt|j�|| d kr�y|j|� W n. tk r� } zt t j |��W Y d d }~X nX | j j �r�y|j|j|j|j� W n0 tk �r } zt t j |��W Y d d }~X n&X d|_d|jk�r,|jd dk�r,qy|j|j� W n0 tk �rl } zt t j |��W Y d d }~X nX x�|jD ]J}y|j|j|� W n0 tk �r� } zt t j |��W Y d d }~X nX �qvW qy |j|j|j|j|jd � W n0 tk �r } zt t j |��W Y d d }~X qX d|_qW d S )N�ipset�timeout�0r � T)r r# r Zset_get_active_terse�optionsr$ �rm_def_cr_optsr& r' r r r( r �_individual_callsZ set_creater � set_flush�entries�set_add� set_restore)r r r r* Zactiver+ �entryr r r � apply_ipset] sL & zFirewallIPSet.apply_ipsetc C s> x8| j � D ],}| j| }d|_tjd| � | j|� q W d S )NFzApplying ipset '%s')r r r r r) r9 )r r r r r r � apply_ipsets� s zFirewallIPSet.apply_ipsetsc C s� xz| j � D ]n}|jdkrq x\| j� D ]P}y| j|� |j|� W q$ tk rr } z|jtjkrb|�W Y d d }~X q$X q$W q W d S )NZnftables) r# r r � check_appliedr& r �coder � NOT_APPLIED)r r* r- r+ r r r �flush� s zFirewallIPSet.flushTc C s | j ||d�jS )N)r )r! r$ )r r r r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�jjd��S )NT)r �,)r r! r$ �split)r r r r r � get_dimension� s zFirewallIPSet.get_dimensionc C s | j |�}| j|� d S )N)r! r )r r r r r r r; � s zFirewallIPSet.check_appliedc C s |j sttj|j��d S )N)r r r r= r )r r r r r r � s z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jkr*|jd dkr*dS dS )N)r ZfamilyZinet6Zipv6Zipv4)r! r1 )r r r r r r r � get_family� s zFirewallIPSet.get_familyc C s� | j |dd�}t|�}tj||j|j� ||jkrFttj d||f ��t ||j� y$x | j � D ]}|j |j |� q^W W n. tk r� } zttj|��W Y d d }~X n&X d|jks�|jd dkr�|jj|� d S )NT)r z'%s' already is in '%s'r. r/ )r! r r � check_entryr1 r$ r5 r r ZALREADY_ENABLEDr r# r6 r r' r( r" )r r r8 r r* r+ r r r � add_entry� s zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jkr4ttjd||f ��y$x | j� D ]}|j|j|� q@W W n. t k r� } zttj |��W Y d d }~X n&X d|j ks�|j d dkr�|jj |� d S )NT)r z'%s' not in '%s'r. r/ ) r! r r5 r r Z NOT_ENABLEDr# Z set_deleter r' r( r1 �remove)r r r8 r r* r+ r r r � remove_entry� s zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jkr:|jd dkr:ttj|��||jkS )NT)r r. r/ )r! r r1 r r ZIPSET_WITH_TIMEOUTr5 )r r r8 r r r r � query_entry� s zFirewallIPSet.query_entryc C s | j |dd�}|jS )NT)r )r! r5 )r r r r r r � get_entries� s zFirewallIPSet.get_entriesc C s@ | j |dd�}t|� x |D ]}tj||j|j� q W d|jksN|jd dkrT||_y"x | j� D ]}|j|j � q`W W n. t k r� } zt t j |��W Y d d }~X nX d|_yXxR| j� D ]F}| jjr�x8|jD ]}|j|j |� q�W q�|j|j |j|j|jd � q�W W n0 t k �r4 } zt t j |��W Y d d }~X nX d|_d S )NT)r r. r/ )r! r r rD r1 r$ r5 r# r4 r r' r r r( r r r3 r6 r7 )r r r5 r r8 r* r+ r r r � set_entries� s. zFirewallIPSet.set_entriesN)F)F)T)T)�__name__� __module__� __qualname__r r r r r r r r! r# r% r, r9 r: r> r? rB r; r rC rE rG rH rI rJ r r r r r " s0 1 N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r2 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s