관리-도구
편집 파일: ipset.cpython-36.pyc
3 @)�fq2 � @ s� d Z dddgZddlZddlZddlmZ ddlmZ ddl m Z dd l m Z dd l mZmZ dd lmZ d Zd ddddddddddg Zddddd�Zd d d d �ZG d d� de�Zd!d� Zd"d� Zd#d$� Zd%d&� Zd'd(� Z dS ))zThe ipset command wrapper�ipset�check_ipset_name� remove_default_create_options� N)�errors)� FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz inet|inet6�valuez value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd'd d�Z dd� Z dd� Z dd� Z d(dd�Z d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name)�self� r �/usr/lib/python3.6/ipset.py�__init__K s zipset.__init__c C s^ dd� |D �}t jd| j| jdj|�� t| j|�\}}|dkrZtd| jdj|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )z%sr )�.0�itemr r r � <listcomp>R s z ipset.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s)r �debug2� __class__r �joinr � ValueError)r �argsZ_args�status�retr r r Z__runO s z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r � check_nameZ s zipset.check_namec C s� g }d}y| j dg�}W n0 tk rH } ztjd| � W Y dd}~X nX |j� }d}xT|D ]L}|r�|j� jdd�}|d |kr�|d tkr�|j|d � |j d�r\d }q\W |S ) z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T) � _ipset__runr r Zdebug1� splitlines�strip�split� IPSET_TYPES�append� startswith)r r" �outputZex�linesZin_types�line�splitsr r r �set_supported_types` s zipset.set_supported_typesc C s( t |�tks|tkr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r# r$ r, r r Z INVALID_TYPE)r � type_namer r r � check_typeu s zipset.check_typeNc C sd | j |� | j|� d||g}t|t�rZx0|j� D ]$\}}|j|� |dkr2|j|� q2W | j|�S )z+Create an ipset with name, type and options�creater& )r% r5 � isinstance�dict�itemsr- r( )r �set_namer4 �optionsr �key�valr r r � set_create{ s zipset.set_createc C s | j |� | jd|g�S )NZdestroy)r% r( )r r: r r r � set_destroy� s zipset.set_destroyc C s d||g}| j |�S )N�add)r( )r r: �entryr r r r �set_add� s z ipset.set_addc C s d||g}| j |�S )N�del)r( )r r: rA r r r r � set_delete� s zipset.set_deletec C s, d||g}|r"|j ddj|� � | j|�S )N�testz%sr )r- r r( )r r: rA r; r r r r rE � s z ipset.testc C s2 dg}|r|j |� |r"|j|� | j|�jd�S )N�list� )r- �extendr( r+ )r r: r; r r r r �set_list� s zipset.set_listc C s< | j dgd�}i }d }}i }�x|D �] }t|�dk r:q&dd� |jdd�D �}t|�dkr`q&q&|d d krv|d }q&|d d kr�|d }q&|d d kr&|d j� }d } x^| t|�k �r|| } | dk� r�t|�| kr�| d7 } || || < ntjd|� i S | d7 } q�W |�r$|�r$|t|�f||< d }}|j� q&W |S )z" Get active ipsets (only headers) z-terse)r; N� c S s g | ] }|j � �qS r )r* )r �xr r r r � s z.ipset.set_get_active_terse.<locals>.<listcomp>�:r' r �NameZTypeZHeaderr r r r �netmaskz&Malformed ipset list -terse output: %s)r r r r rN )rI r# r+ r �errorr �clear) r r0 r" �_nameZ_type�_optionsr1 Zpairr2 �i�optr r r �set_get_active_terse� sD zipset.set_get_active_tersec C s dg}|r|j |� | j|�S )N�save)r- r( )r r: r r r r rV � s z ipset.savec C s� | j |� | j|� t� }d|kr*d| }d||dg}|rlx0|j� D ]$\}} |j|� | dkrD|j| � qDW |jddj|� � |jd| � xN|D ]F} d| kr�d| } |r�|jd|| dj|�f � q�|jd || f � q�W |j� tj |j �} t j d | j | jd |j | jf � d g}t| j||j d �\} } t j� dk�r�yt|j � W n tk �r` Y nVX d}xNt|j �D ]@}t jd||f ddd� |jd��s�t jddd� |d7 }�qrW tj|j � | dk�r�td| jdj|�| f ��| S )Nr z'%s'r6 z-existr& z%s z flush %s z add %s %s %s z add %s %s z%s: %s restore %sz%s: %dZrestore)�stdinr' rJ z%8d: %sr )�nofmt�nlrG )rX z'%s %s' failed: %s)r% r5 r r9 r- �writer �close�os�statr r r r r �st_sizer ZgetDebugLogLevelr � ExceptionZdebug3�endswith�unlinkr )r r: r4 �entriesZcreate_optionsZ entry_optionsZ temp_filer r< r= rA r] r! r" rS r1 r r r � set_restore� sV zipset.set_restorec C s dg}|r|j |� | j|�S )N�flush)r- r( )r r: r r r r � set_flush s zipset.set_flushc C s | j d||g�S )N�rename)r( )r Z old_set_nameZ new_set_namer r r rf s z ipset.renamec C s | j d||g�S )N�swap)r( )r Z set_name_1Z set_name_2r r r rg s z ipset.swapc C s | j dg�S )N�version)r( )r r r r rh s z ipset.version)N)N)NN)N)NN)�__name__� __module__� __qualname__�__doc__r r( r% r3 r5 r> r? rB rD rE rI rU rV rc re rf rg rh r r r r r H s& ' 7c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r# r$ )r r r r r s c C s8 | j � }x*tD ]"}||krt| || kr||= qW |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)r; rR rT r r r r s c C sh g }xX| j d�D ]J}y&|jd� |jttj|dd��� W q tk rX |j|� Y qX qW dj|�S )z! Normalize IP addresses in entry �,�/F)�strict)r+ �indexr- �str� ipaddress� ip_networkr r )rA Z_entryZ_partr r r �normalize_ipset_entry& s rv c C sx t | jd��dkrdS ytj| dd�}W n tk r< dS X x4|D ],}|jtj|dd��rDttjdj | |���qDW dS )z: Check if entry overlaps any entry in the list of entries ro rJ NF)rq z,Entry '{}' overlaps with existing entry '{}') r# r+ rt ru r �overlapsr r � INVALID_ENTRY�format)rA rb Z entry_networkZitrr r r � check_entry_overlaps_existing2 s rz c C s~ ydd� | D �} W n t k r& dS X t| �dkr8dS | j� | jd�}x.| D ]&}|j|�rrttjdj||���|}qPW dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )F)rq )rt ru )r rK r r r r E s z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r r# �sort�poprw r r rx ry )rb Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2 r} ) rl �__all__Zos.pathr\ rt Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r Zfirewall.configr r$ r, ZIPSET_CREATE_OPTIONSrn �objectr r r rv rz r} r r r r �<module> sF P