관리-도구
편집 파일: ipset.cpython-36.pyc
3 @)�f�R � @ s d Z dddgZddljZddlZddlZddlZddlmZ ddl m Z m Z m Z m Z mZmZmZmZmZ ddlmZmZmZmZ dd lmZmZ dd lm Z m Z m Z m Z dd l m!Z! dd lm"Z" dd l#m$Z$ G dd� de�Z%G dd� de�Z&dd� Z'ddd�Z(dS )z$ipset io XML handler, reader, writer�IPSet� ipset_reader� ipset_writer� N)�config) �checkIP�checkIP6� checkIPnMask� checkIP6nMask� u2b_if_py2� check_mac� check_port�checkInterface� checkProtocol)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)� FirewallErrorc s� e Zd Zd d d d!dddifddgffZdZd d d d gZd d dgdgd d�Zdgdgd�Z� fdd�Zdd� Z dd� Z e dd� �Z dd� Z � fd d �Z� ZS )"r �version� �short� description�type�options�entriesz (ssssa{ss}as)�_�-�:�.N�name)r r �ipset�option�entry�value)r( r) c s< t t| �j� d| _d| _d| _d| _g | _i | _d| _ d S )Nr F) �superr �__init__r r r r r" r! �applied)�self)� __class__� �/usr/lib/python3.6/ipset.pyr- C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | jj� d| _d S )Nr F)r r r r r" r! �clearr. )r/ r1 r1 r2 �cleanupM s z IPSet.cleanupc C s\ t | j�| _t | j�| _t | j�| _t | j�| _dd� | jj� D �| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return strings encoded (because of python 2) instead of in unicode. Get rid of it once we throw out python 2 support.c S s i | ]\}}t |�t |��qS r1 )r )�.0�k�vr1 r1 r2 � <dictcomp>^ s z(IPSet.encode_strings.<locals>.<dictcomp>c S s g | ] }t |��qS r1 )r )r5 �er1 r1 r2 � <listcomp>` s z(IPSet.encode_strings.<locals>.<listcomp>N)r r r r r r! �itemsr" )r/ r1 r1 r2 �encode_stringsV s zIPSet.encode_stringsc C s d}d|kr |d dkr d}|j d�s6ttjd| ��|dd � jd�}| jd�}t|�t|�ksnt|�d k r�ttjd | |f ���xztt|��D �]h}|| }|| }|d k�r�d |ko�|dk�rh|d kr�ttjd || |f ��|jd �} t| �dk�rttjd|| ||f ��x�| D ]J} |dk�r2t| � �sH|dk�rt | � �rttjd| | ||f ���qW nh|dk�r�|dk�r�ttjd|| ||f ��|dk�r�t } nt} nt } | |��s�ttjd|| ||f ��q�|dk�r@d |k�r�|jd �} t| �dk�rttjd|| ||f ��|dk�r0t| d � �sJ|dk�rft | d � �rfttjd| d | ||f ��|dk�r�t | d � �s�|dk�r>t | d � �r>ttjd| d | ||f ��n�|j d��r�|dk�o�|dk�o�|dk�s�ttjd|| ||f ��|dk�rt |� �s&|dk�r�t |� �r�ttjd|| ||f ��q�|dk�rvt |� �s`|dk�r�ttjd|| f ��q�|dk�r�d|k�r�|jd�} t| �dk�r�ttjd| ��| d d k�r|dk�r�ttjd || f ��t| d � �r�t| d � �r�ttjd | d | f ��n�| d d1k�r~|dk�rDttjd || f ��t| d � �r�t| d � �r�ttjd!| d | f ��n^| d d2k�r�t| d � �r�ttjd&| d | f ��n&t| d ��s�ttjd'| d | f ��n t|��s�ttjd(|| f ��q�|d)k�r�|j d*��rPyt|d+�} W n* tk �rL ttjd,|| f ��Y nX n8y t|�} W n* tk �r� ttjd,|| f ��Y nX | dk �s�| d-k�r�ttjd,|| f ��q�|d.k�r�t|� �s�t|�d/k�r�ttjd0|| f ��q�ttjd| ��q�W d S )3NZipv4�family�inet6Zipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'Zipr$ z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r Znetz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'Zportr% zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s'�icmpv6� ipv6-icmpz invalid icmpv6 type '%s' in '%s'�tcp�sctp�udp�udplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'ZmarkZ0x� zinvalid mark '%s' in '%s'l �� Ziface� z invalid interface '%s' in '%s')rC rD )rE rF rG rH )� startswithr r � INVALID_IPSET�split�lenZ INVALID_ENTRY�ranger r r r �endswithr r r r r r r �int� ValueErrorr ) r* r! Z ipset_typer= �flagsr; �i�flag�itemZsplitsZ_splitZip_checkZint_valr1 r1 r2 � check_entryb s@ zIPSet.check_entryc C s� |dkr |t kr ttjd| ��|dkr�x�|j� D ]�}|tkrNttjd| ��|dkr�yt|| �}W n, tk r� ttj d||| f ��Y nX |d k r�ttj d ||| f ��q2|d kr2|| dkr2ttj || ��q2W d S )Nr z '%s' is not valid ipset typer! zipset invalid option '%s'�timeout�hashsize�maxelemz)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer= �inetr> )rX rY rZ )r[ r> ) r r r � INVALID_TYPE�keysr rL rQ rR � INVALID_VALUE�INVALID_FAMILY)r/ r rV Z all_config�key� int_valuer1 r1 r2 � _check_config s2 zIPSet._check_configc sr d|d kr6|d d dkr6t |d �dkr6ttj��x&|d D ]}tj||d |d � q@W tt| �j|� d S )NrX � �0r? r � )rN r r ZIPSET_WITH_TIMEOUTr rW r, � import_config)r/ r r* )r0 r1 r2 rf 3 s zIPSet.import_config)r r )r r )r r )r r )�__name__� __module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr- r4 r< � staticmethodrW rb rf � __classcell__r1 r1 )r0 r2 r , s, 7c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc C s� t j| ||� | jj||� |dkrpd|krX|d tkrLttjd|d ��|d | j_d|krl|d | j_ �nz|dkr|�nn|dkr��nb|dk�r�d}d |kr�|d }|d dkr�ttj d|d ��| jjdko�|d dk� r�ttj d|d | jjf ��|d dk�r&| �r&ttj d|d ��|d d k�r�y t |�}W n. t k �rn ttj d|d |f ��Y nX |dk �r�ttj d|d |f ��|d d k�r�|d k�r�ttj|��|d | jjk�r�|| jj|d < ntjd|d � d S ) Nr( r z%sr r r r) r r+ r' r= rX rY rZ zUnknown option '%s'zhash:macz%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'z)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer[ r> z Option %s already set, ignoring.)r= rX rY rZ )r= )r= rX rY rZ )rX rY rZ )r[ r> )r � startElementrV Zparser_check_element_attrsr r r r\ r r ZINVALID_OPTIONrQ rR r^ r_ r! r �warning)r/ r' �attrsr+ ra r1 r1 r2 rm > sd z!ipset_ContentHandler.startElementc C s( t j| |� |dkr$| jjj| j� d S )Nr* )r � endElementrV r" �appendZ_element)r/ r' r1 r1 r2 rp u s z ipset_ContentHandler.endElementN)rg rh ri rm rp r1 r1 r1 r2 rl = s 7rl c % C s t � }| jd�s ttjd| ��| d d� |_|j|j� | |_||_|j t j �rVdnd|_ |j |_ t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~d |jk�rF|jd d k�rFt|j�d k�rFt j d |j� |jd d �= d } t � } x�| t|j�k �r|j| | k�r�t j d |j| � |jj | � nry |j |j| |j|j!� W n< tk �r� } z t j d| � |jj | � W Y d d } ~ X nX | j"|j| � | d7 } �qRW ~ t#�r|j$� |S )Nz.xmlz'%s' is missing .xml suffixrc FTz%s/%s�rbznot a valid ipset file: %srX rd r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z %s, ignoring.rA ���)%r rP r r Z INVALID_NAMEr' Z check_name�filename�pathrK r � ETC_FIREWALLDZbuiltin�defaultrl �saxZ make_parserZsetContentHandler�openZ InputSourceZ setByteStream�parseZSAXParseExceptionrL Z getExceptionr! rN r" r rn �set�poprW r �addr r< ) rt ru r( �handler�parserr' �f�source�msgrT Z entries_setr9 r1 r1 r2 r z s^ ( c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk r� } ztj d||� W Y d d }~X nX tj j |�}|j t j �r�tj j|� r�tj jt j �s�tjt j d� tj|d� tj|ddd�}t|�}|j� d | ji}| j�r| jd k�r| j|d < |jd |� |jd � | j�rz| jd k�rz|jd� |jdi � |j| j� |jd� |jd � | j�r�| jd k�r�|jd� |jdi � |j| j� |jd� |jd � xZ| jj � D ]L\} } |jd� | d k�r |j d| | d�� n|j dd| i� |jd � �q�W xD| j D ]:} |jd� |jdi � |j| � |jd� |jd � �q(W |jd � |jd � |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r( � z r r r) )r' r+ r' r* )!ru rt r' �os�exists�shutilZcopy2� Exceptionr �error�dirnamerK r rv �mkdir�iory r Z startDocumentr r rm ZignorableWhitespacer Z charactersrp r r! r; Z simpleElementr" Z endDocument�close) r( ru �_pathr' r� �dirpathr� r~ ro r` r+ r* r1 r1 r2 r � sf )N))�__doc__�__all__Zxml.saxrx r� r� r� Zfirewallr Zfirewall.functionsr r r r r r r r r Zfirewall.core.io.io_objectr r r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rl r r r1 r1 r1 r2 �<module> s& , =5