3
��g�% � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl
m Z ddl m
Z
ddlmZ G dd� de�Zd S )
z
ipset backend�
FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)�
FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z d4dd�Z
dd� Z dd� Z d5dd�Z
dd� Zdd� Zd d � Zd6d d �Zd!d"� Zd#d$� Zd%d&� Zd7d'd(�Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3S )8r c C s || _ i | _d S )N)�_fw�_ipsets)�self�fw� r � /usr/lib/python3.6/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r )r
r r r �__repr__' s zFirewallIPSet.__repr__c C s | j j� d S )N)r �clear)r
r r r �cleanup, s zFirewallIPSet.cleanupc C s || j � krttj|��d S )N)�
get_ipsetsr
r Z
INVALID_IPSET)r
�namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || j � kS )N)r )r
r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | jj� �S )N)�sortedr �keys)r
r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr )r
r r r �
has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | j |� | j| }|r"| j|� |S )N)r r �check_applied_obj)r
r �applied�objr r r � get_ipset< s
zFirewallIPSet.get_ipsetc C s4 g }| j jr|j| j j� | j jr0|j| j j� |S )N)r Znftables_enabled�appendZnftables_backendZ
ipset_enabledZ
ipset_backend)r
�backendsr r r r# C s zFirewallIPSet.backendsc C s0 |j | jjkr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr
r Z INVALID_TYPEr r )r
r r r r � add_ipsetK s zFirewallIPSet.add_ipsetc C s� | j | }|jrh| rhy x| j� D ]}|j|� q"W W qt tk
rd } zttj|��W Y d d }~X qtX n tj d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option)
r r r# � set_destroy� Exceptionr
r �COMMAND_FAILEDr �debug1)r
r Zkeepr �backend�msgr r r � remove_ipsetQ s
zFirewallIPSet.remove_ipsetc < C s$ | j | }�x| j� D �]}|jdkr�|j� }||kr�d|jksv|jd dksv|j|| d ksvt|j�|| d kr�y|j|� W n. tk
r� } zt t
j |��W Y d d }~X nX | j j
�r�y|j|j|j|j� W n0 tk
�r } zt t
j |��W Y d d }~X n&X d|_d|jk�r,|jd dk�r,qy|j|j� W n0 tk
�rl } zt t
j |��W Y d d }~X nX x�|jD ]J}y|j|j|� W n0 tk
�r� } zt t
j |��W Y d d }~X nX �qvW qy |j|j|j|j|jd � W n0 tk
�r } zt t
j |��W Y d d }~X qX d|_qW d S )N�ipset�timeout�0r � T)r r# r Zset_get_active_terse�optionsr$ �rm_def_cr_optsr& r' r
r r( r �_individual_callsZ
set_creater � set_flush�entries�set_add� set_restore)r
r r r* Zactiver+ �entryr r r � apply_ipset] sL
&
zFirewallIPSet.apply_ipsetc C s> x8| j � D ],}| j| }d|_tjd| � | j|� q
W d S )NFzApplying ipset '%s')r r r r r) r9 )r
r r r r r � apply_ipsets� s
zFirewallIPSet.apply_ipsetsc C s� xz| j � D ]n}|jdkrq
x\| j� D ]P}y| j|� |j|� W q$ tk
rr } z|jtjkrb|�W Y d d }~X q$X q$W q
W d S )NZnftables) r# r r �
check_appliedr& r
�coder � NOT_APPLIED)r
r* r- r+ r r r �flush� s
zFirewallIPSet.flushTc C s | j ||d�jS )N)r )r! r$ )r
r r r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�jjd��S )NT)r �,)r r! r$ �split)r
r r r r �
get_dimension� s zFirewallIPSet.get_dimensionc C s | j |�}| j|� d S )N)r! r )r
r r r r r r; � s
zFirewallIPSet.check_appliedc C s |j sttj|j��d S )N)r r
r r= r )r
r r r r r � s z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jkr*|jd dkr*dS dS )N)r ZfamilyZinet6Zipv6Zipv4)r! r1 )r
r r r r r r �
get_family� s
zFirewallIPSet.get_familyc C s� | j |dd�}t|�}tj||j|j� ||jkrFttj d||f ��t
||j� y$x | j � D ]}|j |j
|� q^W W n. tk
r� } zttj|��W Y d d }~X n&X d|jks�|jd dkr�|jj|� d S )NT)r z'%s' already is in '%s'r. r/ )r! r r � check_entryr1 r$ r5 r
r ZALREADY_ENABLEDr r# r6 r r' r( r" )r
r r8 r r* r+ r r r � add_entry� s
zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jkr4ttjd||f ��y$x | j� D ]}|j|j|� q@W W n. t k
r� } zttj
|��W Y d d }~X n&X d|j ks�|j d dkr�|jj |� d S )NT)r z'%s' not in '%s'r. r/ )
r! r r5 r
r Z NOT_ENABLEDr# Z
set_deleter r' r( r1 �remove)r
r r8 r r* r+ r r r � remove_entry� s
zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jkr:|jd dkr:ttj|��||jkS )NT)r r. r/ )r! r r1 r
r ZIPSET_WITH_TIMEOUTr5 )r
r r8 r r r r � query_entry� s
zFirewallIPSet.query_entryc C s | j |dd�}|jS )NT)r )r! r5 )r
r r r r r � get_entries� s zFirewallIPSet.get_entriesc C s@ | j |dd�}t|� x |D ]}tj||j|j� q W d|jksN|jd dkrT||_y"x | j� D ]}|j|j � q`W W n. t
k
r� } zt t j
|��W Y d d }~X nX d|_yXxR| j� D ]F}| jjr�x8|jD ]}|j|j |� q�W q�|j|j |j|j|jd � q�W W n0 t
k
�r4 } zt t j
|��W Y d d }~X nX d|_d S )NT)r r. r/ )r! r r rD r1 r$ r5 r# r4 r r' r
r r( r r r3 r6 r7 )r
r r5 r r8 r* r+ r r r � set_entries� s.
zFirewallIPSet.set_entriesN)F)F)T)T)�__name__�
__module__� __qualname__r r r r r r r r! r# r% r, r9 r: r> r? rB r; r rC rE rG rH rI rJ r r r r r " s0
1
N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r2 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr
�objectr r r r r �<module> s