ruạṛ
a ��ib' � @ sf d Z dgZddlmZ ddlmZmZmZm Z ddl m Z ddl m Z ddlmZ G dd� de�Zd S ) z ipset backend� FirewallIPSet� )�log)� remove_default_create_options�normalize_ipset_entry� check_entry_overlaps_existing� check_for_overlapping_entries)�IPSet)�errors)� FirewallErrorc @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z d6dd�Z dd� Z dd� Z dd� Z d7dd�Zd8dd �Zd9d d �Zd d � Zd:d"d#�Zd$d%� Zd&d'� Zd(d)� Zd;d*d+�Zd,d-� Zd.d/� Zd0d1� Zd2d3� Zd4d5� ZdS )<r c C s || _ i | _d S �N)�_fw�_ipsets)�self�fw� r �:/usr/lib/python3.9/site-packages/firewall/core/fw_ipset.py�__init__# s zFirewallIPSet.__init__c C s d| j | jf S )Nz%s(%r))� __class__r �r r r r �__repr__' s zFirewallIPSet.__repr__c C s | j �� d S r )r �clearr r r r �cleanup, s zFirewallIPSet.cleanupc C s || � � vrttj|��d S r )� get_ipsetsr r Z INVALID_IPSET�r �namer r r � check_ipset/ s zFirewallIPSet.check_ipsetc C s || � � v S r )r r r r r � query_ipset3 s zFirewallIPSet.query_ipsetc C s t | j�� �S r )�sortedr �keysr r r r r 6 s zFirewallIPSet.get_ipsetsc C s t | j�dkS )Nr )�lenr r r r r � has_ipsets9 s zFirewallIPSet.has_ipsetsFc C s& | � |� | j| }|r"| �|� |S r )r r �check_applied_obj�r r �applied�objr r r � get_ipset< s zFirewallIPSet.get_ipsetc C s | j jr| j j�� rdS dS )NFT)r �nftables_enabledZdirectZhas_runtime_configurationr r r r �omit_native_ipsetC s z FirewallIPSet.omit_native_ipsetc C s< g }| j jr|�| j j� | j jr8| �� s8|�| j j� |S r )r r& �appendZnftables_backendZ ipset_enabledr' Z ipset_backend)r �backendsr r r r) K s zFirewallIPSet.backendsc C s0 |j | jjvr ttjd|j ��|| j|j< d S )Nz '%s' is not supported by ipset.)�typer Zipset_supported_typesr r Z INVALID_TYPEr r �r r$ r r r � add_ipsetS s �zFirewallIPSet.add_ipsetc C s| | j | }|jrd|sdz | �� D ]}|�|� q W qp ty` } zttj|��W Y d }~qpd }~0 0 n t� d|� | j |= d S )Nz,Keeping ipset '%s' because of timeout option) r r# r) � set_destroy� Exceptionr r �COMMAND_FAILEDr �debug1)r r Zkeepr$ �backend�msgr r r � remove_ipsetY s $ zFirewallIPSet.remove_ipsetNc C s, | j | }|r|n| �� D �] }|jdkr�|�� }||v r�d|jvsz|jd dksz|j|| d kszt|j�|| d kr�z|�|� W n0 ty� } zt t j |��W Y d }~n d }~0 0 | j j �r�z|�|j|j|j� W n2 t�y } zt t j |��W Y d }~n.d }~0 0 d|_d|jv �r4|jd dk�r4qz|�|j� W n2 t�yv } zt t j |��W Y d }~n d }~0 0 |jD ]L}z|�|j|� W n2 t�y� } zt t j |��W Y d }~n d }~0 0 �q~qz |�|j|j|j|jd � W n2 t�y } zt t j |��W Y d }~qd }~0 0 d|_qd S )N�ipset�timeout�0r � T)r r) r Zset_get_active_terse�optionsr* �rm_def_cr_optsr- r. r r r/ r �_individual_callsZ set_creater# � set_flush�entries�set_add� set_restore)r r r) r$ r1 Zactiver2 �entryr r r � apply_ipsete sX �� ��" " �" ( �"zFirewallIPSet.apply_ipsetc C s< | � � D ].}| j| }d|_t�d| � | �||� qd S )NFzApplying ipset '%s')r r r# r r0 r@ )r r) r r$ r r r � apply_ipsets� s zFirewallIPSet.apply_ipsetsc C sz | � � D ]l}|jdkrq| �� D ]R}z| �|� |�|� W q typ } z |jtjkr\|�W Y d }~q d }~0 0 q qd S )NZnftables) r) r r � check_appliedr- r �coder � NOT_APPLIED)r r1 r4 r2 r r r �flush� s zFirewallIPSet.flushTc C s | j ||d�jS )N�r# )r% r* )r r r# r r r �get_type� s zFirewallIPSet.get_typec C s t | j|dd�j�d��S )NTrF �,)r r% r* �splitr r r r � get_dimension� s zFirewallIPSet.get_dimensionc C s | � |�}| �|� d S r )r% r! �r r r$ r r r rB � s zFirewallIPSet.check_appliedc C s |j sttj|j��d S r )r# r r rD r r+ r r r r! � s �z FirewallIPSet.check_applied_objc C s. | j ||d�}d|jv r*|jd dkr*dS dS )NrF ZfamilyZinet6Zipv6Zipv4)r% r8 r" r r r � get_family� s zFirewallIPSet.get_familyc C s� | j |dd�}t|�}t�||j|j� ||jv rFttj d||f ��t ||j� z | � � D ]}|� |j |� q\W n0 ty� } zttj|��W Y d }~n.d }~0 0 d|jvs�|jd dkr�|j�|� d S )NTrF z'%s' already is in '%s'r5 r6 )r% r r � check_entryr8 r* r< r r ZALREADY_ENABLEDr r) r= r r. r/ r( �r r r? r$ r1 r2 r r r � add_entry� s � "zFirewallIPSet.add_entryc C s� | j |dd�}t|�}||jvr4ttjd||f ��z | �� D ]}|�|j|� q>W n0 t y� } zttj |��W Y d }~n.d }~0 0 d|j vs�|j d dkr�|j� |� d S )NTrF z'%s' not in '%s'r5 r6 ) r% r r< r r Z NOT_ENABLEDr) Z set_deleter r. r/ r8 �removerN r r r � remove_entry� s � "zFirewallIPSet.remove_entryc C sD | j |dd�}t|�}d|jv r:|jd dkr:ttj|��||jv S �NTrF r5 r6 )r% r r8 r r ZIPSET_WITH_TIMEOUTr< )r r r? r$ r r r � query_entry� s zFirewallIPSet.query_entryc C s | j |dd�}|jS )NTrF )r% r< rK r r r � get_entries� s zFirewallIPSet.get_entriesc C s4 | j |dd�}t|� |D ]}t�||j|j� qd|jvsJ|jd dkrP||_z | �� D ]}|�|j � qZW n0 t y� } zt t j |��W Y d }~nd }~0 0 d|_zP| �� D ]B}| jjr�|jD ]}|�|j |� q�q�|�|j |j|j|jd � q�W n2 t �y( } zt t j |��W Y d }~nd }~0 0 d|_d S rR )r% r r rM r8 r* r< r) r; r r. r r r/ r# r r: r= r> )r r r< r$ r? r1 r2 r r r � set_entries� s0 " � "zFirewallIPSet.set_entries)F)F)N)N)T)T) �__name__� __module__� __qualname__r r r r r r r r% r' r) r, r3 r@ rA rE rG rJ rB r! rL rO rQ rS rT rU r r r r r " s2 1 N)�__doc__�__all__Zfirewall.core.loggerr Zfirewall.core.ipsetr r9 r r r Zfirewall.core.io.ipsetr Zfirewallr Zfirewall.errorsr �objectr r r r r �<module> s
cải xoăn