c`c @ sy d Z d g Z d d l m Z d d l m Z d d l m Z d d l m
Z
d d l m Z d e
f d YZ d S(
s
ipset backendt
FirewallIPSeti( t log( t remove_default_create_options( t IPSet( t errors( t
FirewallErrorc B s e Z d Z d Z d Z d Z d Z d Z d Z e d Z
d Z d Z d
Z
e d Z d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z RS( c C s | | _ i | _ d S( N( t _fwt _ipsets( t selft fw( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt __init__! s c C s d | j | j f S( Ns %s(%r)( t __class__R ( R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt __repr__% s c C s | j j d S( N( R t clear( R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt cleanup* s c C s+ | | j k r' t t j | n d S( N( t
get_ipsetsR R t
INVALID_IPSET( R t name( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt check_ipset- s c C s | | j k S( N( R ( R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt query_ipset1 s c C s t | j j S( N( t sortedR t keys( R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyR 4 s c C s t | j d k S( Ni ( t lenR ( R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt
has_ipsets7 s c C s4 | j | | j | } | r0 | j | n | S( N( R R t check_applied_obj( R R t appliedt obj( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt get_ipset: s
c G sN y | | | Wn6 t k
rI } t | } t j d | | f n Xd S( Ns %s: %s( R t strR t warning( R t fR t argst errort msg( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt _error2warningA s
c C sN g } | j j r( | j | j j n | j j rJ | j | j j n | S( N( R t nftables_enabledt appendt nftables_backendt
ipset_enabledt
ipset_backend( R t backends( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyR( I s c C sE | j | j j k r1 t t j d | j n | | j | j <d S( Ns '%s' is not supported by ipset.( t typeR t ipset_supported_typesR R t INVALID_TYPER R ( R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt add_ipsetQ s c C s | j | } | j rp | rp y( x! | j D] } | j | q- WWq t k
rl } t t j | q Xn t j d | | j | =d S( Ns, Keeping ipset '%s' because of timeout option(
R R R( t set_destroyt ExceptionR R t COMMAND_FAILEDR t debug1( R R t keepR t backendR! ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt remove_ipsetW s
c C s\ xU| j D]G} | j | } t | _ t j d | x| j D] } | j d k r | j } | | k r d | j k s | j d d k s | j
| | d k s t | j | | d k r y | j | Wqt
k
r} t t j | qXq n | j j s'| j d k ry | j | j | j
| j Wn% t
k
rn} t t j | n2 Xt | _ d | j k r| j d d k rqG n x | j D]E } y | j | j | Wqt
k
r} t t j | qXqWqG y) | j | j | j
| j | j d Wn% t
k
rF} t t j | qG Xt | _ qG Wq
Wd S( Ns Applying ipset '%s't ipsett timeoutt 0i i t nftables( R R t FalseR R R0 R( R t set_get_active_terset optionsR) t rm_def_cr_optsR- R. R R R/ R t individual_callst
set_createt Truet entriest set_addt set_restoret None( R R R R2 t activeR! t entry( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt apply_ipsetsc sL
c C s | j | d t j S( NR ( R R> R) ( R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt get_type s c C s% t | j | d t j j d S( NR t ,( R R R> R) t split( R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt
get_dimension s c C s | j | } | j | d S( N( R R ( R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt
check_applied s c C s% | j s! t t j | j n d S( N( R R R t NOT_APPLIEDR ( R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyR s c C sB | j | d t } d | j k r> | j d d k r> d Sn d S( NR t familyt inet6t ipv6t ipv4( R R> R: ( R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt
get_family s
c C s | S( N( ( R RD ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt
__entry_id s c C s d S( N( ( R t enableR RD ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt __entry s c C s | j | d t } t j | | j | j | | j k r\ t t j d | | f n y. x' | j
D] } | j | j | ql WWn% t
k
r } t t j | nE Xd | j k s | j d d k r | | j k r | j j | n d S( NR s '%s' already is in '%s'R5 R6 ( R R> R t check_entryR: R) R? R R t ALREADY_ENABLEDR( R@ R R. R/ R$ ( R R RD R R2 R! ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt add_entry s "c C s | j | d t } | | j k rC t t j d | | f n y. x' | j D] } | j | j | qS WWn% t k
r } t t j
| nE Xd | j k s | j d d k r | | j k r | j j | n d S( NR s '%s' not in '%s'R5 R6 (
R R> R? R R t NOT_ENABLEDR( t
set_deleteR R. R/ R: t remove( R R RD R R2 R! ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt remove_entry s "c C sY | j | d t } d | j k rL | j d d k rL t t j | n | | j k S( NR R5 R6 ( R R> R: R R t IPSET_WITH_TIMEOUTR? ( R R RD R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt query_entry s "c C s | j | d t } | j S( NR ( R R> R? ( R R R ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt get_entries s c C s | j | d t } x' | D] } t j | | j | j q Wd | j k sa | j d d k rm | | _ n y+ x$ | j D] } | j | j q} WWn% t
k
r } t t j
| n
Xt | _ y x | j D]s } | j j s | j d k r'xL | j D] } | j | j | qWq | j | j | j | j | j d q WWn% t
k
rx} t t j
| n
Xt | _ d S( NR R5 R6 R7 ( R R> R RT R: R) R? R( t set_flushR R. R R R/ R R R< R@ RA RB ( R R R? R RD R2 R! ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt set_entries s.
" ( t __name__t
__module__R
R R R R R R R8 R R" R( R, R3 RE RF RI RJ R RP t _FirewallIPSet__entry_idt _FirewallIPSet__entryRV RZ R\ R] R_ ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyR s2 3 N( t __doc__t __all__t firewall.core.loggerR t firewall.core.ipsetR R; t firewall.core.io.ipsetR t firewallR t firewall.errorsR t objectR ( ( ( s: /usr/lib/python2.7/site-packages/firewall/core/fw_ipset.pyt <module> s