????
Your IP : 3.15.137.62
3
@)�f�R � @ s d Z dddgZddljZddlZddlZddlZddlmZ ddl m
Z
m Z m Z m
Z
mZmZmZmZmZ ddlmZmZmZmZ dd lmZmZ dd
lm Z m Z m Z m Z dd l m!Z! dd lm"Z" dd
l#m$Z$ G dd� de�Z%G dd� de�Z&dd� Z'ddd�Z(dS )z$ipset io XML handler, reader, writer�IPSet� ipset_reader� ipset_writer� N)�config) �checkIP�checkIP6� checkIPnMask�
checkIP6nMask�
u2b_if_py2� check_mac�
check_port�checkInterface�
checkProtocol)�PY2� IO_Object�IO_Object_ContentHandler�IO_Object_XMLGenerator)� IPSET_TYPES�IPSET_CREATE_OPTIONS)�check_icmp_name�check_icmp_type�check_icmpv6_name�check_icmpv6_type)�log)�errors)�
FirewallErrorc s� e Zd Zd d d d!dddifddgffZdZd d
d d gZd
d
dgdgd
d�Zdgdgd�Z� fdd�Zdd� Z dd� Z
e dd� �Z dd� Z
� fd d �Z� ZS )"r �version� �short� description�type�options�entriesz
(ssssa{ss}as)�_�-�:�.N�name)r r �ipset�option�entry�value)r( r) c s< t t| �j� d| _d| _d| _d| _g | _i | _d| _ d S )Nr F)
�superr �__init__r r r r r" r! �applied)�self)� __class__� �/usr/lib/python3.6/ipset.pyr- C s zIPSet.__init__c C s8 d| _ d| _d| _d| _| jd d �= | jj� d| _d S )Nr F)r r r r r" r! �clearr. )r/ r1 r1 r2 �cleanupM s
z
IPSet.cleanupc C s\ t | j�| _t | j�| _t | j�| _t | j�| _dd� | jj� D �| _dd� | jD �| _dS )z� HACK. I haven't been able to make sax parser return
strings encoded (because of python 2) instead of in unicode.
Get rid of it once we throw out python 2 support.c S s i | ]\}}t |�t |��qS r1 )r
)�.0�k�vr1 r1 r2 �
<dictcomp>^ s z(IPSet.encode_strings.<locals>.<dictcomp>c S s g | ] }t |��qS r1 )r
)r5 �er1 r1 r2 �
<listcomp>` s z(IPSet.encode_strings.<locals>.<listcomp>N)r
r r r r r! �itemsr" )r/ r1 r1 r2 �encode_stringsV s zIPSet.encode_stringsc
C s d}d|kr |d dkr d}|j d�s6ttjd| ��|dd � jd�}| jd�}t|�t|�ksnt|�d k r�ttjd
| |f ���xztt|��D �]h}|| }|| }|d k�r�d |ko�|dk�rh|d kr�ttjd
|| |f ��|jd �} t| �dk�rttjd|| ||f ��x�| D ]J}
|dk�r2t|
� �sH|dk�rt |
� �rttjd|
| ||f ���qW nh|dk�r�|dk�r�ttjd|| ||f ��|dk�r�t
} nt} nt } | |��s�ttjd|| ||f ��q�|dk�r@d |k�r�|jd �} t| �dk�rttjd|| ||f ��|dk�r0t| d � �sJ|dk�rft | d � �rfttjd| d | ||f ��|dk�r�t
| d � �s�|dk�r>t | d � �r>ttjd| d | ||f ��n�|j d��r�|dk�o�|dk�o�|dk�s�ttjd|| ||f ��|dk�rt
|� �s&|dk�r�t |� �r�ttjd|| ||f ��q�|dk�rvt
|� �s`|dk�r�ttjd|| f ��q�|dk�r�d|k�r�|jd�} t| �dk�r�ttjd| ��| d d k�r|dk�r�ttjd || f ��t| d � �r�t| d � �r�ttjd | d | f ��n�| d d1k�r~|dk�rDttjd || f ��t| d � �r�t| d � �r�ttjd!| d | f ��n^| d d2k�r�t| d � �r�ttjd&| d | f ��n&t| d ��s�ttjd'| d | f ��n t|��s�ttjd(|| f ��q�|d)k�r�|j d*��rPyt|d+�} W n* tk
�rL ttjd,|| f ��Y nX n8y t|�} W n* tk
�r� ttjd,|| f ��Y nX | dk �s�| d-k�r�ttjd,|| f ��q�|d.k�r�t|� �s�t|�d/k�r�ttjd0|| f ��q�ttjd| ��q�W d S )3NZipv4�family�inet6Zipv6zhash:zipset type '%s' not usable� �,� z)entry '%s' does not match ipset type '%s'Zipr$ z invalid address '%s' in '%s'[%d]� z.invalid address range '%s' in '%s' for %s (%s)z(invalid address '%s' in '%s' for %s (%s)z0.0.0.0r Znetz/0zhash:net,ifaceZmacz00:00:00:00:00:00z invalid mac address '%s' in '%s'Zportr% zinvalid port '%s'Zicmpz(invalid protocol for family '%s' in '%s'z invalid icmp type '%s' in '%s'�icmpv6� ipv6-icmpz invalid icmpv6 type '%s' in '%s'�tcp�sctp�udp�udplitez invalid protocol '%s' in '%s'zinvalid port '%s'in '%s'zinvalid port '%s' in '%s'ZmarkZ0x� zinvalid mark '%s' in '%s'l �� Ziface� z invalid interface '%s' in '%s')rC rD )rE rF rG rH )�
startswithr r �
INVALID_IPSET�split�lenZ
INVALID_ENTRY�ranger r r r �endswithr r r r r r r �int�
ValueErrorr
)
r* r! Z
ipset_typer= �flagsr; �i�flag�itemZsplitsZ_splitZip_checkZint_valr1 r1 r2 � check_entryb s@
zIPSet.check_entryc C s� |dkr |t kr ttjd| ��|dkr�x�|j� D ]�}|tkrNttjd| ��|dkr�yt|| �}W n, tk
r� ttj d||| f ��Y nX |d k r�ttj d
||| f ��q2|d kr2|| dkr2ttj
|| ��q2W d S )Nr z '%s' is not valid ipset typer! zipset invalid option '%s'�timeout�hashsize�maxelemz)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer= �inetr> )rX rY rZ )r[ r> ) r r r � INVALID_TYPE�keysr rL rQ rR �
INVALID_VALUE�INVALID_FAMILY)r/ r rV Z
all_config�key� int_valuer1 r1 r2 �
_check_config s2
zIPSet._check_configc sr d|d kr6|d d dkr6t |d �dkr6ttj��x&|d D ]}tj||d |d � q@W tt| �j|� d S )NrX � �0r? r � )rN r r ZIPSET_WITH_TIMEOUTr rW r, �
import_config)r/ r r* )r0 r1 r2 rf 3 s
zIPSet.import_config)r r )r r )r r )r r )�__name__�
__module__� __qualname__ZIMPORT_EXPORT_STRUCTUREZDBUS_SIGNATUREZADDITIONAL_ALNUM_CHARSZ PARSER_REQUIRED_ELEMENT_ATTRSZ PARSER_OPTIONAL_ELEMENT_ATTRSr- r4 r< � staticmethodrW rb rf �
__classcell__r1 r1 )r0 r2 r , s,
7c @ s e Zd Zdd� Zdd� ZdS )�ipset_ContentHandlerc
C s� t j| ||� | jj||� |dkrpd|krX|d tkrLttjd|d ��|d | j_d|krl|d | j_ �nz|dkr|�nn|dkr��nb|dk�r�d}d |kr�|d }|d
dkr�ttj
d|d
��| jjdko�|d
dk� r�ttj
d|d
| jjf ��|d
dk�r&| �r&ttj
d|d
��|d
d k�r�y t |�}W n. t k
�rn ttj
d|d
|f ��Y nX |dk �r�ttj
d|d
|f ��|d
d k�r�|d k�r�ttj|��|d
| jjk�r�|| jj|d
< ntjd|d
� d S ) Nr( r z%sr r r r) r r+ r' r= rX rY rZ zUnknown option '%s'zhash:macz%Unsupported option '%s' for type '%s'z&Missing mandatory value of option '%s'z)Option '%s': Value '%s' is not an integerr z#Option '%s': Value '%s' is negativer[ r> z Option %s already set, ignoring.)r= rX rY rZ )r= )r= rX rY rZ )rX rY rZ )r[ r> )r � startElementrV Zparser_check_element_attrsr r r r\ r r ZINVALID_OPTIONrQ rR r^ r_ r! r �warning)r/ r' �attrsr+ ra r1 r1 r2 rm > sd
z!ipset_ContentHandler.startElementc C s( t j| |� |dkr$| jjj| j� d S )Nr* )r �
endElementrV r" �appendZ_element)r/ r' r1 r1 r2 rp u s z ipset_ContentHandler.endElementN)rg rh ri rm rp r1 r1 r1 r2 rl = s 7rl c % C s t � }| jd�s ttjd| ��| d d� |_|j|j� | |_||_|j t
j �rVdnd|_ |j |_
t|�}tj� }|j|� d|| f }t|d��b}tjd �}|j|� y|j|� W n8 tjk
r� } zttjd|j� ��W Y d d }~X nX W d Q R X ~~d |jk�rF|jd d
k�rFt|j�d k�rFt j d |j� |jd d �= d } t � }
x�| t|j�k �r|j| |
k�r�t j d
|j| � |jj | � nry |j |j| |j|j!� W n< tk
�r� } z t j d| � |jj | � W Y d d } ~ X nX |
j"|j| � | d7 } �qRW ~
t#�r|j$� |S )Nz.xmlz'%s' is missing .xml suffixrc FTz%s/%s�rbznot a valid ipset file: %srX rd r z6ipset '%s': timeout option is set, entries are ignoredz Entry %s already set, ignoring.z
%s, ignoring.rA ���)%r rP r r Z INVALID_NAMEr' Z
check_name�filename�pathrK r �
ETC_FIREWALLDZbuiltin�defaultrl �saxZ make_parserZsetContentHandler�openZ InputSourceZ
setByteStream�parseZSAXParseExceptionrL Z getExceptionr! rN r" r rn �set�poprW r �addr r< ) rt ru r( �handler�parserr' �f�source�msgrT Z entries_setr9 r1 r1 r2 r z s^
( c C s� |r|n| j }| jr$d|| jf }nd|| jf }tj j|�r�ytj|d| � W n0 tk
r� } ztj d||� W Y d d }~X nX tj j
|�}|j t j
�r�tj j|� r�tj jt j
�s�tjt j
d� tj|d� tj|ddd�}t|�}|j� d | ji}| j�r| jd
k�r| j|d < |jd |� |jd
� | j�rz| jd
k�rz|jd� |jdi � |j| j� |jd� |jd
� | j�r�| jd
k�r�|jd� |jdi � |j| j� |jd� |jd
� xZ| jj � D ]L\} }
|jd� |
d
k�r |j d| |
d�� n|j dd| i� |jd
� �q�W xD| j D ]:} |jd� |jdi � |j| � |jd� |jd
� �q(W |jd � |jd
� |j � |j � ~d S )Nz%s/%sz %s/%s.xmlz%s.oldz Backup of file '%s' failed: %si� ZwtzUTF-8)�mode�encodingr r r r( �
z r r r) )r' r+ r' r* )!ru rt r' �os�exists�shutilZcopy2� Exceptionr �error�dirnamerK r rv �mkdir�iory r Z
startDocumentr r rm ZignorableWhitespacer Z
charactersrp r r! r; Z
simpleElementr" Z endDocument�close) r( ru �_pathr' r� �dirpathr� r~ ro r` r+ r* r1 r1 r2 r � sf
)N))�__doc__�__all__Zxml.saxrx r� r� r� Zfirewallr Zfirewall.functionsr r r r r
r r r
r Zfirewall.core.io.io_objectr r r r Zfirewall.core.ipsetr r Zfirewall.core.icmpr r r r Zfirewall.core.loggerr r Zfirewall.errorsr r rl r r r1 r1 r1 r2 �<module> s&
, =5