File: //opt/alt/python37/lib/python3.7/site-packages/pyroute2/__pycache__/ipset.cpython-37.pyc
B
��fD^ � @ sX d Z ddlZddlZddlmZ ddlmZmZmZm Z m
Z
m Z ddl m
Z
mZ ddlmZ ddlmZmZmZmZmZmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8 ddl9m:Z: d d
� Z;G d d � d e<�Z=G d
d� de<�Z>G dd� de:�Z?G dd� de
�Z@dS )a.
ipset support.
This module is tested with hash:ip, hash:net, list:set and several
other ipset structures (like hash:net,iface). There is no guarantee
that this module is working with all available ipset modules.
It supports almost all kernel commands (create, destroy, flush,
rename, swap, test...)
� N)�
basestring)�NETLINK_NETFILTER� NLM_F_ACK�
NLM_F_DUMP�
NLM_F_EXCL�
NLM_F_REQUEST� NLMSG_ERROR)�
IPSetError� NetlinkError)�NFNL_SUBSYS_IPSET)'�
IPSET_CMD_ADD�IPSET_CMD_CREATE�
IPSET_CMD_DEL�IPSET_CMD_DESTROY�IPSET_CMD_FLUSH�IPSET_CMD_GET_BYINDEX�IPSET_CMD_GET_BYNAME�IPSET_CMD_HEADER�IPSET_CMD_LIST�IPSET_CMD_PROTOCOL�IPSET_CMD_RENAME�IPSET_CMD_SWAP�IPSET_CMD_TEST�IPSET_CMD_TYPE�IPSET_ERR_BUSY�IPSET_ERR_COMMENT�IPSET_ERR_COUNTER�IPSET_ERR_EXIST�IPSET_ERR_EXIST_SETNAME2�IPSET_ERR_FIND_TYPE�IPSET_ERR_INVALID_CIDR�IPSET_ERR_INVALID_FAMILY�IPSET_ERR_INVALID_MARKMASK�IPSET_ERR_INVALID_NETMASK�IPSET_ERR_IPADDR_IPV4�IPSET_ERR_IPADDR_IPV6�IPSET_ERR_MAX_SETS�IPSET_ERR_PROTOCOL�IPSET_ERR_REFERENCED�IPSET_ERR_SKBINFO�IPSET_ERR_TIMEOUT�IPSET_ERR_TYPE_MISMATCH�IPSET_FLAG_IFACE_WILDCARD�IPSET_FLAG_PHYSDEV�IPSET_FLAG_WITH_COMMENT�IPSET_FLAG_WITH_COUNTERS�IPSET_FLAG_WITH_FORCEADD�IPSET_FLAG_WITH_SKBINFO� ipset_msg)�
NetlinkSocketc C s | d d t kS )N�header�type)r )�msg� r7 �?/opt/alt/python37/lib/python3.7/site-packages/pyroute2/ipset.py� _nlmsg_errorF s r9 c @ s e Zd ZdZddd�ZdS )� PortRangeaF A simple container for port range with optional protocol
Note that optional protocol parameter is not supported by all
kernel ipset modules using ports. On the other hand, it's sometimes
mandatory to set it (like for hash:net,port ipsets)
Example::
udp_proto = socket.getprotobyname("udp")
port_range = PortRange(1000, 2000, protocol=udp_proto)
ipset.create("foo", stype="hash:net,port")
ipset.add("foo", ("192.0.2.0/24", port_range), etype="net,port")
ipset.test("foo", ("192.0.2.0/24", port_range), etype="net,port")
Nc C s || _ || _|| _d S )N)�begin�end�protocol)�selfr; r< r= r7 r7 r8 �__init__Z s zPortRange.__init__)N)�__name__�
__module__� __qualname__�__doc__r? r7 r7 r7 r8 r: J s r: c @ s e Zd ZdZddd�ZdS )� PortEntryz8A simple container for port entry with optional protocolNc C s || _ || _d S )N)�portr= )r> rE r= r7 r7 r8 r? c s zPortEntry.__init__)N)r@ rA rB rC r? r7 r7 r7 r8 rD ` s rD c s\ e Zd ZdZeeeeeeeee ee
eiZ dddddddd d
d d d
� Z d?� fdd� Z
eeB dfdd�Zdd� Zd@dd�Zdd� ZdAdd �ZdBd d �Zd ejd d!d!dd!ddddd!f d"d#�Zed$d%� �Zd&d'� ZdCd)d*�Z ejd ddd(dddd!f d+d,�Z ejd d(fd-d.�Z ejd(fd/d0�Z d1d2� Z dDd3d4�Z!d5d6� Z"d7d8� Z#d9d:� Z$d;d<� Z%ejfd=d>�Z&� Z'S )E�IPSetzf
NFNetlink socket (family=NETLINK_NETFILTER).
Implements API to the ipset functionality.
ZIPSET_ATTR_IFACEZIPSET_ATTR_MARK�IPSET_ATTR_NAMEZIPSET_ATTR_ETHER�IPSET_ATTR_PORTZIPSET_ATTR_IP_FROMZIPSET_ATTR_IP2ZIPSET_ATTR_CIDRZIPSET_ATTR_CIDR2ZIPSET_ATTR_IP_TOZIPSET_ATTR_IP2_TO) Ziface�mark�set�macrE )�ip_from� )rL � )�cidrrM )rO rN )�ip_torM )rP rN NrN c sh t t| �jtd� tdd� | j�� D ��}| �|� || _|d krX| � � }|d �
d�}|| _ || _ d S )N)�familyc S s g | ]\}}|t d > B |f�qS )� )r )�.0�x�yr7 r7 r8 �
<listcomp>� s z"IPSet.__init__.<locals>.<listcomp>r �IPSET_ATTR_PROTOCOL)
�superrF r? r �dict�policy�itemsZregister_policy�
_nfgen_family�get_proto_version�get_attr�_proto_version�_attr_revision)r> �versionZ
attr_revision� nfgen_familyrZ r6 )� __class__r7 r8 r? � s
zIPSet.__init__c
C s^ | j |d< y t| j||td> B ||d��S tk
rX } zt|j|d��W d d }~X Y nX d S )Nrb rR )� terminate)�cmd)r\ �tupleZ nlm_requestr r
� _IPSetError�code)r> r6 Zmsg_type� msg_flagsrd �errr7 r7 r8 �request� s
z
IPSet.requestc K s | j tfd|i|��S )z�
Get headers of the named ipset. It can be used to test if one ipset
exists, since it returns a no such file or directory.
�name)�_list_or_headersr )r> rl �kwargsr7 r7 r8 �headers� s z
IPSet.headers� c C s t � }d|gg|d< | �|t�S )z�
Get supported protocol version by kernel.
version parameter allow to set mandatory (but unused?)
IPSET_ATTR_PROTOCOL netlink attribute in the request.
rW �attrs)r2 rk r )r> ra r6 r7 r7 r8 r] � s zIPSet.get_proto_versionc O s |r|d |d< | j tf|�S )z�
List installed ipsets. If `name` is provided, list
the named ipset or return an empty list.
Be warned: netlink does not return an error if given name does not
exit, you will receive an empty list.
r rl )rm r )r> �argvrn r7 r7 r8 �list� s z
IPSet.listc C sV t � }d| jgg|d< |d k r0|d �d|g� |d k rJ|d �d|g� | �||�S )NrW rq �IPSET_ATTR_SETNAMEZIPSET_ATTR_FLAGS)r2 r_ �appendrk )r> re rl �flagsr6 r7 r7 r8 rm � s zIPSet._list_or_headersc C sJ t � }d| jgg|d< |dk r0|d �d|g� | j|tttB tB td�S )zQ
Destroy one (when name is set) or all ipset (when name is None)
rW rq Nrt )ri rd ) r2 r_ ru rk r r r r r9 )r> rl r6 r7 r7 r8 �destroy� s
z
IPSet.destroyzhash:ipTFc C s� |rt nd}t� }d}|r"|tO }|r.|tO }|r:|tO }|
rF|tO }|dkr^| dkr^td��dg i}|r�|d d|gg7 < |dk r�|d d|gg7 < | dk r�|d d| gg7 < n&| dk r�|d kr�|d d
| gg7 < |
dk �r|d d |
gg7 < | dk �r�|dk�r�t| t��rV|d d | j gg7 < |d d
| j
gg7 < n4|d d | d gg7 < |d d
| d gg7 < | j dk�r�| � |�d }n| j }d| j
gd|gd|gd|gd|gd|gg|d< | j|tttB |B td�S )a
Create an ipset `name` of type `stype`, by default
`hash:ip`.
Common ipset options are supported:
* exclusive -- if set, raise an error if the ipset exists
* counters -- enable data/packets counters
* comment -- enable comments capability
* maxelem -- max size of the ipset
* forceadd -- you should refer to the ipset manpage
* hashsize -- size of the hashtable (if any)
* timeout -- enable and set a default value for entries (if not None)
* bitmap_ports_range -- set the specified inclusive portrange for
the bitmap ipset structure (0, 65536)
* size -- Size of the list:set, the default is 8
* skbinfo -- enable skbinfo capability
r z bitmap:portNz Missing value bitmap_ports_rangerq �IPSET_ATTR_CADT_FLAGSZIPSET_ATTR_MAXELEMZIPSET_ATTR_HASHSIZEzlist:setZIPSET_ATTR_SIZE�IPSET_ATTR_TIMEOUT�IPSET_ATTR_PORT_FROM�IPSET_ATTR_PORT_TOrM rW rt �IPSET_ATTR_TYPENAME�IPSET_ATTR_FAMILY�IPSET_ATTR_REVISION�IPSET_ATTR_DATA)ri rd )r r2 r/ r. r0 r1 �
ValueError�
isinstancer: r; r< r` �get_supported_revisionsr_ rk r
r r r9 )r> rl �styperQ � exclusiveZcounters�commentZmaxelemZforceaddZhashsize�timeoutZbitmap_ports_range�sizeZskbinfo� excl_flagr6 Z
cadt_flags�data�revisionr7 r7 r8 �create� s` "
z IPSet.createc C s> | d k r:| t jkrdS | t jkr$dS | t jkr2d S td��d S )NZIPSET_ATTR_IPADDR_IPV4ZIPSET_ATTR_IPADDR_IPV6zunknown family)�socket�AF_INET�AF_INET6� AF_UNSPEC� TypeError)rQ r7 r7 r8 �_family_to_versionC s
zIPSet._family_to_versionc
C s� g }d}|dkr"|d|gg7 }|S t |t�r6|�d�}t |tttf�rL|g}�x�t||�d��D �]j\}}|dk�r|d7 }|dkr�d|kr�|�d�\}}|| jd |f t|�gg7 }n8d
|kr�|�d
�\}} || jd |f d || ggigg7 }|| jd
|f d ||ggigg7 }q`|dk�r�t |t��rh|d|jgg7 }|d|j gg7 }|j
d k �r�|d|j
gg7 }nNt |t��r�|d|j gg7 }|j
d k �r�|d|j
gg7 }n|| j| |gg7 }q`|| j| |gg7 }q`W |S )Nr rJ rG �,)�ip�netrM r� �/rO �-rP rq rL rE rz r{ ZIPSET_ATTR_PROTOrH ) r� r �split�intr: rD �zip�attr_mapr; r< r= rE )
r> �entry�etype�
ip_versionrq Zip_count�e�trO �tor7 r7 r8 �_entry_to_data_attrsN sL
zIPSet._entry_to_data_attrsr� c C s2 |rt nd}d}|r |tO }|r(|tO }| �|�}| �|||�}|d k r\|d|gddgg7 }|d k rr|d|gg7 }|
d k r�|d|
gg7 }| d k r�|d| gg7 }| d k r�|d| gg7 }| d k r�|d| gg7 }|
d k r�|d |
gg7 }|r�|d
|gg7 }t� }d | jgd |gd
d|igg|d< | j||tt B |B t
d�S )Nr ZIPSET_ATTR_COMMENTZIPSET_ATTR_CADT_LINENOry ZIPSET_ATTR_BYTESZIPSET_ATTR_PACKETSZIPSET_ATTR_SKBMARKZIPSET_ATTR_SKBPRIOZIPSET_ATTR_SKBQUEUErx rW rt r rq )ri rd ) r r, r- r� r� r2 r_ rk r r r9 )r> rl r� rQ re r� r� r� r� Zpackets�bytes�skbmark�skbprio�skbqueue�wildcardZphysdevr� Z adt_flagsr� Z
data_attrsr6 r7 r7 r8 �_add_delete_test� sF
zIPSet._add_delete_testc
K s* | j |||t|f||||| |
| d�| ��S )a�
Add a member to the ipset.
etype is the entry type that you add to the ipset. It's related to
the ipset type. For example, use "ip" for one hash:ip or bitmap:ip
ipset.
When your ipset store a tuple, like "hash:net,iface", you must use a
comma a separator (etype="net,iface")
entry is a string for "ip" and "net" objects. For ipset with several
dimensions, you must use a tuple (or a list) of objects.
"port" type is specific, since you can use integer of specialized
containers like :class:`PortEntry` and :class:`PortRange`
Examples::
ipset = IPSet()
ipset.create("foo", stype="hash:ip")
ipset.add("foo", "198.51.100.1", etype="ip")
ipset = IPSet()
ipset.create("bar", stype="bitmap:port",
bitmap_ports_range=(1000, 2000))
ipset.add("bar", 1001, etype="port")
ipset.add("bar", PortRange(1500, 2000), etype="port")
ipset = IPSet()
import socket
protocol = socket.getprotobyname("tcp")
ipset.create("foobar", stype="hash:net,port")
port_entry = PortEntry(80, protocol=protocol)
ipset.add("foobar", ("198.51.100.0/24", port_entry),
etype="net,port")
wildcard option enable kernel wildcard matching on interface
name for net,iface entries.
)r� r� r� r� r� r� r� )r� r )
r> rl r� rQ r� r� r� r� r� r� r� r� rn r7 r7 r8 �add� s 6z IPSet.addc C s | j |||t||d�S )zp
Delete a member from the ipset.
See :func:`add` method for more information on etype.
)r� )r� r )r> rl r� rQ r� r� r7 r7 r8 �delete s z IPSet.deletec
C sT y| j |||td|d� dS tk
rN } z|jtkr:dS |�W dd}~X Y nX dS )zr
Test if entry is part of an ipset
See :func:`add` method for more information on etype.
F)r� TN)r� r r rh r )r> rl r� rQ r� r� r7 r7 r8 �test s
z
IPSet.testc C s8 t � }d| jgd|gd|gg|d< | j|tttB td�S )zJ
Swap two ipsets. They must have compatible content type.
rW rt r| rq )ri rd )r2 r_ rk r r r r9 )r> Zset_aZset_br6 r7 r7 r8 �swap# s z
IPSet.swapc C sF t � }d| jgg|d< |dk r0|d �d|g� | j|tttB td�S )zL
Flush all ipsets. When name is set, flush only this ipset.
rW rq Nrt )ri rd )r2 r_ ru rk r r r r9 )r> rl r6 r7 r7 r8 �flush4 s z IPSet.flushc C s8 t � }d| jgd|gd|gg|d< | j|tttB td�S )z#
Rename the ipset.
rW rt r| rq )ri rd )r2 r_ rk r r r r9 )r> Zname_srcZname_dstr6 r7 r7 r8 �renameC s z IPSet.renamec C s^ | j dk rt� �t� }|tkr4d| j gd|gg|d< |tkrRd| j gd|gg|d< | �||�S )N� rW rt rq ZIPSET_ATTR_INDEX)r_ �NotImplementedErrorr2 r r rk )r> re �valuer6 r7 r7 r8 � _get_set_byT s
zIPSet._get_set_byc C s | � t|�S )z'
Get a set by its name
)r� r )r> rl r7 r7 r8 �get_set_bynameg s zIPSet.get_set_bynamec C s | � t|�S )z(
Get a set by its index
)r� r )r> �indexr7 r7 r8 �get_set_byindexn s zIPSet.get_set_byindexc C s\ t � }d| jgd|gd|gg|d< | j|tttB td�}|d �d�}|d �d�}||fS ) a5
Return minimum and maximum of revisions supported by the kernel.
Each ipset module (like hash:net, hash:ip, etc) has several
revisions. Newer revisions often have more features or more
performances. Thanks to this call, you can ask the kernel
the list of supported revisions.
You can manually set/force revisions used in IPSet constructor.
Example::
ipset = IPSet()
ipset.get_supported_revisions("hash:net")
ipset.get_supported_revisions("hash:net,port,net")
rW r| r} rq )ri rd r ZIPSET_ATTR_PROTOCOL_MINr~ )r2 r_ rk r r r r9 r^ )r> r� rQ r6 �responseZ min_revisionZ max_revisionr7 r7 r8 r� u s z IPSet.get_supported_revisions)NNrN )rp )NN)N)
NNr� NNNNNFF)N)(r@ rA rB rC r r2 r r r r r rZ r� r? r r rk ro r] rs rm rw r� r� r� � staticmethodr� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r7 r7 )rc r8 rF h s�
U >
0 ;
rF c s� e Zd ZdZd� fdd� Zedededede d e
d
e d e d iZ
ejd
ededededediZediZedediZedediZ e diZ e diZ e ee!ee"ee#e e$e e%e iZ&� Z'S )rg z�
Proxy class to not import all specifics ipset code in exceptions.py
Out of the ipset module, a caller should use parent class instead
Nc sP || j kr| j | }n$|| jkr:| j| }||kr:|| }tt| ��||� d S )N)�base_map�cmd_maprX rg r? )r> rh r6 re Z error_map)rc r7 r8 r? � s
z_IPSetError.__init__z+Kernel error received: ipset protocol errorz<The value of the CIDR parameter of the IP address is invalidz?Timeout cannot be used: set was created without timeout supportz-An IPv4 address is expected, but not receivedz-An IPv6 address is expected, but not receivedzLPacket/byte counters cannot be used: set was created without counter supportzComment string is too long!zHSkbinfo mapping cannot be used: set was created without skbinfo supportz<Set cannot be created: set with the same name already existsz-Kernel error received: set type not supportedzJKernel error received: maximal number of sets reached, cannot create more.z-The value of the netmask parameter is invalidz.The value of the markmask parameter is invalidz-Protocol family not supported by the set typez;Set cannot be destroyed: it is in use by a kernel componentz=Set cannot be renamed: a set with the new name already existsz5Set cannot be renamed: it is in use by another systemz5Sets cannot be swapped: the second set does not existz5The sets cannot be swapped: their type does not matchz6Element cannot be added to the set: it's already addedz6Element cannot be deleted from the set: it's not added)NN)(r@ rA rB rC r? r' r r* r$ r% r r r) r� �errno�EEXISTr r& r# r" r! Zc_mapr Z destroy_mapr r( Zr_mapr+ Zs_mapr Za_mapZdel_mapr
r r r r r r� r� r7 r7 )rc r8 rg � s:
rg )ArC r� r� Zpyroute2.commonr Zpyroute2.netlinkr r r r r r Zpyroute2.netlink.exceptionsr r
Zpyroute2.netlink.nfnetlinkr Z pyroute2.netlink.nfnetlink.ipsetr r
r r r r r r r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r, r- r. r/ r0 r1 r2 Zpyroute2.netlink.nlsocketr3 r9 �objectr: rD rF rg r7 r7 r7 r8 �<module>
s" �) 5