VULN_CHECK_I913V6 =j,dZddlZddlZddlmZddlmZddlm Z ddl m Z ddl m Z mZddlmZd Zgd Zd d d d dZddddZGddZdZdZdZdZdZy)zThe ipset command wrapperN)errors) FirewallError)runProg)log)tempFilereadfile)COMMANDS ) zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz inet|inet6valuez value in secs)familyhashsizemaxelemtimeoutinet102465536)r r rceZdZdZdZdZdZdZddZdZ d Z d Z dd Z dd Z d ZddZ ddZdZdZdZdZy)ipsetzipset command wrapper classc.td|_d|_y)Nr)r _commandnameselfs 8/usr/lib/python3.12/site-packages/firewall/core/ipset.py__init__zipset.__init__9s )  c@|Dcgc]}d|z }}tjd|j|jdj |t |j|\}}|dk7r-t d|jddj |d||Scc}w)zCall ipset with args%sz %s: %s %s r' ' failed: )rdebug2 __class__rjoinr ValueError)rargsitem_argsstatusrets r__runz ipset.__run=s*... ; sxxO u5  Q;(, sxxL  /s Bcbt|tkDrttjd|zy)zCheck ipset namezipset name '%s' is not validN)lenIPSET_MAXNAMELENrr INVALID_NAME)rrs r check_namezipset.check_nameIs2 t9' '##%Cd%J  (rcrt|tkDs|tvrttj d|zy)zCheck ipset typez!ipset type name '%s' is not validN)r-r. IPSET_TYPESrr INVALID_TYPE)r type_names r check_typezipset.check_typePs: y>, , 0L##%H9%T 1MrNc|j||j|d||g}t|tr@|j D]-\}}|j ||dk7s|j |/|j |S)z+Create an ipset with name, type and optionscreate)r0r5 isinstancedictitemsappend _ipset__run)rset_namer4optionsr&keyvals r set_createzipset.set_createWst !  "(I. gt $#MMOS C "9KK$,zz$rcJ|j||jd|gS)Ndestroy)r0r=)rr>s r set_destroyzipset.set_destroyds" !zz9h/00rc.d||g}|j|S)Naddr=rr>entryr&s rset_addz ipset.set_addhx'zz$rc.d||g}|j|S)NdelrHrIs r set_deletezipset.set_deletelrLrcxd||g}|r#|jddj|z|j|S)Ntestrr)r<r$r=)rr>rJr?r&s rrQz ipset.testps:%(  KKsxx00 1zz$rcdg}|r|j||r|j||j|jdS)Nlist )r<extendr=split)rr>r?r&s rset_listzipset.set_listvsAx  KK !  KK zz$%%d++rct|jdg}i}dx}}i}|D]}t|dkr|jddDcgc]}|j}}t|dk7rO|ddk(r|d}]|dd k(r|d}k|dd k(st|dj} d} | t| krS| | } | d vr6t| | kDr| dz } | | || <nt j d |icS| dz } | t| krS|r|r|t |f||<dx}}|j|Scc}w) z Get active ipsets (only headers)z-terse)r?N:rNameTypeHeader)r r rrnetmaskz&Malformed ipset list -terse output: %s)rWr-rVstriprerrorremove_default_create_optionsclear) rlinesr*_name_type_optionslinexpairsplitsiopts rset_get_active_tersezipset.set_get_active_terse~sc xj 1D4y1}'+zz#q'9:'9!AGGI'9D:4yA~aF"QaF"QaH$a#f+o )CUUv;?FA,21IHSMII&NPTU#%IFA#f+oU"')Fx)P!QCJ $$ 56 1;sD5cPdg}|r|j||j|S)Nsaver<r=rr>r&s rrpz ipset.saves'x  KK !zz$rc 8|j||j|t}d|vrd|z}d||dg}|r@|jD]-\}} |j || dk7s|j | /|j ddj |z|j d|z|D]P} d| vrd| z} |r+|j d|d| ddj |d 9|j d|d| d R|jtj|j} tjd |j|jd |j| jfzd g}t!|j||j \} } tj"dkDr} t%|jd}t%|jD]L}tj&d||fzdd|j)d stj&dd|dz }N tj,|j| dk7r-t/d|jddj |d| | S#t*$rY^wxYw)Nrz'%s'r7z-existr8z%s z flush %s zadd rTz%s: %s restore %sz%s: %drestore)stdinr[rYz%8d: %sr)nofmtnl)rvr r!)r0r5rr;r<writer$closeosstatrrr"r#rst_sizergetDebugLogLevelrdebug3endswith Exceptionunlinkr%)rr>r4entriescreate_options entry_options temp_filer&r@rArJr{r)r*rlrhs r set_restorezipset.set_restores8 !  "J (?(H(Ix8 *002S C "9KK$3 $/0 x/0Ee|(0%-9PQ5 AB wwy~~&  NN MM   5 5  { t9>>J     !A % ($Y^^4DJJyAt94A!D==. 2Q/FA 5 )..! Q;(, sxx~sK  !  s>J JJcPdg}|r|j||j|S)Nflushrqrrs r set_flushzipset.set_flushs'y  KK !zz$rc*|jd||gS)NrenamerH)r old_set_name new_set_names rrz ipset.renameszz8\<@AArc*|jd||gS)NswaprH)r set_name_1 set_name_2s rrz ipset.swapszz6:z:;;rc&|jdgS)NversionrHrs rrz ipset.versionszz9+&&r)N)NN)__name__ __module__ __qualname____doc__rr=r0r5rBrErKrOrQrWrnrprrrrrrrrr6sd%   1   ,"H PT<| B<'rrc*t|tkDryy)z"Return true if ipset name is validFT)r-r.)rs rcheck_ipset_namers 4y## rcl|j}tD]}||vst|||k(s||=|S)z&Return only non default create options)copyIPSET_DEFAULT_CREATE_OPTIONS)r?rgrms rrbrbs=||~H+ (?;C@HSMQ , Orc g}|jdD]C} |jd|jtt j |dEdj|S#t $r|j|YswxYw)zNormalize IP addresses in entry,/Fstrict)rVindexr<str ipaddress ip_networkr%r$)rJ_entry_parts rnormalize_ipset_entryrsw FS! ! KK  MM#i225GH I" 88F  ! MM%  !sAA++BBc<t|jddkDry tj|d}|D]R}|j tj|ds*t tjdj||y#t$rYywxYw)z8Check if entry overlaps any entry in the list of entriesrrYNFrz,Entry '{}' overlaps with existing entry '{}') r-rVrrr%overlapsrr INVALID_ENTRYformat)rJr entry_networkitrs rcheck_entry_overlaps_existingrs 5;;s q !,,U5A   ! !)"6"6s5"I J$$>EEeSQ  sB BBc^ |Dcgc]}tj|d}}t|dk(ry|j |j d}|D]?}|j |r*ttjdj|||}Aycc}w#t$rYywxYw)zL"   1$$077 oV ' #uK s!B BB B B,+B,)ros.pathrzrfirewallrfirewall.errorsrfirewall.core.progrfirewall.core.loggerrfirewall.functionsrrfirewall.configr r.r2IPSET_CREATE_OPTIONSrrrrbrrrrrrrs )&$1$ &  }'}'@ (C'r