shell bypass 403
3
]ûfq2 � @ s� d Z dddgZddlZddlZddlmZ ddlmZ ddl m
Z
dd l m Z dd
l
mZmZ dd lmZ d Zd
ddddddddddg Zddddd�Zd d d d �ZG d d� de�Zd!d� Zd"d� Zd#d$� Zd%d&� Zd'd(� Z dS ))zThe ipset command wrapper�ipset�check_ipset_name� remove_default_create_options� N)�errors)�
FirewallError)�runProg)�log)�tempFile�readfile)�COMMANDS� zhash:ipz hash:ip,portzhash:ip,port,ipzhash:ip,port,netz hash:ip,markzhash:netz hash:net,netz
hash:net,portzhash:net,port,netzhash:net,ifacezhash:macz
inet|inet6�valuez
value in secs)�family�hashsize�maxelem�timeoutZinetZ1024Z65536)r r r c @ s� e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd'd
d�Z dd� Z
dd� Z dd� Z d(dd�Z
d)dd�Zdd� Zd*dd �Zd+d d �Zd d � Zd!d"� Zd#d$� Zd%d&� Zd S ),r zipset command wrapper classc C s t d | _d| _d S )Nr )r �_command�name)�self� r �/usr/lib/python3.6/ipset.py�__init__K s
zipset.__init__c C s^ dd� |D �}t jd| j| jdj|�� t| j|�\}}|dkrZtd| jdj|�|f ��|S )zCall ipset with argsc S s g | ] }d | �qS )z%sr )�.0�itemr r r �
<listcomp>R s z ipset.__run.<locals>.<listcomp>z %s: %s %s� r z'%s %s' failed: %s)r �debug2� __class__r �joinr �
ValueError)r �argsZ_args�status�retr r r Z__runO s z ipset.__runc C s t |�tkr ttjd| ��dS )zCheck ipset namez ipset name '%s' is not validN)�len�IPSET_MAXNAMELENr r Z INVALID_NAME)r r r r r �
check_nameZ s zipset.check_namec C s� g }d}y| j dg�}W n0 tk
rH } ztjd| � W Y dd}~X nX |j� }d}xT|D ]L}|r�|j� jdd�}|d |kr�|d tkr�|j|d � |j d�r\d }q\W |S )
z?Return types that are supported by the ipset command and kernel� z--helpzipset error: %sNF� r zSupported set types:T)
� _ipset__runr r Zdebug1�
splitlines�strip�split� IPSET_TYPES�append�
startswith)r r" �outputZex�linesZin_types�line�splitsr r r �set_supported_types` s
zipset.set_supported_typesc C s( t |�tks|tkr$ttjd| ��dS )zCheck ipset typez!ipset type name '%s' is not validN)r# r$ r, r r Z INVALID_TYPE)r � type_namer r r �
check_typeu s zipset.check_typeNc C sd | j |� | j|� d||g}t|t�rZx0|j� D ]$\}}|j|� |dkr2|j|� q2W | j|�S )z+Create an ipset with name, type and options�creater& )r% r5 �
isinstance�dict�itemsr- r( )r �set_namer4 �optionsr �key�valr r r �
set_create{ s
zipset.set_createc C s | j |� | jd|g�S )NZdestroy)r% r( )r r: r r r � set_destroy� s
zipset.set_destroyc C s d||g}| j |�S )N�add)r( )r r: �entryr r r r �set_add� s
z
ipset.set_addc C s d||g}| j |�S )N�del)r( )r r: rA r r r r �
set_delete� s
zipset.set_deletec C s, d||g}|r"|j ddj|� � | j|�S )N�testz%sr )r- r r( )r r: rA r; r r r r rE � s
z
ipset.testc C s2 dg}|r|j |� |r"|j|� | j|�jd�S )N�list�
)r- �extendr( r+ )r r: r; r r r r �set_list� s
zipset.set_listc C s< | j dgd�}i }d }}i }�x|D �] }t|�dk r:q&dd� |jdd�D �}t|�dkr`q&q&|d d
krv|d }q&|d d kr�|d }q&|d d kr&|d j� }d } x^| t|�k �r|| }
|
dk� r�t|�| kr�| d7 } || ||
< ntjd|� i S | d7 } q�W |�r$|�r$|t|�f||< d }}|j� q&W |S )z" Get active ipsets (only headers) z-terse)r; N� c S s g | ] }|j � �qS r )r* )r �xr r r r � s z.ipset.set_get_active_terse.<locals>.<listcomp>�:r' r �NameZTypeZHeaderr r r r �netmaskz&Malformed ipset list -terse output: %s)r r r r rN )rI r# r+ r �errorr �clear) r r0 r" �_nameZ_type�_optionsr1 Zpairr2 �i�optr r r �set_get_active_terse� sD
zipset.set_get_active_tersec C s dg}|r|j |� | j|�S )N�save)r- r( )r r: r r r r rV � s
z
ipset.savec C s� | j |� | j|� t� }d|kr*d| }d||dg}|rlx0|j� D ]$\}} |j|� | dkrD|j| � qDW |jddj|� � |jd| � xN|D ]F}
d|
kr�d|
}
|r�|jd||
dj|�f � q�|jd ||
f � q�W |j� tj |j
�} t j d
| j
| jd |j
| jf � d g}t| j||j
d
�\} }
t j� dk�r�yt|j
� W n tk
�r` Y nVX d}xNt|j
�D ]@}t jd||f ddd� |jd��s�t jddd� |d7 }�qrW tj|j
� | dk�r�td| jdj|�|
f ��|
S )Nr z'%s'r6 z-existr& z%s
z flush %s
z
add %s %s %s
z
add %s %s
z%s: %s restore %sz%s: %dZrestore)�stdinr' rJ z%8d: %sr )�nofmt�nlrG )rX z'%s %s' failed: %s)r% r5 r r9 r- �writer �close�os�statr r r r r �st_sizer ZgetDebugLogLevelr
� ExceptionZdebug3�endswith�unlinkr )r r: r4 �entriesZcreate_optionsZ
entry_optionsZ temp_filer r< r= rA r] r! r" rS r1 r r r � set_restore� sV
zipset.set_restorec C s dg}|r|j |� | j|�S )N�flush)r- r( )r r: r r r r � set_flush s
zipset.set_flushc C s | j d||g�S )N�rename)r( )r Z old_set_nameZ new_set_namer r r rf
s z ipset.renamec C s | j d||g�S )N�swap)r( )r Z
set_name_1Z
set_name_2r r r rg s z
ipset.swapc C s | j dg�S )N�version)r( )r r r r rh s z
ipset.version)N)N)NN)N)NN)�__name__�
__module__� __qualname__�__doc__r r( r% r3 r5 r> r? rB rD rE rI rU rV rc re rf rg rh r r r r r H s&
'
7c C s t | �tkrdS dS )z"Return true if ipset name is validFT)r# r$ )r r r r r s c C s8 | j � }x*tD ]"}||krt| || kr||= qW |S )z( Return only non default create options )�copy� IPSET_DEFAULT_CREATE_OPTIONS)r; rR rT r r r r s
c
C sh g }xX| j d�D ]J}y&|jd� |jttj|dd��� W q tk
rX |j|� Y qX qW dj|�S )z! Normalize IP addresses in entry �,�/F)�strict)r+ �indexr- �str� ipaddress�
ip_networkr r )rA Z_entryZ_partr r r �normalize_ipset_entry& s
rv c C sx t | jd��dkrdS ytj| dd�}W n tk
r< dS X x4|D ],}|jtj|dd��rDttjdj | |���qDW dS )z: Check if entry overlaps any entry in the list of entries ro rJ NF)rq z,Entry '{}' overlaps with existing entry '{}')
r# r+ rt ru r �overlapsr r �
INVALID_ENTRY�format)rA rb Z
entry_networkZitrr r r � check_entry_overlaps_existing2 s
rz c C s~ ydd� | D �} W n t k
r& dS X t| �dkr8dS | j� | jd�}x.| D ]&}|j|�rrttjdj||���|}qPW dS )z> Check if any entry overlaps any entry in the list of entries c S s g | ]}t j|d d��qS )F)rq )rt ru )r rK r r r r E s z1check_for_overlapping_entries.<locals>.<listcomp>Nr z Entry '{}' overlaps entry '{}') r r# �sort�poprw r r rx ry )rb Z prev_networkZcurrent_networkr r r � check_for_overlapping_entriesB s 2
r} ) rl �__all__Zos.pathr\ rt Zfirewallr Zfirewall.errorsr Zfirewall.core.progr Zfirewall.core.loggerr Zfirewall.functionsr r
Zfirewall.configr r$ r, ZIPSET_CREATE_OPTIONSrn �objectr r r rv rz r} r r r r �<module> sF
P