File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/ipset.cpython-310.pyc
o
�N�g{G � @ s d Z ddlZddlZddlmZ e�e�Zddddd�Z h d�Z
h d�h d �h d �h d
�h d �h d
�h d
�h d
�h d
�h d
�h d
�h d
�h d �h d
�h d
�d�Z h d�Z dgdgdgg g g g g g g g g g g g d�Z
h d�h d�h d�h d�h d�h d�h d�h d�h d�h d�h d�h d�h d�h d�h d�d�ZdZdd� Zdd� Zdd � ZdGd d �ZdHd!d"�ZdId#d$�ZdJd%d&�ZdHd'd(�ZdId)d*�ZdId+d,�ZdId-d.�ZdId/d0�ZdHd1d2�Z d3d4� Z d5d6� Z d7d8� Z d9d:� Z dKd;d<�Z!d=d>� Z"d?d@� Z#dAdB� Z$dCdD� Z%dEdF� Z&dS )Lz
Support for ipset
� N)� ipaddressZinetZinet6)�ipv4Zip4Zipv6Zip6> � hash:ip,mark�hash:ip�hash:net,port,net�hash:net�list:set� hash:ip,port�hash:ip,port,ip�hash:ip,port,net� hash:net,net� bitmap:ip�
hash:net,port�
bitmap:ip,mac�hash:net,iface� bitmap:port�hash:mac> �skbinfo�timeout�range�comment�netmask�counters> r r r r r > r �hashsizer r r �familyr �maxelem> r r r r r r > r r r r r Zmarkmaskr r > �sizer r r )r
r r r r r r r r r
r r r r r > r r r r )r
r r r r r r r r r
r r r r r > r �skbmark�bytes�packets�skbqueue�skbprio> r r r r r! > r Znomatchr r r r r! )r
r r r r r r r r r
r r r r r �ipsetc C s t jj�d�r dS dS )z4
Only load the module if ipset is installed
r" T)FzGThe ipset execution modules cannot be loaded: ipset binary not in path.��salt�utils�path�which� r( r( �F/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/ipset.py� __virtual__� s r* c C s t jj�d�S )z
Return correct command
r" r# r( r( r( r) �
_ipset_cmd s r+ c C s& t � dg} td | dd��� }|d S )zz
Return version from ipset --version
CLI Example:
.. code-block:: bash
salt '*' ipset.version
z --version�cmd.runF�Z python_shell� �r+ �__salt__�split)�cmd�outr( r( r) �version s
r4 r Fc K s� t | }| sdS |s dS |tvrdS t| D ]}||vr$d|� d� S qt� d| |g}t| D ]}||v rI|tv r@|�|� q0|�||| g� q0dt| v rW|�d|g� |r^|�d� td |d
d �}|sjd }|S )
a.
.. versionadded:: 2014.7.0
Create new custom set
CLI Example:
.. code-block:: bash
salt '*' ipset.new_set custom_set list:set
salt '*' ipset.new_set custom_set list:set comment=True
IPv6:
salt '*' ipset.new_set custom_set list:set family=ipv6
z%Error: Set Name needs to be specifiedz%Error: Set Type needs to be specifiedzError: Set Type is invalid�Error: z is a required argument�creater r r, Fr- T) �_IPSET_FAMILIES�_IPSET_SET_TYPES�_CREATE_OPTIONS_REQUIREDr+ �_CREATE_OPTIONS� _CREATE_OPTIONS_WITHOUT_VALUE�append�extendr0 ) �name�set_typer r �kwargsZ ipset_family�itemr2 r3 r( r( r) �new_set s4 � �
rB c C s0 | sdS t � d| g}td |dd�}|sd}|S )z�
.. versionadded:: 2014.7.0
Delete ipset set.
CLI Example:
.. code-block:: bash
salt '*' ipset.delete_set custom_set
IPv6:
salt '*' ipset.delete_set custom_set family=ipv6
� Error: Set needs to be specifiedZdestroyr, Fr- T)r+ r0 �r> r r2 r3 r( r( r) �
delete_setV s rE c C sZ | sdS |sdS t | �}|sdS t |�}|rdS t� d| |g}td |dd�}|s+d }|S )
a
.. versionadded:: 2014.7.0
Delete ipset set.
CLI Example:
.. code-block:: bash
salt '*' ipset.rename_set custom_set new_set=new_set_name
IPv6:
salt '*' ipset.rename_set custom_set new_set=new_set_name family=ipv6
rC z-Error: New name for set needs to be specifiedzError: Set does not existz Error: New Set already exists�renamer, Fr- T��_find_set_typer+ r0 )r> rB r �settyper2 r3 r( r( r) �
rename_setq s rJ c C s� t � ddg}td |dd�}|�d�}d}g }|�i � |D ] }|s,|d }|�i � q |�d d�\}}|dd
� || |< q |S ) z�
.. versionadded:: 2014.7.0
List all ipset sets.
CLI Example:
.. code-block:: bash
salt '*' ipset.list_sets
�list�-tr, Fr- �
r r. �:N�r+ r0 r1 r< ) r r2 r3 �_tmp�countZsetsrA �key�valuer( r( r) � list_sets� s
rT c C s | sdS t | �}|s dS dS )z�
Check that given ipset set exists.
.. versionadded:: 2014.7.0
CLI Example:
.. code-block:: bash
salt '*' ipset.check_set name
rC FT��_find_set_info)r> r �setinfor( r( r) � check_set� s
rX c
K s^ | sdS |sdS t | �}|sd| � d�S |d }t� dd| g|�� }d|v r3d|d vr3d| � d
�S d |v s;d |v rGd
|d vrGd| � d�S d|v rdd|d vrWd| � d�S d|vrd|d|d � g }h d�t|�� �@ rzd|d vrzd| � d�S t| D ]}||v r�|�||| g� q~t| �}||v r�d|� d| � �S td |dd�} | s�dS d| � �S )z�
Append an entry to the specified set.
CLI Example:
.. code-block:: bash
salt '*' ipset.add name 192.168.1.26
salt '*' ipset.add name 192.168.0.3,AA:BB:CC:DD:EE:FF
rC �"Error: Entry needs to be specified� Error: Set � does not exist�Type�addz-existr �Headerz! not created with timeout supportr r r z" not created with counters supportr z! not created with comment support> r! r r r z! not created with skbinfo supportz Warn: Entry z already exists in set r, Fr- �Successr5 ) rV r+ r1 �set�keys� _ADD_OPTIONSr= �_find_set_membersr0 )
r> �entryr r@ rW rI r2 rA �current_membersr3 r( r( r) r] � sD
�
r] c K sX | sdS |sdS t | �}|sd| � d�S t� d| |g}td |dd�}|s'd S d
|� �S ) z�
Delete an entry from the specified set.
CLI Example:
.. code-block:: bash
salt '*' ipset.delete name 192.168.0.3,AA:BB:CC:DD:EE:FF
rC rY rZ r[ �delr, Fr- r_ r5 rG �r> rd r r@ rI r2 r3 r( r( r) �delete s
rh c C s� | sdS |sdS t | �}|sd| � d�S t|t| ��}|s dS t|t�r*t||�}nt||�g}|D ]}|D ] }t||�rA dS q6q2dS )a
Check that an entry exists in the specified set.
name
The ipset name
entry
An entry in the ipset. This parameter can be a single IP address, a
range of IP addresses, or a subnet block. Example:
.. code-block:: cfg
192.168.0.1
192.168.0.2-192.168.0.19
192.168.0.0/25
family
IP protocol version: ipv4 or ipv6
CLI Example:
.. code-block:: bash
salt '*' ipset.check name '192.168.0.1 comment "Hello"'
rC rY rZ r[ FT)rH �_parse_membersrc �
isinstancerK �
_parse_member�_member_contains)r> rd r rI re �entriesZcurrent_memberr( r( r) �check% s(
��rn c K sZ | sdS |sdS t | �}|sd| � d�S t� d| |g}td |dd�}|d d
kr+dS d S ) z�
Test if an entry is in the specified set.
CLI Example:
.. code-block:: bash
salt '*' ipset.test name 192.168.0.2
IPv6:
salt '*' ipset.test name fd81:fc56:9ac7::/48
rC rY rZ r[ �test� cmd.run_allFr- �retcoder TrG rg r( r( r) ro [ s
ro c C s. t � dg}| r |�| � td |dd�}| S )a
Flush entries in the specified set,
Flush all sets if set is not specified.
CLI Example:
.. code-block:: bash
salt '*' ipset.flush
salt '*' ipset.flush set
IPv6:
salt '*' ipset.flush
salt '*' ipset.flush set
�flushr, Fr- )r+ r< r0 rD r( r( r) rr { s
rr c C sj t � d| g}td |dd�}|d dkrdS |d �d�}g }d}|D ]}|r,|�|� d |v r2d
}q#|S ) z*
Return list of members for a set
rK rp Fr- rq r �stdoutrM zMembers:TrO )r> r2 r3 rP �membersZ startMembers�ir( r( r) rc � s
�rc c C sv t � dd| g}td |dd�}|d dkrdS i }|d �d �}|D ]}d
|v r8|�d
d �\}}|d d � ||< q"|S )
z*
Return information about the set
rK rL rp Fr- rq r rs rM rN r. Nr/ )r> r2 r3 rW rP rA rR rS r( r( r) rV � s �rV c C s t | �}|r
|d S dS )z"
Find the type of the set
r\ FrU )r> rW r( r( r) rH � s rH c s( t |t�r t� |�gS � fdd�|D �S )Nc s g | ]}t � |��qS r( )rk )�.0�member�rI r( r) �
<listcomp>� s z"_parse_members.<locals>.<listcomp>)rj �strrk )rI rt r( rx r) ri � s
ri c C s� | � d�d � d�}|� dd�}|d � d�}g }t|�D ]P\}}|| } |dv r`z-d| v r6tj| |d�} n d | v rPtttj| � d ���\}
} tt�|
| ��} nt�| �} W n ty_ Y n w |d
krht | �} |�
| � q t |�dkr{|�
|d � |S ) NrN r. �,� r )�ip�net�/)�strict�-�port) r1 � enumerater �
ip_networkrK �map�
ip_address�summarize_address_range�
ValueError�intr< �len) rI rw r� ZsubtypesZ all_parts�partsZ
parsed_memberru �subtype�part�start�endr( r( r) rk � s0
� � rk c C s d S �Nr( )rt rd r( r( r) �_members_contain� s r� c C s> t | �t |�k r
dS t|�D ]\}}t| | |�s dS qdS )NFT)r� r� �_compare_member_parts)rw rd ru Z_entryr( r( r) rl � s �rl c C sp | |krdS t |t�r|D ]
}t| |�s dS q
dS t| �r(t|�r&| |v S dS t| �r6t|�r4|| v S dS dS )NTF)rj rK r� � _is_address� _is_network)Z member_partZ
entry_partZentry_part_itemr( r( r) r� s"
��r� c C � t | tjtjf�S r� )rj r � IPv4Network� IPv6Network��or( r( r) r� * � r� c C r� r� )rj r � IPv4Address� IPv6Addressr� r( r( r) r� . r� r� )NNr F)Nr )NNr )r )F)'�__doc__�loggingZsalt.utils.pathr$ Z salt._compatr � getLogger�__name__�logr7 r8 r: r; r9 rb Z__virtualname__r* r+ r4 rB rE rJ rT rX r] rh rn ro rr rc rV rH ri rk r� rl r� r� r� r( r( r( r) �<module> s�
�
�l� �Q
7
&
<
6
" "