509318396 ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ 3 W„j^8ã@sDddlZddlTddlZddlZdZGdd„dƒZGdd„dƒZdS)éN)Ú*z0.1c@s eZdZdZdd„Zdd„ZdS)ÚSchemaValidatorz+Libnftables JSON validator using jsonschemac CsJtjjtjjtƒdƒ}t|dƒ}tj|ƒ|_WdQRXddl }||_ dS)Nzschema.jsonÚrr) ÚosÚpathÚjoinÚdirnameÚ__file__ÚopenÚjsonÚloadÚschemaÚ jsonschema)ÚselfZschema_pathZschema_filer©rú/usr/lib/python3.6/nftables.pyÚ__init__s zSchemaValidator.__init__cCs|jj||jddS)N)Úinstancer )rÚvalidater )rrrrrr"szSchemaValidator.validateN)Ú__name__Ú __module__Ú__qualname__Ú__doc__rrrrrrrsrc @sPeZdZdZdddddddd œZdWdXdYdZd[d\d]d^d_d`dadbdœZdZdcdd„Zdd„Zdd„Z dd„Z dd„Zdd „Zd!d"„Z d#d$„Zd%d&„Zd'd(„Zd)d*„Zd+d,„Zd-d.„Zd/d0„Zd1d2„Zd3d4„Zd5d6„Zd7d8„Zd9d:„Zd;d<„Zd=d>„Zd?d@„ZdAdB„ZdCdD„ZdEdF„ZdGdH„Z dIdJ„Z!dKdL„Z"dMdN„Z#dOdP„Z$dQdR„Z%dSdT„Z&dUdV„Z'dS)dÚNftablesz*A class representing libnftables interfaceéééééé é@)ÚscannerÚparserÚevalZnetlinkZmnlz proto-ctxZsegtreerééééé é é)Ú reversednsÚserviceÚ statelessÚhandlerÚechoÚguidÚ numeric_protoÚnumeric_prioÚnumeric_symbolÚnumeric_timeÚterseNúlibnftables.so.1.1.0cCs>tj|ƒ}|j|_t|j_tg|j_|j|_t|j_tg|j_|j |_ ttg|j _|j |_ t|j _tg|j _|j|_ttg|j_|j|_t|j_tg|j_|j |_ t|j _tg|j _|j|_t|j_tg|j_|j|_t|j_tg|j_|j|_t|j_ttg|j_|j|_tg|j_|jdƒ|_|j|jƒ|j|jƒdS)alInstantiate a new Nftables class object. Accepts a shared object file to open, by default standard search path is searched for a file named 'libnftables.so'. After loading the library using ctypes module, a new nftables context is requested from the library and buffering of output and error streams is turned on. rN)ZcdllZLoadLibraryZnft_ctx_newZc_void_pZrestypeZc_intZargtypesÚnft_ctx_output_get_flagsZc_uintÚnft_ctx_output_set_flagsÚnft_ctx_output_get_debugÚnft_ctx_output_set_debugZnft_ctx_buffer_outputÚnft_ctx_get_output_bufferZc_char_pZnft_ctx_buffer_errorÚnft_ctx_get_error_bufferÚnft_run_cmd_from_bufferÚnft_ctx_freeÚ_Nftables__ctx)rZsofileÚlibrrrrCsD zNftables.__init__cCs|j|jƒdS)N)r>r?)rrrrÚ__del__szNftables.__del__cCs|j|}|j|jƒ|@S)N)Úoutput_flagsr7r?)rÚnameÚflagrrrZ__get_output_flag‚s zNftables.__get_output_flagcCsD|j|}|j|jƒ}|r$||B}n ||@}|j|j|ƒ||@S)N)rBr7r?r8)rrCÚvalrDÚflagsZ new_flagsrrrZ__set_output_flag†s zNftables.__set_output_flagcCs |jdƒS)z©Get the current state of reverse DNS output. Returns a boolean indicating whether reverse DNS lookups are performed for IP addresses in output. r+)Ú_Nftables__get_output_flag)rrrrÚget_reversedns_outputszNftables.get_reversedns_outputcCs|jd|ƒS)zŸEnable or disable reverse DNS output. Accepts a boolean turning reverse DNS lookups in output on or off. Returns the previous value. r+)Ú_Nftables__set_output_flag)rrErrrÚset_reversedns_output˜szNftables.set_reversedns_outputcCs |jdƒS)z¦Get the current state of service name output. Returns a boolean indicating whether service names are used for port numbers in output or not. r,)rG)rrrrÚget_service_output¡szNftables.get_service_outputcCs|jd|ƒS)z³Enable or disable service name output. Accepts a boolean turning service names for port numbers in output on or off. Returns the previous value. r,)rI)rrErrrÚset_service_output©szNftables.set_service_outputcCs |jdƒS)z„Get the current state of stateless output. Returns a boolean indicating whether stateless output is active or not. r-)rG)rrrrÚget_stateless_output³szNftables.get_stateless_outputcCs|jd|ƒS)z—Enable or disable stateless output. Accepts a boolean turning stateless output either on or off. Returns the previous value. r-)rI)rrErrrÚset_stateless_outputºszNftables.set_stateless_outputcCs |jdƒS)z~Get the current state of handle output. Returns a boolean indicating whether handle output is active or not. r.)rG)rrrrÚget_handle_outputÃszNftables.get_handle_outputcCs|jd|ƒS)zŠEnable or disable handle output. Accepts a boolean turning handle output on or off. Returns the previous value. r.)rI)rrErrrÚset_handle_outputÊszNftables.set_handle_outputcCs |jdƒS)zzGet the current state of JSON output. Returns a boolean indicating whether JSON output is active or not. r)rG)rrrrÚget_json_outputÓszNftables.get_json_outputcCs|jd|ƒS)zEnable or disable JSON output. Accepts a boolean turning JSON output either on or off. Returns the previous value. r)rI)rrErrrÚset_json_outputÚszNftables.set_json_outputcCs |jdƒS)zzGet the current state of echo output. Returns a boolean indicating whether echo output is active or not. r/)rG)rrrrÚget_echo_outputãszNftables.get_echo_outputcCs|jd|ƒS)z†Enable or disable echo output. Accepts a boolean turning echo output on or off. Returns the previous value. r/)rI)rrErrrÚset_echo_outputêszNftables.set_echo_outputcCs |jdƒS)z›Get the current state of GID/UID output. Returns a boolean indicating whether names for group/user IDs are used in output or not. r0)rG)rrrrÚget_guid_outputószNftables.get_guid_outputcCs|jd|ƒS)z–Enable or disable GID/UID output. Accepts a boolean turning names for group/user IDs on or off. Returns the previous value. r0)rI)rrErrrÚset_guid_outputûszNftables.set_guid_outputcCs |jdƒS)ztGet current status of numeric protocol output flag. Returns a boolean value indicating the status. r1)rG)rrrrÚget_numeric_proto_outputsz!Nftables.get_numeric_proto_outputcCs|jd|ƒS)zœSet numeric protocol output flag. Accepts a boolean turning numeric protocol output either on or off. Returns the previous value. r1)rI)rrErrrÚset_numeric_proto_outputsz!Nftables.set_numeric_proto_outputcCs |jdƒS)zzGet current status of numeric chain priority output flag. Returns a boolean value indicating the status. r2)rG)rrrrÚget_numeric_prio_outputsz Nftables.get_numeric_prio_outputcCs|jd|ƒS)z°Set numeric chain priority output flag. Accepts a boolean turning numeric chain priority output either on or off. Returns the previous value. r2)rI)rrErrrÚset_numeric_prio_outputsz Nftables.set_numeric_prio_outputcCs |jdƒS)zsGet current status of numeric symbols output flag. Returns a boolean value indicating the status. r3)rG)rrrrÚget_numeric_symbol_output%sz"Nftables.get_numeric_symbol_outputcCs|jd|ƒS)zÂSet numeric symbols output flag. Accepts a boolean turning numeric representation of symbolic constants in output either on or off. Returns the previous value. r3)rI)rrErrrÚset_numeric_symbol_output,sz"Nftables.set_numeric_symbol_outputcCs |jdƒS)zqGet current status of numeric times output flag. Returns a boolean value indicating the status. r4)rG)rrrrÚget_numeric_time_output6sz Nftables.get_numeric_time_outputcCs|jd|ƒS)z¹Set numeric times output flag. Accepts a boolean turning numeric representation of time values in output either on or off. Returns the previous value. r4)rI)rrErrrÚset_numeric_time_output=sz Nftables.set_numeric_time_outputcCs |jdƒS)z|Get the current state of terse output. Returns a boolean indicating whether terse output is active or not. r5)rG)rrrrÚget_terse_outputGszNftables.get_terse_outputcCs|jd|ƒS)zEnable or disable terse output. Accepts a boolean turning terse output either on or off. Returns the previous value. r5)rI)rrErrrÚset_terse_outputNszNftables.set_terse_outputcCsV|j|jƒ}g}x2|jjƒD]$\}}||@r|j|ƒ||M}qW|rR|j|ƒ|S)zmGet currently active debug flags. Returns a set of flag names. See set_debug() for details. )r9r?Údebug_flagsÚitemsÚappend)rrEÚnamesÚnÚvrrrÚ get_debugWs zNftables.get_debugcCs`|jƒ}t|ƒttgkr|g}d}x*|D]"}t|ƒtkrB|j|}||O}q(W|j|j|ƒ|S)aSet debug output flags. Accepts either a single flag or a set of flags. Each flag might be given either as string or integer value as shown in the following table: Name | Value (hex) ----------------------- scanner | 0x1 parser | 0x2 eval | 0x4 netlink | 0x8 mnl | 0x10 proto-ctx | 0x20 segtree | 0x40 Returns a set of previously active debug flags, as returned by get_debug() method. r)rgÚtypeÚstrÚintrar:r?)rÚvaluesÚoldrErfrrrÚ set_debughs zNftables.set_debugcCsdd}t|tƒsd}|jdƒ}|j|j|ƒ}|j|jƒ}|j|jƒ}|rZ|jdƒ}|jdƒ}|||fS)aÁRun a simple nftables command via libnftables. Accepts a string containing an nftables command just like what one would enter into an interactive nftables (nft -i) session. Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_buffer() fuction output -- a string containing output written to stdout error -- a string containing output written to stderr FTzutf-8)Ú isinstanceÚbytesÚencoder=r?r;r<Údecode)rZcmdlineZcmdline_is_unicodeÚrcÚoutputÚerrorrrrÚcmd‹s zNftables.cmdcCsJ|jdƒ}|jtj|ƒƒ\}}}|s.|j|ƒt|ƒr@tj|ƒ}|||fS)aiRun an nftables command in JSON syntax via libnftables. Accepts a hash object as input. Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_buffer() function output -- a hash object containing library standard output error -- a string containing output written to stderr T)rRrurÚdumpsÚlenÚloads)rÚ json_rootZjson_out_oldrrrsrtrrrÚjson_cmd£s zNftables.json_cmdcCs|jstƒ|_|jj|ƒdS)z©Validate JSON object against libnftables schema. Accepts a hash object as input. Returns True if JSON is valid, raises an exception otherwise. T)Ú validatorrr)rryrrrÚ json_validateµszNftables.json_validaterrrrrrr é€éiii)r6)(rrrrrarBr{rrArGrIrHrJrKrLrMrNrOrPrQrRrSrTrUrVrWrXrYrZr[r\r]r^r_r`rgrmrurzr|rrrrr%sl < #r)rZctypesÚsysrZNFTABLES_VERSIONrrrrrrÚs