a t׎jAN@sDddlZddlTddlZddlZdZGdddZGdddZdS)N)*z0.1c@s eZdZdZddZddZdS)SchemaValidatorz+Libnftables JSON validator using jsonschemacCs^tjtjtd}t|d}t||_Wdn1sB0Yddl }||_ dS)Nz schema.jsonrr) ospathjoindirname__file__openjsonloadschema jsonschema)selfZ schema_pathZ schema_filerr5/usr/lib/python3.9/site-packages/nftables/nftables.py__init__s  *zSchemaValidator.__init__cCs|jj||jddS)N)instancer )rvalidater )rr rrrr"szSchemaValidator.validateN)__name__ __module__ __qualname____doc__rrrrrrrsrc @seZdZdZdddZddddddd d Zddddddd d d d ddd ZdZdkddZddZ ddZ ddZ ddZ ddZ dd Zd!d"Zd#d$Zd%d&Zd'd(Zd)d*Zd+d,Zd-d.Zd/d0Zd1d2Zd3d4Zd5d6Zd7d8Zd9d:Zd;d<Zd=d>Zd?d@ZdAdBZdCdDZ dEdFZ!dGdHZ"dIdJZ#dKdLZ$dMdNZ%dOdPZ&dQdRZ'dSdTZ(dUdVZ)dWdXZ*dYdZZ+d[d\Z,d]d^Z-d_d`Z.dadbZ/dcddZ0dedfZ1dgdhZ2didjZ3dS)lNftablesz*A class representing libnftables interface)zno-dnsr  @)scannerparserevalZnetlinkZmnlz proto-ctxZsegtreeiii) reversednsservice statelesshandler echoguid numeric_proto numeric_prionumeric_symbol numeric_timeterseNlibnftables.so.1cCs d|_t|}|j|_t|j_tg|j_|j|_t |j_tg|j_|j |_ t |j _tt g|j _|j |_ t |j _tg|j _|j |_ tt g|j _|j |_ t|j _tg|j _|j|_ttg|j_|j|_t|j_tg|j_|j|_t|j_tg|j_|j|_t|j_tg|j_|j|_t|j_tg|j_|j|_t|j_ttg|j_|j|_t|j_ttg|j_|j|_t|j_ttg|j_|j|_tg|j_|j|_t|j_tg|j_|j|_ttg|j_|j|_t|j_ttg|j_|j|_tg|j_|j|_tg|j_|d|_||j||jdS)alInstantiate a new Nftables class object. Accepts a shared object file to open, by default standard search path is searched for a file named 'libnftables.so'. After loading the library using ctypes module, a new nftables context is requested from the library and buffering of output and error streams is turned on. Nr)_Nftables__ctxZcdllZ LoadLibraryZ nft_ctx_newZc_void_pZrestypeZc_intargtypesnft_ctx_input_get_flagsZc_uintnft_ctx_input_set_flagsnft_ctx_output_get_flagsnft_ctx_output_set_flagsnft_ctx_output_get_debugnft_ctx_output_set_debugZnft_ctx_buffer_outputnft_ctx_get_output_bufferZc_char_pZnft_ctx_buffer_errornft_ctx_get_error_buffernft_run_cmd_from_buffernft_run_cmd_from_filenamenft_ctx_add_include_pathnft_ctx_clear_include_pathsnft_ctx_get_dry_runZc_boolnft_ctx_set_dry_runnft_ctx_add_varnft_ctx_clear_vars nft_ctx_free)rZsofilelibrrrrHsv                        zNftables.__init__cCs |jdur||jd|_dSN)r2rDrrrr__del__s  zNftables.__del__cCsDg}|D]$\}}||@r ||||M}q |r@|||SrF)itemsappend)r flags_dictvalnamesnvrrr_flags_from_numerics   zNftables._flags_from_numericcCst|ttfr|f}d}|D]^}t|trF||}|durrtdn,t|trj|dks`|dkrrtdntd||O}q|S)NrzInvalid argumentlzNot a valid flag) isinstancestrintget ValueError TypeError)rrKvaluesrLrOrrr_flags_to_numerics      zNftables._flags_to_numericcCs||j}||j|S)zsGet currently active input flags. Returns a set of flag names. See set_input_flags() for details. )r4r2rP input_flagsrrLrrrget_input_flagss zNftables.get_input_flagscCs*||j|}||j|}||j|S)aSet input flags. Resets all input flags to values. Accepts either a single flag or a list of flags. Each flag might be given either as string or integer value as shown in the following table: Name | Value (hex) ----------------------- "no-dns" | 0x1 "json" | 0x2 "no-dns" disables blocking address lookup. "json" enables JSON mode for input. Returns a set of previously active input flags, as returned by get_input_flags() method. )rXrYr5r2rPrrWrLoldrrrset_input_flagsszNftables.set_input_flagscCs|j|}||j|@dkSNr) output_flagsr6r2)rnameflagrrrZ__get_output_flags zNftables.__get_output_flagcCsH|j|}||j}|r$||B}n ||@}||j|||@dkSr_)r`r6r2r7)rrarLrbflagsZ new_flagsrrrZ__set_output_flags    zNftables.__set_output_flagcCs |dS)zGet the current state of reverse DNS output. Returns a boolean indicating whether reverse DNS lookups are performed for IP addresses in output. r&_Nftables__get_output_flagrGrrrget_reversedns_outputszNftables.get_reversedns_outputcCs |d|S)zEnable or disable reverse DNS output. Accepts a boolean turning reverse DNS lookups in output on or off. Returns the previous value. r&_Nftables__set_output_flagrZrrrset_reversedns_outputszNftables.set_reversedns_outputcCs |dS)zGet the current state of service name output. Returns a boolean indicating whether service names are used for port numbers in output or not. r'rdrGrrrget_service_outputszNftables.get_service_outputcCs |d|S)zEnable or disable service name output. Accepts a boolean turning service names for port numbers in output on or off. Returns the previous value. r'rgrZrrrset_service_outputszNftables.set_service_outputcCs |dS)zGet the current state of stateless output. Returns a boolean indicating whether stateless output is active or not. r(rdrGrrrget_stateless_outputszNftables.get_stateless_outputcCs |d|S)zEnable or disable stateless output. Accepts a boolean turning stateless output either on or off. Returns the previous value. r(rgrZrrrset_stateless_outputszNftables.set_stateless_outputcCs |dS)z~Get the current state of handle output. Returns a boolean indicating whether handle output is active or not. r)rdrGrrrget_handle_output(szNftables.get_handle_outputcCs |d|S)zEnable or disable handle output. Accepts a boolean turning handle output on or off. Returns the previous value. r)rgrZrrrset_handle_output/szNftables.set_handle_outputcCs |dS)zzGet the current state of JSON output. Returns a boolean indicating whether JSON output is active or not. r rdrGrrrget_json_output8szNftables.get_json_outputcCs |d|S)zEnable or disable JSON output. Accepts a boolean turning JSON output either on or off. Returns the previous value. r rgrZrrrset_json_output?szNftables.set_json_outputcCs |dS)zzGet the current state of echo output. Returns a boolean indicating whether echo output is active or not. r*rdrGrrrget_echo_outputHszNftables.get_echo_outputcCs |d|S)zEnable or disable echo output. Accepts a boolean turning echo output on or off. Returns the previous value. r*rgrZrrrset_echo_outputOszNftables.set_echo_outputcCs |dS)zGet the current state of GID/UID output. Returns a boolean indicating whether names for group/user IDs are used in output or not. r+rdrGrrrget_guid_outputXszNftables.get_guid_outputcCs |d|S)zEnable or disable GID/UID output. Accepts a boolean turning names for group/user IDs on or off. Returns the previous value. r+rgrZrrrset_guid_output`szNftables.set_guid_outputcCs |dS)ztGet current status of numeric protocol output flag. Returns a boolean value indicating the status. r,rdrGrrrget_numeric_proto_outputisz!Nftables.get_numeric_proto_outputcCs |d|S)zSet numeric protocol output flag. Accepts a boolean turning numeric protocol output either on or off. Returns the previous value. r,rgrZrrrset_numeric_proto_outputpsz!Nftables.set_numeric_proto_outputcCs |dS)zzGet current status of numeric chain priority output flag. Returns a boolean value indicating the status. r-rdrGrrrget_numeric_prio_outputysz Nftables.get_numeric_prio_outputcCs |d|S)zSet numeric chain priority output flag. Accepts a boolean turning numeric chain priority output either on or off. Returns the previous value. r-rgrZrrrset_numeric_prio_outputsz Nftables.set_numeric_prio_outputcCs |dS)zsGet current status of numeric symbols output flag. Returns a boolean value indicating the status. r.rdrGrrrget_numeric_symbol_outputsz"Nftables.get_numeric_symbol_outputcCs |d|S)zSet numeric symbols output flag. Accepts a boolean turning numeric representation of symbolic constants in output either on or off. Returns the previous value. r.rgrZrrrset_numeric_symbol_outputsz"Nftables.set_numeric_symbol_outputcCs |dS)zqGet current status of numeric times output flag. Returns a boolean value indicating the status. r/rdrGrrrget_numeric_time_outputsz Nftables.get_numeric_time_outputcCs |d|S)zSet numeric times output flag. Accepts a boolean turning numeric representation of time values in output either on or off. Returns the previous value. r/rgrZrrrset_numeric_time_outputsz Nftables.set_numeric_time_outputcCs |dS)z|Get the current state of terse output. Returns a boolean indicating whether terse output is active or not. r0rdrGrrrget_terse_outputszNftables.get_terse_outputcCs |d|S)zEnable or disable terse output. Accepts a boolean turning terse output either on or off. Returns the previous value. r0rgrZrrrset_terse_outputszNftables.set_terse_outputcCs||j}||j|S)zmGet currently active debug flags. Returns a set of flag names. See set_debug() for details. )r8r2rP debug_flagsrZrrr get_debugs zNftables.get_debugcCs(||j|}|}||j||S)aSet debug output flags. Accepts either a single flag or a set of flags. Each flag might be given either as string or integer value as shown in the following table: Name | Value (hex) ----------------------- scanner | 0x1 parser | 0x2 eval | 0x4 netlink | 0x8 mnl | 0x10 proto-ctx | 0x20 segtree | 0x40 Returns a set of previously active debug flags, as returned by get_debug() method. )rXrrr9r2r\rrr set_debugszNftables.set_debugcCsdd}t|tsd}|d}||j|}||j}||j}|rZ|d}|d}|||fS)aRun a simple nftables command via libnftables. Accepts a string containing an nftables command just like what one would enter into an interactive nftables (nft -i) session. Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_buffer() fuction output -- a string containing output written to stdout error -- a string containing output written to stderr FTutf-8)rQbytesencoder<r2r:r;decode)rZcmdlineZcmdline_is_unicodercoutputerrorrrrcmds       z Nftables.cmdcCsJ|d}|t|\}}}|s.||t|r@t|}|||fS)aiRun an nftables command in JSON syntax via libnftables. Accepts a hash object as input. Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_buffer() function output -- a hash object containing library standard output error -- a string containing output written to stderr T)rqrr dumpslenloads)r json_rootZ json_out_oldrrrrrrjson_cmds   zNftables.json_cmdcCs|jst|_|j|dS)zValidate JSON object against libnftables schema. Accepts a hash object as input. Returns True if JSON is valid, raises an exception otherwise. T) validatorrr)rrrrr json_validates zNftables.json_validatecCsld}t|ts$d}t|}|d}||j|}||j}||j}|rb|d}|d}|||fS)aVRun a nftables command set from a file filename can be a str or a Path Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_filename() function output -- a string containing output written to stdout error -- a string containing output written to stderr FTr) rQrrRrr=r2r:r;r)rfilenameZfilename_is_unicoderrrrrr cmd_from_files       zNftables.cmd_from_filecCs2t|tst|}|d}||j|}|dkS)zAdd a path to the include file list The default list includes the built-in default one Returns True on success, False if memory allocation fails rr)rQrrRrr>r2)rrrrrradd_include_path+s   zNftables.add_include_pathcCs||jdS)zSClear include path list Will also remove the built-in default one N)r?r2rGrrrclear_include_paths7szNftables.clear_include_pathscCs ||jS)zHGet dry run state Returns True if set, False otherwise )r@r2rGrrr get_dry_run>szNftables.get_dry_runcCs|}||j||S)zG Set dry run state Returns the previous dry run state )rrAr2)rZonoffr]rrr set_dry_runEszNftables.set_dry_runcCs*t|ts|d}||j|}|dkS)z\Add a variable to the variable list Returns True if added, False otherwise rr)rQrrrBr2)rvarrrrradd_varOs  zNftables.add_varcCs||jdS)zClear variable list N)rCr2rGrrr clear_varsYszNftables.clear_vars)r1)4rrrrrYrr`rrrHrPrXr[r^rerhrfrirjrkrlrmrnrorprqrrrsrtrurvrwrxryrzr{r|r}r~rrrrrrrrrrrrrrrrrr%s  _                  r)r ZctypessysrZNFTABLES_VERSIONrrrrrrs