✏️ 编辑：nftables.cpython-39.pyc
路径：
/usr/lib/python3.9/site-packages/nftables/__pycache__/nftables.cpython-39.pyc
大小：17.5 KB · 修改：2026-08-26 12:09:24 · 权限：0644 · 只读（保存会失败）
← 返回目录
👁 查看
⬇ 下载
检测到二进制内容，直接保存可能损坏文件。请改用「上传替换」。
a tjAN � @ sD d dl Z d dlT d dlZd dlZdZG dd� d�ZG dd� d�ZdS )� N)�*z0.1c @ s e Zd ZdZdd� Zdd� ZdS )�SchemaValidatorz+Libnftables JSON validator using jsonschemac C s^ t j�t j�t�d�}t|d�� }t�|�| _W d � n1 sB0 Y dd l }|| _ d S )Nz schema.json�rr ) �os�path�join�dirname�__file__�open�json�load�schema� jsonschema)�selfZ schema_pathZ schema_filer � r �5/usr/lib/python3.9/site-packages/nftables/nftables.py�__init__ s *zSchemaValidator.__init__c C s | j j|| jd� d S )N)�instancer )r �validater )r r r r r r " s zSchemaValidator.validateN)�__name__� __module__� __qualname__�__doc__r r r r r r r s r c @ s� e Zd ZdZddd�Zddddddd d �Zddddddd d d d ddd� ZdZdkdd�Zdd� Z dd� Z dd� Z dd � Z d d � Z d d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Zd+d,� Zd-d.� Zd/d0� Zd1d2� Zd3d4� Zd5d6� Zd7d8� Zd9d:� Zd;d<� Z d=d>� Z d?d@� Z dAdB� Z dCdD� Z dEdF� Z!dGdH� Z"dIdJ� Z#dKdL� Z$dMdN� Z%dOdP� Z&dQdR� Z'dSdT� Z(dUdV� Z)dWdX� Z*dYdZ� Z+d[d\� Z,d]d^� Z-d_d`� Z.dadb� Z/dcdd� Z0dedf� Z1dgdh� Z2didj� Z3dS )l�Nftablesz*A class representing libnftables interface� � )zno-dnsr � � � � �@ )�scanner�parser�evalZnetlinkZmnlz proto-ctxZsegtree� � i i i ) � reversedns�service� stateless�handler �echo�guid� numeric_proto� numeric_prio�numeric_symbol� numeric_time�terseN�libnftables.so.1c C s d| _ t�|�}|j| _t| j_tg| j_|j| _t | j_tg| j_|j | _ t | j _tt g| j _|j | _ t | j _tg| j _|j | _ tt g| j _|j | _ t| j _tg| j _|j| _ttg| j_|j| _t| j_tg| j_|j| _t| j_tg| j_|j| _t| j_tg| j_|j| _t| j_tg| j_|j| _t| j_ttg| j_|j| _t| j_ttg| j_|j| _t| j_ttg| j_|j| _tg| j_|j| _t| j_tg| j_|j| _ttg| j_|j| _t| j_ttg| j_|j | _ tg| j _|j | _ tg|j _| �d�| _ | �| j � | �| j � dS )al Instantiate a new Nftables class object. Accepts a shared object file to open, by default standard search path is searched for a file named 'libnftables.so'. After loading the library using ctypes module, a new nftables context is requested from the library and buffering of output and error streams is turned on. Nr ) �_Nftables__ctxZcdllZ LoadLibraryZ nft_ctx_newZc_void_pZrestypeZc_int�argtypes�nft_ctx_input_get_flagsZc_uint�nft_ctx_input_set_flags�nft_ctx_output_get_flags�nft_ctx_output_set_flags�nft_ctx_output_get_debug�nft_ctx_output_set_debugZnft_ctx_buffer_output�nft_ctx_get_output_bufferZc_char_pZnft_ctx_buffer_error�nft_ctx_get_error_buffer�nft_run_cmd_from_buffer�nft_run_cmd_from_filename�nft_ctx_add_include_path�nft_ctx_clear_include_paths�nft_ctx_get_dry_runZc_bool�nft_ctx_set_dry_run�nft_ctx_add_var�nft_ctx_clear_vars� nft_ctx_free)r Zsofile�libr r r r H sv zNftables.__init__c C s | j d ur | �| j � d | _ d S �N)r2 rD �r r r r �__del__� s zNftables.__del__c C sD g }|� � D ]$\}}||@ r |�|� || M }q |r@|�|� |S rF )�items�append)r � flags_dict�val�names�n�vr r r �_flags_from_numeric� s z Nftables._flags_from_numericc C s� t |ttf�r|f}d}|D ]^}t |t�rF|�|�}|d u rrtd��n,t |t�rj|dk s`|dkrrtd��ntd��||O }q |S )Nr zInvalid argumentl �� zNot a valid flag)� isinstance�str�int�get� ValueError� TypeError)r rK �valuesrL rO r r r �_flags_to_numeric� s zNftables._flags_to_numericc C s | � | j�}| �| j|�S )zsGet currently active input flags. Returns a set of flag names. See set_input_flags() for details. )r4 r2 rP � input_flags�r rL r r r �get_input_flags� s zNftables.get_input_flagsc C s* | � | j|�}| �| j|�}| �| j|�S )a Set input flags. Resets all input flags to values. Accepts either a single flag or a list of flags. Each flag might be given either as string or integer value as shown in the following table: Name | Value (hex) ----------------------- "no-dns" | 0x1 "json" | 0x2 "no-dns" disables blocking address lookup. "json" enables JSON mode for input. Returns a set of previously active input flags, as returned by get_input_flags() method. )rX rY r5 r2 rP �r rW rL �oldr r r �set_input_flags� s zNftables.set_input_flagsc C s | j | }| �| j�|@ dkS �Nr )� output_flagsr6 r2 )r �name�flagr r r Z__get_output_flag� s zNftables.__get_output_flagc C sH | j | }| �| j�}|r$||B }n || @ }| �| j|� ||@ dkS r_ )r` r6 r2 r7 )r ra rL rb �flagsZ new_flagsr r r Z__set_output_flag� s zNftables.__set_output_flagc C s | � d�S )z�Get the current state of reverse DNS output. Returns a boolean indicating whether reverse DNS lookups are performed for IP addresses in output. r& ��_Nftables__get_output_flagrG r r r �get_reversedns_output� s z Nftables.get_reversedns_outputc C s | � d|�S )z�Enable or disable reverse DNS output. Accepts a boolean turning reverse DNS lookups in output on or off. Returns the previous value. r& ��_Nftables__set_output_flagrZ r r r �set_reversedns_output� s z Nftables.set_reversedns_outputc C s | � d�S )z�Get the current state of service name output. Returns a boolean indicating whether service names are used for port numbers in output or not. r' rd rG r r r �get_service_output s zNftables.get_service_outputc C s | � d|�S )z�Enable or disable service name output. Accepts a boolean turning service names for port numbers in output on or off. Returns the previous value. r' rg rZ r r r �set_service_output s zNftables.set_service_outputc C s | � d�S )z�Get the current state of stateless output. Returns a boolean indicating whether stateless output is active or not. r( rd rG r r r �get_stateless_output s z Nftables.get_stateless_outputc C s | � d|�S )z�Enable or disable stateless output. Accepts a boolean turning stateless output either on or off. Returns the previous value. r( rg rZ r r r �set_stateless_output s z Nftables.set_stateless_outputc C s | � d�S )z~Get the current state of handle output. Returns a boolean indicating whether handle output is active or not. r) rd rG r r r �get_handle_output( s zNftables.get_handle_outputc C s | � d|�S )z�Enable or disable handle output. Accepts a boolean turning handle output on or off. Returns the previous value. r) rg rZ r r r �set_handle_output/ s zNftables.set_handle_outputc C s | � d�S )zzGet the current state of JSON output. Returns a boolean indicating whether JSON output is active or not. r rd rG r r r �get_json_output8 s zNftables.get_json_outputc C s | � d|�S )z�Enable or disable JSON output. Accepts a boolean turning JSON output either on or off. Returns the previous value. r rg rZ r r r �set_json_output? s zNftables.set_json_outputc C s | � d�S )zzGet the current state of echo output. Returns a boolean indicating whether echo output is active or not. r* rd rG r r r �get_echo_outputH s zNftables.get_echo_outputc C s | � d|�S )z�Enable or disable echo output. Accepts a boolean turning echo output on or off. Returns the previous value. r* rg rZ r r r �set_echo_outputO s zNftables.set_echo_outputc C s | � d�S )z�Get the current state of GID/UID output. Returns a boolean indicating whether names for group/user IDs are used in output or not. r+ rd rG r r r �get_guid_outputX s zNftables.get_guid_outputc C s | � d|�S )z�Enable or disable GID/UID output. Accepts a boolean turning names for group/user IDs on or off. Returns the previous value. r+ rg rZ r r r �set_guid_output` s zNftables.set_guid_outputc C s | � d�S )ztGet current status of numeric protocol output flag. Returns a boolean value indicating the status. r, rd rG r r r �get_numeric_proto_outputi s z!Nftables.get_numeric_proto_outputc C s | � d|�S )z�Set numeric protocol output flag. Accepts a boolean turning numeric protocol output either on or off. Returns the previous value. r, rg rZ r r r �set_numeric_proto_outputp s z!Nftables.set_numeric_proto_outputc C s | � d�S )zzGet current status of numeric chain priority output flag. Returns a boolean value indicating the status. r- rd rG r r r �get_numeric_prio_outputy s z Nftables.get_numeric_prio_outputc C s | � d|�S )z�Set numeric chain priority output flag. Accepts a boolean turning numeric chain priority output either on or off. Returns the previous value. r- rg rZ r r r �set_numeric_prio_output� s z Nftables.set_numeric_prio_outputc C s | � d�S )zsGet current status of numeric symbols output flag. Returns a boolean value indicating the status. r. rd rG r r r �get_numeric_symbol_output� s z"Nftables.get_numeric_symbol_outputc C s | � d|�S )z�Set numeric symbols output flag. Accepts a boolean turning numeric representation of symbolic constants in output either on or off. Returns the previous value. r. rg rZ r r r �set_numeric_symbol_output� s z"Nftables.set_numeric_symbol_outputc C s | � d�S )zqGet current status of numeric times output flag. Returns a boolean value indicating the status. r/ rd rG r r r �get_numeric_time_output� s z Nftables.get_numeric_time_outputc C s | � d|�S )z�Set numeric times output flag. Accepts a boolean turning numeric representation of time values in output either on or off. Returns the previous value. r/ rg rZ r r r �set_numeric_time_output� s z Nftables.set_numeric_time_outputc C s | � d�S )z|Get the current state of terse output. Returns a boolean indicating whether terse output is active or not. r0 rd rG r r r �get_terse_output� s zNftables.get_terse_outputc C s | � d|�S )z�Enable or disable terse output. Accepts a boolean turning terse output either on or off. Returns the previous value. r0 rg rZ r r r �set_terse_output� s zNftables.set_terse_outputc C s | � | j�}| �| j|�S )zmGet currently active debug flags. Returns a set of flag names. See set_debug() for details. )r8 r2 rP � debug_flagsrZ r r r � get_debug� s zNftables.get_debugc C s( | � | j|�}| �� }| �| j|� |S )a Set debug output flags. Accepts either a single flag or a set of flags. Each flag might be given either as string or integer value as shown in the following table: Name | Value (hex) ----------------------- scanner | 0x1 parser | 0x2 eval | 0x4 netlink | 0x8 mnl | 0x10 proto-ctx | 0x20 segtree | 0x40 Returns a set of previously active debug flags, as returned by get_debug() method. )rX r� r� r9 r2 r\ r r r � set_debug� s zNftables.set_debugc C sd d}t |t�s d}|�d�}| �| j|�}| �| j�}| �| j�}|rZ|�d�}|�d�}|||fS )a� Run a simple nftables command via libnftables. Accepts a string containing an nftables command just like what one would enter into an interactive nftables (nft -i) session. Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_buffer() fuction output -- a string containing output written to stdout error -- a string containing output written to stderr FT�utf-8)rQ �bytes�encoder< r2 r: r; �decode)r ZcmdlineZcmdline_is_unicode�rc�output�errorr r r �cmd� s z Nftables.cmdc C sJ | � d�}| �t�|��\}}}|s.| � |� t|�r@t�|�}|||fS )ai Run an nftables command in JSON syntax via libnftables. Accepts a hash object as input. Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_buffer() function output -- a hash object containing library standard output error -- a string containing output written to stderr T)rq r� r �dumps�len�loads)r � json_rootZ json_out_oldr� r� r� r r r �json_cmd� s zNftables.json_cmdc C s | j st� | _ | j �|� dS )z�Validate JSON object against libnftables schema. Accepts a hash object as input. Returns True if JSON is valid, raises an exception otherwise. T)� validatorr r )r r� r r r � json_validate s zNftables.json_validatec C sl d}t |t�s$d}t|�}|�d�}| �| j|�}| �| j�}| �| j�}|rb|�d�}|�d�}|||fS )aV Run a nftables command set from a file filename can be a str or a Path Returns a tuple (rc, output, error): rc -- return code as returned by nft_run_cmd_from_filename() function output -- a string containing output written to stdout error -- a string containing output written to stderr FTr� ) rQ r� rR r� r= r2 r: r; r� )r �filenameZfilename_is_unicoder� r� r� r r r � cmd_from_file s zNftables.cmd_from_filec C s2 t |t�s t|�}|�d�}| �| j|�}|dkS )z�Add a path to the include file list The default list includes the built-in default one Returns True on success, False if memory allocation fails r� r )rQ r� rR r� r> r2 )r r� r� r r r �add_include_path+ s zNftables.add_include_pathc C s | � | j� dS )zSClear include path list Will also remove the built-in default one N)r? r2 rG r r r �clear_include_paths7 s z Nftables.clear_include_pathsc C s | � | j�S )zHGet dry run state Returns True if set, False otherwise )r@ r2 rG r r r � get_dry_run> s zNftables.get_dry_runc C s | � � }| �| j|� |S )zG Set dry run state Returns the previous dry run state )r� rA r2 )r Zonoffr] r r r � set_dry_runE s zNftables.set_dry_runc C s* t |t�s|�d�}| �| j|�}|dkS )z\Add a variable to the variable list Returns True if added, False otherwise r� r )rQ r� r� rB r2 )r �varr� r r r �add_varO s zNftables.add_varc C s | � | j� dS )z Clear variable list N)rC r2 rG r r r � clear_varsY s zNftables.clear_vars)r1 )4r r r r rY r� r` r� r rH rP rX r[ r^ re rh rf ri rj rk rl rm rn ro rp rq rr rs rt ru rv rw rx ry rz r{ r| r} r~ r r� r� r� r� r� r� r� r� r� r� r� r� r r r r r % s� �� � _ r )r Zctypes�sysr ZNFTABLES_VERSIONr r r r r r �<module> s
💾 保存
取消
保存为 UTF-8，换行统一为 LF