<,�tEXtComment File Manager

File Manager

Path: /opt/alt/python311/lib/python3.11/site-packages/pyroute2/

Viewing File: ipset.py

'''
ipset support.

This module is tested with hash:ip, hash:net, list:set and several
other ipset structures (like hash:net,iface). There is no guarantee
that this module is working with all available ipset modules.

It supports almost all kernel commands (create, destroy, flush,
rename, swap, test...)
'''

import errno
import socket

from pyroute2.common import basestring
from pyroute2.netlink import (
    NETLINK_NETFILTER,
    NLM_F_ACK,
    NLM_F_DUMP,
    NLM_F_EXCL,
    NLM_F_REQUEST,
    NLMSG_ERROR,
)
from pyroute2.netlink.exceptions import IPSetError
from pyroute2.netlink.nfnetlink import NFNL_SUBSYS_IPSET
from pyroute2.netlink.nfnetlink.ipset import (
    IPSET_CMD_ADD,
    IPSET_CMD_CREATE,
    IPSET_CMD_DEL,
    IPSET_CMD_DESTROY,
    IPSET_CMD_FLUSH,
    IPSET_CMD_GET_BYINDEX,
    IPSET_CMD_GET_BYNAME,
    IPSET_CMD_HEADER,
    IPSET_CMD_LIST,
    IPSET_CMD_PROTOCOL,
    IPSET_CMD_RENAME,
    IPSET_CMD_SWAP,
    IPSET_CMD_TEST,
    IPSET_CMD_TYPE,
    IPSET_ERR_BUSY,
    IPSET_ERR_COMMENT,
    IPSET_ERR_COUNTER,
    IPSET_ERR_EXIST,
    IPSET_ERR_EXIST_SETNAME2,
    IPSET_ERR_FIND_TYPE,
    IPSET_ERR_INVALID_CIDR,
    IPSET_ERR_INVALID_FAMILY,
    IPSET_ERR_INVALID_MARKMASK,
    IPSET_ERR_INVALID_NETMASK,
    IPSET_ERR_IPADDR_IPV4,
    IPSET_ERR_IPADDR_IPV6,
    IPSET_ERR_MAX_SETS,
    IPSET_ERR_PROTOCOL,
    IPSET_ERR_REFERENCED,
    IPSET_ERR_SKBINFO,
    IPSET_ERR_TIMEOUT,
    IPSET_ERR_TYPE_MISMATCH,
    IPSET_FLAG_IFACE_WILDCARD,
    IPSET_FLAG_PHYSDEV,
    IPSET_FLAG_WITH_COMMENT,
    IPSET_FLAG_WITH_COUNTERS,
    IPSET_FLAG_WITH_FORCEADD,
    IPSET_FLAG_WITH_SKBINFO,
    ipset_msg,
)
from pyroute2.netlink.nlsocket import AsyncNetlinkSocket, NetlinkSocket


def _nlmsg_error(msg):
    return msg['header']['type'] == NLMSG_ERROR


def exception_factory(err, msg):
    cls = _IPSetError
    if err.code == errno.ENOENT:
        cls = NoSuchObject
    elif err.code == errno.EEXIST:
        cls = AlreadyExists
    # See nfnl_msg_type in kernel
    # static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
    # {
    #     return subsys << 8 | msg_type;
    # }
    ipset_cmd = msg.orig_type ^ (NFNL_SUBSYS_IPSET << 8)
    return cls(err.code, cmd=ipset_cmd)


class PortRange(object):
    """A simple container for port range with optional protocol

    Note that optional protocol parameter is not supported by all
    kernel ipset modules using ports. On the other hand, it's sometimes
    mandatory to set it (like for hash:net,port ipsets)

    Example::

        udp_proto = socket.getprotobyname("udp")
        port_range = PortRange(1000, 2000, protocol=udp_proto)
        ipset.create("foo", stype="hash:net,port")
        ipset.add("foo", ("192.0.2.0/24", port_range), etype="net,port")
        ipset.test("foo", ("192.0.2.0/24", port_range), etype="net,port")
    """

    def __init__(self, begin, end, protocol=None):
        self.begin = begin
        self.end = end
        self.protocol = protocol


class PortEntry(object):
    """A simple container for port entry with optional protocol"""

    def __init__(self, port, protocol=None):
        self.port = port
        self.protocol = protocol


class AsyncIPSet(AsyncNetlinkSocket):
    '''
    NFNetlink socket (family=NETLINK_NETFILTER).

    Implements API to the ipset functionality.
    '''

    policy = {
        IPSET_CMD_PROTOCOL: ipset_msg,
        IPSET_CMD_LIST: ipset_msg,
        IPSET_CMD_TYPE: ipset_msg,
        IPSET_CMD_HEADER: ipset_msg,
        IPSET_CMD_GET_BYNAME: ipset_msg,
        IPSET_CMD_GET_BYINDEX: ipset_msg,
    }

    attr_map = {
        'iface': 'IPSET_ATTR_IFACE',
        'mark': 'IPSET_ATTR_MARK',
        'set': 'IPSET_ATTR_NAME',
        'mac': 'IPSET_ATTR_ETHER',
        'port': 'IPSET_ATTR_PORT',
        ('ip_from', 1): 'IPSET_ATTR_IP_FROM',
        ('ip_from', 2): 'IPSET_ATTR_IP2',
        ('cidr', 1): 'IPSET_ATTR_CIDR',
        ('cidr', 2): 'IPSET_ATTR_CIDR2',
        ('ip_to', 1): 'IPSET_ATTR_IP_TO',
        ('ip_to', 2): 'IPSET_ATTR_IP2_TO',
    }

    def __init__(self, version=None, attr_revision=None, nfgen_family=2):
        super().__init__(family=NETLINK_NETFILTER)
        policy = dict(
            [
                (x | (NFNL_SUBSYS_IPSET << 8), y)
                for (x, y) in self.policy.items()
            ]
        )
        self._proto_version = version
        self._attr_revision = attr_revision
        self._nfgen_family = nfgen_family
        self.register_policy(policy)

    async def setup_endpoint(self):
        if getattr(self.local, 'transport', None) is not None:
            return
        await super().setup_endpoint()
        msg = await self.get_proto_version()
        self._proto_version = msg[0].get_attr('IPSET_ATTR_PROTOCOL')

    async def __aenter__(self):
        await super().__aenter__()
        await self.setup_endpoint()
        return self

    async def request_iter(
        self,
        msg,
        msg_type,
        msg_flags=NLM_F_REQUEST | NLM_F_DUMP,
        terminate=None,
    ):
        msg['nfgen_family'] = self._nfgen_family
        async for response in await self.nlm_request(
            msg,
            msg_type | (NFNL_SUBSYS_IPSET << 8),
            msg_flags,
            terminate=terminate,
            exception_factory=exception_factory,
        ):
            yield response

    async def request(
        self,
        msg,
        msg_type,
        msg_flags=NLM_F_REQUEST | NLM_F_DUMP,
        terminate=None,
    ):
        return tuple(
            [
                x
                async for x in self.request_iter(
                    msg, msg_type, msg_flags, terminate
                )
            ]
        )

    async def headers(self, name, **kwargs):
        '''
        Get headers of the named ipset. It can be used to test if one ipset
        exists, since it returns a no such file or directory.
        '''
        return await self._list_or_headers(
            IPSET_CMD_HEADER, name=name, **kwargs
        )

    async def get_proto_version(self, version=6):
        '''
        Get supported protocol version by kernel.

        version parameter allow to set mandatory (but unused?)
        IPSET_ATTR_PROTOCOL netlink attribute in the request.
        '''
        msg = ipset_msg()
        msg['attrs'] = [['IPSET_ATTR_PROTOCOL', version]]
        return await self.request(msg, IPSET_CMD_PROTOCOL)

    async def list(self, *argv, **kwargs):
        '''
        List installed ipsets. If `name` is provided, list
        the named ipset or return an empty list.

        Be warned: netlink does not return an error if given name does not
        exit, you will receive an empty list.
        '''
        if argv:
            kwargs['name'] = argv[0]
        return await self._list_or_headers(IPSET_CMD_LIST, **kwargs)

    async def _list_or_headers(self, cmd, name=None, flags=None):
        msg = ipset_msg()
        msg['attrs'] = [['IPSET_ATTR_PROTOCOL', self._proto_version]]
        if name is not None:
            msg['attrs'].append(['IPSET_ATTR_SETNAME', name])
        if flags is not None:
            msg['attrs'].append(['IPSET_ATTR_FLAGS', flags])
        return self.request_iter(msg, cmd)

    async def destroy(self, name=None):
        '''
        Destroy one (when name is set) or all ipset (when name is None)
        '''
        msg = ipset_msg()
        msg['attrs'] = [['IPSET_ATTR_PROTOCOL', self._proto_version]]
        if name is not None:
            msg['attrs'].append(['IPSET_ATTR_SETNAME', name])
        return await self.request(
            msg,
            IPSET_CMD_DESTROY,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK | NLM_F_EXCL,
            terminate=_nlmsg_error,
        )

    async def create(
        self,
        name,
        stype='hash:ip',
        family=socket.AF_INET,
        exclusive=True,
        counters=False,
        comment=False,
        maxelem=None,
        forceadd=False,
        hashsize=None,
        timeout=None,
        bitmap_ports_range=None,
        size=None,
        skbinfo=False,
    ):
        '''
        Create an ipset `name` of type `stype`, by default
        `hash:ip`.

        Common ipset options are supported:

        * exclusive -- if set, raise an error if the ipset exists
        * counters -- enable data/packets counters
        * comment -- enable comments capability
        * maxelem -- max size of the ipset
        * forceadd -- you should refer to the ipset manpage
        * hashsize -- size of the hashtable (if any)
        * timeout -- enable and set a default value for entries (if not None)
        * bitmap_ports_range -- set the specified inclusive portrange for
                                the bitmap ipset structure (0, 65536)
        * size -- Size of the list:set, the default is 8
        * skbinfo -- enable skbinfo capability
        '''
        excl_flag = NLM_F_EXCL if exclusive else 0
        msg = ipset_msg()
        cadt_flags = 0
        if counters:
            cadt_flags |= IPSET_FLAG_WITH_COUNTERS
        if comment:
            cadt_flags |= IPSET_FLAG_WITH_COMMENT
        if forceadd:
            cadt_flags |= IPSET_FLAG_WITH_FORCEADD
        if skbinfo:
            cadt_flags |= IPSET_FLAG_WITH_SKBINFO

        if stype == 'bitmap:port' and bitmap_ports_range is None:
            raise ValueError('Missing value bitmap_ports_range')

        data = {'attrs': []}
        if cadt_flags:
            data['attrs'] += [['IPSET_ATTR_CADT_FLAGS', cadt_flags]]
        if maxelem is not None:
            data['attrs'] += [['IPSET_ATTR_MAXELEM', maxelem]]
        if hashsize is not None:
            data['attrs'] += [["IPSET_ATTR_HASHSIZE", hashsize]]
        elif size is not None and stype == 'list:set':
            data['attrs'] += [['IPSET_ATTR_SIZE', size]]
        if timeout is not None:
            data['attrs'] += [["IPSET_ATTR_TIMEOUT", timeout]]
        if bitmap_ports_range is not None and stype == 'bitmap:port':
            # Set the bitmap range A bitmap type of set
            # can store up to 65536 entries
            if isinstance(bitmap_ports_range, PortRange):
                data['attrs'] += [
                    ['IPSET_ATTR_PORT_FROM', bitmap_ports_range.begin]
                ]
                data['attrs'] += [
                    ['IPSET_ATTR_PORT_TO', bitmap_ports_range.end]
                ]
            else:
                data['attrs'] += [
                    ['IPSET_ATTR_PORT_FROM', bitmap_ports_range[0]]
                ]
                data['attrs'] += [
                    ['IPSET_ATTR_PORT_TO', bitmap_ports_range[1]]
                ]

        if self._attr_revision is None:
            # Get the last revision supported by kernel
            revision = (await self.get_supported_revisions(stype))[1]
        else:
            revision = self._attr_revision
        msg['attrs'] = [
            ['IPSET_ATTR_PROTOCOL', self._proto_version],
            ['IPSET_ATTR_SETNAME', name],
            ['IPSET_ATTR_TYPENAME', stype],
            ['IPSET_ATTR_FAMILY', family],
            ['IPSET_ATTR_REVISION', revision],
            ["IPSET_ATTR_DATA", data],
        ]

        return await self.request(
            msg,
            IPSET_CMD_CREATE,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK | excl_flag,
            terminate=_nlmsg_error,
        )

    @staticmethod
    def _family_to_version(family):
        if family is not None:
            if family == socket.AF_INET:
                return 'IPSET_ATTR_IPADDR_IPV4'
            elif family == socket.AF_INET6:
                return 'IPSET_ATTR_IPADDR_IPV6'
            elif family == socket.AF_UNSPEC:
                return None
            raise TypeError('unknown family')

    def _entry_to_data_attrs(self, entry, etype, ip_version):
        attrs = []
        ip_count = 0

        if etype == 'set':
            attrs += [['IPSET_ATTR_NAME', entry]]
            return attrs

        # We support string (for one element, and for users calling this
        # function like a command line), and tuple/list
        if isinstance(entry, basestring):
            entry = entry.split(',')
        if isinstance(entry, (int, PortRange, PortEntry)):
            entry = [entry]

        for e, t in zip(entry, etype.split(',')):
            if t in ('ip', 'net'):
                ip_count += 1
                if t == 'net':
                    if '/' in e:
                        e, cidr = e.split('/')
                        attrs += [
                            [self.attr_map[('cidr', ip_count)], int(cidr)]
                        ]
                    elif '-' in e:
                        e, to = e.split('-')
                        attrs += [
                            [
                                self.attr_map[('ip_to', ip_count)],
                                {'attrs': [[ip_version, to]]},
                            ]
                        ]
                attrs += [
                    [
                        self.attr_map[('ip_from', ip_count)],
                        {'attrs': [[ip_version, e]]},
                    ]
                ]
            elif t == "port":
                if isinstance(e, PortRange):
                    attrs += [['IPSET_ATTR_PORT_FROM', e.begin]]
                    attrs += [['IPSET_ATTR_PORT_TO', e.end]]
                    if e.protocol is not None:
                        attrs += [['IPSET_ATTR_PROTO', e.protocol]]
                elif isinstance(e, PortEntry):
                    attrs += [['IPSET_ATTR_PORT', e.port]]
                    if e.protocol is not None:
                        attrs += [['IPSET_ATTR_PROTO', e.protocol]]
                else:
                    attrs += [[self.attr_map[t], e]]
            else:
                attrs += [[self.attr_map[t], e]]

        return attrs

    async def _add_delete_test(
        self,
        name,
        entry,
        family,
        cmd,
        exclusive,
        comment=None,
        timeout=None,
        etype="ip",
        packets=None,
        bytes=None,
        skbmark=None,
        skbprio=None,
        skbqueue=None,
        wildcard=False,
        physdev=False,
    ):
        excl_flag = NLM_F_EXCL if exclusive else 0
        adt_flags = 0
        if wildcard:
            adt_flags |= IPSET_FLAG_IFACE_WILDCARD
        if physdev:
            adt_flags |= IPSET_FLAG_PHYSDEV

        ip_version = self._family_to_version(family)
        data_attrs = self._entry_to_data_attrs(entry, etype, ip_version)
        if comment is not None:
            data_attrs += [
                ["IPSET_ATTR_COMMENT", comment],
                ["IPSET_ATTR_CADT_LINENO", 0],
            ]
        if timeout is not None:
            data_attrs += [["IPSET_ATTR_TIMEOUT", timeout]]
        if bytes is not None:
            data_attrs += [["IPSET_ATTR_BYTES", bytes]]
        if packets is not None:
            data_attrs += [["IPSET_ATTR_PACKETS", packets]]
        if skbmark is not None:
            data_attrs += [["IPSET_ATTR_SKBMARK", skbmark]]
        if skbprio is not None:
            data_attrs += [["IPSET_ATTR_SKBPRIO", skbprio]]
        if skbqueue is not None:
            data_attrs += [["IPSET_ATTR_SKBQUEUE", skbqueue]]
        if adt_flags:
            data_attrs += [["IPSET_ATTR_CADT_FLAGS", adt_flags]]
        msg = ipset_msg()
        msg['attrs'] = [
            ['IPSET_ATTR_PROTOCOL', self._proto_version],
            ['IPSET_ATTR_SETNAME', name],
            ['IPSET_ATTR_DATA', {'attrs': data_attrs}],
        ]

        return await self.request(
            msg,
            cmd,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK | excl_flag,
            terminate=_nlmsg_error,
        )

    async def add(
        self,
        name,
        entry,
        family=socket.AF_INET,
        exclusive=True,
        comment=None,
        timeout=None,
        etype="ip",
        skbmark=None,
        skbprio=None,
        skbqueue=None,
        wildcard=False,
        **kwargs,
    ):
        '''
        Add a member to the ipset.

        etype is the entry type that you add to the ipset. It's related to
        the ipset type. For example, use "ip" for one hash:ip or bitmap:ip
        ipset.

        When your ipset store a tuple, like "hash:net,iface", you must use a
        comma a separator (etype="net,iface")

        entry is a string for "ip" and "net" objects. For ipset with several
        dimensions, you must use a tuple (or a list) of objects.

        "port" type is specific, since you can use integer of specialized
        containers like :class:`PortEntry` and :class:`PortRange`

        Examples::

            ipset = IPSet()
            ipset.create("foo", stype="hash:ip")
            ipset.add("foo", "198.51.100.1", etype="ip")

            ipset = IPSet()
            ipset.create("bar", stype="bitmap:port",
                         bitmap_ports_range=(1000, 2000))
            ipset.add("bar", 1001, etype="port")
            ipset.add("bar", PortRange(1500, 2000), etype="port")

            ipset = IPSet()
            import socket
            protocol = socket.getprotobyname("tcp")
            ipset.create("foobar", stype="hash:net,port")
            port_entry = PortEntry(80, protocol=protocol)
            ipset.add("foobar", ("198.51.100.0/24", port_entry),
                      etype="net,port")

        wildcard option enable kernel wildcard matching on interface
        name for net,iface entries.
        '''
        return await self._add_delete_test(
            name,
            entry,
            family,
            IPSET_CMD_ADD,
            exclusive,
            comment=comment,
            timeout=timeout,
            etype=etype,
            skbmark=skbmark,
            skbprio=skbprio,
            skbqueue=skbqueue,
            wildcard=wildcard,
            **kwargs,
        )

    async def delete(
        self, name, entry, family=socket.AF_INET, exclusive=True, etype="ip"
    ):
        '''
        Delete a member from the ipset.

        See :func:`add` method for more information on etype.
        '''
        return await self._add_delete_test(
            name, entry, family, IPSET_CMD_DEL, exclusive, etype=etype
        )

    async def test(self, name, entry, family=socket.AF_INET, etype="ip"):
        '''
        Test if entry is part of an ipset

        See :func:`add` method for more information on etype.
        '''
        try:
            await self._add_delete_test(
                name, entry, family, IPSET_CMD_TEST, False, etype=etype
            )
            return True
        except IPSetError as e:
            if e.code == IPSET_ERR_EXIST:
                return False
            raise e

    async def swap(self, set_a, set_b):
        '''
        Swap two ipsets. They must have compatible content type.
        '''
        msg = ipset_msg()
        msg['attrs'] = [
            ['IPSET_ATTR_PROTOCOL', self._proto_version],
            ['IPSET_ATTR_SETNAME', set_a],
            ['IPSET_ATTR_TYPENAME', set_b],
        ]
        return await self.request(
            msg,
            IPSET_CMD_SWAP,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK,
            terminate=_nlmsg_error,
        )

    async def flush(self, name=None):
        '''
        Flush all ipsets. When name is set, flush only this ipset.
        '''
        msg = ipset_msg()
        msg['attrs'] = [['IPSET_ATTR_PROTOCOL', self._proto_version]]
        if name is not None:
            msg['attrs'].append(['IPSET_ATTR_SETNAME', name])
        return await self.request(
            msg,
            IPSET_CMD_FLUSH,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK,
            terminate=_nlmsg_error,
        )

    async def rename(self, name_src, name_dst):
        '''
        Rename the ipset.
        '''
        msg = ipset_msg()
        msg['attrs'] = [
            ['IPSET_ATTR_PROTOCOL', self._proto_version],
            ['IPSET_ATTR_SETNAME', name_src],
            ['IPSET_ATTR_TYPENAME', name_dst],
        ]
        return await self.request(
            msg,
            IPSET_CMD_RENAME,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK,
            terminate=_nlmsg_error,
        )

    async def _get_set_by(self, cmd, value):
        # Check that IPSet version is supported
        if self._proto_version < 7:
            raise NotImplementedError()

        msg = ipset_msg()
        if cmd == IPSET_CMD_GET_BYNAME:
            msg['attrs'] = [
                ['IPSET_ATTR_PROTOCOL', self._proto_version],
                ['IPSET_ATTR_SETNAME', value],
            ]

        if cmd == IPSET_CMD_GET_BYINDEX:
            msg['attrs'] = [
                ['IPSET_ATTR_PROTOCOL', self._proto_version],
                ['IPSET_ATTR_INDEX', value],
            ]
        return await self.request(msg, cmd)

    async def get_set_byname(self, name):
        '''
        Get a set by its name
        '''

        return await self._get_set_by(IPSET_CMD_GET_BYNAME, name)

    async def get_set_byindex(self, index):
        '''
        Get a set by its index
        '''

        return await self._get_set_by(IPSET_CMD_GET_BYINDEX, index)

    async def get_supported_revisions(self, stype, family=socket.AF_INET):
        '''
        Return minimum and maximum of revisions supported by the kernel.

        Each ipset module (like hash:net, hash:ip, etc) has several
        revisions. Newer revisions often have more features or more
        performances. Thanks to this call, you can ask the kernel
        the list of supported revisions.

        You can manually set/force revisions used in IPSet constructor.

        Example::

            ipset = IPSet()
            ipset.get_supported_revisions("hash:net")

            ipset.get_supported_revisions("hash:net,port,net")
        '''
        msg = ipset_msg()
        msg['attrs'] = [
            ['IPSET_ATTR_PROTOCOL', self._proto_version],
            ['IPSET_ATTR_TYPENAME', stype],
            ['IPSET_ATTR_FAMILY', family],
        ]
        response = await self.request(
            msg,
            IPSET_CMD_TYPE,
            msg_flags=NLM_F_REQUEST | NLM_F_ACK,
            terminate=_nlmsg_error,
        )

        min_revision = response[0].get_attr("IPSET_ATTR_PROTOCOL_MIN")
        max_revision = response[0].get_attr("IPSET_ATTR_REVISION")
        return min_revision, max_revision


class _IPSetError(IPSetError):
    '''
    Proxy class to not import all specifics ipset code in exceptions.py

    Out of the ipset module, a caller should use parent class instead
    '''

    def __init__(self, code, msg=None, cmd=None):
        if code in self.base_map:
            msg = self.base_map[code]
        elif cmd in self.cmd_map:
            error_map = self.cmd_map[cmd]
            if code in error_map:
                msg = error_map[code]
        super(_IPSetError, self).__init__(code, msg)

    base_map = {
        IPSET_ERR_PROTOCOL: "Kernel error received:" " ipset protocol error",
        IPSET_ERR_INVALID_CIDR: "The value of the CIDR parameter of"
        " the IP address is invalid",
        IPSET_ERR_TIMEOUT: "Timeout cannot be used: set was created"
        " without timeout support",
        IPSET_ERR_IPADDR_IPV4: "An IPv4 address is expected, but"
        " not received",
        IPSET_ERR_IPADDR_IPV6: "An IPv6 address is expected, but"
        " not received",
        IPSET_ERR_COUNTER: "Packet/byte counters cannot be used:"
        " set was created without counter support",
        IPSET_ERR_COMMENT: "Comment string is too long!",
        IPSET_ERR_SKBINFO: "Skbinfo mapping cannot be used: "
        " set was created without skbinfo support",
    }

    c_map = {
        errno.EEXIST: "Set cannot be created: set with the same"
        " name already exists",
        IPSET_ERR_FIND_TYPE: "Kernel error received: "
        "set type not supported",
        IPSET_ERR_MAX_SETS: "Kernel error received: maximal number of"
        " sets reached, cannot create more.",
        IPSET_ERR_INVALID_NETMASK: "The value of the netmask parameter"
        " is invalid",
        IPSET_ERR_INVALID_MARKMASK: "The value of the markmask parameter"
        " is invalid",
        IPSET_ERR_INVALID_FAMILY: "Protocol family not supported by the"
        " set type",
    }

    destroy_map = {
        IPSET_ERR_BUSY: "Set cannot be destroyed: it is in use"
        " by a kernel component"
    }

    r_map = {
        IPSET_ERR_EXIST_SETNAME2: "Set cannot be renamed: a set with the"
        " new name already exists",
        IPSET_ERR_REFERENCED: "Set cannot be renamed: it is in use by"
        " another system",
    }

    s_map = {
        IPSET_ERR_EXIST_SETNAME2: "Sets cannot be swapped: the second set"
        " does not exist",
        IPSET_ERR_TYPE_MISMATCH: "The sets cannot be swapped: their type"
        " does not match",
    }

    a_map = {
        IPSET_ERR_EXIST: "Element cannot be added to the set: it's"
        " already added"
    }

    del_map = {
        IPSET_ERR_EXIST: "Element cannot be deleted from the set:"
        " it's not added"
    }

    cmd_map = {
        IPSET_CMD_CREATE: c_map,
        IPSET_CMD_DESTROY: destroy_map,
        IPSET_CMD_RENAME: r_map,
        IPSET_CMD_SWAP: s_map,
        IPSET_CMD_ADD: a_map,
        IPSET_CMD_DEL: del_map,
    }


class NoSuchObject(_IPSetError):
    """Specific exception on No such file or directory error"""


class AlreadyExists(_IPSetError):
    """Specific exception on EEXIST error code"""


class IPSet(NetlinkSocket):

    def __init__(self, version=None, attr_revision=None, nfgen_family=2):
        self.asyncore = AsyncIPSet(version, attr_revision, nfgen_family)
        self.asyncore.local.keep_event_loop = True
        self.asyncore.status['event_loop'] = 'new'
        self.asyncore.status['nlm_generator'] = True
        self.asyncore.event_loop.run_until_complete(
            self.asyncore.setup_endpoint()
        )
        if self.asyncore.socket.fileno() == -1:
            raise OSError(9, 'Bad file descriptor')

    @property
    def _proto_version(self):
        return self.asyncore._proto_version

    @_proto_version.setter
    def _proto_version(self, value):
        self.asyncore._proto_version = value

    @property
    def _attr_revision(self):
        return self.asyncore._attr_revision

    @_attr_revision.setter
    def _attr_revision(self, value):
        self.asyncore._attr_revision = value

    def headers(self, name, **kwarg):
        return self._generate_with_cleanup(
            self.asyncore.headers, name, **kwarg
        )

    def get_proto_version(self, version=6):
        return self._run_with_cleanup(self.asyncore.get_proto_version, version)

    def list(self, *argv, **kwarg):
        return self._generate_with_cleanup(self.asyncore.list, *argv, **kwarg)

    def destroy(self, name=None):
        return self._run_with_cleanup(self.asyncore.destroy, name)

    def create(
        self,
        name,
        stype='hash:ip',
        family=socket.AF_INET,
        exclusive=True,
        counters=False,
        comment=False,
        maxelem=None,
        forceadd=False,
        hashsize=None,
        timeout=None,
        bitmap_ports_range=None,
        size=None,
        skbinfo=False,
    ):
        return self._run_with_cleanup(
            self.asyncore.create,
            name,
            stype,
            family,
            exclusive,
            counters,
            comment,
            maxelem,
            forceadd,
            hashsize,
            timeout,
            bitmap_ports_range,
            size,
            skbinfo,
        )

    def add(
        self,
        name,
        entry,
        family=socket.AF_INET,
        exclusive=True,
        comment=None,
        timeout=None,
        etype="ip",
        skbmark=None,
        skbprio=None,
        skbqueue=None,
        wildcard=False,
        **kwarg,
    ):
        return self._run_with_cleanup(
            self.asyncore.add,
            name,
            entry,
            family,
            exclusive,
            comment,
            timeout,
            etype,
            skbmark,
            skbprio,
            skbqueue,
            wildcard,
            **kwarg,
        )

    def delete(
        self, name, entry, family=socket.AF_INET, exclusive=True, etype="ip"
    ):
        return self._run_with_cleanup(
            self.asyncore.delete, name, entry, family, exclusive, etype
        )

    def test(self, name, entry, family=socket.AF_INET, etype="ip"):
        return self._run_with_cleanup(
            self.asyncore.test, name, entry, family, etype
        )

    def swap(self, set_a, set_b):
        return self._run_with_cleanup(self.asyncore.swap, set_a, set_b)

    def flush(self, name=None):
        return self._run_with_cleanup(self.asyncore.flush, name)

    def rename(self, name_src, name_dst):
        return self._run_with_cleanup(self.asyncore.rename, name_src, name_dst)

    def get_set_byname(self, name):
        return self._run_with_cleanup(self.asyncore.get_set_byname, name)

    def get_set_byindex(self, index):
        return self._run_with_cleanup(self.asyncore.get_set_byindex, index)

    def get_supported_revisions(self, stype, family=socket.AF_INET):
        return self._run_with_cleanup(
            self.asyncore.get_supported_revisions, stype, family
        )

��b IDATx��ytVս��ϓ22 �A@�IR��:�h�CiZ[�v��*E��:�W��ũZA� ^d��QeQ ��@ !��j�Z�'�>g�s��V��仿$�|?g�)&x-E�IE�N�T ��;@x�T.i��%-��X��}S�v�S�5�.��r/UHz^�_$-��W"�w��)�Ɗ�/@Z �&IoX��P�$K��}��JzX��:�;`�� &�, ��ŋu�i��,�e��6��m��X� Ե��rKb1�ԗ��)D�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�AD�A�݀!��I*��]R;I�2$eZ#OR��Z��Sr��r�6m��teff�u��*((P��u�'��v{��DIߔ4^�pI��m�'77WEEE;v�Ǝ��4�-��$]'�RI��{��\�I�&�G�� :I��HJ�� DWBB��=�\��W�R�޽m� o$K�(�V9��ABB�.��}��jѢ��v�`^?IO�ȅ}ڶm�G}T#F��J`�5�6��$-��ھ}�F��I�&��v;0(h;��Б�3�8CӧOWf��!�;A i:��F_m��9s&�|�q%=�#��w��Z�p�rrrl�a A� &��P\\��СC�[A#!� �{��o��l��F�} `��E2��}��M��K/��vV��)i��{4Bff�V�\��|ۭX�`��b�@��k��ɶ�@��%i��$K�z��5z�h�mX�[�I�XZ`� '��b%$��r�5��M��4�º��/�l� ԃ��ߖ�xhʔ)�[@=�} K�6IM}^��5k��㏷݆��z ��Η�ÿO��:gdG��B�m��y�T/��@+��Vɶ�纽z񕏵l�.��y�޴i�t뭷zV��0[�Y^>�Ws�qs}�\/�@$�(�T7�f��.��I�nݺi��R$푔n��.�~?H))\Z�RW'M�o�~v� Ov6o��ԃ��x��z��!�S,&�xm/�y�ɞԟ?�'ua��S�ѽ��b�,8�Gל�K��b��o�i�&��3t7Y,��)JJ��c[�n��z��ӳ�d�E��&K�sZ�Lӄ��I?@��&�%ӟ�۶mSMM�њ0��i�ؐSZ�,�|J+��N�� ~�,��0A0!5%Q-��YQQa��3}$_vV��r�f9f?S8`��zD�AD�AD�AD�AD�AD�AD�AD�AD�A�d��q�P��,ت��m��M��mg��1V?�r�S��I꒟��]�u|�l ��R��CyE�f�٢9�j��URb�zt�Ѱ!m5~tG��j�2�D��h�G�*�{H9�)꒟��ר3:(+3\?�/;TU��ݭ��ʴ~S�6lڧ��U��J*�i�$�d�(#=Yݺd�{�,�p|3��B))��q�:��vN0Y.�jk��ק6��;�SɶVzHJJЀ�-u��tѹ�սk��>�QUU��\��޲��~]fF�n��K?��&��ߡ��5��b��=z9�)��^�|u_�k�-[��y%Z��NU6 ��7M�i��:�]ۦt�k��[�n� ��X��(�e6B�b�.��"�8�cۭ|��~�t�e��u��u��w�|��ή��I-5�"��~��U��k��;��Zi�cE�m��N/��:�]�M��> cQ�^�ui�ƞ��??Ң��p�c#TUU�3�U��a��k��Nw�A`��:��Y_V��-8.KKf�R��itv�޲* 9S�6ֿ��j�,Ճ��NOMߤ��]��z�^��f��O�h��|��<�>@Å5��_��/I��u?{S��Y��4h�K��/2��]��4�%i��t�5��q�]�G�G��e�2�%i�R��| ��W��&f�*^]�??��vq[��Lg��E��_��3f}��F�xu~��}q��d�-��ږF�xu~I N>\��;��͗��O��֊�:�̗��W��J@Bh�W=��y��|��Ggwܷ�H�_NY��?��)T��d��i�'?��խw�h�lm�Qi� �!SUU��sw4kӺ�e4rf��x�u�-[n�Ht��MFj}�H�_��u�~w�>)�o�V}�(�T'��e��bʒ�v��3_�[+v�n@Ȭ\S�}��o��t��}w��=��k�H��F�n�xg��S�� 0eޢm~�l��}��u��q��Z�f��F��oZuu��E��g� ��`z�t~?b�;t�%�>��WTkķ�h��[�2e�G8L��IW�x��,��^\thr�l��^��Ϊ��{��=�ǆ��<}�q��V�@ ��⠨��W��y^��L��F_��>�0��U�k��D�u�ʫu��Cs$)I��v��:�IK��;6ֲ�4{^��6��ե��m+l��3>�݆��uM �9��u��?>�Z��c��}g�~q��h��Kw��ڭ��eFMM�~p�М�uq�ǿz��6T��b@8��@Y�|��jx��]�(^]�gf�}�M�"tG ��-w��.@�vOqh~/�HII��`��S�[l��.��6�nØXL��9�v�U�cOo��B�\�x�o��Ǥ�'�T�&I��Ǎ�Qw��_w�p�v��[�k�m��O�{�w�~�>�#=P1P�ɞ�a�-w��e�:i�Ǐl��H��o�׈��꒟�f9��SzH�?��+s�h�k%F��s:��q��Vh�qY��`��j�vO�'ρ?PyX3�lх��]�˾u��V�{��ݞ]1��,�M�z�YN�W~̈́�joY�n��}��ȚF߾׮mS]��F�� z�+�E��D�xm/��d{�F��{-�W��-�4w�Y��듏:�?��?��_�g�P�f� ^3��e��cg ��ҵs��8R��2�מ�z�@T��A��N��Gj�)��}CNi��/�R~��}��c:5�{��!��Z�HӋӾ��6}T�]��G�]�7W�6^��n �9*,��Y��qOZj��:P?�Q�� DF��L�|��?��-�^��.��Ɵ�7��}f�F�h׶��xe��2P�s��c��z�1��&5\cn��[�=�V��n[��ĶE鎀uˌ��d3G�II ��k�;�l�NmشOuuRVf��BE��]ۣ�eӶu :��X�-[��(��e��r�4��~��LH�i�6:��Ѻ@ԅ��r��ST�0��trk%$Č��0ez��"� *��z�"��T�/X9|8��.��C5F�eg}��C�Q%�͞�ˣ��JvL��/��?�j�^��h��&�9x�F��`�њ�Z��(��&�y��F��&Iݻf�g��#��W��;�3^�{Wo^4�'v�V[[�K'��;+��m��Ӎִ�]AC@��W?1^{�එyh��+^]��f��m��~�i��Ե�]AB@��WTk�̏t��uR�?�l�.O�IH�i�Yy�Զ�]A�ˀ7c��:��q}ힽ��a�f�6��Z~�қm(��+sK4{^�6}T��*UUu�]��n��.��:kx{�:��2�� _m��=�sA�ߤ�U��@?��Z��-V�ކ�е��z왍��Nэ��{|5� pڶn��b� �p-@��sPg]0G7�fy��-��M�{GCF��'%�{�4`��=�$-�Ge\��eU:m�+Z�t�'�W��jO�!O�AF@��i�k&t�݆��ϥ_�� e��}��=]"��Wz��_��.��͜�E3�l�e�W��F�i��h|t��-w��Z��ۍ��-�u��w=�6�YN��{��6|��}��|��*={��Ѽ��n.�S�.��z��1z��j�ۻT��H]��흾� �D�u��D��v��mv��K��.`V]yY�~s�I��@��t?/��ϓ.� ��m�&�["�+��P��?M��z�ovV��ЫG3�-�G��RR��[(!!\�_��,��^��%?�v@��ҵ�ő�� m��`�Y)�te�m8��G��Mx.))A�]Y��i`�V��i��W�`�?�^��~!�S#��^+�ѽ��GZj��?V�ģ�0.))A�꨷��l�z�L�*��]��O��X�r��Y�`DBBL�Oj��{��-M�H'�ii�-ϰ��ok�7^�� )쭡�b��]�UX��S�ְ�mռY��|5��*��c�ֽk��0B��7镹%ڽ��P#8n�Ȏ��q}mJr�23��_>��l��E�5��$i��wu��i�+ ��H�~�F`��IjƵ@�q �\ �@#qG�0"��.�0"� l��`��.�0!� ,�AQ�HN6�q��z�k��KJ�#��o;`X�v2��>,tێJ��J��7Z/*��A��.@f�ف�jM��zk��g��@TvZ�H3Z�xu�6Ra��'%��O��?/d�Q��5�x��Yk��U]��R�ֽk�ق@��Da�S^�RS�ּ�5��|��B��e��HNN�͘p �Hvc�Y�c��C5:��y �#��`�οb��;z��2��.��!��k��r��}g��U��Wk��yZ��n�=�f�� Pv��sn��3�p��~�;4p�˚=�ē~�Nm�I] ��¾0lH[��_��L��h�sh��_��ғߤ��c_њ�e��c�)��g�7��V�IZ��5��yr�gk̞W��#��IjӪ�v�>��՞��y睝��M�8�[�|�]��\�շ��8�M��6�%�|@P��Z��ڨ�I-m��>=�k��=�'a��iRo�-x�?>Q��.��}`�Ȏ:�Ws�mu� �u�� > �.@,&��;+!!�˱�tﭧD��Q�w��RW\��vF\~Q7�>�s�p�Y�w$��%A~�;~}��6��¾��g�&if_��=��j�,�v+�U��L�1(tW��a��ke��:@Ș>�j�$�Gq�2�t7S?�vL��|��]u�/�� .�(�0�E��6M��k�6�h��iۺ��z�ښ��O��r��i�f�ޱ�xm/��G�x>�� La�l%%��~�{��l�Bs��R4�*��}{�0Z/��t��N�I��ɚ��p�V^#�L�f�:u@k#�RSu�� =��S^��Zy��uR/��.@n�&��΃z~��B=��0eg뺆��#,��Þ�[�B/?�H� uUf�7�y ��W��y}Bw��eg��ל`��Wh�(|��|��`l`.�;�Ws��?��V�@"��c:i�ɍ��L֯��PG�v�6z�c�tM��̠��'��:w��uW��;d��=�;E�v�e��D��}��9�J@B(��0�iհ�b�v�P�1{�\P��&��G�7��D��޴I��y��_��$-Q�jm�~Yrr�&]�C��Dv%b�h|�Yz�n�i_�R;�k��g�}n��JOII��w��yuL}{�Ќǋ�}�:+3Y�?:��W��J/N+Rz��d=�h��b��;d��j͒su��ݔ��@NKMԄ�j��qz��C��5@��y°�h��L��m;*5�ezᕏ��=�ep�� X��L�n?�מ:��r�`��۵�tŤ�Z�|�1�v`�V�뽧��_c��s�ج'�ߤ%o�Tuum�k%%%h�)�u�y]��N�k��[�n� ��'b�2� �l�.=��͜�E%��gf$��[c;�s:�V-�͞W��ߤW�h��-��j�7��]4��=��F-X�]�>��Z�LS�i��[�Y��*�W��e;��Z�a��n(ӇW|e(HNNP��5[= r4tP �&0�<��p�c#��`�v�TNV GFq��v�T�i�*��Ty�a�m�$��ߏWyE�*�V��JKMTfF�w��>'��$-�ؽ�.Ho��.��8��c��"@D�AD�AD�AD�AD�AD�AD�AD�AD�A~�j��*֘,N;Pi�3599�h=��g�o�ضL�g��i��J�5��փy~�}&��Z��d9p֚ e:|��h��L��`��`��b/��d9p�?�fgg+%%�hM��gXo��s�ج��, Ω��Ol0Z��h=x��d��j��L��m��h��ݻ�o��O�[�g_�l�,8a��]�٭+��ӧ��0��$��I�]��c��]:粹:Te��ꢢ"�5a^��K�g�h,&��=��=��՟^��߶�ߢE�ܹS �J}��I%�:8 �IDAT~,�9/ʃPW'M�o�}z��N�ƍ쨓z�Pb��NZ�~�^z�=4m��s��w��g;5�� Y�~��S�VM��RXUյڱ�R��f��?��s�:w �;6�H:�º��i��5��-�maM��&O��3;1I�K�eam�Z�h�͛7+##�v+�c ~u�~ca]�Gn��F'��ټL~��PPP��b��n� v�o��C�4R,ӟ��gg��%�hq}@#M�4IÇ�� O�y^�x�M��Z�x�� )� �yOw@H�k�N˖-Sǎm�b]X@n��+i��͖��!++K3g�d��\�$m�t�$^��Y�f��J��\8PR��F�)77W��א!Cl��$i��:�@@��_o��G�� I{$��#� ��8磌��ŋ9�1A��(�I�m7��֭��>}�ߴ�J�q�7ޗt��^� -[��ԩS�j�*��}��%]&�'� -��ɓ'�ꫯVzz��vB#�;a �7@G��xI��{��j޼�ƌ��.�LÇWBB�7��`O��"I�$/�@R�@eee��@�۷��>}�0��,ɒ2$53Xs��|c��S~��rpTYYY��} kH�c�%��&k��.]��, @��AD�AD�AD�AD�AD�AD�AD�AD�A��@�l��T��<%''�*��L�o�^={��رc5h� %$+CnܸQ3f��ҥK�}�vUVV��s�9G� R,�_{�x��ˇ��3��o߾��;TTTd�}��馛��]uuuG��~��i�ԩ��@4��b��n��v�m�vfϞ�/�Peeeq}}za I~,�誫��{UWW뮻��}��_~Y�ƍSMMM��Yχ֝w��aw\�ď�cxꩧt�E��ƍկ_?�۷��5��@�u�?�1�k�N�ׯWzz�/�w�y�>}z�j��3�� k�(�ٺu��q_�Z�v�f̘��:~�AB�Q&�r��|��!��%K��ҥK��g��Ԟ={<_��X-�z� !��C�y�FUU��z~�AB�QIIIjݺ��W�$UXX��D��ٳ��Z~�AB�Q�ƍ�e��c��W�$<(~<�RSS�v�Zu��jjjԧO�Z��Qu��@4� 8��m�&&&j�ԩ��g�$�ď��1h� ͟?_��{�768��@��g �=@�`)))��5o��6m��3��)��ѣ�ƌ��J�;w��ҿUTT��/��K��ZR�{~a=@��0o�<��*狔��i�F��ɶ[�ˎ;T]]��OX@��?��K�.�ۈ�xN ��pppppppppppppppppP��fl߾],�{ｧ��k۶mڿ��o�5B��TӦMӴiӴ|�r�� DB��2e�|�A��n!D��y�'t��k�Ν�[A� $***t�5��'�� "�!�駟��o�a�Dn�Ν:t�֭[g�D��ШQ��0�6q�D��;��@ ��x� M�6�v�(Pii��z�m��Z�4e��w��"@��̴i�x��f��[��~-F�ٱc��&I�Z�2�|��n��!�?$@��{�[��H�T��ɏ�#��@�h��Ȏ��I#�_�m�(F��/6Z3��z��'�\r�,��r��!��;��w2Z3j��=~�G��Y��7��"I�$��i�I.�p��_"��?�p��N`�y��DD��?: ��_�� G�ÿa��b�7J��!B��x@�0�� B��o ��c��G��@`1��C��[@�0��G ��@`0��C��_�u�V1�� a��CX��>�W�` |��`!<��S�`"<��.��`#�c�`�?c��A��C4 �?��c�� p#��~@�0��?:��0��8&��_��M�Q1��J�h#��?��/`��7��;I��q7�aw�Q��A�1Hp ��!�#��<8��/#@�1��U�l7��=�S�=��K.�4Z�?E��_$i��@��!�1�!E4�?��`��P_� ��@��Bă�1��0�#��:��"��a��U�,�x�b��F��Y1� ��[��n|��n� ��#'��v�E��H:`�x��b� ��#��v��D��4��Y ��h��i.i��&��E�Ζ��v#��O� H��4�I�Ŷ��}�:I�k�h��@t��ZR��F��#��(�tXҙ��zZ �?��I��3l7q��@õ��|ۍ�1,G��p�u��Y� ��Ꮿ@h��J��v#�x��xk$ ��v#�9��5��}��_��$��c �S�#��=+��"K�{F��*m7�`#��%�H:NRS�p�6I?��sIՖ{Ap��$I$I:QR��v�2$�Z�@�UJ*��$�]<��F��O4IEND�B`�