黑松山资源网 Design By www.paidiu.com
为方便用ipset 来管理防火墙,写了下面Ipset类来对Ip进行管理
#!/usr/bin/env python # coding: utf-8 import MySQLdb import MySQLdb.cursors import subprocess import logging import re,os import xml.sax class XMLHandler(xml.sax.ContentHandler): ''' 用来解析ipset数据 ''' def __init__(self): self.current_tag = "" self.current_set = "" self.mapping = {} def startElement(self, name, attributes): self.current_tag = name if name == 'ipset': self.current_set = attributes['name'] self.mapping[self.current_set] = [] def characters(self, data): if self.current_tag == 'elem' and data!='\n': self.mapping[self.current_set].append(data) def endElement(self, name): if name == 'ipset': self.current_set = '' def getData(self): return self.mapping class IpsetPool(object): def __init__(self): self.msg = [] self.config = '/etc/sysconfig/ipset' self.logger_file = '/data/logs/ipset.log' self.ipsets = ['manage','center','project'] self.log = self.mylog() self.ipset_data = self.getIpsetData(XMLHandler) def sub_call(self,run_cmd, **kwargs): p = subprocess.Popen( run_cmd, shell=True, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, **kwargs) outdata, errdata = p.communicate() retcode = p.wait() self.msg.append((False,errdata) if retcode != 0 else (True,outdata)) return retcode, outdata, errdata @staticmethod def querydb(sql): host = "192.168.59.128" user = "dev" passwd = "123456" db = "gmweb_res" conn = MySQLdb.connect( host=host, user=user, passwd=passwd, db=db, charset="utf8", cursorclass=MySQLdb.cursors.DictCursor) cursor = conn.cursor() cursor.execute(sql) rs = cursor.fetchall() cursor.close() conn.commit() conn.close() return rs def getManageIps(self): sql = "select * from host where state not in (6) and `use` REGEXP ',2$|^2,|^2$|,2,';" return [x["ip1"] for x in self.querydb(sql)] def getProjectIps(self): from jgconf.models import projectConf return [i['saltIp'] for item in projectConf.objects.all() for i in item.getSaltServer()] def checkAddrIsIn(self, ip, setname): ''' 判断ip是否在某个set中 ''' if ip in self.ipset_data[setname]: return True else: return False def getIpsetData(self,xml_handler): ''' 获取机器上当前的ipset配置数据 ''' xh = xml_handler() xml.sax.parseString(self.sub_call('ipset list -o xml')[1], xh) return xh.getData() def createSet(self,setname): self.log.info('create {0} set'.format(setname)) set_cmd = 'ipset create {0} hash:ip'.format(setname) return self.sub_call(set_cmd) def renderSetFile(self): ''' 重导配置 ''' self.sub_call('ipset save > {0}'.format(self.config)) def createIpsets(self): for ipset in self.ipsets: self.createSet(ipset) def addIps2Set(self,setname,ips): if setname not in self.ipsets: self.log.error('invalid set name!') return False if not self.ipset_data.has_key(setname): self.createSet(setname) for ip in ips: if not self.checkAddrIsIn(ip,setname): self.log.info('add {0} {1}'.format(setname,ip)) self.sub_call('ipset -A {0} {1}'.format(setname,ip)) self.renderSetFile() def delIpsFromSet(self,setname,ips): self.log.info(ips) if setname in self.ipsets and self.ipset_data.has_key(setname): for ip in ips: if self.checkAddrIsIn(ip,setname): self.log.info('delete {0} {1}'.format(setname,ip)) self.sub_call('ipset -D {0} {1}'.format(setname,ip)) self.renderSetFile() def mylog(self): logger_dir = os.path.split(self.logger_file)[0] if not os.path.exists(logger_dir): os.makedirs(logger_dir) logger = logging.getLogger("reload") logger.setLevel(logging.DEBUG) # create file handler which logs even debug messages fh = logging.FileHandler(self.logger_file) fh.setLevel(logging.DEBUG) # create formatter and add it to the handlers formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s') fh.setFormatter(formatter) console = logging.StreamHandler() console.setLevel(logging.DEBUG) # add the handlers to the logger logger.addHandler(fh) logger.addHandler(console) return logger def reloadIpset(self): """ 从文件中加载最新集合 """ reloadlog = mylog() try: # 刷新清空当前规则 sub_call("/etc/init.d/iptables stop") sub_call("/etc/init.d/ipset restart") sub_call("/etc/init.d/iptables start") reloadlog.info("reload成功") except Exception as e: reloadlog.info("ipset reload异常 %s" % e) def loadDefault(self): #self.addIps2Set('manage',self.getManageIps()) self.addIps2Set('project',self.getProjectIps()) if __name__ == '__main__': p = IpsetPool() p.loadDefault()
以上这篇python ipset管理 增删白名单的方法就是小编分享给大家的全部内容了,希望能给大家一个参考,也希望大家多多支持。
黑松山资源网 Design By www.paidiu.com
广告合作:本站广告合作请联系QQ:858582 申请时备注:广告合作(否则不回)
免责声明:本站资源来自互联网收集,仅供用于学习和交流,请遵循相关法律法规,本站一切资源不代表本站立场,如有侵权、后门、不妥请联系本站删除!
免责声明:本站资源来自互联网收集,仅供用于学习和交流,请遵循相关法律法规,本站一切资源不代表本站立场,如有侵权、后门、不妥请联系本站删除!
黑松山资源网 Design By www.paidiu.com
暂无评论...
更新日志
2024年10月07日
2024年10月07日
- 张柏芝《全新经验》[FLAC/分轨][450MB]
- 唐朝.2008-浪漫骑士【音乐家】【WAV+CUE】
- 张芸京.2016-失败的高歌【泡耳音乐】【WAV+CUE】
- 群星.1991-音乐工厂1·皇后大道东【音乐工厂】【WAV+CUE】
- 群星.1992-音乐工厂2·首都【音乐工厂】【WAV+CUE】
- 群星.1994-音乐工厂3·儿童乐园【音乐工厂】【WAV+CUE】
- 胡鸿钧.2021-ex:CHANGE【星梦娱乐】【WAV+CUE】
- 班得瑞原装进口《第一张新世纪专辑:仙境》1CD[APE/CUE分轨][292.3MB]
- 伍佰《摇滚教父 伍佰黄金精选 2CD》[WAV+CUE][990MB]
- 班得瑞原装进口《第二张新世纪专辑:寂静山林》1CD[APE/CUE分轨][327.1MB]
- Beyond.1989-真的见证(2024环球MQA-UHQCD限量版)【环球】【WAV+CUE】
- 陈怡婷.2024-予你的心谁来赔【福茂】【FLAC分轨】
- 陈冠希.2003-HITS.OR.MISSES【英皇娱乐】【WAV+CUE】
- 班得瑞原装进口《第三张新世纪专辑:春野》1CD[APE/CUE分轨][278.9MB]
- 班得瑞原装进口《第四张新世纪专辑:蓝色天际》1CD[APE/CUE分轨][284.8MB]