File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/iptables.cpython-310.pyc
Back
o ;j�� � @ sh d Z ddlZddlZddlZddlZddlZddlZddlZddl Zddl Zddl m Z ddl mZ e�e�Zdd� Zd9dd �Zd9d d �Zd9d d �Zdd� Zd:dd�Zd9dd�Z d;dd�Zd<dd�Zd9dd�Z d=d d �Z d>d d �Z d=d d!�Z d<d"d#�Z d=d$d%�Z!d>d&d'�Z"d>d(d)�Z#d>d*d+�Z$d=d,d-�Z%d?d.d/�Z&d@d0d1�Z'dAd2d3�Z(dBd5d6�Z)d7d8� Z*dS )Ca� Support for iptables Configuration Options --------------------- The following options can be set in the minion config, grains, pillar, or master config. The configuration is read using :py:func:`config.get <salt.modules.config.get>`. - ``iptables.save_filters``: List of REGEX strings to FILTER OUT matching lines This is useful for filtering out chains, rules, etc that you do not wish to persist, such as ephemeral Docker rules. The default is to not filter out anything. .. code-block:: yaml iptables.save_filters: - "-j CATTLE_PREROUTING" - "-j DOCKER" - "-A POSTROUTING" - "-A CATTLE_POSTROUTING" - "-A FORWARD" � N)� SaltException)�STATE_INTERNAL_KEYWORDSc C s t jj�d�s dS dS )z7 Only load the module if iptables is installed �iptables)FzGThe iptables execution module cannot be loaded: iptables not installed.T��salt�utils�path�which� r r �I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/iptables.py� __virtual__, s r �ipv4c C s$ | dkr t jj�d�S t jj�d�S )zG Return correct command based on the family, e.g. ipv4 or ipv6 �ipv6Z ip6tablesr r ��familyr r r � _iptables_cmd9 s r c C s* t |�� d�}| td |dd�v rdS dS )z� Return truth of whether iptables has `option`. For example: .. code-block:: python _has_option('--wait') _has_option('--check', family='ipv6') z --help�cmd.run_stdout�quiet�Zoutput_loglevelTF)r �__salt__)�optionr �cmdr r r � _has_optionC s r c C s� t d dkr| dkr dS dS t d dkr | dkrdS dS t d d kr*| dkr(d S d S t d d kr8| dkr6dS dS t d dkr@dS t d dkrN| dkrLdS dS t d dkr\| dkrZdS dS t d dkrj| dkrhdS dS tdd�t d � d ��) z@ Some distros have a specific location for config files Z os_familyZRedHatr z/etc/sysconfig/ip6tablesz/etc/sysconfig/iptablesZArchz /etc/iptables/ip6tables.rulesz /etc/iptables/iptables.rulesZDebianz/etc/iptables/rules.v6z/etc/iptables/rules.v4�osZGentooz /var/lib/ip6tables/rules-savez /var/lib/iptables/rules-saveZSusez+/etc/sysconfig/scripts/SuSEfirewall2-customZVoidr ZAlpinez/etc/iptables/rules6-savez/etc/iptables/rules-saveZ NILinuxRTz!/etc/natinst/share/ip6tables.confz /etc/natinst/share/iptables.confz Saving iptables to file is notz supported on {}.z$ Please file an issue with SaltStack)Z __grains__r �formatr r r r �_confR sJ ���r c C s t d dg �} | S )a Return array of strings from `save_filters` in config. This array will be pulled from minion config, minion grains, minion pillar, or master config. The default value returned is []. .. code-block:: python _conf_save_filters() z config.option�iptables.save_filters)r )Zconfigr r r �_conf_save_filters� s r c C s� dt vr6g t d< |p t� D ](}z t d �t�|�� W q tjy5 } z t�d||� W Y d}~q d}~ww t d rIdd� | �d�D �}d� |�S | S )ar Return string with `save_filter` regex entries removed. For example: If `filters` is not provided, it will be pulled from minion config, minion grains, minion pillar, or master config. Default return value if no filters found is the original cmd_output string. .. code-block:: python _regex_iptables_save(cmd_output, ['-A DOCKER*']) r z Skipping regex rule: '%s': %sNc s* g | ]� t � fd d�td D ��s� �qS )c 3 s � | ]}|� � �V qd S �N)�search)�.0Zreg��liner r � <genexpr>� s � z2_regex_iptables_save.<locals>.<listcomp>.<genexpr>r )�any� __context__)r r r! r � <listcomp>� s ��z(_regex_iptables_save.<locals>.<listcomp>T� ) r% r �append�re�compile�error�log�warning� splitlines�join)Z cmd_output�filters�pattern�eZ_filtered_cmd_outputr r r �_regex_iptables_save� s ��� r3 c C s& t | �� d�}td |��� }|d S )z� Return version from iptables --version CLI Example: .. code-block:: bash salt '*' iptables.version IPv6: salt '*' iptables.version family=ipv6 z --versionr � )r r �split)r r �outr r r �version� s r7 �filterr' c s� d�v r �� d��d< �� dd� �� dd� tt�g d� D ] }|�v r(�|= q g }d} t�d�� � �fd d �} d �v rM|�d �| d ��d �� �d = d �v ra|�d�| d ��d �� �d = d�v ru��d�dkru�d �d< �d= d�v r�| s�|�d�| d��d �� d} �d= d�v r�d } t| t�s�| � d�} | D ]!} |�d| � �� d�v r�| � � dv r�|�d��d �� �d= q�d�v rވ�d�dkr�|�d�| d��d �� �d= �d= d�v �r t�d t �r�d g�d< �d D ]$} d }| � d ��s| � d ��rd }t� � d | �} |�d |� d!| � �� q��d= d"�v �r?d#|v�r/|�d#� |�d$�| d"��d" �� �d"= d%�v �rT|�d&�| d%��d% �� �d%= d'�v �ri|�d(�| d'��d' �� �d'= d)D ]r}|�v �r�d*|v�r�|�d*� | �s� d+S �| }t|t��r�td,d-� |D ���r�� fd.d/�|D �}|�d � d�d0d-� |D ��}n t |�� d ��s�t |�� d ��r�t� � d |�}|�d � n|}|�d1|� d2|� �� �|= �qkd3�v �r�d4|v�r�|�d4� |�d5��d3 �� �d3= d6�v �r�d6 �r|�d7�| d6��d6 �� �d6= g }d8}|D ]B}|�v �r[�| ��d9v �r3|�d1|� �� n%t�fd:d-�tjD ���rM|�d1|� d;�� d<�� n |�d1|� d2�� �� �|= �q�D ]/}| |�}�| �t|�d=k�rrd>nd1}�d9v �r{d nd2�� ��|�|� |� |� �� �� �q_||7 }|�r�| �s�d?S |�s�d@S |�s�dAS |dBv �r�d>}nd1}tdC|��r�dCnd }dD�t|�|| ||||d2�|��S d2�|�S )Ea� Build a well-formatted iptables rule based on kwargs. A `table` and `chain` are not required, unless `full` is True. If `full` is `True`, then `table`, `chain` and `command` are required. `command` may be specified as either a short option ('I') or a long option (`--insert`). This will return the iptables command, exactly as it would be used from the command line. If a position is required (as with `-I` or `-D`), it may be specified as `position`. This will only be useful if `full` is True. If `state` is passed, it will be ignored, use `connstate`. If `connstate` is passed in, it will automatically be changed to `state`. To pass in jump options that doesn't take arguments, pass in an empty string. .. note:: Whereas iptables will accept ``-p``, ``--proto[c[o[l]]]`` as synonyms of ``--protocol``, if ``--proto`` appears in an iptables command after the appearance of ``-m policy``, it is interpreted as the ``--proto`` option of the policy extension (see the iptables-extensions(8) man page). CLI Examples: .. code-block:: bash salt '*' iptables.build_rule match=state \ connstate=RELATED,ESTABLISHED jump=ACCEPT salt '*' iptables.build_rule filter INPUT command=I position=3 \ full=True match=state connstate=RELATED,ESTABLISHED jump=ACCEPT salt '*' iptables.build_rule filter INPUT command=A \ full=True match=state connstate=RELATED,ESTABLISHED \ source='127.0.0.1' jump=ACCEPT .. Invert Rules salt '*' iptables.build_rule filter INPUT command=A \ full=True match=state connstate=RELATED,ESTABLISHED \ source='!127.0.0.1' jump=ACCEPT salt '*' iptables.build_rule filter INPUT command=A \ full=True match=state connstate=RELATED,ESTABLISHED \ destination='not 127.0.0.1' jump=ACCEPT IPv6: salt '*' iptables.build_rule match=state \ connstate=RELATED,ESTABLISHED jump=ACCEPT \ family=ipv6 salt '*' iptables.build_rule filter INPUT command=I position=3 \ full=True match=state connstate=RELATED,ESTABLISHED jump=ACCEPT \ family=ipv6 �target�jump�nameN�state)�chain�save�tableFz (!|not)\s?c s: t �| �}|�d�s|�d�rt�� d|��| < dS dS )z� Will check if the defined argument is intended to be negated, (i.e. prefixed with '!' or 'not'), and add a '! ' to the rule. The prefix will be removed from the value in the kwargs dict. �!�notr' �! )�str� startswithr) �sub)�arg�value)� bang_not_pat�kwargsr r �maybe_add_negation s z&build_rule.<locals>.maybe_add_negation�ifz{}-i {}Zofz{}-o {}�proto�match�policy�protocolz{}-p {}T�,z-m Zname_)ZpknockZquota2Zrecentz --name {}z {}--proto {}� match-setr' r@ rA rB z-m set z --match-set Z connstatez-m statez {}--state {}Zdportz {}--dport {}Zsportz {}--sport {})�dportsZsportsz -m multiportz!Error: protocol must be specifiedc s s0 � | ]}t |��d �st |��d�r|V qdS )r@ rA N)rC rD �r �ir r r r# p s � � � �z build_rule.<locals>.<genexpr>c s g | ] }t �� d t|���qS )r' )r) rE rC )r �item)rH r r r& u s �z build_rule.<locals>.<listcomp>c s s � | ]}t |�V qd S r �rC rS r r r r# y s � z--� �commentz -m commentz--comment "{}"�setz{}--match-set {})p�jr: �add-set�and-mark�and-tos� checksum-fill�clamp-mss-to-pmtu� clustermac�ctevents�ctmask�del-set�ecn-tcp-remove�exist� expevents�gateway� hash-init�hashmode�helper�label� local-node�log-ip-options� log-level� log-prefix�log-tcp-options�log-tcp-sequence�log-uid�mask�new�nfmask� nflog-group� nflog-prefix� nflog-range�nflog-threshold�nodst�notrack�on-ip�on-port�or-mark�or-tos� persistent� queue-balance� queue-bypass� queue-num�random�rateest-ewmalog�rateest-interval� rateest-name� reject-with�restore� restore-mark� save-mark�selctx� set-class�set-dscp�set-dscp-class�set-mark�set-mss�set-tos� set-xmark� strip-options�timeout�to�to-destination�to-ports� to-source� total-nodes� tproxy-mark�ttl-dec�ttl-inc�ttl-set�type� ulog-cprange� ulog-nlgroup� ulog-prefix�ulog-qthreshold�xor-mark�xor-tos�zone�dst-pfx�hl-dec�hl-inc�hl-set�hmark-dport-mask�hmark-dst-prefix� hmark-mod� hmark-offset�hmark-proto-mask� hmark-rnd�hmark-spi-mask�hmark-sport-mask�hmark-src-prefix� hmark-tuple�led-always-blink� led-delay�led-trigger-id�queue-cpu-fanout�src-pfxzto-port�addr�and-mask�delude�honeypot�or-mask�prefix�reset�reuse�set-mac�shift�static�tarpit�tname�ttl)Nr' c 3 s � | ] }|t � �v V qd S r rV )r Zws_char)rG r r r# s � z "�"r4 �-z"Error: Table needs to be specified�"Error: Chain needs to be specifiedz$Error: Command needs to be specifiedZ ACDIRLSFZNXPE�--waitz{} {} -t {} {}{} {} {} {})�pop�list�_STATE_INTERNAL_KEYWORDSr) r* r( r �get� isinstancer5 �striprC rD rE r$ r/ �string� whitespace�lenr r )r? r= Zcommand�position�fullr rI �ignore�rulerO rJ Z match_valuerM Z match_setZnegative_match_setZ multiport_argZmp_valuerR Z after_jumpZafter_jump_argumentsZafter_jump_argument�keyZnegation�flag�waitr )rH rI rG r � build_rule� s B � � �� � � � � w � � r� c C s t | |d�S )z� Return a data structure of the rules in the conf file CLI Example: .. code-block:: bash salt '*' iptables.get_saved_rules IPv6: salt '*' iptables.get_saved_rules family=ipv6 �� conf_filer �� _parse_confr� r r r �get_saved_rules@ s r� c C s t d| d�S )z� Return a data structure of the current, in-memory rules CLI Example: .. code-block:: bash salt '*' iptables.get_rules IPv6: salt '*' iptables.get_rules family=ipv6 T��in_memr r� r r r r � get_rulesP s r� c C s< |sdS t ||d�}z || | d W S ty Y dS w )a� Return the current policy for the specified table/chain CLI Examples: .. code-block:: bash salt '*' iptables.get_saved_policy filter INPUT salt '*' iptables.get_saved_policy filter INPUT \ conf_file=/etc/iptables.saved IPv6: salt '*' iptables.get_saved_policy filter INPUT family=ipv6 salt '*' iptables.get_saved_policy filter INPUT \ conf_file=/etc/iptables.saved family=ipv6 r� r rN N�r� �KeyError)r? r= r� r �rulesr r r �get_saved_policya s �r� c C s< |sdS t d|d�}z || | d W S ty Y dS w )z� Return the current policy for the specified table/chain CLI Example: .. code-block:: bash salt '*' iptables.get_policy filter INPUT IPv6: salt '*' iptables.get_policy filter INPUT family=ipv6 r� Tr� rN Nr� )r? r= r r� r r r � get_policy} s �r� c C sH |sdS |sdS t d|�rdnd}d�t|�|| ||�}td |�}|S )z� Set the current policy for the specified table/chain CLI Example: .. code-block:: bash salt '*' iptables.set_policy filter INPUT ACCEPT IPv6: salt '*' iptables.set_policy filter INPUT ACCEPT family=ipv6 r� z#Error: Policy needs to be specifiedr� r' z{} {} -t {} -P {} {}�cmd.run_stderr)r r r r )r? r= rN r r� r r6 r r r � set_policy� s � r� c C sz t � r | s t |�} t�d| � tj�| �}tj�|�s t�|� t|�� d�}t d |�}t � r4t |�}t d | |�}|S )z� Save the current in-memory rules to disk CLI Example: .. code-block:: bash salt '*' iptables.save /etc/sysconfig/iptables IPv6: salt '*' iptables.save /etc/sysconfig/iptables family=ipv6 zSaving rules to %s�-saver z file.write) r r, �debugr r �dirname�isdir�makedirsr r r r3 )�filenamer Z parent_dirr Ziptr6 r r r r> � s r> c C s& |sdS |sdS t |�}td|�r+|� d| � d|� d|� �}td |dd � td S tt�� �}td |� d| � d |� �� td |� d| � d |� d|� �� td |� d��}td |� d| � d|� �� td |� d| � d|� �� |�� D ]}|�d|� ��r�|� ||�|�� v r� dS qydS )a� Check for the existence of a rule in the table and chain This function accepts a rule in a standard iptables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Example: .. code-block:: bash salt '*' iptables.check filter INPUT \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' IPv6: salt '*' iptables.check filter INPUT \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \ family=ipv6 r� �!Error: Rule needs to be specifiedz--check� -t z -C rW r� r r �retcodezcmd.run� -N � -A r r� � -F � -X z-A TF) r r r r% �hex�uuidZgetnoder. rD �replace) r? r= r� r Zipt_cmdr Z _chain_namer6 rT r r r �check� s* " �r� c C sL |sdS t |�� d| � �}td |��d|� d��}|dkr"d}|S d}|S ) a .. versionadded:: 2014.1.0 Check for the existence of a chain in the table CLI Example: .. code-block:: bash salt '*' iptables.check_chain filter INPUT IPv6: salt '*' iptables.check_chain filter INPUT family=ipv6 r� z -save -t r �:rW ���TF)r r �find)r? r= r r r6 r r r � check_chain s �r c C �P |sdS t d|�r dnd}t|�� d|� d| � d|� �}td |�}|s&d}|S ) a .. versionadded:: 2014.1.0 Create new custom chain to the specified table. CLI Example: .. code-block:: bash salt '*' iptables.new_chain filter CUSTOM_CHAIN IPv6: salt '*' iptables.new_chain filter CUSTOM_CHAIN family=ipv6 r� r� r' rW r� r� r� T�r r r �r? r= r r� r r6 r r r � new_chain$ � r c C r ) a .. versionadded:: 2014.1.0 Delete custom chain to the specified table. CLI Example: .. code-block:: bash salt '*' iptables.delete_chain filter CUSTOM_CHAIN IPv6: salt '*' iptables.delete_chain filter CUSTOM_CHAIN family=ipv6 r� r� r' rW r� r� r� Tr r r r r � delete_chain@ r r c C sx |sdS |sdS t d|�rdnd}t| |||�}t|t�r!|r!dS t|�� d|� d| � d|� d|� � }td |�}| S ) ax Append a rule to the specified table/chain. This function accepts a rule in a standard iptables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Example: .. code-block:: bash salt '*' iptables.append filter INPUT \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' IPv6: salt '*' iptables.append filter INPUT \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \ family=ipv6 r� r� r� r' FrW r� r� r� )r r� r� �boolr r )r? r= r� r r� � returnCheckr r6 r r r r( \ s $ r( c C s� |sdS |sdS |s dS |dk r+t |d�}t|| | d �}|| d }|dkr+d}td|�r2dnd }t| |||�}t|t�rD|rDd S d �t|�|| |||�} td | �} | S ) a� Insert a rule into the specified table/chain, at the specified position. This function accepts a rule in a standard iptables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. If the position specified is a negative number, then the insert will be performed counting from the end of the list. For instance, a position of -1 will insert the rule as the second to last rule. To insert a rule in the last position, use the append function instead. CLI Examples: .. code-block:: bash salt '*' iptables.insert filter INPUT position=3 \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' IPv6: salt '*' iptables.insert filter INPUT position=3 \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \ family=ipv6 r� z8Error: Position needs to be specified or use append (-A)r� r r r� r4 r� r' Fz{} {} -t {} -I {} {} {}r� ) r� r� r r� r� r r r r ) r? r= r� r� r r� �sizer� r r r6 r r r �insert s* � r c C sZ |r|rdS |r |}t d|�rdnd}t|�� d|� d| � d|� d|� � }td |�}|S )aR Delete a rule from the specified table/chain, specifying either the rule in its entirety, or the rule's position in the chain. This function accepts a rule in a standard iptables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Examples: .. code-block:: bash salt '*' iptables.delete filter INPUT position=3 salt '*' iptables.delete filter INPUT \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' IPv6: salt '*' iptables.delete filter INPUT position=3 family=ipv6 salt '*' iptables.delete filter INPUT \ rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \ family=ipv6 z2Error: Only specify a position or a rule, not bothr� r' rW r� z -D r� r )r? r= r� r� r r� r r6 r r r �delete� s $ r c C s@ t d|�rdnd}t|�� d|� d| � d|� �}td |�}|S )a Flush the chain in the specified table, flush all chains in the specified table if not specified chain. CLI Example: .. code-block:: bash salt '*' iptables.flush filter INPUT IPv6: salt '*' iptables.flush filter INPUT family=ipv6 r� r' rW r� r� r� r r r r r �flush� s r Fc C s� t � r | s |s t |�} d}| r,tjj�| d�� }|�� }W d � n1 s&w Y n|r<t|�� d�}td |�}ntd��i }d}t � }|� � D �]�} tjj � | �} | � d�re| �dd�}i ||< qK| � d�r�| �� } | d �dd�} i || | < | d || | d < | d �d d��dd�} | �d�\} }| || | d< ||| | d< g || | d< i || | d< qK| � d��r�tjj�| �}d }|d t|�k �rm|| dko�||d � d�}|r�||d || ||< ||d < || � d��ra|d 7 }|| � d��s|| dk�r|�s|�|d� nH|d t|�k �ra||d dk�ra||d � d��sa|| d|�|d �� �7 < |d t|�k �ra||d dk�ra||d � d��r5|d 7 }|d t|�k s�|d � d��rz|�d� g }|�|�\}}t|�}i }|d } |D ]}|| �r�|dk�r�|| ||< �q�|d du�r�|d d �d�}||| | d d |< || | d d �|� qK|S )zg If a file is not passed in, and the correct one for this OS is not detected, return False r' �rNr� r z A file was not found to parse�*r� r r4 rN � �[�]z packet countz byte countr� Z rules_comment�-Ar@ r� rW r� r( rX r� )r r r �filesZfopen�readr r r �_parserr. Z stringutilsZ to_unicoderD r� r5 �argsZ shlex_splitr� r r� r( �parse_known_args�varsr� )r� r� r r� Zifiler �retr? �parserr" �compsr= ZcountersZpcountZbcountr �indexZswapZ parsed_args�opts�_Zret_argsrF rX r r r r� � s� �� "$� ��� ��r� c C sL t �� } | j}|ddddd� |ddddd� |dd d dd� |d d d dd� |ddddd� |ddddd� |ddddd� |ddddd� |ddd dd� |d d d dd� |d d!d"dd� |d#d$d%dd� |d&d'd(dd� |d)d*d+dd� |d,d-d.dd� |d/d0d1dd� |d2d3d4dd� |d5d6d7dd� |d8d9d:dd� |d;d<d=dd� |d>d?d@dd� |dAdBdd� |dCdDdd� |dEdFdd� |dGdHdd� |dIdJdd� |dKdLdd� |dMdNdd� |dOdPdd� |dQdRdd� |dSdTdd� |dUdVdd� |dWdXdd� |dYdZdd� |d[d\dd� |d]d^dd� |d_d`dd� |dadbdd� |dcdddd� |dedfdd� |dgdhdd� |didjdd� |dkdldd� |dmdndd� |dodpdd� |dqdrdd� |dsdtdd� |dudvdd� |dwdxdd� |dydzdd� |d{d|dd� |d}d~dd� |dd�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�d�dd� |d�d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d�d�dd� |d��d dd� |�d�ddd� |�d�d�ddd� |�d�d�ddd� |�d �d dd� |�d �d dd� |�d �ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�d dd� |�d �d dd� |�d �d dd� |�d!�d"dd� |�d#�d$dd� |�d%�d&dd� |�d'�d(dd� |�d)�d*dd� |�d+�d,dd� |�d-�d.dd� |�d/�d0dd� |�d1�d2dd� |�d3�d4dd� |�d5�d6dd� |�d7�d8dd� |�d9�d:dd� |�d;�d<dd� |�d=�d>dd� |�d?�d@dd� |�dA�dBdd� |�dC�dDdd� |�dE�dFdd� |�dG�dHdd� |�dI�dJdd� |�dK�dLdd� |�dM�dNdd� |�dO�dPdd� |�dQ�dRdd� |�dS�dTdd� |�dU�dVdd� |�dW�dXdd� |�dY�dZdd� |�d[�d\dd� |�d]�d^dd� |�d_�d`dd� |�da�dbdd� |�dc�dddd� |�de�dfdd� |�dg�dhdd� |�di�djdd� |�dk�dldd� |�dm�dndd� |�do�dpdd� |�dq�drdd� |�ds�dtdd� |�du�dvdd� |�dw�dxdd� |�dy�dzdd� |�d{�d|dd� |�d}�d~dd� |�d�d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�dÐd�dd� |�dŐd�dd� |�dǐd�dd� |�dɐd�dd� |�dːd�dd� |�d͐d�dd� |�dϐd�dd� |�dѐd�dd� |�dӐd�dd� |�dՐd�dd� |�dאd�dd� |�dِd�dd� |�dېd�dd� |�dݐd�dd� |�dߐd�dd� |�d�d�dd� |�d�d�d�dd� |�d�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d dd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d �d dd� |�d �d dd� |�d �ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�d dd� |�d �d dd� |�d �d dd� |�d!�d"dd� |�d#�d$dd� |�d%�d&dd� |�d'�d(dd� |�d)�d*dd� |�d+�d,dd� |�d-�d.dd� |�d/�d0dd� |�d1�d2dd� |�d3�d4dd� |�d5�d6dd� |�d7�d8dd� |�d9�d:dd� |�d;�d<dd� |�d=�d>dd� |�d?�d@dd� |�dA�dBdd� |�dC�dDdd� |�dE�dFdd� |�dG�dHdd� |�dI�dJdd� |�dK�dLdd� |�dM�dNdd� |�dO�dPdd� |�dQ�dRdd� |�dS�dTdd� |�dU�dVdd� |�dW�dXdd� |�dY�dZdd� |�d[�d\dd� |�d]�d^dd� |�d_�d`dd� |�da�dbdd� |�dc�dddd� |�de�dfdd� |�dg�dhdd� |�di�djdd� |�dk�dldd� |�dm�dndd� |�do�dpdd� |�dq�drdd� |�ds�dtdd� |�du�dvdd� |�dw�dxdd� |�dy�dzdd� |�d{�d|dd� |�d}�d~dd� |�d�d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�dÐd�dd� |�dŐd�dd� |�dǐd�dd� |�dɐd�dd� |�dːd�dd� |�d͐d�dd� |�dϐd�dd� |�dѐd�dd� |�dӐd�dd� |�dՐd�dd� |�dאd�dd� |�dِd�dd� |�dېd�dd� |�dݐd�dd� |�dߐd�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d�d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d�dd� |�d��d dd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d �d dd� |�d �d dd� |�d �ddd� |�d�ddd� |�d�ddd� |�d�ddd� |�d�ddd� | S ( z� This function attempts to list all the options documented in the iptables(8) and iptables-extensions(8) man pages. They will not all be used by all parts of the module; use them intelligently and appropriately. r z--appendr( )�dest�actionz-Dz--deleter z-Iz--insertr z-Rz --replacer� z-Lz--listr� z-Fz--flushr z-Zz--zeroZzeroz-Nz --new-chainz new-chainz-Xz--delete-chainz delete-chainz-Pz--policyrN z-Ez--rename-chainz rename-chainz-pz --protocolrO z-sz--source�sourcez-dz --destinationZ destinationz-jz--jumpr: z-gz--gotoZgotoz-iz--in-interfacez in-interfacez-oz--out-interfacez out-interfacez-fz --fragment�fragmentz-cz--set-countersz set-countersz-mz--matchrM z --src-typezsrc-typez --dst-typezdst-typez--limit-iface-inzlimit-iface-inz--limit-iface-outzlimit-iface-outz--ahspiZahspiz--ahlenZahlenz--ahresZahresz --bytecode�bytecodez--cgroupZcgroupz--cluster-total-nodeszcluster-total-nodesz--cluster-local-nodezcluster-local-nodez--cluster-local-nodemaskzcluster-local-nodemaskz--cluster-hash-seedzcluster-hash-seedz --h-lengthzh-lengthz--mangle-mac-sz mangle-mac-sz--mangle-mac-dz mangle-mac-dz --commentrX z --connbytesZ connbytesz--connbytes-dirz connbytes-dirz--connbytes-modezconnbytes-modez--labelrk z--connlimit-uptozconnlimit-uptoz--connlimit-abovezconnlimit-abovez--connlimit-maskzconnlimit-maskz--connlimit-saddrzconnlimit-saddrz--connlimit-daddrzconnlimit-daddrz--markZmarkz --ctstateZctstatez --ctprotoZctprotoz --ctorigsrcZ ctorigsrcz --ctorigdstZ ctorigdstz --ctreplsrcZ ctreplsrcz --ctrepldstZ ctrepldstz--ctorigsrcportZ ctorigsrcportz--ctorigdstportZ ctorigdstportz--ctreplsrcportZ ctreplsrcportz--ctrepldstportZ ctrepldstportz --ctstatusZctstatusz --ctexpireZctexpirez--ctdirZctdirz--cpuZcpuz--sportz --source-portZ source_portz--dportz--destination-portZdestination_portz --dccp-typesz dccp-typesz --dccp-optionz dccp-optionz --src-groupz src-groupz --dst-groupz dst-groupz--dscpZdscpz --dscp-classz dscp-classz --dst-lenzdst-lenz --dst-optszdst-optsz --ecn-tcp-cwrz ecn-tcp-cwrz --ecn-tcp-ecez ecn-tcp-ecez --ecn-ip-ectz ecn-ip-ectz--espspiZespspiz--fragidZfragidz --fraglenZfraglenz --fragresZfragresz --fragfirstZ fragfirstz --fragmoreZfragmorez --fraglastZfraglastz--hashlimit-uptozhashlimit-uptoz--hashlimit-abovezhashlimit-abovez--hashlimit-burstzhashlimit-burstz--hashlimit-modezhashlimit-modez--hashlimit-srcmaskzhashlimit-srcmaskz--hashlimit-dstmaskzhashlimit-dstmaskz--hashlimit-namezhashlimit-namez--hashlimit-htable-sizezhashlimit-htable-sizez--hashlimit-htable-maxzhashlimit-htable-maxz--hashlimit-htable-expirezhashlimit-htable-expirez --hashlimit-htable-gcintervalzhashlimit-htable-gcintervalz --hbh-lenzhbh-lenz --hbh-optszhbh-optsz--helperrj z--hl-eqzhl-eqz--hl-ltzhl-ltz--hl-gtzhl-gtz --icmp-typez icmp-typez --icmpv6-typez icmpv6-typez --src-rangez src-rangez --dst-rangez dst-rangez--softZsoftz--header�headerz--ipvsZipvsz--vprotoZvprotoz--vaddrZvaddrz--vportZvportz--vdirZvdirz --vmethodZvmethodz --vportctlZvportctlz--length�lengthz--limit�limitz --limit-burstz limit-burstz --mac-sourcez mac-sourcez --mh-typezmh-typez--sportsz--source-portsz source-portsz--dportsz--destination-portszdestination-portsz--portsZportsz --nfacct-namez nfacct-namez--genreZgenrez--ttlr� z--logr, z --uid-ownerz uid-ownerz --gid-ownerz gid-ownerz--socket-existsz socket-existsz --physdev-inz physdev-inz --physdev-outz physdev-outz--physdev-is-inz physdev-is-inz--physdev-is-outzphysdev-is-outz--physdev-is-bridgedzphysdev-is-bridgedz --pkt-typezpkt-typez--dir�dirz--polZpolz--strict�strictz--reqidZreqidz--spiZspiz--protorL z--mode�modez --tunnel-srcz tunnel-srcz --tunnel-dstz tunnel-dstz--next�nextz--quotaZquotaz --rateestZrateestz --rateest1Zrateest1z --rateest2Zrateest2z--rateest-deltaz rateest-deltaz --rateest-bpsz rateest-bpsz--rateest-bps1z rateest-bps1z--rateest-bps2z rateest-bps2z --rateest-ppsz rateest-ppsz--rateest-pps1z rateest-pps1z--rateest-pps2z rateest-pps2z --rateest-ltz rateest-ltz --rateest-gtz rateest-gtz --rateest-eqz rateest-eqz--rateest-namer� z--rateest-intervalr� z--rateest-ewmaz rateest-ewmaz--realmZrealmz--namer; z--setrY z --rsourceZrsourcez--rdestZrdestz--maskrs z--rcheckZrcheckz--update�updatez--remove�removez --seconds�secondsz--reapZreapz --hitcountZhitcountz--rttlZrttlz--looseZloosez --validmarkZ validmarkz--accept-localz accept-localz--invert�invertz --rt-typezrt-typez --rt-segsleftz rt-segsleftz--rt-lenzrt-lenz --rt-0-reszrt-0-resz --rt-0-addrsz rt-0-addrsz--rt-0-not-strictzrt-0-not-strictz --chunk-typesz chunk-typesz --match-setrQ z--return-nomatchzreturn-nomatchz--update-counterszupdate-countersz--update-subcounterszupdate-subcountersz --packets-eqz packets-eqz --packets-ltz packets-ltz --packets-gtz packets-gtz --bytes-eqzbytes-eqz --bytes-ltzbytes-ltz --bytes-gtzbytes-gtz --transparentZ transparentz --nowildcardZ nowildcardz--stater< z --probabilityZ probabilityz--everyZeveryz--packetZpacketz--algoZalgoz--from�fromz--tor� z--stringr� z --hex-stringz hex-stringz --tcp-flagsz tcp-flagsz--synZsynz --tcp-optionz tcp-optionz--mssZmssz --datestartZ datestartz --datestopZdatestopz --timestartZ timestartz --timestopZtimestopz --monthdaysZ monthdaysz --weekdaysZweekdaysz --contiguous� contiguousz --kerneltzZkerneltzz--utc�utcz --localtzZlocaltzz--tosZtosz--ttl-eqzttl-eqz--ttl-gtzttl-gtz--ttl-ltzttl-ltz--u32�u32z --conditionZ conditionz--macZmacz --lower-limitz lower-limitz --upper-limitz upper-limitz--src-ccz--source-countryzsource-countryz--dst-ccz--destination-countryzdestination-countryz --enabled�enabledz --disabled�disabledz--ifaceZifacez--dev-inzdev-inz --dev-outzdev-outz--upZupz--downZdownz --broadcast� broadcastz --loopbackZloopbackz--pointtopointZ pointtopointz --runningZrunningz--noarpZnoarpz--arpZarpz --promiscZpromiscz --multicastZ multicastz --dynamicZdynamicz --lower-upzlower-upz --dormantZdormantz--edkZedkz--kazaaZkazaaz--gnuZgnuz--dcZdcz--bit�bitz--appleZapplez--soulZsoulz--winmxZwinmxz--aresZaresz--debugr� z--flags�flagsz--anyr$ z--layer3Zlayer3z--layer4Zlayer4z--layer5Zlayer5z --stealthZstealthz --synscanZsynscanz--cnscanZcnscanz--grscanZgrscanz--psd-weight-thresholdzpsd-weight-thresholdz--psd-delay-thresholdzpsd-delay-thresholdz--psd-lo-ports-weightzpsd-lo-ports-weightz--psd-hi-ports-weightzpsd-hi-ports-weightz--growZgrowz --no-changez no-changez --packetsZpacketsz --knockportsZ knockportsz--time�timez --autocloseZ autoclosez --checkipZcheckipz--typer� z--checksum-fillr^ z --set-classr� z--newrt z --hashmoderi z --clustermacr` z --total-nodesr� z --local-noderl z --hash-initrh z --set-xmarkr� z --save-markr� z--restore-markr� z --and-markr\ z --or-markr~ z --xor-markr� z --set-markr� z--nfmaskru z--ctmaskrb z--saver> z --restorer� z --notrackr{ z --cteventsra z --expeventsrf z--zoner� z --timeoutr� z--to-destinationr� z--randomr� z --persistentr� z --src-pfxr� z --dst-pfxr� z --set-dscpr� z--set-dscp-classr� z--ecn-tcp-removerd z--hl-setr� z--hl-decr� z--hl-incr� z --hmark-tupler� z --hmark-modr� z--hmark-offsetr� z--hmark-src-prefixr� z--hmark-dst-prefixr� z--hmark-sport-maskr� z--hmark-dport-maskr� z--hmark-spi-maskr� z--hmark-proto-maskr� z --hmark-rndr� z--led-trigger-idr� z --led-delayr� z--led-always-blinkr� z --log-levelrn z --log-prefixro z--log-tcp-sequencerq z--log-tcp-optionsrp z--log-ip-optionsrm z --log-uidrr z --to-portsr� z --nflog-grouprv z--nflog-prefixrw z --nflog-rangerx z--nflog-thresholdry z --queue-numr� z--queue-balancer� z--queue-bypassr� z--queue-cpu-fanoutr� z--rateest-ewmalogr� z --reject-withr� z--nodstrz z--selctxr� z --add-setr[ z --del-setrc z--existre z --to-sourcer� z --set-mssr� z--clamp-mss-to-pmtur_ z--strip-optionsr� z --gatewayrg z --set-tosr� z --and-tosr] z--or-tosr z --xor-tosr� z --on-portr} z--on-ipr| z --tproxy-markr� z --ttl-setr� z --ttl-decr� z --ttl-incr� z--ulog-nlgroupr� z --ulog-prefixr� z--ulog-cpranger� z--ulog-qthresholdr� z--addrr� z--tnamer� z--deluder� z--tarpitr� z --set-macr� z--prefixr� z--reuser� z--staticr� z --and-maskr� z --or-maskr� z--shiftr� z --honeypotr� z--resetr� )�argparse�ArgumentParser� add_argument)r Zadd_argr r r r 5 s ����r )r r )r8 NNr' Nr )Nr )r8 NNr )r8 Nr )r8 NNNr )NNNr )r8 r' r )NFr )+�__doc__r9 �loggingr r) r� r� Zsalt.utils.argsr Zsalt.utils.filesZsalt.utils.pathZsalt.exceptionsr Z salt.stater r� � getLogger�__name__r, r r r r r r3 r7 r� r� r� r� r� r� r> r� r r r r( r r r r� r r r r r �<module> sZ 3 " � z 8 # 3 % I
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings