File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/nftables.cpython-310.pyc
Back
o ;j�� � @ sj d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl m Z e� e�Zdddddddd d d � Zd d � Zdd� Zd?dd�Zdd� Z d@dd�ZdAdd�ZdBdd�ZdBd d �ZdBd d �ZdCd d!�ZdDd#d$�ZdDd%d&�Z dEd'd(�Z dCd)d*�Z dBd+d,�Z dBd-d.�Z dFd/d0�Z!dEd1d2�Z"dDd3d4�Z#dGd5d6�Z$dHd7d8�Z%dId9d:�Z&dEd;d<�Z'dDd=d>�Z(dS )Jz Support for nftables � N)�CommandExecutionError)�STATE_INTERNAL_KEYWORDS�ip�ip6�inet�arp�bridge�netdev) �ipv4Zip4r Zipv6r r r r r c C s t jj�d�r dS dS )z7 Only load the module if nftables is installed �nft�nftables)FzHThe nftables execution module failed to load: nftables is not installed.)�salt�utils�path�which� r r �I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/nftables.py� __virtual__ s r c C s dS )z Return correct command r r r r r r � _nftables_cmd* s r c C sD t d dkrdS t d dkrdS t d dkrdS t d dkr dS dS ) z. Use the same file for rules for now. Z os_familyZRedHatz /etc/nftablesZArchZDebian�osZGentooF)Z __grains__��familyr r r �_conf1 s r c C s$ t � � d�} td | ��� }|d S )z� Return version from nftables --version CLI Example: .. code-block:: bash salt '*' nftables.version z --version�cmd.run� )r �__salt__�split)�cmd�outr r r �versionA s r � r c K sj dddd�}d|v r|d |d< |d= t t�g d� D ] }||v r$||= qd} d} t| } d|v r=| d�|d �7 } |d= d |v rM| d �|d �7 } |d = d |v rU|d } d |v r\|d = d |v rl| d�|d �7 } |d = d|v r|| d�|d �7 } |d= d|v r�| d�|d �7 } |d= d|v r�| d7 } |d= d|v s�d|v r�| d�| |�d�p�|�d��7 } d|v r�|d= d|v r�|d= d|v s�d|v r�| d�| |�d�p�|�d��7 } d|v r�|d= d|v r�|d= d|v �r t|d �|d< d |d v �r|d �d d �|d< | d �|d �7 } |d= d |v �r7t|d �|d < d |d v �r+|d �d d �|d < | d �|d �7 } |d = d!|v �rh|d! �d"�} d#d$� | D �} | jd%d&� d'� d(d)� | D ��|d!< | d �|d! �7 } |d!= d*|v �r�|d* �d"�} d+d$� | D �} | jd%d&� d'� d,d)� | D ��|d*< | d �|d* �7 } |d*= g }d|v �r�|� d-�|d �� |d= d.|v �r�|� d-�|d. �� |d.= d/|v �s�d0|v �r�|� d1�|�d/��p�|�d0��� d/|v �r�|d/= d0|v �r�|d0= d2|v �r�|� d3�|d2 �� |d2= d4|v �r|� d-�|d4 �� |d4= d5|v �r |� d-�|d5 �� |d5= d6|v �r2|� d7�|d6 �� |d6= |D ]}| |7 } �q4| � � } | �d| � d8��} | �d | � d9��} | |d:< |d;v �r�| �sdd<|d=< |S |�smd>|d=< |S |�svd?|d=< |S |d@v �r�|�r�dA�t � | | ||| �|d:< ndB�t � | | || �|d:< n dC�t � || | || �|d:< |d: �r�dD|d=< d%|dE< |S )Fa� Build a well-formatted nftables rule based on kwargs. A `table` and `chain` are not required, unless `full` is True. If `full` is `True`, then `table`, `chain` and `command` are required. `command` may be specified as either insert, append, or delete. This will return the nftables command, exactly as it would be used from the command line. If a position is required (as with `insert` or `delete`), it may be specified as `position`. This will only be useful if `full` is True. If `connstate` is passed in, it will automatically be changed to `state`. CLI Examples: .. code-block:: bash salt '*' nftables.build_rule match=state \ connstate=RELATED,ESTABLISHED jump=ACCEPT salt '*' nftables.build_rule filter input command=insert position=3 \ full=True match=state state=related,established jump=accept IPv6: salt '*' nftables.build_rule match=state \ connstate=related,established jump=accept \ family=ipv6 salt '*' nftables.build_rule filter input command=insert position=3 \ full=True match=state state=related,established jump=accept \ family=ipv6 r F)�comment�rule�result�targetZjump)�chain�save�table�ifzmeta iifname {} Zofzmeta oifname {} �proto�stateZ connstatezct state {{ {0} }} z icmp-typezicmp type {{ {0} }} Zpkttypezmeta pkttype {{ {0} }} Zcounterzcounter Zsaddr�sourcez {} saddr {} ZdaddrZ destinationz {} daddr {} Zdport�:�-zdport {{ {0} }} Zsportzsport {{ {0} }} Zdports�,c S � g | ]}t |��qS r ��int��.0�xr r r � <listcomp>� � z build_rule.<locals>.<listcomp>T)�reversez, c s � � | ]}t |�V qd S �N��strr2 r r r � <genexpr>� � � z build_rule.<locals>.<genexpr>Zsportsc S r/ r r0 r2 r r r r5 � r6 c s r8 r9 r: r2 r r r r< � r= z{} �jz redirect-tozto-portzredirect to {} zto-portsz--to-ports {} z to-sourcezto-destinationz reject-withzreject with {} z dportz sportr" )�True�true�Table needs to be specifiedr! �Chain needs to be specifiedz Command needs to be specified)ZInsert�insertZINSERT�&{} insert rule {} {} {} position {} {}�{} insert rule {} {} {} {}z{} {} rule {} {} {} {}zSuccessfully built ruler# ) �list�_STATE_INTERNAL_KEYWORDS�_NFTABLES_FAMILIES�format�getr; �replacer �sort�join�append�stripr )r' r% Zcommand�position�fullr �kwargs�ret�ignorer" r) � nft_familyZ_dportsZ_sportsZ after_jump�itemr r r � build_ruleQ s ) ��� � � �� rW c C s� t � r| st � } tjj�| ��}tjj�|�� �}W d � n1 s#w Y g }|D ]}|�� }|s5q,|� d�r;q,|� |� q,|S )z� Return a data structure of the rules in the conf file CLI Example: .. code-block:: bash salt '*' nftables.get_saved_rules N�#) r r r �files�fopen�data�decode� readlinesrO � startswithrN )Z conf_fileZfp_�lines�rules�lineZtmpliner r r �get_saved_rules2 s � rb c C s� t | }g }d�t� |�}td |dd�}|s|S zt�|�}W n ty+ | Y S w |r3|�d�s5|S |�dg �D ] }d|vrH|�|d � q;t � |� |S )z� Return a data structure of the current, in-memory tables CLI Example: .. code-block:: bash salt '*' nftables.list_tables salt '*' nftables.list_tables family=ipv6 z6{} --json --numeric --numeric --numeric list tables {}r F�Z python_shellr Zmetainfor' ) rH rI r r �json�loads� ValueErrorrJ rN �log�debug)r rU �tablesr r r[ rV r r r � list_tablesM s* � �� rj c C sT t | �}t| }g }|D ]}|d }d�t� ||�}td |dd�}|�|� q |S )z� Return a data structure of the current, in-memory rules CLI Example: .. code-block:: bash salt '*' nftables.get_rules salt '*' nftables.get_rules family=ipv6 �namez1{} --numeric --numeric --numeric list table {} {}r Frc )rj rH rI r r rN )r ri rU r` r' Z table_namer r r r r � get_rulesr s � rl c C sb t | }g }d�t� |�}td |dd�}|s|S z t�|�d }W |S ttfy0 | Y S w )a3 .. versionadded:: 3002 Return a list of dictionaries comprising the current, in-memory rules family Networking family, either ipv4 or ipv6 CLI Example: .. code-block:: bash salt '*' nftables.get_rules_json salt '*' nftables.get_rules_json family=ipv6 z7{} --numeric --numeric --numeric --json list ruleset {}r Frc r )rH rI r r rd re �KeyErrorrf )r rU r` r r r r r �get_rules_json� s ���rn c C s� t � r| st � } dd� t�� D �}dd� |�� D �}d}|D ]}t|�}|r*|d7 }|d�|� }q |d }td | �rA| � d�} z'tjj� | d��}|� tjj � |�� W d � W |S 1 saw Y W |S t y{ } ztd |� ���d }~ww ) af .. versionchanged:: 3002 Save the current in-memory rules to disk. On systems where /etc/nftables is a directory, a file named salt-all-in-one.nft will be dropped inside by default. The main nftables configuration will need to include this file. CLI Example: .. code-block:: bash salt '*' nftables.save /etc/nftables c S � i | ]\}}||�qS r r �r3 �k�vr r r � <dictcomp>� � zsave.<locals>.<dictcomp>c S ro r r rp r r r rs � rt z #! nft -f � zfile.directory_existsz/salt-all-in-one.nft�wbNz'Problem writing to configuration file: )r rH �itemsrl rM r r r rY rZ �writer[ �encode�OSErrorr )�filenamer Z nft_familiesr` r Z_fh�excr r r r& � s0 �����r& �filterc C s� ddd�}|s d|d< |S |sd|d< |S t | |d�}|d s!|S t| ||d�}|d s.|S t| |||d�}|d s<|S t| }d �t� || |�}td |dd �}t�d |�} t� |� d ��} | D ]} | � | �} | rtd| � d�d� S qadd|� �d�S )aU Get the handle for a particular rule This function accepts a rule in a standard nftables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Example: .. code-block:: bash salt '*' nftables.get_rule_handle filter input \ rule='tcp dport 22 log accept' IPv6: salt '*' nftables.get_rule_handle filter input \ rule='tcp dport 22 log accept' \ family=ipv6 r F�r! r# rB r! �Rule needs to be specifiedr r# z={} --numeric --numeric --numeric --handle list chain {} {} {}r rc z +z # handle (?P<handle>\d+)T�handle)r# r� zCould not find rule )r# r! ) � check_table� check_chain�checkrH rI r r �rer �compile�search�group) r' r% r" r rS �resrU r r r` �pat�r�matchr r r �get_rule_handle� s: � �r� c C s� ddd�}|s d|d< |S |sd|d< |S t | |d�}|d s!|S t| ||d�}|d s.|S t| }t� � d |� d | � d |� �}|� d ��d d ��dd�}td |dd�} t�|| �} | sid�||| |�|d< |S d�||| |�|d< d|d< |S )aU Check for the existence of a rule in the table and chain This function accepts a rule in a standard nftables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Example: .. code-block:: bash salt '*' nftables.check filter input \ rule='tcp dport 22 log accept' IPv6: salt '*' nftables.check filter input \ rule='tcp dport 22 log accept' \ family=ipv6 r Fr~ rB r! r r r# z --handle list chain � z #z{ z{? ?z }z ?}?r rc z;Rule {} in chain {} in table {} in family {} does not existz3Rule {} in chain {} in table {} in family {} existsT) r� r� rH r rK r r� r� rI ) r' r% r" r rS r� rU r Z search_ruler �foundr r r r� s: �� ��r� c C s� ddd�}|s d|d< |S t | }t� � d|� d| � �}td |dd ��d |� d ��}|d kr:d �|| |�|d< |S d�|| |�|d< d|d< |S )a .. versionadded:: 2014.7.0 Check for the existence of a chain in the table CLI Example: .. code-block:: bash salt '*' nftables.check_chain filter input IPv6: salt '*' nftables.check_chain filter input family=ipv6 r Fr~ rB r! z list table r� r rc zchain z {���z0Chain {} in table {} in family {} does not existz(Chain {} in table {} in family {} existsTr# )rH r r �findrI )r' r% r rS rU r r r r r r� O s" ���r� c C s� ddd�}| s d|d< |S t | }t� � d|� �}td |dd��d |� d | � ��}|d kr;d | � d |� d�|d< |S d | � d |� d�|d< d|d< |S )z� Check for the existence of a table CLI Example: .. code-block:: bash salt '*' nftables.check_table nat r Fr~ rA r! z list tables r rc ztable r� r� �Table � in family z does not existz existsTr# )rH r r r� )r' r rS rU r r r r r r� u s ��r� c C s� ddd�}| s d|d< |S t | |d�}|d r|S t| }t� � d|� d | � �}td |dd �}|sCd | � d |� d�|d< d|d< |S d�| |�|d< |S )z� .. versionadded:: 2014.7.0 Create new custom table. CLI Example: .. code-block:: bash salt '*' nftables.new_table filter IPv6: salt '*' nftables.new_table filter family=ipv6 r Fr~ rA r! r r# z add table r� r rc r� r� z createdTz*Table {} in family {} could not be created�r� rH r r rI �r' r rS r� rU r r r r r � new_table� �$ ��r� c C s� ddd�}| s d|d< |S t | |d�}|d s|S t| }t� � d|� d | � �}td |dd �}|sCd | � d |� d�|d< d|d< |S d�| |�|d< |S )z� .. versionadded:: 2014.7.0 Create new custom table. CLI Example: .. code-block:: bash salt '*' nftables.delete_table filter IPv6: salt '*' nftables.delete_table filter family=ipv6 r Fr~ rA r! r r# z delete table r� r rc r� r� z deletedTz*Table {} in family {} could not be deletedr� r� r r r � delete_table� r� r� c C s ddd�}|s d|d< |S t | |d�}|d s|S t| ||d�}|d r/d�|| |�|d< |S t| }t� � d |� d | � d |� �} |sG|sG|r^|rX|rXt|�rXd �| |||�} nd |d< |S td | dd�} | swd�|| |�|d< d|d< |S d�|| |�|d< |S )aL .. versionadded:: 2014.7.0 Create new chain to the specified table. CLI Example: .. code-block:: bash salt '*' nftables.new_chain filter input salt '*' nftables.new_chain filter input \ table_type=filter hook=input priority=0 salt '*' nftables.new_chain filter foo IPv6: salt '*' nftables.new_chain filter input family=ipv6 salt '*' nftables.new_chain filter input \ table_type=filter hook=input priority=0 family=ipv6 salt '*' nftables.new_chain filter foo family=ipv6 r Fr~ rB r! r r# z0Chain {} in table {} in family {} already existsz -- add chain r� z,{0} \{{ type {1} hook {2} priority {3}\; \}}z(Table_type, hook, and priority required.r rc z)Chain {} in table {} in family {} createdTz6Chain {} in table {} in family {} could not be created)r� r� rI rH r r; r ) r' r% Z table_type�hook�priorityr rS r� rU r r r r r � new_chain� sD � �����r� c C s� ddd�}|s d|d< |S t | |d�}|d s|S t| ||d�}|d s&|S t| }t� � d|� d | � d |� �}td |dd �}|sQd �|| |�|d< d |d< |S d�|| |�|d< |S )av .. versionadded:: 2014.7.0 Delete the chain from the specified table. CLI Example: .. code-block:: bash salt '*' nftables.delete_chain filter input salt '*' nftables.delete_chain filter foo IPv6: salt '*' nftables.delete_chain filter input family=ipv6 salt '*' nftables.delete_chain filter foo family=ipv6 r Fr~ rB r! r r# z delete chain r� r rc z)Chain {} in table {} in family {} deletedTz6Chain {} in table {} in family {} could not be deleted)r� r� rH r r rI )r' r% r rS r� rU r r r r r � delete_chain) s0 ����r� c C s� d� ||| �dd�}|sd|d< |S |sd|d< |S t| |d�}|d s&|S t| ||d�}|d s3|S t| |||d�}|d rKd � ||| |�|d< |S t| }d � t� || ||�}td |dd �}|ssd |d< d� ||| |�|d< |S d� ||| |�|d< |S )aL Append a rule to the specified table & chain. This function accepts a rule in a standard nftables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Example: .. code-block:: bash salt '*' nftables.append filter input \ rule='tcp dport 22 log accept' IPv6: salt '*' nftables.append filter input \ rule='tcp dport 22 log accept' \ family=ipv6 z1Failed to append rule {} to chain {} in table {}.Fr~ rB r! r r r# �8Rule {} chain {} in table {} in family {} already existsz{} add rule {} {} {} {}r rc T�2Added rule "{}" chain {} in table {} in family {}.�:Failed to add rule "{}" chain {} in table {} in family {}.)rI r� r� r� rH r r ) r' r% r" r rS r� rU r r r r r rN \ sP �� �� �� ���rN c C s d|� d| � d�dd�}|sd|d< |S |s d|d< |S t | |d �}|d s(|S t| ||d �}|d s5|S t| |||d �}|d rMd �||| |�|d< |S t| }|r_d �t� || |||�}n d �t� || ||�}td |dd�} | s�d|d < d�||| |�|d< |S d�||| |�|d< |S )a� Insert a rule into the specified table & chain, at the specified position. If position is not specified, rule will be inserted in first position. This function accepts a rule in a standard nftables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Examples: .. code-block:: bash salt '*' nftables.insert filter input \ rule='tcp dport 22 log accept' salt '*' nftables.insert filter input position=3 \ rule='tcp dport 22 log accept' IPv6: salt '*' nftables.insert filter input \ rule='tcp dport 22 log accept' \ family=ipv6 salt '*' nftables.insert filter input position=3 \ rule='tcp dport 22 log accept' \ family=ipv6 zFailed to insert rule z to table �.Fr~ rB r! r r r# r� rD rE r rc Tr� r� )r� r� r� rI rH r r � r' r% rP r" r rS r� rU r r r r r rC � sT � ��� �� ���rC c C s d|� d| � d�dd�}|r|rd|d< |S t | |d�}|d s"|S t| ||d�}|d s/|S t| |||d�}|d sGd �||| |�|d< |S |sPt| |||�}t| }d �t� || ||�}td |dd �} | sxd|d < d�||| |�|d< |S d�||| |�|d< |S )a( Delete a rule from the specified table & chain, specifying either the rule in its entirety, or the rule's position in the chain. This function accepts a rule in a standard nftables command format, starting with the chain. Trying to force users to adapt to a new method of creating rules would be irritating at best, and we already have a parser that can handle it. CLI Examples: .. code-block:: bash salt '*' nftables.delete filter input position=3 salt '*' nftables.delete filter input \ rule='tcp dport 22 log accept' IPv6: salt '*' nftables.delete filter input position=3 family=ipv6 salt '*' nftables.delete filter input \ rule='tcp dport 22 log accept' \ family=ipv6 zFailed to delete rule � in table r� Fr~ z+Only specify a position or a rule, not bothr! r r# z8Rule {} chain {} in table {} in family {} does not existz!{} delete rule {} {} {} handle {}r rc Tz7Deleted rule "{}" in chain {} in table {} in family {}.z=Failed to delete rule "{}" in chain {} table {} in family {})r� r� r� rI r� rH r r r� r r r �delete� sL � �� ��� ���r� c C s� d� || �dd�}t| |d�}|d s|S t| }|r>t| ||d�}|d s(|S d� t� || |�}d|� d| � d |� d �}nt� � d |� d | � �}d | � d |� d �}td |dd�}|sid|d< d|� �|d< |S d|� �|d< |S )aB Flush the chain in the specified table, flush all chains in the specified table if chain is not specified. CLI Example: .. code-block:: bash salt '*' nftables.flush filter salt '*' nftables.flush filter input IPv6: salt '*' nftables.flush filter input family=ipv6 z0Failed to flush rules from chain {} in table {}.Fr~ r r# z{} flush chain {} {} {}z from chain r� r� r� z flush table r� z from table r rc TzFlushed rules r! zFailed to flush rules )rI r� rH r� r r ) r' r% r rS r� rU r r! r r r r �flushI s4 �� ��r� c C s� |sdS t | }t|d�}z)|d D ]!}|�di ��d�|kr3|�di ��d�| kr3|d d W S qW dS tttfyC Y dS w ) a� .. versionadded:: 3002 Return the current policy for the specified table/chain table Name of the table containing the chain to check chain Name of the chain to get the policy for family Networking family, either ipv4 or ipv6 CLI Example: .. code-block:: bash salt '*' nftables.get_policy filter input IPv6: salt '*' nftables.get_policy filter input family=ipv6 �"Error: Chain needs to be specifiedr r r% rk �type�policyN)rH rn rJ rm � TypeErrorrf )r' r% r rU r` r" r r r � get_policy{ s ���r� c C s |sdS |sdS t | }i }t|d�}|sdS |D ]$}z|d d | kr3|d d |kr3|d }W n W q ty= Y qw |sBdS t� � d|� d | � d |� �}d |vs\d |vs\d |vr^dS d �|d |d |d �} |� d| � d|� d�}td |dd�} | d S )a- .. versionadded:: 3002 Set the current policy for the specified table/chain. This only works on chains with an existing base chain. table Name of the table containing the chain to modify chain Name of the chain to set the policy for policy accept or drop family Networking family, either ipv4 or ipv6 CLI Example: .. code-block:: bash salt '*' nftables.set_policy filter input accept IPv6: salt '*' nftables.set_policy filter input accept family=ipv6 r� z#Error: Policy needs to be specifiedr Fr% r' rk z add chain r� r� r� �prioz type {} hook {} priority {};z "{ z policy z; }"z cmd.run_allrc �retcode)rH rn rm r rI r ) r' r% r� r rU Z chain_infor` r" r �paramsr r r r � set_policy� s: � � � r� )r )NNNr Nr r9 )r )Nr )r} NNr )r} Nr )r} NNNNr )r} NNNr )NNNr )r} r r ))�__doc__rd �loggingr� Zsalt.utils.datar Zsalt.utils.filesZsalt.utils.pathZsalt.exceptionsr Z salt.stater rG � getLogger�__name__rg rH r r r r rW rb rj rl rn r& r� r� r� r� r� r� r� r� rN rC r� r� r� r� r r r r �<module> sh � � b % # * : ; & '( � H 3 I U O 2*
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings