Current File : //lib/python2.7/site-packages/salt/modules/nftables.pyo
�
���^c @@ s3 d Z d d l m Z m Z m Z d d l Z d d l Z d d l m Z d d l Z
d d l Z
d d l Z
d d l
m Z d d l m Z e j e � Z i d d 6d d 6d d 6d
d 6d
d
6d d 6d
d
6d d 6d d 6Z d � Z d � Z d d � Z d � Z d d d d d d d � Z d d � Z d d � Z d d d � Z d d d d d � Z d d d d d � Z d d d d � Z! d d d � Z" d d � Z# d d � Z$ d d d d d d d � Z% d d d d! � Z& d d d d d" � Z' d d d d d d# � Z( d d d d d$ � Z) d d d d% � Z* d S(& u
Support for nftables
i ( t absolute_importt print_functiont unicode_literalsN( t six( t STATE_INTERNAL_KEYWORDS( t CommandExecutionErroru ipu ipv4u ip4u ip6u ipv6u inetu arpu bridgeu netdevc C@ s# t j j j d � r d St d f S( u7
Only load the module if nftables is installed
u nftu nftablesuH The nftables execution module failed to load: nftables is not installed.( t saltt utilst patht whicht False( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt __virtual__& s c C@ s d S( u
Return correct command
u nft( ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt
_nftables_cmd/ s c C@ sX t d d k r d St d d k r( d St d d k r< d St d d k rP d St Sd S( u.
Use the same file for rules for now.
u os_familyu RedHatu
/etc/nftablesu Archu Debianu osu GentooN( t
__grains__R
( t family( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt _conf6 s c C@ s0 d j t � � } t d | � j � } | d S( u�
Return version from nftables --version
CLI Example:
.. code-block:: bash
salt '*' nftables.version
u
{0} --versionu cmd.runi ( t formatR t __salt__t split( t cmdt out( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt versionF s u c K@ s� i d d 6d d 6t d 6} d | k r? | d | d <| d =n x7 t t � d d d g D] } | | k rY | | =qY qY Wd } d }
t | } d
| k r� | d j | d
� 7} | d
=n d | k r� | d
j | d � 7} | d =n d | k r| d }
n d | k r| d =n d | k rE| d j | d � 7} | d =n d | k r�t j | d � | d <d | d k r�| d j d d � | d <n | d j | d � 7} | d =n d | k r't j | d � | d <d | d k r| d j d d � | d <n | d j | d � 7} | d =n d | k r�| d j d � } g | D] }
t |
� ^ qM} | j
d t � d j d � | D� � | d <| d j | d � 7} | d =n d | k r?| d j d � } g | D] }
t |
� ^ q�} | j
d t � d j d � | D� � | d <| d j | d � 7} | d =n g } d | k ru| j
d j | d � � | d =n d | k r�| j
d j | d � � | d =n d! | k r�| j
d" j | d! � � | d! =n d# | k r| j
d$ j | d# � � | d# =n d% | k r5| j
d& j | d% � � | d% =n d' | k re| j
d( j | d' � � | d' =n x | D] } | | 7} qlW| j � } | j d d) j |
� � } | j d d* j |
� � } | | d <| d7 k r�| s�d- | d <| S| s d. | d <| S| sd/ | d <| S| d8 k rs| rNd3 j t � | | | | | � | d <q�d4 j t � | | | | � | d <q�d5 j t � | | | | | � | d <n | d r�d6 | d <n t | d <| S(9 u�
Build a well-formatted nftables rule based on kwargs.
A `table` and `chain` are not required, unless `full` is True.
If `full` is `True`, then `table`, `chain` and `command` are required.
`command` may be specified as either insert, append, or delete.
This will return the nftables command, exactly as it would
be used from the command line.
If a position is required (as with `insert` or `delete`), it may be specified as
`position`. This will only be useful if `full` is True.
If `connstate` is passed in, it will automatically be changed to `state`.
CLI Examples:
.. code-block:: bash
salt '*' nftables.build_rule match=state \
connstate=RELATED,ESTABLISHED jump=ACCEPT
salt '*' nftables.build_rule filter input command=insert position=3 \
full=True match=state state=related,established jump=accept
IPv6:
salt '*' nftables.build_rule match=state \
connstate=related,established jump=accept \
family=ipv6
salt '*' nftables.build_rule filter input command=insert position=3 \
full=True match=state state=related,established jump=accept \
family=ipv6
u u commentu ruleu resultu targetu jumpu chainu saveu tableu ifu meta iifname {0} u ofu meta oifname {0} u protou stateu connstateu ct state {{ {0}}} u dportu :u -u dport {{ {0} }} u sportu sport {{ {0} }} u dportsu ,t reverseu , c s@ s | ] } t j | � Vq d S( N( R t text_type( t .0t x( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pys <genexpr>� s u sportsc s@ s | ] } t j | � Vq d S( N( R R ( R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pys <genexpr>� s u {0} u ju to-portu --to-port {0} u to-portsu --to-ports {0} u to-destinationu --to-destination {0} u reject-withu --reject-with {0} u {0} dportu {0} sportu Trueu trueu Table needs to be specifiedu Chain needs to be specifiedu Command needs to be specifiedu Insertu insertu INSERTu, {0} insert rule {1} {2} {3} position {4} {5}u {0} insert rule {1} {2} {3} {4}u {0} {1} rule {2} {3} {4} {5}u Successfully built rule( u Trueu true( u Insertu insertu INSERT( R
t listt _STATE_INTERNAL_KEYWORDSt _NFTABLES_FAMILIESR R R t replaceR t intt sortt Truet joint appendt stripR ( t tablet chaint commandt positiont fullR t kwargst rett ignoret rulet protot
nft_familyt _dportsR t _sportst
after_jumpt item( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt
build_ruleV s� "
c C@ s� t � r | r t � } n t j j j | � �" } t j j j | j � � } Wd QXg } xH | D]@ } | j � } | s� qb n | j d � r� qb n | j
| � qb W| S( u�
Return a data structure of the rules in the conf file
CLI Example:
.. code-block:: bash
salt '*' nftables.get_saved_rules
Nu #( R R R t filest fopent datat decodet readlinesR# t
startswithR" ( t conf_filet fp_t linest rulest linet tmpline( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt get_saved_rules s !
c C@ s� t | } g } d j t � | � } t d | d t �} | sE | St j d | � } x\ | D]T } | j d � d } d j t � | | � } t d | d t �} | j | � q^ W| S( u�
Return a data structure of the current, in-memory rules
CLI Example:
.. code-block:: bash
salt '*' nftables.get_rules
salt '*' nftables.get_rules family=ipv6
u1 {0} --numeric --numeric --numeric list tables {1}u cmd.runt python_shellu
+u i u4 {0} --numeric --numeric --numeric list table {1} {2}( R R R R R
t reR R" ( R R. R= R R t tablesR$ t
table_name( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt get_rules0 s"
c C@ s� t � r | r t � } n d d d d g } d } x@ | D]8 } t | � } | r` | d 7} n | d j | � } q; W| d } yA t j j j | d � �# } | j t j j j | � � Wd QXWn. t
t f k
r� } t d j
| � � � n X| S(
u�
Save the current in-memory rules to disk
CLI Example:
.. code-block:: bash
salt '*' nftables.save /etc/nftables
u ipu ip6u arpu bridgeu
#! nft -f
u
u wbNu* Problem writing to configuration file: {0}( R RE R! R R R4 R5 t
writelinesR6 t encodet IOErrort OSErrorR R ( t filenameR t nft_familiesR= R t _fht exc( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt saveQ s"
&u filterc
C@ sf i d d 6t d 6} | s( d | d <| S| s< d | d <| St | d | �} | d s\ | St | | d | �} | d s | St | | | d | �} | d s� | St | } d j t � | | | � } t d | d t �} t j d
| � } t j
d j | � � }
x> | D]6 } |
j | � } | ri t d 6| j
d � d 6SqWi t d 6d
j | � d 6S( uU
Get the handle for a particular rule
This function accepts a rule in a standard nftables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Example:
.. code-block:: bash
salt '*' nftables.get_rule_handle filter input \
rule='tcp dport 22 log accept'
IPv6:
salt '*' nftables.get_rule_handle filter input \
rule='tcp dport 22 log accept' \
family=ipv6
u u commentu resultu Chain needs to be specifiedu Rule needs to be specifiedR uA {0} --numeric --numeric --numeric --handle list chain {1} {2} {3}u cmd.runRA u
+u {0} # handle (?P<handle>\d+)u handleu Could not find rule {0}( R
t check_tablet check_chaint checkR R R R RB R t compilet searchR t group(
R$ R% R, R R* t resR. R R R= t patt rt match( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt get_rule_handler s:
c
C@ s' i d d 6t d 6} | s( d | d <| S| s< d | d <| St | d | �} | d s\ | St | | d | �} | d s | St | } d j t � | | | � } d j | � } t d | d
t �j | � } | d k r� d j | | | | � | d <n& d
j | | | | � | d <t | d <| S( uU
Check for the existence of a rule in the table and chain
This function accepts a rule in a standard nftables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Example:
.. code-block:: bash
salt '*' nftables.check filter input \
rule='tcp dport 22 log accept'
IPv6:
salt '*' nftables.check filter input \
rule='tcp dport 22 log accept' \
family=ipv6
u u commentu resultu Chain needs to be specifiedu Rule needs to be specifiedR uA {0} --handle --numeric --numeric --numeric list chain {1} {2} {3}u {0} #u cmd.runRA i����u? Rule {0} in chain {1} in table {2} in family {3} does not existu7 Rule {0} in chain {1} in table {2} in family {3} exists( R
RO RP R R R R t findR (
R$ R% R, R R* RU R. R t search_ruleR ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyRQ � s4
c C@ s� i d d 6t d 6} | s( d | d <| St | } d j t � | | � } t d | d t �j d j | � � } | d k r� d
j | | | � | d <n# d j | | | � | d <t | d <| S( u
.. versionadded:: 2014.7.0
Check for the existence of a chain in the table
CLI Example:
.. code-block:: bash
salt '*' nftables.check_chain filter input
IPv6:
salt '*' nftables.check_chain filter input family=ipv6
u u commentu resultu Chain needs to be specifiedu {0} list table {1} {2}u cmd.runRA u chain {0} {{i����u3 Chain {0} in table {1} in family {2} does not existu+ Chain {0} in table {1} in family {2} exists( R
R R R R RZ R ( R$ R% R R* R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyRP � s
(
c C@ s� i d d 6t d 6} | s( d | d <| St | } d j t � | � } t d | d t �j d j | | � � } | d k r� d
j | | � | d <n d j | | � | d <t | d <| S( uj
Check for the existence of a table
CLI Example::
salt '*' nftables.check_table nat
u u commentu resultu Table needs to be specifiedu {0} list tables {1}u cmd.runRA u
table {0} {1}i����u& Table {0} in family {1} does not existu Table {0} in family {1} exists( R
R R R R RZ R ( R$ R R* R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyRO
s
+
c C@ s� i d d 6t d 6} | s( d | d <| St | d | �} | d rH | St | } d j t � | | � } t d | d t �} | s� d j | | � | d <t | d <n d
j | | � | d <| S( u�
.. versionadded:: 2014.7.0
Create new custom table.
CLI Example:
.. code-block:: bash
salt '*' nftables.new_table filter
IPv6:
salt '*' nftables.new_table filter family=ipv6
u u commentu resultu Table needs to be specifiedR u {0} add table {1} {2}u cmd.runRA u Table {0} in family {1} createdu, Table {0} in family {1} could not be created( R
RO R R R R R ( R$ R R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt new_table' s$
c C@ s� i d d 6t d 6} | s( d | d <| St | d | �} | d sH | St | } d j t � | | � } t d | d t �} | s� d j | | � | d <t | d <n d
j | | � | d <| S( u�
.. versionadded:: 2014.7.0
Create new custom table.
CLI Example:
.. code-block:: bash
salt '*' nftables.delete_table filter
IPv6:
salt '*' nftables.delete_table filter family=ipv6
u u commentu resultu Table needs to be specifiedR u {0} delete table {1} {2}u cmd.runRA u Table {0} in family {1} deletedu, Table {0} in family {1} could not be deleted( R
RO R R R R R ( R$ R R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt delete_tableO s$
c C@ sa i d d 6t d 6} | s( d | d <| St | d | �} | d sH | St | | d | �} | d r� d j | | | � | d <| St | } d j t � | | | � } | s� | s� | r| r� | r� t j | � r� d j | | | | � } qd | d <| Sn t d
| d t �}
|
sDd j | | | � | d <t | d <n d
j | | | � | d <| S( uL
.. versionadded:: 2014.7.0
Create new chain to the specified table.
CLI Example:
.. code-block:: bash
salt '*' nftables.new_chain filter input
salt '*' nftables.new_chain filter input \
table_type=filter hook=input priority=0
salt '*' nftables.new_chain filter foo
IPv6:
salt '*' nftables.new_chain filter input family=ipv6
salt '*' nftables.new_chain filter input \
table_type=filter hook=input priority=0 family=ipv6
salt '*' nftables.new_chain filter foo family=ipv6
u u commentu resultu Chain needs to be specifiedR u3 Chain {0} in table {1} in family {2} already existsu {0} add chain {1} {2} {3}u, {0} \{{ type {1} hook {2} priority {3}\; \}}u( Table_type, hook, and priority required.u cmd.runRA u, Chain {0} in table {1} in family {2} createdu9 Chain {0} in table {1} in family {2} could not be created(
R
RO RP R R R R R R R ( R$ R% t
table_typet hookt priorityR R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt new_chainw s<
c C@ s� i d d 6t d 6} | s( d | d <| St | d | �} | d sH | St | | d | �} | d sk | St | } d j t � | | | � } t d | d t �} | s� d j | | | � | d <t | d <n d
j | | | � | d <| S( uv
.. versionadded:: 2014.7.0
Delete the chain from the specified table.
CLI Example:
.. code-block:: bash
salt '*' nftables.delete_chain filter input
salt '*' nftables.delete_chain filter foo
IPv6:
salt '*' nftables.delete_chain filter input family=ipv6
salt '*' nftables.delete_chain filter foo family=ipv6
u u commentu resultu Chain needs to be specifiedR u {0} delete chain {1} {2} {3}u cmd.runRA u, Chain {0} in table {1} in family {2} deletedu9 Chain {0} in table {1} in family {2} could not be deleted( R
RO RP R R R R R ( R$ R% R R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt delete_chain� s,
c C@ si i d j | | | � d 6t d 6} | s7 d | d <| S| sK d | d <| St | d | �} | d sk | St | | d | �} | d s� | St | | | d | �} | d r� d j | | | | � | d <| St | } d j t � | | | | � } t d | d
t �} t | � d k rIt | d <d j | | | | � | d <n d
j | | | | � | d <| S( uL
Append a rule to the specified table & chain.
This function accepts a rule in a standard nftables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Example:
.. code-block:: bash
salt '*' nftables.append filter input \
rule='tcp dport 22 log accept'
IPv6:
salt '*' nftables.append filter input \
rule='tcp dport 22 log accept' \
family=ipv6
u4 Failed to append rule {0} to chain {1} in table {2}.u commentu resultu Chain needs to be specifiedu Rule needs to be specifiedR u< Rule {0} chain {1} in table {2} in family {3} already existsu {0} add rule {1} {2} {3} {4}u cmd.runRA i u6 Added rule "{0}" chain {1} in table {2} in family {3}.u> Failed to add rule "{0}" chain {1} in table {2} in family {3}.(
R R
RO RP RQ R R R t lenR ( R$ R% R, R R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyR" � s<
c
C@ s� i d j | | � d 6t d 6} | s4 d | d <| S| sH d | d <| St | d | �} | d sh | St | | d | �} | d s� | St | | | d | �} | d r� d j | | | | � | d <| St | } | rd j t � | | | | | � } n d j t � | | | | � } t d
| d t �} t | � d k rpt | d <d
j | | | | � | d <n d j | | | | � | d <| S( u�
Insert a rule into the specified table & chain, at the specified position.
If position is not specified, rule will be inserted in first position.
This function accepts a rule in a standard nftables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Examples:
.. code-block:: bash
salt '*' nftables.insert filter input \
rule='tcp dport 22 log accept'
salt '*' nftables.insert filter input position=3 \
rule='tcp dport 22 log accept'
IPv6:
salt '*' nftables.insert filter input \
rule='tcp dport 22 log accept' \
family=ipv6
salt '*' nftables.insert filter input position=3 \
rule='tcp dport 22 log accept' \
family=ipv6
u' Failed to insert rule {0} to table {1}.u commentu resultu Chain needs to be specifiedu Rule needs to be specifiedR u< Rule {0} chain {1} in table {2} in family {3} already existsu, {0} insert rule {1} {2} {3} position {4} {5}u {0} insert rule {1} {2} {3} {4}u cmd.runRA i u6 Added rule "{0}" chain {1} in table {2} in family {3}.u> Failed to add rule "{0}" chain {1} in table {2} in family {3}.(
R R
RO RP RQ R R R Rc R (
R$ R% R' R, R R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt insert' sB
c
C@ sv i d j | | � d 6t d 6} | r: | r: d | d <| St | d | �} | d sZ | St | | d | �} | d s} | St | | | d | �} | d s� d j | | | | � | d <| S| s� t | | | | � } n t | } d j t � | | | | � } t d | d t �} t | � d
k rVt
| d <d j | | | | � | d <n d j | | | | � | d <| S(
u(
Delete a rule from the specified table & chain, specifying either the rule
in its entirety, or the rule's position in the chain.
This function accepts a rule in a standard nftables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Examples:
.. code-block:: bash
salt '*' nftables.delete filter input position=3
salt '*' nftables.delete filter input \
rule='tcp dport 22 log accept'
IPv6:
salt '*' nftables.delete filter input position=3 family=ipv6
salt '*' nftables.delete filter input \
rule='tcp dport 22 log accept' \
family=ipv6
u' Failed to delete rule {0} in table {1}.u commentu resultu+ Only specify a position or a rule, not bothR u< Rule {0} chain {1} in table {2} in family {3} does not existu& {0} delete rule {1} {2} {3} handle {4}u cmd.runRA i u; Deleted rule "{0}" in chain {1} in table {2} in family {3}.uA Failed to delete rule "{0}" in chain {1} table {2} in family {3}( R R
RO RP RQ RY R R R Rc R (
R$ R% R' R, R R* RU R. R R ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt deleteq s:
c C@ s/ i d j | | � d 6t d 6} t | d | �} | d s@ | St | } | r� t | | d | �} | d ss | Sd j t � | | | � } d j | | | � } n* d j t � | | � } d j | | � } t d | d
t �} t | � d k rt | d <d j | � | d <n d
j | � | d <| S( uB
Flush the chain in the specified table, flush all chains in the specified
table if chain is not specified.
CLI Example:
.. code-block:: bash
salt '*' nftables.flush filter
salt '*' nftables.flush filter input
IPv6:
salt '*' nftables.flush filter input family=ipv6
u2 Failed to flush rules from chain {0} in table {1}.u commentu resultR u {0} flush chain {1} {2} {3}u* from chain {0} in table {1} in family {2}.u {0} flush table {1} {2}u from table {0} in family {1}.u cmd.runRA i u Flushed rules {0}u Failed to flush rules {0}( R R
RO R RP R R Rc R ( R$ R% R R* RU R. R t commentR ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt flush� s0
(+ t __doc__t
__future__R R R t loggingRB t salt.extR t salt.utils.dataR t salt.utils.filest salt.utils.patht
salt.stateR R t salt.exceptionsR t getLoggert __name__t logR R R R R t NoneR3 R@ RE RN RY RQ RP RO R\ R] Ra Rb R" Rd Re Rg ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/nftables.pyt <module> sP
� !!;8% ( (B1=JC
Mini Shell