Current File : //lib/python2.7/site-packages/salt/states/nftables.pyo
�
���^c @@ s� d Z d d l m Z m Z m Z d d l m Z d d l Z e j e
� Z d � Z d d d d d d � Z d d d � Z d d
� Z d d � Z d d � Z d d
� Z d S( u
Management of nftables
======================
This is an nftables-specific module designed to manage Linux firewalls. It is
expected that this state module, and other system-specific firewall states, may
at some point be deprecated in favor of a more generic `firewall` state.
.. code-block:: yaml
httpd:
nftables.append:
- table: filter
- chain: input
- jump: accept
- match: state
- connstate: new
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
httpd:
nftables.append:
- table: filter
- family: ipv6
- chain: INPUT
- jump: ACCEPT
- match: state
- connstate: NEW
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
httpd:
nftables.insert:
- position: 1
- table: filter
- chain: INPUT
- jump: ACCEPT
- match: state
- connstate: NEW
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
httpd:
nftables.insert:
- position: 1
- table: filter
- family: ipv6
- chain: INPUT
- jump: ACCEPT
- match: state
- connstate: NEW
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
httpd:
nftables.delete:
- table: filter
- chain: INPUT
- jump: ACCEPT
- match: state
- connstate: NEW
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
httpd:
nftables.delete:
- position: 1
- table: filter
- chain: INPUT
- jump: ACCEPT
- match: state
- connstate: NEW
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
httpd:
nftables.delete:
- table: filter
- family: ipv6
- chain: INPUT
- jump: ACCEPT
- match: state
- connstate: NEW
- dport: 80
- proto: tcp
- sport: 1025:65535
- save: True
output:
nftables.chain_present:
- family: ip
- table: filter
output:
nftables.chain_absent:
- family: ip
- table: filter
i ( t absolute_importt print_functiont unicode_literals( t STATE_INTERNAL_KEYWORDSNc C@ s d t k r d St S( uA
Only load if the locale module is available in __salt__
u nftables.versionu nftables( t __salt__t False( ( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt __virtual__z s u filteru ipv4c C@ s i | d 6i d 6d d 6d d 6} t d | | d | �} | d t k rr t | d <d j | | | � | d <| St d | | d
| d | d | d | �} | d t k r� i | d
6| d <t | d <d j | | | � | d <| St | d <d j | | | d j � | � | d <| Sd S( u�
.. versionadded:: 2014.7.0
Verify the chain is exist.
name
A user-defined chain name.
table
The table to own the chain.
family
Networking family, either ipv4 or ipv6
u nameu changesu resultu u commentu nftables.check_chaint familyu8 nftables {0} chain is already exist in {1} table for {2}u nftables.new_chaint
table_typet hookt priorityu localeu6 nftables {0} chain in {1} table create success for {2}u4 Failed to create {0} chain in {1} table: {2} for {3}N( t NoneR t Truet formatR t strip( t namet tableR R R
R t rett chain_checkt res( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt
chain_present� s<
c C@ s9 i | d 6i d 6d d 6d d 6} t d | | | � } | se t | d <d j | | | � | d <| St d | | | � } | r t d | | | � } | t k r� i | d
6| d <t | d <d j | | | � | d <q5t | d <d j | | | j � | � | d <n, t | d <d
j | | | j � | � | d <| S( u�
.. versionadded:: 2014.7.0
Verify the chain is absent.
family
Networking family, either ipv4 or ipv6
u nameu changesu resultu u commentu nftables.check_chainu9 nftables {0} chain is already absent in {1} table for {2}u nftables.flushu nftables.delete_chainu localeu6 nftables {0} chain in {1} table delete success for {2}u4 Failed to delete {0} chain in {1} table: {2} for {3}u3 Failed to flush {0} chain in {1} table: {2} for {3}N( R R R R
R R ( R R R R R t flush_chaint command( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt chain_absent� s8
c K@ s5 i | d 6i d 6d d 6d d 6} x$ t D] } | | k r) | | =q) q) Wt d d | | � } | d sm | S| d } t d d t d | d
d | � } | d s� | S| d } t d | d
| d | | � } | d r t | d <d j | | j � | � | d <| Sd t k rBt d rBd j | | j � | � | d <| St d | d
| d | | � } | d r�i | d 6| d <t | d <d j | | j � | � | d <d | k r�| d r�t d d d d | � d j | | j � | � | d <q�n | St | d <d j | | j � | | d � | d <| Sd S( u�
.. versionadded:: 0.17.0
Append a rule to a chain
name
A user-defined name to call this rule by in another part of a state or
formula. This should not be an actual rule.
family
Network family, ipv4 or ipv6.
All other arguments are passed in with the same name as the long option
that would normally be used for nftables, with one exception: `--state` is
specified as `connstate` instead of `state` (not to be confused with
`ctstate`).
u nameu changesu resultu u commentu nftables.build_ruleR u rulet fullR u addu nftables.checku tableu chainu/ nftables rule for {0} already set ({1}) for {2}u testu3 nftables rule for {0} needs to be set ({1}) for {2}u nftables.appendu localeu) Set nftables rule for {0} to: {1} for {2}u saveu
nftables.savet filenameu3 Set and Saved nftables rule for {0} to: {1} for {2}uH Failed to set nftables rule for {0}.
Attempted rule was {1} for {2}.
{3}N( R t _STATE_INTERNAL_KEYWORDSR R R
R t __opts__R ( R R t kwargsR t ignoreR t ruleR ( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt append� sl
"
c K@ s2 i | d 6i d 6d d 6d d 6} x$ t D] } | | k r) | | =q) q) Wt d d | | � } | d sm | S| d } t d d t d | d
d | � } | d s� | S| d } t d | d
| d | | � } | d r t | d <d j | | | j � � | d <| Sd t k rBt d rBd j | | | j � � | d <| St d | d
| d | d | | � } | d ri | d 6| d <t | d <d j | | j � | � | d <d | k r | d r t d d d d | � d j | | j � | � | d <q n | St | d <d j | | j � � | d <| Sd S( u
.. versionadded:: 2014.7.0
Insert a rule into a chain
name
A user-defined name to call this rule by in another part of a state or
formula. This should not be an actual rule.
family
Networking family, either ipv4 or ipv6
All other arguments are passed in with the same name as the long option
that would normally be used for nftables, with one exception: `--state` is
specified as `connstate` instead of `state` (not to be confused with
`ctstate`).
u nameu changesu resultu u commentu nftables.build_ruleR u ruleR R u insertu nftables.checku tableu chainu/ nftables rule for {0} already set for {1} ({2})u testu3 nftables rule for {0} needs to be set for {1} ({2})u nftables.insertu positionu localeu) Set nftables rule for {0} to: {1} for {2}u saveu
nftables.saveR u3 Set and Saved nftables rule for {0} to: {1} for {2}u; Failed to set nftables rule for {0}.
Attempted rule was {1}N( R R R R R
R R R ( R R R R R R R R ( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt insert4 st
c K@ sh i | d 6i d 6d d 6d d 6} x$ t D] } | | k r) | | =q) q) Wt d d | | � } | d sm | S| d } t d d t d | d
d | � } | d s� | S| d } t d | d
| d | | � } | d s t | d <d j | | | j � � | d <| Sd t k rBt d rBd j | | | j � � | d <| Sd | k r|t d | d
| d d | d | d �} n' t d | d
| d d | d | �} | d r:i | d 6| d <t | d <d j | | j � � | d <d | k r6| d r6t d d d d | � d j | | j � | � | d <q6n | St | d <d j | | j � � | d <| Sd S( u�
.. versionadded:: 2014.7.0
Delete a rule to a chain
name
A user-defined name to call this rule by in another part of a state or
formula. This should not be an actual rule.
family
Networking family, either ipv4 or ipv6
All other arguments are passed in with the same name as the long option
that would normally be used for nftables, with one exception: `--state` is
specified as `connstate` instead of `state` (not to be confused with
`ctstate`).
u nameu changesu resultu u commentu nftables.build_ruleR u ruleR R u Du nftables.checku tableu chainu2 nftables rule for {0} already absent for {1} ({2})u testu7 nftables rule for {0} needs to be deleted for {1} ({2})u positionu nftables.deletet positionR u localeu Delete nftables rule for {0} {1}u saveu
nftables.saveR u2 Deleted and Saved nftables rule for {0} for {1}{2}u> Failed to delete nftables rule for {0}.
Attempted rule was {1}N( R R R R R
R R R ( R R R R R R R R ( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt delete� sx
"
c K@ s� i | d 6i d 6d d 6d d 6} x$ t D] } | | k r) | | =q) q) Wd | k rb d | d <n t d | d d | �} | d s� t | d <d
j | d | � | d <| Sd | k r� d | d <nZ t d | d | d d | �} | d s!t | d <d
j | d | d | � | d <| St d | d | d | � } | d r�i | d 6| d <t | d <d j | d | d | � | d <| St | d <d | d <| Sd S( u�
.. versionadded:: 2014.7.0
Flush current nftables state
family
Networking family, either ipv4 or ipv6
u nameu changesu resultu u commentu tableu filteru nftables.check_tableR u> Failed to flush table {0} in family {1}, table does not exist.u chainu nftables.check_chainuK Failed to flush chain {0} in table {1} in family {2}, chain does not exist.u nftables.flushu localeu6 Flush nftables rules in {0} table {1} chain {2} familyu Failed to flush nftables rulesN( R R R R R
R ( R R R R R R ( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt flush� sT
( t __doc__t
__future__R R R t
salt.stateR R t loggingt getLoggert __name__t logR R R R R R R" R# ( ( ( s8 /usr/lib/python2.7/site-packages/salt/states/nftables.pyt <module>p s 6- P S Y
Mini Shell