Current File : //usr/lib/python2.7/site-packages/salt/modules/iptables.pyo
�
���^c @@ sZ d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z d d l Z d d l
Z d d l m Z d d l m Z d d l m Z d d l Z e j e � Z d � Z d d � Z d d
� Z d d � Z d � Z e d
� Z d d � Z d e e d e d d � Z! e d d � Z" d d � Z# d e e d d � Z$ d e d d � Z% d e e d d � Z& e d d � Z' d e e d d � Z( d e d d � Z) d e d d � Z* d e d d � Z+ d e e d d � Z, d e e e d d � Z- e e e d d � Z. d d d d � Z/ e e0 d d � Z1 d! � Z2 d S(" u�
Support for iptables
Configuration Options
---------------------
The following options can be set in the minion config, grains, pillar, or
master config. The configuration is read using :py:func:`config.get
<salt.modules.config.get>`.
- ``iptables.save_filters``: List of REGEX strings to FILTER OUT matching lines
This is useful for filtering out chains, rules, etc that you do not wish to
persist, such as ephemeral Docker rules.
The default is to not filter out anything.
.. code-block:: yaml
iptables.save_filters:
- "-j CATTLE_PREROUTING"
- "-j DOCKER"
- "-A POSTROUTING"
- "-A CATTLE_POSTROUTING"
- "-A FORWARD"
i ( t absolute_importt unicode_literalst print_functionN( t STATE_INTERNAL_KEYWORDS( t
SaltException( t sixc C@ s# t j j j d � s t d f St S( u7
Only load the module if iptables is installed
u iptablesuG The iptables execution module cannot be loaded: iptables not installed.( t saltt utilst patht whicht Falset True( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt __virtual__1 s
u ipv4c C@ s6 | d k r t j j j d � St j j j d � Sd S( uG
Return correct command based on the family, e.g. ipv4 or ipv6
u ipv6u ip6tablesu iptablesN( R R R R ( t family( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt
_iptables_cmd; s c C@ s9 d j t | � � } | t d | d d �k r5 t St S( u�
Return truth of whether iptables has `option`. For example:
.. code-block:: python
_has_option('--wait')
_has_option('--check', family='ipv6')
u
{0} --helpu cmd.runt output_loglevelu quiet( t formatR t __salt__R R
( t optionR
t cmd( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt _has_optionE s c C@ s# t d d k r' | d k r d Sd Sn� t d d k rN | d k rG d Sd Sn� t d d k ru | d k rn d
Sd Sn� t d d
k r� | d k r� d Sd Sn� t d d k r� d St d d k r� | d k r� d Sd SnH t d d k r� | d k r� d Sd Sn! t d d j t d � d � � d S( u@
Some distros have a specific location for config files
u os_familyu RedHatu ipv6u /etc/sysconfig/ip6tablesu /etc/sysconfig/iptablesu Archu /etc/iptables/ip6tables.rulesu /etc/iptables/iptables.rulesu Debianu /etc/iptables/rules.v6u /etc/iptables/rules.v4u osu Gentoou /var/lib/ip6tables/rules-saveu /var/lib/iptables/rules-saveu Suseu+ /etc/sysconfig/scripts/SuSEfirewall2-customu Voidu ipv4u Alpineu /etc/iptables/rules6-saveu /etc/iptables/rules-saveu Saving iptables to file is notu supported on {0}.u$ Please file an issue with SaltStackN( t
__grains__R R ( R
( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt _confT s: c C@ s t d d g � } | S( u
Return array of strings from `save_filters` in config.
This array will be pulled from minion config, minion grains,
minion pillar, or master config. The default value returned is [].
.. code-block:: python
_conf_save_filters()
u
config.optionu iptables.save_filters( R ( t config( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt _conf_save_filters s c @ s� d t k r� g t d <xg | p% t � D]S } y t d j t j | � � Wq& t j k
rx } t j d | | � q& q& Xq& Wn t t d � d k r� g | j t
� D], � t � f d � t d D� � s� � ^ q� } d j | � S| S( ur
Return string with `save_filter` regex entries removed. For example:
If `filters` is not provided, it will be pulled from minion config,
minion grains, minion pillar, or master config. Default return value
if no filters found is the original cmd_output string.
.. code-block:: python
_regex_iptables_save(cmd_output, ['-A DOCKER*'])
u iptables.save_filtersu Skipping regex rule: '%s': %si c 3@ s | ] } | j � � Vq d S( N( t search( t .0t reg( t line( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pys <genexpr>� s u (
t __context__R t appendt ret compilet errort logt warningt lent
splitlinesR t anyt join( t
cmd_outputt filterst patternt et _filtered_cmd_output( ( R s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt _regex_iptables_save� s
c C@ s3 d j t | � � } t d | � j � } | d S( u�
Return version from iptables --version
CLI Example:
.. code-block:: bash
salt '*' iptables.version
IPv6:
salt '*' iptables.version family=ipv6
u
{0} --versionu cmd.runi ( R R R t split( R
R t out( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt version� s
u filteru c s @ s� d � k r" � j d � � d <n � j d d� � � j d d� � x7 t t � d d d g D] } | � k r\ � | =q\ q\ Wg } t } t j d � � � � f d � }
d
� k r� | j d j |
d
� � d
� � � d
=n d � k r| j d
j |
d � � d � � � d =n d � k rT� j d � d k rT� d � d <� d =n d � k r�| s�| j d j |
d � � d � � t
} n � d =n d � k r�� d } t | t � s�| j d � } n xf | D]^ } | j d j | � � d � k r�| j
� d� k r�| j d j � d � � � d =q�q�Wd � k r�� j d � d k r�| j d j |
d � � d � � � d =n � d =n d � k rDt � d t j � r�� d g � d <n xm � d D]a }
d } |
j d � s�|
j d � r d } t j � d |
� }
n | j d j | |
� � q�W� d =n d! � k r�d" | k rl| j d" � n | j d# j |
d! � � d! � � � d! =n d$ � k r�| j d% j |
d$ � � d$ � � � d$ =n d& � k r | j d' j |
d& � � d& � � � d& =n xAd� D]9} | � k rd* | k rJ| j d* � | sJd+ Sn � | } t | t � r�t d, � | D� � r�g | D]! } t j � d t | � � ^ q�} | j d � n d j d- � | D� � } nU t | � j d � s�t | � j d � r"t j � d | � } | j d � n | } | j d. j | | � � � | =qqWd/ � k r�d0 | k rw| j d0 � n | j d1 j � d/ � � � d/ =n d2 � k r�� d2 r�| j d3 j |
d2 � � d2 � � � d2 =n g } d� } x� | D]� } | � k r�� | � � d� k r2| j d� j | � � nT t � f d� � t j D� � rm| j d� j | � � � n | j d. j | � � � � | =q�q�Wx� � D]z } |
| � } � | � t | � d� k r�d� n d� } � d� k r�d n d� j � � � | j d� j | | | � � � q�W| | 7} | r�| s3d� S| s=d� S| sGd� S| d� k r\d� } n d� } t d� | � rwd� n d } d� j t | � | | | | | | d� j | � � Sd� j | � S(� u�
Build a well-formatted iptables rule based on kwargs. A `table` and `chain`
are not required, unless `full` is True.
If `full` is `True`, then `table`, `chain` and `command` are required.
`command` may be specified as either a short option ('I') or a long option
(`--insert`). This will return the iptables command, exactly as it would
be used from the command line.
If a position is required (as with `-I` or `-D`), it may be specified as
`position`. This will only be useful if `full` is True.
If `state` is passed, it will be ignored, use `connstate`.
If `connstate` is passed in, it will automatically be changed to `state`.
To pass in jump options that doesn't take arguments, pass in an empty
string.
.. note::
Whereas iptables will accept ``-p``, ``--proto[c[o[l]]]`` as synonyms
of ``--protocol``, if ``--proto`` appears in an iptables command after
the appearance of ``-m policy``, it is interpreted as the ``--proto``
option of the policy extension (see the iptables-extensions(8) man
page).
CLI Examples:
.. code-block:: bash
salt '*' iptables.build_rule match=state \
connstate=RELATED,ESTABLISHED jump=ACCEPT
salt '*' iptables.build_rule filter INPUT command=I position=3 \
full=True match=state connstate=RELATED,ESTABLISHED jump=ACCEPT
salt '*' iptables.build_rule filter INPUT command=A \
full=True match=state connstate=RELATED,ESTABLISHED \
source='127.0.0.1' jump=ACCEPT
.. Invert Rules
salt '*' iptables.build_rule filter INPUT command=A \
full=True match=state connstate=RELATED,ESTABLISHED \
source='!127.0.0.1' jump=ACCEPT
salt '*' iptables.build_rule filter INPUT command=A \
full=True match=state connstate=RELATED,ESTABLISHED \
destination='not 127.0.0.1' jump=ACCEPT
IPv6:
salt '*' iptables.build_rule match=state \
connstate=RELATED,ESTABLISHED jump=ACCEPT \
family=ipv6
salt '*' iptables.build_rule filter INPUT command=I position=3 \
full=True match=state connstate=RELATED,ESTABLISHED jump=ACCEPT \
family=ipv6
u targetu jumpu nameu stateu chainu saveu tableu
(!|not)\s?c @ sO t � | � } | j d � s. | j d � rK t j � d | � � | <d Sd S( u�
Will check if the defined argument is intended to be negated,
(i.e. prefixed with '!' or 'not'), and add a '! ' to the rule.
The prefix will be removed from the value in the kwargs dict.
u !u notu u ! ( t strt
startswithR t sub( t argt value( t bang_not_patt kwargs( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt maybe_add_negation
s
u ifu {0}-i {1}u ofu {0}-o {1}u protou matchu policyu protocolu {0}-p {1}u ,u -m {0}u name_u pknocku quota2u recentu
--name {0}u {0}--proto {1}u match-setu u !u notu ! u -m set {0}--match-set {1}u connstateu -m stateu {0}--state {1}u dportu {0}--dport {1}u sportu {0}--sport {1}u dportsu sportsu -m multiportu! Error: protocol must be specifiedc s@ s? | ]5 } t | � j d � s3 t | � j d � r | Vq d S( u !u notN( R1 R2 ( R t i( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pys <genexpr>^ s c s@ s | ] } t | � Vq d S( N( R1 ( R R9 ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pys <genexpr>a s u --{0} {1}u commentu
-m commentu --comment "{0}"u setu {0}--match-set {1}u ju add-setu and-marku and-tosu
checksum-fillu clamp-mss-to-pmtuu
clustermacu cteventsu ctmasku del-setu ecn-tcp-removeu existu expeventsu gatewayu hash-initu hashmodeu helperu labelu
local-nodeu log-ip-optionsu log-levelu
log-prefixu log-tcp-optionsu log-tcp-sequenceu log-uidu masku newu nfmasku nflog-groupu nflog-prefixu nflog-rangeu nflog-thresholdu nodstu notracku on-ipu on-portu or-marku or-tosu
persistentu
queue-balanceu queue-bypassu queue-numu randomu rateest-ewmalogu rateest-intervalu rateest-nameu reject-withu restoreu restore-marku save-marku selctxu set-classu set-dscpu set-dscp-classu set-marku set-mssu set-tosu set-xmarku
strip-optionsu timeoutu tou to-destinationu to-portsu to-sourceu total-nodesu tproxy-marku ttl-decu ttl-incu ttl-setu typeu ulog-cprangeu ulog-nlgroupu ulog-prefixu ulog-qthresholdu xor-marku xor-tosu zoneu dst-pfxu hl-decu hl-incu hl-setu hmark-dport-masku hmark-dst-prefixu hmark-modu hmark-offsetu hmark-proto-masku hmark-rndu hmark-spi-masku hmark-sport-masku hmark-src-prefixu hmark-tupleu led-always-blinku led-delayu led-trigger-idu queue-cpu-fanoutu src-pfxu to-portu addru and-masku deludeu honeypotu or-masku prefixu resetu reuseu set-macu shiftu staticu tarpitu tnameu ttlu --{0}c 3@ s! | ] } | t � � k Vq d S( N( R1 ( R t ws_char( R5 ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pys <genexpr>� s u --{0} "{1}"i u -u --u {0}u {0}{1}{2}{3}u" Error: Table needs to be specifiedu" Error: Chain needs to be specifiedu$ Error: Command needs to be specifiedu
ACDIRLSFZNXPEu --waitu! {0} {1} -t {2} {3}{4} {5} {6} {7}u N( u pknocku quota2u recent( u dportsu sports(p u ju jumpu add-setu and-marku and-tosu
checksum-fillu clamp-mss-to-pmtuu
clustermacu cteventsu ctmasku del-setu ecn-tcp-removeu existu expeventsu gatewayu hash-initu hashmodeu helperu labelu
local-nodeu log-ip-optionsu log-levelu
log-prefixu log-tcp-optionsu log-tcp-sequenceu log-uidu masku newu nfmasku nflog-groupu nflog-prefixu nflog-rangeu nflog-thresholdu nodstu notracku on-ipu on-portu or-marku or-tosu
persistentu
queue-balanceu queue-bypassu queue-numu randomu rateest-ewmalogu rateest-intervalu rateest-nameu reject-withu restoreu restore-marku save-marku selctxu set-classu set-dscpu set-dscp-classu set-marku set-mssu set-tosu set-xmarku
strip-optionsu timeoutu tou to-destinationu to-portsu to-sourceu total-nodesu tproxy-marku ttl-decu ttl-incu ttl-setu typeu ulog-cprangeu ulog-nlgroupu ulog-prefixu ulog-qthresholdu xor-marku xor-tosu zoneu dst-pfxu hl-decu hl-incu hl-setu hmark-dport-masku hmark-dst-prefixu hmark-modu hmark-offsetu hmark-proto-masku hmark-rndu hmark-spi-masku hmark-sport-masku hmark-src-prefixu hmark-tupleu led-always-blinku led-delayu led-trigger-idu queue-cpu-fanoutu src-pfxu to-portu addru and-masku deludeu honeypotu or-masku prefixu resetu reuseu set-macu shiftu staticu tarpitu tnameu ttl( Nu ( Nu ( t popt Nonet listt _STATE_INTERNAL_KEYWORDSR
R R R R t getR t
isinstanceR. t stripR t string_typesR2 R3 R& R1 R' t stringt
whitespaceR$ R R ( t tablet chaint commandt positiont fullR
R7 t ignoret rulet protocolR8 t match_valuet matcht match_sett negative_match_sett
multiport_argt mp_valuet itemt dportst
after_jumpt after_jump_argumentst after_jump_argumentt keyt negationt flagt wait( ( R6 R7 R5 s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt
build_rule� s� ;
#
#
!
#
!#
#
#
#
. *
#
!#
"c C@ s t d | d | � S( u�
Return a data structure of the rules in the conf file
CLI Example:
.. code-block:: bash
salt '*' iptables.get_saved_rules
IPv6:
salt '*' iptables.get_saved_rules family=ipv6
t conf_fileR
( t _parse_conf( R] R
( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt get_saved_rules$ s
c C@ s t d t d | � S( u�
Return a data structure of the current, in-memory rules
CLI Example:
.. code-block:: bash
salt '*' iptables.get_rules
IPv6:
salt '*' iptables.get_rules family=ipv6
t in_memR
( R^ R ( R
( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt get_rules4 s c C@ sI | s
d St | d | �} y | | | d SWn t k
rD d SXd S( u�
Return the current policy for the specified table/chain
CLI Examples:
.. code-block:: bash
salt '*' iptables.get_saved_policy filter INPUT
salt '*' iptables.get_saved_policy filter INPUT \
conf_file=/etc/iptables.saved
IPv6:
salt '*' iptables.get_saved_policy filter INPUT family=ipv6
salt '*' iptables.get_saved_policy filter INPUT \
conf_file=/etc/iptables.saved family=ipv6
u" Error: Chain needs to be specifiedR
u policyN( R^ t KeyErrorR< ( RE RF R] R
t rules( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt get_saved_policyE s
c C@ sL | s
d St d t d | � } y | | | d SWn t k
rG d SXd S( u�
Return the current policy for the specified table/chain
CLI Example:
.. code-block:: bash
salt '*' iptables.get_policy filter INPUT
IPv6:
salt '*' iptables.get_policy filter INPUT family=ipv6
u" Error: Chain needs to be specifiedR` R
u policyN( R^ R Rb R< ( RE RF R
Rc ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt
get_policya s
c C@ sd | s
d S| s d St d | � r) d n d } d j t | � | | | | � } t d | � } | S( u�
Set the current policy for the specified table/chain
CLI Example:
.. code-block:: bash
salt '*' iptables.set_policy filter INPUT ACCEPT
IPv6:
salt '*' iptables.set_policy filter INPUT ACCEPT family=ipv6
u" Error: Chain needs to be specifiedu# Error: Policy needs to be specifiedu --waitu u {0} {1} -t {2} -P {3} {4}u cmd.run( R R R R ( RE RF t policyR
R[ R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt
set_policyx s
c C@ s� t � r | r t | � } n t j d | � t j j | � } t j j | � sc t j | � n d j t | � � } t
d | � } t t � � d k r� t
| � } n t
d | | � } | S( u�
Save the current in-memory rules to disk
CLI Example:
.. code-block:: bash
salt '*' iptables.save /etc/sysconfig/iptables
IPv6:
salt '*' iptables.save /etc/sysconfig/iptables family=ipv6
u Saving rules to %su {0}-saveu cmd.runi u
file.write( R R" t debugt osR t dirnamet isdirt makedirsR R R R$ R R- ( t filenameR
t
parent_dirR t iptR/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt save� s
c C@ sh | s
d S| s d St | � } t d | � r` d j | | | | � } t d | d d �} n� t t j � � } t d d j | | | � � t d d j | | | | � � t d d
j | � � } t d d j | | | � � t d d j | | | � � xQ | j � D]C } | j d
j | � � r| j | | � | j � k rRt
SqqWt S| sdt
S| S( u�
Check for the existence of a rule in the table and chain
This function accepts a rule in a standard iptables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Example:
.. code-block:: bash
salt '*' iptables.check filter INPUT \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'
IPv6:
salt '*' iptables.check filter INPUT \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
family=ipv6
u" Error: Chain needs to be specifiedu! Error: Rule needs to be specifiedu --checku {0} -t {1} -C {2} {3}u cmd.runR u quietu {0} -t {1} -N {2}u {0} -t {1} -A {2} {3}u {0}-saveu {0} -t {1} -F {2}u {0} -t {1} -X {2}u -A {0}( R R R R t hext uuidt getnodeR% R2 t replaceR R
( RE RF RK R
t ipt_cmdR R/ t _chain_nameR9 ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt check� s, c C@ sc | s
d Sd j t | � | � } t d | � j d j | � � } | d k rY t } n t } | S( u
.. versionadded:: 2014.1.0
Check for the existence of a chain in the table
CLI Example:
.. code-block:: bash
salt '*' iptables.check_chain filter INPUT
IPv6:
salt '*' iptables.check_chain filter INPUT family=ipv6
u" Error: Chain needs to be specifiedu {0}-save -t {1}u cmd.runu :{0} i����( R R R t findR R
( RE RF R
R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt check_chain� s " c C@ sf | s
d St d | � r d n d } d j t | � | | | � } t d | � } | sb t } n | S( u
.. versionadded:: 2014.1.0
Create new custom chain to the specified table.
CLI Example:
.. code-block:: bash
salt '*' iptables.new_chain filter CUSTOM_CHAIN
IPv6:
salt '*' iptables.new_chain filter CUSTOM_CHAIN family=ipv6
u" Error: Chain needs to be specifiedu --waitu u {0} {1} -t {2} -N {3}u cmd.run( R R R R R ( RE RF R
R[ R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt new_chain s c C@ sf | s
d St d | � r d n d } d j t | � | | | � } t d | � } | sb t } n | S( u
.. versionadded:: 2014.1.0
Delete custom chain to the specified table.
CLI Example:
.. code-block:: bash
salt '*' iptables.delete_chain filter CUSTOM_CHAIN
IPv6:
salt '*' iptables.delete_chain filter CUSTOM_CHAIN family=ipv6
u" Error: Chain needs to be specifiedu --waitu u {0} {1} -t {2} -X {3}u cmd.run( R R R R R ( RE RF R
R[ R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt delete_chain# s c C@ s� | s
d S| s d St d | � r) d n d } t | | | | � } t | t � r] | r] t Sd j t | � | | | | � } t d | � } t | � d k r� t St Sd S( ux
Append a rule to the specified table/chain.
This function accepts a rule in a standard iptables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Example:
.. code-block:: bash
salt '*' iptables.append filter INPUT \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'
IPv6:
salt '*' iptables.append filter INPUT \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
family=ipv6
u" Error: Chain needs to be specifiedu! Error: Rule needs to be specifiedu --waitu u {0} {1} -t {2} -A {3} {4}u cmd.runi N(
R Rw R@ t boolR
R R R R$ R ( RE RF RK R
R[ t returnCheckR R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyR @ s c C@ s� | s
d S| s d S| s d S| d k rw t d | � } t | | | d � } | | d } | d k rw d } qw n t d | � r� d n d } t | | | | � } t | t � r� | r� t Sd
j t | � | | | | | � } t d | � }
|
S( u�
Insert a rule into the specified table/chain, at the specified position.
This function accepts a rule in a standard iptables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
If the position specified is a negative number, then the insert will be
performed counting from the end of the list. For instance, a position
of -1 will insert the rule as the second to last rule. To insert a rule
in the last position, use the append function instead.
CLI Examples:
.. code-block:: bash
salt '*' iptables.insert filter INPUT position=3 \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'
IPv6:
salt '*' iptables.insert filter INPUT position=3 \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
family=ipv6
u" Error: Chain needs to be specifiedu8 Error: Position needs to be specified or use append (-A)u! Error: Rule needs to be specifiedi R
u rulesi u --waitu u {0} {1} -t {2} -I {3} {4} {5}u cmd.run(
Ra R$ R Rw R@ R| R
R R R ( RE RF RH RK R
Rc t sizeR[ R} R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt insertg s( c C@ so | r | r d S| r | } n t d | � r4 d n d } d j t | � | | | | � } t d | � } | S( uR
Delete a rule from the specified table/chain, specifying either the rule
in its entirety, or the rule's position in the chain.
This function accepts a rule in a standard iptables command format,
starting with the chain. Trying to force users to adapt to a new
method of creating rules would be irritating at best, and we
already have a parser that can handle it.
CLI Examples:
.. code-block:: bash
salt '*' iptables.delete filter INPUT position=3
salt '*' iptables.delete filter INPUT \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'
IPv6:
salt '*' iptables.delete filter INPUT position=3 family=ipv6
salt '*' iptables.delete filter INPUT \
rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
family=ipv6
u2 Error: Only specify a position or a rule, not bothu --waitu u {0} {1} -t {2} -D {3} {4}u cmd.run( R R R R ( RE RF RH RK R
R[ R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt delete� s c C@ sM t d | � r d n d } d j t | � | | | � } t d | � } | S( u
Flush the chain in the specified table, flush all chains in the specified
table if not specified chain.
CLI Example:
.. code-block:: bash
salt '*' iptables.flush filter INPUT
IPv6:
salt '*' iptables.flush filter INPUT family=ipv6
u --waitu u {0} {1} -t {2} -F {3}u cmd.run( R R R R ( RE RF R
R[ R R/ ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt flush� s c C@ sN t � r& | r& | r& t | � } n d } | rb t j j j | d � � } | j � } Wd QXn: | r� d j t | � � } t d | � } n t d � � i } d } t
� } x�| j � D]�} t j j j
| � } | j d � r| j d d � } i | | <q� | j d � r�| j � }
|
d j d d � } i | | | <|
d
| | | d <|
d j d
d � j d d � } | j d � \ }
} |
| | | d <| | | | d <g | | | d <i | | | d <q� | j d � r� t j j j | � } d } xE| d
t | � k rO| | d k oE| | d
j d � } | rv| | d
| | | | <| | d
<n | | j d � rB| d
7} | | j d � s�| | d k r�| r�| j | d � qBxo | d
t | � k r>| | d
d k r>| | d
j d � r>| | c d j | j | d
� � 7<q�Wn | d
7} q W| d j d � rs| j d � n g } | j | � \ } } t | � } i } | d } x5 | D]- } | | r�| d k r�| | | | <q�q�W| d d k r&| d d j d � } | | | | d d | <n | | | d d j | � q� q� W| S( ug
If a file is not passed in, and the correct one for this OS is not
detected, return False
u u rNu {0}-saveu cmd.runu A file was not found to parseu *u :i i u policyi u [u ]u packet countu
byte countu rulesu
rules_commentu -Au !u -u {0}i����u appendu commentu "( R R R t filest fopent readR R R R t _parserR% t stringutilst
to_unicodeR2 Rt R. t argst shlex_splitR$ R R; R t parse_known_argst varsR< RA ( R] R` R
Rc t ifileR t retRE t parserR t compsRF t counterst pcountt bcountR� t indext swapt parsed_argst optst _t ret_argsR4 t comment( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyR^ � sz
"'(
#-
$c C@ sp! d } t j j d � r< d d l } | j � } | j } n! d d l } | j � } | j } | d d d d d d �| d d
d d d d �| d d
d d d d �| d d d d d d �| d d d d d d �| d d d d d d �| d d d d d d �| d d d d d d �| d d d d d d �| d! d" d d# d d �| d$ d% d d& d d �| d' d( d d) d d �| d* d+ d d, d d �| d- d. d d/ d d �| d0 d1 d d2 d d �| d3 d4 d d5 d d �| d6 d7 d d8 d d �| d9 d: d d; d d �| d< d= d d> d d �| d? d@ d dA d d �| dB dC d dD d d �| dE d dF d d �| dG d dH d d �| dI d dJ d d �| dK d dL d d �| dM d dN d d �| dO d dP d d �| dQ d dR d d �| dS d dT d d �| dU d dV d d �| dW d dX d d �| dY d dZ d d �| d[ d d\ d d �| d] d d^ d d �| d_ d d` d d �| da d db d d �| dc d dd d d �| de d df d d �| dg d dh d d �| di d dj d d �| dk d dl d d �| dm d dn d d �| do d dp d d �| dq d dr d d �| ds d dt d d �| du d dv d d �| dw d dx d d �| dy d dz d d �| d{ d d| d d �| d} d d~ d d �| d d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d� d d� d d �| d� d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d� d d �| d� d d d d �| dd dd d �| dd dd d �| dd dd d �| ddd d d d �| d
d d d d d �| d
d dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd d d d �| d d d d d �| d d d d d �| d!d d"d d �| d#d d$d d �| d%d d&d d �| d'd d(d d �| d)d d*d d �| d+d d,d d �| d-d d.d d �| d/d d0d d �| d1d d2d d �| d3d d4d d �| d5d d6d d �| d7d d8d d �| d9d d:d d �| d;d d<d d �| d=d d>d d �| d?d d@d d �| dAd dBd d �| dCd dDd d �| dEd dFd d �| dGd dHd d �| dId dJd d �| dKd dLd d �| dMd dNd d �| dOd dPd d �| dQd dRd d �| dSd dTd d �| dUd dVd d �| dWd dXd d �| dYd dZd d �| d[d d\d d �| d]d d^d d �| d_d d`d d �| dad dbd d �| dcd ddd d �| ded dfd d �| dgd dhd d �| did djd d �| dkd dld d �| dmd dnd d �| dod dpd d �| dqd drd d �| dsd dtd d �| dud dvd d �| dwd dxd d �| dyd dzd d �| d{d d|d d �| d}d d~d d �| dd d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d�d d�d d �| d�d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d d d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| d d d
d d �| d d d d d �| d
d dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd d d d �| d d d d d �| d d d d d �| d!d d"d d �| d#d d$d d �| d%d d&d d �| d'd d(d d �| d)d d*d d �| d+d d,d d �| d-d d.d d �| d/d d0d d �| d1d d2d d �| d3d d4d d �| d5d d6d d �| d7d d8d d �| d9d d:d d �| d;d d<d d �| d=d d>d d �| d?d d@d d �| dAd dBd d �| dCd dDd d �| dEd dFd d �| dGd dHd d �| dId dJd d �| dKd dLd d �| dMd dNd d �| dOd dPd d �| dQd dRd d �| dSd dTd d �| dUd dVd d �| dWd dXd d �| dYd dZd d �| d[d d\d d �| d]d d^d d �| d_d d`d d �| dad dbd d �| dcd ddd d �| ded dfd d �| dgd dhd d �| did djd d �| dkd dld d �| dmd dnd d �| dod dpd d �| dqd drd d �| dsd dtd d �| dud dvd d �| dwd dxd d �| dyd dzd d �| d{d d|d d �| d}d d~d d �| dd d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d�d d �| d�d d d d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| d d d
d d �| d d d d d �| d
d dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| dd dd d �| S( u�
This function attempts to list all the options documented in the
iptables(8) and iptables-extensions(8) man pages. They will not all be
used by all parts of the module; use them intelligently and appropriately.
u 2.6i Nu -Au --appendt destu appendt actionu -Du --deleteu deleteu -Iu --insertu insertu -Ru --replaceu replaceu -Lu --listu listu -Fu --flushu flushu -Zu --zerou zerou -Nu --new-chainu new-chainu -Xu --delete-chainu delete-chainu -Pu --policyu policyu -Eu --rename-chainu rename-chainu -pu
--protocolu protocolu -su --sourceu sourceu -du
--destinationu destinationu -ju --jumpu jumpu -gu --gotou gotou -iu --in-interfaceu in-interfaceu -ou --out-interfaceu
out-interfaceu -fu
--fragmentu fragmentu -cu --set-countersu set-countersu -mu --matchu matchu
--src-typeu src-typeu
--dst-typeu dst-typeu --limit-iface-inu limit-iface-inu --limit-iface-outu limit-iface-outu --ahspiu ahspiu --ahlenu ahlenu --ahresu ahresu
--bytecodeu bytecodeu --cgroupu cgroupu --cluster-total-nodesu cluster-total-nodesu --cluster-local-nodeu cluster-local-nodeu --cluster-local-nodemasku cluster-local-nodemasku --cluster-hash-seedu cluster-hash-seedu
--h-lengthu h-lengthu --mangle-mac-su mangle-mac-su --mangle-mac-du mangle-mac-du --commentu commentu --connbytesu connbytesu --connbytes-diru
connbytes-diru --connbytes-modeu connbytes-modeu --labelu labelu --connlimit-uptou connlimit-uptou --connlimit-aboveu connlimit-aboveu --connlimit-masku connlimit-masku --connlimit-saddru connlimit-saddru --connlimit-daddru connlimit-daddru --marku marku --ctstateu ctstateu --ctprotou ctprotou --ctorigsrcu ctorigsrcu --ctorigdstu ctorigdstu --ctreplsrcu ctreplsrcu --ctrepldstu ctrepldstu --ctorigsrcportu
ctorigsrcportu --ctorigdstportu
ctorigdstportu --ctreplsrcportu
ctreplsrcportu --ctrepldstportu
ctrepldstportu
--ctstatusu ctstatusu
--ctexpireu ctexpireu --ctdiru ctdiru --cpuu cpuu --sportu
--source-portu source_portu --dportu --destination-portu destination_portu --dccp-typesu
dccp-typesu
--dccp-optionu dccp-optionu --src-groupu src-groupu --dst-groupu dst-groupu --dscpu dscpu --dscp-classu
dscp-classu --dst-lenu dst-lenu
--dst-optsu dst-optsu
--ecn-tcp-cwru ecn-tcp-cwru
--ecn-tcp-eceu ecn-tcp-eceu --ecn-ip-ectu
ecn-ip-ectu --espspiu espspiu --fragidu fragidu --fraglenu fraglenu --fragresu fragresu --fragfirstu fragfirstu
--fragmoreu fragmoreu
--fraglastu fraglastu --hashlimit-uptou hashlimit-uptou --hashlimit-aboveu hashlimit-aboveu --hashlimit-burstu hashlimit-burstu --hashlimit-modeu hashlimit-modeu --hashlimit-srcmasku hashlimit-srcmasku --hashlimit-dstmasku hashlimit-dstmasku --hashlimit-nameu hashlimit-nameu --hashlimit-htable-sizeu hashlimit-htable-sizeu --hashlimit-htable-maxu hashlimit-htable-maxu --hashlimit-htable-expireu hashlimit-htable-expireu --hashlimit-htable-gcintervalu hashlimit-htable-gcintervalu --hbh-lenu hbh-lenu
--hbh-optsu hbh-optsu --helperu helperu --hl-equ hl-equ --hl-ltu hl-ltu --hl-gtu hl-gtu --icmp-typeu icmp-typeu
--icmpv6-typeu icmpv6-typeu --src-rangeu src-rangeu --dst-rangeu dst-rangeu --softu softu --headeru headeru --ipvsu ipvsu --vprotou vprotou --vaddru vaddru --vportu vportu --vdiru vdiru --vmethodu vmethodu
--vportctlu vportctlu --lengthu lengthu --limitu limitu
--limit-burstu limit-burstu --mac-sourceu
mac-sourceu --mh-typeu mh-typeu --sportsu --source-portsu source-portsu --dportsu --destination-portsu destination-portsu --portsu portsu
--nfacct-nameu nfacct-nameu --genreu genreu --ttlu ttlu --logu logu --uid-owneru uid-owneru --gid-owneru gid-owneru --socket-existsu
socket-existsu --physdev-inu
physdev-inu
--physdev-outu physdev-outu --physdev-is-inu
physdev-is-inu --physdev-is-outu physdev-is-outu --physdev-is-bridgedu physdev-is-bridgedu
--pkt-typeu pkt-typeu --diru diru --polu polu --strictu strictu --reqidu reqidu --spiu spiu --protou protou --modeu modeu --tunnel-srcu
tunnel-srcu --tunnel-dstu
tunnel-dstu --nextu nextu --quotau quotau --rateestu rateestu
--rateest1u rateest1u
--rateest2u rateest2u --rateest-deltau
rateest-deltau
--rateest-bpsu rateest-bpsu --rateest-bps1u rateest-bps1u --rateest-bps2u rateest-bps2u
--rateest-ppsu rateest-ppsu --rateest-pps1u rateest-pps1u --rateest-pps2u rateest-pps2u --rateest-ltu
rateest-ltu --rateest-gtu
rateest-gtu --rateest-equ
rateest-equ --rateest-nameu rateest-nameu --rateest-intervalu rateest-intervalu --rateest-ewmau rateest-ewmau --realmu realmu --nameu nameu --setu setu --rsourceu rsourceu --rdestu rdestu --masku masku --rchecku rchecku --updateu updateu --removeu removeu --secondsu secondsu --reapu reapu
--hitcountu hitcountu --rttlu rttlu --looseu looseu --validmarku validmarku --accept-localu accept-localu --invertu invertu --rt-typeu rt-typeu
--rt-segsleftu rt-segsleftu --rt-lenu rt-lenu
--rt-0-resu rt-0-resu --rt-0-addrsu
rt-0-addrsu --rt-0-not-strictu rt-0-not-strictu
--chunk-typesu chunk-typesu --match-setu match-setu --return-nomatchu return-nomatchu --update-countersu update-countersu --update-subcountersu update-subcountersu --packets-equ
packets-equ --packets-ltu
packets-ltu --packets-gtu
packets-gtu
--bytes-equ bytes-equ
--bytes-ltu bytes-ltu
--bytes-gtu bytes-gtu
--transparentu transparentu --nowildcardu
nowildcardu --stateu stateu
--probabilityu probabilityu --everyu everyu --packetu packetu --algou algou --fromu fromu --tou tou --stringu stringu --hex-stringu
hex-stringu --tcp-flagsu tcp-flagsu --synu synu --tcp-optionu
tcp-optionu --mssu mssu --datestartu datestartu
--datestopu datestopu --timestartu timestartu
--timestopu timestopu --monthdaysu monthdaysu
--weekdaysu weekdaysu --contiguousu
contiguousu
--kerneltzu kerneltzu --utcu utcu --localtzu localtzu --tosu tosu --ttl-equ ttl-equ --ttl-gtu ttl-gtu --ttl-ltu ttl-ltu --u32u u32u --conditionu conditionu --macu macu
--lower-limitu lower-limitu
--upper-limitu upper-limitu --src-ccu --source-countryu source-countryu --dst-ccu --destination-countryu destination-countryu --enabledu enabledu
--disabledu disabledu --ifaceu ifaceu --dev-inu dev-inu --dev-outu dev-outu --upu upu --downu downu --broadcastu broadcastu
--loopbacku loopbacku --pointtopointu pointtopointu --runningu runningu --noarpu noarpu --arpu arpu --promiscu promiscu --multicastu multicastu --dynamicu dynamicu
--lower-upu lower-upu --dormantu dormantu --edku edku --kazaau kazaau --gnuu gnuu --dcu dcu --bitu bitu --appleu appleu --soulu soulu --winmxu winmxu --aresu aresu --debugu debugu --flagsu flagsu --anyu anyu --layer3u layer3u --layer4u layer4u --layer5u layer5u --stealthu stealthu --synscanu synscanu --cnscanu cnscanu --grscanu grscanu --psd-weight-thresholdu psd-weight-thresholdu --psd-delay-thresholdu psd-delay-thresholdu --psd-lo-ports-weightu psd-lo-ports-weightu --psd-hi-ports-weightu psd-hi-ports-weightu --growu growu --no-changeu no-changeu --packetsu packetsu --knockportsu
knockportsu --timeu timeu --autocloseu autocloseu --checkipu checkipu --typeu typeu --checksum-fillu
checksum-fillu --set-classu set-classu --newu newu
--hashmodeu hashmodeu --clustermacu
clustermacu
--total-nodesu total-nodesu --local-nodeu
local-nodeu --hash-initu hash-initu --set-xmarku set-xmarku --save-marku save-marku --restore-marku restore-marku
--and-marku and-marku --or-marku or-marku
--xor-marku xor-marku
--set-marku set-marku --nfmasku nfmasku --ctmasku ctmasku --saveu saveu --restoreu restoreu --notracku notracku
--cteventsu cteventsu --expeventsu expeventsu --zoneu zoneu --timeoutu timeoutu --to-destinationu to-destinationu --randomu randomu --persistentu
persistentu --src-pfxu src-pfxu --dst-pfxu dst-pfxu
--set-dscpu set-dscpu --set-dscp-classu set-dscp-classu --ecn-tcp-removeu ecn-tcp-removeu --hl-setu hl-setu --hl-decu hl-decu --hl-incu hl-incu
--hmark-tupleu hmark-tupleu --hmark-modu hmark-modu --hmark-offsetu hmark-offsetu --hmark-src-prefixu hmark-src-prefixu --hmark-dst-prefixu hmark-dst-prefixu --hmark-sport-masku hmark-sport-masku --hmark-dport-masku hmark-dport-masku --hmark-spi-masku hmark-spi-masku --hmark-proto-masku hmark-proto-masku --hmark-rndu hmark-rndu --led-trigger-idu led-trigger-idu --led-delayu led-delayu --led-always-blinku led-always-blinku --log-levelu log-levelu --log-prefixu
log-prefixu --log-tcp-sequenceu log-tcp-sequenceu --log-tcp-optionsu log-tcp-optionsu --log-ip-optionsu log-ip-optionsu --log-uidu log-uidu
--to-portsu to-portsu
--nflog-groupu nflog-groupu --nflog-prefixu nflog-prefixu
--nflog-rangeu nflog-rangeu --nflog-thresholdu nflog-thresholdu --queue-numu queue-numu --queue-balanceu
queue-balanceu --queue-bypassu queue-bypassu --queue-cpu-fanoutu queue-cpu-fanoutu --rateest-ewmalogu rateest-ewmalogu
--reject-withu reject-withu --nodstu nodstu --selctxu selctxu --add-setu add-setu --del-setu del-setu --existu existu --to-sourceu to-sourceu --set-mssu set-mssu --clamp-mss-to-pmtuu clamp-mss-to-pmtuu --strip-optionsu
strip-optionsu --gatewayu gatewayu --set-tosu set-tosu --and-tosu and-tosu --or-tosu or-tosu --xor-tosu xor-tosu --on-portu on-portu --on-ipu on-ipu
--tproxy-marku tproxy-marku --ttl-setu ttl-setu --ttl-decu ttl-decu --ttl-incu ttl-incu --ulog-nlgroupu ulog-nlgroupu
--ulog-prefixu ulog-prefixu --ulog-cprangeu ulog-cprangeu --ulog-qthresholdu ulog-qthresholdu --addru addru --tnameu tnameu --deludeu deludeu --tarpitu tarpitu --set-macu set-macu --prefixu prefixu --reuseu reuseu --staticu staticu
--and-masku and-masku --or-masku or-masku --shiftu shiftu
--honeypotu honeypotu --resetu reset(
R< t sysR0 R2 t optparset OptionParsert
add_optiont argparset ArgumentParsert add_argument( t add_argR� R� R� ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyR� sL (3 t __doc__t
__future__R R R Ri R R� Rr RC t salt.utils.argsR t salt.utils.filest salt.utils.patht
salt.stateR R> t salt.exceptionsR t salt.extR t loggingt getLoggert __name__R" R R R R R R< R- R0 R\ R_ Ra Rd Re Rg Rp Rw Ry Rz R{ R R R� R� R
R^ R� ( ( ( s9 /usr/lib/python2.7/site-packages/salt/modules/iptables.pyt <module> sN
+ # � b 7 '2&H
Mini Shell