o

�N�g���
@sj
dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlm	Z	
d
dl
mZ
e�
e�
Zdddddddd	d
d�	Zdd
�Zdd�Zd?dd�
Zdd�Z						d@dd�
ZdAdd�
ZdBdd�
ZdBdd�
ZdBdd�
ZdCd d!�
ZdDd#d$�
ZdDd%d&�
ZdEd'd(�
ZdCd)d*�
ZdBd+d,�
ZdBd-d.�
Z 	dFd/d0�
Z!dEd1d2�
Z"dDd3d4�
Z#dGd5d6�
Z$dHd7d8�
Z%dId9d:�
Z&dEd;d<�
Z'dDd=d>�
Z(dS)Jz
Support for nftables
�N)
�CommandExecutionError)
�STATE_INTERNAL_KEYWORDS�ip�ip6�inet�arp�bridge�netdev)	�ipv4Zip4rZipv6rrrrr	cCstj
j�d
�
r	dSdS)z7
    Only load the module if nftables is installed
    �nft�nftables)FzHThe nftables execution module failed to load: nftables is not installed.)�salt�utils�path�which�rr�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/nftables.py�__virtual__s

rc
Csd
S)z 
    Return correct command
    rrrrrr�
_nftables_cmd*src

CsDtd
dkrdStd
dkrdStd
dkrdStddkr dSdS)	z.
    Use the same file for rules for now.
    Z	os_familyZRedHatz
/etc/nftablesZArchZDebian�osZGentooF)
Z
__grains__�
�familyrrr�_conf1s






rcCs$t��d
�}t
d|�
��}
|
dS)z�
    Return version from nftables --version

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.version

    z
 --version�cmd.run�
)r�__salt__�split)�cmd�outrrr�versionAs

r�r
cKsjd
d
dd�}d|vr|d|d<|d=tt
�
gd�
D]	}||vr$||=qd
}	d
}
t|}d|vr=|	d�|d�
7}	|d=d	|vrM|	d
�|d	�
7}	|d	=d|vrU|d}
d|vr\|d=d
|vrl|	d�|d
�
7}	|d
=d|vr||	d�|d�
7}	|d=d|vr�|	d�|d�
7}	|d=d|vr�|	d7}	|d=d|vs�d|vr�|	d�||�d�
p�|�d�
�7}	d|vr�|d=d|vr�|d=d|vs�d|vr�|	d�||�d�
p�|�d�
�7}	d|vr�|d=d|vr�|d=d|v�
r
t|d�
|d<d|dv�
r
|d�dd�|d<|	d�|d�
7}	|d=d|v�
r7t|d�
|d<d|dv�
r+|d�dd�|d<|	d �|d�
7}	|d=d!|v�
rh|d!�d"�
}d#d$�|D�
}|jd%d&�

d'�	d(d)�|D�
�
|d!<|	d�|d!�
7}	|d!=d*|v�
r�|d*�d"�
}
d+d$�|
D�
}
|
jd%d&�

d'�	d,d)�|
D�
�
|d*<|	d �|d*�
7}	|d*=g}d|v�
r�|�
d-�|d�
�

|d=d.|v�
r�|�
d-�|d.�
�

|d.=d/|v�
s�d0|v�
r�|�
d1�|�d/�
�
p�|�d0�
�
�

d/|v�
r�|d/=d0|v�
r�|d0=d2|v�
r�|�
d3�|d2�
�

|d2=d4|v�r|�
d-�|d4�
�

|d4=d5|v�r |�
d-�|d5�
�

|d5=d6|v�r2|�
d7�|d6�
�

|d6=|D]}|	|7}	�q4|	��}	|	�d|
�d8��}	|	�d|
�d9��}	|	|d:<|d;v�r�|�sdd<|d=<|S|
�smd>|d=<|S|�svd?|d=<|S|d@v�r�|�r�dA�t�|||
||	�|d:<ndB�t�|||
|	�|d:<n
dC�t�||||
|	�|d:<|d:�r�dD|d=<d%|dE<|S)Fa�
    Build a well-formatted nftables rule based on kwargs.
    A `table` and `chain` are not required, unless `full` is True.

    If `full` is `True`, then `table`, `chain` and `command` are required.
    `command` may be specified as either insert, append, or delete.
    This will return the nftables command, exactly as it would
    be used from the command line.

    If a position is required (as with `insert` or `delete`), it may be specified as
    `position`. This will only be useful if `full` is True.

    If `connstate` is passed in, it will automatically be changed to `state`.

    CLI Examples:

    .. code-block:: bash

        salt '*' nftables.build_rule match=state \
            connstate=RELATED,ESTABLISHED jump=ACCEPT
        salt '*' nftables.build_rule filter input command=insert position=3 \
            full=True match=state state=related,established jump=accept

        IPv6:
        salt '*' nftables.build_rule match=state \
            connstate=related,established jump=accept \
            family=ipv6
        salt '*' nftables.build_rule filter input command=insert position=3 \
            full=True match=state state=related,established jump=accept \
            family=ipv6

    r F)�comment�rule�result�targetZjump)�chain�save�table�ifzmeta iifname {} Zofzmeta oifname {} �proto�stateZ	connstatezct state {{ {0} }} z	icmp-typezicmp type {{ {0} }} Zpkttypezmeta pkttype {{ {0} }} Zcounterzcounter Zsaddr�sourcez{} saddr {} ZdaddrZdestinationz{} daddr {} Zdport�
:�
-zdport {{ {0} }} Zsportzsport {{ {0} }} Zdports�
,c
S�g|]}
t|
�
�qSr�
�int��.0�
xrrr�
<listcomp>��zbuild_rule.<locals>.<listcomp>T)
�reversez, c
s��|]}
t|
�
V
qdS�
N�
�strr2rrr�	<genexpr>���zbuild_rule.<locals>.<genexpr>Zsportsc
Sr/rr0r2rrrr5�r6c
sr8r9r:r2rrrr<�r=z{} �
jzredirect-tozto-portzredirect to {} zto-portsz--to-ports {} z	to-sourcezto-destinationzreject-withzreject with {} z dportz sportr")�True�true�Table needs to be specifiedr!�Chain needs to be specifiedzCommand needs to be specified)ZInsert�insertZINSERT�&{} insert rule {} {} {} position {} {}�{} insert rule {} {} {} {}z{} {} rule {} {} {} {}zSuccessfully built ruler#)
�list�_STATE_INTERNAL_KEYWORDS�_NFTABLES_FAMILIES�format�getr;�replacer�sort�join�append�stripr)r'r%Zcommand�position�fullr�kwargs�ret�ignorer"r)�
nft_familyZ_dportsZ_sportsZ
after_jump�itemrrr�
build_ruleQs

)



�
















�




�
































�






























�

�
�



rWc
Cs�t�r|st�}t
jj�|�
�}
t
jj�|
���
}Wd
�
n1s#w



Y
g}|D]}|��}|s5q,|�	d�
r;q,|�
|�

q,|S)z�
    Return a data structure of the rules in the conf file

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.get_saved_rules

    N�
#)rr
r�files�fopen�data�decode�	readlinesrO�
startswithrN)Z	conf_fileZfp_�lines�rules�lineZtmplinerrr�get_saved_rules2
s


�








rbc
Cs�t|}
g}d
�
t�|
�}td|dd�}|s|Szt�|�
}Wnty+


|YSw|r3|�d�
s5|S|�dg�D]
}d|v
rH|�|d�

q;t	�
|�

|S)z�
    Return a data structure of the current, in-memory tables

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.list_tables

        salt '*' nftables.list_tables family=ipv6

    z6{} --json --numeric --numeric --numeric list tables {}rF�
Zpython_shellrZmetainfor')rHrIrr�json�loads�
ValueErrorrJrN�log�debug)rrU�tablesrrr[rVrrr�list_tablesM
s*



�




�


�


rjc
CsTt|�
}
t
|}g}|
D]}|d
}d�t�||�}td|dd�}|�|�

q|S)z�
    Return a data structure of the current, in-memory rules

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.get_rules

        salt '*' nftables.get_rules family=ipv6

    �namez1{} --numeric --numeric --numeric list table {} {}rFrc)rjrHrIrrrN)rrirUr`r'Z
table_namerrrrr�	get_rulesr
s





�

rlc
	Csbt|}
g}d
�
t�|
�}td|dd�}|s|Sz
t�|�
d}W|Sttfy0


|YSw)a3

    .. versionadded:: 3002

    Return a list of dictionaries comprising the current, in-memory rules

    family
        Networking family, either ipv4 or ipv6

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.get_rules_json

        salt '*' nftables.get_rules_json family=ipv6

    z7{} --numeric --numeric --numeric --json list ruleset {}rFrcr)rHrIrrrdre�KeyErrorrf)rrUr`rrrrr�get_rules_json�
s


�


�
�rnc
Cs�t�r|st�}d
d�t
��D�
}dd�|��D�
}d}|D]}
t|
�
}|r*|d7}|d�|�
}q|d}td|�
rA|�d�}z'tjj�	|d��}|�
tjj�|�
�

Wd	�
W|S1saw



Y
W|St
y{
}
ztd
|���
�
d	}~w
w)af

    .. versionchanged:: 3002

    Save the current in-memory rules to disk. On systems where /etc/nftables is
    a directory, a file named salt-all-in-one.nft will be dropped inside by default.
    The main nftables configuration will need to include this file.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.save /etc/nftables
    c
S�i|]\}
}||
�qSrr�r3�
k�
vrrr�
<dictcomp>�
�zsave.<locals>.<dictcomp>c
Srorrrprrrrs�
rtz
#! nft -f
�

zfile.directory_existsz/salt-all-in-one.nft�wbNz'Problem writing to configuration file: )rrH�itemsrlrMrr
rrYrZ�writer[�encode�OSErrorr)�filenamerZnft_familiesr`rZ_fh�excrrrr&�
s0










���
��r&�filterc
Cs�d
dd�}|
s
d|d<|S|sd|d<|St||d�}|ds!|St
||
|d�}|ds.|St||
||d�}|ds<|St|}d	�t�|||
�}td
|dd�}t�d|�}	t�	|�d
��
}
|	D]}|
�
|�
}|rtd|�d�
d�
Sqadd|��d�S)aU
    Get the handle for a particular rule

    This function accepts a rule in a standard nftables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.get_rule_handle filter input \
            rule='tcp dport 22 log accept'

        IPv6:
        salt '*' nftables.get_rule_handle filter input \
            rule='tcp dport 22 log accept' \
            family=ipv6
    r F�r!r#rBr!�Rule needs to be specifiedrr#z={} --numeric --numeric --numeric --handle list chain {} {} {}rrcz
+z # handle (?P<handle>\d+)T�handle)r#r�zCould not find rule )r#r!)�check_table�check_chain�checkrHrIrr�rer�compile�search�group)
r'r%r"rrS�resrUrrr`�pat�
r�matchrrr�get_rule_handle�
s:













�





�r�c
Cs�d
dd�}|
s
d|d<|S|sd|d<|St||d�}|ds!|St
||
|d�}|ds.|St|}d	�t�|||
�}|�d
�}td|dd��|�
}	|	d
kr[d�||
||�|d<|Sd�||
||�|d<d|d<|S)aU
    Check for the existence of a rule in the table and chain

    This function accepts a rule in a standard nftables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.check filter input \
            rule='tcp dport 22 log accept'

        IPv6:
        salt '*' nftables.check filter input \
            rule='tcp dport 22 log accept' \
            family=ipv6
    r Fr~rBr!rrr#z={} --handle --numeric --numeric --numeric list chain {} {} {}z #rrc���z;Rule {} in chain {} in table {} in family {} does not existz3Rule {} in chain {} in table {} in family {} existsT)r�r�rHrIrr�find)
r'r%r"rrSr�rUrZsearch_rulerrrrr�s<











�


��
�
�
r�cCs�d
dd�}|
s
d|d<|St|}t
��d|�d|��}td|dd	��d
|
�d��
}|dkr:d
�|
||�|d<|Sd�|
||�|d<d|d<|S)a

    .. versionadded:: 2014.7.0

    Check for the existence of a chain in the table

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.check_chain filter input

        IPv6:
        salt '*' nftables.check_chain filter input family=ipv6
    r Fr~rBr!z list table �
 rrczchain z {r�z0Chain {} in table {} in family {} does not existz(Chain {} in table {} in family {} existsTr#)rHrrr�rI)r'r%rrSrUrrrrrr�Ps"






��
�
r�cCs�d
dd�}|s
d|d<|St|
}t
��d|��}td|dd��d	|�d
|���
}|dkr;d|�d
|
�d�|d<|Sd|�d
|
�d�|d<d|d<|S)z�
    Check for the existence of a table

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.check_table nat
    r Fr~rAr!z
 list tables rrcztable r�r��Table � in family z does not existz existsTr#)rHrrr�)r'rrSrUrrrrrr�vs






�
�

r�cCs�d
dd�}|s
d|d<|St||
d�}|dr|St
|
}t��d|�d	|��}td
|dd�}|sCd|�d
|
�d�|d<d|d<|Sd�||
�|d<|S)z�
    .. versionadded:: 2014.7.0

    Create new custom table.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.new_table filter

        IPv6:
        salt '*' nftables.new_table filter family=ipv6
    r Fr~rAr!rr#z add table r�rrcr�r�z createdTz*Table {} in family {} could not be created�r�rHrrrI�r'rrSr�rUrrrrr�	new_table��$








�
�r�cCs�d
dd�}|s
d|d<|St||
d�}|ds|St
|
}t��d|�d	|��}td
|dd�}|sCd|�d
|
�d�|d<d|d<|Sd�||
�|d<|S)z�
    .. versionadded:: 2014.7.0

    Create new custom table.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.delete_table filter

        IPv6:
        salt '*' nftables.delete_table filter family=ipv6
    r Fr~rAr!rr#z delete table r�rrcr�r�z deletedTz*Table {} in family {} could not be deletedr�r�rrr�delete_table�r�r�cCs
d
dd�}|
s
d|d<|St||d�}|ds|St
||
|d�}|dr/d�|
||�|d<|St|}t��d	|�d
|�d
|
��}	|sG|sG|r^|rX|rXt|�
rXd�|	|||�}	nd|d<|Std
|	dd�}
|
swd�|
||�|d<d|d<|Sd�|
||�|d<|S)aL
    .. versionadded:: 2014.7.0

    Create new chain to the specified table.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.new_chain filter input

        salt '*' nftables.new_chain filter input \
                table_type=filter hook=input priority=0

        salt '*' nftables.new_chain filter foo

        IPv6:
        salt '*' nftables.new_chain filter input family=ipv6

        salt '*' nftables.new_chain filter input \
                table_type=filter hook=input priority=0 family=ipv6

        salt '*' nftables.new_chain filter foo family=ipv6
    r Fr~rBr!rr#z0Chain {} in table {} in family {} already existsz -- add chain r�z,{0} \{{ type {1} hook {2} priority {3}\; \}}z(Table_type, hook, and priority required.rrcz)Chain {} in table {} in family {} createdTz6Chain {} in table {} in family {} could not be created)r�r�rIrHrr;r)r'r%Z
table_type�hook�priorityrrSr�rUrrrrr�	new_chain�sD







�




�


��
��r�cCs�d
dd�}|
s
d|d<|St||d�}|ds|St
||
|d�}|ds&|St|}t��d|�d	|�d	|
��}td
|dd�}|sQd�|
||�|d<d
|d<|Sd�|
||�|d<|S)av

    .. versionadded:: 2014.7.0

    Delete the chain from the specified table.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.delete_chain filter input

        salt '*' nftables.delete_chain filter foo

        IPv6:
        salt '*' nftables.delete_chain filter input family=ipv6

        salt '*' nftables.delete_chain filter foo family=ipv6
    r Fr~rBr!rr#z delete chain r�rrcz)Chain {} in table {} in family {} deletedTz6Chain {} in table {} in family {} could not be deleted)r�r�rHrrrI)r'r%rrSr�rUrrrrr�delete_chain*s0










��
��r�c	Cs�d
�||
|�dd�}|
sd|d<|S|sd|d<|St
||d�}|ds&|St||
|d�}|ds3|St||
||d�}|drKd	�||
||�|d<|St|}d
�t�|||
|�}td|dd�}|ssd
|d<d�||
||�|d<|Sd�||
||�|d<|S)aL
    Append a rule to the specified table & chain.

    This function accepts a rule in a standard nftables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.append filter input \
            rule='tcp dport 22 log accept'

        IPv6:
        salt '*' nftables.append filter input \
            rule='tcp dport 22 log accept' \
            family=ipv6
    z1Failed to append rule {} to chain {} in table {}.Fr~rBr!rrr#�8Rule {} chain {} in table {} in family {} already existsz{} add rule {} {} {} {}rrcT�2Added rule "{}" chain {} in table {} in family {}.�:Failed to add rule "{}" chain {} in table {} in family {}.)rIr�r�r�rHrr)	r'r%r"rrSr�rUrrrrrrN]sP
��









��

�


�	�
��rNc
Cs
d
|�d|�d�dd�}|
sd|d<|S|sd|d<|St||d	�}|d
s(|St
||
|d	�}|d
s5|St||
||d	�}|d
rMd�||
||�|d<|St|}|r_d�t�|||
||�}n
d
�t�|||
|�}td|dd�}	|	s�d|d
<d�||
||�|d<|Sd�||
||�|d<|S)a�
    Insert a rule into the specified table & chain, at the specified position.

    If position is not specified, rule will be inserted in first position.

    This function accepts a rule in a standard nftables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Examples:

    .. code-block:: bash

        salt '*' nftables.insert filter input \
            rule='tcp dport 22 log accept'

        salt '*' nftables.insert filter input position=3 \
            rule='tcp dport 22 log accept'

        IPv6:
        salt '*' nftables.insert filter input \
            rule='tcp dport 22 log accept' \
            family=ipv6

        salt '*' nftables.insert filter input position=3 \
            rule='tcp dport 22 log accept' \
            family=ipv6
    zFailed to insert rule z
 to table �
.Fr~rBr!rrr#r�rDrErrcTr�r�)r�r�r�rIrHrr�
r'r%rPr"rrSr�rUrrrrrrC�sT
�









��


�
�


�	�
��rCc
Cs
d
|�d|�d�dd�}|r|rd|d<|St||d�}|d	s"|St
||
|d�}|d	s/|St||
||d�}|d	sGd
�||
||�|d<|S|sPt||
||�}t|}d�t�|||
|�}td|dd
�}	|	sxd|d	<d�||
||�|d<|Sd�||
||�|d<|S)a(
    Delete a rule from the specified table & chain, specifying either the rule
        in its entirety, or the rule's position in the chain.

    This function accepts a rule in a standard nftables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Examples:

    .. code-block:: bash

        salt '*' nftables.delete filter input position=3

        salt '*' nftables.delete filter input \
            rule='tcp dport 22 log accept'

        IPv6:
        salt '*' nftables.delete filter input position=3 family=ipv6

        salt '*' nftables.delete filter input \
            rule='tcp dport 22 log accept' \
            family=ipv6
    zFailed to delete rule �
 in table r�Fr~z+Only specify a position or a rule, not bothr!rr#z8Rule {} chain {} in table {} in family {} does not existz!{} delete rule {} {} {} handle {}rrcTz7Deleted rule "{}" in chain {} in table {} in family {}.z=Failed to delete rule "{}" in chain {}  table {} in family {})r�r�r�rIr�rHrrr�rrr�delete�sL
�







��


�

���
��r�c	Cs�d
�|
|�dd�}t
||d�}|ds|St|}|
r>t||
|d�}|ds(|Sd�t�|||
�}d|
�d|�d	|�d
�}nt��d|�d|��}d
|�d	|�d
�}td|dd�}|sid|d<d|��|d<|Sd|��|d<|S)aB

    Flush the chain in the specified table, flush all chains in the specified
    table if chain is not specified.

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.flush filter

        salt '*' nftables.flush filter input

        IPv6:
        salt '*' nftables.flush filter input family=ipv6
    z0Failed to flush rules from chain {} in table {}.Fr~rr#z{} flush chain {} {} {}zfrom chain r�r�r�z
 flush table r�zfrom table rrcTzFlushed rules r!zFailed to flush rules )rIr�rHr�rr)	r'r%rrSr�rUrr!rrrr�flushJs4
��







�



�
r�c
Cs�|
sd
St|}t
|d�
}z)|dD]!}|�di��d�
|
kr3|�di��d�
|kr3|dd
WSqWdStttfyC


YdSw)	a�

    .. versionadded:: 3002

    Return the current policy for the specified table/chain

    table
        Name of the table containing the chain to check

    chain
        Name of the chain to get the policy for

    family
        Networking family, either ipv4 or ipv6

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.get_policy filter input

        IPv6:
        salt '*' nftables.get_policy filter input family=ipv6
    �"Error: Chain needs to be specifiedrrr%rk�type�policyN)rHrnrJrm�	TypeErrorrf)r'r%rrUr`r"rrr�
get_policy|s



��
�r�c	Cs
|
sd
S|sdSt|}i}t
|d�
}|sdS|D]$}z|dd|kr3|dd|
kr3|d}W
nWqty=


Yqw|sBdSt��d|�d	|�d	|
��}d
|v
s\d|v
s\d|v
r^dSd
�|d
|d|d�}	|�d|	�d|�d�}td|dd�}
|
dS)a-
    .. versionadded:: 3002

    Set the current policy for the specified table/chain. This only works on
    chains with an existing base chain.

    table
        Name of the table containing the chain to modify

    chain
        Name of the chain to set the policy for

    policy
        accept or drop

    family
        Networking family, either ipv4 or ipv6

    CLI Example:

    .. code-block:: bash

        salt '*' nftables.set_policy filter input accept

        IPv6:
        salt '*' nftables.set_policy filter input accept family=ipv6
    r�z#Error: Policy needs to be specifiedrFr%r'rkz add chain r�r�r��prioztype {} hook {} priority {};z "{ z policy z; }"zcmd.run_allrc�retcode)rHrnrmrrIr)r'r%r�rrUZ
chain_infor`r"r�paramsrrrr�
set_policy�s:






 


�

�


�
r�)
r)NNNr Nr
r9)
r
)Nr
)r}NNr
)r}Nr
)r}NNNNr
)r}NNNr
)NNNr
)r}r r
))�__doc__rd�loggingr�Zsalt.utils.datar
Zsalt.utils.filesZsalt.utils.pathZsalt.exceptionsrZ
salt.staterrG�	getLogger�__name__rgrHrrrrrWrbrjrlrnr&r�r�r�r�r�r�r�r�rNrCr�r�r�r�rrrr�<module>
sh














�







�
b

%

#
*
:
<
&

'(
�
H
3
I
U
O
2*