o

�N�g�'�@s�dZd
dl
Z
e
�e�
Zdd�Z									
ddd�
Z							
dd
d�
Zddd�
Zdd�Z	ddd�
Z
ddd�
Zddd�
Zddd�
Z
dS)a"

CSF Ip tables management
========================

:depends:   - csf utility
:configuration: See http://download.configserver.com/csf/install.txt
 for setup instructions.

.. code-block:: yaml

    Simply allow/deny rules:
      csf.rule_present:
        ip: 1.2.3.4
        method: allow
�NcCsd
tvrdSdS)N�
csf.existsZcsf)Fzcsf module could not be loaded�
�__salt__�rr�C/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/csf.py�__virtual__s


r�tcp�in�
d�
s�Fc
Cs�|id
dd�}
|}td|
||||||||d�	}|r|
S|r#d|
��}
td|
��}
|
||||||||d�}|r:d	}|	rNtd
�rF|d7}n|d7}d
|
d<||
d<d|
dd<|
S)at
    Ensure iptable rule exists.

    name
        The ip address or CIDR for the rule.

    method
        The type of rule.  Either 'allow' or 'deny'.

    port
        Optional port to be open or closed for the
        iptables rule.

    proto
        The protocol. Either 'tcp', or 'udp'.
        Only applicable if port is specified.

    direction
        The diretion of traffic to apply the rule to.
        Either 'in', or 'out'. Only applicable if
        port is specified.

    port_origin
        Specifies either the source or destination
        port is relevant for this rule. Only applicable
        if port is specified.  Either 's', or 'd'.

    ip_origin
        Specifies whether the ip in this rule refers to
        the source or destination ip. Either 's', or
        'd'. Only applicable if port is specified.

    ttl
        How long the rule should exist. If supplied,
        `csf.tempallow()` or csf.tempdeny()` are used.

    comment
        An optional comment to appear after the rule
        as a #comment .

    reload
        Reload the csf service after applying this rule.
        Default false.

    TzRule already exists.��name�changes�result�commentr)	�method�ip�port�proto�	direction�port_origin�	ip_origin�ttlrZtempzcsf.)rrrrrrrzRule has been added.�
csf.reload� Csf reloaded.z Unable to reload csf.Frr�Createdr�Ruler)rrrrrrrrr�reload�retr�exists�func�rulerrr�rule_presentsT:


�








�












�









r#c	Cs�|}	|id
dd�}
td|
|	||||||d�}|s|
Std|
|	|||||d|d�	}|r.d	}
|r>td
�r:|
d7}
n|
d7}
|
|
d
<d|
dd<|
S)a
    Ensure iptable is not present.

    name
        The ip address or CIDR for the rule.

    method
        The type of rule.  Either 'allow' or 'deny'.

    port
        Optional port to be open or closed for the
        iptables rule.

    proto
        The protocol. Either 'tcp', 'udp'.
        Only applicable if port is specified.

    direction
        The diretion of traffic to apply the rule to.
        Either 'in', or 'out'. Only applicable if
        port is specified.

    port_origin
        Specifies either the source or destination
        port is relevant for this rule. Only applicable
        if port is specified.  Either 's', or 'd'.

    ip_origin
        Specifies whether the ip in this rule refers to
        the source or destination ip. Either 's', or
        'd'. Only applicable if port is specified.

    ttl
        How long the rule should exist. If supplied,
        `csf.tempallow()` or csf.tempdeny()` are used.

    reload
        Reload the csf service after applying this rule.
        Default false.
    TzRule not present.r
r)rrrrrrzcsf.remove_ruler)	rrrrrrrrrzRule has been removed.rrzCsf unable to be reloaded.rZRemovedrrr)rrrrrrrrrrrr r"rrrr�rule_absent�sD3








�









�








r$c	Cs�tt
t|
��
}
d
}d�|
�
iddd�}td||d�}|��}td|�
}|D]}t�d	||�
t�d
|
�
|||
kr?d}q'|rUtd|
||d�}d|d
d<||d<|S)a�

    Ensure ports are open for a protocol, in a direction.
    e.g. - proto='tcp', direction='in' would set the values
    for TCP_IN in the csf.conf file.

    ports
        A list of ports that should be open.

    proto
        The protocol. May be one of 'tcp', 'udp',
        'tcp6', or 'udp6'.

    direction
        Choose 'in', 'out', or both to indicate the port
        should be opened for inbound traffic, outbound
        traffic, or both.
    F�
,TzPorts open.r
z
csf.get_ports)rrzcsf.build_directionszcurrent_ports[direction]: %sz	ports: %szcsf.allow_ports�ChangedrZPortsr)�list�map�str�joinr�upper�logZtrace)	rZportsrr�diffrZ
current_portsZ
directionsrrrr�
ports_open�s*



�






�




r.cCst||
|d
�S)zJ
    Alias for :mod:`csf.nics_skipped <salt.states.csf.nics_skipped>`
    )�nics�ipv6)
�nics_skipped)rr/r0rrr�	nics_skip
sr2cCsNd
�|
�
iddd�}t
d|d�
}|
|kr|St
d|
|d�}d|d	d
<|S)z�
    name
        Meaningless arg, but required for state.

    nics
        A list of nics to skip.

    ipv6
        Boolean. Set to true if you want to skip
        the ipv6 interface. Default false (ipv4).
    r%Tz
NICs skipped.r
zcsf.get_skipped_nics)
r0z
csf.skip_nicsr&rzSkipped NICs)r*r)rr/r0rZcurrent_skipped_nicsrrrrr1
s



�




r1cCsld
iddd�}i}td�}t
|�
dkr|Std�}|r*d}|
r*td	�r*|d
7}d|dd
<||d<|S)��
    Ensure testing mode is enabled in csf.

    reload
        Reload CSF after changing the testing status.
        Default false.
    �testing modeTzTesting mode already ON.r
�csf.get_testing_status�
zcsf.enable_testing_modezCsf testing mode enabledr� and csf reloaded.�onr�Testing Moder�r�int)rrrr�testing�enablerrrr�
testing_on1
s$



�














r>cCsld
iddd�}i}td�}t
|�
dkr|Std�}|r*d}|
r*td	�r*|d
7}d|dd
<||d<|S)r3r4TzTesting mode already OFF.r
r5r
zcsf.disable_testing_modezCsf testing mode disabledrr7Zoffrr9rr:)rrrrr<�disablerrrr�testing_offO
s$



�














r@c	Cs�d
iddd�}|}td|�
}|r7td|�
}|d}d|
�d�|kr%|Std	||
�}d
|d<d|d
d<ntdd|�d|
�d�d�}d|d<d|d
d<|rltd�r`|dd7<|S|dd7<d|d<|S)z�
    Ensure the state of a particular option/setting in csf.

    name
        The option name in csf.conf

    value
        The value it should be set to.

    reload
        Boolean. If set to true, csf will be reloaded after.
    r4TzOption already present.r
zcsf.get_optionzcsf.split_optionr6�
"zcsf.set_optionzOption modified.rr&rZOptionzfile.appendz/etc/csf/csf.confz = ")
�argsz(Option not present. Appended to csf.confzChanged.rz. Csf reloaded.z. Csf failed to reload.Frr)	r�valuerr�optionZcurrent_option�
lZoption_valuerrrr�option_presentn
s6


�








�




�

rF)Nrr	r
rNrF)Nrr	r
rNF)rr	)
F)�__doc__�logging�	getLogger�__name__r,rr#r$r.r2r1r>r@rFrrrr�<module>
s6
	







�o






�
\+