HEX
Server: Apache
System: Linux server2.voipitup.com.au 4.18.0-553.109.1.lve.el8.x86_64 #1 SMP Thu Mar 5 20:23:46 UTC 2026 x86_64
User: posscale (1027)
PHP: 8.2.30
Disabled: exec,passthru,shell_exec,system
$ pwd: /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/nftables.cpython-310.pyc
o

�N�gUN�@s�dZddlZddlmZe�e�Zdd�Z	ddd	�Z	dd
d�Z
ddd
�Zddd�Zddd�Z
ddd�Zddd�Zddd�Zddd�ZdS)a		
Management of nftables
======================

This is an nftables-specific module designed to manage Linux firewalls. It is
expected that this state module, and other system-specific firewall states, may
at some point be deprecated in favor of a more generic `firewall` state.

.. code-block:: yaml

    httpd:
      nftables.append:
        - table: filter
        - chain: input
        - jump: accept
        - match: state
        - connstate: new
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      nftables.append:
        - table: filter
        - family: ipv6
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      nftables.insert:
        - position: 1
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      nftables.insert:
        - position: 1
        - table: filter
        - family: ipv6
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      nftables.delete:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      nftables.delete:
        - position: 1
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      nftables.delete:
        - table: filter
        - family: ipv6
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - proto: tcp
        - sport: 1025:65535
        - save: True

    output:
      nftables.chain_present:
        - family: ip
        - table: filter

    output:
      nftables.chain_absent:
        - family: ip
        - table: filter

�N)�STATE_INTERNAL_KEYWORDScCsdtvrdSdS)zA
    Only load if the locale module is available in __salt__
    znftables.versionZnftables)Fz#nftables module could not be loaded)�__salt__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/nftables.py�__virtual__xsr�filter�ipv4c	Cs�|iddd�}td|||d�}|ddur%d|d<d�|||�|d	<|Std
r4d�|||�|d	<|Std||||||d
�}|ddur[d|i|d<d|d<d�|||�|d	<|Sd|d<d�|||d	��|�|d	<|S)a
    .. versionadded:: 2014.7.0

    .. versionchanged:: 3002

    Verify a chain exists in a table.

    name
        A user-defined chain name.

    table
        The table to own the chain.

    family
        Networking family, either ipv4 or ipv6
    N���name�changes�result�comment�nftables.check_chain��familyr
Tz5nftables {} chain is already exist in {} table for {}r�testz<nftables chain {} would be created in table {} for family {}znftables.new_chain)�
table_type�hook�priorityr�localerz3nftables {} chain in {} table create success for {}Fz0Failed to create {} chain in {} table: {} for {})r�format�__opts__�strip)	r�tablerrrr�ret�chain_check�resrrr�
chain_present�s:������rcCs�|iddd�}td|||�}|s d|d<d�|||�|d<|Std	|||�}|r]td
|||�}|durKd|i|d<d|d<d
�|||�|d<|Sd|d<d�|||��|�|d<|Sd|d<d�|||��|�|d<|S)z�
    .. versionadded:: 2014.7.0

    Verify the chain is absent.

    family
        Networking family, either ipv4 or ipv6
    Nr	r
rTr
z6nftables {} chain is already absent in {} table for {}r�nftables.flushznftables.delete_chainrrz3nftables {} chain in {} table delete success for {}Fz0Failed to delete {} chain in {} table: {} for {}z/Failed to flush {} chain in {} table: {} for {})rrr)rrrrrZflush_chain�commandrrr�chain_absent�s<
��������r!cKs�|iddd�}tD]	}||vr||=q	tddd|i|��}|ds$|S|d}tddd|d	d
�|��}|ds;|S|d}td|d|d
||�}|drad|d<d�||��|�|d<|Sdtvrvtdrvd�||��|�|d<|Std|d|d
||�}|dr�d|i|d<d|d<d�||��|�|d<d|vr�|dr�tdd|d�d�||��|�|d<|Sd|d<d�||��||d�|d<|S)a�
    .. versionadded:: 0.17.0

    Append a rule to a chain

    name
        A user-defined name to call this rule by in another part of a state or
        formula. This should not be an actual rule.

    family
        Network family, ipv4 or ipv6.

    All other arguments are passed in with the same name as the long option
    that would normally be used for nftables, with one exception: `--state` is
    specified as `connstate` instead of `state` (not to be confused with
    `ctstate`).
    Nr	r
�nftables.build_rulerr
�ruleT�add��fullrr �nftables.checkr�chainz,nftables rule for {} already set ({}) for {}rrz0nftables rule for {} needs to be set ({}) for {}znftables.appendrr�&Set nftables rule for {} to: {} for {}�save�
nftables.save��filenamer�0Set and Saved nftables rule for {} to: {} for {}FzDFailed to set nftables rule for {}.
Attempted rule was {} for {}.
{}r��_STATE_INTERNAL_KEYWORDSrrrr�rr�kwargsr�ignorerr#r rrr�append�sd���
�
�
�
����r4cKs�|iddd�}tD]	}||vr||=q	tddd|i|��}|ds$|S|d}tddd|d	d
�|��}|ds;|S|d}td|d|d
||�}|drad|d<d�|||���|d<|Sdtvrvtdrvd�|||���|d<|Std|d|d
|d||�}|dr�d|i|d<d|d<d�||��|�|d<d|vr�|dr�tdd|d�d�||��|�|d<|Sd|d<d�||���|d<|S)a
    .. versionadded:: 2014.7.0

    Insert a rule into a chain

    name
        A user-defined name to call this rule by in another part of a state or
        formula. This should not be an actual rule.

    family
        Networking family, either ipv4 or ipv6

    All other arguments are passed in with the same name as the long option
    that would normally be used for nftables, with one exception: `--state` is
    specified as `connstate` instead of `state` (not to be confused with
    `ctstate`).
    Nr	r
r"rr
r#T�insertr%r'rr(z,nftables rule for {} already set for {} ({})rrz0nftables rule for {} needs to be set for {} ({})znftables.insert�positionrrr)r*r+r,r.Fz9Failed to set nftables rule for {}.
Attempted rule was {}rr/r1rrrr51sh���
�
��
�
����r5cKs�|iddd�}tD]	}||vr||=q	tdd d|i|��}|ds$|S|d}tdd d|d	d
�|��}|ds;|S|d}td|d|d
||�}|dsad|d<d�|||���|d<|Sdtvrvtdrvd�|||���|d<|Sd|vr�td|d|d
||dd�}ntd|d|d
||d�}|dr�d|i|d<d|d<d|�d|����|d<d|vr�|dr�tdd|d�d�||��|�|d<|Sd|d<d�||���|d<|S)!a�
    .. versionadded:: 2014.7.0

    Delete a rule to a chain

    name
        A user-defined name to call this rule by in another part of a state or
        formula. This should not be an actual rule.

    family
        Networking family, either ipv4 or ipv6

    All other arguments are passed in with the same name as the long option
    that would normally be used for nftables, with one exception: `--state` is
    specified as `connstate` instead of `state` (not to be confused with
    `ctstate`).
    Nr	r
r"rr
r#T�Dr%r'rr(z/nftables rule for {} already absent for {} ({})rrz4nftables rule for {} needs to be deleted for {} ({})r6znftables.delete)rr6)rr#rrzDelete nftables rule for � r*r+r,z/Deleted and Saved nftables rule for {} for {}{}Fz<Failed to delete nftables rule for {}.
Attempted rule was {}rr/r1rrr�delete|sl���
�
���
����r9Fc	Ksb|iddd�}tdrd|d<|StD]	}||vr||=qd|vr%d|d<td	|d|d
�}|sE|dsEd|d<d
�|d|�|d<|Sd|vrNd|d<n&td|d|d|d
�}|st|dstd|d<d�|d|d|�|d<|Std|d|d|�}|ds�|r�|dr�|ds�d|i|d<d|d<d�|d|d|�|d<|Sd|d<d|d<|S)a>
    .. versionadded:: 2014.7.0

    .. versionchanged:: 3002

    Flush current nftables state

    family
        Networking family, either ipv4 or ipv6

    ignore_absence
        If set to True, attempts to flush a non-existent table will not
        result in a failed state.

        .. versionadded:: 3002

    Nr	r
rz*nftables flush not performed in test mode.rrr�nftables.check_tablerr
Fz<Failed to flush table {} in family {}, table does not exist.r(rzHFailed to flush chain {} in table {} in family {}, chain does not exist.rrrTz3Flush nftables rules in {} table {} chain {} familyzFailed to flush nftables rules)rr0rr)	rrZignore_absencer2rr3Zcheck_tableZcheck_chainrrrr�flush�s\���
������r;cKsF|iddd�}tD]	}||vr||=q	td||d|�}|p d��|d��kr=d|d<d	�|d|||d�|d
<|StdrQd�|d|||d�|d
<|Std
||d|d��|�r�d|i|d<d|d<d�|d|d|�|d
<d|vr�|dr�td|�d�|d�d�|d|d|�|d
<|Sd|d<d|d
<|S)a
    .. versionadded:: 3002

    Sets the default policy for nftables chains

    table
        The table that owns the chain that should be modified

    family
        Networking family, either ipv4 or ipv6

    policy
        The requested table policy (accept or drop)

    save
        Boolean to save the in-memory nftables settings to a file.

    save_filename
        The filename to save the nftables settings (default: /etc/nftables
        or /etc/nftables/salt-all-in-one.nft if the former is a directory)

    Nr	r
znftables.get_policyr(�policyTr
zInftables default policy for chain {} on table {} for {} already set to {}rrzMnftables default policy for chain {} on table {} for {} needs to be set to {}znftables.set_policyrrz)Set default policy for {} to {} family {}r*r+Z
save_filenamer,z3Set and saved default policy for {} to {} family {}Fz%Failed to set nftables default policy)r0r�lowerrr�get)rrrr2rr3r<rrr�
set_policysN������
���	�r?cKs�|iddd�}td||d�}|ddur#d|d<d�||�|d	<|Std
r1d�||�|d	<|Std||d�}|ddurSd
|i|d<d|d<d�||�|d	<|Sd|d<d|�d|��|d	<|S)z�
    .. versionadded:: 3002

    Ensure an nftables table is present

    name
        A user-defined table name.

    family
        Networking family, either ipv4 or ipv6
    Nr	r
r:rr
Tz-nftables table {} already exists in family {}rrz/nftables table {} would be created in family {}znftables.new_tablerrz3nftables table {} successfully created in family {}FzFailed to create table z for family �rrr�rrr2rZtable_checkrrrr�
table_present]s0
����rBcKs�|iddd�}td||�}|ddur"d|d<d�||�|d	<|Std
r0d�||�|d	<|Std||d
�}|ddurRd|i|d<d|d<d�||�|d	<|Sd|d<d|�d|��|d	<|S)z�
    .. versionadded:: 3002

    Ensure an nftables table is absent

    name
        Name of the table to ensure is absent

    family
        Networking family, either ipv4 or ipv6
    Nr	r
r:r
FTz2nftables table {} is already absent from family {}rrz1nftables table {} would be deleted from family {}znftables.delete_tablerrrz5nftables table {} successfully deleted from family {}zFailed to delete table z
 from family r@rArrr�table_absent�s0
����rC)rNNNr)rr)r)rF)�__doc__�loggingZ
salt.staterr0�	getLogger�__name__�logrrr!r4r5r9r;r?rBrCrrrr�<module>sp


�
9
.
I
K
Q
G
I-
@ Telegram