o

�N�g=�@s�dZd
dl
Zd
dlmZ
zd
dlZdZWney


dZYn
wdd�Zdd	�Z	d
d�Z
dd
�Zdd�Zdd�Z
dd�Zdd�Zddd�
Zdd�Zdd�ZdS)z�
Support for Advanced Policy Firewall (APF)
==========================================
:maintainer: Mostafa Hussein <mostafa.hussein91@gmail.com>
:maturity: new
:depends: python-iptables
:platform: Linux
�N)
�CommandExecutionErrorTFcCs"tj
j�d
�
durdStsdSdS)z/
    Only load if apf exists on the system
    �apfN)Fz;The apf execution module cannot be loaded: apf unavailable.)FzFThe apf execution module cannot be loaded: python-iptables is missing.T)�salt�utils�path�which�
IPTC_IMPORTED�r	r	�D/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/apf.py�__virtual__s



rc
Cs^d
�t
jj�d�
|�}
td|
�
}|ddkr+|ds |d}n|d}td|���
�
|dS)	z!
    Return the apf location
    z{} {}rzcmd.run_all�retcoder
�stderr�stdoutzapf failed: )�formatrrrrZ__salt__r)�cmdZapf_cmd�out�msgr	r	r
�	__apf_cmd$s





rcCs<d
}t�
tj
j�
}
|
jD]}d|j��vrd}q|rdSdS)z>
    Return True if apf is running otherwise return False
    r
Zsanity�
TF)�iptcZTableZFILTERZchains�name�lower)�status�table�chainr	r	r
�_status_apf4s




�
rc
Cst�rd
SdS)zd
    Check apf status

    CLI Example:

    .. code-block:: bash

        salt '*' apf.running
    TF)
rr	r	r	r
�running@�
rcCst�rt
d
�
SdS)zs
    Stop (flush) all firewall rules

    CLI Example:

    .. code-block:: bash

        salt '*' apf.disable
    z-fN�rrr	r	r	r
�disableM�

�rcC�t�st
d
�
SdS)zj
    Load all firewall rules

    CLI Example:

    .. code-block:: bash

        salt '*' apf.enable
    z-sNrr	r	r	r
�enable[r r"cCr!)zw
    Stop (flush) & reload firewall rules

    CLI Example:

    .. code-block:: bash

        salt '*' apf.reload
    z-rNrr	r	r	r
�reloadir r#cCstd
�
S)z~
    Refresh & resolve dns names in trust rules

    CLI Example:

    .. code-block:: bash

        salt '*' apf.refresh
    z-e�
rr	r	r	r
�refreshws
r%cCs|
d
urtd|���
Sd
S)z�
    Add host (IP/FQDN) to allow_hosts.rules and immediately load new rule into firewall

    CLI Example:

    .. code-block:: bash

        salt '*' apf.allow 127.0.0.1
    Nz-a r$)�ip�portr	r	r
�allow�s

�r(c

C�td
|���
S)z�
    Add host (IP/FQDN) to deny_hosts.rules and immediately load new rule into firewall

    CLI Example:

    .. code-block:: bash

        salt '*' apf.deny 1.2.3.4
    z-d r$�
r&r	r	r
�deny�rr+c

Cr))z�
    Remove host from [glob]*_hosts.rules and immediately remove rule from firewall

    CLI Example:

    .. code-block:: bash

        salt '*' apf.remove 1.2.3.4
    z-u r$r*r	r	r
�remove�rr,)
N)�__doc__Zsalt.utils.pathrZsalt.exceptionsrrr�ImportErrorrrrrrr"r#r%r(r+r,r	r	r	r
�<module>
s(	



�