HEX
Server: Apache
System: Linux server2.voipitup.com.au 4.18.0-553.104.1.lve.el8.x86_64 #1 SMP Tue Feb 10 20:07:30 UTC 2026 x86_64
User: posscale (1027)
PHP: 8.2.29
Disabled: exec,passthru,shell_exec,system
$ pwd: /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/iptables.cpython-310.pyc
o

�N�g���@shdZddlZddlZddlZddlZddlZddlZddlZddl	Zddl
ZddlmZddl
mZe�e�Zdd�Zd9dd	�Zd9d
d�Zd9dd
�Zdd�Zd:dd�Zd9dd�Z						d;dd�Zd<dd�Zd9dd�Zd=dd�Zd>dd�Zd=d d!�Zd<d"d#�Z d=d$d%�Z!d>d&d'�Z"d>d(d)�Z#d>d*d+�Z$d=d,d-�Z%d?d.d/�Z&d@d0d1�Z'dAd2d3�Z(dBd5d6�Z)d7d8�Z*dS)Ca�
Support for iptables

Configuration Options
---------------------

The following options can be set in the minion config, grains, pillar, or
master config. The configuration is read using :py:func:`config.get
<salt.modules.config.get>`.

- ``iptables.save_filters``: List of REGEX strings to FILTER OUT matching lines

  This is useful for filtering out chains, rules, etc that you do not wish to
  persist, such as ephemeral Docker rules.

  The default is to not filter out anything.

  .. code-block:: yaml

      iptables.save_filters:
        - "-j CATTLE_PREROUTING"
        - "-j DOCKER"
        - "-A POSTROUTING"
        - "-A CATTLE_POSTROUTING"
        - "-A FORWARD"
�N)�
SaltException)�STATE_INTERNAL_KEYWORDScCstjj�d�s	dSdS)z7
    Only load the module if iptables is installed
    �iptables)FzGThe iptables execution module cannot be loaded: iptables not installed.T��salt�utils�path�which�r
r
�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/iptables.py�__virtual__,sr�ipv4cCs$|dkrtjj�d�Stjj�d�S)zG
    Return correct command based on the family, e.g. ipv4 or ipv6
    �ipv6Z	ip6tablesrr��familyr
r
r�
_iptables_cmd9srcCs*t|��d�}|td|dd�vrdSdS)z�
    Return truth of whether iptables has `option`.  For example:

    .. code-block:: python

        _has_option('--wait')
        _has_option('--check', family='ipv6')
    z --help�cmd.run_stdout�quiet�Zoutput_loglevelTF)r�__salt__)�optionr�cmdr
r
r�_has_optionCs	rcCs�tddkr|dkrdSdStddkr|dkrdSdStdd	kr*|dkr(d
SdStdd
kr8|dkr6dSdStddkr@dStddkrN|dkrLdSdStddkr\|dkrZdSdStddkrj|dkrhdSdStdd�td�d��)z@
    Some distros have a specific location for config files
    Z	os_familyZRedHatrz/etc/sysconfig/ip6tablesz/etc/sysconfig/iptablesZArchz/etc/iptables/ip6tables.rulesz/etc/iptables/iptables.rulesZDebianz/etc/iptables/rules.v6z/etc/iptables/rules.v4�osZGentooz/var/lib/ip6tables/rules-savez/var/lib/iptables/rules-saveZSusez+/etc/sysconfig/scripts/SuSEfirewall2-customZVoidr
ZAlpinez/etc/iptables/rules6-savez/etc/iptables/rules-saveZ	NILinuxRTz!/etc/natinst/share/ip6tables.confz /etc/natinst/share/iptables.confzSaving iptables to file is notz supported on {}.z$ Please file an issue with SaltStack)Z
__grains__r�formatrr
r
r�_confRsJ���rcCstddg�}|S)a
    Return array of strings from `save_filters` in config.

    This array will be pulled from minion config, minion grains,
    minion pillar, or master config.  The default value returned is [].

    .. code-block:: python

        _conf_save_filters()
    z
config.option�iptables.save_filters)r)Zconfigr
r
r�_conf_save_filters�srcCs�dtvr6gtd<|pt�D](}ztd�t�|��Wq
tjy5}z
t�d||�WYd}~q
d}~wwtdrIdd�|�d�D�}d�	|�S|S)ar
    Return string with `save_filter` regex entries removed.  For example:

    If `filters` is not provided, it will be pulled from minion config,
    minion grains, minion pillar, or master config. Default return value
    if no filters found is the original cmd_output string.

    .. code-block:: python

        _regex_iptables_save(cmd_output, ['-A DOCKER*'])
    rzSkipping regex rule: '%s': %sNcs*g|]�t�fdd�tdD��s��qS)c3s�|]}|���VqdS�N)�search)�.0Zreg��liner
r�	<genexpr>�s�z2_regex_iptables_save.<locals>.<listcomp>.<genexpr>r)�any�__context__)r r
r!r�
<listcomp>�s��z(_regex_iptables_save.<locals>.<listcomp>T�)
r%r�append�re�compile�error�log�warning�
splitlines�join)Z
cmd_output�filters�pattern�eZ_filtered_cmd_outputr
r
r�_regex_iptables_save�s 
���
r3cCs&t|��d�}td|���}|dS)z�
    Return version from iptables --version

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.version

        IPv6:
        salt '*' iptables.version family=ipv6
    z
 --versionr�)rr�split)rr�outr
r
r�version�s
r7�filterr'cs�d�vr��d��d<��dd���dd�tt�gd�D]	}|�vr(�|=qg}d}	t�d����fd	d
�}
d�vrM|�d�|
d��d���d=d
�vra|�d�|
d
��d
���d
=d�vru��d�dkru�d�d<�d=d�vr�|	s�|�d�|
d��d��d}	�d=d�vr�d}t|t�s�|�	d�}|D]!}|�d|���d�vr�|�
�dvr�|�d��d���d=q�d�vrވ�d�dkr�|�d�|
d��d���d=�d=d�v�r t�dt�r�dg�d<�dD]$}
d}|
�d��s|
�d��rd}t�
�d|
�}
|�d |�d!|
���q��d=d"�v�r?d#|v�r/|�d#�|�d$�|
d"��d"���d"=d%�v�rT|�d&�|
d%��d%���d%=d'�v�ri|�d(�|
d'��d'���d'=d)D]r}|�v�r�d*|v�r�|�d*�|	�s�d+S�|}t|t��r�td,d-�|D���r��fd.d/�|D�}|�d�d�d0d-�|D��}nt|��d��s�t|��d��r�t�
�d|�}|�d�n|}|�d1|�d2|����|=�qkd3�v�r�d4|v�r�|�d4�|�d5��d3���d3=d6�v�r�d6�r|�d7�|
d6��d6���d6=g}d8}|D]B}|�v�r[�|��d9v�r3|�d1|���n%t�fd:d-�tjD���rM|�d1|�d;��d<��n|�d1|�d2�����|=�q�D]/}|
|�}�|�t|�d=k�rrd>nd1}�d9v�r{dnd2����|�|�|�|������q_||7}|�r�|�s�d?S|�s�d@S|�s�dAS|dBv�r�d>}nd1}tdC|��r�dCnd}dD�t|�||||||d2�|��Sd2�|�S)Ea�
    Build a well-formatted iptables rule based on kwargs. A `table` and `chain`
    are not required, unless `full` is True.

    If `full` is `True`, then `table`, `chain` and `command` are required.
    `command` may be specified as either a short option ('I') or a long option
    (`--insert`). This will return the iptables command, exactly as it would
    be used from the command line.

    If a position is required (as with `-I` or `-D`), it may be specified as
    `position`. This will only be useful if `full` is True.

    If `state` is passed, it will be ignored, use `connstate`.
    If `connstate` is passed in, it will automatically be changed to `state`.

    To pass in jump options that doesn't take arguments, pass in an empty
    string.

    .. note::

        Whereas iptables will accept ``-p``, ``--proto[c[o[l]]]`` as synonyms
        of ``--protocol``, if ``--proto`` appears in an iptables command after
        the appearance of ``-m policy``, it is interpreted as the ``--proto``
        option of the policy extension (see the iptables-extensions(8) man
        page).

    CLI Examples:

    .. code-block:: bash

        salt '*' iptables.build_rule match=state \
            connstate=RELATED,ESTABLISHED jump=ACCEPT

        salt '*' iptables.build_rule filter INPUT command=I position=3 \
            full=True match=state connstate=RELATED,ESTABLISHED jump=ACCEPT

        salt '*' iptables.build_rule filter INPUT command=A \
            full=True match=state connstate=RELATED,ESTABLISHED \
            source='127.0.0.1' jump=ACCEPT

        .. Invert Rules
        salt '*' iptables.build_rule filter INPUT command=A \
            full=True match=state connstate=RELATED,ESTABLISHED \
            source='!127.0.0.1' jump=ACCEPT

        salt '*' iptables.build_rule filter INPUT command=A \
            full=True match=state connstate=RELATED,ESTABLISHED \
            destination='not 127.0.0.1' jump=ACCEPT

        IPv6:
        salt '*' iptables.build_rule match=state \
            connstate=RELATED,ESTABLISHED jump=ACCEPT \
            family=ipv6
        salt '*' iptables.build_rule filter INPUT command=I position=3 \
            full=True match=state connstate=RELATED,ESTABLISHED jump=ACCEPT \
            family=ipv6
    �target�jump�nameN�state)�chain�save�tableFz
(!|not)\s?cs:t�|�}|�d�s|�d�rt��d|��|<dSdS)z�
        Will check if the defined argument is intended to be negated,
        (i.e. prefixed with '!' or 'not'), and add a '! ' to the rule.

        The prefix will be removed from the value in the kwargs dict.
        �!�notr'�! )�str�
startswithr)�sub)�arg�value)�bang_not_pat�kwargsr
r�maybe_add_negations
z&build_rule.<locals>.maybe_add_negation�ifz{}-i {}Zofz{}-o {}�proto�match�policy�protocolz{}-p {}T�,z-m Zname_)ZpknockZquota2Zrecentz	--name {}z{}--proto {}�	match-setr'r@rArBz-m set z--match-set Z	connstatez-m statez{}--state {}Zdportz{}--dport {}Zsportz{}--sport {})�dportsZsportsz-m multiportz!Error: protocol must be specifiedcss0�|]}t|��d�st|��d�r|VqdS)r@rAN)rCrD�r �ir
r
rr#ps���
�zbuild_rule.<locals>.<genexpr>csg|]}t��dt|���qS)r')r)rErC)r �item)rHr
rr&us�zbuild_rule.<locals>.<listcomp>css�|]}t|�VqdSr�rCrSr
r
rr#ys�z--� �commentz
-m commentz--comment "{}"�setz{}--match-set {})p�jr:�add-set�and-mark�and-tos�
checksum-fill�clamp-mss-to-pmtu�
clustermac�ctevents�ctmask�del-set�ecn-tcp-remove�exist�	expevents�gateway�	hash-init�hashmode�helper�label�
local-node�log-ip-options�	log-level�
log-prefix�log-tcp-options�log-tcp-sequence�log-uid�mask�new�nfmask�nflog-group�nflog-prefix�nflog-range�nflog-threshold�nodst�notrack�on-ip�on-port�or-mark�or-tos�
persistent�
queue-balance�queue-bypass�	queue-num�random�rateest-ewmalog�rateest-interval�rateest-name�reject-with�restore�restore-mark�	save-mark�selctx�	set-class�set-dscp�set-dscp-class�set-mark�set-mss�set-tos�	set-xmark�
strip-options�timeout�to�to-destination�to-ports�	to-source�total-nodes�tproxy-mark�ttl-dec�ttl-inc�ttl-set�type�ulog-cprange�ulog-nlgroup�ulog-prefix�ulog-qthreshold�xor-mark�xor-tos�zone�dst-pfx�hl-dec�hl-inc�hl-set�hmark-dport-mask�hmark-dst-prefix�	hmark-mod�hmark-offset�hmark-proto-mask�	hmark-rnd�hmark-spi-mask�hmark-sport-mask�hmark-src-prefix�hmark-tuple�led-always-blink�	led-delay�led-trigger-id�queue-cpu-fanout�src-pfxzto-port�addr�and-mask�delude�honeypot�or-mask�prefix�reset�reuse�set-mac�shift�static�tarpit�tname�ttl)Nr'c3s�|]	}|t��vVqdSrrV)r Zws_char)rGr
rr#s�z "�"r4�-z"Error: Table needs to be specified�"Error: Chain needs to be specifiedz$Error: Command needs to be specifiedZ
ACDIRLSFZNXPE�--waitz{} {} -t {} {}{} {} {} {})�pop�list�_STATE_INTERNAL_KEYWORDSr)r*r(r�get�
isinstancer5�striprCrDrEr$r/�string�
whitespace�lenrr)r?r=Zcommand�position�fullrrI�ignore�rulerOrJZmatch_valuerMZ	match_setZnegative_match_setZ
multiport_argZmp_valuerRZ
after_jumpZafter_jump_argumentsZafter_jump_argument�keyZnegation�flag�waitr
)rHrIrGr�
build_rule�sB�

�

��



�





�
�
 �


w

�
�
r�cCst||d�S)z�
    Return a data structure of the rules in the conf file

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.get_saved_rules

        IPv6:
        salt '*' iptables.get_saved_rules family=ipv6
    ��	conf_filer��_parse_confr�r
r
r�get_saved_rules@s
r�cCstd|d�S)z�
    Return a data structure of the current, in-memory rules

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.get_rules

        IPv6:
        salt '*' iptables.get_rules family=ipv6

    T��in_memrr�rr
r
r�	get_rulesPsr�cCs<|sdSt||d�}z	|||dWStyYdSw)a�
    Return the current policy for the specified table/chain

    CLI Examples:

    .. code-block:: bash

        salt '*' iptables.get_saved_policy filter INPUT
        salt '*' iptables.get_saved_policy filter INPUT \
            conf_file=/etc/iptables.saved

        IPv6:
        salt '*' iptables.get_saved_policy filter INPUT family=ipv6
        salt '*' iptables.get_saved_policy filter INPUT \
            conf_file=/etc/iptables.saved family=ipv6

    r�rrNN�r��KeyError)r?r=r�r�rulesr
r
r�get_saved_policyas�r�cCs<|sdStd|d�}z	|||dWStyYdSw)z�
    Return the current policy for the specified table/chain

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.get_policy filter INPUT

        IPv6:
        salt '*' iptables.get_policy filter INPUT family=ipv6
    r�Tr�rNNr�)r?r=rr�r
r
r�
get_policy}s
�r�cCsH|sdS|sdStd|�rdnd}d�t|�||||�}td|�}|S)z�
    Set the current policy for the specified table/chain

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.set_policy filter INPUT ACCEPT

        IPv6:
        salt '*' iptables.set_policy filter INPUT ACCEPT family=ipv6
    r�z#Error: Policy needs to be specifiedr�r'z{} {} -t {} -P {} {}�cmd.run_stderr)rrrr)r?r=rNrr�rr6r
r
r�
set_policy�s
�r�cCszt�r	|s	t|�}t�d|�tj�|�}tj�|�s t�|�t|��d�}t	d|�}t
�r4t|�}t	d||�}|S)z�
    Save the current in-memory rules to disk

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.save /etc/sysconfig/iptables

        IPv6:
        salt '*' iptables.save /etc/sysconfig/iptables family=ipv6
    zSaving rules to %s�-saverz
file.write)rr,�debugrr�dirname�isdir�makedirsrrrr3)�filenamerZ
parent_dirrZiptr6r
r
rr>�s


r>c	Cs&|sdS|sdSt|�}td|�r+|�d|�d|�d|��}td|dd	�td
Stt���}td|�d|�d|���td|�d|�d
|�d|���td|�d��}td|�d|�d|���td|�d|�d|���|��D]}|�d|���r�|�	||�|��vr�dSqydS)a�
    Check for the existence of a rule in the table and chain

    This function accepts a rule in a standard iptables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.check filter INPUT \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'

        IPv6:
        salt '*' iptables.check filter INPUT \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
            family=ipv6
    r��!Error: Rule needs to be specifiedz--check� -t z -C rWr�rr�retcodezcmd.run� -N � -A rr�� -F � -X z-A TF)
rrrr%�hex�uuidZgetnoder.rD�replace)	r?r=r�rZipt_cmdrZ_chain_namer6rTr
r
r�check�s*

"�r�cCsL|sdSt|��d|��}td|��d|�d��}|dkr"d}|Sd}|S)	a
    .. versionadded:: 2014.1.0

    Check for the existence of a chain in the table

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.check_chain filter INPUT

        IPv6:
        salt '*' iptables.check_chain filter INPUT family=ipv6
    r�z	-save -t r�:rW���TF)rr�find)r?r=rrr6r
r
r�check_chains�rcC�P|sdStd|�rdnd}t|��d|�d|�d|��}td|�}|s&d}|S)	a
    .. versionadded:: 2014.1.0

    Create new custom chain to the specified table.

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.new_chain filter CUSTOM_CHAIN

        IPv6:
        salt '*' iptables.new_chain filter CUSTOM_CHAIN family=ipv6
    r�r�r'rWr�r�r�T�rrr�r?r=rr�rr6r
r
r�	new_chain$�rcCr)	a
    .. versionadded:: 2014.1.0

    Delete custom chain to the specified table.

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.delete_chain filter CUSTOM_CHAIN

        IPv6:
        salt '*' iptables.delete_chain filter CUSTOM_CHAIN family=ipv6
    r�r�r'rWr�r�r�Trrr
r
r�delete_chain@rrc	Csx|sdS|sdStd|�rdnd}t||||�}t|t�r!|r!dSt|��d|�d|�d|�d|��	}td	|�}|S)
ax
    Append a rule to the specified table/chain.

    This function accepts a rule in a standard iptables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.append filter INPUT \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'

        IPv6:
        salt '*' iptables.append filter INPUT \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
            family=ipv6
    r�r�r�r'FrWr�r�r�)rr�r��boolrr)r?r=r�rr��returnCheckrr6r
r
rr(\s$r(cCs�|sdS|sdS|sdS|dkr+t|d�}t|||d�}||d}|dkr+d}td|�r2dnd	}t||||�}t|t�rD|rDd
Sd�t|�|||||�}	td|	�}
|
S)
a�
    Insert a rule into the specified table/chain, at the specified position.

    This function accepts a rule in a standard iptables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    If the position specified is a negative number, then the insert will be
        performed counting from the end of the list. For instance, a position
        of -1 will insert the rule as the second to last rule. To insert a rule
        in the last position, use the append function instead.

    CLI Examples:

    .. code-block:: bash

        salt '*' iptables.insert filter INPUT position=3 \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'

        IPv6:
        salt '*' iptables.insert filter INPUT position=3 \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
            family=ipv6
    r�z8Error: Position needs to be specified or use append (-A)r�rrr�r4r�r'Fz{} {} -t {} -I {} {} {}r�)	r�r�rr�r�rrrr)r?r=r�r�rr��sizer�rrr6r
r
r�inserts*
�r
c	CsZ|r|rdS|r
|}td|�rdnd}t|��d|�d|�d|�d|��	}td|�}|S)aR
    Delete a rule from the specified table/chain, specifying either the rule
        in its entirety, or the rule's position in the chain.

    This function accepts a rule in a standard iptables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

    CLI Examples:

    .. code-block:: bash

        salt '*' iptables.delete filter INPUT position=3
        salt '*' iptables.delete filter INPUT \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT'

        IPv6:
        salt '*' iptables.delete filter INPUT position=3 family=ipv6
        salt '*' iptables.delete filter INPUT \
            rule='-m state --state RELATED,ESTABLISHED -j ACCEPT' \
            family=ipv6
    z2Error: Only specify a position or a rule, not bothr�r'rWr�z -D r�r)r?r=r�r�rr�rr6r
r
r�delete�s$rcCs@td|�rdnd}t|��d|�d|�d|��}td|�}|S)a
    Flush the chain in the specified table, flush all chains in the specified
    table if not specified chain.

    CLI Example:

    .. code-block:: bash

        salt '*' iptables.flush filter INPUT

        IPv6:
        salt '*' iptables.flush filter INPUT family=ipv6
    r�r'rWr�r�r�rrr
r
r�flush�srFc	Cs�t�r|s|st|�}d}|r,tjj�|d��}|��}Wd�n1s&wYn|r<t|��d�}td|�}ntd��i}d}t	�}|�
�D�]�}	tjj�|	�}	|	�
d�re|	�dd�}i||<qK|	�
d�r�|	��}
|
d	�dd�}i|||<|
d
|||d<|
d�d
d��dd�}|�d�\}
}|
|||d<||||d<g|||d<i|||d<qK|	�
d��r�tjj�|	�}d	}|d
t|�k�rm||dko�||d
�
d�}|r�||d
||||<||d
<||�
d��ra|d
7}||�
d��s||dk�r|�s|�|d�nH|d
t|�k�ra||d
dk�ra||d
�
d��sa||d|�|d
���7<|d
t|�k�ra||d
dk�ra||d
�
d��r5|d
7}|d
t|�ks�|d�
d��rz|�d�g}|�|�\}}t|�}i}|d}|D]}||�r�|dk�r�||||<�q�|ddu�r�|dd	�d�}||||d	d|<|||d	d�|�qK|S)zg
    If a file is not passed in, and the correct one for this OS is not
    detected, return False
    r'�rNr�rzA file was not found to parse�*r�rr4rN��[�]zpacket countz
byte countr�Z
rules_comment�-Ar@r�rWr�r(rXr�)rrr�filesZfopen�readrrr�_parserr.ZstringutilsZ
to_unicoderDr�r5�argsZshlex_splitr�r
r�r(�parse_known_args�varsr�)r�r�rr�Zifiler�retr?�parserr"�compsr=ZcountersZpcountZbcountr�indexZswapZparsed_args�opts�_Zret_argsrFrXr
r
rr��s�
��


"$� ���
��r�cCsLt��}|j}|ddddd�|ddddd�|dd	d
dd�|ddd
dd�|ddddd�|ddddd�|ddddd�|ddddd�|ddddd�|ddddd�|d d!d"dd�|d#d$d%dd�|d&d'd(dd�|d)d*d+dd�|d,d-d.dd�|d/d0d1dd�|d2d3d4dd�|d5d6d7dd�|d8d9d:dd�|d;d<d=dd�|d>d?d@dd�|dAdBdd�|dCdDdd�|dEdFdd�|dGdHdd�|dIdJdd�|dKdLdd�|dMdNdd�|dOdPdd�|dQdRdd�|dSdTdd�|dUdVdd�|dWdXdd�|dYdZdd�|d[d\dd�|d]d^dd�|d_d`dd�|dadbdd�|dcdddd�|dedfdd�|dgdhdd�|didjdd�|dkdldd�|dmdndd�|dodpdd�|dqdrdd�|dsdtdd�|dudvdd�|dwdxdd�|dydzdd�|d{d|dd�|d}d~dd�|dd�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�d�dd�|d�d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d�d�dd�|d��ddd�|�d�ddd�|�d�d�ddd�|�d�d�ddd�|�d	�d
dd�|�d�ddd�|�d
�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�d dd�|�d!�d"dd�|�d#�d$dd�|�d%�d&dd�|�d'�d(dd�|�d)�d*dd�|�d+�d,dd�|�d-�d.dd�|�d/�d0dd�|�d1�d2dd�|�d3�d4dd�|�d5�d6dd�|�d7�d8dd�|�d9�d:dd�|�d;�d<dd�|�d=�d>dd�|�d?�d@dd�|�dA�dBdd�|�dC�dDdd�|�dE�dFdd�|�dG�dHdd�|�dI�dJdd�|�dK�dLdd�|�dM�dNdd�|�dO�dPdd�|�dQ�dRdd�|�dS�dTdd�|�dU�dVdd�|�dW�dXdd�|�dY�dZdd�|�d[�d\dd�|�d]�d^dd�|�d_�d`dd�|�da�dbdd�|�dc�dddd�|�de�dfdd�|�dg�dhdd�|�di�djdd�|�dk�dldd�|�dm�dndd�|�do�dpdd�|�dq�drdd�|�ds�dtdd�|�du�dvdd�|�dw�dxdd�|�dy�dzdd�|�d{�d|dd�|�d}�d~dd�|�d�d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�dÐd�dd�|�dŐd�dd�|�dǐd�dd�|�dɐd�dd�|�dːd�dd�|�d͐d�dd�|�dϐd�dd�|�dѐd�dd�|�dӐd�dd�|�dՐd�dd�|�dאd�dd�|�dِd�dd�|�dېd�dd�|�dݐd�dd�|�dߐd�dd�|�d�d�dd�|�d�d�d�dd�|�d�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d	�d
dd�|�d�ddd�|�d
�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�d dd�|�d!�d"dd�|�d#�d$dd�|�d%�d&dd�|�d'�d(dd�|�d)�d*dd�|�d+�d,dd�|�d-�d.dd�|�d/�d0dd�|�d1�d2dd�|�d3�d4dd�|�d5�d6dd�|�d7�d8dd�|�d9�d:dd�|�d;�d<dd�|�d=�d>dd�|�d?�d@dd�|�dA�dBdd�|�dC�dDdd�|�dE�dFdd�|�dG�dHdd�|�dI�dJdd�|�dK�dLdd�|�dM�dNdd�|�dO�dPdd�|�dQ�dRdd�|�dS�dTdd�|�dU�dVdd�|�dW�dXdd�|�dY�dZdd�|�d[�d\dd�|�d]�d^dd�|�d_�d`dd�|�da�dbdd�|�dc�dddd�|�de�dfdd�|�dg�dhdd�|�di�djdd�|�dk�dldd�|�dm�dndd�|�do�dpdd�|�dq�drdd�|�ds�dtdd�|�du�dvdd�|�dw�dxdd�|�dy�dzdd�|�d{�d|dd�|�d}�d~dd�|�d�d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�dÐd�dd�|�dŐd�dd�|�dǐd�dd�|�dɐd�dd�|�dːd�dd�|�d͐d�dd�|�dϐd�dd�|�dѐd�dd�|�dӐd�dd�|�dՐd�dd�|�dאd�dd�|�dِd�dd�|�dېd�dd�|�dݐd�dd�|�dߐd�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d�d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��d�dd�|�d��ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d	�d
dd�|�d�ddd�|�d
�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|�d�ddd�|S(z�
    This function attempts to list all the options documented in the
    iptables(8) and iptables-extensions(8) man pages.  They will not all be
    used by all parts of the module; use them intelligently and appropriately.
    rz--appendr()�dest�actionz-Dz--deleterz-Iz--insertr
z-Rz	--replacer�z-Lz--listr�z-Fz--flushrz-Zz--zeroZzeroz-Nz--new-chainz	new-chainz-Xz--delete-chainzdelete-chainz-Pz--policyrNz-Ez--rename-chainzrename-chainz-pz
--protocolrOz-sz--source�sourcez-dz
--destinationZdestinationz-jz--jumpr:z-gz--gotoZgotoz-iz--in-interfacezin-interfacez-oz--out-interfacez
out-interfacez-fz
--fragment�fragmentz-cz--set-counterszset-countersz-mz--matchrMz
--src-typezsrc-typez
--dst-typezdst-typez--limit-iface-inzlimit-iface-inz--limit-iface-outzlimit-iface-outz--ahspiZahspiz--ahlenZahlenz--ahresZahresz
--bytecode�bytecodez--cgroupZcgroupz--cluster-total-nodeszcluster-total-nodesz--cluster-local-nodezcluster-local-nodez--cluster-local-nodemaskzcluster-local-nodemaskz--cluster-hash-seedzcluster-hash-seedz
--h-lengthzh-lengthz--mangle-mac-szmangle-mac-sz--mangle-mac-dzmangle-mac-dz	--commentrXz--connbytesZ	connbytesz--connbytes-dirz
connbytes-dirz--connbytes-modezconnbytes-modez--labelrkz--connlimit-uptozconnlimit-uptoz--connlimit-abovezconnlimit-abovez--connlimit-maskzconnlimit-maskz--connlimit-saddrzconnlimit-saddrz--connlimit-daddrzconnlimit-daddrz--markZmarkz	--ctstateZctstatez	--ctprotoZctprotoz--ctorigsrcZ	ctorigsrcz--ctorigdstZ	ctorigdstz--ctreplsrcZ	ctreplsrcz--ctrepldstZ	ctrepldstz--ctorigsrcportZ
ctorigsrcportz--ctorigdstportZ
ctorigdstportz--ctreplsrcportZ
ctreplsrcportz--ctrepldstportZ
ctrepldstportz
--ctstatusZctstatusz
--ctexpireZctexpirez--ctdirZctdirz--cpuZcpuz--sportz
--source-portZsource_portz--dportz--destination-portZdestination_portz--dccp-typesz
dccp-typesz
--dccp-optionzdccp-optionz--src-groupz	src-groupz--dst-groupz	dst-groupz--dscpZdscpz--dscp-classz
dscp-classz	--dst-lenzdst-lenz
--dst-optszdst-optsz
--ecn-tcp-cwrzecn-tcp-cwrz
--ecn-tcp-ecezecn-tcp-ecez--ecn-ip-ectz
ecn-ip-ectz--espspiZespspiz--fragidZfragidz	--fraglenZfraglenz	--fragresZfragresz--fragfirstZ	fragfirstz
--fragmoreZfragmorez
--fraglastZfraglastz--hashlimit-uptozhashlimit-uptoz--hashlimit-abovezhashlimit-abovez--hashlimit-burstzhashlimit-burstz--hashlimit-modezhashlimit-modez--hashlimit-srcmaskzhashlimit-srcmaskz--hashlimit-dstmaskzhashlimit-dstmaskz--hashlimit-namezhashlimit-namez--hashlimit-htable-sizezhashlimit-htable-sizez--hashlimit-htable-maxzhashlimit-htable-maxz--hashlimit-htable-expirezhashlimit-htable-expirez--hashlimit-htable-gcintervalzhashlimit-htable-gcintervalz	--hbh-lenzhbh-lenz
--hbh-optszhbh-optsz--helperrjz--hl-eqzhl-eqz--hl-ltzhl-ltz--hl-gtzhl-gtz--icmp-typez	icmp-typez
--icmpv6-typezicmpv6-typez--src-rangez	src-rangez--dst-rangez	dst-rangez--softZsoftz--header�headerz--ipvsZipvsz--vprotoZvprotoz--vaddrZvaddrz--vportZvportz--vdirZvdirz	--vmethodZvmethodz
--vportctlZvportctlz--length�lengthz--limit�limitz
--limit-burstzlimit-burstz--mac-sourcez
mac-sourcez	--mh-typezmh-typez--sportsz--source-portszsource-portsz--dportsz--destination-portszdestination-portsz--portsZportsz
--nfacct-nameznfacct-namez--genreZgenrez--ttlr�z--logr,z--uid-ownerz	uid-ownerz--gid-ownerz	gid-ownerz--socket-existsz
socket-existsz--physdev-inz
physdev-inz
--physdev-outzphysdev-outz--physdev-is-inz
physdev-is-inz--physdev-is-outzphysdev-is-outz--physdev-is-bridgedzphysdev-is-bridgedz
--pkt-typezpkt-typez--dir�dirz--polZpolz--strict�strictz--reqidZreqidz--spiZspiz--protorLz--mode�modez--tunnel-srcz
tunnel-srcz--tunnel-dstz
tunnel-dstz--next�nextz--quotaZquotaz	--rateestZrateestz
--rateest1Zrateest1z
--rateest2Zrateest2z--rateest-deltaz
rateest-deltaz
--rateest-bpszrateest-bpsz--rateest-bps1zrateest-bps1z--rateest-bps2zrateest-bps2z
--rateest-ppszrateest-ppsz--rateest-pps1zrateest-pps1z--rateest-pps2zrateest-pps2z--rateest-ltz
rateest-ltz--rateest-gtz
rateest-gtz--rateest-eqz
rateest-eqz--rateest-namer�z--rateest-intervalr�z--rateest-ewmazrateest-ewmaz--realmZrealmz--namer;z--setrYz	--rsourceZrsourcez--rdestZrdestz--maskrsz--rcheckZrcheckz--update�updatez--remove�removez	--seconds�secondsz--reapZreapz
--hitcountZhitcountz--rttlZrttlz--looseZloosez--validmarkZ	validmarkz--accept-localzaccept-localz--invert�invertz	--rt-typezrt-typez
--rt-segsleftzrt-segsleftz--rt-lenzrt-lenz
--rt-0-reszrt-0-resz--rt-0-addrsz
rt-0-addrsz--rt-0-not-strictzrt-0-not-strictz
--chunk-typeszchunk-typesz--match-setrQz--return-nomatchzreturn-nomatchz--update-counterszupdate-countersz--update-subcounterszupdate-subcountersz--packets-eqz
packets-eqz--packets-ltz
packets-ltz--packets-gtz
packets-gtz
--bytes-eqzbytes-eqz
--bytes-ltzbytes-ltz
--bytes-gtzbytes-gtz
--transparentZtransparentz--nowildcardZ
nowildcardz--stater<z
--probabilityZprobabilityz--everyZeveryz--packetZpacketz--algoZalgoz--from�fromz--tor�z--stringr�z--hex-stringz
hex-stringz--tcp-flagsz	tcp-flagsz--synZsynz--tcp-optionz
tcp-optionz--mssZmssz--datestartZ	datestartz
--datestopZdatestopz--timestartZ	timestartz
--timestopZtimestopz--monthdaysZ	monthdaysz
--weekdaysZweekdaysz--contiguous�
contiguousz
--kerneltzZkerneltzz--utc�utcz	--localtzZlocaltzz--tosZtosz--ttl-eqzttl-eqz--ttl-gtzttl-gtz--ttl-ltzttl-ltz--u32�u32z--conditionZ	conditionz--macZmacz
--lower-limitzlower-limitz
--upper-limitzupper-limitz--src-ccz--source-countryzsource-countryz--dst-ccz--destination-countryzdestination-countryz	--enabled�enabledz
--disabled�disabledz--ifaceZifacez--dev-inzdev-inz	--dev-outzdev-outz--upZupz--downZdownz--broadcast�	broadcastz
--loopbackZloopbackz--pointtopointZpointtopointz	--runningZrunningz--noarpZnoarpz--arpZarpz	--promiscZpromiscz--multicastZ	multicastz	--dynamicZdynamicz
--lower-upzlower-upz	--dormantZdormantz--edkZedkz--kazaaZkazaaz--gnuZgnuz--dcZdcz--bit�bitz--appleZapplez--soulZsoulz--winmxZwinmxz--aresZaresz--debugr�z--flags�flagsz--anyr$z--layer3Zlayer3z--layer4Zlayer4z--layer5Zlayer5z	--stealthZstealthz	--synscanZsynscanz--cnscanZcnscanz--grscanZgrscanz--psd-weight-thresholdzpsd-weight-thresholdz--psd-delay-thresholdzpsd-delay-thresholdz--psd-lo-ports-weightzpsd-lo-ports-weightz--psd-hi-ports-weightzpsd-hi-ports-weightz--growZgrowz--no-changez	no-changez	--packetsZpacketsz--knockportsZ
knockportsz--time�timez--autocloseZ	autoclosez	--checkipZcheckipz--typer�z--checksum-fillr^z--set-classr�z--newrtz
--hashmoderiz--clustermacr`z
--total-nodesr�z--local-noderlz--hash-initrhz--set-xmarkr�z--save-markr�z--restore-markr�z
--and-markr\z	--or-markr~z
--xor-markr�z
--set-markr�z--nfmaskruz--ctmaskrbz--saver>z	--restorer�z	--notrackr{z
--cteventsraz--expeventsrfz--zoner�z	--timeoutr�z--to-destinationr�z--randomr�z--persistentr�z	--src-pfxr�z	--dst-pfxr�z
--set-dscpr�z--set-dscp-classr�z--ecn-tcp-removerdz--hl-setr�z--hl-decr�z--hl-incr�z
--hmark-tupler�z--hmark-modr�z--hmark-offsetr�z--hmark-src-prefixr�z--hmark-dst-prefixr�z--hmark-sport-maskr�z--hmark-dport-maskr�z--hmark-spi-maskr�z--hmark-proto-maskr�z--hmark-rndr�z--led-trigger-idr�z--led-delayr�z--led-always-blinkr�z--log-levelrnz--log-prefixroz--log-tcp-sequencerqz--log-tcp-optionsrpz--log-ip-optionsrmz	--log-uidrrz
--to-portsr�z
--nflog-grouprvz--nflog-prefixrwz
--nflog-rangerxz--nflog-thresholdryz--queue-numr�z--queue-balancer�z--queue-bypassr�z--queue-cpu-fanoutr�z--rateest-ewmalogr�z
--reject-withr�z--nodstrzz--selctxr�z	--add-setr[z	--del-setrcz--existrez--to-sourcer�z	--set-mssr�z--clamp-mss-to-pmtur_z--strip-optionsr�z	--gatewayrgz	--set-tosr�z	--and-tosr]z--or-tosrz	--xor-tosr�z	--on-portr}z--on-ipr|z
--tproxy-markr�z	--ttl-setr�z	--ttl-decr�z	--ttl-incr�z--ulog-nlgroupr�z
--ulog-prefixr�z--ulog-cpranger�z--ulog-qthresholdr�z--addrr�z--tnamer�z--deluder�z--tarpitr�z	--set-macr�z--prefixr�z--reuser�z--staticr�z
--and-maskr�z	--or-maskr�z--shiftr�z
--honeypotr�z--resetr�)�argparse�ArgumentParser�add_argument)rZadd_argr
r
rr5s����r)r
r)r8NNr'Nr
)Nr
)r8NNr
)r8Nr
)r8NNNr
)NNNr
)r8r'r
)NFr
)+�__doc__r9�loggingrr)r�r�Zsalt.utils.argsrZsalt.utils.filesZsalt.utils.pathZsalt.exceptionsrZ
salt.staterr��	getLogger�__name__r,rrrrrr3r7r�r�r�r�r�r�r>r�rrrr(r
rrr�rr
r
r
r�<module>sZ




3

"
�
z





 
8



#
3
%
I
@ Telegram