o

�N�g�%�@s|dZd
dl
Z
d
dlZd
dlZd
dlmZmZ
e
�e	�
Z
dd�Zdd�Zdd	�Z
d
d�Zddd�
Zdd�Zdd�Zdd�ZdS)z{
Control the OpenBSD packet filter (PF).

:codeauthor: Jasper Lievisse Adriaanse <j@jasper.la>

.. versionadded:: 2019.2.0
�N)�CommandExecutionError�SaltInvocationErrorc
Cs8d
dg}td|vrt
jj�d�
rdSdd�td�
fS)z�
    Only works on OpenBSD and FreeBSD for now; other systems with pf (macOS,
    FreeBSD, etc) need to be tested before enabling them.
    �FreeBSDZOpenBSD�os�pfctlTFzlThe pf execution module cannot be loaded: either the OS ({}) is not tested or the pfctl binary was not found)�
__grains__�salt�utils�path�which�format)
Ztested_oses�r
�C/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/pf.py�__virtual__s




�rcC�bi}td
dddd�}
|
ddkrdd	d
�}|S|
ddkr%d
dd
�}|St
d|
dg
dd�d��
)zk
    Enable the Packet Filter.

    CLI Example:

    .. code-block:: bash

        salt '*' pf.enable
    �cmd.run_allzpfctl -e�traceF�Zoutput_loglevel�python_shell�retcoder
z
pf enabledT��comment�changes�stderrzpfctl: pf already enabledzpf already enabledzCould not enable pf��errorsr�
�info��__salt__r��ret�resultr
r
r�enable"�


�

�

�

�r#cCr)zm
    Disable the Packet Filter.

    CLI Example:

    .. code-block:: bash

        salt '*' pf.disable
    rzpfctl -drFrrr
zpf disabledTrrzpfctl: pf not enabledzpf already disabledzCould not disable pfrrrr r
r
r�disableAr$r%c
Cs�d
di
}
td}|dkrgd�
}ngd�
}||v
r t
d|���
�
tdd	|��d
dd�}|d
dkr>td|dg
dd�d��
|
S)a^

    Set the debug level which limits the severity of log messages printed by ``pf(4)``.

    level:
        Log level. Should be one of the following: emerg, alert, crit, err, warning, notice,
        info or debug (OpenBSD); or none, urgent, misc, loud (FreeBSD).

    CLI Example:

    .. code-block:: bash

        salt '*' pf.loglevel emerg
    rTrr)ZnoneZurgentZmiscZloud)ZemergZalertZcrit�err�warningZnoticer�debugzUnknown loglevel: rz	pfctl -x rFrrr
z$Problem encountered setting loglevelrrr)rrrr)�levelr!ZmyosZ
all_levelsr"r
r
r�loglevel`s 





�


�r*�/etc/pf.confFcCshd
di
}dd|g}|
rd|d
<|�d�

t
d|ddd	�}|d
dkr2td|��|d
g
dd�d��
|S)aA

    Load a ruleset from the specific file, overwriting the currently loaded ruleset.

    file:
        Full path to the file containing the ruleset.

    noop:
        Don't actually load the rules, just parse them.

    CLI Example:

    .. code-block:: bash

        salt '*' pf.load /etc/pf.conf.d/lockdown.conf
    rTrz-fFz-nrrrrr
z!Problem loading the ruleset from rrr)�appendrr)�fileZnoopr!�cmdr"r
r
r�load�s







�r/c
Cs�i}
gd
�
}ddg}||7}|��|vr|��}||v
r#t
d|���
�
d|��}td|ddd	�}|d
dkrPt�d|d
�rDd|
d<nd|
d<|d
|
d<|
Std|��|d
g
dd�d��
)a�

    Flush the specified packet filter parameters.

    modifier:
        Should be one of the following:

        - all
        - info
        - osfp
        - rules
        - sources
        - states
        - tables

        Please refer to the OpenBSD `pfctl(8) <https://man.openbsd.org/pfctl#T>`_
        documentation for a detailed explanation of each command.

    CLI Example:

    .. code-block:: bash

        salt '*' pf.flush states
    )�rules�statesrZosfp�allZsources�tablesZSources�Tables�Unknown modifier: zpfctl -v -F rrFrrr
z^0.*rrTrzCould not flush rr)�titlerr�re�matchr)�modifierr!�
all_modifiers�capital_modifiersr.r"r
r
r�flush�s(








�

�r<cKsH
i}gd
�
}||v
rtd|���
�
dd|
d|g}|dvr%||�
dg�7}n|dkr:|�
d	d
�}|s5td�
�
|�|�

td|d
dd�}|ddkr}|dkrWd|d��i
}|S|dkrd|ddd�}|St�d|d�rqd|d<nd|d<|d|d<|S|dkr�t�d|d�r�|ddd�}|Std|�d|
��|dg
dd�d��
) a�
    Apply a command on the specified table.

    table:
        Name of the table.

    command:
        Command to apply to the table. Supported commands are:

        - add
        - delete
        - expire
        - flush
        - kill
        - replace
        - show
        - test
        - zero

        Please refer to the OpenBSD `pfctl(8) <https://man.openbsd.org/pfctl#T>`_
        documentation for a detailed explanation of each command.

    CLI Example:

    .. code-block:: bash

        salt '*' pf.table expire table=spam_hosts number=300
        salt '*' pf.table add table=local_hosts addresses='["127.0.0.1", "::1"]'
    )	�killr<�add�delete�expire�replace�show�testZzerozUnknown table command: rz-tz-T)r>r?rArC�	addressesr@�numberNz.need expire_number argument for expire commandrrF)Zoutput_levelrrr
rBr�stdoutrCrT)r�matchesz^(0.*|no changes)rz^\d+/\d+ addresses match.$zCould not apply z
 on table rr)r�getr,r�splitr7r8r)Zcommand�table�kwargsr!Zall_commandsr.rEr"r
r
rrJ�sD








�
�

�
��

�rJc
Cs�d
di
}
dg
}gd�
}||7}|��|vr|��}||v
r$t
d|���
�
d|��}td|ddd	�}|d
dkrC|d�d
�
|
d<|
Std|��|dg
dd�d��
)a#

    Show filter parameters.

    modifier:
        Modifier to apply for filtering. Only a useful subset of what pfctl supports
        can be used with Salt.

        - rules
        - states
        - tables

    CLI Example:

    .. code-block:: bash

        salt '*' pf.show rules
    rFr4)r0r1r3r5z	pfctl -s rrrrr
rF�

rzCould not show rrr)r6rrrIr)r9r!r;r:r.r"r
r
rrBE
s"







�

�rB)r+F)�__doc__�loggingr7Zsalt.utils.pathrZsalt.exceptionsrr�	getLogger�__name__�logrr#r%r*r/r<rJrBr
r
r
r�<module>
s



0$9X