o

�N�g�n�@srdZd
dl
Z
d
dlmZ
dd�Zddd	�
Zdd
d�
Zddd
�
Zddd�
Z	ddd�
Z
ddd�
Zddd�
Zdd�Z
dS)a,
Management of iptables
======================

This is an iptables-specific module designed to manage Linux firewalls. It is
expected that this state module, and other system-specific firewall states, may
at some point be deprecated in favor of a more generic ``firewall`` state.

.. code-block:: yaml

    httpd:
      iptables.append:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.append:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match:
            - state
            - comment
        - comment: "Allow HTTP"
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.append:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match:
            - state
            - comment
        - comment: "Allow HTTP"
        - connstate: NEW
        - source: '127.0.0.1'
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    .. Invert Rule
    httpd:
      iptables.append:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match:
            - state
            - comment
        - comment: "Allow HTTP"
        - connstate: NEW
        - source: '! 127.0.0.1'
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.append:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match:
            - state
            - comment
        - comment: "Allow HTTP"
        - connstate: NEW
        - source: 'not 127.0.0.1'
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.append:
        - table: filter
        - family: ipv6
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.append:
        - table: filter
        - family: ipv4
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dports:
            - 80
            - 443
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.insert:
        - position: 1
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.insert:
        - position: 1
        - table: filter
        - family: ipv6
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.delete:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.delete:
        - position: 1
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    httpd:
      iptables.delete:
        - table: filter
        - family: ipv6
        - chain: INPUT
        - jump: ACCEPT
        - match: state
        - connstate: NEW
        - dport: 80
        - protocol: tcp
        - sport: 1025:65535
        - save: True

    default to accept:
      iptables.set_policy:
        - chain: INPUT
        - policy: ACCEPT

.. note::

    Whereas iptables will accept ``-p``, ``--proto[c[o[l]]]`` as synonyms of
    ``--protocol``, if ``--proto`` appears in an iptables command after the
    appearance of ``-m policy``, it is interpreted as the ``--proto`` option of
    the policy extension (see the iptables-extensions(8) man page).


Example rules for IPSec policy:

.. code-block:: yaml

    accept_esp_in:
      iptables.append:
        - table: filter
        - chain: INPUT
        - jump: ACCEPT
        - source: 10.20.0.0/24
        - destination: 10.10.0.0/24
        - in-interface: eth0
        - match: policy
        - dir: in
        - pol: ipsec
        - reqid: 1
        - proto: esp
    accept_esp_forward_in:
      iptables.append:
        - use:
          - iptables: accept_esp_in
        - chain: FORWARD

    accept_esp_out:
      iptables.append:
        - table: filter
        - chain: OUTPUT
        - jump: ACCEPT
        - source: 10.10.0.0/24
        - destination: 10.20.0.0/24
        - out-interface: eth0
        - match: policy
        - dir: out
        - pol: ipsec
        - reqid: 1
        - proto: esp
    accept_esp_forward_out:
      iptables.append:
        - use:
          - iptables: accept_esp_out
        - chain: FORWARD

.. note::

    ``name`` is reserved for the Salt state name. To pass ``--name EXAMPLE`` to
    iptables, provide it with ``- name_: EXAMPLE``.

.. note::

    Various functions of the ``iptables`` module use the ``--check`` option. If
    the version of ``iptables`` on the target system does not include this
    option, an alternate version of this check will be performed using the
    output of iptables-save. This may have unintended consequences on legacy
    releases of ``iptables``.
�N)
�STATE_INTERNAL_KEYWORDScCsd
tvrdSdS)zA
    Only load if the locale module is available in __salt__
    ziptables.versionT)Fz#iptables module could not be loaded)
�__salt__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/iptables.py�__virtual__�s

r�filter�ipv4cCs�|id
dd�}td|
||�}|dur"d|d<d�
||
|�|d<|Std	r1d
�
||
|�|d<|Std|
||�}|durRd|i
|d
<d|d<d�
||
|�|d<|Sd|d<d�
||
|��|�|d<|S)z�
    .. versionadded:: 2014.1.0

    Verify the chain is exist.

    name
        A user-defined chain name.

    table
        The table to own the chain.

    family
        Networking family, either ipv4 or ipv6
    N���name�changes�result�comment�iptables.check_chainTr
z5iptables {} chain is already exist in {} table for {}r�testz4iptables {} chain in {} table needs to be set for {}ziptables.new_chain�localerz3iptables {} chain in {} table create success for {}Fz0Failed to create {} chain in {} table: {} for {}�r�format�__opts__�strip)r�table�family�ret�chain_check�commandrrr�
chain_present
s4



�

�





�

�rcCs�|id
dd�}td|
||�}|s d|d<d�
||
|�|d<|Std	r/d
�
||
|�|d<|Std|
||�}|sltd|
||�}|durZd
|i
|d<d|d<d�
||
|�|d<|Sd|d<d�
||
|��|�|d<|Sd|d<d�
||
|��|�|d<|S)z�
    .. versionadded:: 2014.1.0

    Verify the chain is absent.

    table
        The table to remove the chain from

    family
        Networking family, either ipv4 or ipv6
    Nr	r
rTr
z6iptables {} chain is already absent in {} table for {}rrz4iptables {} chain in {} table needs to be removed {}�iptables.flushziptables.delete_chainrrz3iptables {} chain in {} table delete success for {}Fz0Failed to delete {} chain in {} table: {} for {}z/Failed to flush {} chain in {} table: {} for {}r)rrrrrZflush_chainrrrr�chain_absent6
sF



��


�






���

��

�rc	Ks�|id
dd�}d|vr�g|dd<g}d}|dD]R}d|vr"|d=d|vr)|d=d	|vrD|d	rDd
}|d	d
u
r>|d	}nd
}d|d	<td%i|�
�
}	d|	dvr^|dd�|	dd�

|�|	d�

|	d|d<q|r||d
urtd
}t
d
||d�
|dds�|dd=d�|�
|d<|Sd|vr�|d=tD]	}
|
|vr�||
=q�||d<|
|d<t
dd%d|i
|�
�
}t
dd%d|dd�|�
�
}t
d|
|d||�d
u�
r]d
|d<d�||��|�|d<d	|v�
r[|d	�
r[|d	d
u
r�|d	}nd
}t
d||d�}
t
d|d�
}g}|D]}
||
D]}|�||
|�d�
�

�
q�
q
g}|
D]}
|
|
D]}|�|
|
|�d�
�

�
q,�
q&||k�
r[t
d
||d�}|dd�|||��|�7<|Std�
rod �||��|�|d<|St
d!|
|d||��
r�d|i
|d<d
|d<d"�||��|�|d<d	|v�
r�|d	�
r�|d	d
u
�
r�|d	}nd
}t
d
||d�}d#�|||��|�|d<|Sd|d<d$�||��|�|d<|S)&a�
    .. versionadded:: 0.17.0

    Add a rule to the end of the specified chain.
    If the rule is already present anywhere in the chain, its position is
    not changed.

    name
        A user-defined name to call this rule by in another part of a state or
        formula. This should not be an actual rule.

    table
        The table that owns the chain which should be modified

    family
        Network family, ipv4 or ipv6.

    save
        If set to a true value, the new iptables rules for the given family
        will be saved to a file.

        If the value is True, rules are saved to an OS-dependent file
        that will be loaded during system startup, resulting in the
        firewall rule remaining active across reboots if possible.

        Note that loading the iptables rules during system startup
        may require non-default packages to be installed.
        On Debian-derived systems, the iptables-persistent
        package is required.

        If the value is a string, it is taken to be a filename to which
        the rules will be saved. Arranging for the rules to be loaded
        during system startup must be done separately.

    All other arguments are passed in with the same name as the long option
    that would normally be used for iptables, with one exception: ``--state`` is
    specified as `connstate` instead of `state` (not to be confused with
    `ctstate`).

    Jump options that doesn't take arguments should be passed in with an empty
    string.
    Nr	r
�rulesrrF�__agg__�saveTrr
�
iptables.save��filenamer�

rr�iptables.build_ruler�True�
A��fullrr�iptables.check�chainz,iptables rule for {} already set ({}) for {}�iptables.get_saved_rules�Z	conf_filer�iptables.get_rules�
r�$
Saved iptables rule {} for {}
{}
{}rz0iptables rule for {} needs to be set ({}) for {}ziptables.append�&Set iptables rule for {} to: {} for {}�+Set and saved iptables rule {} for {}
{}
{}z@Failed to set iptables rule for {}.
Attempted rule was {} for {}r)�appendr�join�_STATE_INTERNAL_KEYWORDSrr�getr�rrr�kwargsr�commentsr �rule�	save_file�_ret�ignorerr#Zsaved_rulesZ_rulesZ__rulesr+Z
__saved_rules�outrrrr3k
s�+































�




�
�



�




�



�


�



�




�





�





�

��r3c	Ks�|id
dd�}d|vr�g|dd<g}d}|dD]R}d|vr"|d=d|vr)|d=d	|vrD|d	rDd
}|d	d
u
r>|d	}nd
}d|d	<td%i|�
�
}	d|	dvr^|dd�
|	dd�

|�
|	d�

|	d|d<q|r||d
urtd
}td
||d�
|dds�|dd=d�|�
|d<|StD]	}
|
|vr�||
=q�||d<|
|d<tdd%d|i
|�
�
}tdd%d
|dd�|�
�
}td|
|d||�d
u�
rVd
|d<d�|||���|d<d	|v�
rT|d	�
rT|d	d
u
r�|d	}nd
}td||d�}
td|d�
}g}|D]}
||
D]}|�
||
|�d�
�

�
q	�
qg}|
D]}
|
|
D]}|�
|
|
|�d�
�

�
q%�
q||k�
rTtd
||d�}|dd�|||��|�7<|Std�
rhd�|||���|d<|Std |
|d|d!||��
s�d|i
|d<d
|d<d"�||��|�|d<d	|v�
r�|d	�
r�|d	d
u
�
r�|d	}nd
}td
||d�}d#�|||��|�|d<|Sd|d<d$�||���|d<|S)&aF
    .. versionadded:: 2014.1.0

    Insert a rule into a chain. If the rule is already present anywhere
    in the chain, its position is not changed.

    name
        A user-defined name to call this rule by in another part of a state or
        formula. This should not be an actual rule.

    table
        The table that owns the chain that should be modified

    family
        Networking family, either ipv4 or ipv6

    position
        The numerical representation of where the rule should be inserted into
        the chain. Note that ``-1`` is not a supported position value.

    save
        If set to a true value, the new iptables rules for the given family
        will be saved to a file. See the ``append`` state for more details.

    All other arguments are passed in with the same name as the long option
    that would normally be used for iptables, with one exception: ``--state`` is
    specified as `connstate` instead of `state` (not to be confused with
    `ctstate`).

    Jump options that doesn't take arguments should be passed in with an empty
    string.
    Nr	r
rrrFrr Trr
r!r"r$rrr%r�
Ir(r*r+z,iptables rule for {} already set for {} ({})r,r-r.r/r0rz0iptables rule for {} needs to be set for {} ({})ziptables.insert�positionr1r2z9Failed to set iptables rule for {}.
Attempted rule was {}r)	�insertr3rr4r5rrr6rr7rrrrA�
s�!





























�




�
�



�




�



�


�



�




�

�



�





�
��rAcKs�|id
dd�}d|vr�g|dd<g}d}|dD]P}d|vr"|d=d|vr)|d=d	|vrB|d	rB|d	d
u
r<|d	}nd
}d|d	<td#i|�
�
}	d|	dvr\|dd�
|	dd�

|�
|	d�

|	d|d<q|rz|d
urrd
}td
||d�
|dds�|dd=d�|�
|d<|StD]	}
|
|vr�||
=q�||d<|
|d<tdd#d|i
|�
�
}tdd#d
|dd�|�
�
}td|
|d||�d
u
r�d|v
r�d
|d<d�|||���|d<|Stdr�d�|||���|d<|Sd|v�
r
td|
|d||dd�}ntd|
|d||d�}|�
sTd|i
|d<d
|d<d|�d |����|d<d	|v�
rR|d	�
rR|d	d
u
�
r<|d	}
nd
}
td
|
|d�}d!�|||��|�|d<|Sd|d<d"�||���|d<|S)$a�
    .. versionadded:: 2014.1.0

    Delete a rule from a chain if present. If the rule is already absent,
    this is not an error and nothing is changed.

    name
        A user-defined name to call this rule by in another part of a state or
        formula. This should not be an actual rule.

    table
        The table that owns the chain that should be modified

    family
        Networking family, either ipv4 or ipv6

    save
        If set to a true value, the new iptables rules for the given family
        will be saved to a file. See the ``append`` state for more details.

    All other arguments are passed in with the same name as the long option
    that would normally be used for iptables, with one exception: ``--state`` is
    specified as `connstate` instead of `state` (not to be confused with
    `ctstate`).

    Jump options that doesn't take arguments should be passed in with an empty
    string.
    Nr	r
rrrFrr Trr
r!r"r$rrr%r�
Dr(r*r+r@z/iptables rule for {} already absent for {} ({})rz4iptables rule for {} needs to be deleted for {} ({})ziptables.delete)rr@)rr:zDelete iptables rule for �
 z/Deleted and saved iptables rule {} for {}
{}
{}z<Failed to delete iptables rule for {}.
Attempted rule was {}r)�deleter3rr4r5rrr)rrrr8rr9r r:r;r<r=rr
r#r>rrrrD�s�




























�




�
�




�



�


�
�









�
��rDcKsF
|id
dd�}tD]	}||vr||=q	t
d|
|d|�|dkr5d|d<d	�|d|
||d�|d
<|StdrId�|d|
||d�|d
<|St
d
|
|d|d|�s�d|i
|d<d|d<d�|d|d|�|d
<d|vr�|dr�|ddu
r�|d}nd
}t
d||d�
d�|d|d|�|d
<|Sd|d<d|d
<|S)a�

    .. versionadded:: 2014.1.0

    Sets the default policy for iptables firewall tables

    table
        The table that owns the chain that should be modified

    family
        Networking family, either ipv4 or ipv6

    policy
        The requested table policy

    save
        If set to a true value, the new iptables rules for the given family
        will be saved to a file. See the ``append`` state for more details.

    Nr	r
ziptables.get_policyr+�policyTr
zIiptables default policy for chain {} on table {} for {} already set to {}rrzMiptables default policy for chain {} on table {} for {} needs to be set to {}ziptables.set_policyrrz)Set default policy for {} to {} family {}r r!r"z3Set and saved default policy for {} to {} family {}Fz%Failed to set iptables default policy)r5rrr)rrrr8rr=r#rrr�
set_policy�sP

�
�
��

�

�


�




��

rFcKs�|id
dd�}tD]	}||vr||=q	d|v
rd|d<t
dr*d�||
|�|d<|Std|
|d|�sKd	|i
|d
<d|d<d
�|
|d|�|d<|Sd|d<d|d<|S)a&

    .. versionadded:: 2014.1.0

    Flush current iptables state

    table
        The table that owns the chain that should be modified

    family
        Networking family, either ipv4 or ipv6

    chain
        The chain to be flushed. All the chains in the table if none is given.


    Nr	r
r+rzAiptables rules in {} table {} chain {} family needs to be flushedrrrrTr
z3Flush iptables rules in {} table {} chain {} familyFzFailed to flush iptables rules)r5rrr)rrrr8rr=rrr�flush>s.

�


��





�

rGcCs�g}d
dg}|�d�
|v
r|S|
D]4}t
d|�
}||vrq|�d�
dkrEd|vr*q|�d�
|�d�
kr5q||v
rE|�t�|�
�

d|d<q|rYd	|vrU|d	�|�

|S||d	<|S)
z�
    The mod_aggregate function which looks up all rules in the available
    low chunks and merges them into a single rules ref in the present low data
    r3rAZfunz
state.gen_tag�stateZiptablesrTr)r6Z	__utils__r3�copy�deepcopy�extend)�low�chunksZrunningrZagg_enabled�chunk�tagrrr�
mod_aggregateks2
�









�

�
rP)rr)�__doc__rIZ
salt.staterr5rrrr3rArDrFrGrPrrrr�<module>
sy
	
/
5

	
t
E-