root/usr/share/firewall4/templates/mangle-rule.uc

   1 {%+ for (let src_devices in rule.src?.zone) }
   2
   3 {%+ if (rule.family && !rule.has_addrs): -%}
   4         meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
   5 {%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes): -%}
   6         meta l4proto {{
   7                 (rule.proto.name == 'icmp' && rule.family == 6) ? 'ipv6-icmp' : rule.proto.name
   8         }} {%+ endif -%}
   9 {%+ if (rule.saddrs_pos): -%}
  10         {{ fw4.ipproto(rule.family) }} saddr {{ fw4.set(rule.saddrs_pos) }} {%+ endif -%}
  11 {%+ if (rule.saddrs_neg): -%}
  12         {{ fw4.ipproto(rule.family) }} saddr != {{ fw4.set(rule.saddrs_neg) }} {%+ endif -%}
  13 {%+ if (rule.daddrs_pos): -%}
  14         {{ fw4.ipproto(rule.family) }} daddr {{ fw4.set(rule.daddrs_pos) }} {%+ endif -%}
  15 {%+ if (rule.daddrs_neg): -%}
  16         {{ fw4.ipproto(rule.family) }} daddr != {{ fw4.set(rule.daddrs_neg) }} {%+ endif -%}
  17 {%+ if (rule.sports_pos): -%}
  18         {{ rule.proto.name }} sport {{ fw4.set(rule.sports_pos) }} {%+ endif -%}
  19 {%+ if (rule.sports_neg): -%}
  20         {{ rule.proto.name }} sport != {{ fw4.set(rule.sports_neg) }} {%+ endif -%}
  21 {%+ if (rule.dports_pos): -%}
  22         {{ rule.proto.name }} dport {{ fw4.set(rule.dports_pos) }} {%+ endif -%}
  23 {%+ if (rule.dports_neg): -%}
  24         {{ rule.proto.name }} dport != {{ fw4.set(rule.dports_neg) }} {%+ endif -%}
  25 {%+ if (rule.smacs_pos): -%}
  26         ether saddr {{ fw4.set(rule.smacs_pos) }} {%+ endif -%}
  27 {%+ if (rule.smacs_neg): -%}
  28         ether saddr != {{ fw4.set(rule.smacs_neg) }} {%+ endif -%}
  29 {%+ if (rule.icmp_types): -%}
  30         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type {{ fw4.set(rule.icmp_types) }} {%+ endif -%}
  31 {%+ if (rule.icmp_codes): -%}
  32         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type . {{ (rule.family == 4) ? "icmp" : "icmpv6" }} code {{
  33                 fw4.set(rule.icmp_codes, true)
  34         }} {%+ endif -%}
  35 {%+ if (rule.helper): -%}
  36         ct helper{% if (rule.helper.invert): %} !={% endif %} {{ fw4.quote(rule.helper.name, true) }} {%+ endif -%}
  37 {%+ if (rule.limit): -%}
  38         limit rate {{ rule.limit.rate }}/{{ rule.limit.unit }}
  39         {%- if (rule.limit_burst): %} burst {{ rule.limit_burst }} packets{% endif %} {%+ endif -%}
  40 {%+ if (rule.start_date): -%}
  41         meta time >= {{
  42                 exists(rule.start_date, "hour") ? fw4.datetime(rule.start_date) : fw4.date(rule.start_date)
  43         }} {%+ endif -%}
  44 {%+ if (rule.stop_date): -%}
  45         meta time <= {{
  46                 exists(rule.stop_date, "hour") ? fw4.datetime(rule.stop_date) : fw4.date(rule.stop_date)
  47         }} {%+ endif -%}
  48 {%+ if (rule.start_time): -%}
  49         meta hour >= {{ fw4.time(rule.start_time) }} {%+ endif -%}
  50 {%+ if (rule.stop_time): -%}
  51         meta hour <= {{ fw4.time(rule.stop_time) }} {%+ endif -%}
  52 {%+ if (rule.weekdays): -%}
  53         meta day{% if (rule.weekdays.invert): %} !={% endif %} {{ fw4.set(rule.weekdays.days) }} {%+ endif -%}
  54 {%+ if (rule.mark && rule.mark.mask < 0xFFFFFFFF): -%}
  55         meta mark and {{ fw4.hex(rule.mark.mask) }} {{
  56                 rule.mark.invert ? '!=' : '=='
  57         }} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  58 {%+ if (rule.mark && rule.mark.mask == 0xFFFFFFFF): -%}
  59         meta mark{% if (rule.mark.invert): %} !={% endif %} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  60 {%+ if (rule.dscp): -%}
  61         dscp{% if (rule.dscp.invert): %} !={% endif %} {{ fw4.hex(rule.dscp.dscp) }} {%+ endif -%}
  62 {%+ if (rule.ipset): -%}
  63         {{ fw4.concat(rule.ipset.fields) }}{{
  64                 rule.ipset.invert ? ' !=' : ''
  65         }} @{{ rule.ipset.name }} {%+ endif -%}
  66 {%+ if (rule.counter): -%}
  67         counter {%+ endif -%}
  68 {%+ if (rule.log): -%}
  69         log prefix {{ fw4.quote(rule.log, true) }} {%+ endif -%}
  70 {%+ if (rule.target == "mark"): -%}
  71         meta mark set {{
  72                 (rule.set_xmark.mask == 0xFFFFFFFF)
  73                         ? fw4.hex(rule.set_xmark.mark)
  74                         : (rule.set_xmark.mark == 0)
  75                                 ? 'mark and ' + fw4.hex(~rule.set_xmark.mask & 0xFFFFFFFF)
  76                                 : (rule.set_xmark.mark == rule.set_xmark.mask)
  77                                         ? 'mark or ' + fw4.hex(rule.set_xmark.mark)
  78                                         : (rule.set_xmark.mask == 0)
  79                                                 ? 'mark xor ' + fw4.hex(rule.set_xmark.mark)
  80                                                 : 'mark and ' + fw4.hex(~r.set_xmark.mask & 0xFFFFFFFF) + ' xor ' + fw4.hex(r.set_xmark.mark)
  81         }} {%+
  82    elif (rule.target == "dscp"): -%}
  83         {{ fw4.ipproto(rule.family) }} dscp set {{ fw4.hex(rule.set_dscp.dscp) }} {%+
  84    elif (rule.target == "notrack"): -%}
  85         notrack {%+
  86    elif (rule.target == "helper"): -%}
  87         ct helper set {{ fw4.quote(rule.set_helper.name, true) }} {%+
  88    elif (rule.jump_chain): -%}
  89         jump {{ rule.jump_chain }} {%+
  90    elif (rule.target): -%}
  91         {{ rule.target }} {%+
  92    endif -%}
  93 comment {{ fw4.quote(`!fw4: ${rule.name}`, true) }}