root/usr/share/firewall4/templates/rule.uc

   1 {%+ if (rule.family && !rule.has_addrs): -%}
   2         meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
   3 {%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes): -%}
   4         meta l4proto {{
   5                 (rule.proto.name == 'icmp' && rule.family == 6) ? 'ipv6-icmp' : rule.proto.name
   6         }} {%+ endif -%}
   7 {%+ if (rule.iifnames): -%}
   8         iifname {{ fw4.set(rule.iifnames) }} {%+ endif -%}
   9 {%+ if (rule.oifnames): -%}
  10         oifname {{ fw4.set(rule.oifnames) }} {%+ endif -%}
  11 {%+ if (rule.saddrs_pos): -%}
  12         {{ fw4.ipproto(rule.family) }} saddr {{ fw4.set(rule.saddrs_pos) }} {%+ endif -%}
  13 {%+ if (rule.saddrs_neg): -%}
  14         {{ fw4.ipproto(rule.family) }} saddr != {{ fw4.set(rule.saddrs_neg) }} {%+ endif -%}
  15 {%+ for (let a in rule.saddrs_masked): -%}
  16         {{ fw4.ipproto(rule.family) }} saddr & {{ a.mask }} {{ a.invert ? '!=' : '==' }} {{ a.addr }} {%+ endfor -%}
  17 {%+ if (rule.daddrs_pos): -%}
  18         {{ fw4.ipproto(rule.family) }} daddr {{ fw4.set(rule.daddrs_pos) }} {%+ endif -%}
  19 {%+ if (rule.daddrs_neg): -%}
  20         {{ fw4.ipproto(rule.family) }} daddr != {{ fw4.set(rule.daddrs_neg) }} {%+ endif -%}
  21 {%+ for (let a in rule.daddrs_masked): -%}
  22         {{ fw4.ipproto(rule.family) }} daddr & {{ a.mask }} {{ a.invert ? '!=' : '==' }} {{ a.addr }} {%+ endfor -%}
  23 {%+ if (rule.sports_pos): -%}
  24         {{ rule.proto.name }} sport {{ fw4.set(rule.sports_pos) }} {%+ endif -%}
  25 {%+ if (rule.sports_neg): -%}
  26         {{ rule.proto.name }} sport != {{ fw4.set(rule.sports_neg) }} {%+ endif -%}
  27 {%+ if (rule.dports_pos): -%}
  28         {{ rule.proto.name }} dport {{ fw4.set(rule.dports_pos) }} {%+ endif -%}
  29 {%+ if (rule.dports_neg): -%}
  30         {{ rule.proto.name }} dport != {{ fw4.set(rule.dports_neg) }} {%+ endif -%}
  31 {%+ if (rule.smacs_pos): -%}
  32         ether saddr {{ fw4.set(rule.smacs_pos) }} {%+ endif -%}
  33 {%+ if (rule.smacs_neg): -%}
  34         ether saddr != {{ fw4.set(rule.smacs_neg) }} {%+ endif -%}
  35 {%+ if (rule.icmp_types): -%}
  36         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type {{ fw4.set(rule.icmp_types) }} {%+ endif -%}
  37 {%+ if (rule.icmp_codes): -%}
  38         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type . {{ (rule.family == 4) ? "icmp" : "icmpv6" }} code {{
  39                 fw4.set(rule.icmp_codes, true)
  40         }} {%+ endif -%}
  41 {%+ if (rule.helper): -%}
  42         ct helper{% if (rule.helper.invert): %} !={% endif %} {{ fw4.quote(rule.helper.name, true) }} {%+ endif -%}
  43 {%+ if (rule.limit): -%}
  44         limit rate {{ rule.limit.rate }}/{{ rule.limit.unit }}
  45         {%- if (rule.limit_burst): %} burst {{ rule.limit_burst }} packets{% endif %} {%+ endif -%}
  46 {%+ if (rule.start_date): -%}
  47         meta time >= {{
  48                 exists(rule.start_date, "hour") ? fw4.datetime(rule.start_date) : fw4.date(rule.start_date)
  49         }} {%+ endif -%}
  50 {%+ if (rule.stop_date): -%}
  51         meta time <= {{
  52                 exists(rule.stop_date, "hour") ? fw4.datetime(rule.stop_date) : fw4.date(rule.stop_date)
  53         }} {%+ endif -%}
  54 {%+ if (rule.start_time): -%}
  55         meta hour >= {{ fw4.time(rule.start_time) }} {%+ endif -%}
  56 {%+ if (rule.stop_time): -%}
  57         meta hour <= {{ fw4.time(rule.stop_time) }} {%+ endif -%}
  58 {%+ if (rule.weekdays): -%}
  59         meta day{% if (rule.weekdays.invert): %} !={% endif %} {{ fw4.set(rule.weekdays.days) }} {%+ endif -%}
  60 {%+ if (rule.mark && rule.mark.mask < 0xFFFFFFFF): -%}
  61         meta mark and {{ fw4.hex(rule.mark.mask) }} {{
  62                 rule.mark.invert ? '!=' : '=='
  63         }} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  64 {%+ if (rule.mark && rule.mark.mask == 0xFFFFFFFF): -%}
  65         meta mark{% if (rule.mark.invert): %} !={% endif %} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  66 {%+ if (rule.dscp): -%}
  67         {{ fw4.ipproto(rule.family) }} dscp{% if (rule.dscp.invert): %} !={% endif %} {{ fw4.hex(rule.dscp.dscp) }} {%+ endif -%}
  68 {%+ if (rule.ipset): -%}
  69         {{ fw4.concat(rule.ipset.fields) }}{{
  70                 rule.ipset.invert ? ' !=' : ''
  71         }} @{{ rule.ipset.name }} {%+ endif -%}
  72 {%+ if (rule.counter): -%}
  73         counter {%+ endif -%}
  74 {%+ if (rule.log): -%}
  75         log prefix {{ fw4.quote(rule.log, true) }} {%+ endif -%}
  76 {%+ if (rule.target == "mark"): -%}
  77         meta mark set {{
  78                 (rule.set_xmark.mask == 0xFFFFFFFF)
  79                         ? fw4.hex(rule.set_xmark.mark)
  80                         : (rule.set_xmark.mark == 0)
  81                                 ? 'mark and ' + fw4.hex(~rule.set_xmark.mask & 0xFFFFFFFF)
  82                                 : (rule.set_xmark.mark == rule.set_xmark.mask)
  83                                         ? 'mark or ' + fw4.hex(rule.set_xmark.mark)
  84                                         : (rule.set_xmark.mask == 0)
  85                                                 ? 'mark xor ' + fw4.hex(rule.set_xmark.mark)
  86                                                 : 'mark and ' + fw4.hex(~r.set_xmark.mask & 0xFFFFFFFF) + ' xor ' + fw4.hex(r.set_xmark.mark)
  87         }} {%+
  88    elif (rule.target == "dscp"): -%}
  89         {{ fw4.ipproto(rule.family) }} dscp set {{ fw4.hex(rule.set_dscp.dscp) }} {%+
  90    elif (rule.target == "notrack"): -%}
  91         notrack {%+
  92    elif (rule.target == "helper"): -%}
  93         ct helper set {{ fw4.quote(rule.set_helper.name, true) }} {%+
  94    elif (rule.jump_chain): -%}
  95         jump {{ rule.jump_chain }} {%+
  96    elif (rule.target): -%}
  97         {{ rule.target }} {%+
  98    endif -%}
  99 comment {{ fw4.quote("!fw4: " + rule.name, true) }}