root/usr/share/firewall4/templates/rule.uc

   1 {%+ if (rule.family && !rule.has_addrs): -%}
   2         meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
   3 {%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes): -%}
   4         meta l4proto {{ fw4.l4proto(rule.family, rule.proto) }} {%+ endif -%}
   5 {%+ if (rule.iifnames): -%}
   6         iifname {{ fw4.set(rule.iifnames) }} {%+ endif -%}
   7 {%+ if (rule.oifnames): -%}
   8         oifname {{ fw4.set(rule.oifnames) }} {%+ endif -%}
   9 {%+ if (rule.saddrs_pos): -%}
  10         {{ fw4.ipproto(rule.family) }} saddr {{ fw4.set(rule.saddrs_pos) }} {%+ endif -%}
  11 {%+ if (rule.saddrs_neg): -%}
  12         {{ fw4.ipproto(rule.family) }} saddr != {{ fw4.set(rule.saddrs_neg) }} {%+ endif -%}
  13 {%+ for (let a in rule.saddrs_masked): -%}
  14         {{ fw4.ipproto(rule.family) }} saddr & {{ a.mask }} {{ a.invert ? '!=' : '==' }} {{ a.addr }} {%+ endfor -%}
  15 {%+ if (rule.daddrs_pos): -%}
  16         {{ fw4.ipproto(rule.family) }} daddr {{ fw4.set(rule.daddrs_pos) }} {%+ endif -%}
  17 {%+ if (rule.daddrs_neg): -%}
  18         {{ fw4.ipproto(rule.family) }} daddr != {{ fw4.set(rule.daddrs_neg) }} {%+ endif -%}
  19 {%+ for (let a in rule.daddrs_masked): -%}
  20         {{ fw4.ipproto(rule.family) }} daddr & {{ a.mask }} {{ a.invert ? '!=' : '==' }} {{ a.addr }} {%+ endfor -%}
  21 {%+ if (rule.sports_pos): -%}
  22         {{ rule.proto.name }} sport {{ fw4.set(rule.sports_pos) }} {%+ endif -%}
  23 {%+ if (rule.sports_neg): -%}
  24         {{ rule.proto.name }} sport != {{ fw4.set(rule.sports_neg) }} {%+ endif -%}
  25 {%+ if (rule.dports_pos): -%}
  26         {{ rule.proto.name }} dport {{ fw4.set(rule.dports_pos) }} {%+ endif -%}
  27 {%+ if (rule.dports_neg): -%}
  28         {{ rule.proto.name }} dport != {{ fw4.set(rule.dports_neg) }} {%+ endif -%}
  29 {%+ if (rule.smacs_pos): -%}
  30         ether saddr {{ fw4.set(rule.smacs_pos) }} {%+ endif -%}
  31 {%+ if (rule.smacs_neg): -%}
  32         ether saddr != {{ fw4.set(rule.smacs_neg) }} {%+ endif -%}
  33 {%+ if (rule.icmp_types): -%}
  34         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type {{ fw4.set(rule.icmp_types) }} {%+ endif -%}
  35 {%+ if (rule.icmp_codes): -%}
  36         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type . {{ (rule.family == 4) ? "icmp" : "icmpv6" }} code {{
  37                 fw4.set(rule.icmp_codes, true)
  38         }} {%+ endif -%}
  39 {%+ if (rule.helper): -%}
  40         ct helper{% if (rule.helper.invert): %} !={% endif %} {{ fw4.quote(rule.helper.name, true) }} {%+ endif -%}
  41 {%+ if (rule.limit): -%}
  42         limit rate {{ rule.limit.rate }}/{{ rule.limit.unit }}
  43         {%- if (rule.limit_burst): %} burst {{ rule.limit_burst }} packets{% endif %} {%+ endif -%}
  44 {%+ if (rule.start_date): -%}
  45         meta time >= {{
  46                 exists(rule.start_date, "hour") ? fw4.datetime(rule.start_date) : fw4.date(rule.start_date)
  47         }} {%+ endif -%}
  48 {%+ if (rule.stop_date): -%}
  49         meta time <= {{
  50                 exists(rule.stop_date, "hour") ? fw4.datetime(rule.stop_date) : fw4.date(rule.stop_date)
  51         }} {%+ endif -%}
  52 {%+ if (rule.start_time): -%}
  53         meta hour >= {{ fw4.time(rule.start_time) }} {%+ endif -%}
  54 {%+ if (rule.stop_time): -%}
  55         meta hour <= {{ fw4.time(rule.stop_time) }} {%+ endif -%}
  56 {%+ if (rule.weekdays): -%}
  57         meta day{% if (rule.weekdays.invert): %} !={% endif %} {{ fw4.set(rule.weekdays.days) }} {%+ endif -%}
  58 {%+ if (rule.mark && rule.mark.mask < 0xFFFFFFFF): -%}
  59         meta mark and {{ fw4.hex(rule.mark.mask) }} {{
  60                 rule.mark.invert ? '!=' : '=='
  61         }} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  62 {%+ if (rule.mark && rule.mark.mask == 0xFFFFFFFF): -%}
  63         meta mark{% if (rule.mark.invert): %} !={% endif %} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  64 {%+ if (rule.dscp): -%}
  65         {{ fw4.ipproto(rule.family) }} dscp{% if (rule.dscp.invert): %} !={% endif %} {{ fw4.hex(rule.dscp.dscp) }} {%+ endif -%}
  66 {%+ if (rule.ipset): -%}
  67         {{ fw4.concat(rule.ipset.fields) }}{{
  68                 rule.ipset.invert ? ' !=' : ''
  69         }} @{{ rule.ipset.name }} {%+ endif -%}
  70 {%+ if (rule.counter): -%}
  71         counter {%+ endif -%}
  72 {%+ if (rule.log): -%}
  73         log prefix {{ fw4.quote(rule.log, true) }} {%+ endif -%}
  74 {%+ if (rule.target == "mark"): -%}
  75         meta mark set {{
  76                 (rule.set_xmark.mask == 0xFFFFFFFF)
  77                         ? fw4.hex(rule.set_xmark.mark)
  78                         : (rule.set_xmark.mark == 0)
  79                                 ? 'mark and ' + fw4.hex(~rule.set_xmark.mask & 0xFFFFFFFF)
  80                                 : (rule.set_xmark.mark == rule.set_xmark.mask)
  81                                         ? 'mark or ' + fw4.hex(rule.set_xmark.mark)
  82                                         : (rule.set_xmark.mask == 0)
  83                                                 ? 'mark xor ' + fw4.hex(rule.set_xmark.mark)
  84                                                 : 'mark and ' + fw4.hex(~r.set_xmark.mask & 0xFFFFFFFF) + ' xor ' + fw4.hex(r.set_xmark.mark)
  85         }} {%+
  86    elif (rule.target == "dscp"): -%}
  87         {{ fw4.ipproto(rule.family) }} dscp set {{ fw4.hex(rule.set_dscp.dscp) }} {%+
  88    elif (rule.target == "notrack"): -%}
  89         notrack {%+
  90    elif (rule.target == "helper"): -%}
  91         ct helper set {{ fw4.quote(rule.set_helper.name, true) }} {%+
  92    elif (rule.jump_chain): -%}
  93         jump {{ rule.jump_chain }} {%+
  94    elif (rule.target): -%}
  95         {{ rule.target }} {%+
  96    endif -%}
  97 comment {{ fw4.quote("!fw4: " + rule.name, true) }}