root/usr/share/firewall4/templates/rule.uc

   1 {%+ if (rule.family && !rule.has_addrs): -%}
   2         meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
   3 {%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes): -%}
   4         meta l4proto {{
   5                 (rule.proto.name == 'icmp' && rule.family == 6) ? 'ipv6-icmp' : rule.proto.name
   6         }} {%+ endif -%}
   7 {%+ if (rule.saddrs_pos): -%}
   8         {{ fw4.ipproto(rule.family) }} saddr {{ fw4.set(rule.saddrs_pos) }} {%+ endif -%}
   9 {%+ if (rule.saddrs_neg): -%}
  10         {{ fw4.ipproto(rule.family) }} saddr != {{ fw4.set(rule.saddrs_neg) }} {%+ endif -%}
  11 {%+ if (rule.daddrs_pos): -%}
  12         {{ fw4.ipproto(rule.family) }} daddr {{ fw4.set(rule.daddrs_pos) }} {%+ endif -%}
  13 {%+ if (rule.daddrs_neg): -%}
  14         {{ fw4.ipproto(rule.family) }} daddr != {{ fw4.set(rule.daddrs_neg) }} {%+ endif -%}
  15 {%+ if (rule.sports_pos): -%}
  16         {{ rule.proto.name }} sport {{ fw4.set(rule.sports_pos) }} {%+ endif -%}
  17 {%+ if (rule.sports_neg): -%}
  18         {{ rule.proto.name }} sport != {{ fw4.set(rule.sports_neg) }} {%+ endif -%}
  19 {%+ if (rule.dports_pos): -%}
  20         {{ rule.proto.name }} dport {{ fw4.set(rule.dports_pos) }} {%+ endif -%}
  21 {%+ if (rule.dports_neg): -%}
  22         {{ rule.proto.name }} dport != {{ fw4.set(rule.dports_neg) }} {%+ endif -%}
  23 {%+ if (rule.smacs_pos): -%}
  24         ether saddr {{ fw4.set(rule.smacs_pos) }} {%+ endif -%}
  25 {%+ if (rule.smacs_neg): -%}
  26         ether saddr != {{ fw4.set(rule.smacs_neg) }} {%+ endif -%}
  27 {%+ if (rule.icmp_types): -%}
  28         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type {{ fw4.set(rule.icmp_types) }} {%+ endif -%}
  29 {%+ if (rule.icmp_codes): -%}
  30         {{ (rule.family == 4) ? "icmp" : "icmpv6" }} type . {{ (rule.family == 4) ? "icmp" : "icmpv6" }} code {{
  31                 fw4.set(rule.icmp_codes)
  32         }} {%+ endif -%}
  33 {%+ if (rule.helper): -%}
  34         ct helper{% if (rule.helper.invert): %} !={% endif %} {{ fw4.quote(rule.helper.name, true) }} {%+ endif -%}
  35 {%+ if (rule.limit): -%}
  36         limit rate {{ rule.limit.rate }}/{{ rule.limit.unit }}
  37         {%- if (rule.limit_burst): %} burst {{ rule.limit_burst }} packets{% endif %} {%+ endif -%}
  38 {%+ if (rule.start_date): -%}
  39         meta time >= {{
  40                 exists(rule.start_date, "hour") ? fw4.datetime(rule.start_date) : fw4.date(rule.start_date)
  41         }} {%+ endif -%}
  42 {%+ if (rule.stop_date): -%}
  43         meta time <= {{
  44                 exists(rule.stop_date, "hour") ? fw4.datetime(rule.stop_date) : fw4.date(rule.stop_date)
  45         }} {%+ endif -%}
  46 {%+ if (rule.start_time): -%}
  47         meta hour >= {{ fw4.time(rule.start_time) }} {%+ endif -%}
  48 {%+ if (rule.stop_time): -%}
  49         meta hour <= {{ fw4.time(rule.stop_time) }} {%+ endif -%}
  50 {%+ if (rule.weekdays): -%}
  51         meta day{% if (rule.weekdays.invert): %} !={% endif %} {{ fw4.set(rule.weekdays.days) }} {%+ endif -%}
  52 {%+ if (rule.mark && rule.mark.mask < 0xFFFFFFFF): -%}
  53         meta mark and {{ fw4.hex(rule.mark.mask) }} {{
  54                 rule.mark.invert ? '!=' : '=='
  55         }} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  56 {%+ if (rule.mark && rule.mark.mask == 0xFFFFFFFF): -%}
  57         meta mark{% if (rule.mark.invert): %} !={% endif %} {{ fw4.hex(rule.mark.mark) }} {%+ endif -%}
  58 {%+ if (rule.dscp): -%}
  59         dscp{% if (rule.dscp.invert): %} !={% endif %} {{ fw4.hex(rule.dscp.dscp) }} {%+ endif -%}
  60 {%+ if (rule.ipset): -%}
  61         {{ fw4.concat(rule.ipset.fields) }}{{
  62                 rule.ipset.invert ? ' !=' : ''
  63         }} @{{ rule.ipset.name }} {%+ endif -%}
  64 {%+ if (rule.counter): -%}
  65         counter {%+ endif -%}
  66 {%+ if (rule.log): -%}
  67         log prefix {{ fw4.quote(rule.log, true) }} {%+ endif -%}
  68 {% if (rule.target == "mark"): -%}
  69         meta mark set {{
  70                 (rule.set_xmark.mask == 0xFFFFFFFF)
  71                         ? fw4.hex(rule.set_xmark.mark)
  72                         : (rule.set_xmark.mark == 0)
  73                                 ? 'mark and ' + fw4.hex(~rule.set_xmark.mask & 0xFFFFFFFF)
  74                                 : (rule.set_xmark.mark == rule.set_xmark.mask)
  75                                         ? 'mark or ' + fw4.hex(rule.set_xmark.mark)
  76                                         : (rule.set_xmark.mask == 0)
  77                                                 ? 'mark xor ' + fw4.hex(rule.set_xmark.mark)
  78                                                 : 'mark and ' + fw4.hex(~r.set_xmark.mask & 0xFFFFFFFF) + ' xor ' + fw4.hex(r.set_xmark.mark)
  79         }}
  80 {%- elif (rule.target == "dscp"): -%}
  81         {{ fw4.ipproto(rule.family) }} dscp set {{ fw4.hex(rule.set_dscp.dscp) }}
  82 {%- elif (rule.target == "notrack"): -%}
  83         notrack
  84 {%- elif (rule.target == "helper"): -%}
  85         ct helper set {{ fw4.quote(rule.set_helper.name, true) }}
  86 {%- elif (rule.jump_chain): -%}
  87         jump {{ rule.jump_chain }}
  88 {%- else -%}
  89         {{ rule.target }}
  90 {%- endif %} comment {{ fw4.quote("!fw4: " + rule.name, true) }}