golden hour

/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules

File/Folder	Size	Actions
__init__.py	35 B
__pycache__	-
acme.py	12.74 KB
aix_group.py	4.12 KB
aix_shadow.py	1.93 KB
aixpkg.py	24.15 KB
aliases.py	5.07 KB
alternatives.py	5.71 KB
ansiblegate.py	19.51 KB
apache.py	12.47 KB
apcups.py	2.15 KB
apf.py	3.09 KB
apkpkg.py	16 KB
aptly.py	15.28 KB
aptpkg.py	116.64 KB
archive.py	48.63 KB
arista_pyeapi.py	22.06 KB
artifactory.py	24.78 KB
at.py	10.72 KB
at_solaris.py	8.51 KB
augeas_cfg.py	13.93 KB
aws_sqs.py	6.55 KB
azurearm_compute.py	20.8 KB
azurearm_dns.py	15.8 KB
azurearm_network.py	82.99 KB
azurearm_resource.py	35.75 KB
bamboohr.py	7.36 KB
baredoc.py	11.13 KB
bcache.py	28.97 KB
beacons.py	27.82 KB
bigip.py	69.11 KB
bluez_bluetooth.py	6.76 KB
boto3_elasticache.py	37.34 KB
boto3_elasticsearch.py	53.17 KB
boto3_route53.py	39.82 KB
boto3_sns.py	12.93 KB
boto_apigateway.py	61.86 KB
boto_asg.py	35.69 KB
boto_cfn.py	7.95 KB
boto_cloudfront.py	12.75 KB
boto_cloudtrail.py	14.45 KB
boto_cloudwatch.py	10.99 KB
boto_cloudwatch_event.py	9.48 KB
boto_cognitoidentity.py	14.63 KB
boto_datapipeline.py	6.94 KB
boto_dynamodb.py	14.98 KB
boto_ec2.py	79.27 KB
boto_efs.py	14.05 KB
boto_elasticache.py	23.69 KB
boto_elasticsearch_domain.py	15.85 KB
boto_elb.py	35.53 KB
boto_elbv2.py	10.78 KB
boto_iam.py	75.62 KB
boto_iot.py	26.2 KB
boto_kinesis.py	19.62 KB
boto_kms.py	17.29 KB
boto_lambda.py	35.05 KB
boto_rds.py	34.92 KB
boto_route53.py	32.55 KB
boto_s3.py	4.24 KB
boto_s3_bucket.py	31.8 KB
boto_secgroup.py	25.22 KB
boto_sns.py	7.22 KB
boto_sqs.py	6.43 KB
boto_ssm.py	3.63 KB
boto_vpc.py	113.08 KB
bower.py	5.85 KB
bridge.py	10.81 KB
bsd_shadow.py	6.25 KB
btrfs.py	33.66 KB
cabal.py	3.79 KB
capirca_acl.py	40.04 KB
cassandra_cql.py	54.16 KB
cassandra_mod.py	4.3 KB
celery.py	3.33 KB
ceph.py	15.82 KB
chassis.py	1.52 KB
chef.py	4.66 KB
chocolatey.py	41.55 KB
chronos.py	2.89 KB
chroot.py	11.73 KB
cimc.py	23.02 KB
ciscoconfparse_mod.py	14.79 KB
cisconso.py	3.83 KB
cloud.py	9.39 KB
cmdmod.py	163.73 KB
composer.py	10.31 KB
config.py	16.98 KB
consul.py	69.3 KB
container_resource.py	12.94 KB
cp.py	31.98 KB
cpan.py	5.54 KB
cron.py	28.09 KB
cryptdev.py	10.08 KB
csf.py	16.04 KB
cyg.py	8.32 KB
daemontools.py	5.41 KB
data.py	3.85 KB
datadog_api.py	7.76 KB
ddns.py	7.12 KB
deb_apache.py	7.41 KB
deb_postgres.py	4.18 KB
debconfmod.py	4.06 KB
debian_ip.py	64.91 KB
debian_service.py	6.55 KB
debuild_pkgbuild.py	34.68 KB
defaults.py	6.55 KB
devinfo.py	9.07 KB
devmap.py	627 B
dig.py	8.75 KB
disk.py	30.82 KB
djangomod.py	7.53 KB
dnsmasq.py	5.71 KB
dnsutil.py	11.51 KB
dockercompose.py	32.62 KB
dockermod.py	224.85 KB
dpkg_lowpkg.py	12.94 KB
drac.py	10.97 KB
dracr.py	38.53 KB
drbd.py	7.19 KB
dummyproxy_pkg.py	2.46 KB
dummyproxy_service.py	2.91 KB
ebuildpkg.py	38.74 KB
eix.py	1.58 KB
elasticsearch.py	51.44 KB
environ.py	8.96 KB
eselect.py	4.99 KB
esxcluster.py	1.66 KB
esxdatacenter.py	1.68 KB
esxi.py	2.79 KB
esxvm.py	1.63 KB
etcd_mod.py	8.56 KB
ethtool.py	11.12 KB
event.py	7.67 KB
extfs.py	8.78 KB
file.py	232.18 KB
firewalld.py	20.51 KB
freebsd_sysctl.py	4.99 KB
freebsd_update.py	6.19 KB
freebsdjail.py	7.16 KB
freebsdkmod.py	6.17 KB
freebsdpkg.py	17.04 KB
freebsdports.py	13.13 KB
freebsdservice.py	12.53 KB
freezer.py	10.2 KB
gcp_addon.py	4.07 KB
gem.py	10.6 KB
genesis.py	21.75 KB
gentoo_service.py	9.18 KB
gentoolkitmod.py	8.39 KB
git.py	172.01 KB
github.py	53.19 KB
glanceng.py	4.69 KB
glassfish.py	19.49 KB
glusterfs.py	19.55 KB
gnomedesktop.py	6.85 KB
google_chat.py	1.52 KB
gpg.py	39.09 KB
grafana4.py	30.27 KB
grains.py	21.81 KB
groupadd.py	11.87 KB
grub_legacy.py	3.08 KB
guestfs.py	2.37 KB
hadoop.py	3.76 KB
haproxyconn.py	10.17 KB
hashutil.py	6.77 KB
heat.py	25.25 KB
helm.py	39.27 KB
hg.py	7.16 KB
highstate_doc.py	22.76 KB
hosts.py	10.47 KB
http.py	3.76 KB
icinga2.py	4.46 KB
idem.py	1.75 KB
ifttt.py	2.28 KB
ilo.py	15.98 KB
incron.py	7.68 KB
influxdb08mod.py	15.07 KB
influxdbmod.py	16.13 KB
infoblox.py	17.53 KB
ini_manage.py	14.63 KB
inspectlib	-
inspector.py	8.19 KB
introspect.py	4.02 KB
iosconfig.py	14.78 KB
ipmi.py	25.47 KB
ipset.py	17.97 KB
iptables.py	57.44 KB
iwtools.py	3.99 KB
jboss7.py	20.51 KB
jboss7_cli.py	15.23 KB
jenkinsmod.py	11.9 KB
jinja.py	2.66 KB
jira_mod.py	7.07 KB
junos.py	73.96 KB
k8s.py	24.87 KB
kapacitor.py	5.37 KB
kerberos.py	5.42 KB
kernelpkg_linux_apt.py	6.71 KB
kernelpkg_linux_yum.py	7.26 KB
key.py	1007 B
keyboard.py	2.64 KB
keystone.py	43.14 KB
keystoneng.py	21.82 KB
keystore.py	7.18 KB
kmod.py	7.65 KB
kubeadm.py	34.64 KB
kubernetesmod.py	46.77 KB
launchctl_service.py	9.69 KB
layman.py	4.22 KB
ldap3.py	18.81 KB
ldapmod.py	5.9 KB
libcloud_compute.py	23.48 KB
libcloud_dns.py	9.73 KB
libcloud_loadbalancer.py	13.14 KB
libcloud_storage.py	12.16 KB
linux_acl.py	7.7 KB
linux_ip.py	5.55 KB
linux_lvm.py	17.86 KB
linux_service.py	4.64 KB
linux_shadow.py	12.96 KB
linux_sysctl.py	7.5 KB
localemod.py	11.84 KB
locate.py	2.58 KB
logadm.py	9.44 KB
logmod.py	1.25 KB
logrotate.py	7.72 KB
lvs.py	11.54 KB
lxc.py	147.27 KB
lxd.py	90.07 KB
mac_assistive.py	11.37 KB
mac_brew_pkg.py	19.91 KB
mac_desktop.py	2.77 KB
mac_group.py	6.62 KB
mac_keychain.py	6.39 KB
mac_pkgutil.py	2.84 KB
mac_portspkg.py	11.36 KB
mac_power.py	13.29 KB
mac_service.py	19.64 KB
mac_shadow.py	14.23 KB
mac_softwareupdate.py	14.52 KB
mac_sysctl.py	5.13 KB
mac_system.py	15.07 KB
mac_timezone.py	8.34 KB
mac_user.py	16.41 KB
mac_xattr.py	6.27 KB
macdefaults.py	2.33 KB
macpackage.py	6.66 KB
makeconf.py	17.31 KB
mandrill.py	6.31 KB
marathon.py	5.36 KB
match.py	13 KB
mattermost.py	3.4 KB
mdadm_raid.py	9.86 KB
mdata.py	3.38 KB
memcached.py	6.13 KB
mine.py	18.84 KB
minion.py	7.68 KB
mod_random.py	7.18 KB
modjk.py	12.48 KB
mongodb.py	29.75 KB
monit.py	5.51 KB
moosefs.py	3.87 KB
mount.py	58.44 KB
mssql.py	14.64 KB
msteams.py	2.11 KB
munin.py	2.4 KB
mysql.py	90.66 KB
nacl.py	9.72 KB
nagios.py	6.53 KB
nagios_rpc.py	5.09 KB
namecheap_domains.py	12.84 KB
namecheap_domains_dns.py	5.93 KB
namecheap_domains_ns.py	4.51 KB
namecheap_ssl.py	25.69 KB
namecheap_users.py	2.4 KB
napalm_bgp.py	9.72 KB
napalm_formula.py	11.33 KB
napalm_mod.py	61.37 KB
napalm_netacl.py	28.59 KB
napalm_network.py	93.22 KB
napalm_ntp.py	10.22 KB
napalm_probes.py	13.25 KB
napalm_route.py	5.09 KB
napalm_snmp.py	7.05 KB
napalm_users.py	6.49 KB
napalm_yang_mod.py	20.28 KB
netaddress.py	1.6 KB
netbox.py	32.22 KB
netbsd_sysctl.py	3.92 KB
netbsdservice.py	6.43 KB
netmiko_mod.py	19.61 KB
netscaler.py	27.02 KB
network.py	63.42 KB
neutron.py	44.92 KB
neutronng.py	15.02 KB
nexus.py	22.95 KB
nfs3.py	3.9 KB
nftables.py	33.58 KB
nginx.py	3.83 KB
nilrt_ip.py	36.18 KB
nix.py	8.03 KB
nova.py	19.6 KB
npm.py	10.4 KB
nspawn.py	41.35 KB
nxos.py	24.65 KB
nxos_api.py	14.72 KB
nxos_upgrade.py	14.74 KB
omapi.py	3.6 KB
openbsd_sysctl.py	3.74 KB
openbsdpkg.py	10.97 KB
openbsdrcctl_service.py	6.33 KB
openbsdservice.py	8.31 KB
openscap.py	2.81 KB
openstack_config.py	3.21 KB
openstack_mng.py	2.71 KB
openvswitch.py	17.19 KB
opkg.py	49.67 KB
opsgenie.py	3.29 KB
oracle.py	5.82 KB
osquery.py	24.93 KB
out.py	2.53 KB
pacmanpkg.py	31.92 KB
pagerduty.py	4.7 KB
pagerduty_util.py	13.48 KB
pam.py	2.01 KB
panos.py	61.05 KB
parallels.py	19.85 KB
parted_partition.py	21.53 KB
pcs.py	14.11 KB
pdbedit.py	10.79 KB
pecl.py	3.79 KB
peeringdb.py	8.39 KB
pf.py	9.51 KB
philips_hue.py	1.55 KB
pillar.py	21.37 KB
pip.py	53.42 KB
pkg_resource.py	12.3 KB
pkgin.py	17.29 KB
pkgng.py	61.07 KB
pkgutil.py	9.85 KB
portage_config.py	22.73 KB
postfix.py	16.24 KB
postgres.py	88.24 KB
poudriere.py	7.85 KB
powerpath.py	2.57 KB
proxy.py	11.49 KB
ps.py	20.89 KB
publish.py	10.25 KB
puppet.py	10.9 KB
purefa.py	33.59 KB
purefb.py	13.69 KB
pushbullet.py	1.88 KB
pushover_notify.py	3.48 KB
pw_group.py	4.62 KB
pw_user.py	12.47 KB
pyenv.py	6.93 KB
qemu_img.py	1.53 KB
qemu_nbd.py	3.28 KB
quota.py	6.43 KB
rabbitmq.py	38.4 KB
rallydev.py	6.09 KB
random_org.py	23.76 KB
rbac_solaris.py	16.05 KB
rbenv.py	10.75 KB
rdp.py	6.08 KB
rebootmgr.py	7.68 KB
redismod.py	16.36 KB
reg.py	16.36 KB
rest_pkg.py	2.26 KB
rest_sample_utils.py	558 B
rest_service.py	3.63 KB
restartcheck.py	24.1 KB
restconf.py	3.15 KB
ret.py	1.27 KB
rh_ip.py	38.55 KB
rh_service.py	16.61 KB
riak.py	5.19 KB
rpm_lowpkg.py	27.67 KB
rpmbuild_pkgbuild.py	24.53 KB
rsync.py	8.04 KB
runit.py	17.17 KB
rvm.py	11.1 KB
s3.py	9.93 KB
s6.py	3.62 KB
salt_proxy.py	4.48 KB
salt_version.py	4.58 KB
saltcheck.py	46.66 KB
saltcloudmod.py	954 B
saltutil.py	57.49 KB
schedule.py	50.81 KB
scp_mod.py	6.22 KB
scsi.py	2.66 KB
sdb.py	2.48 KB
seed.py	8.87 KB
selinux.py	24.2 KB
sensehat.py	7.79 KB
sensors.py	1.3 KB
serverdensity_device.py	8.1 KB
servicenow.py	4.36 KB
slack_notify.py	7.83 KB
slackware_service.py	6.84 KB
slsutil.py	19.04 KB
smartos_imgadm.py	12.04 KB
smartos_nictagadm.py	6.46 KB
smartos_virt.py	5.21 KB
smartos_vmadm.py	26.2 KB
smbios.py	10.05 KB
smf_service.py	8.52 KB
smtp.py	5.41 KB
snapper.py	27.14 KB
solaris_fmadm.py	11.2 KB
solaris_group.py	2.8 KB
solaris_shadow.py	7.98 KB
solaris_system.py	3.72 KB
solaris_user.py	11.06 KB
solarisipspkg.py	18.68 KB
solarispkg.py	15.4 KB
solr.py	45.54 KB
solrcloud.py	14.63 KB
splunk.py	8.14 KB
splunk_search.py	8.76 KB
sqlite3.py	2.54 KB
ssh.py	43.89 KB
ssh_pkg.py	1.08 KB
ssh_service.py	3.39 KB
state.py	82.34 KB
status.py	57.79 KB
statuspage.py	14.67 KB
supervisord.py	11.15 KB
suse_apache.py	2.45 KB
suse_ip.py	35.72 KB
svn.py	10.75 KB
swarm.py	13.5 KB
swift.py	5.53 KB
sysbench.py	6.62 KB
sysfs.py	6.61 KB
syslog_ng.py	31.52 KB
sysmod.py	22.59 KB
sysrc.py	3.38 KB
system.py	19.28 KB
system_profiler.py	3.54 KB
systemd_service.py	46.29 KB
telegram.py	3.28 KB
telemetry.py	12.87 KB
temp.py	831 B
test.py	15.4 KB
test_virtual.py	237 B
testinframod.py	9.92 KB
textfsm_mod.py	16.22 KB
timezone.py	19.98 KB
tls.py	58.63 KB
tomcat.py	18.59 KB
trafficserver.py	10.44 KB
transactional_update.py	35.83 KB
travisci.py	2.05 KB
tuned.py	2.34 KB
twilio_notify.py	2.95 KB
udev.py	3.72 KB
upstart_service.py	16.92 KB
uptime.py	3.23 KB
useradd.py	22.63 KB
uwsgi.py	996 B
vagrant.py	20.4 KB
varnish.py	3.08 KB
vault.py	15.61 KB
vbox_guest.py	10.55 KB
vboxmanage.py	14.71 KB
vcenter.py	1.61 KB
victorops.py	6.54 KB
virt.py	287.71 KB
virtualenv_mod.py	15.09 KB
vmctl.py	9.56 KB
vsphere.py	380.41 KB
webutil.py	3.66 KB
win_auditpol.py	4.74 KB
win_autoruns.py	2.29 KB
win_certutil.py	4.55 KB
win_dacl.py	32.27 KB
win_disk.py	1.8 KB
win_dism.py	20.7 KB
win_dns_client.py	4.19 KB
win_dsc.py	27.54 KB
win_event.py	22.32 KB
win_file.py	64.39 KB
win_firewall.py	20.15 KB
win_groupadd.py	11.27 KB
win_iis.py	68.78 KB
win_ip.py	11.43 KB
win_lgpo.py	491.76 KB
win_lgpo_reg.py	17.9 KB
win_license.py	2.72 KB
win_network.py	13.9 KB
win_ntp.py	1.8 KB
win_path.py	11.12 KB
win_pkg.py	86.43 KB
win_pki.py	15.8 KB
win_powercfg.py	9.85 KB
win_psget.py	8.97 KB
win_servermanager.py	14.21 KB
win_service.py	32.96 KB
win_shadow.py	3.03 KB
win_shortcut.py	16.49 KB
win_smtp_server.py	17.67 KB
win_snmp.py	13.38 KB
win_status.py	16.94 KB
win_system.py	40.61 KB
win_task.py	79.17 KB
win_timezone.py	13.3 KB
win_useradd.py	27.39 KB
win_wua.py	38.29 KB
win_wusa.py	5.88 KB
winrepo.py	6.09 KB
wordpress.py	4.71 KB
x509.py	63.1 KB
x509_v2.py	74.15 KB
xapi_virt.py	24.07 KB
xbpspkg.py	15.84 KB
xfs.py	15.35 KB
xml.py	2.14 KB
xmpp.py	5.28 KB
yaml.py	1.94 KB
yumpkg.py	116.5 KB
zabbix.py	97.55 KB
zcbuildout.py	28.16 KB
zenoss.py	5.64 KB
zfs.py	34.44 KB
zk_concurrency.py	11.16 KB
znc.py	2.26 KB
zoneadm.py	15.05 KB
zonecfg.py	21.85 KB
zookeeper.py	14.72 KB
zpool.py	44.02 KB
zypperpkg.py	94.87 KB

Edit: nftables.py

"""
Support for nftables
"""

import json
import logging
import re

import salt.utils.data
import salt.utils.files
import salt.utils.path
from salt.exceptions import CommandExecutionError
from salt.state import STATE_INTERNAL_KEYWORDS as _STATE_INTERNAL_KEYWORDS

log = logging.getLogger(__name__)

_NFTABLES_FAMILIES = {
    "ipv4": "ip",
    "ip4": "ip",
    "ip": "ip",
    "ipv6": "ip6",
    "ip6": "ip6",
    "inet": "inet",
    "arp": "arp",
    "bridge": "bridge",
    "netdev": "netdev",
}

def __virtual__():
    """
    Only load the module if nftables is installed
    """
    if salt.utils.path.which("nft"):
        return "nftables"
    return (
        False,
        "The nftables execution module failed to load: nftables is not installed.",
    )

def _nftables_cmd():
    """
    Return correct command
    """
    return "nft"

def _conf(family="ip"):
    """
    Use the same file for rules for now.
    """
    if __grains__["os_family"] == "RedHat":
        return "/etc/nftables"
    elif __grains__["os_family"] == "Arch":
        return "/etc/nftables"
    elif __grains__["os_family"] == "Debian":
        return "/etc/nftables"
    elif __grains__["os"] == "Gentoo":
        return "/etc/nftables"
    else:
        return False

def version():
    """
    Return version from nftables --version

CLI Example:

.. code-block:: bash

salt '*' nftables.version

"""
    cmd = "{} --version".format(_nftables_cmd())
    out = __salt__["cmd.run"](cmd).split()
    return out[1]

def build_rule(
    table=None,
    chain=None,
    command=None,
    position="",
    full=None,
    family="ipv4",
    **kwargs
):
    """
    Build a well-formatted nftables rule based on kwargs.
    A `table` and `chain` are not required, unless `full` is True.

If `full` is `True`, then `table`, `chain` and `command` are required.
    `command` may be specified as either insert, append, or delete.
    This will return the nftables command, exactly as it would
    be used from the command line.

If a position is required (as with `insert` or `delete`), it may be specified as
    `position`. This will only be useful if `full` is True.

If `connstate` is passed in, it will automatically be changed to `state`.

CLI Examples:

.. code-block:: bash

salt '*' nftables.build_rule match=state \\
            connstate=RELATED,ESTABLISHED jump=ACCEPT
        salt '*' nftables.build_rule filter input command=insert position=3 \\
            full=True match=state state=related,established jump=accept

IPv6:
        salt '*' nftables.build_rule match=state \\
            connstate=related,established jump=accept \\
            family=ipv6
        salt '*' nftables.build_rule filter input command=insert position=3 \\
            full=True match=state state=related,established jump=accept \\
            family=ipv6

"""
    ret = {"comment": "", "rule": "", "result": False}

if "target" in kwargs:
        kwargs["jump"] = kwargs["target"]
        del kwargs["target"]

for ignore in list(_STATE_INTERNAL_KEYWORDS) + ["chain", "save", "table"]:
        if ignore in kwargs:
            del kwargs[ignore]

rule = ""
    proto = ""

nft_family = _NFTABLES_FAMILIES[family]

if "if" in kwargs:
        rule += "meta iifname {} ".format(kwargs["if"])
        del kwargs["if"]

if "of" in kwargs:
        rule += "meta oifname {} ".format(kwargs["of"])
        del kwargs["of"]

if "proto" in kwargs:
        proto = kwargs["proto"]

if "state" in kwargs:
        del kwargs["state"]

if "connstate" in kwargs:
        rule += "ct state {{ {0} }} ".format(kwargs["connstate"])
        del kwargs["connstate"]

if "icmp-type" in kwargs:
        rule += "icmp type {{ {0} }} ".format(kwargs["icmp-type"])
        del kwargs["icmp-type"]

if "pkttype" in kwargs:
        rule += "meta pkttype {{ {0} }} ".format(kwargs["pkttype"])
        del kwargs["pkttype"]

if "counter" in kwargs:
        rule += "counter "
        del kwargs["counter"]

if "saddr" in kwargs or "source" in kwargs:
        rule += "ip saddr {} ".format(kwargs.get("saddr") or kwargs.get("source"))
        if "saddr" in kwargs:
            del kwargs["saddr"]
        if "source" in kwargs:
            del kwargs["source"]

if "daddr" in kwargs or "destination" in kwargs:
        rule += "ip daddr {} ".format(kwargs.get("daddr") or kwargs.get("destination"))
        if "daddr" in kwargs:
            del kwargs["daddr"]
        if "destination" in kwargs:
            del kwargs["destination"]

if "dport" in kwargs:
        kwargs["dport"] = str(kwargs["dport"])
        if ":" in kwargs["dport"]:
            kwargs["dport"] = kwargs["dport"].replace(":", "-")
        rule += "dport {{ {0} }} ".format(kwargs["dport"])
        del kwargs["dport"]

if "sport" in kwargs:
        kwargs["sport"] = str(kwargs["sport"])
        if ":" in kwargs["sport"]:
            kwargs["sport"] = kwargs["sport"].replace(":", "-")
        rule += "sport {{ {0} }} ".format(kwargs["sport"])
        del kwargs["sport"]

if "dports" in kwargs:
        # nftables reverse sorts the ports from
        # high to low, create rule like this
        # so that the check will work
        _dports = kwargs["dports"].split(",")
        _dports = [int(x) for x in _dports]
        _dports.sort(reverse=True)
        kwargs["dports"] = ", ".join(str(x) for x in _dports)

rule += "dport {{ {0} }} ".format(kwargs["dports"])
        del kwargs["dports"]

if "sports" in kwargs:
        # nftables reverse sorts the ports from
        # high to low, create rule like this
        # so that the check will work
        _sports = kwargs["sports"].split(",")
        _sports = [int(x) for x in _sports]
        _sports.sort(reverse=True)
        kwargs["sports"] = ", ".join(str(x) for x in _sports)

rule += "sport {{ {0} }} ".format(kwargs["sports"])
        del kwargs["sports"]

# Jumps should appear last, except for any arguments that are passed to
    # jumps, which of course need to follow.
    after_jump = []

if "jump" in kwargs:
        after_jump.append("{} ".format(kwargs["jump"]))
        del kwargs["jump"]

if "j" in kwargs:
        after_jump.append("{} ".format(kwargs["j"]))
        del kwargs["j"]

if "redirect-to" in kwargs or "to-port" in kwargs:
        after_jump.append(
            "redirect to {} ".format(kwargs.get("redirect-to") or kwargs.get("to-port"))
        )
        if "redirect-to" in kwargs:
            del kwargs["redirect-to"]
        if "to-port" in kwargs:
            del kwargs["to-port"]

if "to-ports" in kwargs:
        after_jump.append("--to-ports {} ".format(kwargs["to-ports"]))
        del kwargs["to-ports"]

if "to-source" in kwargs:
        after_jump.append("{} ".format(kwargs["to-source"]))
        del kwargs["to-source"]

if "to-destination" in kwargs:
        after_jump.append("{} ".format(kwargs["to-destination"]))
        del kwargs["to-destination"]

if "reject-with" in kwargs:
        after_jump.append("reject with {} ".format(kwargs["reject-with"]))
        del kwargs["reject-with"]

for item in after_jump:
        rule += item

# Strip trailing spaces off rule
    rule = rule.strip()

# Insert the protocol prior to dport or sport
    rule = rule.replace("dport", "{} dport".format(proto))
    rule = rule.replace("sport", "{} sport".format(proto))

ret["rule"] = rule

if full in ["True", "true"]:

if not table:
            ret["comment"] = "Table needs to be specified"
            return ret

if not chain:
            ret["comment"] = "Chain needs to be specified"
            return ret

if not command:
            ret["comment"] = "Command needs to be specified"
            return ret

if command in ["Insert", "insert", "INSERT"]:
            if position:
                ret["rule"] = "{} insert rule {} {} {} position {} {}".format(
                    _nftables_cmd(), nft_family, table, chain, position, rule
                )
            else:
                ret["rule"] = "{} insert rule {} {} {} {}".format(
                    _nftables_cmd(), nft_family, table, chain, rule
                )
        else:
            ret["rule"] = "{} {} rule {} {} {} {}".format(
                _nftables_cmd(), command, nft_family, table, chain, rule
            )

if ret["rule"]:
        ret["comment"] = "Successfully built rule"
    ret["result"] = True
    return ret

def get_saved_rules(conf_file=None):
    """
    Return a data structure of the rules in the conf file

CLI Example:

.. code-block:: bash

salt '*' nftables.get_saved_rules

"""
    if _conf() and not conf_file:
        conf_file = _conf()

with salt.utils.files.fopen(conf_file) as fp_:
        lines = salt.utils.data.decode(fp_.readlines())
    rules = []
    for line in lines:
        tmpline = line.strip()
        if not tmpline:
            continue
        if tmpline.startswith("#"):
            continue
        rules.append(line)
    return rules

def list_tables(family="ipv4"):
    """
    Return a data structure of the current, in-memory tables

CLI Example:

.. code-block:: bash

salt '*' nftables.list_tables

salt '*' nftables.list_tables family=ipv6

"""
    nft_family = _NFTABLES_FAMILIES[family]
    tables = []
    cmd = "{} --json --numeric --numeric --numeric list tables {}".format(
        _nftables_cmd(), nft_family
    )
    out = __salt__["cmd.run"](cmd, python_shell=False)
    if not out:
        return tables

try:
        data = json.loads(out)
    except ValueError:
        return tables

if not data or not data.get("nftables"):
        return tables

for item in data.get("nftables", []):
        if "metainfo" not in item:
            tables.append(item["table"])
    log.debug(tables)
    return tables

def get_rules(family="ipv4"):
    """
    Return a data structure of the current, in-memory rules

CLI Example:

.. code-block:: bash

salt '*' nftables.get_rules

salt '*' nftables.get_rules family=ipv6

"""
    tables = list_tables(family)
    nft_family = _NFTABLES_FAMILIES[family]

rules = []
    for table in tables:
        table_name = table["name"]
        cmd = "{} --numeric --numeric --numeric list table {} {}".format(
            _nftables_cmd(), nft_family, table_name
        )
        out = __salt__["cmd.run"](cmd, python_shell=False)
        rules.append(out)
    return rules

def get_rules_json(family="ipv4"):
    """
    .. versionadded:: 3002

Return a list of dictionaries comprising the current, in-memory rules

family
        Networking family, either ipv4 or ipv6

CLI Example:

.. code-block:: bash

salt '*' nftables.get_rules_json

salt '*' nftables.get_rules_json family=ipv6

"""
    nft_family = _NFTABLES_FAMILIES[family]
    rules = []
    cmd = "{} --numeric --numeric --numeric --json list ruleset {}".format(
        _nftables_cmd(), nft_family
    )
    out = __salt__["cmd.run"](cmd, python_shell=False)
    if not out:
        return rules

try:
        rules = (json.loads(out))["nftables"]
    except (KeyError, ValueError):
        return rules

return rules

def save(filename=None, family="ipv4"):
    """
    .. versionchanged:: 3002

Save the current in-memory rules to disk. On systems where /etc/nftables is
    a directory, a file named salt-all-in-one.nft will be dropped inside by default.
    The main nftables configuration will need to include this file.

CLI Example:

.. code-block:: bash

salt '*' nftables.save /etc/nftables
    """
    if _conf() and not filename:
        filename = _conf()

# Not a typo. Invert the dictionary twice to get unique values only.
    nft_families = {v: k for k, v in _NFTABLES_FAMILIES.items()}
    nft_families = {v: k for k, v in _NFTABLES_FAMILIES.items()}

rules = "#! nft -f\n"

for family in nft_families:
        out = get_rules(family)
        if out:
            rules += "\n"
        rules = rules + "\n".join(out)
    rules = rules + "\n"

if __salt__["file.directory_exists"](filename):
        filename = "{}/salt-all-in-one.nft".format(filename)

try:
        with salt.utils.files.fopen(filename, "wb") as _fh:
            # Write out any changes
            _fh.write(salt.utils.data.encode(rules))
    except OSError as exc:
        raise CommandExecutionError(
            "Problem writing to configuration file: {}".format(exc)
        )
    return rules

def get_rule_handle(table="filter", chain=None, rule=None, family="ipv4"):
    """
    Get the handle for a particular rule

This function accepts a rule in a standard nftables command format,
        starting with the chain. Trying to force users to adapt to a new
        method of creating rules would be irritating at best, and we
        already have a parser that can handle it.

CLI Example:

.. code-block:: bash

salt '*' nftables.get_rule_handle filter input \\
            rule='tcp dport 22 log accept'

IPv6:
        salt '*' nftables.get_rule_handle filter input \\
            rule='tcp dport 22 log accept' \\
            family=ipv6
    """
    ret = {"comment": "", "result": False}

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

if not rule:
        ret["comment"] = "Rule needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if not res["result"]:
        return res

res = check(table, chain, rule, family=family)
    if not res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} --numeric --numeric --numeric --handle list chain {} {} {}".format(
        _nftables_cmd(), nft_family, table, chain
    )
    out = __salt__["cmd.run"](cmd, python_shell=False)
    rules = re.split("\n+", out)

pat = re.compile(r"{} # handle (?P<handle>\d+)".format(rule))
    for r in rules:
        match = pat.search(r)
        if match:
            return {"result": True, "handle": match.group("handle")}
    return {"result": False, "comment": "Could not find rule {}".format(rule)}

def check(table="filter", chain=None, rule=None, family="ipv4"):
    """
    Check for the existence of a rule in the table and chain

CLI Example:

.. code-block:: bash

salt '*' nftables.check filter input \\
            rule='tcp dport 22 log accept'

IPv6:
        salt '*' nftables.check filter input \\
            rule='tcp dport 22 log accept' \\
            family=ipv6
    """
    ret = {"comment": "", "result": False}

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

if not rule:
        ret["comment"] = "Rule needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if not res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} --handle --numeric --numeric --numeric list chain {} {} {}".format(
        _nftables_cmd(), nft_family, table, chain
    )
    search_rule = "{} #".format(rule)
    out = __salt__["cmd.run"](cmd, python_shell=False).find(search_rule)

if out == -1:
        ret[
            "comment"
        ] = "Rule {} in chain {} in table {} in family {} does not exist".format(
            rule, chain, table, family
        )
    else:
        ret["comment"] = "Rule {} in chain {} in table {} in family {} exists".format(
            rule, chain, table, family
        )
        ret["result"] = True
    return ret

def check_chain(table="filter", chain=None, family="ipv4"):
    """
    .. versionadded:: 2014.7.0

Check for the existence of a chain in the table

CLI Example:

.. code-block:: bash

salt '*' nftables.check_chain filter input

IPv6:
        salt '*' nftables.check_chain filter input family=ipv6
    """

ret = {"comment": "", "result": False}

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} list table {} {}".format(_nftables_cmd(), nft_family, table)
    out = __salt__["cmd.run"](cmd, python_shell=False).find(
        "chain {0} {{".format(chain)
    )

if out == -1:
        ret["comment"] = "Chain {} in table {} in family {} does not exist".format(
            chain, table, family
        )
    else:
        ret["comment"] = "Chain {} in table {} in family {} exists".format(
            chain, table, family
        )
        ret["result"] = True
    return ret

def check_table(table=None, family="ipv4"):
    """
    Check for the existence of a table

CLI Example:

.. code-block:: bash

salt '*' nftables.check_table nat
    """
    ret = {"comment": "", "result": False}

if not table:
        ret["comment"] = "Table needs to be specified"
        return ret

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} list tables {}".format(_nftables_cmd(), nft_family)
    out = __salt__["cmd.run"](cmd, python_shell=False).find(
        "table {} {}".format(nft_family, table)
    )

if out == -1:
        ret["comment"] = "Table {} in family {} does not exist".format(table, family)
    else:
        ret["comment"] = "Table {} in family {} exists".format(table, family)
        ret["result"] = True
    return ret

def new_table(table, family="ipv4"):
    """
    .. versionadded:: 2014.7.0

Create new custom table.

CLI Example:

.. code-block:: bash

salt '*' nftables.new_table filter

IPv6:
        salt '*' nftables.new_table filter family=ipv6
    """
    ret = {"comment": "", "result": False}

if not table:
        ret["comment"] = "Table needs to be specified"
        return ret

res = check_table(table, family=family)
    if res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} add table {} {}".format(_nftables_cmd(), nft_family, table)
    out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["comment"] = "Table {} in family {} created".format(table, family)
        ret["result"] = True
    else:
        ret["comment"] = "Table {} in family {} could not be created".format(
            table, family
        )
    return ret

def delete_table(table, family="ipv4"):
    """
    .. versionadded:: 2014.7.0

Create new custom table.

CLI Example:

.. code-block:: bash

salt '*' nftables.delete_table filter

IPv6:
        salt '*' nftables.delete_table filter family=ipv6
    """
    ret = {"comment": "", "result": False}

if not table:
        ret["comment"] = "Table needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} delete table {} {}".format(_nftables_cmd(), nft_family, table)
    out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["comment"] = "Table {} in family {} deleted".format(table, family)
        ret["result"] = True
    else:
        ret["comment"] = "Table {} in family {} could not be deleted".format(
            table, family
        )
    return ret

def new_chain(
    table="filter", chain=None, table_type=None, hook=None, priority=None, family="ipv4"
):
    """
    .. versionadded:: 2014.7.0

Create new chain to the specified table.

CLI Example:

.. code-block:: bash

salt '*' nftables.new_chain filter input

salt '*' nftables.new_chain filter input \\
                table_type=filter hook=input priority=0

salt '*' nftables.new_chain filter foo

IPv6:
        salt '*' nftables.new_chain filter input family=ipv6

salt '*' nftables.new_chain filter input \\
                table_type=filter hook=input priority=0 family=ipv6

salt '*' nftables.new_chain filter foo family=ipv6
    """
    ret = {"comment": "", "result": False}

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if res["result"]:
        ret["comment"] = "Chain {} in table {} in family {} already exists".format(
            chain, table, family
        )
        return ret

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} -- add chain {} {} {}".format(_nftables_cmd(), nft_family, table, chain)
    if table_type or hook or priority:
        if table_type and hook and str(priority):
            cmd = r"{0} \{{ type {1} hook {2} priority {3}\; \}}".format(
                cmd, table_type, hook, priority
            )
        else:
            # Specify one, require all
            ret["comment"] = "Table_type, hook, and priority required."
            return ret

out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["comment"] = "Chain {} in table {} in family {} created".format(
            chain, table, family
        )
        ret["result"] = True
    else:
        ret[
            "comment"
        ] = "Chain {} in table {} in family {} could not be created".format(
            chain, table, family
        )
    return ret

def delete_chain(table="filter", chain=None, family="ipv4"):
    """
    .. versionadded:: 2014.7.0

Delete the chain from the specified table.

CLI Example:

.. code-block:: bash

salt '*' nftables.delete_chain filter input

salt '*' nftables.delete_chain filter foo

IPv6:
        salt '*' nftables.delete_chain filter input family=ipv6

salt '*' nftables.delete_chain filter foo family=ipv6
    """
    ret = {"comment": "", "result": False}

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if not res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} delete chain {} {} {}".format(_nftables_cmd(), nft_family, table, chain)
    out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["comment"] = "Chain {} in table {} in family {} deleted".format(
            chain, table, family
        )
        ret["result"] = True
    else:
        ret[
            "comment"
        ] = "Chain {} in table {} in family {} could not be deleted".format(
            chain, table, family
        )
    return ret

def append(table="filter", chain=None, rule=None, family="ipv4"):
    """
    Append a rule to the specified table & chain.

CLI Example:

.. code-block:: bash

salt '*' nftables.append filter input \\
            rule='tcp dport 22 log accept'

IPv6:
        salt '*' nftables.append filter input \\
            rule='tcp dport 22 log accept' \\
            family=ipv6
    """
    ret = {
        "comment": "Failed to append rule {} to chain {} in table {}.".format(
            rule, chain, table
        ),
        "result": False,
    }

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

if not rule:
        ret["comment"] = "Rule needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if not res["result"]:
        return res

res = check(table, chain, rule, family=family)
    if res["result"]:
        ret[
            "comment"
        ] = "Rule {} chain {} in table {} in family {} already exists".format(
            rule, chain, table, family
        )
        return ret

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} add rule {} {} {} {}".format(
        _nftables_cmd(), nft_family, table, chain, rule
    )
    out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["result"] = True
        ret["comment"] = 'Added rule "{}" chain {} in table {} in family {}.'.format(
            rule, chain, table, family
        )
    else:
        ret[
            "comment"
        ] = 'Failed to add rule "{}" chain {} in table {} in family {}.'.format(
            rule, chain, table, family
        )
    return ret

def insert(table="filter", chain=None, position=None, rule=None, family="ipv4"):
    """
    Insert a rule into the specified table & chain, at the specified position.

If position is not specified, rule will be inserted in first position.

CLI Examples:

.. code-block:: bash

salt '*' nftables.insert filter input \\
            rule='tcp dport 22 log accept'

salt '*' nftables.insert filter input position=3 \\
            rule='tcp dport 22 log accept'

IPv6:
        salt '*' nftables.insert filter input \\
            rule='tcp dport 22 log accept' \\
            family=ipv6

salt '*' nftables.insert filter input position=3 \\
            rule='tcp dport 22 log accept' \\
            family=ipv6
    """
    ret = {
        "comment": "Failed to insert rule {} to table {}.".format(rule, table),
        "result": False,
    }

if not chain:
        ret["comment"] = "Chain needs to be specified"
        return ret

if not rule:
        ret["comment"] = "Rule needs to be specified"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if not res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]
    if position:
        cmd = "{} insert rule {} {} {} position {} {}".format(
            _nftables_cmd(), nft_family, table, chain, position, rule
        )
    else:
        cmd = "{} insert rule {} {} {} {}".format(
            _nftables_cmd(), nft_family, table, chain, rule
        )
    out = __salt__["cmd.run"](cmd, python_shell=False)

def delete(table, chain=None, position=None, rule=None, family="ipv4"):
    """
    Delete a rule from the specified table & chain, specifying either the rule
        in its entirety, or the rule's position in the chain.

CLI Examples:

.. code-block:: bash

salt '*' nftables.delete filter input position=3

salt '*' nftables.delete filter input \\
            rule='tcp dport 22 log accept'

IPv6:
        salt '*' nftables.delete filter input position=3 family=ipv6

salt '*' nftables.delete filter input \\
            rule='tcp dport 22 log accept' \\
            family=ipv6
    """
    ret = {
        "comment": "Failed to delete rule {} in table {}.".format(rule, table),
        "result": False,
    }

if position and rule:
        ret["comment"] = "Only specify a position or a rule, not both"
        return ret

res = check_table(table, family=family)
    if not res["result"]:
        return res

res = check_chain(table, chain, family=family)
    if not res["result"]:
        return res

res = check(table, chain, rule, family=family)
    if not res["result"]:
        ret[
            "comment"
        ] = "Rule {} chain {} in table {} in family {} does not exist".format(
            rule, chain, table, family
        )
        return ret

# nftables rules can only be deleted using the handle
    # if we don't have it, find it.
    if not position:
        position = get_rule_handle(table, chain, rule, family)

nft_family = _NFTABLES_FAMILIES[family]
    cmd = "{} delete rule {} {} {} handle {}".format(
        _nftables_cmd(), nft_family, table, chain, position
    )
    out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["result"] = True
        ret[
            "comment"
        ] = 'Deleted rule "{}" in chain {} in table {} in family {}.'.format(
            rule, chain, table, family
        )
    else:
        ret[
            "comment"
        ] = 'Failed to delete rule "{}" in chain {}  table {} in family {}'.format(
            rule, chain, table, family
        )
    return ret

def flush(table="filter", chain="", family="ipv4"):
    """
    Flush the chain in the specified table, flush all chains in the specified
    table if chain is not specified.

CLI Example:

.. code-block:: bash

salt '*' nftables.flush filter

salt '*' nftables.flush filter input

IPv6:
        salt '*' nftables.flush filter input family=ipv6
    """
    ret = {
        "comment": "Failed to flush rules from chain {} in table {}.".format(
            chain, table
        ),
        "result": False,
    }

res = check_table(table, family=family)
    if not res["result"]:
        return res

nft_family = _NFTABLES_FAMILIES[family]

if chain:
        res = check_chain(table, chain, family=family)
        if not res["result"]:
            return res
        cmd = "{} flush chain {} {} {}".format(
            _nftables_cmd(), nft_family, table, chain
        )
        comment = "from chain {} in table {} in family {}.".format(chain, table, family)
    else:
        cmd = "{} flush table {} {}".format(_nftables_cmd(), nft_family, table)
        comment = "from table {} in family {}.".format(table, family)
    out = __salt__["cmd.run"](cmd, python_shell=False)

if not out:
        ret["result"] = True
        ret["comment"] = "Flushed rules {}".format(comment)
    else:
        ret["comment"] = "Failed to flush rules {}".format(comment)
    return ret

def get_policy(table="filter", chain=None, family="ipv4"):
    """
    .. versionadded:: 3002

Return the current policy for the specified table/chain

table
        Name of the table containing the chain to check

chain
        Name of the chain to get the policy for

family
        Networking family, either ipv4 or ipv6

CLI Example:

.. code-block:: bash

salt '*' nftables.get_policy filter input

IPv6:
        salt '*' nftables.get_policy filter input family=ipv6
    """
    if not chain:
        return "Error: Chain needs to be specified"

nft_family = _NFTABLES_FAMILIES[family]

rules = get_rules_json(family=nft_family)

try:
        for rule in rules["nftables"]:
            if (
                rule.get("chain", {}).get("name") == chain
                and rule.get("chain", {}).get("type") == table
            ):
                return rule["chain"]["policy"]
    except (KeyError, TypeError, ValueError):
        return None

def set_policy(table="filter", chain=None, policy=None, family="ipv4"):
    """
    .. versionadded:: 3002

Set the current policy for the specified table/chain. This only works on
    chains with an existing base chain.

table
        Name of the table containing the chain to modify

chain
        Name of the chain to set the policy for

policy
        accept or drop

family
        Networking family, either ipv4 or ipv6

CLI Example:

.. code-block:: bash

salt '*' nftables.set_policy filter input accept

IPv6:
        salt '*' nftables.set_policy filter input accept family=ipv6
    """
    if not chain:
        return "Error: Chain needs to be specified"
    if not policy:
        return "Error: Policy needs to be specified"

nft_family = _NFTABLES_FAMILIES[family]

chain_info = {}
    rules = get_rules_json(family=nft_family)

if not rules:
        return False

for rule in rules:
        try:
            if rule["chain"]["table"] == table and rule["chain"]["name"] == chain:
                chain_info = rule["chain"]
                break
        except KeyError:
            continue

if not chain_info:
        return False

cmd = "{} add chain {} {} {}".format(_nftables_cmd(), nft_family, table, chain)

# We can't infer the base chain parameters. Bail out if they're not present.
    if "type" not in chain_info or "hook" not in chain_info or "prio" not in chain_info:
        return False

params = "type {} hook {} priority {};".format(
        chain_info["type"], chain_info["hook"], chain_info["prio"]
    )

cmd = '{0} "{{ {1} policy {2}; }}"'.format(cmd, params, policy)

out = __salt__["cmd.run_all"](cmd, python_shell=False)

return not out["retcode"]