# {{ ansible_managed }}

{# Domain, table, chain #}
{# ==================== #}
{% set ferm__tpl_domain = ferm__domains %}
{% set ferm__tpl_table = [ 'filter' ] %}
{% set ferm__tpl_chain = [ 'INPUT' ] %}
{% if item.domain|d() %}
{%   if item.domain is string %}
{%     set ferm__tpl_domain = [ item.domain ] %}
{%   else %}
{%     set ferm__tpl_domain = item.domain | unique %}
{%   endif %}
{% elif item.domains|d() %}
{%   if item.domains is string %}
{%     set ferm__tpl_domain = [ item.domains ] %}
{%   else %}
{%     set ferm__tpl_domain = item.domains | unique %}
{%   endif %}
{% endif %}
{% if item.table|d() %}
{%   if item.table is string %}
{%     set ferm__tpl_table = [ item.table ] %}
{%   else %}
{%     set ferm__tpl_table = item.table | unique %}
{%   endif %}
{% elif item.tables|d() %}
{%   if item.tables is string %}
{%     set ferm__tpl_table = [ item.tables ] %}
{%   else %}
{%     set ferm__tpl_table = item.tables | unique %}
{%   endif %}
{% endif %}
{% if item.chain|d() %}
{%   if item.chain is string %}
{%     set ferm__tpl_chain = [ item.chain ] %}
{%   else %}
{%     set ferm__tpl_chain = item.chain | unique %}
{%   endif %}
{% elif item.chains|d() %}
{%   if item.chains is string %}
{%     set ferm__tpl_chain = [ item.chains ] %}
{%   else %}
{%     set ferm__tpl_chain = item.chains | unique %}
{%   endif %}
{% endif %}
{% set ferm__tpl_domain_args = [] %}
{% if ferm__tpl_domain %}
{%   if ferm__tpl_domain | length == 1 %}
{%     set _ = ferm__tpl_domain_args.append("domain " +  ferm__tpl_domain | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_domain_args.append("domain (" + ferm__tpl_domain | join(" ") + ")") %}
{%   endif %}
{% endif %}
{% if ferm__tpl_table %}
{%   if ferm__tpl_table | length == 1 %}
{%     set _ = ferm__tpl_domain_args.append("table " +  ferm__tpl_table | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_domain_args.append("table (" + ferm__tpl_table | join(" ") + ")") %}
{%   endif %}
{% endif %}
{% if ferm__tpl_chain %}
{%   if ferm__tpl_chain | length == 1 %}
{%     set _ = ferm__tpl_domain_args.append("chain " +  ferm__tpl_chain | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_domain_args.append("chain (" + ferm__tpl_chain | join(" ") + ")") %}
{%   endif %}
{% endif %}
{# Rule arguments #}
{# ============== #}
{% set ferm__tpl_target = 'ACCEPT' %}
{% set ferm__tpl_reject_with = 'icmp-admin-prohibited' %}
{% set ferm__tpl_interface = [] %}
{% set ferm__tpl_interface_present = [] %}
{% set ferm__tpl_outerface = [] %}
{% set ferm__tpl_outerface_present = [] %}
{% set ferm__tpl_protocol = [] %}
{% set ferm__tpl_protocol_syn = [] %}
{% set ferm__tpl_saddr = [] %}
{% set ferm__tpl_daddr = [] %}
{% set ferm__tpl_sport = [] %}
{% set ferm__tpl_dport = [] %}
{% set ferm__tpl_state = [] %}
{% set ferm__tpl_subchain = (item.type + "-" + item.name | d((item.dport[0] if item.dport|d() else "rules"))) %}
{% if item.interface|d() %}
{%   if item.interface is string %}
{%     set ferm__tpl_interface = [ item.interface ] %}
{%   else %}
{%     set ferm__tpl_interface = item.interface | unique %}
{%   endif %}
{% elif item.interfaces|d() %}
{%   if item.interfaces is string %}
{%     set ferm__tpl_interface = [ item.interfaces ] %}
{%   else %}
{%     set ferm__tpl_interface = item.interfaces | unique %}
{%   endif %}
{% endif %}
{% if item.interface_present|d() %}
{%   if item.interface_present is string %}
{%     if hostvars[inventory_hostname]["ansible_" + item.interface_present]|d() %}
{%       set ferm__tpl_interface_present = [ item.interface_present ] %}
{%     endif %}
{%   else %}
{%     for interface in item.interface_present %}
{%       if hostvars[inventory_hostname]["ansible_" + interface]|d() %}
{%         set _ = ferm__tpl_interface_present.append(interface) %}
{%       endif %}
{%     endfor %}
{%   endif %}
{% elif item.interfaces_present|d() %}
{%   if item.interfaces_present is string %}
{%     if hostvars[inventory_hostname]["ansible_" + item.interfaces_present]|d() %}
{%       set ferm__tpl_interface_present = [ item.interfaces_present ] %}
{%     endif %}
{%   else %}
{%     for interface in item.interfaces_present %}
{%       if hostvars[inventory_hostname]["ansible_" + interface]|d() %}
{%         set _ = ferm__tpl_interface_present.append(interface) %}
{%       endif %}
{%     endfor %}
{%   endif %}
{% endif %}
{% if item.outerface|d() %}
{%   if item.outerface is string %}
{%     set ferm__tpl_outerface = [ item.outerface ] %}
{%   else %}
{%     set ferm__tpl_outerface = item.outerface | unique %}
{%   endif %}
{% elif item.outerfaces|d() %}
{%   if item.outerfaces is string %}
{%     set ferm__tpl_outerface = [ item.outerfaces ] %}
{%   else %}
{%     set ferm__tpl_outerface = item.outerfaces | unique %}
{%   endif %}
{% endif %}
{% if item.outerface_present|d() %}
{%   if item.outerface_present is string %}
{%     if hostvars[inventory_hostname]["ansible_" + item.outerface_present]|d() %}
{%       set ferm__tpl_outerface_present = [ item.outerface_present ] %}
{%     endif %}
{%   else %}
{%     for outerface in item.outerface_present %}
{%       if hostvars[inventory_hostname]["ansible_" + outerface]|d() %}
{%         set _ = ferm__tpl_outerface_present.append(outerface) %}
{%       endif %}
{%     endfor %}
{%   endif %}
{% elif item.outerfaces_present|d() %}
{%   if item.outerfaces_present is string %}
{%     if hostvars[inventory_hostname]["ansible_" + item.outerfaces_present]|d() %}
{%       set ferm__tpl_outerface_present = [ item.outerfaces_present ] %}
{%     endif %}
{%   else %}
{%     for outerface in item.outerfaces_present %}
{%       if hostvars[inventory_hostname]["ansible_" + outerface]|d() %}
{%         set _ = ferm__tpl_outerface_present.append(outerface) %}
{%       endif %}
{%     endfor %}
{%   endif %}
{% endif %}
{% if item.protocol|d() %}
{%   if item.protocol is string %}
{%     set ferm__tpl_protocol = [ item.protocol ] %}
{%   else %}
{%     set ferm__tpl_protocol = item.protocol | unique %}
{%   endif %}
{% elif item.protocols|d() %}
{%   if item.protocols is string %}
{%     set ferm__tpl_protocol = [ item.protocols ] %}
{%   else %}
{%     set ferm__tpl_protocol = item.protocols | unique %}
{%   endif %}
{% endif %}
{% if item.protocol_syn is defined %}
{%   if item.protocol_syn | bool %}
{%     set ferm__tpl_protocol_syn = [ 'syn' ] %}
{%   elif not item.protocol_syn | bool %}
{%     set ferm__tpl_protocol_syn = [ '! syn' ] %}
{%   endif %}
{% endif %}
{% if item.saddr|d() %}
{%   if item.saddr is string %}
{%     set ferm__tpl_saddr = [ item.saddr ] %}
{%   else %}
{%     set ferm__tpl_saddr = item.saddr | unique %}
{%   endif %}
{% endif %}
{% if item.daddr|d() %}
{%   if item.daddr is string %}
{%     set ferm__tpl_daddr = [ item.daddr ] %}
{%   else %}
{%     set ferm__tpl_daddr = item.daddr | unique %}
{%   endif %}
{% endif %}
{% if item.sport|d() %}
{%   if item.sport is string %}
{%     set ferm__tpl_sport = [ item.sport ] %}
{%   else %}
{%     set ferm__tpl_sport = item.sport | unique %}
{%   endif %}
{% endif %}
{% if item.dport|d() %}
{%   if item.dport is string %}
{%     set ferm__tpl_dport = [ item.dport ] %}
{%   else %}
{%     set ferm__tpl_dport = item.dport | unique %}
{%   endif %}
{% endif %}
{% if item.state|d() %}
{%   if item.state is string %}
{%     set ferm__tpl_state = [ item.state ] %}
{%   else %}
{%     set ferm__tpl_state = item.state | unique %}
{%   endif %}
{% endif %}
{% if item.target|d() %}
{%   set ferm__tpl_target = item.target %}
{% endif %}
{% if item.reject_with|d() %}
{%   set ferm__tpl_reject_with = item.reject_with %}
{% endif %}
{% if item.subchain is defined %}
{%   if item.subchain | bool %}
{%     set ferm__tpl_subchain = item.subchain %}
{%   else %}
{%     set ferm__tpl_subchain = '' %}
{%   endif %}
{% endif %}
{% set ferm__tpl_arguments = [] %}
{% if ferm__tpl_interface %}
{%   if ferm__tpl_interface | length == 1 %}
{%     set _ = ferm__tpl_arguments.append("interface " +  ferm__tpl_interface | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_arguments.append("interface (" + ferm__tpl_interface | join(" ") + ")") %}
{%   endif %}
{% elif ferm__tpl_interface_present %}
{%   if ferm__tpl_interface_present | length == 1 %}
{%     set _ = ferm__tpl_arguments.append("interface " +  ferm__tpl_interface_present | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_arguments.append("interface (" + ferm__tpl_interface_present | join(" ") + ")") %}
{%   endif %}
{% endif %}
{% if ferm__tpl_outerface %}
{%   if ferm__tpl_outerface | length == 1 %}
{%     set _ = ferm__tpl_arguments.append("outerface " +  ferm__tpl_outerface | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_arguments.append("outerface (" + ferm__tpl_outerface | join(" ") + ")") %}
{%   endif %}
{% elif ferm__tpl_outerface_present %}
{%   if ferm__tpl_outerface_present | length == 1 %}
{%     set _ = ferm__tpl_arguments.append("outerface " +  ferm__tpl_outerface_present | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_arguments.append("outerface (" + ferm__tpl_outerface_present | join(" ") + ")") %}
{%   endif %}
{% endif %}
{% if ferm__tpl_protocol %}
{%   if ferm__tpl_protocol | length == 1 %}
{%     set _ = ferm__tpl_arguments.append("protocol " +  ferm__tpl_protocol | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_arguments.append("protocol (" + ferm__tpl_protocol | join(" ") + ")") %}
{%   endif %}
{% elif not ferm__tpl_protocol and (ferm__tpl_sport or ferm__tpl_dport) %}
{%   set _ = ferm__tpl_arguments.append("protocol tcp") %}
{% endif %}
{% if ferm__tpl_protocol_syn %}
{%   set _ = ferm__tpl_arguments.append(ferm__tpl_protocol_syn | join(" ")) %}
{% endif %}
{% if ferm__tpl_dport %}
{%   if item.multiport|d() and item.multiport | bool %}
{%     if ferm__tpl_dport | length == 1 %}
{%       set _ = ferm__tpl_arguments.append("dport " +  ferm__tpl_dport | join(" ")) %}
{%     else %}
{%       set _ = ferm__tpl_arguments.append("mod multiport destination-ports (" + ferm__tpl_dport | join(" ") + ")") %}
{%     endif %}
{%   else %}
{%     if ferm__tpl_dport | length == 1 %}
{%       set _ = ferm__tpl_arguments.append("dport " +  ferm__tpl_dport | join(" ")) %}
{%     else %}
{%       set _ = ferm__tpl_arguments.append("dport (" + ferm__tpl_dport | join(" ") + ")") %}
{%     endif %}
{%   endif %}
{% endif %}
{% if ferm__tpl_daddr %}
{%   set _= ferm__tpl_arguments.append("daddr (" + ferm__tpl_daddr | join(" ") +")") %}
{% endif %}
{% if ferm__tpl_state %}
{%   if ferm__tpl_state | length == 1 %}
{%     set _ = ferm__tpl_arguments.append("mod state state " +  ferm__tpl_state | join(" ")) %}
{%   else %}
{%     set _ = ferm__tpl_arguments.append("mod state state (" + ferm__tpl_state | join(" ") + ")") %}
{%   endif %}
{% endif %}
{% if ferm__tpl_arguments and (ferm__tpl_saddr | length > 3) %}
{%   if ferm__tpl_subchain %}
{%     set _ = ferm__tpl_arguments.append('@subchain "' + ferm__tpl_subchain + '"') %}
{%   endif %}
{% endif %}
{# Main template #}
{# ============= #}
{% if item.comment|d() %}
# {{ item.comment }}

{% endif %}
{% if item.when is undefined or item.when | bool %}
{%   if ferm__tpl_domain_args %}{{ ferm__tpl_domain_args | join(" ") }} {% endif %}{
    {% if ferm__tpl_arguments %}{{ ferm__tpl_arguments | join(" ") }} {% endif %}{
{%   if item.enabled is undefined or item.enabled | bool %}
{%     if ferm__tpl_saddr|d() %}
        @def $ITEMS = ( @ipfilter( ({{ ferm__tpl_saddr | unique | join(" ") }}) ) );
        @if @ne($ITEMS,"") {
{%       if ferm__tpl_target not in [ 'ACCEPT', 'DROP', 'REJECT', 'RETURN', 'NOP' ] %}
{%         if item.include|d() %}
            @include "{{ item.include }}";
{%         elif item.realgoto is undefined or not item.realgoto | bool %}
            saddr $ITEMS jump "{{ ferm__tpl_target }}";
{%         elif item.realgoto|d() and item.realgoto | bool %}
            saddr $ITEMS realgoto "{{ ferm__tpl_target }}";
{%         endif %}
{%       elif ferm__tpl_target in [ 'REJECT' ] %}
            saddr $ITEMS REJECT reject-with {{ ferm__tpl_reject_with }};
{%       else %}
            saddr $ITEMS {{ ferm__tpl_target }};
{%       endif %}
        }
{%     else %}
{%       if item.accept_any is defined %}
{%         if item.accept_any | bool %}
{%           if ferm__tpl_target not in [ 'ACCEPT', 'DROP', 'REJECT', 'RETURN', 'NOP' ] %}
{%             if item.include|d() %}
        @include "{{ item.include }}";
{%             elif item.realgoto is undefined or not item.realgoto | bool %}
        jump "{{ ferm__tpl_target }}";
{%             elif item.realgoto|d() and item.realgoto | bool %}
        realgoto "{{ ferm__tpl_target }}";
{%             endif %}
{%           elif ferm__tpl_target in [ 'REJECT' ] %}
        REJECT reject-with {{ ferm__tpl_reject_with }};
{%           else %}
        {{ ferm__tpl_target }};
{%           endif %}
{%         elif not item.accept_any | bool %}
        # Connections from any IP address not allowed
{%         endif %}
{%       else %}
{%         if ferm__tpl_target not in [ 'ACCEPT', 'DROP', 'REJECT', 'RETURN', 'NOP' ] %}
{%           if item.include|d() %}
        @include "{{ item.include }}";
{%           elif item.realgoto is undefined or not item.realgoto | bool %}
        jump "{{ ferm__tpl_target }}";
{%           elif item.realgoto|d() and item.realgoto | bool %}
        realgoto "{{ ferm__tpl_target }}";
{%           endif %}
{%         elif ferm__tpl_target in [ 'REJECT' ] %}
        REJECT reject-with {{ ferm__tpl_reject_with }};
{%         else %}
{%           if ferm__tpl_arguments %}
        {{ ferm__tpl_target }};
{%           else %}
        # No rule parameters specified
{%           endif %}
{%         endif %}
{%       endif %}
{%     endif %}
{%   endif %}
    }
}
{% else %}
# Rule disabled by 'item.when' condition
{% endif %}

