christianmanivong
f77091c489
CI / test (3.10) (push) Successful in 40s
CI / test (3.11) (push) Successful in 25s
CI / test (3.12) (push) Successful in 25s
CI / test (3.13) (push) Successful in 51s
CI / test (3.10) (pull_request) Successful in 24s
CI / test (3.11) (pull_request) Successful in 26s
CI / test (3.12) (pull_request) Successful in 27s
CI / test (3.13) (pull_request) Successful in 25s
get_host_firewall() reads `nft -j list ruleset` as root and returns every chain with its family, table, hook, priority and policy, and every rule as matches and a verdict. Rules iptables-nft wrote show their extensions in nft's JSON only as an opaque `xt`, so the tables iptables manages are taken from iptables-save instead; a legacy iptables is kept beside nft's tables, since both apply. A condition the parse does not model is an `unknown` match with its text, never left out. Without root neither tool can be read, and HostFirewallUnavailable is raised rather than a host without rules. A driver supplies only _run_host_firewall_command(command, privileged=). Version 4.21.0.