---
# Copyright 2019 Red Hat, Inc.
# All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.


# NOTE(Cloudnull): This task exists because the iptables module will not
#                  create a chain. There is a feature request open for this
#                  [ https://github.com/ansible/ansible/issues/25099 ].
#                  A change has been added to support this functionality but
#                  it is awaiting review and merge.
#                  [ https://github.com/ansible/ansible/pull/32158 ]. When
#                  this change is merged this task should be removed.
- name: Ensure chains exist
  shell: |-
    EXIT_CODE=0
    if ! iptables --list "{{ item['rule']['chain'] }}"; then
      iptables -N "{{ item['rule']['chain'] }}"
      EXIT_CODE=99
    fi
    if ! ip6tables --list "{{ item['rule']['chain'] }}"; then
      ip6tables -N "{{ item['rule']['chain'] }}"
      EXIT_CODE=99
    fi
    exit ${EXIT_CODE}
  when:
    - (item['rule']['chain'] | default('INPUT')) != 'INPUT'
    - tripleo_firewall_port_states[(item['rule']['extras'] | default({}))['ensure'] | default('enabled')] == "present"
  register: iptables_chain
  changed_when: iptables_chain.rc == 99
  failed_when: not (iptables_chain.rc in [0, 99])

- include_tasks: tripleo_firewall_state.yml

- name: Firewall port rule (ipv4)
  iptables:
    table: "{{ item['rule']['table'] | default(omit) }}"
    chain: "{{ item['rule']['chain'] | default('INPUT') }}"
    in_interface: "{{ item['rule']['interface'] | default(omit) }}"
    protocol: "{{ item['rule']['proto'] | default('tcp') }}"
    destination_port: "{{ port | replace('-', ':') }}"
    source_port: "{{ item['rule']['sport'] | default(omit) | replace('-', ':') }}"
    source: "{{ item['rule']['source'] | default(omit) }}"
    comment: "{{ item['rule_name'] }} ipv4"
    jump: "{{ item['rule']['jump'] | default('ACCEPT') }}"
    ctstate: "{{ tripleo_ctstate }}"
    ip_version: ipv4
    state: "{{ tripleo_firewall_port_states[(item['rule']['extras'] | default({}))['ensure'] | default('enabled')] }}"
  when:
    - (item['rule']['proto'] | default('tcp')) != 'ipv6'
    - item['rule']['source'] | default('127.0.0.1') | ipv4
  loop: "{{ ((item['rule']['dport'] is iterable) and (item['rule']['dport'] is not string)) | ternary(item['rule']['dport'], [item['rule']['dport']]) }}"
  loop_control:
    loop_var: port
  notify:
    - Save firewall rules

- name: Firewall port rule (ipv6)
  iptables:
    table: "{{ item['rule']['table'] | default(omit) }}"
    chain: "{{ item['rule']['chain'] | default('INPUT') }}"
    in_interface: "{{ item['rule']['interface'] | default(omit) }}"
    protocol: "{{ item['rule']['proto'] | default('tcp') }}"
    destination_port: "{{ port | replace('-', ':') }}"
    source_port: "{{ item['rule']['sport'] | default(omit) | replace('-', ':') }}"
    source: "{{ item['rule']['source'] | default(omit) }}"
    comment: "{{ item['rule_name'] }} ipv6"
    jump: "{{ item['rule']['jump'] | default('ACCEPT') }}"
    ctstate: "{{ tripleo_ctstate }}"
    ip_version: ipv6
    state: "{{ tripleo_firewall_port_states[(item['rule']['extras'] | default({}))['ensure'] | default('enabled')] }}"
  when:
    - (item['rule']['proto'] | default('tcp')) != 'ipv4'
    - item['rule']['source'] | default('::') | ipv6
  loop: "{{ ((item['rule']['dport'] is iterable) and (item['rule']['dport'] is not string)) | ternary(item['rule']['dport'], [item['rule']['dport']]) }}"
  loop_control:
    loop_var: port
  notify:
    - Save firewall rules