86 lines
3.5 KiB
YAML
86 lines
3.5 KiB
YAML
---
|
|
# Copyright 2019 Red Hat, Inc.
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
|
|
# NOTE(Cloudnull): This task exists because the iptables module will not
|
|
# create a chain. There is a feature request open for this
|
|
# [ https://github.com/ansible/ansible/issues/25099 ].
|
|
# A change has been added to support this functionality but
|
|
# it is awaiting review and merge.
|
|
# [ https://github.com/ansible/ansible/pull/32158 ]. When
|
|
# this change is merged this task should be removed.
|
|
- name: Ensure chains exist
|
|
shell: |-
|
|
EXIT_CODE=0
|
|
if ! iptables --list "{{ item['rule']['chain'] }}"; then
|
|
iptables -N "{{ item['rule']['chain'] }}"
|
|
EXIT_CODE=99
|
|
fi
|
|
if ! ip6tables --list "{{ item['rule']['chain'] }}"; then
|
|
ip6tables -N "{{ item['rule']['chain'] }}"
|
|
EXIT_CODE=99
|
|
fi
|
|
exit ${EXIT_CODE}
|
|
when:
|
|
- (item['rule']['chain'] | default('INPUT')) != 'INPUT'
|
|
register: iptables_chain
|
|
changed_when: iptables_chain.rc == 99
|
|
failed_when: not (iptables_chain.rc in [0, 99])
|
|
|
|
- name: Add firewall service rule (ipv4)
|
|
iptables:
|
|
table: "{{ item['rule']['table'] | default(omit) }}"
|
|
chain: "{{ item['rule']['chain'] | default('INPUT') }}"
|
|
in_interface: "{{ item['rule']['interface'] | default(omit) }}"
|
|
protocol: "{{ item['rule']['proto'] | default('tcp') }}"
|
|
destination_port: "{{ port | replace('-', ':') }}"
|
|
source_port: "{{ item['rule']['sport'] | default(omit) | replace('-', ':') }}"
|
|
source: "{{ item['rule']['source'] | default(omit) }}"
|
|
comment: "{{ item['rule_name'] }} ipv4"
|
|
jump: "{{ item['rule']['jump'] | default('ACCEPT') }}"
|
|
ctstate: "{{ item['rule']['ctstate'] | default('NEW') }}"
|
|
ip_version: ipv4
|
|
state: "present"
|
|
when:
|
|
- item['rule']['source'] | default('127.0.0.1') | ipv4
|
|
loop: "{{ (item['rule']['dport'] is iterable) | ternary(item['rule']['dport'], [item['rule']['dport']]) }}"
|
|
loop_control:
|
|
loop_var: port
|
|
notify:
|
|
- Save firewall rules
|
|
|
|
- name: Add firewall service rule (ipv6)
|
|
iptables:
|
|
table: "{{ item['rule']['table'] | default(omit) }}"
|
|
chain: "{{ item['rule']['chain'] | default('INPUT') }}"
|
|
in_interface: "{{ item['rule']['interface'] | default(omit) }}"
|
|
protocol: "{{ item['rule']['proto'] | default('tcp') }}"
|
|
destination_port: "{{ port | replace('-', ':') }}"
|
|
source_port: "{{ item['rule']['sport'] | default(omit) | replace('-', ':') }}"
|
|
source: "{{ item['rule']['source'] | default(omit) }}"
|
|
comment: "{{ item['rule_name'] }} ipv6"
|
|
jump: "{{ item['rule']['jump'] | default('ACCEPT') }}"
|
|
ctstate: "{{ item['rule']['ctstate'] | default('NEW') }}"
|
|
ip_version: ipv6
|
|
state: "present"
|
|
when:
|
|
- item['rule']['source'] | default('::') | ipv6
|
|
loop: "{{ (item['rule']['dport'] is iterable) | ternary(item['rule']['dport'], [item['rule']['dport']]) }}"
|
|
loop_control:
|
|
loop_var: port
|
|
notify:
|
|
- Save firewall rules
|