mirror of https://github.com/ansible/ansible.git
module: system/iptables
parent
c7c32ef86f
commit
5cd6b56453
@ -0,0 +1,128 @@
|
|||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# (c) 2015, Linus Unnebäck <linus@folkdatorn.se>
|
||||||
|
#
|
||||||
|
# This file is part of Ansible
|
||||||
|
#
|
||||||
|
# This module is free software: you can redistribute it and/or modify
|
||||||
|
# it under the terms of the GNU General Public License as published by
|
||||||
|
# the Free Software Foundation, either version 3 of the License, or
|
||||||
|
# (at your option) any later version.
|
||||||
|
#
|
||||||
|
# This software is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this software. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
|
||||||
|
# import module snippets
|
||||||
|
from ansible.module_utils.basic import *
|
||||||
|
|
||||||
|
DOCUMENTATION = '''
|
||||||
|
---
|
||||||
|
module: iptables
|
||||||
|
short_description: Modify the systems iptables
|
||||||
|
requirements: []
|
||||||
|
version_added: "2.0"
|
||||||
|
author: Linus Unnebäck (@LinusU) <linus@folkdatorn.se>
|
||||||
|
description: Iptables is used to set up, maintain, and inspect the tables of IPv4 packet filter rules in the Linux kernel.
|
||||||
|
options:
|
||||||
|
table:
|
||||||
|
description: Packet matching table to operate on.
|
||||||
|
required: false
|
||||||
|
default: filter
|
||||||
|
choices: [ "filter", "nat", "mangle", "raw", "security" ]
|
||||||
|
chain:
|
||||||
|
description: Chain to operate on.
|
||||||
|
required: true
|
||||||
|
choices: [ "INPUT", "FORWARD", "OUTPUT", "PREROUTING", "POSTROUTING", "SECMARK", "CONNSECMARK" ]
|
||||||
|
rule:
|
||||||
|
description: The rule that should be absent or present
|
||||||
|
required: true
|
||||||
|
state:
|
||||||
|
description: Wheter the rule should be absent or present
|
||||||
|
required: false
|
||||||
|
default: present
|
||||||
|
choices: [ "present", "absent" ]
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = '''
|
||||||
|
# Block specific IP
|
||||||
|
- iptables: chain=INPUT rule='-s 8.8.8.8 -j DROP'
|
||||||
|
become: yes
|
||||||
|
|
||||||
|
# Forward port 80 to 8600
|
||||||
|
- iptables: table=nat chain=PREROUTING rule='-i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8600'
|
||||||
|
become: yes
|
||||||
|
'''
|
||||||
|
|
||||||
|
|
||||||
|
def push_arguments(iptables_path, action, args):
|
||||||
|
cmd = [iptables_path]
|
||||||
|
cmd.extend(['-t', args['table']])
|
||||||
|
cmd.extend([action, args['chain']])
|
||||||
|
cmd.extend(args['rule'].split(' '))
|
||||||
|
return cmd
|
||||||
|
|
||||||
|
|
||||||
|
def check_present(iptables_path, module, args):
|
||||||
|
cmd = push_arguments(iptables_path, '-C', args)
|
||||||
|
rc, _, __ = module.run_command(cmd, check_rc=False)
|
||||||
|
return (rc == 0)
|
||||||
|
|
||||||
|
|
||||||
|
def append_rule(iptables_path, module, args):
|
||||||
|
cmd = push_arguments(iptables_path, '-A', args)
|
||||||
|
module.run_command(cmd, check_rc=True)
|
||||||
|
|
||||||
|
|
||||||
|
def remove_rule(iptables_path, module, args):
|
||||||
|
cmd = push_arguments(iptables_path, '-D', args)
|
||||||
|
module.run_command(cmd, check_rc=True)
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
module = AnsibleModule(
|
||||||
|
supports_check_mode=True,
|
||||||
|
argument_spec=dict(
|
||||||
|
table=dict(required=False, default='filter', choices=['filter', 'nat', 'mangle', 'raw', 'security']),
|
||||||
|
chain=dict(required=True, default=None, choices=['INPUT', 'FORWARD', 'OUTPUT', 'PREROUTING', 'POSTROUTING', 'SECMARK', 'CONNSECMARK']),
|
||||||
|
rule=dict(required=True, default=None),
|
||||||
|
state=dict(required=False, default='present', choices=['present', 'absent']),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
args = dict(
|
||||||
|
changed=False,
|
||||||
|
failed=False,
|
||||||
|
table=module.params['table'],
|
||||||
|
chain=module.params['chain'],
|
||||||
|
rule=module.params['rule'],
|
||||||
|
state=module.params['state'],
|
||||||
|
)
|
||||||
|
iptables_path = module.get_bin_path('iptables', True)
|
||||||
|
rule_is_present = check_present(iptables_path, module, args)
|
||||||
|
should_be_present = (args['state'] == 'present')
|
||||||
|
|
||||||
|
# Check if target is up to date
|
||||||
|
args['changed'] = (rule_is_present != should_be_present)
|
||||||
|
|
||||||
|
# Check only; don't modify
|
||||||
|
if module.check_mode:
|
||||||
|
module.exit_json(changed=args['changed'])
|
||||||
|
|
||||||
|
# Target is already up to date
|
||||||
|
if args['changed'] == False:
|
||||||
|
module.exit_json(**args)
|
||||||
|
|
||||||
|
if should_be_present:
|
||||||
|
append_rule(iptables_path, module, args)
|
||||||
|
else:
|
||||||
|
remove_rule(iptables_path, module, args)
|
||||||
|
|
||||||
|
module.exit_json(**args)
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
Loading…
Reference in New Issue