1093 lines
42 KiB
Python
1093 lines
42 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
"""
|
|
IPtables raw module.
|
|
|
|
(c) 2016, Strahinja Kustudic <strahinjak@nordeus.com>
|
|
(c) 2016, Damir Markovic <damir@damirda.com>
|
|
|
|
This file is part of Ansible
|
|
|
|
Ansible is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
Ansible is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
"""
|
|
|
|
from __future__ import (absolute_import, division, print_function)
|
|
|
|
__metaclass__ = type
|
|
|
|
ANSIBLE_METADATA = {'status': ['preview'], 'supported_by': 'community', 'metadata_version': '1.0'}
|
|
|
|
DOCUMENTATION = r'''
|
|
---
|
|
module: iptables_raw
|
|
short_description: Manage iptables rules
|
|
version_added: 1.1.0
|
|
description:
|
|
- Add/remove iptables rules while keeping state.
|
|
options:
|
|
backup:
|
|
description:
|
|
- Create a backup of the iptables state file before overwriting it.
|
|
required: false
|
|
type: bool
|
|
default: False
|
|
ipversion:
|
|
description:
|
|
- Target the IP version this rule is for.
|
|
required: false
|
|
default: "4"
|
|
type: str
|
|
choices: ["4", "6"]
|
|
keep_unmanaged:
|
|
description:
|
|
- If set to C(yes) keeps active iptables (unmanaged) rules for the target
|
|
C(table) and gives them C(weight=90). This means these rules will be
|
|
ordered after most of the rules, since default priority is 40, so they
|
|
shouldn't be able to block any allow rules. If set to C(no) deletes all
|
|
rules which are not set by this module.
|
|
- "WARNING: Be very careful when running C(keep_unmanaged=no) for the
|
|
first time, since if you don't specify correct rules, you can block
|
|
yourself out of the managed host."
|
|
required: false
|
|
type: bool
|
|
default: True
|
|
name:
|
|
description:
|
|
- Name that will be used as an identifier for these rules. It can contain
|
|
alphanumeric characters, underscore, hyphen, or a space; has to be
|
|
UNIQUE for a specified C(table). You can also pass C(name=*) with
|
|
C(state=absent) to flush all rules in the selected table, or even all
|
|
tables with C(table=*).
|
|
required: true
|
|
type: str
|
|
rules:
|
|
description:
|
|
- The rules that we want to add. Accepts multiline values.
|
|
- "Note: You can only use C(-A)/C(--append), C(-N)/C(--new-chain), and
|
|
C(-P)/C(--policy) to specify rules."
|
|
required: false
|
|
type: str
|
|
default: ""
|
|
state:
|
|
description:
|
|
- The state this rules fragment should be in.
|
|
choices: ["present", "absent"]
|
|
required: false
|
|
type: str
|
|
default: present
|
|
table:
|
|
description:
|
|
- The table this rule applies to. You can specify C(table=*) only with
|
|
with C(name=*) and C(state=absent) to flush all rules in all tables.
|
|
choices: ["filter", "nat", "mangle", "raw", "security", "*"]
|
|
required: false
|
|
type: str
|
|
default: filter
|
|
weight:
|
|
description:
|
|
- Determines the order of the rules. Lower C(weight) means higher
|
|
priority. Supported range is C(0 - 99)
|
|
type: int
|
|
required: false
|
|
default: 40
|
|
notes:
|
|
- Requires C(iptables) package. Debian-based distributions additionally
|
|
require C(iptables-persistent).
|
|
- "Depending on the distribution, iptables rules are saved in different
|
|
locations, so that they can be loaded on boot. Red Hat distributions (RHEL,
|
|
CentOS, etc): C(/etc/sysconfig/iptables) and C(/etc/sysconfig/ip6tables);
|
|
Debian distributions (Debian, Ubuntu, etc): C(/etc/iptables/rules.v4) and
|
|
C(/etc/iptables/rules.v6); other distributions: C(/etc/sysconfig/iptables)
|
|
and C(/etc/sysconfig/ip6tables)."
|
|
- This module saves state in C(/etc/ansible-iptables) directory, so don't
|
|
modify this directory!
|
|
author:
|
|
- "Strahinja Kustudic (@kustodian)"
|
|
- "Damir Markovic (@damirda)"
|
|
'''
|
|
|
|
EXAMPLES = '''
|
|
# Allow all IPv4 traffic coming in on port 80 (http)
|
|
- iptables_raw:
|
|
name: allow_tcp_80
|
|
rules: '-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT'
|
|
|
|
# Set default rules with weight 10 and disregard all unmanaged rules
|
|
- iptables_raw:
|
|
name: default_rules
|
|
weight: 10
|
|
keep_unmanaged: false
|
|
rules: |
|
|
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
-A INPUT -i lo -j ACCEPT
|
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
|
-P INPUT DROP
|
|
-P FORWARD DROP
|
|
-P OUTPUT ACCEPT
|
|
|
|
# Allow all IPv6 traffic coming in on port 443 (https) with weight 50
|
|
- iptables_raw:
|
|
ipversion: 6
|
|
weight: 50
|
|
name: allow_tcp_443
|
|
rules: '-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT'
|
|
|
|
# Remove the above rule
|
|
- iptables_raw:
|
|
state: absent
|
|
ipversion: 6
|
|
name: allow_tcp_443
|
|
|
|
# Define rules with a custom chain
|
|
- iptables_raw:
|
|
name: custom1_rules
|
|
rules: |
|
|
-N CUSTOM1
|
|
-A CUSTOM1 -s 192.168.0.0/24 -j ACCEPT
|
|
|
|
# Reset all IPv4 iptables rules in all tables and allow all traffic
|
|
- iptables_raw:
|
|
name: '*'
|
|
table: '*'
|
|
state: absent
|
|
'''
|
|
|
|
RETURN = '''
|
|
state:
|
|
description: state of the rules
|
|
returned: success
|
|
type: str
|
|
sample: present
|
|
name:
|
|
description: name of the rules
|
|
returned: success
|
|
type: str
|
|
sample: open_tcp_80
|
|
weight:
|
|
description: weight of the rules
|
|
returned: success
|
|
type: int
|
|
sample: 40
|
|
ipversion:
|
|
description: IP version of iptables used
|
|
returned: success
|
|
type: int
|
|
sample: 6
|
|
rules:
|
|
description: passed rules
|
|
returned: success
|
|
type: str
|
|
sample: "-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT"
|
|
table:
|
|
description: iptables table used
|
|
returned: success
|
|
type: str
|
|
sample: filter
|
|
backup:
|
|
description: if the iptables file should backed up
|
|
returned: success
|
|
type: bool
|
|
sample: False
|
|
keep_unmanaged:
|
|
description: if it should keep unmanaged rules
|
|
returned: success
|
|
type: bool
|
|
sample: True
|
|
'''
|
|
|
|
import fcntl
|
|
import os
|
|
import re
|
|
import shlex
|
|
import tempfile
|
|
import time
|
|
from collections import defaultdict
|
|
|
|
from ansible.module_utils.basic import AnsibleModule
|
|
from ansible.module_utils.basic import json
|
|
|
|
|
|
# Genereates a diff dictionary from an old and new table dump.
|
|
def generate_diff(dump_old, dump_new):
|
|
diff = dict()
|
|
if dump_old != dump_new:
|
|
diff['before'] = dump_old
|
|
diff['after'] = dump_new
|
|
return diff
|
|
|
|
|
|
def compare_dictionaries(dict1, dict2):
|
|
if dict1 is None or dict2 is None:
|
|
return False
|
|
if not (isinstance(dict1, dict) and isinstance(dict2, dict)):
|
|
return False
|
|
shared_keys = set(dict2.keys()) & set(dict2.keys())
|
|
if not (len(shared_keys) == len(dict1.keys()) and len(shared_keys) == len(dict2.keys())):
|
|
return False
|
|
dicts_are_equal = True
|
|
for key in dict1.keys():
|
|
if isinstance(dict1[key], dict):
|
|
dicts_are_equal = dicts_are_equal and compare_dictionaries(dict1[key], dict2[key])
|
|
else:
|
|
dicts_are_equal = dicts_are_equal and (dict1[key] == dict2[key])
|
|
if not dicts_are_equal:
|
|
break
|
|
return dicts_are_equal
|
|
|
|
|
|
class Iptables:
|
|
|
|
# Default chains for each table
|
|
DEFAULT_CHAINS = {
|
|
'filter': ['INPUT', 'FORWARD', 'OUTPUT'],
|
|
'raw': ['PREROUTING', 'OUTPUT'],
|
|
'nat': ['PREROUTING', 'INPUT', 'OUTPUT', 'POSTROUTING'],
|
|
'mangle': ['PREROUTING', 'INPUT', 'FORWARD', 'OUTPUT', 'POSTROUTING'],
|
|
'security': ['INPUT', 'FORWARD', 'OUTPUT']
|
|
}
|
|
|
|
# List of tables
|
|
TABLES = list(DEFAULT_CHAINS.copy().keys())
|
|
|
|
# Directory which will store the state file.
|
|
STATE_DIR = '/etc/ansible-iptables'
|
|
|
|
# Key used for unmanaged rules
|
|
UNMANAGED_RULES_KEY_NAME = '$unmanaged_rules$'
|
|
|
|
# Only allow alphanumeric characters, underscore, hyphen, or a space for
|
|
# now. We don't want to have problems while parsing comments using regular
|
|
# expressions.
|
|
RULE_NAME_ALLOWED_CHARS = 'a-zA-Z0-9_ -'
|
|
|
|
module = None
|
|
|
|
def __init__(self, module, ipversion):
|
|
# Create directory for json files.
|
|
if not os.path.exists(self.STATE_DIR):
|
|
os.makedirs(self.STATE_DIR)
|
|
if Iptables.module is None:
|
|
Iptables.module = module
|
|
self.state_save_path = self._get_state_save_path(ipversion)
|
|
self.system_save_path = self._get_system_save_path(ipversion)
|
|
self.state_dict = self._read_state_file()
|
|
self.bins = self._get_bins(ipversion)
|
|
self.iptables_names_file = self._get_iptables_names_file(ipversion)
|
|
# Check if we have a required iptables version.
|
|
self._check_compatibility()
|
|
# Save active iptables rules for all tables, so that we don't
|
|
# need to fetch them every time using 'iptables-save' command.
|
|
self._active_rules = {}
|
|
self._refresh_active_rules(table='*')
|
|
|
|
def __eq__(self, other):
|
|
return (
|
|
isinstance(other, self.__class__)
|
|
and compare_dictionaries(other.state_dict, self.state_dict)
|
|
)
|
|
|
|
def __ne__(self, other):
|
|
return not self.__eq__(other)
|
|
|
|
def _get_bins(self, ipversion):
|
|
if ipversion == '4':
|
|
return {
|
|
'iptables': Iptables.module.get_bin_path('iptables'),
|
|
'iptables-save': Iptables.module.get_bin_path('iptables-save'),
|
|
'iptables-restore': Iptables.module.get_bin_path('iptables-restore')
|
|
}
|
|
else:
|
|
return {
|
|
'iptables': Iptables.module.get_bin_path('ip6tables'),
|
|
'iptables-save': Iptables.module.get_bin_path('ip6tables-save'),
|
|
'iptables-restore': Iptables.module.get_bin_path('ip6tables-restore')
|
|
}
|
|
|
|
def _get_iptables_names_file(self, ipversion):
|
|
if ipversion == '4':
|
|
return '/proc/net/ip_tables_names'
|
|
else:
|
|
return '/proc/net/ip6_tables_names'
|
|
|
|
# Return a list of active iptables tables
|
|
def _get_list_of_active_tables(self):
|
|
if os.path.isfile(self.iptables_names_file):
|
|
table_names = open(self.iptables_names_file, 'r').read()
|
|
return table_names.splitlines()
|
|
else:
|
|
return []
|
|
|
|
# If /etc/debian_version exist, this means this is a debian based OS (Ubuntu, Mint, etc...)
|
|
def _is_debian(self):
|
|
return os.path.isfile('/etc/debian_version')
|
|
|
|
# Get the iptables system save path.
|
|
# Supports RHEL/CentOS '/etc/sysconfig/' location.
|
|
# Supports Debian/Ubuntu/Mint, '/etc/iptables/' location.
|
|
def _get_system_save_path(self, ipversion):
|
|
# distro detection, path setting should be added
|
|
if ipversion == '4':
|
|
if self._is_debian():
|
|
return '/etc/iptables/rules.v4'
|
|
else:
|
|
return '/etc/sysconfig/iptables'
|
|
else:
|
|
if self._is_debian():
|
|
return '/etc/iptables/rules.v6'
|
|
else:
|
|
return '/etc/sysconfig/ip6tables'
|
|
|
|
# Return path to json state file.
|
|
def _get_state_save_path(self, ipversion):
|
|
if ipversion == '4':
|
|
return self.STATE_DIR + '/iptables.json'
|
|
else:
|
|
return self.STATE_DIR + '/ip6tables.json'
|
|
|
|
# Checks if iptables is installed and if we have a correct version.
|
|
def _check_compatibility(self):
|
|
from distutils.version import StrictVersion
|
|
cmd = [self.bins['iptables'], '--version']
|
|
rc, stdout, stderr = Iptables.module.run_command(cmd, check_rc=False)
|
|
if rc == 0:
|
|
result = re.search(r'^ip6tables\s+v(\d+\.\d+)\.\d+$', stdout)
|
|
if result:
|
|
version = result.group(1)
|
|
# CentOS 5 ip6tables (v1.3.x) doesn't support comments,
|
|
# which means it cannot be used with this module.
|
|
if StrictVersion(version) < StrictVersion('1.4'):
|
|
Iptables.module.fail_json(
|
|
msg="This module isn't compatible with ip6tables versions older than 1.4.x"
|
|
)
|
|
else:
|
|
Iptables.module.fail_json(
|
|
msg='Could not fetch iptables version! Is iptables installed?'
|
|
)
|
|
|
|
# Read rules from the json state file and return a dict.
|
|
def _read_state_file(self):
|
|
json_str = '{}'
|
|
if os.path.isfile(self.state_save_path):
|
|
json_str = open(self.state_save_path, 'r').read()
|
|
read_dict = defaultdict(lambda: dict(dump='', rules_dict={}), json.loads(json_str))
|
|
return read_dict
|
|
|
|
# Checks if a table exists in the state_dict.
|
|
def _has_table(self, tbl):
|
|
return tbl in self.state_dict
|
|
|
|
# Deletes table from the state_dict.
|
|
def _delete_table(self, tbl):
|
|
if self._has_table(tbl):
|
|
del self.state_dict[tbl]
|
|
|
|
# Acquires lock or exits after wait_for_seconds if it cannot be acquired.
|
|
def acquire_lock_or_exit(self, wait_for_seconds=10):
|
|
lock_file = self.STATE_DIR + '/.iptables.lock'
|
|
i = 0
|
|
f = open(lock_file, 'w+')
|
|
while i < wait_for_seconds:
|
|
try:
|
|
fcntl.flock(f, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
|
return
|
|
except IOError:
|
|
i += 1
|
|
time.sleep(1)
|
|
Iptables.module.fail_json(
|
|
msg='Could not acquire lock to continue execution! '
|
|
'Probably another instance of this module is running.'
|
|
)
|
|
|
|
# Check if a table has anything to flush (to check all tables pass table='*').
|
|
def table_needs_flush(self, table):
|
|
needs_flush = False
|
|
if table == '*':
|
|
for tbl in Iptables.TABLES:
|
|
# If the table exists or if it needs to be flushed that means will make changes.
|
|
if self._has_table(tbl) or self._single_table_needs_flush(tbl):
|
|
needs_flush = True
|
|
break
|
|
# Only flush the specified table
|
|
else:
|
|
if self._has_table(table) or self._single_table_needs_flush(table):
|
|
needs_flush = True
|
|
return needs_flush
|
|
|
|
# Check if a passed table needs to be flushed.
|
|
def _single_table_needs_flush(self, table):
|
|
needs_flush = False
|
|
active_rules = self._get_active_rules(table)
|
|
if active_rules:
|
|
policies = self._filter_default_chain_policies(active_rules, table)
|
|
chains = self._filter_custom_chains(active_rules, table)
|
|
rules = self._filter_rules(active_rules, table)
|
|
# Go over default policies and check if they are all ACCEPT.
|
|
for line in policies.splitlines():
|
|
if not re.search(r'\bACCEPT\b', line):
|
|
needs_flush = True
|
|
break
|
|
# If there is at least one rule or custom chain, that means we need flush.
|
|
if len(chains) > 0 or len(rules) > 0:
|
|
needs_flush = True
|
|
return needs_flush
|
|
|
|
# Returns a copy of the rules dict of a passed table.
|
|
def _get_table_rules_dict(self, table):
|
|
return self.state_dict[table]['rules_dict'].copy()
|
|
|
|
# Returns saved table dump.
|
|
def get_saved_table_dump(self, table):
|
|
return self.state_dict[table]['dump']
|
|
|
|
# Sets saved table dump.
|
|
def _set_saved_table_dump(self, table, dump):
|
|
self.state_dict[table]['dump'] = dump
|
|
|
|
# Updates saved table dump from the active rules.
|
|
def refresh_saved_table_dump(self, table):
|
|
active_rules = self._get_active_rules(table)
|
|
self._set_saved_table_dump(table, active_rules)
|
|
|
|
# Sets active rules of the passed table.
|
|
def _set_active_rules(self, table, rules):
|
|
self._active_rules[table] = rules
|
|
|
|
# Return active rules of the passed table.
|
|
def _get_active_rules(self, table, clean=True):
|
|
active_rules = ''
|
|
if table == '*':
|
|
all_rules = []
|
|
for tbl in Iptables.TABLES:
|
|
if tbl in self._active_rules:
|
|
all_rules.append(self._active_rules[tbl])
|
|
active_rules = '\n'.join(all_rules)
|
|
else:
|
|
active_rules = self._active_rules[table]
|
|
if clean:
|
|
return self._clean_save_dump(active_rules)
|
|
else:
|
|
return active_rules
|
|
|
|
# Refresh active rules of a table ('*' for all tables).
|
|
def _refresh_active_rules(self, table):
|
|
if table == '*':
|
|
for tbl in Iptables.TABLES:
|
|
self._set_active_rules(tbl, self._get_system_active_rules(tbl))
|
|
else:
|
|
self._set_active_rules(table, self._get_system_active_rules(table))
|
|
|
|
# Get iptables-save dump of active rules of one or all tables (pass '*')
|
|
# and return it as a string.
|
|
def _get_system_active_rules(self, table):
|
|
active_tables = self._get_list_of_active_tables()
|
|
if table == '*':
|
|
cmd = [self.bins['iptables-save']]
|
|
# If there are no active tables, that means there are no rules
|
|
if not active_tables:
|
|
return ''
|
|
else:
|
|
cmd = [self.bins['iptables-save'], '-t', table]
|
|
# If the table is not active, that means it has no rules
|
|
if table not in active_tables:
|
|
return ''
|
|
rc, stdout, stderr = Iptables.module.run_command(cmd, check_rc=True)
|
|
return stdout
|
|
|
|
# Splits a rule into tokens
|
|
def _split_rule_into_tokens(self, rule):
|
|
try:
|
|
return shlex.split(rule, comments=True)
|
|
except Exception:
|
|
msg = 'Could not parse the iptables rule:\n%s' % rule
|
|
Iptables.module.fail_json(msg=msg)
|
|
|
|
# Removes comment lines and empty lines from rules.
|
|
@staticmethod
|
|
def clean_up_rules(rules):
|
|
cleaned_rules = []
|
|
for line in rules.splitlines():
|
|
# Remove lines with comments and empty lines.
|
|
if not (Iptables.is_comment(line) or Iptables.is_empty_line(line)):
|
|
cleaned_rules.append(line)
|
|
return '\n'.join(cleaned_rules)
|
|
|
|
# Checks if the line is a custom chain in specific iptables table.
|
|
@staticmethod
|
|
def is_custom_chain(line, table):
|
|
default_chains = Iptables.DEFAULT_CHAINS[table]
|
|
if re.match(r'\s*(:|(-N|--new-chain)\s+)[^\s]+', line) and not re.match(
|
|
r'\s*(:|(-N|--new-chain)\s+)\b(' + '|'.join(default_chains) + r')\b', line
|
|
):
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
# Checks if the line is a default chain of an iptables table.
|
|
@staticmethod
|
|
def is_default_chain(line, table):
|
|
default_chains = Iptables.DEFAULT_CHAINS[table]
|
|
if re.match(
|
|
r'\s*(:|(-P|--policy)\s+)\b(' + '|'.join(default_chains) + r')\b\s+(ACCEPT|DROP)', line
|
|
):
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
# Checks if a line is an iptables rule.
|
|
@staticmethod
|
|
def is_rule(line):
|
|
# We should only allow adding rules with '-A/--append', since others don't make any sense.
|
|
if re.match(r'\s*(-A|--append)\s+[^\s]+', line):
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
# Checks if a line starts with '#'.
|
|
@staticmethod
|
|
def is_comment(line):
|
|
if re.match(r'\s*#', line):
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
# Checks if a line is empty.
|
|
@staticmethod
|
|
def is_empty_line(line):
|
|
if re.match(r'^$', line.strip()):
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
# Return name of custom chain from the rule.
|
|
def _get_custom_chain_name(self, line, table):
|
|
if Iptables.is_custom_chain(line, table):
|
|
return re.match(r'\s*(:|(-N|--new-chain)\s+)([^\s]+)', line).group(3)
|
|
else:
|
|
return ''
|
|
|
|
# Return name of default chain from the rule.
|
|
def _get_default_chain_name(self, line, table):
|
|
if Iptables.is_default_chain(line, table):
|
|
return re.match(r'\s*(:|(-N|--new-chain)\s+)([^\s]+)', line).group(3)
|
|
else:
|
|
return ''
|
|
|
|
# Return target of the default chain from the rule.
|
|
def _get_default_chain_target(self, line, table):
|
|
if Iptables.is_default_chain(line, table):
|
|
return re.match(r'\s*(:|(-N|--new-chain)\s+)([^\s]+)\s+([A-Z]+)', line).group(4)
|
|
else:
|
|
return ''
|
|
|
|
# Removes duplicate custom chains from the table rules.
|
|
def _remove_duplicate_custom_chains(self, rules, table):
|
|
all_rules = []
|
|
custom_chain_names = []
|
|
for line in rules.splitlines():
|
|
# Extract custom chains.
|
|
if Iptables.is_custom_chain(line, table):
|
|
chain_name = self._get_custom_chain_name(line, table)
|
|
if chain_name not in custom_chain_names:
|
|
custom_chain_names.append(chain_name)
|
|
all_rules.append(line)
|
|
else:
|
|
all_rules.append(line)
|
|
return '\n'.join(all_rules)
|
|
|
|
# Returns current iptables-save dump cleaned from comments and packet/byte counters.
|
|
def _clean_save_dump(self, simple_rules):
|
|
cleaned_dump = []
|
|
for line in simple_rules.splitlines():
|
|
# Ignore comments.
|
|
if Iptables.is_comment(line):
|
|
continue
|
|
# Reset counters for chains (begin with ':'), for easier comparing later on.
|
|
if re.match(r'\s*:', line):
|
|
cleaned_dump.append(re.sub(r'\[([0-9]+):([0-9]+)\]', '[0:0]', line))
|
|
else:
|
|
cleaned_dump.append(line)
|
|
cleaned_dump.append('\n')
|
|
return '\n'.join(cleaned_dump)
|
|
|
|
# Returns lines with default chain policies.
|
|
def _filter_default_chain_policies(self, rules, table):
|
|
chains = []
|
|
for line in rules.splitlines():
|
|
if Iptables.is_default_chain(line, table):
|
|
chains.append(line)
|
|
return '\n'.join(chains)
|
|
|
|
# Returns lines with iptables rules from an iptables-save table dump
|
|
# (removes chain policies, custom chains, comments and everything else). By
|
|
# default returns all rules, if 'only_unmanged=True' returns rules which
|
|
# are not managed by Ansible.
|
|
def _filter_rules(self, rules, table, only_unmanaged=False):
|
|
filtered_rules = []
|
|
for line in rules.splitlines():
|
|
if Iptables.is_rule(line):
|
|
if only_unmanaged:
|
|
tokens = self._split_rule_into_tokens(line)
|
|
# We need to check if a rule has a comment which starts with 'ansible[name]'
|
|
if '--comment' in tokens:
|
|
comment_index = tokens.index('--comment') + 1
|
|
if comment_index < len(tokens):
|
|
# Fetch the comment
|
|
comment = tokens[comment_index]
|
|
# Skip the rule if the comment starts with 'ansible[name]'
|
|
if not re.match(
|
|
r'ansible\[[' + Iptables.RULE_NAME_ALLOWED_CHARS + r']+\]', comment
|
|
):
|
|
filtered_rules.append(line)
|
|
else:
|
|
# Fail if there is no comment after the --comment parameter
|
|
msg = 'Iptables rule is missing a comment after ' \
|
|
"the '--comment' parameter:\n%s" % line
|
|
Iptables.module.fail_json(msg=msg)
|
|
# If it doesn't have comment, this means it is not managed by Ansible
|
|
# and we should append it.
|
|
else:
|
|
filtered_rules.append(line)
|
|
else:
|
|
filtered_rules.append(line)
|
|
return '\n'.join(filtered_rules)
|
|
|
|
# Same as _filter_rules(), but returns custom chains
|
|
def _filter_custom_chains(self, rules, table, only_unmanaged=False):
|
|
filtered_chains = []
|
|
# Get list of managed custom chains, which is needed to detect unmanaged custom chains
|
|
managed_custom_chains_list = self._get_custom_chains_list(table)
|
|
for line in rules.splitlines():
|
|
if Iptables.is_custom_chain(line, table):
|
|
if only_unmanaged:
|
|
# The chain is not managed by this module if it's not
|
|
# in the list of managed custom chains.
|
|
chain_name = self._get_custom_chain_name(line, table)
|
|
if chain_name not in managed_custom_chains_list:
|
|
filtered_chains.append(line)
|
|
else:
|
|
filtered_chains.append(line)
|
|
return '\n'.join(filtered_chains)
|
|
|
|
# Returns list of custom chains of a table.
|
|
def _get_custom_chains_list(self, table):
|
|
custom_chains_list = []
|
|
for key, value in self._get_table_rules_dict(table).items():
|
|
# Ignore UNMANAGED_RULES_KEY_NAME key, since we only want managed custom chains.
|
|
if key != Iptables.UNMANAGED_RULES_KEY_NAME:
|
|
for line in value['rules'].splitlines():
|
|
if Iptables.is_custom_chain(line, table):
|
|
chain_name = self._get_custom_chain_name(line, table)
|
|
if chain_name not in custom_chains_list:
|
|
custom_chains_list.append(chain_name)
|
|
return custom_chains_list
|
|
|
|
# Prepends 'ansible[name]: ' to iptables rule '--comment' argument,
|
|
# or adds 'ansible[name]' as a comment if there is no comment.
|
|
def _prepend_ansible_comment(self, rules, name):
|
|
commented_lines = []
|
|
for line in rules.splitlines():
|
|
# Extract rules only since we cannot add comments to custom chains.
|
|
if Iptables.is_rule(line):
|
|
tokens = self._split_rule_into_tokens(line)
|
|
if '--comment' in tokens:
|
|
# If there is a comment parameter, we need to prepand 'ansible[name]: '.
|
|
comment_index = tokens.index('--comment') + 1
|
|
if comment_index < len(tokens):
|
|
# We need to remove double quotes from comments, since there
|
|
# is an incompatiblity with older iptables versions
|
|
comment_text = tokens[comment_index].replace('"', '')
|
|
tokens[comment_index] = 'ansible[' + name + ']: ' + comment_text
|
|
else:
|
|
# Fail if there is no comment after the --comment parameter
|
|
msg = 'Iptables rule is missing a comment after ' \
|
|
"the '--comment' parameter:\n%s" % line
|
|
Iptables.module.fail_json(msg=msg)
|
|
else:
|
|
# If comment doesn't exist, we add a comment 'ansible[name]'
|
|
tokens += ['-m', 'comment', '--comment', 'ansible[' + name + ']']
|
|
# Escape and quote tokens in case they have spaces
|
|
tokens = [self._escape_and_quote_string(x) for x in tokens]
|
|
commented_lines.append(' '.join(tokens))
|
|
# Otherwise it's a chain, and we should just return it.
|
|
else:
|
|
commented_lines.append(line)
|
|
return '\n'.join(commented_lines)
|
|
|
|
# Double quote a string if it contains a space and escape double quotes.
|
|
def _escape_and_quote_string(self, s):
|
|
escaped = s.replace('"', r'\"')
|
|
if re.search(r'\s', escaped):
|
|
return '"' + escaped + '"'
|
|
else:
|
|
return escaped
|
|
|
|
# Add table rule to the state_dict.
|
|
def add_table_rule(self, table, name, weight, rules, prepend_ansible_comment=True):
|
|
self._fail_on_bad_rules(rules, table)
|
|
if prepend_ansible_comment:
|
|
self.state_dict[table]['rules_dict'][name] = {
|
|
'weight': weight,
|
|
'rules': self._prepend_ansible_comment(rules, name)
|
|
}
|
|
else:
|
|
self.state_dict[table]['rules_dict'][name] = {'weight': weight, 'rules': rules}
|
|
|
|
# Remove table rule from the state_dict.
|
|
def remove_table_rule(self, table, name):
|
|
if name in self.state_dict[table]['rules_dict']:
|
|
del self.state_dict[table]['rules_dict'][name]
|
|
|
|
# TODO: Add sorting of rules so that diffs in check_mode look nicer and easier to follow.
|
|
# Sorting would be done from top to bottom like this:
|
|
# * default chain policies
|
|
# * custom chains
|
|
# * rules
|
|
#
|
|
# Converts rules from a state_dict to an iptables-save readable format.
|
|
def get_table_rules(self, table):
|
|
generated_rules = ''
|
|
# We first add a header e.g. '*filter'.
|
|
generated_rules += '*' + table + '\n'
|
|
rules_list = []
|
|
custom_chains_list = []
|
|
default_chain_policies = []
|
|
dict_rules = self._get_table_rules_dict(table)
|
|
# Return list of rule names sorted by ('weight', 'rules') tuple.
|
|
for rule_name in sorted(
|
|
dict_rules, key=lambda x: (dict_rules[x]['weight'], dict_rules[x]['rules'])
|
|
):
|
|
rules = dict_rules[rule_name]['rules']
|
|
# Fail if some of the rules are bad
|
|
self._fail_on_bad_rules(rules, table)
|
|
rules_list.append(self._filter_rules(rules, table))
|
|
custom_chains_list.append(self._filter_custom_chains(rules, table))
|
|
default_chain_policies.append(self._filter_default_chain_policies(rules, table))
|
|
# Clean up empty strings from these two lists.
|
|
rules_list = list(filter(None, rules_list))
|
|
custom_chains_list = list(filter(None, custom_chains_list))
|
|
default_chain_policies = list(filter(None, default_chain_policies))
|
|
if default_chain_policies:
|
|
# Since iptables-restore applies the last chain policy it reads, we
|
|
# have to reverse the order of chain policies so that those with
|
|
# the lowest weight (higher priority) are read last.
|
|
generated_rules += '\n'.join(reversed(default_chain_policies)) + '\n'
|
|
if custom_chains_list:
|
|
# We remove duplicate custom chains so that iptables-restore
|
|
# doesn't fail because of that.
|
|
generated_rules += self._remove_duplicate_custom_chains(
|
|
'\n'.join(sorted(custom_chains_list)), table
|
|
) + '\n'
|
|
if rules_list:
|
|
generated_rules += '\n'.join(rules_list) + '\n'
|
|
generated_rules += 'COMMIT\n'
|
|
return generated_rules
|
|
|
|
# Sets unmanaged rules for the passed table in the state_dict.
|
|
def _set_unmanaged_rules(self, table, rules):
|
|
self.add_table_rule(
|
|
table, Iptables.UNMANAGED_RULES_KEY_NAME, 90, rules, prepend_ansible_comment=False
|
|
)
|
|
|
|
# Clears unmanaged rules of a table.
|
|
def clear_unmanaged_rules(self, table):
|
|
self._set_unmanaged_rules(table, '')
|
|
|
|
# Updates unmanaged rules of a table from the active rules.
|
|
def refresh_unmanaged_rules(self, table):
|
|
# Get active iptables rules and clean them up.
|
|
active_rules = self._get_active_rules(table)
|
|
unmanaged_chains_and_rules = []
|
|
unmanaged_chains_and_rules.append(
|
|
self._filter_custom_chains(active_rules, table, only_unmanaged=True)
|
|
)
|
|
unmanaged_chains_and_rules.append(
|
|
self._filter_rules(active_rules, table, only_unmanaged=True)
|
|
)
|
|
# Clean items which are empty strings
|
|
unmanaged_chains_and_rules = list(filter(None, unmanaged_chains_and_rules))
|
|
self._set_unmanaged_rules(table, '\n'.join(unmanaged_chains_and_rules))
|
|
|
|
# Check if there are bad lines in the specified rules.
|
|
def _fail_on_bad_rules(self, rules, table):
|
|
for line in rules.splitlines():
|
|
tokens = self._split_rule_into_tokens(line)
|
|
if '-t' in tokens or '--table' in tokens:
|
|
msg = (
|
|
"Iptables rules cannot contain '-t/--table' parameter. "
|
|
"You should use the 'table' parameter of the module to set rules "
|
|
'for a specific table.'
|
|
)
|
|
Iptables.module.fail_json(msg=msg)
|
|
# Fail if the parameter --comment doesn't have a comment after
|
|
if '--comment' in tokens and len(tokens) <= tokens.index('--comment') + 1:
|
|
msg = 'Iptables rule is missing a comment after ' \
|
|
"the '--comment' parameter:\n%s" % line
|
|
Iptables.module.fail_json(msg=msg)
|
|
if not (
|
|
Iptables.is_rule(line) or Iptables.is_custom_chain(line, table)
|
|
or Iptables.is_default_chain(line, table) or Iptables.is_comment(line)
|
|
):
|
|
msg = (
|
|
"Bad iptables rule '%s'! You can only use -A/--append, -N/--new-chain "
|
|
'and -P/--policy to specify rules.' % line
|
|
)
|
|
Iptables.module.fail_json(msg=msg)
|
|
|
|
# Write rules to dest path.
|
|
def _write_rules_to_file(self, rules, dest):
|
|
tmp_path = self._write_to_temp_file(rules)
|
|
Iptables.module.atomic_move(tmp_path, dest)
|
|
|
|
# Write text to a temp file and return path to that file.
|
|
def _write_to_temp_file(self, text):
|
|
fd, path = tempfile.mkstemp()
|
|
Iptables.module.add_cleanup_file(path) # add file for cleanup later
|
|
tmp = os.fdopen(fd, 'w')
|
|
tmp.write(text)
|
|
tmp.close()
|
|
return path
|
|
|
|
#
|
|
# Public and private methods which make changes on the system
|
|
# are named 'system_*' and '_system_*', respectively.
|
|
#
|
|
|
|
# Flush all rules in a passed table.
|
|
def _system_flush_single_table_rules(self, table):
|
|
# Set all default chain policies to ACCEPT.
|
|
for chain in Iptables.DEFAULT_CHAINS[table]:
|
|
cmd = [self.bins['iptables'], '-t', table, '-P', chain, 'ACCEPT']
|
|
Iptables.module.run_command(cmd, check_rc=True)
|
|
# Then flush all rules.
|
|
cmd = [self.bins['iptables'], '-t', table, '-F']
|
|
Iptables.module.run_command(cmd, check_rc=True)
|
|
# And delete custom chains.
|
|
cmd = [self.bins['iptables'], '-t', table, '-X']
|
|
Iptables.module.run_command(cmd, check_rc=True)
|
|
# Update active rules in the object.
|
|
self._refresh_active_rules(table)
|
|
|
|
# Save active iptables rules to the system path.
|
|
def _system_save_active(self, backup=False):
|
|
# Backup if needed
|
|
if backup:
|
|
Iptables.module.backup_local(self.system_save_path)
|
|
# Get iptables-save dump of all tables
|
|
all_active_rules = self._get_active_rules(table='*', clean=False)
|
|
# Move iptables-save dump of all tables to the iptables_save_path
|
|
self._write_rules_to_file(all_active_rules, self.system_save_path)
|
|
|
|
# Apply table dict rules to the system.
|
|
def system_apply_table_rules(self, table, test=False):
|
|
dump_path = self._write_to_temp_file(self.get_table_rules(table))
|
|
if test:
|
|
cmd = [self.bins['iptables-restore'], '-t', dump_path]
|
|
else:
|
|
cmd = [self.bins['iptables-restore'], dump_path]
|
|
rc, stdout, stderr = Iptables.module.run_command(cmd, check_rc=False)
|
|
if rc != 0:
|
|
if test:
|
|
dump_contents_file = open(dump_path, 'r')
|
|
dump_contents = dump_contents_file.read()
|
|
dump_contents_file.close()
|
|
msg = 'There is a problem with the iptables rules:' \
|
|
+ '\n\nError message:\n' \
|
|
+ stderr \
|
|
+ '\nGenerated rules:\n#######\n' \
|
|
+ dump_contents + '#####'
|
|
else:
|
|
msg = 'Could not load iptables rules:\n\n' + stderr
|
|
Iptables.module.fail_json(msg=msg)
|
|
self._refresh_active_rules(table)
|
|
|
|
# Flush one or all tables (to flush all tables pass table='*').
|
|
def system_flush_table_rules(self, table):
|
|
if table == '*':
|
|
for tbl in Iptables.TABLES:
|
|
self._delete_table(tbl)
|
|
if self._single_table_needs_flush(tbl):
|
|
self._system_flush_single_table_rules(tbl)
|
|
# Only flush the specified table.
|
|
else:
|
|
self._delete_table(table)
|
|
if self._single_table_needs_flush(table):
|
|
self._system_flush_single_table_rules(table)
|
|
|
|
# Saves state file and system iptables rules.
|
|
def system_save(self, backup=False):
|
|
self._system_save_active(backup=backup)
|
|
rules = json.dumps(self.state_dict, sort_keys=True, indent=4, separators=(',', ': '))
|
|
self._write_rules_to_file(rules, self.state_save_path)
|
|
|
|
|
|
def main():
|
|
|
|
module = AnsibleModule(
|
|
argument_spec=dict(
|
|
ipversion=dict(required=False, choices=['4', '6'], type='str', default='4'),
|
|
state=dict(
|
|
required=False, choices=['present', 'absent'], default='present', type='str'
|
|
),
|
|
weight=dict(required=False, type='int', default=40),
|
|
name=dict(required=True, type='str'),
|
|
table=dict(
|
|
required=False, choices=Iptables.TABLES + ['*'], default='filter', type='str'
|
|
),
|
|
rules=dict(required=False, type='str', default=''),
|
|
backup=dict(required=False, type='bool', default=False),
|
|
keep_unmanaged=dict(required=False, type='bool', default=True),
|
|
),
|
|
supports_check_mode=True,
|
|
)
|
|
|
|
check_mode = module.check_mode
|
|
changed = False
|
|
ipversion = module.params['ipversion']
|
|
state = module.params['state']
|
|
weight = module.params['weight']
|
|
name = module.params['name']
|
|
table = module.params['table']
|
|
rules = module.params['rules']
|
|
backup = module.params['backup']
|
|
keep_unmanaged = module.params['keep_unmanaged']
|
|
|
|
kw = dict(
|
|
state=state,
|
|
name=name,
|
|
rules=rules,
|
|
weight=weight,
|
|
ipversion=ipversion,
|
|
table=table,
|
|
backup=backup,
|
|
keep_unmanaged=keep_unmanaged
|
|
)
|
|
|
|
iptables = Iptables(module, ipversion)
|
|
|
|
# Acquire lock so that only one instance of this object can exist.
|
|
# Fail if the lock cannot be acquired within 10 seconds.
|
|
iptables.acquire_lock_or_exit(wait_for_seconds=10)
|
|
|
|
# Clean up rules of comments and empty lines.
|
|
rules = Iptables.clean_up_rules(rules)
|
|
|
|
# Check additional parameter requirements
|
|
if state == 'present' and name == '*':
|
|
module.fail_json(msg="Parameter 'name' can only be '*' if 'state=absent'")
|
|
if state == 'present' and table == '*':
|
|
module.fail_json(msg="Parameter 'table' can only be '*' if 'name=*' and 'state=absent'")
|
|
if state == 'present' and not name:
|
|
module.fail_json(msg="Parameter 'name' cannot be empty")
|
|
if state == 'present' and not re.match('^[' + Iptables.RULE_NAME_ALLOWED_CHARS + ']+$', name):
|
|
module.fail_json(
|
|
msg="Parameter 'name' not valid! It can only contain alphanumeric characters, "
|
|
"underscore, hyphen, or a space, got: '%s'" % name
|
|
)
|
|
if weight < 0 or weight > 99:
|
|
module.fail_json(msg="Parameter 'weight' can be 0-99, got: %d" % weight)
|
|
if state == 'present' and rules == '':
|
|
module.fail_json(msg="Parameter 'rules' cannot be empty when 'state=present'")
|
|
|
|
# Flush rules of one or all tables
|
|
if state == 'absent' and name == '*':
|
|
# Check if table(s) need to be flushed
|
|
if iptables.table_needs_flush(table):
|
|
changed = True
|
|
if not check_mode:
|
|
# Flush table(s)
|
|
iptables.system_flush_table_rules(table)
|
|
# Save state and system iptables rules
|
|
iptables.system_save(backup=backup)
|
|
# Exit since there is nothing else to do
|
|
kw['changed'] = changed
|
|
module.exit_json(**kw)
|
|
|
|
# Initialize new iptables object which will store new rules
|
|
iptables_new = Iptables(module, ipversion)
|
|
|
|
if state == 'present':
|
|
iptables_new.add_table_rule(table, name, weight, rules)
|
|
else:
|
|
iptables_new.remove_table_rule(table, name)
|
|
|
|
if keep_unmanaged:
|
|
iptables_new.refresh_unmanaged_rules(table)
|
|
else:
|
|
iptables_new.clear_unmanaged_rules(table)
|
|
|
|
# Refresh saved table dump with active iptables rules
|
|
iptables_new.refresh_saved_table_dump(table)
|
|
|
|
# Check if there are changes in iptables, and if yes load new rules
|
|
if iptables != iptables_new:
|
|
|
|
changed = True
|
|
|
|
# Test generated rules
|
|
iptables_new.system_apply_table_rules(table, test=True)
|
|
|
|
if check_mode:
|
|
# Create a predicted diff for check_mode.
|
|
# Diff will be created from rules generated from the state dictionary.
|
|
if hasattr(module, '_diff') and module._diff:
|
|
# Update unmanaged rules in the old object so the generated diff
|
|
# from the rules dictionaries is more accurate.
|
|
iptables.refresh_unmanaged_rules(table)
|
|
# Generate table rules from rules dictionaries.
|
|
table_rules_old = iptables.get_table_rules(table)
|
|
table_rules_new = iptables_new.get_table_rules(table)
|
|
# If rules generated from dicts are not equal, we generate a diff from them.
|
|
if table_rules_old != table_rules_new:
|
|
kw['diff'] = generate_diff(table_rules_old, table_rules_new)
|
|
else:
|
|
# TODO: Update this comment to be better.
|
|
kw['diff'] = {
|
|
'prepared':
|
|
'System rules were not changed (e.g. rule '
|
|
'weight changed, redundant rule, etc)'
|
|
}
|
|
else:
|
|
# We need to fetch active table dump before we apply new rules
|
|
# since we will need them to generate a diff.
|
|
table_active_rules = iptables_new.get_saved_table_dump(table)
|
|
|
|
# Apply generated rules.
|
|
iptables_new.system_apply_table_rules(table)
|
|
|
|
# Refresh saved table dump with active iptables rules.
|
|
iptables_new.refresh_saved_table_dump(table)
|
|
|
|
# Save state and system iptables rules.
|
|
iptables_new.system_save(backup=backup)
|
|
|
|
# Generate a diff.
|
|
if hasattr(module, '_diff') and module._diff:
|
|
table_active_rules_new = iptables_new.get_saved_table_dump(table)
|
|
if table_active_rules != table_active_rules_new:
|
|
kw['diff'] = generate_diff(table_active_rules, table_active_rules_new)
|
|
else:
|
|
# TODO: Update this comment to be better.
|
|
kw['diff'] = {
|
|
'prepared':
|
|
'System rules were not changed (e.g. rule '
|
|
'weight changed, redundant rule, etc)'
|
|
}
|
|
|
|
kw['changed'] = changed
|
|
module.exit_json(**kw)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|