ansible/library/system/ufw

#!/usr/bin/python
# -*- coding: utf-8 -*-

# (c) 2013, Aleksey Ovcharenko <aleksey.ovcharenko@gmail.com>
# (c) 2013, James Martin <jmartin@basho.com>
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
DOCUMENTATION = '''
---
module: ufw
short_description: This module handles Ubuntu UFW operations
description:
     - This module handles Ubuntu UFW operations
options:
  default_policy:
    description:
      - Change the default policy for incoming traffic.
    required: false
    choices: ['allow', 'deny', 'reject']
    default: None
  delete:
    description:
      - Delete rule instead of creation.
    required: false
    choices: ['yes', 'no']
    default: 'no'
  state:
    description: |
        I(enable) reloads firewall and enables firewall on boot.
        I(disable) unloads firewall and disables firewall on boot.
        I(reload) reloads firewall.
        I(reset) disables and resets firewall to installation defaults.
        I(allow) adds allow rule. See B(EXAMPLES).
        I(deny) adds deny rule. See B(EXAMPLES).
        I(reject) adds reject rule. See B(EXAMPLES).
        I(limit)  adds limit rule. Currently only IPv4 is supported. See B(EXAMPLES).
    required: false
    choices: ['enable', 'disable', 'reload', 'reset', 'allow', 'deny', 'reject', 'limit']
    aliases: ['rule']
    default: 'allow'
  name:
    description:
      - Use profile located in /etc/ufw/applications.d
    required: false
    default: None
    version_added: "2.1"
  from_ip:
    description:
      - Source IP address.
    required: false
    aliases: ['src']
    default: 'any'
  from_port:
    description:
      - Source port.
    required: false
    default: 'any'
  to_ip:
    description:
      - Destination IP address.
    required: false
    aliases: ['dest']
    default: 'any'
  to_port:
    description:
      - Destination port.
    required: false
    default: 'any'
    aliases: ['port']
  proto:
    description:
      - TCP/IP protocol.
    choices: ['any', 'tcp', 'udp', 'ipv6']
    required: false
  log:
    description:
      - Toggles logging. Logged packets use the LOG_KERN syslog facility.
    choices: ['yes', 'no']
    required: false
    default: 'no'
version_added: 2.0
notes:
   -  See C(man 8 ufw) for more example.
requirements: [ ]
author: Aleksey Ovcharenko
'''

EXAMPLES = '''
# Allow everything and enable UFW
ufw: state={{ item }}
with_items:
- allow
- enable

# Sometimes it is desirable to let the sender know when traffic is
# being denied, rather than simply ignoring it. In these cases, use
# reject instead of deny.  For example:
ufw: state=reject port=auth

# ufw supports connection rate limiting, which is useful for protecting
# against brute-force login attacks. ufw will deny connections if an IP
# address has attempted to initiate 6 or more connections in the last
# 30 seconds. See  http://www.debian-administration.org/articles/187
# for details. Typical usage is:
ufw: state=limit port=ssh proto=tcp

# Allow OpenSSH
ufw: state=allow name=OpenSSH

# Deny all access to port 53:
ufw: state=deny port=53

# Allow all access to tcp port 80:
ufw: state=allow to_port=80 proto=tcp

# Allow all access from RFC1918 networks to this host:
ufw: state=allow from_ip={{ item }}
with_items:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16

# Deny access to udp port 514 from host 1.2.3.4:
ufw: state=deny proto=udp from_ip=1.2.3.4 to_port=514

# Allow access to udp 1.2.3.4 port 5469 from 1.2.3.5 port 5469:
ufw: state=allow proto=udp from_ip=1.2.3.5 from_port=5469 to_ip=1.2.3.4 to_port=5469

# Deny all traffic from the IPv6 2001:db8::/32 to tcp port 25 on this host.
# Note that IPv6 must be enabled in /etc/default/ufw for IPv6 firewalling to work.
ufw: state=deny proto=tcp src=2001:db8::/32 port=25
'''

import platform

def main():
    module = AnsibleModule(
        argument_spec = dict(
            default_policy = dict(default=None, choices=['allow', 'deny', 'reject'], required=False),
            state = dict(default=None, aliases=['rule'], choices=['enable', 'disable', 'reload', 'reset', 'allow', 'deny', 'reject', 'limit'], required=False),
            name = dict(default=None, required=False),
            from_ip = dict(default='any', aliases=['src'], required=False),
            from_port = dict(default='any', required=False),
            to_ip = dict(default='any', aliases=['dest'], required=False),
            to_port = dict(default='any', aliases=['port'], required=False),
            proto = dict(default='any', choices=['any', 'tcp', 'udp', 'ipv6'], required=False),
            delete = dict(default=False, choices=BOOLEANS, required=False),
            log = dict(default=False, choices=BOOLEANS, required=False)
        ),
        supports_check_mode = True
    )

    default_policy =  module.params.get('default_policy')
    state =  module.params.get('state')
    name = module.params.get('name')
    from_ip =  module.params.get('from_ip')
    from_port =  module.params.get('from_port')
    to_ip =  module.params.get('to_ip')
    to_port =  module.params.get('to_port')
    proto =  module.params.get('proto')
    delete = module.params['delete']
    log = module.params['log']

    system = platform.system()

    if "Linux" not in system:
        module.exit_json(msg="Not implemented for system %s. Only Linux (Ubuntu) is supported" % (system), changed=False)
    else:
        dist = platform.dist()
        if dist and 'Ubuntu' not in dist[0]:
            module.exit_json(msg="Not implemented for distrubution %s. Only Ubuntu is supported" % (dist[0]), changed=False)

	result = {}
    result['state'] = state

    cmd = module.get_bin_path('ufw')

    if module.check_mode:
        cmd = cmd + ' --dry-run'

    if default_policy:
        if state:
            module.fail_json(msg="'default_policy' and 'state' are mutually exclusive options.")
        else:
            if default_policy in ['allow', 'deny', 'reject']:
                cmd = cmd + ' default %s' % (default_policy)
                changed_marker = "Default incoming policy changed to '%s'\n(be sure to update your rules accordingly)" % (default_policy)
            else:
                module.fail_json(msg="Wrong default policy %s. See 'ansible-doc ufw' for usage." % (default_policy))

    if not default_policy:
        if not state:
            module.fail_json(msg="You must specify either 'default_policy' or 'state' option.")
        else:
            if state in 'enable':
                cmd = cmd + ' -f %s' % (state)
                changed_marker = 'Firewall is active and enabled on system startup'
            elif state in 'disable':
                cmd = cmd + ' -f %s' % (state)
                changed_marker = 'Firewall stopped and disabled on system startup'
            elif state in 'reload':
                cmd = cmd + ' -f %s' % (state)
                changed_marker = 'Firewall reloaded'
            elif state in 'reset':
                cmd = cmd + ' -f %s' % (state)
                changed_marker = 'Backing up'
            elif state in ['allow', 'deny', 'reject', 'limit']:
                changed_marker = ['Rules updated', 'Rules updated (v6)', 'Rule added', 'Rule added (v6)', 'Rule deleted', 'Rule deleted (v6)' ]
                if delete:
                    cmd = cmd + ' delete'

                cmd = cmd + ' %s' % (state)
                if log:
                    cmd = cmd + ' log'
                if name:
                    cmd = cmd + ' %s' % (name)
                else:
                    if proto and proto not in 'any':
                        cmd = cmd + ' proto %s' % (proto)
                    if from_ip and from_ip not in 'any':
                        cmd = cmd + ' from %s' % (from_ip)
                        if from_port and from_port not in 'any':
                             cmd = cmd + ' port %s' % (from_port)
                    elif from_port and from_port not in 'any':
                        cmd = cmd + ' from port %s' % (from_port)

                    if to_ip:
                        cmd = cmd + ' to %s' % (to_ip)
                        if to_port and to_port not in 'any':
                             cmd = cmd + ' port %s' % (to_port)
                    elif to_port and to_port not in 'any':
                        cmd = cmd + ' to port %s' % (to_port)
            else:
                module.fail_json(msg="Wrong rule %s. See 'ansible-doc ufw' for usage." % (state))

    (rc, out, err) = module.run_command(cmd)

    if rc != 0:
        if err:
            module.fail_json(msg=err)
        else:
            module.fail_json(msg=out)

    result['cmd'] = cmd
    result['msg'] = out.rstrip()

    if isinstance(changed_marker, basestring):
        result['changed'] = result['msg'] in changed_marker
    else:
        result['changed'] = any(item in result['msg'] for item in changed_marker)

    return module.exit_json(**result)

# include magic from lib/ansible/module_common.py
#<<INCLUDE_ANSIBLE_MODULE_COMMON>>

main()