module: system/iptables

2015-09-22 20:41:53 +02:00 · 2015-09-22 20:41:53 +02:00 · 5cd6b56453
commit 5cd6b56453
parent c7c32ef86f
1 changed files with 128 additions and 0 deletions
--- a/system/iptables.py
+++ b/system/iptables.py
@ -0,0 +1,128 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# (c) 2015, Linus Unnebäck <linus@folkdatorn.se>
+#
+# This file is part of Ansible
+#
+# This module is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This software is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this software.  If not, see <http://www.gnu.org/licenses/>.
+
+# import module snippets
+from ansible.module_utils.basic import *
+
+DOCUMENTATION = '''
+---
+module: iptables
+short_description: Modify the systems iptables
+requirements: []
+version_added: "2.0"
+author: Linus Unnebäck (@LinusU) <linus@folkdatorn.se>
+description: Iptables is used to set up, maintain, and inspect the tables of IPv4 packet filter rules in the Linux kernel.
+options:
+  table:
+    description: Packet matching table to operate on.
+    required: false
+    default: filter
+    choices: [ "filter", "nat", "mangle", "raw", "security" ]
+  chain:
+    description: Chain to operate on.
+    required: true
+    choices: [ "INPUT", "FORWARD", "OUTPUT", "PREROUTING", "POSTROUTING", "SECMARK", "CONNSECMARK" ]
+  rule:
+    description: The rule that should be absent or present
+    required: true
+  state:
+    description: Wheter the rule should be absent or present
+    required: false
+    default: present
+    choices: [ "present", "absent" ]
+'''
+
+EXAMPLES = '''
+# Block specific IP
+- iptables: chain=INPUT rule='-s 8.8.8.8 -j DROP'
+  become: yes
+
+# Forward port 80 to 8600
+- iptables: table=nat chain=PREROUTING rule='-i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8600'
+  become: yes
+'''
+
+
+def push_arguments(iptables_path, action, args):
+    cmd = [iptables_path]
+    cmd.extend(['-t', args['table']])
+    cmd.extend([action, args['chain']])
+    cmd.extend(args['rule'].split(' '))
+    return cmd
+
+
+def check_present(iptables_path, module, args):
+    cmd = push_arguments(iptables_path, '-C', args)
+    rc, _, __ = module.run_command(cmd, check_rc=False)
+    return (rc == 0)
+
+
+def append_rule(iptables_path, module, args):
+    cmd = push_arguments(iptables_path, '-A', args)
+    module.run_command(cmd, check_rc=True)
+
+
+def remove_rule(iptables_path, module, args):
+    cmd = push_arguments(iptables_path, '-D', args)
+    module.run_command(cmd, check_rc=True)
+
+
+def main():
+    module = AnsibleModule(
+        supports_check_mode=True,
+        argument_spec=dict(
+            table=dict(required=False, default='filter', choices=['filter', 'nat', 'mangle', 'raw', 'security']),
+            chain=dict(required=True, default=None, choices=['INPUT', 'FORWARD', 'OUTPUT', 'PREROUTING', 'POSTROUTING', 'SECMARK', 'CONNSECMARK']),
+            rule=dict(required=True, default=None),
+            state=dict(required=False, default='present', choices=['present', 'absent']),
+        ),
+    )
+    args = dict(
+        changed=False,
+        failed=False,
+        table=module.params['table'],
+        chain=module.params['chain'],
+        rule=module.params['rule'],
+        state=module.params['state'],
+    )
+    iptables_path = module.get_bin_path('iptables', True)
+    rule_is_present = check_present(iptables_path, module, args)
+    should_be_present = (args['state'] == 'present')
+
+    # Check if target is up to date
+    args['changed'] = (rule_is_present != should_be_present)
+
+    # Check only; don't modify
+    if module.check_mode:
+        module.exit_json(changed=args['changed'])
+
+    # Target is already up to date
+    if args['changed'] == False:
+        module.exit_json(**args)
+
+    if should_be_present:
+        append_rule(iptables_path, module, args)
+    else:
+        remove_rule(iptables_path, module, args)
+
+    module.exit_json(**args)
+
+if __name__ == '__main__':
+    main()