a0b8b85fa5
* ufw: escalate privileges in integration tests A few of the integration tests for the UFW module forgot to `become`. This is problematic if the test suite is executed as a non-privileged user. This commit amends that by adding `become` when appropriate. * ufw: add unit tests for direction and interface Extend the unit tests for the UFW module to test the `direction` and `interface` parameters. This will help in the implementation of a fix for issue #63903. * ufw: add support for interface_in and interface_out The UFW module has support for specifying `direction` and `interface` for UFW rules. Rules with these parameters are built such that per-interface filtering only apply to a single direction based on the value of `direction`. Not being able to specify multiple interfaces complicates things for `routed` rules where one might want to apply filtering only for a specific combination of `in` and `out` interfaces. This commit introduces two new parameters to the UFW module: `interface_in` and `interface_out`. These rules are mutually exclusive with the old `direction` and `interface` parameter because of the ambiguity of having e.g.: direction: XXX interface: foo interface_XXX: bar Fixes #63903
81 lines
1.7 KiB
YAML
81 lines
1.7 KiB
YAML
- name: Enable
|
|
ufw:
|
|
state: enabled
|
|
|
|
- name: Route with interface in and out
|
|
ufw:
|
|
rule: allow
|
|
route: yes
|
|
interface_in: foo
|
|
interface_out: bar
|
|
proto: tcp
|
|
from_ip: 1.1.1.1
|
|
to_ip: 8.8.8.8
|
|
from_port: 1111
|
|
to_port: 2222
|
|
|
|
- name: Route with interface in
|
|
ufw:
|
|
rule: allow
|
|
route: yes
|
|
interface_in: foo
|
|
proto: tcp
|
|
from_ip: 1.1.1.1
|
|
from_port: 1111
|
|
|
|
- name: Route with interface out
|
|
ufw:
|
|
rule: allow
|
|
route: yes
|
|
interface_out: bar
|
|
proto: tcp
|
|
from_ip: 1.1.1.1
|
|
from_port: 1111
|
|
|
|
- name: Non-route with interface in
|
|
ufw:
|
|
rule: allow
|
|
interface_in: foo
|
|
proto: tcp
|
|
from_ip: 1.1.1.1
|
|
from_port: 3333
|
|
|
|
- name: Non-route with interface out
|
|
ufw:
|
|
rule: allow
|
|
interface_out: bar
|
|
proto: tcp
|
|
from_ip: 1.1.1.1
|
|
from_port: 4444
|
|
|
|
- name: Check result
|
|
shell: ufw status |grep -E '(ALLOW|DENY|REJECT|LIMIT)' |sed -E 's/[ \t]+/ /g'
|
|
register: ufw_status
|
|
|
|
- assert:
|
|
that:
|
|
- '"8.8.8.8 2222/tcp on bar ALLOW FWD 1.1.1.1 1111/tcp on foo " in stdout'
|
|
- '"Anywhere ALLOW FWD 1.1.1.1 1111/tcp on foo " in stdout'
|
|
- '"Anywhere on bar ALLOW FWD 1.1.1.1 1111/tcp " in stdout'
|
|
- '"Anywhere on foo ALLOW 1.1.1.1 3333/tcp " in stdout'
|
|
- '"Anywhere ALLOW OUT 1.1.1.1 4444/tcp on bar " in stdout'
|
|
vars:
|
|
stdout: '{{ ufw_status.stdout_lines }}'
|
|
|
|
- name: Non-route with interface_in and interface_out
|
|
ufw:
|
|
rule: allow
|
|
interface_in: foo
|
|
interface_out: bar
|
|
proto: tcp
|
|
from_ip: 1.1.1.1
|
|
from_port: 1111
|
|
to_ip: 8.8.8.8
|
|
to_port: 2222
|
|
ignore_errors: yes
|
|
register: ufw_non_route_iface
|
|
|
|
- assert:
|
|
that:
|
|
- ufw_non_route_iface is failed
|
|
- '"Only route rules" in ufw_non_route_iface.msg'
|