b99de25f32
* Enable 'changed' var with ufw check mode * Fix from comment of the PR + Unit Test * Fix on ufw module after the second review - delete rules change works in check mode - simplify execute def & use it on every call process - improved regexp - rename vars defaults to current_default_values * Add ignore error to execute() and use it in get_current_rules() * Update after third code review (introduce change in changed status) * Adjust tests and fix some problems (#1) * 'active' also appears in 'inactive'. * 'reject' is also a valid option here. * For example for reloaded, changed will be set back to False here. * Improve and adjust tests. * Fix after merging integration test * handle "disabled" on default routed * Add /var/lib/ufw/.. rules files * add unit test * Fix pep8 formatting error * Separate ipv6 and ipv4 rules process from checkmode * fix non-ascii error on ci * Some change after review * Add unit test with sub network mask * rename is_match function by is_starting * add changelog fragment
115 lines
2.6 KiB
YAML
115 lines
2.6 KiB
YAML
---
|
|
- name: Enable ufw
|
|
ufw:
|
|
state: enabled
|
|
|
|
# ############################################
|
|
- name: Make sure logging is off
|
|
ufw:
|
|
logging: no
|
|
- name: Logging (check mode)
|
|
ufw:
|
|
logging: yes
|
|
check_mode: yes
|
|
register: logging_check
|
|
- name: Logging
|
|
ufw:
|
|
logging: yes
|
|
register: logging
|
|
- name: Get logging
|
|
shell: |
|
|
ufw status verbose | grep "^Logging:"
|
|
register: ufw_logging
|
|
environment:
|
|
LC_ALL: C
|
|
- name: Logging (idempotency)
|
|
ufw:
|
|
logging: yes
|
|
register: logging_idem
|
|
- name: Logging (idempotency, check mode)
|
|
ufw:
|
|
logging: yes
|
|
check_mode: yes
|
|
register: logging_idem_check
|
|
- name: Logging (change, check mode)
|
|
ufw:
|
|
logging: full
|
|
check_mode: yes
|
|
register: logging_change_check
|
|
- name: Logging (change)
|
|
ufw:
|
|
logging: full
|
|
register: logging_change
|
|
- name: Get logging
|
|
shell: |
|
|
ufw status verbose | grep "^Logging:"
|
|
register: ufw_logging_change
|
|
environment:
|
|
LC_ALL: C
|
|
- assert:
|
|
that:
|
|
- logging_check is changed
|
|
- logging is changed
|
|
- "ufw_logging.stdout == 'Logging: on (low)'"
|
|
- logging_idem is not changed
|
|
- logging_idem_check is not changed
|
|
- "ufw_logging_change.stdout == 'Logging: on (full)'"
|
|
- logging_change is changed
|
|
- logging_change_check is changed
|
|
|
|
# ############################################
|
|
- name: Default (check mode)
|
|
ufw:
|
|
default: reject
|
|
direction: incoming
|
|
check_mode: yes
|
|
register: default_check
|
|
- name: Default
|
|
ufw:
|
|
default: reject
|
|
direction: incoming
|
|
register: default
|
|
- name: Get defaults
|
|
shell: |
|
|
ufw status verbose | grep "^Default:"
|
|
register: ufw_defaults
|
|
environment:
|
|
LC_ALL: C
|
|
- name: Default (idempotency)
|
|
ufw:
|
|
default: reject
|
|
direction: incoming
|
|
register: default_idem
|
|
- name: Default (idempotency, check mode)
|
|
ufw:
|
|
default: reject
|
|
direction: incoming
|
|
check_mode: yes
|
|
register: default_idem_check
|
|
- name: Default (change, check mode)
|
|
ufw:
|
|
default: allow
|
|
direction: incoming
|
|
check_mode: yes
|
|
register: default_change_check
|
|
- name: Default (change)
|
|
ufw:
|
|
default: allow
|
|
direction: incoming
|
|
register: default_change
|
|
- name: Get defaults
|
|
shell: |
|
|
ufw status verbose | grep "^Default:"
|
|
register: ufw_defaults_change
|
|
environment:
|
|
LC_ALL: C
|
|
- assert:
|
|
that:
|
|
- default_check is changed
|
|
- default is changed
|
|
- "'reject (incoming)' in ufw_defaults.stdout"
|
|
- default_idem is not changed
|
|
- default_idem_check is not changed
|
|
- default_change_check is changed
|
|
- default_change is changed
|
|
- "'allow (incoming)' in ufw_defaults_change.stdout"
|