forked from ansible/ansible
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ufw: add support for interface_in and interface_out (ansible#65382)
* ufw: escalate privileges in integration tests A few of the integration tests for the UFW module forgot to `become`. This is problematic if the test suite is executed as a non-privileged user. This commit amends that by adding `become` when appropriate. * ufw: add unit tests for direction and interface Extend the unit tests for the UFW module to test the `direction` and `interface` parameters. This will help in the implementation of a fix for issue ansible#63903. * ufw: add support for interface_in and interface_out The UFW module has support for specifying `direction` and `interface` for UFW rules. Rules with these parameters are built such that per-interface filtering only apply to a single direction based on the value of `direction`. Not being able to specify multiple interfaces complicates things for `routed` rules where one might want to apply filtering only for a specific combination of `in` and `out` interfaces. This commit introduces two new parameters to the UFW module: `interface_in` and `interface_out`. These rules are mutually exclusive with the old `direction` and `interface` parameter because of the ambiguity of having e.g.: direction: XXX interface: foo interface_XXX: bar Fixes ansible#63903
- Loading branch information
1 parent
8ad4d22
commit 95e61ff
Showing
5 changed files
with
252 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,2 @@ | ||
minor_changes: | ||
- ufw - accept ``interface_in`` and ``interface_out`` as parameters. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,81 @@ | ||
- name: Enable | ||
ufw: | ||
state: enabled | ||
|
||
- name: Route with interface in and out | ||
ufw: | ||
rule: allow | ||
route: yes | ||
interface_in: foo | ||
interface_out: bar | ||
proto: tcp | ||
from_ip: 1.1.1.1 | ||
to_ip: 8.8.8.8 | ||
from_port: 1111 | ||
to_port: 2222 | ||
|
||
- name: Route with interface in | ||
ufw: | ||
rule: allow | ||
route: yes | ||
interface_in: foo | ||
proto: tcp | ||
from_ip: 1.1.1.1 | ||
from_port: 1111 | ||
|
||
- name: Route with interface out | ||
ufw: | ||
rule: allow | ||
route: yes | ||
interface_out: bar | ||
proto: tcp | ||
from_ip: 1.1.1.1 | ||
from_port: 1111 | ||
|
||
- name: Non-route with interface in | ||
ufw: | ||
rule: allow | ||
interface_in: foo | ||
proto: tcp | ||
from_ip: 1.1.1.1 | ||
from_port: 3333 | ||
|
||
- name: Non-route with interface out | ||
ufw: | ||
rule: allow | ||
interface_out: bar | ||
proto: tcp | ||
from_ip: 1.1.1.1 | ||
from_port: 4444 | ||
|
||
- name: Check result | ||
shell: ufw status |grep -E '(ALLOW|DENY|REJECT|LIMIT)' |sed -E 's/[ \t]+/ /g' | ||
register: ufw_status | ||
|
||
- assert: | ||
that: | ||
- '"8.8.8.8 2222/tcp on bar ALLOW FWD 1.1.1.1 1111/tcp on foo " in stdout' | ||
- '"Anywhere ALLOW FWD 1.1.1.1 1111/tcp on foo " in stdout' | ||
- '"Anywhere on bar ALLOW FWD 1.1.1.1 1111/tcp " in stdout' | ||
- '"Anywhere on foo ALLOW 1.1.1.1 3333/tcp " in stdout' | ||
- '"Anywhere ALLOW OUT 1.1.1.1 4444/tcp on bar " in stdout' | ||
vars: | ||
stdout: '{{ ufw_status.stdout_lines }}' | ||
|
||
- name: Non-route with interface_in and interface_out | ||
ufw: | ||
rule: allow | ||
interface_in: foo | ||
interface_out: bar | ||
proto: tcp | ||
from_ip: 1.1.1.1 | ||
from_port: 1111 | ||
to_ip: 8.8.8.8 | ||
to_port: 2222 | ||
ignore_errors: yes | ||
register: ufw_non_route_iface | ||
|
||
- assert: | ||
that: | ||
- ufw_non_route_iface is failed | ||
- '"Only route rules" in ufw_non_route_iface.msg' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters