Extend match functionality for iptables module

[EvanDonato]

SUMMARY

iptables module only offers a limited set of functionality for the match function of iptables.

ISSUE TYPE

• Feature Idea

COMPONENT NAME

iptables

ANSIBLE VERSION

ansible 2.5.3
  config file = None
  configured module search path = [u'/Users/edonato/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/Cellar/ansible/2.5.3/libexec/lib/python2.7/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.15 (default, May  1 2018, 16:44:08) [GCC 4.2.1 Compatible Apple LLVM 9.1.0 (clang-902.0.39.1)]

CONFIGURATION

OS / ENVIRONMENT

Source: OSX 10.13.4
Target: CentOS 7

STEPS TO REPRODUCE

Two options for new command:
- name: Drop long DNS TCP
  iptables:
    chain: INPUT
    protocol: tcp
    source_port: 53
    match: length
    length: 1025
    jump: DROP
  become: yes

OR

- name: Log long DNS TCP
  iptables:
    chain: INPUT
    protocol: tcp
    source_port: 53
    match: length
    match_args: --length 1025
    jump: DROP
  become: yes

EXPECTED RESULTS

There are two proposed options. First would follow the current model where sanity checks and the like are done by the iptables module prior to attempting an insert and the second would simplify things in a sense by allowing a user to supply an argument to the match option that would be error handled by iptables itself.

ACTUAL RESULTS

[ansibot]

Files identified in the description:

• lib/ansible/modules/system/iptables.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @LinusU @sebastiendarocha
click here for bot help

[grimlokason]

Hello,
This feature is still something needed,.

For exemple, actually with something like :

- name: configure | Adding iptables rules
  iptables:
    chain: FORWARD
    protocol: tcp 
    destination_port: 15672
    action: insert 
    match: "set ! --match-set AWX3.0 src"
    jump: DROP
    rule_num: 1

It's converted to :

/sbin/iptables -t filter -I FORWARD 1 -p tcp -m 'set ! --match-set AWX3.0 src' -j DROP --destination-port 15672

this give the error :

iptables v1.4.21: Couldn't load match `set ! --match-set AWX3.0 src':

While it should be :

/sbin/iptables -t filter -I FORWARD 1 -p tcp -m set ! --match-set AWX3.0 src -j DROP --destination-port 15672

tested on ansible 2.8

[ansibot]

Files identified in the description:

• lib/ansible/modules/iptables.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[estenrye]

I would like to see the match funtionality extended to include support for the recent match module in iptables.

from the iptables man page

recent

Allows you to dynamically create a list of IP addresses and then match against that list in a few different ways.

For example, you can create a 'badguy' list out of people attempting to connect to port 139 on your firewall and then DROP all future packets from them without considering them.
--name name
    Specify the list to use for the commands. If no name is given then 'DEFAULT' will be used. 
[!] --set
    This will add the source address of the packet to the list. If the source address is already in the list, this will update the existing entry. This will always return success (or failure if '!' is passed in). 
[!] --rcheck
    Check if the source address of the packet is currently in the list. 
[!] --update
    Like --rcheck, except it will update the "last seen" timestamp if it matches. 
[!] --remove
    Check if the source address of the packet is currently in the list and if so that address will be removed from the list and the rule will return true. If the address is not found, false is returned. 
[!] --seconds seconds
    This option must be used in conjunction with one of --rcheck or --update. When used, this will narrow the match to only happen when the address is in the list and was seen within the last given number of seconds. 
[!] --hitcount hits
    This option must be used in conjunction with one of --rcheck or --update. When used, this will narrow the match to only happen when the address is in the list and packets had been received greater than or equal to the given value. This option may be used along with --seconds to create an even narrower match requiring a certain number of hits within a specific time frame. 

Ideally I would like to see something like this:

- name: Drop Quarantined Hosts for Port Scanning for 60 seconds
  ansible.builtin.iptables:
    table: filter
    chain: INPUT
    jump: DROP
    recent:
      name: psc
      update: true
      seconds: 60

Result in an iptables rule like this:

-A INPUT  -m recent --name psc --update --seconds 60 -j DROP

And something like this:

- name: Drop Quarantined Hosts for Port Scanning Internal Services
  ansible.builtin.iptables_raw:
    table: filter
    chain: INPUT
    jump: DROP
    in_interface: "! lo"
    destination_port: 1433
    protocol: tcp
    comment: SQLServer
    recent:
      name: psc
      set: true

result in a rule like this:

-A INPUT -i ! lo -m tcp -p tcp --dport 1433  -m recent --name psc --set -m comment --comment SQLServer -j DROP

[bcoca]

waiting_on_contributor

[ansibot]

Thank you very much for your submission to Ansible. It means a lot to us that you've taken time to contribute.

Unfortunately, this issue has been open for some time while waiting for a contributor to take it up but there does not seem to have been anyone that did so. So we are going to close this issue to clear up the queues and make it easier for contributors to browse possible implementation targets.

However, we're absolutely always up for discussion. Because this project is very active, we're unlikely to see comments made on closed tickets and we lock them after some time. If you or anyone else has any further questions, please let us know by using any of the communication methods listed in the page below:

• https://docs.ansible.com/ansible/latest/community/communication.html

In the future, sometimes starting a discussion on the development list prior to proposing or implementing a feature can make getting things included a little easier, but it's not always necessary.

Thank you once again for this and your interest in Ansible!

click here for bot help