iptables: implement log_level parameter

lib/ansible/modules/system/iptables.py

@@ -150,6 +150,14 @@
       - Specifies a log text for the rule. Only make sense with a LOG jump.
     type: str
     version_added: "2.5"
+  log_level:
+    description:
+      - Logging level according to the syslogd-defined priorities.
+      - The value can be strings or numbers from 1-8.
+      - This parameter is only applicable if C(jump) is set to C(LOG).
+    type: str
+    version_added: "2.8"
+    choices: [ '0', '1', '2', '3', '4', '5', '6', '7', 'emerg', 'alert', 'crit', 'error', 'warning', 'notice', 'info', 'debug' ]
   goto:
     description:
       - This specifies that the processing should continue in a user specified chain.
@@ -407,6 +415,16 @@
     chain: '{{ item }}'
     flush: yes
   with_items: [ 'INPUT', 'OUTPUT', 'PREROUTING', 'POSTROUTING' ]
+
+- name: Log packets arriving into an user-defined chain
+  iptables:
+    chain: LOGGING
+    action: append
+    state: present
+    limit: 2/second
+    limit_burst: 20
+    log_prefix: "IPTABLES:INFO: "
+    log_level: info
 '''
 
 import re
@@ -474,6 +492,7 @@ def construct_rule(params):
     append_tcp_flags(rule, params['tcp_flags'], '--tcp-flags')
     append_param(rule, params['jump'], '-j', False)
     append_param(rule, params['log_prefix'], '--log-prefix', False)
+    append_param(rule, params['log_level'], '--log-level', False)
     append_param(rule, params['to_destination'], '--to-destination', False)
     append_param(rule, params['to_source'], '--to-source', False)
     append_param(rule, params['goto'], '-g', False)
@@ -593,6 +612,12 @@ def main():
                            ),
             jump=dict(type='str'),
             log_prefix=dict(type='str'),
+            log_level=dict(type='str',
+                           choices=['0', '1', '2', '3', '4', '5', '6', '7',
+                                    'emerg', 'alert', 'crit', 'error',
+                                    'warning', 'notice', 'info', 'debug'],
+                           default=None,
+                           ),
             goto=dict(type='str'),
             in_interface=dict(type='str'),
             out_interface=dict(type='str'),
@@ -637,6 +662,12 @@ def main():
     if args['flush'] is False and args['chain'] is None:
         module.fail_json(msg="Either chain or flush parameter must be specified.")
 
+    if module.params.get('log_prefix', None) or module.params.get('log_level', None):
+        if module.params['jump'] is None:
+            module.params['jump'] = 'LOG'
+        elif module.params['jump'] != 'LOG':
+            module.fail_json(msg="Logging options can only be used with the LOG jump target.")
+
     # Flush the table
     if args['flush'] is True:
         args['changed'] = True

test/units/modules/system/test_iptables.py

@@ -636,3 +636,38 @@ def test_tcp_flags(self):
                 '-j',
                 'DROP'
             ])
+
+    def test_log_level(self):
+        """ Test various ways of log level flag """
+
+        log_levels = ['0', '1', '2', '3', '4', '5', '6', '7',
+                      'emerg', 'alert', 'crit', 'error', 'warning', 'notice', 'info', 'debug']
+
+        for log_lvl in log_levels:
+            set_module_args({
+                'chain': 'INPUT',
+                'jump': 'LOG',
+                'log_level': log_lvl,
+                'source': '1.2.3.4/32',
+                'log_prefix': '** DROP-this_ip **'
+            })
+            commands_results = [
+                (0, '', ''),
+            ]
+
+            with patch.object(basic.AnsibleModule, 'run_command') as run_command:
+                run_command.side_effect = commands_results
+                with self.assertRaises(AnsibleExitJson) as result:
+                    iptables.main()
+                    self.assertTrue(result.exception.args[0]['changed'])
+
+                self.assertEqual(run_command.call_count, 1)
+                self.assertEqual(run_command.call_args_list[0][0][0], [
+                    '/sbin/iptables',
+                    '-t', 'filter',
+                    '-C', 'INPUT',
+                    '-s', '1.2.3.4/32',
+                    '-j', 'LOG',
+                    '--log-prefix', '** DROP-this_ip **',
+                    '--log-level', log_lvl
+                ])