Google
Edit File: iptables.cpython-39.pyc
a �)g� � @ s d dl mZmZmZ eZdZdZd dlZd dl m Z d dl m Z dZ dZed d d �Zed d d �Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd:d d �Zd!d"� Zd#d$� Z d%d&� Z d'd(� Z d)d*� Z d+d,� Z d-d.� Z!d/d0� Z"d1d2� Z#d3d4� Z$d5d6� Z%d7d8� Z&e'd9k�re&� dS );� )�absolute_import�division�print_functionu�: --- module: iptables short_description: Modify iptables rules version_added: "2.0" author: - Linus Unnebäck (@LinusU) <linus@folkdatorn.se> - Sébastien DA ROCHA (@sebastiendarocha) description: - C(iptables) is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. - This module does not handle the saving and/or loading of rules, but rather only manipulates the current rules that are present in memory. This is the same as the behaviour of the C(iptables) and C(ip6tables) command which this module uses internally. extends_documentation_fragment: action_common_attributes attributes: check_mode: support: full diff_mode: support: none platform: platforms: linux notes: - This module just deals with individual rules. If you need advanced chaining of rules the recommended way is to template the iptables restore file. options: table: description: - This option specifies the packet matching table which the command should operate on. - If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there. type: str choices: [ filter, nat, mangle, raw, security ] default: filter state: description: - Whether the rule should be absent or present. type: str choices: [ absent, present ] default: present action: description: - Whether the rule should be appended at the bottom or inserted at the top. - If the rule already exists the chain will not be modified. type: str choices: [ append, insert ] default: append version_added: "2.2" rule_num: description: - Insert the rule as the given rule number. - This works only with C(action=insert). type: str version_added: "2.5" ip_version: description: - Which version of the IP protocol this rule should apply to. type: str choices: [ ipv4, ipv6 ] default: ipv4 chain: description: - Specify the iptables chain to modify. - This could be a user-defined chain or one of the standard iptables chains, like C(INPUT), C(FORWARD), C(OUTPUT), C(PREROUTING), C(POSTROUTING), C(SECMARK) or C(CONNSECMARK). type: str protocol: description: - The protocol of the rule or of the packet to check. - The specified protocol can be one of C(tcp), C(udp), C(udplite), C(icmp), C(ipv6-icmp) or C(icmpv6), C(esp), C(ah), C(sctp) or the special keyword C(all), or it can be a numeric value, representing one of these protocols or a different one. - A protocol name from I(/etc/protocols) is also allowed. - A C(!) argument before the protocol inverts the test. - The number zero is equivalent to all. - C(all) will match with all protocols and is taken as default when this option is omitted. type: str source: description: - Source specification. - Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. - Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. - The mask can be either a network mask or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A C(!) argument before the address specification inverts the sense of the address. type: str destination: description: - Destination specification. - Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. - Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. - The mask can be either a network mask or a plain number, specifying the number of 1's at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A C(!) argument before the address specification inverts the sense of the address. type: str tcp_flags: description: - TCP flags specification. - C(tcp_flags) expects a dict with the two keys C(flags) and C(flags_set). type: dict default: {} version_added: "2.4" suboptions: flags: description: - List of flags you want to examine. type: list elements: str flags_set: description: - Flags to be set. type: list elements: str match: description: - Specifies a match to use, that is, an extension module that tests for a specific property. - The set of matches make up the condition under which a target is invoked. - Matches are evaluated first to last if specified as an array and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop. type: list elements: str default: [] jump: description: - This specifies the target of the rule; i.e., what to do if the packet matches it. - The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). - If this option is omitted in a rule (and the goto parameter is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented. type: str gateway: description: - This specifies the IP address of host to send the cloned packets. - This option is only valid when C(jump) is set to C(TEE). type: str version_added: "2.8" log_prefix: description: - Specifies a log text for the rule. Only make sense with a LOG jump. type: str version_added: "2.5" log_level: description: - Logging level according to the syslogd-defined priorities. - The value can be strings or numbers from 1-8. - This parameter is only applicable if C(jump) is set to C(LOG). type: str version_added: "2.8" choices: [ '0', '1', '2', '3', '4', '5', '6', '7', 'emerg', 'alert', 'crit', 'error', 'warning', 'notice', 'info', 'debug' ] goto: description: - This specifies that the processing should continue in a user specified chain. - Unlike the jump argument return will not continue processing in this chain but instead in the chain that called us via jump. type: str in_interface: description: - Name of an interface via which a packet was received (only for packets entering the C(INPUT), C(FORWARD) and C(PREROUTING) chains). - When the C(!) argument is used before the interface name, the sense is inverted. - If the interface name ends in a C(+), then any interface which begins with this name will match. - If this option is omitted, any interface name will match. type: str out_interface: description: - Name of an interface via which a packet is going to be sent (for packets entering the C(FORWARD), C(OUTPUT) and C(POSTROUTING) chains). - When the C(!) argument is used before the interface name, the sense is inverted. - If the interface name ends in a C(+), then any interface which begins with this name will match. - If this option is omitted, any interface name will match. type: str fragment: description: - This means that the rule only refers to second and further fragments of fragmented packets. - Since there is no way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match any rules which specify them. - When the "!" argument precedes fragment argument, the rule will only match head fragments, or unfragmented packets. type: str set_counters: description: - This enables the administrator to initialize the packet and byte counters of a rule (during C(INSERT), C(APPEND), C(REPLACE) operations). type: str source_port: description: - Source port or port range specification. - This can either be a service name or a port number. - An inclusive range can also be specified, using the format C(first:last). - If the first port is omitted, C(0) is assumed; if the last is omitted, C(65535) is assumed. - If the first port is greater than the second one they will be swapped. type: str destination_port: description: - "Destination port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format first:last. If the first port is omitted, '0' is assumed; if the last is omitted, '65535' is assumed. If the first port is greater than the second one they will be swapped. This is only valid if the rule also specifies one of the following protocols: tcp, udp, dccp or sctp." type: str destination_ports: description: - This specifies multiple destination port numbers or port ranges to match in the multiport module. - It can only be used in conjunction with the protocols tcp, udp, udplite, dccp and sctp. type: list elements: str version_added: "2.11" to_ports: description: - This specifies a destination port or range of ports to use, without this, the destination port is never altered. - This is only valid if the rule also specifies one of the protocol C(tcp), C(udp), C(dccp) or C(sctp). type: str to_destination: description: - This specifies a destination address to use with C(DNAT). - Without this, the destination address is never altered. type: str version_added: "2.1" to_source: description: - This specifies a source address to use with C(SNAT). - Without this, the source address is never altered. type: str version_added: "2.2" syn: description: - This allows matching packets that have the SYN bit set and the ACK and RST bits unset. - When negated, this matches all packets with the RST or the ACK bits set. type: str choices: [ ignore, match, negate ] default: ignore version_added: "2.5" set_dscp_mark: description: - This allows specifying a DSCP mark to be added to packets. It takes either an integer or hex value. - Mutually exclusive with C(set_dscp_mark_class). type: str version_added: "2.1" set_dscp_mark_class: description: - This allows specifying a predefined DiffServ class which will be translated to the corresponding DSCP mark. - Mutually exclusive with C(set_dscp_mark). type: str version_added: "2.1" comment: description: - This specifies a comment that will be added to the rule. type: str ctstate: description: - A list of the connection states to match in the conntrack module. - Possible values are C(INVALID), C(NEW), C(ESTABLISHED), C(RELATED), C(UNTRACKED), C(SNAT), C(DNAT). type: list elements: str default: [] src_range: description: - Specifies the source IP range to match in the iprange module. type: str version_added: "2.8" dst_range: description: - Specifies the destination IP range to match in the iprange module. type: str version_added: "2.8" match_set: description: - Specifies a set name which can be defined by ipset. - Must be used together with the match_set_flags parameter. - When the C(!) argument is prepended then it inverts the rule. - Uses the iptables set extension. type: str version_added: "2.11" match_set_flags: description: - Specifies the necessary flags for the match_set parameter. - Must be used together with the match_set parameter. - Uses the iptables set extension. type: str choices: [ "src", "dst", "src,dst", "dst,src" ] version_added: "2.11" limit: description: - Specifies the maximum average number of matches to allow per second. - The number can specify units explicitly, using C(/second), C(/minute), C(/hour) or C(/day), or parts of them (so C(5/second) is the same as C(5/s)). type: str limit_burst: description: - Specifies the maximum burst before the above limit kicks in. type: str version_added: "2.1" uid_owner: description: - Specifies the UID or username to use in match by owner rule. - From Ansible 2.6 when the C(!) argument is prepended then the it inverts the rule to apply instead to all users except that one specified. type: str version_added: "2.1" gid_owner: description: - Specifies the GID or group to use in match by owner rule. type: str version_added: "2.9" reject_with: description: - 'Specifies the error packet type to return while rejecting. It implies "jump: REJECT".' type: str version_added: "2.1" icmp_type: description: - This allows specification of the ICMP type, which can be a numeric ICMP type, type/code pair, or one of the ICMP type names shown by the command 'iptables -p icmp -h' type: str version_added: "2.2" flush: description: - Flushes the specified table and chain of all rules. - If no chain is specified then the entire table is purged. - Ignores all other parameters. type: bool default: false version_added: "2.2" policy: description: - Set the policy for the chain to the given target. - Only built-in chains can have policies. - This parameter requires the C(chain) parameter. - If you specify this parameter, all other parameters will be ignored. - This parameter is used to set default policy for the given C(chain). Do not confuse this with C(jump) parameter. type: str choices: [ ACCEPT, DROP, QUEUE, RETURN ] version_added: "2.2" wait: description: - Wait N seconds for the xtables lock to prevent multiple instances of the program from running concurrently. type: str version_added: "2.10" chain_management: description: - If C(true) and C(state) is C(present), the chain will be created if needed. - If C(true) and C(state) is C(absent), the chain will be deleted if the only other parameter passed are C(chain) and optionally C(table). type: bool default: false version_added: "2.13" a� - name: Block specific IP ansible.builtin.iptables: chain: INPUT source: 8.8.8.8 jump: DROP become: yes - name: Forward port 80 to 8600 ansible.builtin.iptables: table: nat chain: PREROUTING in_interface: eth0 protocol: tcp match: tcp destination_port: 80 jump: REDIRECT to_ports: 8600 comment: Redirect web traffic to port 8600 become: yes - name: Allow related and established connections ansible.builtin.iptables: chain: INPUT ctstate: ESTABLISHED,RELATED jump: ACCEPT become: yes - name: Allow new incoming SYN packets on TCP port 22 (SSH) ansible.builtin.iptables: chain: INPUT protocol: tcp destination_port: 22 ctstate: NEW syn: match jump: ACCEPT comment: Accept new SSH connections. - name: Match on IP ranges ansible.builtin.iptables: chain: FORWARD src_range: 192.168.1.100-192.168.1.199 dst_range: 10.0.0.1-10.0.0.50 jump: ACCEPT - name: Allow source IPs defined in ipset "admin_hosts" on port 22 ansible.builtin.iptables: chain: INPUT match_set: admin_hosts match_set_flags: src destination_port: 22 jump: ALLOW - name: Tag all outbound tcp packets with DSCP mark 8 ansible.builtin.iptables: chain: OUTPUT jump: DSCP table: mangle set_dscp_mark: 8 protocol: tcp - name: Tag all outbound tcp packets with DSCP DiffServ class CS1 ansible.builtin.iptables: chain: OUTPUT jump: DSCP table: mangle set_dscp_mark_class: CS1 protocol: tcp # Create the user-defined chain ALLOWLIST - iptables: chain: ALLOWLIST chain_management: true # Delete the user-defined chain ALLOWLIST - iptables: chain: ALLOWLIST chain_management: true state: absent - name: Insert a rule on line 5 ansible.builtin.iptables: chain: INPUT protocol: tcp destination_port: 8080 jump: ACCEPT action: insert rule_num: 5 # Think twice before running following task as this may lock target system - name: Set the policy for the INPUT chain to DROP ansible.builtin.iptables: chain: INPUT policy: DROP - name: Reject tcp with tcp-reset ansible.builtin.iptables: chain: INPUT protocol: tcp reject_with: tcp-reset ip_version: ipv4 - name: Set tcp flags ansible.builtin.iptables: chain: OUTPUT jump: DROP protocol: tcp tcp_flags: flags: ALL flags_set: - ACK - RST - SYN - FIN - name: Iptables flush filter ansible.builtin.iptables: chain: "{{ item }}" flush: yes with_items: [ 'INPUT', 'FORWARD', 'OUTPUT' ] - name: Iptables flush nat ansible.builtin.iptables: table: nat chain: '{{ item }}' flush: yes with_items: [ 'INPUT', 'OUTPUT', 'PREROUTING', 'POSTROUTING' ] - name: Log packets arriving into an user-defined chain ansible.builtin.iptables: chain: LOGGING action: append state: present limit: 2/second limit_burst: 20 log_prefix: "IPTABLES:INFO: " log_level: info - name: Allow connections on multiple ports ansible.builtin.iptables: chain: INPUT protocol: tcp destination_ports: - "80" - "443" - "8081:8083" jump: ACCEPT N)� LooseVersion)� AnsibleModulez1.4.20z1.6.0ZiptablesZ ip6tables)�ipv4�ipv6z --icmp-typez --icmpv6-typec C s^ |r |D ]}t | ||d� qn<|d urZ|d dkrL| �d||dd � g� n| �||g� d S )NFr �!� )� append_param�extend)�rule�param�flagZis_list�item� r �</usr/lib/python3.9/site-packages/ansible/modules/iptables.pyr / s r c C s< |r8d|v r8d|v r8| � |d�|d �d�|d �g� d S )N�flags� flags_set�,�r �join�r r r r r r �append_tcp_flags; s r c C s4 |dkr| � |g� n|r0|dkr0| � d|g� d S )N�match�negater �r )r r r Z negatabler r r �append_match_flagA s r c C s |r| � |d�|�g� d S )Nr r r r r r � append_csvH s r c C s |r| � d|g� d S )N�-mr )r r r r r r � append_matchM s r c C s |r| � d|g� d S )N�-jr )r r �jumpr r r � append_jumpR s r# c C s |r| � ||g� d S )Nr r r r r � append_waitW s r$ c C sP g }t || d d� t|| d dd� t|| d dd� t|| d d d� t|| d d d � t|| d d� t|| d dd� | �d�r�| d �� dkr�t|| d dd� t|| d dd� t|| d dd� t|| d dd� t|| d d� t|| d d � t|| d d d� t|| d d d� t|| d! d"d� t|| d# d$d� t|| d% d&d� t|| d' d(d� t|| d) d*d� t|| d+ d,d� t|| d- d.d� t|| d/ d0d� t|| d1 d2d� t|| d3 d4d � d5| d v �r�t|| d6 d7� nJd8| d v �rt|| d6 d9� n*| d6 �rBt|| d6 d5� t|| d6 d7� d:| d v �rvt|| d; d<d� t|| d= d>d� nR| d; �s�| d= �r�t|| d; �p�| d= d:� t|| d; d<d� t|| d= d>d� d?| d v �r�t|| d@ dAd� t|d | dB d� n>| d@ �r:t|| d@ d?� t|| d@ dAd� t|d | dB d� t|| dC �pN| dD dC� t|| dC dEd� t|| dD dFd� t|| dG dH� t|| dG dId � t|| dG dId� t|| dJ dH� t|| dJ dKd � t|| dJ dKd� | d d u �r�t|| dL dM� t|| dL dNd� t|| dO t | dP d� t|| dQ dQ� t|| dQ dRd� |S )SN�waitz-w�protocolz-pF�sourcez-s� destinationz-dr r T� tcp_flagsz --tcp-flagsr" r! �tee�gatewayz --gateway� log_prefixz --log-prefix� log_levelz --log-level�to_destinationz--to-destination�destination_portsZ multiportz--dports� to_sourcez --to-source�gotoz-g� in_interfacez-i� out_interfacez-o�fragmentz-f� set_countersz-c� source_portz --source-port�destination_portz--destination-port�to_portsz --to-ports� set_dscp_markz --set-dscp�set_dscp_mark_classz--set-dscp-class�synz--synZ conntrack�ctstatez --ctstate�statez--stateZiprange� src_rangez --src-range� dst_rangez --dst-range�set� match_setz --match-set�match_set_flags�limit� limit_burstz--limitz --limit-burst� uid_owner�ownerz --uid-owner� gid_ownerz --gid-owner� reject_withZREJECTz --reject-with� icmp_type� ip_version�commentz --comment) r$ r r �get�lowerr r r r# �ICMP_TYPE_OPTIONS)�paramsr r r r �construct_rule\ s� � �rP Tc C s` | g}|� d|d g� |� ||d g� |dkrJ|d rJ|� |d g� |r\|� t|�� |S )Nz-t�table�chain�-I�rule_num)r rP )� iptables_path�actionrO � make_rule�cmdr r r �push_arguments� s rY c C s( t | d|�}|j|dd�\}}}|dkS )Nz-CF�Zcheck_rcr �rY � run_command�rU �modulerO rX �rc�_�__r r r �check_rule_present� s rb c C s t | d|�}|j|dd� d S )Nz-ATrZ r[ �rU r^ rO rX r r r � append_rule� s rd c C s t | d|�}|j|dd� d S )NrS TrZ r[ rc r r r � insert_rule� s re c C s t | d|�}|j|dd� d S )Nz-DTrZ r[ rc r r r � remove_rule� s rf c C s" t | d|dd�}|j|dd� d S )Nz-FF�rW TrZ r[ rc r r r � flush_table� s rh c C s0 t | d|dd�}|�|d � |j|dd� d S )Nz-PFrg �policyTrZ )rY �appendr\ rc r r r �set_chain_policy� s rk c C sP t | d|dd�}|j|dd�\}}}|�d�d }t�d|�}|rL|�d �S d S ) N�-LFrg TrZ � r z\(policy ([A-Z]+)\)r )rY r\ �split�re�search�group) rU r^ rO rX r_ �outr` Z chain_header�resultr r r �get_chain_policy� s rt c C s0 | dg}|j |dd�\}}}|�d�d �d�S )Nz --versionTrZ �vr rm )r\ rn �rstrip)rU r^ rX r_ rr r` r r r �get_iptables_version� s rw c C s" t | d|dd�}|j|dd� d S )Nz-NFrg TrZ r[ rc r r r � create_chain� s rx c C s, t | d|dd�}|j|dd�\}}}|dkS )Nrl Frg rZ r r[ r] r r r �check_chain_present� s ry c C s" t | d|dd�}|j|dd� d S )Nz-XFrg TrZ r[ rc r r r � delete_chain� s rz c 3 C s� t dttddg d�d�tddddgd�tdddd gd�tdd d d gd�tdd �tdd �tdd �tdd �tdd �tdd �tdd �tdd �td dg d�tdttd dd�td dd�d�d�tdd �tdd �tdd �tdg d�d d�tdd �tdd �tdd �tdd �tdd �tdd �tdd �td dg d�tdd �tdd �tdd �tdd �td dg d�tdd �tdd �tdd �tdg d�d�tdd �tdd �tdd �tdd �tdd �tdd �tddg d�d�tddd�tdg d �d�tddd�d �-d d gd d!gfd"d#d$ggd"d%d$gggd&�} tdd| jd' | jd( | jd) | jd d*�t| j��| jd+ | jd, d-� }| jd' }| �t| d�}|d du �r�|d) d u �r�| jd.d/� | j�d0d ��s�| j�d1d ��r�| jd" d u �r�d2| jd"< n | jd" d2k�r�| jd3d/� t t || ��}|t t �k�r |t t �k �r&d4| jd5< n d | jd5< |d du �rVd|d6< | j �s�t|| | j� �n~| jd! �r�t|| | j�}|�s�| jd7d/� || jd! k}||d6< |�r�| j �s�t|| | j� �n |d+ dk�r|d8 �st|| | j�}||d6< |�r�|d, �r�| j �s�t|| | j� n�| jd9 d k}t|| | j�} | �p<t|| | j�}|d+ dk} | | k|d6< |d6 du �rt| jf i |�� | j �s�| �r�|�s�|d, �r�t|| | j� |�r�t|| | j� nt|| | j� nt|| | j� | jf i |�� d S ):NT�str�filter)r| ZnatZmangle�rawZsecurity)�type�default�choicesZpresentZabsentrj �insertr r )r~ �list)r~ �elementsr �dict)r~ r� )r r )r~ �options)�0�1�2�3�4�5�6�7ZemergZalertZcrit�errorZwarningZnotice�info�debug)r~ r� r )�src�dstzsrc,dstzdst,src)r~ r� �ignore)r� r r �boolF)r~ r )ZACCEPTZDROPZQUEUEZRETURN)-rQ r= rV rJ rR rT r& r% r' r0 r( r. r r) r" r+ r, r- r1 r2 r3 r4 r5 r6 r7 r/ r8 r9 r: rK r< r> r? rA rB rC rD rE rG rH rI r; �flushri �chain_managementr9 r: r� ri r" ZTEEr+ r* )Zsupports_check_modeZ argument_specZmutually_exclusiveZ required_ifrJ rQ rR � r= r� ) �changedZfailedrJ rQ rR r� r r= r� z2Either chain or flush parameter must be specified.)�msgr, r- ZLOGz:Logging options can only be used with the LOG jump target.� r% r� zCan't detect current policyr rV )r r� rO r rP Z get_bin_path�BINSZ fail_jsonrL r rw �IPTABLES_WAIT_SUPPORT_ADDED�(IPTABLES_WAIT_WITH_SECONDS_SUPPORT_ADDEDZ check_moderh rt rk ry rz rb Z exit_jsonrx re rd rf ) r^ �argsrJ rU Ziptables_versionZcurrent_policyr� Zchain_is_presentr� Zrule_is_presentZshould_be_presentr r r �main� s ��� �9� ��C� ��� r� �__main__)T)(Z __future__r r r r~ Z __metaclass__Z DOCUMENTATIONZEXAMPLESro Z#ansible.module_utils.compat.versionr Zansible.module_utils.basicr r� r� r� r� rN r r r r r r# r$ rP rY rb rd re rf rh rk rt rw rx ry rz r� �__name__r r r r �<module> sV { �� K "