Vh][pddlmZmZmZeZdZdZddlZddl m Z ddl m Z dZ dZd Zed k(reyy) )absolute_importdivisionprint_functionae module: ufw short_description: Manage firewall with UFW description: - Manage firewall with UFW. author: - Aleksey Ovcharenko (@ovcharenko) - Jarno Keskikangas (@pyykkis) - Ahti Kitsik (@ahtik) notes: - See C(man ufw) for more examples. - B(Warning:) Whilst the module itself can be run using concurrent strategies, C(ufw) does not support concurrency, as firewall rules are meant to be ordered and parallel executions do not guarantee order. B(Do not use concurrency:) The results are unpredictable and the module may fail silently if you do. requirements: - C(ufw) package extends_documentation_fragment: - community.general.attributes attributes: check_mode: support: full diff_mode: support: none options: state: description: - V(enabled) reloads firewall and enables firewall on boot. - V(disabled) unloads firewall and disables firewall on boot. - V(reloaded) reloads firewall. - V(reset) disables and resets firewall to installation defaults. type: str choices: [disabled, enabled, reloaded, reset] default: description: - Change the default policy for incoming or outgoing traffic. type: str choices: [allow, deny, reject] aliases: [policy] direction: description: - Select direction for a rule or default policy command. Mutually exclusive with O(interface_in) and O(interface_out). type: str choices: [in, incoming, out, outgoing, routed] logging: description: - Toggles logging. Logged packets use the LOG_KERN syslog facility. type: str choices: ['on', 'off', low, medium, high, full] insert: description: - Insert the corresponding rule as rule number NUM. - Note that ufw numbers rules starting with 1. - If O(delete=true) and a value is provided for O(insert), then O(insert) is ignored. type: int insert_relative_to: description: - Allows to interpret the index in O(insert) relative to a position. - V(zero) interprets the rule number as an absolute index (that is, 1 is the first rule). - V(first-ipv4) interprets the rule number relative to the index of the first IPv4 rule, or relative to the position where the first IPv4 rule would be if there is currently none. - V(last-ipv4) interprets the rule number relative to the index of the last IPv4 rule, or relative to the position where the last IPv4 rule would be if there is currently none. - V(first-ipv6) interprets the rule number relative to the index of the first IPv6 rule, or relative to the position where the first IPv6 rule would be if there is currently none. - V(last-ipv6) interprets the rule number relative to the index of the last IPv6 rule, or relative to the position where the last IPv6 rule would be if there is currently none. type: str choices: [first-ipv4, first-ipv6, last-ipv4, last-ipv6, zero] default: zero rule: description: - Add firewall rule. type: str choices: [allow, deny, limit, reject] log: description: - Log new connections matched to this rule. type: bool default: false from_ip: description: - Source IP address. type: str default: any aliases: [from, src] from_port: description: - Source port. type: str to_ip: description: - Destination IP address. type: str default: any aliases: [dest, to] to_port: description: - Destination port. type: str aliases: [port] proto: description: - TCP/IP protocol. - The value V(vrrp) is supported since community.general 10.3.0. type: str choices: [any, tcp, udp, ipv6, esp, ah, gre, igmp, vrrp] aliases: [protocol] name: description: - Use profile located in C(/etc/ufw/applications.d). type: str aliases: [app] delete: description: - Delete rule. - If O(delete=true) and a value is provided for O(insert), then O(insert) is ignored. type: bool default: false interface: description: - Specify interface for the rule. The direction (in or out) used for the interface depends on the value of O(direction). See O(interface_in) and O(interface_out) for routed rules that needs to supply both an input and output interface. Mutually exclusive with O(interface_in) and O(interface_out). type: str aliases: [if] interface_in: description: - Specify input interface for the rule. This is mutually exclusive with O(direction) and O(interface). However, it is compatible with O(interface_out) for routed rules. type: str aliases: [if_in] version_added: '0.2.0' interface_out: description: - Specify output interface for the rule. This is mutually exclusive with O(direction) and O(interface). However, it is compatible with O(interface_in) for routed rules. type: str aliases: [if_out] version_added: '0.2.0' route: description: - Apply the rule to routed/forwarded packets. type: bool default: false comment: description: - Add a comment to the rule. Requires UFW version >=0.35. type: str a - name: Allow everything and enable UFW community.general.ufw: state: enabled policy: allow - name: Set logging community.general.ufw: logging: 'on' # Sometimes it is desirable to let the sender know when traffic is # being denied, rather than simply ignoring it. In these cases, use # reject instead of deny. In addition, log rejected connections: - community.general.ufw: rule: reject port: auth log: true # ufw supports connection rate limiting, which is useful for protecting # against brute-force login attacks. ufw will deny connections if an IP # address has attempted to initiate 6 or more connections in the last # 30 seconds. See http://www.debian-administration.org/articles/187 # for details. Typical usage is: - community.general.ufw: rule: limit port: ssh proto: tcp # Allow OpenSSH. (Note that as ufw manages its own state, simply removing # a rule=allow task can leave those ports exposed. Either use delete=true # or a separate state=reset task) - community.general.ufw: rule: allow name: OpenSSH - name: Delete OpenSSH rule community.general.ufw: rule: allow name: OpenSSH delete: true - name: Deny all access to port 53 community.general.ufw: rule: deny port: '53' - name: Allow port range 60000-61000 community.general.ufw: rule: allow port: 60000:61000 proto: tcp - name: Allow all access to tcp port 80 community.general.ufw: rule: allow port: '80' proto: tcp - name: Allow all access from RFC1918 networks to this host community.general.ufw: rule: allow src: '{{ item }}' loop: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - name: Deny access to udp port 514 from host 1.2.3.4 and include a comment community.general.ufw: rule: deny proto: udp src: 1.2.3.4 port: '514' comment: Block syslog - name: Allow incoming access to eth0 from 1.2.3.5 port 5469 to 1.2.3.4 port 5469 community.general.ufw: rule: allow interface: eth0 direction: in proto: udp src: 1.2.3.5 from_port: '5469' dest: 1.2.3.4 to_port: '5469' # Note that IPv6 must be enabled in /etc/default/ufw for IPv6 firewalling to work. - name: Deny all traffic from the IPv6 2001:db8::/32 to tcp port 25 on this host community.general.ufw: rule: deny proto: tcp src: 2001:db8::/32 port: '25' - name: Deny all IPv6 traffic to tcp port 20 on this host # this should be the first IPv6 rule community.general.ufw: rule: deny proto: tcp port: '20' to_ip: "::" insert: 0 insert_relative_to: first-ipv6 - name: Deny all IPv4 traffic to tcp port 20 on this host # This should be the third to last IPv4 rule # (insert: -1 addresses the second to last IPv4 rule; # so the new rule will be inserted before the second # to last IPv4 rule, and will be come the third to last # IPv4 rule.) community.general.ufw: rule: deny proto: tcp port: '20' to_ip: "::" insert: -1 insert_relative_to: last-ipv4 # Can be used to further restrict a global FORWARD policy set to allow - name: Deny forwarded/routed traffic from subnet 1.2.3.0/24 to subnet 4.5.6.0/24 community.general.ufw: rule: deny route: true src: 192.0.2.0/24 dest: 198.51.100.0/24 N) itemgetter) AnsibleModulec:d}|dz }tj|S)Nz1((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}z((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])recompilers i/home/dcms/DCMS/lib/python3.12/site-packages/ansible_collections/community/general/plugins/modules/ufw.pycompile_ipv4_regexpr*s }25fd?}4fd@}5fdA}d|06fdB 113fdC}167fdD} 6j} |D cic]} | | s | | | } } 6j dEd576j dFd5317gdGgg} |}d}| j D]o\}}7g6jdHgg}|dk(rSdIdJdKdLd}|dMvrd5}6jr'| jdNdOk7}|dPk(r|s |dQk(sW|rZd5}]1|dRg||ggzp|d k(r{tjdS| }|rD|jdT}|jdU}|dVk7r|dVk(rd5}n|dWk7r||k7r d5}n |dVk7rd5}nd5}6jr1||g|ggz|dk(r| d dXvr6jdYZ6jrtd[}tj|| }|Vi}|jdU|d\<|jdT|d]<|jd^|d_<|| d xsd\}||dPfvsd5}d5}1||g|g| d ggz|dk(s| d d`vr6jdaZ| ds| dr| d!r6jdbZ|j6j| ddg|j6j| ddg| d| ds{| d}|dk(r| d}nR6j7dcddg\}}}tj de}|j#D cgc]} |j%| df| vf}!} |!D"#cgc]$\}"}#|"s t'|"jdU|#f&}!}"}#|!rt)|!D$#cgc]\}$}#|$ c}#}$ndg}%t+dh|!D}&t+di|!D}'|djk(rdU}(ng|dkk(r&|&r!t)|!D$#cgc] \}$}#|#r |$ c}#}$ndU}(n<|dlk(r)|&r$t)|!D$#cgc] \}$}#|#r |$ c}#}$dUzndU}(n|dmk(r |'r|%n|%dUz}(| d(z}||%kDrd}|j|dudn|zg|j|g|j| d do| d zg|j| ddp| dzg|j| ddq| dzg|j| d!dr| d!zg|j6j| d#d#gdsD] \} })| | }|j||)|zg"| \}*}+}|*dgk(r|+dtk\s|*dgkDr|j| d4du| d4zg1|},6jst-|dv|,}-|-dgkDr|-t-|,j#d5k(r|dw|,},|| d$s || d*r||||,k7s6d5}:|| d$s || d*r||||,k7scd5}g||,k7snd5}r6jr6j/|0xS17gdcgdygg}.|s|}/| |.k7xs||/k7}6j/|0|.j1zScc} wcc} wcc}#}"wcc}#}$wcc}#}$wcc}#}$w)}N)statedefaultruleloggingrstr)enableddisabledreloadedreset)typechoicesrpolicy)allowdenyreject)raliasesrr)fullhighlowmediumoffon direction)inincomingoutoutgoingrouteddeleteboolF)rrrouteinsertint)rinsert_relative_to)zero first-ipv4 last-ipv4 first-ipv6 last-ipv6r6)rrr)r r!limitr" interfaceif)rr# interface_inif_in interface_outif_outlogfrom_ipanyfromsrc)rrr# from_portto_ipdesttoto_portportprotoprotocol) ahrDespipv6tcpudpgreigmpvrrpnameappcommentT)rWrMr)r*)r<) argument_specsupports_check_modemutually_exclusiverequired_one_of required_bycdj|jdDcgc]}|j|s|c}Scc}wNT)join splitlines startswithpatterncontentlines rfilter_line_that_not_start_withz-main..filter_line_that_not_start_withos6ww););D)A^T__U\E]^__^ AAcT|jdDcgc] }||vs| c}Scc}w)NT)rcres rfilter_line_that_containsz'main..filter_line_that_containsrs'!(!3!3D!9MW_MMMs %%cdj|jdDcgc]}|j|r|c}Scc}wr`)rbrccontainsres rfilter_line_that_not_containsz+main..filter_line_that_not_containsus6ww););D)A`W^I_`aa`rjczdj|jdDcgc] }|| |c}Scc}wr`)rbrc) match_funcrgrhs rfilter_line_that_match_funcz)main..filter_line_that_match_funcxs5ww););D)AbZPTEUEabccbs 88c*j|SNsearch)rgrr ipv4_regexps rfilter_line_that_contains_ipv4z,main..filter_line_that_contains_ipv4{*;+=+=wGGrc*j|Srtru)rgrr ipv6_regexps rfilter_line_that_contains_ipv6z,main..filter_line_that_contains_ipv6~ryrc*j|duSrtmatch)iprws ris_starting_by_ipv4z!main..is_starting_by_ipv4  $D00rc*j|duSrtr~)rr{s ris_starting_by_ipv6z!main..is_starting_by_ipv6rrc djttdttd|}j |j |ddi\}}}|dk7r|sj |xs||S)N rLANGC)environ_update)msgcommands)rbmaprfilterappend run_command fail_json)cmd ignore_errorrcr-errcmdsmodules rexecutezmain..executeswhhs:b>6*Q-+EFG C++C +NS# 7<   d  ; rczgd}gdgdgg}|j|Dcgc]}|gc}|dScc}w)N)z/lib/ufw/user.rulesz/lib/ufw/user6.rulesz/etc/ufw/user.rulesz/etc/ufw/user6.rulesz/var/lib/ufw/user.rulesz/var/lib/ufw/user6.rulesz-hz '^### tuple'T)r)extend)user_rules_filesrfrgrep_bins rget_current_ruleszmain..get_current_rulessL8zD6N#34 !12AQC23s..3s 8c gdgg}|jdDcgc]}|jdk7s|}}t|dk(rjdd|t j d|d}|jdd|t |jd}t |jd }d}|jd t |jd }|||fScc}w) zU Returns the major and minor version of ufw installed on the system. z --version rarzFailed to get ufw version.)rrr-z!^ufw.+(\d+)\.(\d+)(?:\.(\d+))?.*$)splitstriplenrr rvr4group) r-xlinesmatchesmajorminorrevrrufw_bins r ufw_versionzmain..ufw_versionsy;-01IIdO?qqwwyB?? u:?   !=!  M))@%(K ?   !=!  MGMM!$%GMM!$% ==  'gmmA&'CeS  @s C7C7ufwgrepzstatus verbosez --dry-runenabledisablereloadr)rrz activerrrz-fz#Logging: (on|off)(?: \(([a-z]+)\))?rrr(r))r.r,r/NznFor default, direction must be one of "outgoing", "incoming" and "routed", or direction must not be specified.)rztDefault: (deny|allow|reject) \(incoming\), (deny|allow|reject) \(outgoing\), (deny|allow|reject|disabled) \(routed\)r,r.rr/)r+r-NzWFor rules, direction must be one of "in" and "out", or direction must not be specified.z;Only route rules can combine interface_in and interface_outstatusnumberedz^\[ *([0-9]+)\] z(v6)rc3(K|] \}}|  ywrt.0norQs r zmain..s"D Tt8"Dsc3&K|] \}}| ywrtrrs rrzmain..s"@JR4"@sr7r8r9r:z insert %sz%szon %szin on %sz out on %s))rCzfrom %s)rGport %s)rHzto %s)rKr)rMzproto %s)rWzapp '%s'#z comment '%s'Skippingz ### tuple)changedrverbose)rrrr)F)rdictrrparams get_bin_pathitems check_modefindr rvrrrbooleanrr rcrr4maxrDr exit_jsonrstrip)8 command_keysrirlrorxr|rrrrrkeyr pre_state pre_rulesrcommandvaluerstates ufw_enabledextract current_levelcurrent_on_off_valueregexpcurrent_default_valuesvrelative_to_cmd insert_todummynumbered_statenumbered_line_rerhrmatcherrQr last_numberhas_ipv4has_ipv6 relative_totemplate ufw_major ufw_minor rules_drynb_skipping_line post_state post_rulesrrrrrrwr{rrs8 @@@@@@@@rmainrCsu :L  E+WX ehZA\] e-[\ /^_  VU3  FE2  U#  $,jtz{ 5*NO v6 57)< EH:> &%0 eUVUOL & E564.I! "efX6# $EJ<BCD% &55'2' (e$) ,! ( . ) / *  '% ?"FH D%'K%'K`NbdHH11  /!.]]F,8HSF3KVC[ HHH!!%.G""640H'%5$678I!#IG%NN,B'%y6,,k:; g !)y"*W>F--  'nnY72= Z'KUi=OXc"Gvu 778  !ii F RG ' a 0 '.}}Q'7$E>+u4"&$5M+A"&)U2"G$$y5'223  !k"*RR  &V W  Q))FI6&-/*9@q9I*:69@q9I*:67>}}Q7G*84.vk/B/PjQA 33"&"Gy5'F;4G3HIIJ  k"*==  %~ '?vn'=&BY  &B C JJvg7A B JJvh'78(C Dh+F84D"()=">"f, &x 0I5;5G5GRZ\fHg5h2UNE')zz2E'F$XfXqXqXstPT.44T:FdNKtEtRWc[bc'--"23T:cEcGL#E&Bjr4r&B"CRSK""De"DDH""@%"@@H&,6&' (K7W_c*R*2tT2*R&Sef (L8[cc*R*2tT2*R&SVW&Wij (K75=k;QR? &x 0; >I ;.%)  IT1;3JKL JJw  JJ{+TF;4G-GH I JJ{+Wvk7J-JK L JJ~. VN=S0ST U JJ/vo?V1VW X JJve}5u= >$Q 8hs  E8u#567  8 +6- 'Iy%Q9?y1} F9-~y@Q/QRS I  #&'@Y'W#X (1,1ASI]I]^bIcEd1d ? Y WI*6)+<=ATU[\cUdAe9)DHfgpHqq&*G,VI->?CVW]^eWfCg9)DHfgpHqq&*G"i/"&EB'J$??wi(i[AB *,J J.LI4KG$JDUDUDWXXsIruc&B +S*Rs< _;_;/` `` `  ` (`  ` ` __main__) __future__rrrr __metaclass__ DOCUMENTATIONEXAMPLESr operatorransible.module_utils.basicrrrr__name__rrrrsVA@ T l} ~ 4 &NYb zFr