/usr/share/perl5/Rex/Resource/firewall.pm is in rex 1.4.1-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 | #
# (c) Jan Gehring <jan.gehring@gmail.com>
#
# vim: set ts=2 sw=2 tw=0:
# vim: set expandtab:
=head1 NAME
Rex::Resource::firewall - Firewall functions
=head1 DESCRIPTION
With this module it is easy to manage different firewall systems.
=head1 SYNOPSIS
# Configure a particular rule
task "configure_firewall", "server01", sub {
firewall "some-name",
ensure => "present",
proto => "tcp",
action => "accept",
source => "192.168.178.0/24",
destination => "192.168.1.0/24",
sport => 80,
sapp => 'www', # source application, if provider supports it
port => 80, # same as dport
dport => 80,
app => 'www', # same as dapp, destination application, if provider supports it
dapp => 'www', # destination application, if provider supports it
tcp_flags => ["FIN", "SYN", "RST"],
chain => "INPUT",
table => "nat",
jump => "LOG",
iniface => "eth0",
outiface => "eth1",
reject_with => "icmp-host-prohibited",
log => "new|all", # if provider supports it
log_level => "", # if provider supports it
log_prefix => "FW:", # if provider supports it
state => "NEW",
ip_version => -4; # for iptables provider. valid options -4 and -6
};
# Add overall logging (if provider supports)
firewall "some-name",
provider => 'ufw',
logging => "medium";
=head1 EXPORTED RESOURCES
=over 4
=cut
package Rex::Resource::firewall;
use strict;
use warnings;
our $VERSION = '1.4.1'; # VERSION
use Data::Dumper;
use Rex -minimal;
use Rex::Commands::Gather;
use Rex::Resource::Common;
use Carp;
my $__provider = { default => "Rex::Resource::firewall::Provider::iptables", };
=item firewall($name, %params)
=cut
resource "firewall", { export => 1 }, sub {
my $rule_name = resource_name;
my $rule_config = {
action => param_lookup("action"),
ensure => param_lookup( "ensure", "present" ),
proto => param_lookup( "proto", undef ),
source => param_lookup( "source", undef ),
destination => param_lookup( "destination", undef ),
port => param_lookup( "port", undef ),
app => param_lookup( "app", undef ),
sport => param_lookup( "sport", undef ),
sapp => param_lookup( "sapp", undef ),
dport => param_lookup( "dport", undef ),
dapp => param_lookup( "dapp", undef ),
tcp_flags => param_lookup( "tcp_falgs", undef ),
chain => param_lookup( "chain", "input" ),
table => param_lookup( "table", "filter" ),
iniface => param_lookup( "iniface", undef ),
outiface => param_lookup( "outiface", undef ),
reject_with => param_lookup( "reject_with", undef ),
logging => param_lookup( "logging", undef ), # overall logging
log => param_lookup( "log", undef ), # logging for rule
log_level => param_lookup( "log_level", undef ), # logging for rule
log_prefix => param_lookup( "log_prefix", undef ),
state => param_lookup( "state", undef ),
ip_version => param_lookup( "ip_version", -4 ),
};
my $provider =
param_lookup( "provider", case ( lc(operating_system), $__provider ) );
if ( $provider !~ m/::/ ) {
$provider = "Rex::Resource::firewall::Provider::$provider";
}
$provider->require;
my $provider_o = $provider->new();
my $changed = 0;
if ( my $logging = $rule_config->{logging} ) {
if ( $provider_o->logging($logging) ) {
emit changed, "Firewall logging updated.";
}
}
elsif ( $rule_config->{ensure} eq "present" ) {
if ( $provider_o->present($rule_config) ) {
emit created, "Firewall rule created.";
}
}
elsif ( $rule_config->{ensure} eq "absent" ) {
if ( $provider_o->absent($rule_config) ) {
emit removed, "Firewall rule removed.";
}
}
elsif ( $rule_config->{ensure} eq "disabled" ) {
if ( $provider_o->disable($rule_config) ) {
emit changed, "Firewall disabled.";
}
}
elsif ( $rule_config->{ensure} eq "enabled" ) {
if ( $provider_o->enable($rule_config) ) {
emit changed, "Firewall enabled.";
}
}
else {
die "Error: $rule_config->{ensure} not a valid option for 'ensure'.";
}
};
=back
=cut
1;
|