ryanc/ansible
1
0
Fork 0
Code Issues 4 Pull Requests Releases Wiki Activity

Use FQCN for IP utils

Browse Source
This commit is contained in:
Ryan Cavicchioni 2022-08-30 22:30:13 -05:00
parent cd66cef7ad
commit 08441c5f5c
Signed by: ryanc
GPG Key ID: 877EEDAF9245103D
7 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
roles/firewall/templates/ip6tables.j2
View File

@ -66,7 +66,7 @@
-A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
{% if firewall_ssh_whitelist | length %} {% if firewall_ssh_whitelist | length %}
{% for ip in firewall_ssh_whitelist | ipv6 %} {% for ip in firewall_ssh_whitelist | ansible.utils.ipv6 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %} {% endif %}

4
roles/firewall/templates/ipset.j2
View File

@ -9,8 +9,8 @@ add {{ name }} {{ ip_or_net }}
{% endmacro %} {% endmacro %}
{% macro render_dual_stack_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %} {% macro render_dual_stack_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
{{ render_ipset(ipset | ipv4, name + "4", type=type, family=family, timeout=timeout) }} {{ render_ipset(ipset | ansible.utils.ipv4, name + "4", type=type, family=family, timeout=timeout) }}
{{ render_ipset(ipset | ipv6, name + "6", type=type, family="inet6", timeout=timeout) }} {{ render_ipset(ipset | ansible.utils.ipv6, name + "6", type=type, family="inet6", timeout=timeout) }}
{% endmacro %} {% endmacro %}
{{ render_dual_stack_ipset([], 'block') }} {{ render_dual_stack_ipset([], 'block') }}

2
roles/firewall/templates/ipset.v4.j2
View File

@ -2,7 +2,7 @@
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
flush {{ name }} flush {{ name }}
{% if ipset | length %} {% if ipset | length %}
{% for ip_or_net in ipset | ipv4 %} {% for ip_or_net in ipset | ansible.utils.ipv4 %}
add {{ name }} {{ ip_or_net }} add {{ name }} {{ ip_or_net }}
{% endfor %} {% endfor %}
{% endif %} {% endif %}

2
roles/firewall/templates/ipset.v6.j2
View File

@ -2,7 +2,7 @@
create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
flush {{ name }} flush {{ name }}
{% if ipset | length %} {% if ipset | length %}
{% for ip_or_net in ipset | ipv6 %} {% for ip_or_net in ipset | ansible.utils.ipv6 %}
add {{ name }} {{ ip_or_net }} add {{ name }} {{ ip_or_net }}
{% endfor %} {% endfor %}
{% endif %} {% endif %}

4
roles/firewall/templates/iptables.j2
View File

@ -66,7 +66,7 @@
-A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
{% if firewall_ssh_whitelist | length %} {% if firewall_ssh_whitelist | length %}
{% for ip in firewall_ssh_whitelist | ipv4 %} {% for ip in firewall_ssh_whitelist | ansible.utils.ipv4 %}
-A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %} {% endif %}
@ -94,7 +94,7 @@
-A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
{% if firewall_allowed_icmp_types | length %} {% if firewall_allowed_icmp_types | length %}
{% for type in firewall_allowed_icmp_types | ipv4 %} {% for type in firewall_allowed_icmp_types | ansible.utils.ipv4 %}
-A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
{% endfor %} {% endfor %}
{% endif %} {% endif %}

2
roles/network/templates/netcfg.yaml.j2
View File

@ -31,7 +31,7 @@ network:
{% if ansible_default_ipv4.address is defined or ansible_default_ipv6.address is defined %} {% if ansible_default_ipv4.address is defined or ansible_default_ipv6.address is defined %}
addresses: addresses:
{% if ansible_default_ipv4.address is defined %} {% if ansible_default_ipv4.address is defined %}
- {{ ansible_default_ipv4.address }}/{{ (ansible_default_ipv4.network + "/" + ansible_default_ipv4.netmask) | ipaddr('prefix') }} - {{ ansible_default_ipv4.address }}/{{ (ansible_default_ipv4.network + "/" + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('prefix') }}
{% endif %} {% endif %}
{% if ansible_default_ipv6.address is defined %} {% if ansible_default_ipv6.address is defined %}
- {{ ansible_default_ipv6.address }}/{{ ansible_default_ipv6.prefix }} - {{ ansible_default_ipv6.address }}/{{ ansible_default_ipv6.prefix }}

2
roles/network/templates/systemd-network.j2
View File

@ -25,7 +25,7 @@ Name={{ ansible_default_ipv4.interface }}
{% if ansible_default_ipv4.address is defined or ansible_default_ipv6.address is defined %} {% if ansible_default_ipv4.address is defined or ansible_default_ipv6.address is defined %}
[Network] [Network]
{% if ansible_default_ipv4.address is defined %} {% if ansible_default_ipv4.address is defined %}
Address={{ ansible_default_ipv4.address }}/{{ (ansible_default_ipv4.network + "/" + ansible_default_ipv4.netmask) | ipaddr('prefix') }} Address={{ ansible_default_ipv4.address }}/{{ (ansible_default_ipv4.network + "/" + ansible_default_ipv4.netmask) | ansible.utils.ipaddr('prefix') }}
{% endif %} {% endif %}
{% if ansible_default_ipv6.address is defined %} {% if ansible_default_ipv6.address is defined %}
Address={{ ansible_default_ipv6.address }}/{{ ansible_default_ipv6.prefix }} Address={{ ansible_default_ipv6.address }}/{{ ansible_default_ipv6.prefix }}