openstack/ansible-collections-openstack
Code Issues Proposed changes

Refactored security_group_rule{,_info} modules

Browse Source 
Change-Id: Ie953bee843a43b945d24d6152766b3ae418f797c
This commit is contained in:
Jakob Meng 2023-01-05 12:41:52 +01:00
parent 4cf6842222
commit 4dc6c421db
3 changed files with 450 additions and 470 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

335
ci/roles/security_group_rule/tasks/main.yml
View File

@ -1,18 +1,17 @@
---
- name: Create security group
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: ansible_security_group
state: present
description: Created from Ansible playbook
cloud: "{{ cloud }}"
name: ansible_security_group
state: present
- name: Create empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert return values of security_group_rule module
@ -23,11 +22,11 @@
- name: Assert changed
assert:
that: security_group_rule is changed
that: security_group_rule is changed
- name: Fetch all security group rule
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
cloud: "{{ cloud }}"
register: security_group_rules
- name: Assert return values of security_group_rule_info module
@ -39,8 +38,8 @@
- name: Fetch security group rule based on rule
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
id: "{{ security_group_rule.rule.id }}"
cloud: "{{ cloud }}"
id: "{{ security_group_rule.rule.id }}"
register: security_group_rules
- name: Assert return fields security_group_rule_info
@ -49,157 +48,157 @@
- name: Create empty ICMP rule again
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert not changed
assert:
that: security_group_rule is not changed
that: security_group_rule is not changed
- name: Create -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert not changed
assert:
that: security_group_rule is not changed
that: security_group_rule is not changed
- name: Create -1 ICMP rule again
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert not changed
assert:
that: security_group_rule is not changed
that: security_group_rule is not changed
- name: Create empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert changed
assert:
that: security_group_rule is changed
that: security_group_rule is changed
- name: Create TCP rule again with port range (1, 65535)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 1
port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 1
port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert changed
assert:
that: security_group_rule is not changed
that: security_group_rule is not changed
- name: Create TCP rule again with port range (-1, -1)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert changed
assert:
that: security_group_rule is not changed
that: security_group_rule is not changed
- name: Create TCP rule again with defined range
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 8000
port_range_max: 9000
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 8000
port_range_max: 9000
remote_ip_prefix: 0.0.0.0/0
register: security_group_rule
- name: Assert changed
assert:
that: security_group_rule is changed
that: security_group_rule is changed
- name: Create empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: udp
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: udp
remote_ip_prefix: 0.0.0.0/0
- name: Create UDP rule again with port range (1, 65535)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: udp
port_range_min: 1
port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: udp
port_range_min: 1
port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0
- name: Create UDP rule again with port range (-1, -1)
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: udp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: udp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
- name: Create HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
- name: Create egress rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 30000
port_range_max: 30001
remote_ip_prefix: 0.0.0.0/0
direction: egress
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: present
protocol: tcp
port_range_min: 30000
port_range_max: 30001
remote_ip_prefix: 0.0.0.0/0
direction: egress
- name: List all available rules of all security groups in a project
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
cloud: "{{ cloud }}"
register: security_group_rules
- name: Check - List all available rules of all security groups in a project
@ -209,8 +208,8 @@
- name: List all available rules of a specific security group
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
security_group: ansible_security_group
cloud: "{{ cloud }}"
security_group: ansible_security_group
register: security_group_rules
- name: Check - List all available rules of a specific security group
@ -220,70 +219,80 @@
- name: List all available rules with filters
openstack.cloud.security_group_rule_info:
cloud: "{{ cloud }}"
security_group: ansible_security_group
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
- name: Delete -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: udp
remote_ip_prefix: 0.0.0.0/0
- name: Delete HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
cloud: "{{ cloud }}"
security_group: ansible_security_group
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
- name: Delete egress rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 30000
port_range_max: 30001
remote_ip_prefix: 0.0.0.0/0
direction: egress
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 30000
port_range_max: 30001
remote_ip_prefix: 0.0.0.0/0
direction: egress
- name: Delete HTTP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 80
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty UDP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: udp
remote_ip_prefix: 0.0.0.0/0
- name: Delete TCP rule again with defined range
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
port_range_min: 8000
port_range_max: 9000
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty TCP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
- name: Delete -1 ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
port_range_min: -1
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
- name: Delete empty ICMP rule
openstack.cloud.security_group_rule:
cloud: "{{ cloud }}"
security_group: ansible_security_group
state: absent
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
- name: Delete security group
openstack.cloud.security_group:
cloud: "{{ cloud }}"
name: ansible_security_group
state: absent
cloud: "{{ cloud }}"
name: ansible_security_group
state: absent

525
plugins/modules/security_group_rule.py
View File

@ -5,82 +5,101 @@
# Copyright (c) 2013, Benno Joy <benno@ansible.com>
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
DOCUMENTATION = '''
DOCUMENTATION = r'''
---
module: security_group_rule
short_description: Add/Delete rule from an existing security group
short_description: Manage security group rules in OpenStack network (Neutron)
author: OpenStack Ansible SIG
description:
- Add or Remove rule from an existing security group
- Add or remove security group rule to/from OpenStack network (Neutron)
service.
options:
security_group:
description:
- Name or ID of the security group
required: true
type: str
protocol:
description:
- IP protocols ANY TCP UDP ICMP and others, also number in range 0-255
type: str
port_range_min:
description:
- Starting port
type: int
port_range_max:
description:
- Ending port
type: int
remote_ip_prefix:
description:
- Source IP address(es) in CIDR notation (exclusive with remote_group)
type: str
remote_group:
description:
- Name or ID of the Security group to link (exclusive with
remote_ip_prefix)
type: str
ether_type:
description:
- Must be IPv4 or IPv6, and addresses represented in CIDR must
match the ingress or egress rules. Not all providers support IPv6.
choices: ['IPv4', 'IPv6']
default: IPv4
type: str
aliases: [ethertype]
direction:
description:
- The direction in which the security group rule is applied. Not
all providers support egress.
choices: ['egress', 'ingress']
default: ingress
type: str
state:
description:
- Should the resource be present or absent.
choices: [present, absent]
default: present
type: str
project:
description:
- Unique name or ID of the project.
required: false
type: str
description:
required: false
description:
- Description of the rule.
type: str
description:
description:
- Description of the security group rule.
type: str
direction:
description:
- The direction in which the security group rule is applied.
- Not all providers support C(egress).
choices: ['egress', 'ingress']
default: ingress
type: str
ether_type:
description:
- Must be IPv4 or IPv6, and addresses represented in CIDR must
match the ingress or egress rules. Not all providers support IPv6.
choices: ['IPv4', 'IPv6']
default: IPv4
type: str
aliases: ['ethertype']
port_range_max:
description:
- The maximum port number in the range that is matched by the security
group rule.
- If the protocol is TCP, UDP, DCCP, SCTP or UDP-Lite this value must be
greater than or equal to the I(port_range_min) attribute value.
- If the protocol is ICMP, this value must be an ICMP code.
type: int
port_range_min:
description:
- The minimum port number in the range that is matched by the security
group rule.
- If the protocol is TCP, UDP, DCCP, SCTP or UDP-Lite this value must be
less than or equal to the port_range_max attribute value.
- If the protocol is ICMP, this value must be an ICMP type.
type: int
project:
description:
- Unique name or ID of the project.
type: str
protocol:
description:
- The IP protocol can be represented by a string, an integer, or null.
- Valid string or integer values are C(any) or C(0), C(ah) or C(51),
C(dccp) or C(33), C(egp) or C(8), C(esp) or C(50), C(gre) or C(47),
C(icmp) or C(1), C(icmpv6) or C(58), C(igmp) or C(2), C(ipip) or C(4),
C(ipv6-encap) or C(41), C(ipv6-frag) or C(44), C(ipv6-icmp) or C(58),
C(ipv6-nonxt) or C(59), C(ipv6-opts) or C(60), C(ipv6-route) or C(43),
C(ospf) or C(89), C(pgm) or C(113), C(rsvp) or C(46), C(sctp) or
C(132), C(tcp) or C(6), C(udp) or C(17), C(udplite) or C(136), C(vrrp)
or C(112).
- Additionally, any integer value between C([0-255]) is also valid.
- The string any (or integer 0) means all IP protocols.
- See the constants in neutron_lib.constants for the most up-to-date
list of supported strings.
type: str
remote_group:
description:
- Name or ID of the security group to link.
- Mutually exclusive with I(remote_ip_prefix).
type: str
remote_ip_prefix:
description:
- Source IP address(es) in CIDR notation.
- Mutually exclusive with I(remote_group).
type: str
security_group:
description:
- Name or ID of the security group.
required: true
type: str
state:
description:
- Should the resource be present or absent.
choices: [present, absent]
default: present
type: str
requirements:
- "python >= 3.6"
- "openstacksdk"
- "python >= 3.6"
- "openstacksdk"
extends_documentation_fragment:
- openstack.cloud.openstack
- openstack.cloud.openstack
'''
EXAMPLES = '''
# Create a security group rule
- openstack.cloud.security_group_rule:
EXAMPLES = r'''
- name: Create a security group rule
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: tcp
@ -88,15 +107,15 @@ EXAMPLES = '''
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
# Create a security group rule for ping
- openstack.cloud.security_group_rule:
- name: Create a security group rule for ping
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
# Another way to create the ping rule
- openstack.cloud.security_group_rule:
- name: Another way to create the ping rule
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: icmp
@ -104,8 +123,8 @@ EXAMPLES = '''
port_range_max: -1
remote_ip_prefix: 0.0.0.0/0
# Create a TCP rule covering all ports
- openstack.cloud.security_group_rule:
- name: Create a TCP rule covering all ports
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: tcp
@ -113,326 +132,278 @@ EXAMPLES = '''
port_range_max: 65535
remote_ip_prefix: 0.0.0.0/0
# Another way to create the TCP rule above (defaults to all ports)
- openstack.cloud.security_group_rule:
- name: Another way to create the TCP rule above (defaults to all ports)
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: tcp
remote_ip_prefix: 0.0.0.0/0
# Create a rule for VRRP with numbered protocol 112
- openstack.cloud.security_group_rule:
- name: Create a rule for VRRP with numbered protocol 112
openstack.cloud.security_group_rule:
security_group: loadbalancer_sg
protocol: 112
remote_group: loadbalancer-node_sg
# Create a security group rule for a given project
- openstack.cloud.security_group_rule:
- name: Create a security group rule for a given project
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: icmp
remote_ip_prefix: 0.0.0.0/0
project: myproj
# Remove the default created egress rule for IPv4
- openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: any
remote_ip_prefix: 0.0.0.0/0
- name: Remove the default created egress rule for IPv4
openstack.cloud.security_group_rule:
cloud: mordred
security_group: foo
protocol: any
remote_ip_prefix: 0.0.0.0/0
'''
RETURN = '''
RETURN = r'''
rule:
description: Representation of the security group rule
description: Dictionary describing the security group rule
type: dict
returned: when I(state) is present
returned: On success when I(state) is C(present).
contains:
created_at:
description: Timestamp when the resource was created
type: str
returned: always
description:
description: Description of the resource
type: str
returned: always
direction:
description: The direction in which the security group rule is applied.
type: str
sample: 'egress'
returned: always
ether_type:
description: Either IPv4 or IPv6
type: str
returned: always
id:
description: Unique rule UUID.
type: str
returned: always
name:
description: Name of the resource.
type: str
returned: always
port_range_max:
description: The maximum port number in the range that is matched by
the security group rule.
type: int
sample: 8000
returned: always
port_range_min:
description: The minimum port number in the range that is matched by
the security group rule.
type: int
sample: 8000
returned: always
project_id:
description: ID of the project the resource belongs to.
type: str
returned: always
protocol:
description: The protocol that is matched by the security group rule.
type: str
sample: 'tcp'
returned: always
remote_address_group_id:
description: The remote address group ID to be associated with this
security group rule.
type: str
sample: '0.0.0.0/0'
returned: always
remote_group_id:
description: The remote security group ID to be associated with this
security group rule.
type: str
sample: '0.0.0.0/0'
returned: always
remote_ip_prefix:
description: The remote IP prefix to be associated with this security
group rule.
type: str
sample: '0.0.0.0/0'
returned: always
revision_number:
description: Revision number
type: int
sample: 0
returned: always
security_group_id:
description: The security group ID to associate with this security group
rule.
type: str
returned: always
tags:
description: Tags associated with resource.
type: list
elements: str
returned: always
tenant_id:
description: ID of the project the resource belongs to. Deprecated.
type: str
returned: always
updated_at:
description: Timestamp when the security group rule was last updated.
type: str
returned: always
'''
from ansible_collections.openstack.cloud.plugins.module_utils.openstack import (
OpenStackModule)
def _ports_match(protocol, module_min, module_max, rule_min, rule_max):
"""
Capture the complex port matching logic.
The port values coming in for the module might be -1 (for ICMP),
which will work only for Nova, but this is handled by sdk. Likewise,
they might be None, which works for Neutron, but not Nova. This too is
handled by sdk. Since sdk will consistently return these port
values as None, we need to convert any -1 values input to the module
to None here for comparison.
For TCP and UDP protocols, None values for both min and max are
represented as the range 1-65535 for Nova, but remain None for
Neutron. sdk returns the full range when Nova is the backend (since
that is how Nova stores them), and None values for Neutron. If None
values are input to the module for both values, then we need to adjust
for comparison.
"""
# Check if the user is supplying -1 for ICMP.
if protocol in ['icmp', 'ipv6-icmp']:
if module_min and int(module_min) == -1:
module_min = None
if module_max and int(module_max) == -1:
module_max = None
# Rules with 'any' protocol do not match ports
if protocol == 'any':
return True
# Check if the user is supplying -1, 1 to 65535 or None values for full TPC/UDP port range.
if protocol in ['tcp', 'udp'] or protocol is None:
if (
not module_min and not module_max
or (int(module_min) in [-1, 1]
and int(module_max) in [-1, 65535])
):
if (
not rule_min and not rule_max
or (int(rule_min) in [-1, 1]
and int(rule_max) in [-1, 65535])
):
# (None, None) == (1, 65535) == (-1, -1)
return True
# Sanity check to make sure we don't have type comparison issues.
if module_min:
module_min = int(module_min)
if module_max:
module_max = int(module_max)
if rule_min:
rule_min = int(rule_min)
if rule_max:
rule_max = int(rule_max)
return module_min == rule_min and module_max == rule_max
class SecurityGroupRuleModule(OpenStackModule):
argument_spec = dict(
security_group=dict(required=True),
protocol=dict(),
port_range_min=dict(type='int'),
port_range_max=dict(type='int'),
remote_ip_prefix=dict(),
remote_group=dict(),
ether_type=dict(default='IPv4',
choices=['IPv4', 'IPv6'],
aliases=['ethertype']),
direction=dict(default='ingress',
choices=['egress', 'ingress']),
state=dict(default='present',
choices=['absent', 'present']),
description=dict(),
direction=dict(default='ingress', choices=['egress', 'ingress']),
ether_type=dict(default='IPv4', choices=['IPv4', 'IPv6'],
aliases=['ethertype']),
port_range_max=dict(type='int'),
port_range_min=dict(type='int'),
project=dict(),
protocol=dict(),
remote_group=dict(),
remote_ip_prefix=dict(),
security_group=dict(required=True),
state=dict(default='present', choices=['absent', 'present']),
)
module_kwargs = dict(
mutually_exclusive=[
['remote_ip_prefix', 'remote_group'],
]
],
supports_check_mode=True,
)
def _build_kwargs(self, secgroup, remote_group, project):
kwargs = dict(
security_group_id=secgroup.id,
description=self.params['description'],
port_range_max=self.params['port_range_max'],
port_range_min=self.params['port_range_min'],
protocol=self.params['protocol'],
remote_ip_prefix=self.params['remote_ip_prefix'],
direction=self.params['direction'],
ether_type=self.params['ether_type'],
)
if self.params['port_range_min'] != -1:
kwargs['port_range_min'] = self.params['port_range_min']
if self.params['port_range_max'] != -1:
kwargs['port_range_max'] = self.params['port_range_max']
if project:
kwargs['project_id'] = project.id
if remote_group:
kwargs['remote_group_id'] = remote_group.id
return {k: v for k, v in kwargs.items() if v is not None}
def _find_matching_rule(self, kwargs, secgroup):
"""
Find a rule in the group that matches the module parameters.
:returns: The matching rule dict, or None if no matches.
"""
fields = ('protocol', 'remote_ip_prefix', 'direction',
'remote_group_id')
for rule in secgroup['security_group_rules']:
if ('ether_type' in kwargs
and rule['ethertype'] != kwargs['ether_type']):
continue
if any(field in kwargs and rule[field] != kwargs[field]
for field in fields):
continue
if _ports_match(
self.params['protocol'],
self.params['port_range_min'],
self.params['port_range_max'],
rule['port_range_min'],
rule['port_range_max']
):
return rule
return None
def _system_state_change(self, secgroup, rule):
state = self.params['state']
if not secgroup:
return False
if state == 'present' and not rule:
return True
if state == 'absent' and rule:
return True
return False
def run(self):
state = self.params['state']
security_group = self.params['security_group']
remote_group_name_or_id = self.params['remote_group']
project_name_or_id = self.params['project']
project = None
if project_name_or_id:
project = self.conn.identity.find_project(project_name_or_id,
ignore_missing=False)
filters = {}
if project and not remote_group_name_or_id:
filters = {'project_id': project.id}
secgroup = self.conn.network.find_security_group(
security_group, ignore_missing=(state == 'absent'), **filters)
remote_group = None
if remote_group_name_or_id:
remote_group = self.conn.network.find_security_group(
remote_group_name_or_id, ignore_missing=False, filters=filters)
kwargs = self._build_kwargs(secgroup, remote_group, project)
rule = None
if secgroup:
# TODO: Replace with self.conn.network.find_security_group_rule()?
rule = self._find_matching_rule(kwargs, secgroup)
if rule:
rule = self.conn.network.get_security_group_rule(rule['id'])
security_group_rule = self._find()
if self.ansible.check_mode:
self.exit_json(changed=self._system_state_change(secgroup, rule))
self.exit_json(
changed=self._will_change(state, security_group_rule))
changed = False
if state == 'present':
if self.params['protocol'] == 'any':
self.params['protocol'] = None
if state == 'present' and not security_group_rule:
# Create security_group_rule
security_group_rule = self._create()
self.exit_json(changed=True,
rule=security_group_rule.to_dict(computed=False))
if not rule:
rule = self.conn.network.create_security_group_rule(**kwargs)
changed = True
elif state == 'present' and security_group_rule:
# Only exact matches will cause security_group_rule to be not None
self.exit_json(changed=False,
rule=security_group_rule.to_dict(computed=False))
elif state == 'absent' and security_group_rule:
# Delete security_group_rule
self._delete(security_group_rule)
self.exit_json(changed=True)
rule = rule.to_dict(computed=False)
self.exit_json(changed=changed, rule=rule)
elif state == 'absent' and not security_group_rule:
# Do nothing
self.exit_json(changed=False)
if state == 'absent' and rule:
self.conn.network.delete_security_group_rule(rule['id'])
changed = True
def _create(self):
prototype = self._define_prototype()
return self.conn.network.create_security_group_rule(**prototype)
self.exit_json(changed=changed)
def _define_prototype(self):
filters = {}
prototype = dict((k, self.params[k])
for k in ['direction', 'protocol', 'remote_ip_prefix']
if self.params[k] is not None)
project_name_or_id = self.params['project']
if project_name_or_id is not None:
project = self.conn.identity.find_project(project_name_or_id,
ignore_missing=False)
filters = {'project_id': project.id}
prototype['project_id'] = project.id
security_group_name_or_id = self.params['security_group']
security_group = self.conn.network.find_security_group(
security_group_name_or_id, ignore_missing=False, **filters)
prototype['security_group_id'] = security_group.id
remote_group = None
remote_group_name_or_id = self.params['remote_group']
if remote_group_name_or_id is not None:
remote_group = self.conn.network.find_security_group(
remote_group_name_or_id, ignore_missing=False)
prototype['remote_group_id'] = remote_group.id
ether_type = self.params['ether_type']
if ether_type is not None:
prototype['ether_type'] = ether_type
protocol = self.params['protocol']
port_range_max = self.params['port_range_max']
port_range_min = self.params['port_range_min']
if protocol in ['icmp', 'ipv6-icmp']:
# Check if the user is supplying -1 for ICMP.
if port_range_max is not None and int(port_range_max) != -1:
prototype['port_range_max'] = int(port_range_max)
if port_range_min is not None and int(port_range_min) != -1:
prototype['port_range_min'] = int(port_range_min)
elif protocol in ['tcp', 'udp']:
if port_range_max is not None and int(port_range_max) != -1:
prototype['port_range_max'] = int(port_range_max)
if port_range_min is not None and int(port_range_min) != -1:
prototype['port_range_min'] = int(port_range_min)
elif protocol in ['any', '0']:
# Rules with 'any' protocol do not match ports
pass
else:
if port_range_max is not None:
prototype['port_range_max'] = int(port_range_max)
if port_range_min is not None:
prototype['port_range_min'] = int(port_range_min)
return prototype
def _delete(self, security_group_rule):
self.conn.network.delete_security_group_rule(security_group_rule.id)
def _find(self):
# Replacing this code with self.conn.network.find_security_group_rule()
# is not possible because the latter requires an id or name.
matches = self._find_matches()
if len(matches) > 1:
self.fail_json(msg='Found more a single matching security group'
' rule which match the given parameters.')
elif len(matches) == 1:
return self.conn.network.get_security_group_rule(matches[0]['id'])
else: # len(matches) == 0
return None
def _find_matches(self):
prototype = self._define_prototype()
security_group = self.conn.network.\
get_security_group(prototype['security_group_id'])
if 'ether_type' in prototype:
prototype['ethertype'] = prototype.pop('ether_type')
if 'protocol' in prototype and prototype['protocol'] in ['any', '0']:
prototype.pop('protocol')
if 'protocol' in prototype and prototype['protocol'] in ['tcp', 'udp']:
# Check if the user is supplying -1, 1 to 65535 or None values
# for full TPC or UDP port range.
# (None, None) == (1, 65535) == (-1, -1)
if 'port_range_max' in prototype \
and prototype['port_range_max'] in [-1, 65535]:
prototype.pop('port_range_max')
if 'port_range_min' in prototype \
and prototype['port_range_min'] in [-1, 1]:
prototype.pop('port_range_min')
return [r for r in security_group.security_group_rules
if all(r[k] == prototype[k] for k in prototype.keys())]
def _will_change(self, state, security_group_rule):
if state == 'present' and not security_group_rule:
return True
elif state == 'present' and security_group_rule:
# Only exact matches will cause security_group_rule to be not None
return False
elif state == 'absent' and security_group_rule:
return True
else:
# state == 'absent' and not security_group_rule:
return False
def main():

60
plugins/modules/security_group_rule_info.py
View File

@ -4,13 +4,13 @@
# Copyright (c) 2020 by Tino Schreiber (Open Telekom Cloud), operated by T-Systems International GmbH
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
DOCUMENTATION = '''
DOCUMENTATION = r'''
---
module: security_group_rule_info
short_description: Querying security group rules
short_description: Fetch OpenStack network (Neutron) security group rules
author: OpenStack Ansible SIG
description:
- Querying security group rules
- Fetch security group rules from OpenStack network (Neutron) API.
options:
description:
description:
@ -69,23 +69,20 @@ options:
description:
- Name or ID of the security group
type: str
requirements:
- "python >= 3.6"
- "openstacksdk"
extends_documentation_fragment:
- openstack.cloud.openstack
'''
EXAMPLES = '''
# Get all security group rules
- openstack.cloud.security_group_rule_info:
EXAMPLES = r'''
- name: Fetch all security group rules
openstack.cloud.security_group_rule_info:
cloud: devstack
register: sg
# Filter security group rules for port 80 and name
- openstack.cloud.security_group_rule_info:
- name: Filter security group rules for port 80 and name
openstack.cloud.security_group_rule_info:
cloud: devstack
security_group: foo
protocol: tcp
@ -93,13 +90,13 @@ EXAMPLES = '''
port_range_max: 80
remote_ip_prefix: 0.0.0.0/0
# Filter for ICMP rules
- openstack.cloud.security_group_rule_info:
- name: Filter for ICMP rules
openstack.cloud.security_group_rule_info:
cloud: devstack
protocol: icmp
'''
RETURN = '''
RETURN = r'''
security_group_rules:
description: List of dictionaries describing security group rules.
type: list
@ -213,29 +210,32 @@ class SecurityGroupRuleInfoModule(OpenStackModule):
def run(self):
filters = dict((k, self.params[k])
for k in ['description', 'direction', 'ether_type',
'port_range_min', 'port_range_max',
'id', 'port_range_min', 'port_range_max',
'protocol', 'remote_group',
'revision_number', 'remote_ip_prefix']
if self.params[k] is not None)
if self.params['id']:
filters['id'] = self.params['id']
if self.params['project']:
proj = self.conn.find_project(self.params['project'],
ignore_missing=False)
filters['project_id'] = proj.id
if self.params['security_group']:
sec_grp = self.conn.network.find_security_group(
name_or_id=self.params['security_group'],
ignore_missing=False)
filters['security_group_id'] = sec_grp.id
project_name_or_id = self.params['project']
if project_name_or_id is not None:
project = self.conn.find_project(project_name_or_id)
if not project:
self.exit_json(changed=False, security_group_rules=[])
filters['project_id'] = project.id
security_group_rules = [
rule.to_dict(computed=False)
for rule in self.conn.network.security_group_rules(**filters)]
security_group_name_or_id = self.params['security_group']
if security_group_name_or_id is not None:
security_group = self.conn.network.\
find_security_group(security_group_name_or_id)
if not security_group:
self.exit_json(changed=False, security_group_rules=[])
filters['security_group_id'] = security_group.id
security_group_rules = \
self.conn.network.security_group_rules(**filters)
self.exit_json(changed=False,
security_group_rules=security_group_rules)
security_group_rules=[r.to_dict(computed=False)
for r in security_group_rules])
def main():