Merge branch 'bhupender-singh' into 'master'

oo4abhishek · oo4abhishek · commit d66bd7e1dd86 · 2020-08-08T13:56:11.000Z
added restricted entries in tasks/firewall.yaml tasks, added variables...

See merge request oosm/osm_openvpn!20
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -1,22 +1,22 @@
 ---
+version: 2.1
+jobs:
+  yaml_lint:
+    docker:
+      - image: opstree/docker:ansible-lint
+    steps:
+      - checkout
+      - run: yamllint ./*/*.yml
+  ansible_lint:
+    docker:
+      - image: opstree/docker:ansible-lint
+    steps:
+      - checkout
+      - run: ansible-lint .
+workflows:
   version: 2.1
-  jobs:
-    yaml_lint:
-      docker:
-        - image: opstree/docker:ansible-lint
-      steps:
-        - checkout
-        - run: yamllint ./*/*.yml
-    ansible_lint:
-      docker:
-        - image: opstree/docker:ansible-lint
-      steps:
-        - checkout
-        - run: ansible-lint .
-  workflows:
-    version: 2.1
-    lint_tests:
-      jobs:
-        - yaml_lint
-        - ansible_lint
+  lint_tests:
+    jobs:
+      - yaml_lint
+      - ansible_lint
 ...
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -9,7 +9,7 @@ yaml_lint:
   stage: yaml-lint
   image: opstree/docker:ansible-lint
   script:
-   - yamllint ./*/*.yml
+    - yamllint ./*/*.yml
   allow_failure: true
 
 ansible_lint:
diff --git a/.yamllint b/.yamllint
@@ -1,3 +1,4 @@
+---
 extends: default
 
 rules:
diff --git a/Jenkinsfile.publisher b/Jenkinsfile.publisher
@@ -1,4 +1,4 @@
-@Library('opstree-library@github-promoter-v1.0')_
+@Library('opstree-library@feature')_
 
 node{
     githubpromoterworkflow.call(
diff --git a/README.md b/README.md
@@ -113,6 +113,9 @@ Role Variables
 | openvpn_server_network | 10.8.0.0 | CIDR range given to vpn network | Optional |
 | base_directory | /etc/openvpn | Configuration path of openvpn server | Optional |
 | easy_rsa_url | url | URL to download Easy RSA | Optional |
+| block_all_connection | false | Block all communication for openvpn client | Optional |
+| port_list | [80,443] | Allow specific ports for openvpn client & only applicable if block_all_connection == true | Optional |
+
 
 Example Playbook
 ----------------
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -16,4 +16,6 @@ apache_dir_ubuntu: "/etc/apache2/conf-available/openvpn-monitor.conf"
 apache_dir_centos: "/etc/httpd/conf.d/openvpn-monitor.conf"
 client_list: clientlist
 revoke_list: revokelist
+block_all_connection: false
+port_list: [80, 443]
 ...
diff --git a/meta/main.yaml b/meta/main.yaml
@@ -14,9 +14,9 @@ galaxy_info:
         - xenial
         - bionic
   galaxy_tags:
-        - vpn
-        - tunnel
-        - system
-        - networking
+    - vpn
+    - tunnel
+    - system
+    - networking
   dependencies: []
 ...
diff --git a/tasks/client_keys.yaml b/tasks/client_keys.yaml
@@ -21,21 +21,21 @@
     dest: /{{ base_directory }}
     owner: nobody
     group: nogroup
-    remote_src: yes
+    remote_src: true
 
 - name: Copying client keys to openvpn directory
   copy:
     src: "/{{ base_directory }}/easy-rsa/pki/private/{{ item }}.key"
     dest: /{{ base_directory }}
-    remote_src: yes
+    remote_src: true
   with_items: "{{ lookup('file', '{{ client_list }}').splitlines() | trim }}"
   ignore_errors: true
 
 - name: Copying client certificate to openvpn directory
   copy:
     src: "/{{ base_directory }}/easy-rsa/pki/issued/{{ item }}.crt"
     dest: /{{ base_directory }}
-    remote_src: yes
+    remote_src: true
   with_items: "{{ lookup('file', '{{ client_list }}').splitlines() }}"
   ignore_errors: true
 
@@ -58,7 +58,7 @@
   fetch:
     src: "/{{ base_directory }}/{{ item }}.ovpn"
     dest: /tmp/
-    flat: yes
+    flat: true
   with_items: "{{ lookup('file', '{{ client_list }}').splitlines() }}"
   ignore_errors: true
 ...
diff --git a/tasks/config.yaml b/tasks/config.yaml
@@ -18,8 +18,8 @@
     line: "{{ item.line }}"
     state: present
   with_items:
-  - { regexp: 'port 1194', line: 'port {{ PORT }}' }
-  - { regexp: 'proto udp', line: 'proto {{ PROTOCOL }}' }
+    - { regexp: 'port 1194', line: 'port {{ PORT }}' }
+    - { regexp: 'proto udp', line: 'proto {{ PROTOCOL }}' }
 
 - name: Getting public IP for client.conf
   ipify_facts:
@@ -31,8 +31,8 @@
     line: "{{ item.line }}"
     state: present
   with_items:
-  - { regexp: 'proto udp', line: 'proto {{ PROTOCOL }}' }
-  - { regexp: 'remote my-server-1 1194', line: 'remote {{ ipify_public_ip }} {{ PORT }}' }
+    - { regexp: 'proto udp', line: 'proto {{ PROTOCOL }}' }
+    - { regexp: 'remote my-server-1 1194', line: 'remote {{ ipify_public_ip }} {{ PORT }}' }
   notify:
     - daemon_reload
     - starting_openvpn
diff --git a/tasks/easy-rsa.yaml b/tasks/easy-rsa.yaml
@@ -3,7 +3,7 @@
   get_url:
     url: "{{ easy_rsa_url }}"
     dest: /tmp/
-    validate_certs: False
+    validate_certs: false
 
 - name: Unarchiving easy-rsa
   unarchive:
diff --git a/tasks/firewall.yaml b/tasks/firewall.yaml
@@ -9,9 +9,9 @@
   sysctl:
     name: net.ipv4.ip_forward
     value: 1
-    sysctl_set: yes
+    sysctl_set: true
     state: present
-    reload: yes
+    reload: true
 
 - name: Disabling Selinux for Redhat & Centos
   selinux:
@@ -28,11 +28,37 @@
     jump: MASQUERADE
     comment: "Perform NAT readdressing"
 
+- name: iptables - Apply the iptable rule to Allow specific ports for openvpn client
+  iptables:
+    action: insert
+    chain: FORWARD
+    protocol: tcp
+    source: "{{ openvpn_server_network }}/24"
+    jump: ACCEPT
+    destination_port: "{{ item }}"
+    in_interface: tun0
+    comment: "Perform Ports Allow for openvpn client"
+  when: block_all_connection
+  with_items:
+    - "{{ port_list }}"
+
+- name: iptables - Block all communication
+  iptables:
+    action: append
+    protocol: tcp
+    chain: FORWARD
+    source: "{{ openvpn_server_network }}/24"
+    jump: DROP
+    in_interface: tun0
+    comment: "Perform all communication blocking for openvpn client"
+  when: block_all_connection
+
+
 - name: save iptables
   command: netfilter-persistent save
   when: ansible_distribution == "Ubuntu" or ansible_distribution=="Debian"
 
 - name: reload iptables
   command: netfilter-persistent reload
   when: ansible_distribution == "Ubuntu" or ansible_distribution=="Debian"
-...
+...
diff --git a/tasks/install.yaml b/tasks/install.yaml
@@ -2,7 +2,7 @@
 - name: Installing openvpn package and updating cache for ubuntu & Debian
   apt:
     pkg: openvpn
-    update_cache: yes
+    update_cache: true
     cache_valid_time: 3600
   when: ansible_distribution == "Ubuntu" or ansible_distribution=="Debian"
 
@@ -28,7 +28,7 @@
   group:
     name: nogroup
     state: present
-    system: yes
+    system: true
   when: ansible_distribution == "CentOS" or ansible_distribution=="RedHat" or ansible_distribution == "Amazon"
 
 - name: Changing the ownership of openvpn client for Redhat & Centos
diff --git a/tasks/main.yaml b/tasks/main.yaml
@@ -20,12 +20,12 @@
 - name: Including client_keys.yaml for OpenVPN setup
   include: client_keys.yaml
   tags:
-  - generate_client_keys
+    - generate_client_keys
 
 - name: Including revoke.yaml for OpenVpn setup
   include: revoke.yaml
   tags:
-  - revoke_client_keys
+    - revoke_client_keys
 
 - name: Including firewall.yaml for OpenVPN setup
   include: firewall.yaml
diff --git a/tasks/revoke.yaml b/tasks/revoke.yaml
@@ -28,7 +28,7 @@
   copy:
     src: /{{ base_directory }}/easy-rsa/pki/crl.pem
     dest: /{{ base_directory }}/crl.pem
-    remote_src: yes
+    remote_src: true
 
 - name: Removing client certificate request
   file:
diff --git a/tasks/server_keys.yaml b/tasks/server_keys.yaml
@@ -53,10 +53,10 @@
   copy:
     src: "{{ item }}"
     dest: /{{ base_directory }}
-    remote_src: yes
+    remote_src: true
   with_items:
-  - /{{ base_directory }}/easy-rsa/pki/ca.crt
-  - /{{ base_directory }}/easy-rsa/pki/issued/{{ server_name }}.crt
-  - /{{ base_directory }}/easy-rsa/pki/private/{{ server_name }}.key
-  - /{{ base_directory }}/easy-rsa/pki/dh.pem
+    - /{{ base_directory }}/easy-rsa/pki/ca.crt
+    - /{{ base_directory }}/easy-rsa/pki/issued/{{ server_name }}.crt
+    - /{{ base_directory }}/easy-rsa/pki/private/{{ server_name }}.key
+    - /{{ base_directory }}/easy-rsa/pki/dh.pem
 ...

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+---`
`1`	`2`	`extends: default`
`2`	`3`
`3`	`4`	`rules:`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-@Library('opstree-library@github-promoter-v1.0')_`
	`1`	`+@Library('opstree-library@feature')_`
`2`	`2`
`3`	`3`	`node{`
`4`	`4`	`githubpromoterworkflow.call(`