使用 ansible 模板化防火墙区域 - xml 或 vars 问题

Question 1

模板期望是，source但您输入了source address。我有点惊讶 Ansible 没有对此发出抱怨，因为这显然是一个错误。

它看起来应该是这样的：

    rule:
      - {family: ipv4, source: {address: 172.18.0.0/16}, action: accept}
      - {family: ipv4, source: {address: 172.17.0.0/16}, action: accept}

Answer

模板期望是，source但您输入了source address。我有点惊讶 Ansible 没有对此发出抱怨，因为这显然是一个错误。

它看起来应该是这样的：

    rule:
      - {family: ipv4, source: {address: 172.18.0.0/16}, action: accept}
      - {family: ipv4, source: {address: 172.17.0.0/16}, action: accept}

Question 2

花了一些时间检查模板文件并进行了一些尝试后，发现模板文件中存在间距/缩进问题，并且我的 vars 文件存在结构问题。

我将用更正后的版本更新我的问题，以便可以看到差异。

修改后的模板文件：

<?xml version="1.0" encoding="utf-8"?>
<zone{% if item.target is defined %} target="{{ item.target }}"{% endif %}>
  <short>{{ item.short|default(item.name)|upper }}</short>
{% if item.description is defined %}
  <description>{{ item.description }}</description>
{% endif %}
{% for tag in item %}
{# Settings which can be used several times #}
{% if tag in ['interface','source','service','port','protocol','icmp-block','forward-port','source-port'] %}
{% for subtag in item[tag] %}
  <{{ tag }}{% for name,value in subtag.items() %} {{ name }}="{{ value }}"{% endfor %}/>
{% endfor %}
{# Settings which can be used once #}
{% elif tag in ['icmp-block-inversion','masquerade'] and item[tag] == True %}
  <{{ tag }}/>
{% endif %}
{% endfor %}
{% for rule in item.rule|default([]) %}
  <rule{% if rule.family is defined %} family="{{ rule.family }}"{% endif %}>
{% for tag in rule %}
{% if tag in ['source','destination','service','port','icmp-block','icmp-type','masquerade','forward-port','protocol'] %}
{% for subtag in rule[tag] %}
  {% for name,value in subtag.items() %}
{% if name in ['action'] %}
  <{{ value }}/>
{% else %}
  <{{ tag }} {{ name }}="{{ value }}"/>
{% endif %}
{% endfor %}
{% endfor %}
{% endif %}
{% endfor %}
  </rule>
{% endfor %}
</zone>

修改后的 vars 结构：

firewalld_zones: 
  - name: public
    short: "Public"
    description: "Public Zone"
    service:
      - { name: ssh }
      - { name: dhcpv6-client }
    port:
      - { protocol: tcp, port: 8000 }
      - { protocol: tcp, port: 8089 }
      - { protocol: udp, port: 52311 }
      - { protocol: udp, port: 514 }
      - { protocol: tcp, port: 8191 }
      - { protocol: tcp, port: 8888 }
    masquerade: true
    forward-port:
      - { to-port: 8000, protocol: tcp, port: 443 }
    rule:
      - family: ipv4
        source:
          - address: "172.18.0.0/16"
          - action: accept
      - family: ipv4
        source:
          - address: "172.17.0.0/16"
          - action: accept

编译文件的输出：

# cat public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>PUBLIC</short>
  <description>Public Zone</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <port protocol="tcp" port="8000"/>
  <port protocol="tcp" port="8089"/>
  <port protocol="udp" port="52311"/>
  <port protocol="udp" port="514"/>
  <port protocol="tcp" port="8191"/>
  <port protocol="tcp" port="8888"/>
  <masquerade/>
  <forward-port to-port="8000" protocol="tcp" port="443"/>
  <rule family="ipv4">
    <source address="172.18.0.0/16"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="172.17.0.0/16"/>
    <accept/>
  </rule>
</zone>

Answer