---

# ---
# Install/Uodate git firewall repository
# ---

- name: Install/update firewall repository
  git:
    repo: '{{ git_firewall_repository.repo }}'
    dest: '{{ git_firewall_repository.dest }}'
  when: git_firewall_repository is defined and git_firewall_repository|length > 0


# ---
# Some Checks
# ---

- name: Check if file '/etc/ipt-firewall/main_ipv4.conf' exists
  stat:
    path: /etc/ipt-firewall/main_ipv4.conf
  register: main_ipv4_exists

- name: Check if file '/etc/ipt-firewall/main_ipv6.conf' exists
  stat:
    path: /etc/ipt-firewall/main_ipv6.conf
  register: main_ipv6_exists

- name: Check if file '/etc/ipt-firewall/interfaces_ipv4.conf' exists
  stat:
    path: /etc/ipt-firewall/interfaces_ipv4.conf
  register: interfaces_ipv4_exists

- name: Check if file '/etc/ipt-firewall/interfaces_ipv6.conf' exists
  stat:
    path: /etc/ipt-firewall/interfaces_ipv6.conf
  register: interfaces_ipv6_exists


# ---
# Adjust some lines
# ---

- name: addjust line 'zoom_udp_ports' (IPv4)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv4.conf
    regexp: '^zoom_udp_ports='
    line: 'zoom_udp_ports="$standard_zoom_udp_ports"'
  when: 
    - main_ipv4_exists.stat.exists
  notify:
    - Restart IPv4 Firewall

- name: addjust line 'zoom_udp_ports' (IPv6)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv6.conf
    regexp: '^zoom_udp_ports='
    line: 'zoom_udp_ports="$standard_zoom_udp_ports"'
  when: 
    - main_ipv6_exists.stat.exists
  notify:
    - Restart IPv6 Firewall

- name: addjust line 'jitsi_udp_ports' (IPv4)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv4.conf
    regexp: '^jitsi_udp_ports='
    line: 'jitsi_udp_ports="$standard_jitsi_udp_ports"'
  when: 
    - main_ipv4_exists.stat.exists
  notify:
    - Restart IPv4 Firewall

- name: addjust line 'jitsi_udp_ports' (IPv6)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv6.conf
    regexp: '^jitsi_udp_ports='
    line: 'jitsi_udp_ports="$standard_jitsi_udp_ports"'
  when: 
    - main_ipv6_exists.stat.exists
  notify:
    - Restart IPv6 Firewall

- name: addjust line 'bigbluebutton_udp_ports' (IPv4)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv4.conf
    regexp: '^bigbluebutton_udp_ports='
    line: 'bigbluebutton_udp_ports="$standard_bigbluebutton_udp_ports"'
  when: 
    - main_ipv4_exists.stat.exists
  notify:
    - Restart IPv4 Firewall

- name: addjust line 'bigbluebutton_udp_ports' (IPv6)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv6.conf
    regexp: '^bigbluebutton_udp_ports='
    line: 'bigbluebutton_udp_ports="$standard_bigbluebutton_udp_ports"'
  when: 
    - main_ipv6_exists.stat.exists
  notify:
    - Restart IPv6 Firewall

- name: addjust line 'adjust_kernel_parameters' (IPv6)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv6.conf
    regexp: '^adjust_kernel_parameters='
    line: '#adjust6_kernel_parameters=true'
  when:
      - main_ipv6_exists.stat.exists
  notify:
    - Restart IPv6 Firewall

- name: addjust line 'protect_against_several_attack' (IPv6)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv6.conf
    regexp: '^protect_against_several_attacks='
    line: '#protect6_against_several_attacks=true'
  when: 
      - main_ipv6_exists.stat.exists
  notify:
    - Restart IPv6 Firewall


- name: addjust line 'blocked_ips' (IPv4)
  lineinfile:
    path: /etc/ipt-firewall/main_ipv4.conf
    regexp: '^blocked_ips='
    line: 'blocked_ips=""'
  when: 
    - main_ipv4_exists.stat.exists
  notify:
    - Restart IPv4 Firewall


# ---
# Restrict VPN Networks
# ---

- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv4) is present
  shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv4.conf
  register: restrict_vpn_net_to_local_service_ipv4_present
  when: main_ipv4_exists.stat.exists
  failed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 1"
  changed_when: "restrict_vpn_net_to_local_service_ipv4_present.rc > 0"

- name: Adjust file '/etc/ipt-firewall/main_ipv4.conf' (restrict_vpn_net_to_local_service)
  blockinfile:
    path: /etc/ipt-firewall/main_ipv4.conf
    insertafter: '^#?\s*vpn_out_ports='
    block: |

      # -----
      # - Restrict VPN Network to local Service
      # -----#

      # - restrict_vpn_net_to_local_service
      # -
      # -    allow_ext_net_to_local_service="vpn-net:local-address:port:protocol [vpn-net:local-address:port:protocol] [..]"
      # -
      # - Note:
      # - =====
      # -    - Only 'tcp' and 'udp' are allowed valuse for protocol.
      # -
      # - Example:
      # -   restrict_vpn_net_to_local_service="
      # -      10.100.112.0/24:192.168.112.192/27:80:tcp
      # -      10.100.112.0/24:192.168.112.192/27:443:tcp
      # -    "
      # -
      # - Blank separated list
      # -
      restrict_vpn_net_to_local_service=""


      # -----
      # - Restrict VPN Network to local (Sub) network
      # -----

      # - restrict_vpn_net_to_local_subnet
      # -
      # -    restrict_vpn_net_to_local_subnet="<src-vpn-net>:<dst-local-net> [<src-vpn-net>:<dst-local-net>} [..]
      # -
      # - Example:
      # -   restrict_vpn_net_to_local_subnet="
      # -      10.100.112.0/24:192.168.112.192/27
      # -    "
      # -
      # - Blank separated list
      # -
      restrict_vpn_net_to_local_subnet=""
    marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
  when: 
    - main_ipv4_exists.stat.exists
    - restrict_vpn_net_to_local_service_ipv4_present is changed


- name: Check if String 'restrict_vpn_net_to_local_service..' (IPv6) is present
  shell: grep -q -E "^#?restrict_vpn_net_to_local_service=" /etc/ipt-firewall/main_ipv6.conf
  register: restrict_vpn_net_to_local_service_ipv6_present
  when: main_ipv6_exists.stat.exists
  failed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 1"
  changed_when: "restrict_vpn_net_to_local_service_ipv6_present.rc > 0"

- name: Adjust file '/etc/ipt-firewall/main_ipv6.conf' (restrict_vpn_net_to_local_service)
  blockinfile:
    path: /etc/ipt-firewall/main_ipv6.conf
    insertafter: '^#?\s*vpn_out_ports='
    block: |

      # ----- 
      # - Restrict VPN Network to local Service
      # -----#

      # - restrict_vpn_net_to_local_service
      # -
      # -    allow_ext_net_to_local_service="vpn-net,local-address,port,protocol [vpn-net,local-address,port,protocol] [..]"
      # -
      # - Note:
      # - =====
      # -    - Only 'tcp' and 'udp' are allowed valuse for protocol.
      # -
      # - Example:
      # -   restrict_vpn_net_to_local_service="
      # -      2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,80,tcp
      # -      2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64,443,tcp
      # -    "
      # -
      # - Blank separated list
      # -
      restrict_vpn_net_to_local_service=""


      # -----
      # - Restrict VPN Network to local (Sub) network
      # -----

      # - restrict_vpn_net_to_local_subnet
      # -
      # -    restrict_vpn_net_to_local_subnet="<src-vpn-net>,<dst-local-net> [<src-vpn-net>,<dst-local-net>} [..]
      # -
      # - Example:
      # -   restrict_vpn_net_to_local_subnet="
      # -      2001:sc03:dd:bd2f:a63e:eb5f:86a5:d338/64,2003:ec:df3d:ffd:a63e:eb5f:86a5:d338/64
      # -    "
      # -
      # - Blank separated list
      # -
      restrict_vpn_net_to_local_subnet=""
    marker: "# Marker set by modify-ipt-gateway.yml (restrict_vpn_net_to_local_service)"
  when: 
    - main_ipv6_exists.stat.exists
    - restrict_vpn_net_to_local_service_ipv6_present is changed


# ---
# Remove Marker set by blockinfile
# ---

- name: Remove marker IPv4 (main_ipv4.conf)
  replace :
    path: /etc/ipt-firewall/main_ipv4.conf
    regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
    replace: ""
  register: marker_ipv4_removed
  #failed_when: "marker_ipv4_removed.rc > 1"
  #changed_when: "marker_ipv4_removed.rc < 1"
  when: 
    - main_ipv4_exists.stat.exists

- name: Remove marker IPv6 (main_ipv6.conf)
  replace :
    path: /etc/ipt-firewall/main_ipv6.conf
    regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
    replace: ""
  register: marker_ipv6_removed
  #failed_when: "marker_ipv6_removed.rc > 1"
  #changed_when: "marker_ipv6_removed.rc < 1"
  when: 
    - main_ipv6_exists.stat.exists

- name: Remove marker IPv4 (interfaces_ipv4.conf)
  replace :
    path: /etc/ipt-firewall/interfaces_ipv4.conf
    regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
    replace: ""
  register: marker_ipv4_removed
  #failed_when: "marker_ipv4_removed.rc > 1"
  #changed_when: "marker_ipv4_removed.rc < 1"
  when: 
    - interfaces_ipv4_exists.stat.exists

- name: Remove marker IPv6 (interfaces_ipv6.conf)
  replace :
    path: /etc/ipt-firewall/interfaces_ipv6.conf
    regexp: "^# Marker set by modify-ipt-gateway.yml.*$"
    replace: ""
  register: marker_ipv6_removed
  #failed_when: "marker_ipv6_removed.rc > 1"
  #changed_when: "marker_ipv6_removed.rc < 1"
  when: 
    - interfaces_ipv6_exists.stat.exists

# ---
# Confiuration Files
# ---

- name: Check if configuration files are latest
  shell: 'diff {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }} > /dev/null 2>&1'
  changed_when: "diff_script_output.rc > 0"
  # diff_output.rc
  #    0  -> unchanged
  #    1  -> changed
  #    2  -> not present
  failed_when: "diff_script_output.rc > 2"
  when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
  loop:
     - default_ports.conf
     - default_ipv4.conf
     - default_ipv6.conf
     - default_basic_behavior.conf
     - include_functions.conf
     - load_modules_ipv4.conf
     - load_modules_ipv6.conf
     - logging_ipv4.conf
     - logging_ipv6.conf
     - post_decalrations.conf
  register: diff_script_output

- name: Ensure configuration files are latest
  command: cp {{ git_firewall_repository.dest }}/conf/{{ item }} /etc/ipt-firewall/{{ item }}
  loop:
     - default_ports.conf
     - default_ipv4.conf
     - default_ipv6.conf
     - default_basic_behavior.conf
     - include_functions.conf
     - load_modules_ipv4.conf
     - load_modules_ipv6.conf
     - logging_ipv4.conf
     - logging_ipv6.conf
     - post_decalrations.conf
  when:
    - (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
    - diff_script_output.changed
  notify:
    - Restart IPv4 Firewall
    - Restart IPv6 Firewall

# ---
# Firewall scripts
# ---

- name: Check if firewall scripts are latest
  shell: 'diff {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }} > /dev/null 2>&1'
  changed_when: "diff_script_output.rc > 0"
  # diff_output.rc
  #    0  -> unchanged
  #    1  -> changed
  #    2  -> not present
  failed_when: "diff_script_output.rc > 2"
  when: (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
  loop:
     - ipt-firewall-gateway
     - ip6t-firewall-gateway
  register: diff_script_output

- name: Ensure firewall scripts are latest
  command: cp {{ git_firewall_repository.dest }}/{{ item }} /usr/local/sbin/{{ item }}
  loop:
     - ipt-firewall-gateway
     - ip6t-firewall-gateway
  when:
    - (git_firewall_repository is defined) and (git_firewall_repository|length > 0)
    - diff_script_output.changed
  notify:
    - Restart IPv4 Firewall
    - Restart IPv6 Firewall