New version of Robot Firewall introduced breaking changes

[filviu]

SUMMARY

Hetzner introduced (without prior notification I might add) a breaking change to the robot firewall:

You now have to separately define an outgoing rule. Using the community.hrobot.firewall module results in an unaccessible server as the outgoing rules are left blank.

Secondly you can now refer to ipv4 / ipv6 or wildcard when defining an incoming / outgoing rule. If I read the API correctly https://robot.hetzner.com/doc/webservice/en.html#post-firewall-server-id you need to leave out protocol version in order to attein the wildcard. Again this is not supported msg: 'missing required arguments: ip_version found in rules -> input'

Third: you have the option called ** Filter IPv6 packets ** setting this is also not supported right now.

ISSUE TYPE

• Bug Report

COMPONENT NAME

ommunity.hrobot.firewall

ANSIBLE VERSION

ansible [core 2.14.2]
  config file = /home/silviu/repos/setup-devops/ansible-playbooks/ansible.cfg
  configured module search path = ['/home/silviu/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/silviu/.local/lib/python3.10/site-packages/ansible
  ansible collection location = /home/silviu/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/silviu/.local/bin/ansible
  python version = 3.10.6 (main, Nov 14 2022, 16:10:14) [GCC 11.3.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True

COLLECTION VERSION

# /home/xxx/.ansible/collections/ansible_collections
Collection        Version
----------------- -------
community.general 6.3.0  

# /home/xxx/.local/lib/python3.10/site-packages/ansible_collections
Collection        Version
----------------- -------
community.general 6.3.0  

OS / ENVIRONMENT

Ubuntu 22.04 under wsl2

[felixfontein]

Well, I guess it's nice that they finally added IPv6 support and outgoing connection support, but it's pretty annoying that they did this with an unannounced breaking change which invalidates every existing client of the API...

I'll try to extend the module in the next days...

[filviu]

Yes, they usually at least announce it - especially since it looks like an improvement. But now complete silence, I only found out when my ansible scripts started to produce unaccessible servers.

Anyways, I'm available if I can help with testing.

[felixfontein]

I started working on this in #76. Please note that I have tested nothing except the firewall_info so far, so the firewall module might or might not work (and might also do strange stuff, burn down datacenters, ... :) ) at this stage.

[felixfontein]

@filviu did you have a chance to test my fix (#76)?

[filviu]

Yes, only today. The moment I wrote I have time to test my work Jira lit up 😆 It works and produces an usable configuration by adding the outgoing allow all rule.

I also tested adding rules with src_ip or dst_ip but without ip_version and sure enough I got a validation error. Nice!

But then I ran into a weird situation.

If I add this rule under input:

  - name: tailscale
    dst_port: 41641
    protocol: udp
    action: accept

I get the following error:

TASK [base : setup | Hetzner Robot Firewall] ***************************************************************************************************************************************************
fatal: [REDACTED -> localhost]: FAILED! => changed=false 
  msg: 'Request failed: 400 INVALID_INPUT (invalid input)'

I assumed dst_port also requires specifying ip_version (even if port based rules should work on both unless my low coffeine is playing tricks on me) but sure enough it works fine like this:

  - name: tailscale
    ip_version: ipv4
    dst_port: 41641
    protocol: udp
    action: accept

Icing on the cake: I can go into the robot web interface and set ip_version to '*' and it saves and applies corectly 🤷

[felixfontein]

In the UI you cannot configure protocol: udp when ip_version is *. This is apparently a restriction by the firewall that isn't documented in the API docs (https://robot.hetzner.com/doc/webservice/en.html#post-firewall-server-id). Though, actually it says that, though somewhat hidden: "Without specifying the IP version, it is not possible to filter on a specific protocol.". I'll add a restriction to the argument spec.

[filviu]

You are right, I missed seeing that it switched protocl from udp to '*' in the UI.