def main():
    module = AnsibleModule(
        argument_spec=dict(
            service=dict(required=False, type="list", default=[]),
            port=dict(required=False, type="list", default=[]),
            trust=dict(required=False, type="list", default=[]),
            trust_by_mac=dict(required=False, type="list", default=[]),
            masq=dict(required=False, type="list", default=[]),
            masq_by_mac=dict(required=False, type="list", default=[]),
            forward_port=dict(required=False, type="list", default=[]),
            forward_port_by_mac=dict(required=False, type="list", default=[]),
            zone=dict(required=False, type="str", default=None),
            state=dict(choices=["enabled", "disabled"], required=True),
        ),
        required_one_of=([
            "service",
            "port",
            "trust",
            "trust_by_mac",
            "masq",
            "masq_by_mac",
            "forward_prot",
        ], ),
        supports_check_mode=True,
    )

    if not HAS_FIREWALLD and not HAS_SYSTEM_CONFIG_FIREWALL:
        module.fail_json(msg="No firewall backend could be imported.")

    service = module.params["service"]
    port = []
    for port_proto in module.params["port"]:
        _port, _protocol = port_proto.split("/")
        if _protocol is None:
            module.fail_json(msg="improper port format (missing protocol?)")
        port.append((_port, _protocol))
    trust = module.params["trust"]
    trust_by_mac = []
    for item in module.params["trust_by_mac"]:
        _interface = get_device_for_mac(item)
        if _interface is None:
            module.fail_json(msg="MAC address not found %s" % item)
        trust_by_mac.append(_interface)
    masq = module.params["masq"]
    masq_by_mac = []
    for item in module.params["masq_by_mac"]:
        _interface = get_device_for_mac(item)
        if _interface is None:
            module.fail_json(msg="MAC address not found %s" % item)
        masq_by_mac.append(_interface)
    forward_port = []
    for item in module.params["forward_port"]:
        args = item.split(";")
        if len(args) == 4:
            _interface, __port, _to_port, _to_addr = args
        elif len(args) == 3:
            _interface = ""
            __port, _to_port, _to_addr = args
        else:
            module.fail_json(msg="improper forward_port format: %s" % item)
        _port, _protocol = __port.split("/")
        if _protocol is None:
            module.fail_json(
                msg="improper forward port format (missing protocol?)")
        if _to_port == "":
            _to_port = None
        if _to_addr == "":
            _to_addr = None
        forward_port.append((_interface, _port, _protocol, _to_port, _to_addr))

    forward_port_by_mac = []
    for item in module.params["forward_port_by_mac"]:
        args = item.split(";")
        if len(args) != 4:
            module.fail_json(msg="improper forward_port_by_mac format")
        _mac_addr, __port, _to_port, _to_addr = args
        _port, _protocol = __port.split("/")
        if _protocol is None:
            module.fail_json(
                msg="improper forward_port_by_mac format (missing protocol?)")
        if _to_port == "":
            _to_port = None
        if _to_addr == "":
            _to_addr = None
        _interface = get_device_for_mac(_mac_addr)
        if _interface is None:
            module.fail_json(msg="MAC address not found %s" % _mac_addr)
        forward_port_by_mac.append(
            (_interface, _port, _protocol, _to_port, _to_addr))
    zone = module.params["zone"]
    if HAS_SYSTEM_CONFIG_FIREWALL and zone is not None:
        module.fail_json(
            msg="Zone can not be used with system-config-firewall/lokkit.")
    desired_state = module.params["state"]

    if HAS_FIREWALLD:
        fw = FirewallClient()

        def exception_handler(exception_message):
            module.fail_json(msg=exception_message)

        fw.setExceptionHandler(exception_handler)

        if not fw.connected:
            module.fail_json(msg="firewalld service must be running")

        trusted_zone = "trusted"
        external_zone = "external"
        if zone is not None:
            if zone not in fw.getZones():
                module.fail_json(msg="Runtime zone '%s' does not exist." %
                                 zone)
            if zone not in fw.config().getZoneNames():
                module.fail_json(msg="Permanent zone '%s' does not exist." %
                                 zone)
        else:
            zone = fw.getDefaultZone()
        fw_zone = fw.config().getZoneByName(zone)
        fw_settings = fw_zone.getSettings()

        changed = False
        changed_zones = {}

        # service
        for item in service:
            if desired_state == "enabled":
                if not fw.queryService(zone, item):
                    fw.addService(zone, item)
                    changed = True
                if not fw_settings.queryService(item):
                    fw_settings.addService(item)
                    changed = True
                    changed_zones[fw_zone] = fw_settings
            elif desired_state == "disabled":
                if fw.queryService(zone, item):
                    fw.removeService(zone, item)
                if fw_settings.queryService(item):
                    fw_settings.removeService(item)
                    changed = True
                    changed_zones[fw_zone] = fw_settings

        # port
        for _port, _protocol in port:
            if desired_state == "enabled":
                if not fw.queryPort(zone, _port, _protocol):
                    fw.addPort(zone, _port, _protocol)
                    changed = True
                if not fw_settings.queryPort(_port, _protocol):
                    fw_settings.addPort(_port, _protocol)
                    changed = True
                    changed_zones[fw_zone] = fw_settings
            elif desired_state == "disabled":
                if fw.queryPort(zone, _port, _protocol):
                    fw.removePort(zone, _port, _protocol)
                    changed = True
                if fw_settings.queryPort(_port, _protocol):
                    fw_settings.removePort(_port, _protocol)
                    changed = True
                    changed_zones[fw_zone] = fw_settings

        # trust, trust_by_mac
        if len(trust) > 0 or len(trust_by_mac) > 0:
            items = trust
            if len(trust_by_mac) > 0:
                items.extend(trust_by_mac)

            if zone != trusted_zone:
                _fw_zone = fw.config().getZoneByName(trusted_zone)
                if _fw_zone in changed_zones:
                    _fw_settings = changed_zones[_fw_zone]
                else:
                    _fw_settings = _fw_zone.getSettings()
            else:
                _fw_zone = fw_zone
                _fw_settings = fw_settings

            for item in items:
                if desired_state == "enabled":
                    if try_set_zone_of_interface(trusted_zone, item):
                        changed = True
                    else:
                        if not fw.queryInterface(trusted_zone, item):
                            fw.changeZoneOfInterface(trusted_zone, item)
                            changed = True
                        if not _fw_settings.queryInterface(item):
                            _fw_settings.addInterface(item)
                            changed = True
                            changed_zones[_fw_zone] = _fw_settings
                elif desired_state == "disabled":
                    if try_set_zone_of_interface("", item):
                        if module.check_mode:
                            module.exit_json(changed=True)
                    else:
                        if fw.queryInterface(trusted_zone, item):
                            fw.removeInterface(trusted_zone, item)
                            changed = True
                        if _fw_settings.queryInterface(item):
                            _fw_settings.removeInterface(item)
                            changed = True
                            changed_zones[_fw_zone] = _fw_settings

        # masq, masq_by_mac
        if len(masq) > 0 or len(masq_by_mac) > 0:
            items = masq
            if len(masq_by_mac) > 0:
                items.extend(masq_by_mac)

            if zone != external_zone:
                _fw_zone = fw.config().getZoneByName(external_zone)
                if _fw_zone in changed_zones:
                    _fw_settings = changed_zones[_fw_zone]
                else:
                    _fw_settings = _fw_zone.getSettings()
            else:
                _fw_zone = fw_zone
                _fw_settings = fw_settings

            for item in items:
                if desired_state == "enabled":
                    if try_set_zone_of_interface(external_zone, item):
                        changed = True
                    else:
                        if not fw.queryInterface(external_zone, item):
                            fw.changeZoneOfInterface(external_zone, item)
                            changed = True
                        if not _fw_settings.queryInterface(item):
                            _fw_settings.addInterface(item)
                            changed = True
                            changed_zones[_fw_zone] = _fw_settings
                elif desired_state == "disabled":
                    if try_set_zone_of_interface("", item):
                        if module.check_mode:
                            module.exit_json(changed=True)
                    else:
                        if fw.queryInterface(external_zone, item):
                            fw.removeInterface(external_zone, item)
                            changed = True
                        if _fw_settings.queryInterface(item):
                            _fw_settings.removeInterface(item)
                            changed = True
                            changed_zones[_fw_zone] = _fw_settings

        # forward_port, forward_port_by_mac
        if len(forward_port) > 0 or len(forward_port_by_mac) > 0:
            items = forward_port
            if len(forward_port_by_mac) > 0:
                items.extend(forward_port_by_mac)

            for _interface, _port, _protocol, _to_port, _to_addr in items:
                if _interface != "":
                    _zone = fw.getZoneOfInterface(_interface)
                else:
                    _zone = zone
                if _zone != "" and _zone != zone:
                    _fw_zone = fw.config().getZoneByName(_zone)
                    if _fw_zone in changed_zones:
                        _fw_settings = changed_zones[_fw_zone]
                    else:
                        _fw_settings = _fw_zone.getSettings()
                else:
                    _fw_zone = fw_zone
                    _fw_settings = fw_settings

                if desired_state == "enabled":
                    if not fw.queryForwardPort(_zone, _port, _protocol,
                                               _to_port, _to_addr):
                        fw.addForwardPort(_zone, _port, _protocol, _to_port,
                                          _to_addr)
                        changed = True
                    if not _fw_settings.queryForwardPort(
                            _port, _protocol, _to_port, _to_addr):
                        _fw_settings.addForwardPort(_port, _protocol, _to_port,
                                                    _to_addr)
                        changed = True
                        changed_zones[_fw_zone] = _fw_settings
                elif desired_state == "disabled":
                    if fw.queryForwardPort(_zone, _port, _protocol, _to_port,
                                           _to_addr):
                        fw.removeForwardPort(_zone, _port, _protocol, _to_port,
                                             _to_addr)
                        changed = True
                    if _fw_settings.queryForwardPort(_port, _protocol,
                                                     _to_port, _to_addr):
                        _fw_settings.removeForwardPort(_port, _protocol,
                                                       _to_port, _to_addr)
                        changed = True
                        changed_zones[_fw_zone] = _fw_settings

        # apply changes
        if changed:
            for _zone in changed_zones:
                _zone.update(changed_zones[_zone])
            module.exit_json(changed=True)

    elif HAS_SYSTEM_CONFIG_FIREWALL:
        (config, old_config, _) = fw_lokkit.loadConfig(args=[],
                                                       dbus_parser=True)

        changed = False

        # service
        for item in service:
            if config.services is None:
                config.services = []

            if desired_state == "enabled":
                if item not in config.services:
                    config.services.append(item)
                    changed = True
            elif desired_state == "disabled":
                if item in config.services:
                    config.services.remove(item)
                    changed = True

        # port
        for _port, _protocol in port:
            if config.ports is None:
                config.ports = []

            _range = getPortRange(_port)
            if _range < 0:
                module.fail_json(msg="invalid port definition %s" % _port)
            elif _range is None:
                module.fail_json(msg="port _range is not unique.")
            elif len(_range) == 2 and _range[0] >= _range[1]:
                module.fail_json(msg="invalid port range %s" % _port)
            port_proto = (_range, _protocol)
            if desired_state == "enabled":
                if port_proto not in config.ports:
                    config.ports.append(port_proto)
                    changed = True
            elif desired_state == "disabled":
                if port_proto in config.ports:
                    config.ports.remove(port_proto)
                    changed = True

        # trust, trust_by_mac
        if len(trust) > 0 or len(trust_by_mac) > 0:
            if config.trust is None:
                config.trust = []

            items = trust
            if len(trust_by_mac) > 0:
                items.extend(trust_by_mac)

            for item in items:
                if desired_state == "enabled":
                    if item not in config.trust:
                        config.trust.append(item)
                        changed = True
                elif desired_state == "disabled":
                    if item in config.trust:
                        config.trust.remove(item)
                        changed = True

        # masq, masq_by_mac
        if len(masq) > 0 or len(masq_by_mac) > 0:
            if config.masq is None:
                config.masq = []

            items = masq
            if len(masq_by_mac) > 0:
                items.extend(masq_by_mac)

            for item in items:
                if desired_state == "enabled":
                    if item not in config.masq:
                        config.masq.append(item)
                        changed = True
                elif desired_state == "disabled":
                    if item in config.masq:
                        config.masq.remove(item)
                        changed = True

        # forward_port, forward_port_by_mac
        if len(forward_port) > 0 or len(forward_port_by_mac) > 0:
            if config.forward_port is None:
                config.forward_port = []

            items = forward_port
            if len(forward_port_by_mac) > 0:
                items.extend(forward_port_by_mac)

            for _interface, _port, _protocol, _to_port, _to_addr in items:
                _range = getPortRange(_port)
                if _range < 0:
                    module.fail_json(msg="invalid port definition")
                elif _range is None:
                    module.fail_json(msg="port _range is not unique.")
                elif len(_range) == 2 and _range[0] >= _range[1]:
                    module.fail_json(msg="invalid port range")
                fwd_port = {
                    "if": _interface,
                    "port": _range,
                    "proto": _protocol
                }
                if _to_port is not None:
                    _range = getPortRange(_to_port)
                    if _range < 0:
                        module.fail_json(msg="invalid port definition %s" %
                                         _to_port)
                    elif _range is None:
                        module.fail_json(msg="port _range is not unique.")
                    elif len(_range) == 2 and _range[0] >= _range[1]:
                        module.fail_json(msg="invalid port range")
                    fwd_port["toport"] = _range
                if _to_addr is not None:
                    fwd_port["toaddr"] = _to_addr

                if desired_state == "enabled":
                    if fwd_port not in config.forward_port:
                        config.forward_port.append(fwd_port)
                        changed = True
                elif desired_state == "disabled":
                    if fwd_port in config.forward_port:
                        config.forward_port.remove(fwd_port)
                        changed = True

        # apply changes
        if changed:
            fw_lokkit.updateFirewall(config, old_config)
            if module.check_mode:
                module.exit_json(changed=True)

    else:
        module.fail_json(msg="No firewalld and system-config-firewall")

    module.exit_json(changed=False)
Example #2
0
def main():
    module = AnsibleModule(argument_spec=dict(
        service=dict(required=False, type='list', default=[]),
        port=dict(required=False, type='list', default=[]),
        trust=dict(required=False, type='list', default=[]),
        trust_by_mac=dict(required=False, type='list', default=[]),
        masq=dict(required=False, type='list', default=[]),
        masq_by_mac=dict(required=False, type='list', default=[]),
        forward_port=dict(required=False, type='list', default=[]),
        forward_port_by_mac=dict(required=False, type='list', default=[]),
        state=dict(choices=['enabled', 'disabled'], required=True),
    ),
                           required_one_of=([
                               'service', 'port', 'trust', 'trust_by_mac',
                               'masq', 'masq_by_mac', 'forward_prot'
                           ], ),
                           supports_check_mode=True)

    if not HAS_FIREWALLD and not HAS_SYSTEM_CONFIG_FIREWALL:
        module.fail_json(msg='No firewall backend could be imported.')

    service = module.params['service']
    port = []
    for port_proto in module.params['port']:
        _port, _protocol = port_proto.split('/')
        if _protocol is None:
            module.fail_json(msg='improper port format (missing protocol?)')
        port.append((_port, _protocol))
    trust = module.params['trust']
    trust_by_mac = []
    for item in module.params['trust_by_mac']:
        _interface = get_device_for_mac(item)
        if _interface is None:
            module.fail_json(msg='MAC address not found %s' % item)
        trust_by_mac.append(_interface)
    masq = module.params['masq']
    masq_by_mac = []
    for item in module.params['masq_by_mac']:
        _interface = get_device_for_mac(item)
        if _interface is None:
            module.fail_json(msg='MAC address not found %s' % item)
        masq_by_mac.append(_interface)
    forward_port = []
    for item in module.params['forward_port']:
        args = item.split(";")
        if len(args) != 4:
            module.fail_json(msg='improper forward_port format: %s' % item)
        _interface, __port, _to_port, _to_addr = args
        _port, _protocol = __port.split('/')
        if _protocol is None:
            module.fail_json(msg='improper port format (missing protocol?)')
        if _to_port == "":
            _to_port = None
        if _to_addr == "":
            _to_addr = None
        forward_port.append((_interface, _port, _protocol, _to_port, _to_addr))

    forward_port_by_mac = []
    for item in module.params['forward_port_by_mac']:
        args = item.split(";")
        if len(args) != 4:
            module.fail_json(msg='improper forward_port_by_mac format')
        _mac_addr, __port, _to_port, _to_addr = args
        _port, _protocol = __port.split('/')
        if _protocol is None:
            module.fail_json(msg='improper port format (missing protocol?)')
        if _to_port == "":
            _to_port = None
        if _to_addr == "":
            _to_addr = None
        _interface = get_device_for_mac(_mac_addr)
        if _interface is None:
            module.fail_json(msg='MAC address not found %s' % _mac_addr)
        forward_port_by_mac.append(
            (_interface, _port, _protocol, _to_port, _to_addr))
    desired_state = module.params['state']

    if HAS_FIREWALLD:
        fw = FirewallClient()

        def exception_handler(exception_message):
            module.fail_json(msg=exception_message)

        fw.setExceptionHandler(exception_handler)

        if not fw.connected:
            module.fail_json(msg='firewalld service must be running')

        trusted_zone = "trusted"
        external_zone = "external"
        default_zone = fw.getDefaultZone()
        fw_zone = fw.config().getZoneByName(default_zone)
        fw_settings = fw_zone.getSettings()

        changed = False
        changed_zones = {}

        # service
        for item in service:
            if desired_state == "enabled":
                if not fw.queryService(default_zone, item):
                    fw.addService(default_zone, item)
                    changed = True
                if not fw_settings.queryService(item):
                    fw_settings.addService(item)
                    changed = True
                    changed_zones[fw_zone] = fw_settings
            elif desired_state == "disabled":
                if fw.queryService(default_zone, item):
                    fw.removeService(default_zone, item)
                if fw_settings.queryService(item):
                    fw_settings.removeService(item)
                    changed = True
                    changed_zones[fw_zone] = fw_settings

        # port
        for _port, _protocol in port:
            if desired_state == "enabled":
                if not fw.queryPort(default_zone, _port, _protocol):
                    fw.addPort(default_zone, _port, _protocol)
                    changed = True
                if not fw_settings.queryPort(_port, _protocol):
                    fw_settings.addPort(_port, _protocol)
                    changed = True
                    changed_zones[fw_zone] = fw_settings
            elif desired_state == "disabled":
                if fw.queryPort(default_zone, _port, _protocol):
                    fw.removePort(default_zone, _port, _protocol)
                    changed = True
                if fw_settings.queryPort(_port, _protocol):
                    fw_settings.removePort(_port, _protocol)
                    changed = True
                    changed_zones[fw_zone] = fw_settings

        # trust, trust_by_mac
        if len(trust) > 0 or len(trust_by_mac) > 0:
            items = trust
            if len(trust_by_mac) > 0:
                items.extend(trust_by_mac)

            if default_zone != trusted_zone:
                fw_zone = fw.config().getZoneByName(trusted_zone)
                fw_settings = fw_zone.getSettings()

            for item in items:
                if desired_state == "enabled":
                    if try_set_zone_of_interface(trusted_zone, item):
                        changed = True
                    else:
                        if not fw.queryInterface(trusted_zone, item):
                            fw.changeZoneOfInterface(trusted_zone, item)
                            changed = True
                        if not fw_settings.queryInterface(item):
                            fw_settings.addInterface(item)
                            changed = True
                            changed_zones[fw_zone] = fw_settings
                elif desired_state == "disabled":
                    if try_set_zone_of_interface("", item):
                        if module.check_mode:
                            module.exit_json(changed=True)
                    else:
                        if fw.queryInterface(trusted_zone, item):
                            fw.removeInterface(trusted_zone, item)
                            changed = True
                        if fw_settings.queryInterface(item):
                            fw_settings.removeInterface(item)
                            changed = True
                            changed_zones[fw_zone] = fw_settings

        # masq, masq_by_mac
        if len(masq) > 0 or len(masq_by_mac) > 0:
            items = masq
            if len(masq_by_mac) > 0:
                items.extend(masq_by_mac)

            if default_zone != external_zone:
                fw_zone = fw.config().getZoneByName(external_zone)
                fw_settings = fw_zone.getSettings()

            for item in items:
                if desired_state == "enabled":
                    if try_set_zone_of_interface(external_zone, item):
                        changed = True
                    else:
                        if not fw.queryInterface(external_zone, item):
                            fw.changeZoneOfInterface(external_zone, item)
                            changed = True
                        if not fw_settings.queryInterface(item):
                            fw_settings.addInterface(item)
                            changed = True
                            changed_zones[fw_zone] = fw_settings
                elif desired_state == "disabled":
                    if try_set_zone_of_interface("", item):
                        if module.check_mode:
                            module.exit_json(changed=True)
                    else:
                        if fw.queryInterface(external_zone, item):
                            fw.removeInterface(external_zone, item)
                            changed = True
                        if fw_settings.queryInterface(item):
                            fw_settings.removeInterface(item)
                            changed = True
                            changed_zones[fw_zone] = fw_settings

        # forward_port, forward_port_by_mac
        if len(forward_port) > 0 or len(forward_port_by_mac) > 0:
            items = forward_port
            if len(forward_port_by_mac) > 0:
                items.extend(forward_port_by_mac)

            for _interface, _port, _protocol, _to_port, _to_addr in items:
                if _interface != "":
                    _zone = fw.getZoneOfInterface(_interface)
                    if _zone != "" and _zone != default_zone:
                        fw_zone = fw.config().getZoneByName(_zone)
                        fw_settings = fw_zone.getSettings()

                if desired_state == "enabled":
                    if not fw.queryForwardPort(_zone, _port, _protocol,
                                               _to_port, _to_addr):
                        fw.addForwardPort(_zone, _port, _protocol, _to_port,
                                          _to_addr)
                        changed = True
                    if not fw_settings.queryForwardPort(
                            _port, _protocol, _to_port, _to_addr):
                        fw_settings.addForwardPort(_port, _protocol, _to_port,
                                                   _to_addr)
                        changed = True
                        changed_zones[fw_zone] = fw_settings
                elif desired_state == "disabled":
                    if fw.queryForwardPort(_zone, _port, _protocol, _to_port,
                                           _to_addr):
                        fw.removeForwardPort(_zone, _port, _protocol, _to_port,
                                             _to_addr)
                        changed = True
                    if fw_settings.queryForwardPort(_port, _protocol, _to_port,
                                                    _to_addr):
                        fw_settings.removeForwardPort(_port, _protocol,
                                                      _to_port, _to_addr)
                        changed = True
                        changed_zones[fw_zone] = fw_settings

        # apply changes
        if changed:
            for _zone in changed_zones:
                _zone.update(changed_zones[_zone])
            if module.check_mode:
                module.exit_json(changed=True)

    elif HAS_SYSTEM_CONFIG_FIREWALL:
        (config, old_config, _) = fw_lokkit.loadConfig(args=[],
                                                       dbus_parser=True)

        changed = False

        # service
        for item in service:
            if config.services is None:
                config.services = []

            if desired_state == "enabled":
                if item not in config.services:
                    config.services.append(item)
                    changed = True
            elif desired_state == "disabled":
                if item in config.services:
                    config.services.remove(item)
                    changed = True

        # port
        for _port, _protocol in port:
            if config.ports is None:
                config.ports = []

            _range = getPortRange(_port)
            if _range < 0:
                module.fail_json(msg='invalid port definition %s' % _port)
            elif _range is None:
                module.fail_json(msg='port _range is not unique.')
            elif len(_range) == 2 and _range[0] >= _range[1]:
                module.fail_json(msg='invalid port range %s' % _port)
            port_proto = (_range, _protocol)
            if desired_state == "enabled":
                if port_proto not in config.ports:
                    config.ports.append(port_proto)
                    changed = True
            elif desired_state == "disabled":
                if port_proto in config.ports:
                    config.ports.remove(port_proto)
                    changed = True

        # trust, trust_by_mac
        if len(trust) > 0 or len(trust_by_mac) > 0:
            if config.trust is None:
                config.trust = []

            items = trust
            if len(trust_by_mac) > 0:
                items.extend(trust_by_mac)

            for item in items:
                if desired_state == "enabled":
                    if item not in config.trust:
                        config.trust.append(item)
                        changed = True
                elif desired_state == "disabled":
                    if item in config.trust:
                        config.trust.remove(item)
                        changed = True

        # masq, masq_by_mac
        if len(masq) > 0 or len(masq_by_mac) > 0:
            if config.masq is None:
                config.masq = []

            items = masq
            if len(masq_by_mac) > 0:
                items.extend(masq_by_mac)

            for item in items:
                if desired_state == "enabled":
                    if item not in config.masq:
                        config.masq.append(item)
                        changed = True
                elif desired_state == "disabled":
                    if item in config.masq:
                        config.masq.remove(item)
                        changed = True

        # forward_port, forward_port_by_mac
        if len(forward_port) > 0 or len(forward_port_by_mac) > 0:
            if config.forward_port is None:
                config.forward_port = []

            items = forward_port
            if len(forward_port_by_mac) > 0:
                items.extend(forward_port_by_mac)

            for _interface, _port, _protocol, _to_port, _to_addr in items:
                _range = getPortRange(_port)
                if _range < 0:
                    module.fail_json(msg='invalid port definition')
                elif _range is None:
                    module.fail_json(msg='port _range is not unique.')
                elif len(_range) == 2 and _range[0] >= _range[1]:
                    module.fail_json(msg='invalid port range')
                fwd_port = {
                    "if": _interface,
                    "port": _range,
                    "proto": _protocol
                }
                if _to_port is not None:
                    _range = getPortRange(_to_port)
                    if _range < 0:
                        module.fail_json(msg='invalid port definition %s' % \
                                         _to_port)
                    elif _range is None:
                        module.fail_json(msg='port _range is not unique.')
                    elif len(_range) == 2 and _range[0] >= _range[1]:
                        module.fail_json(msg='invalid port range')
                    fwd_port["toport"] = _range
                if _to_addr is not None:
                    fwd_port["toaddr"] = _to_addr

                if desired_state == "enabled":
                    if fwd_port not in config.forward_port:
                        config.forward_port.append(fwd_port)
                        changed = True
                elif desired_state == "disabled":
                    if fwd_port in config.forward_port:
                        config.forward_port.remove(fwd_port)
                        changed = True

        # apply changes
        if changed:
            fw_lokkit.updateFirewall(config, old_config)
            if module.check_mode:
                module.exit_json(changed=True)

    else:
        module.fail_json(msg='No firewalld and system-config-firewall')

    module.exit_json(changed=False)