ec2_vpc_nacl: add IPv6 support (ansible-collections#398)

ec2_vpc_nacl.py

@@ -43,8 +43,8 @@
   egress:
     description:
       - A list of rules for outgoing traffic. Each rule must be specified as a list.
-        Each rule may contain the rule number (integer 1-32766), protocol (one of ['tcp', 'udp', 'icmp', '-1', 'all']),
-        the rule action ('allow' or 'deny') the CIDR of the IPv4 network range to allow or deny,
+        Each rule may contain the rule number (integer 1-32766), protocol (one of ['tcp', 'udp', 'icmp', 'ipv6-icmp', '-1', 'all']),
+        the rule action ('allow' or 'deny') the CIDR of the IPv4 or IPv6 network range to allow or deny,
         the ICMP type (-1 means all types), the ICMP code (-1 means all codes), the last port in the range for
         TCP or UDP protocols, and the first port in the range for TCP or UDP protocols.
         See examples.
@@ -55,8 +55,8 @@
   ingress:
     description:
       - List of rules for incoming traffic. Each rule must be specified as a list.
-        Each rule may contain the rule number (integer 1-32766), protocol (one of ['tcp', 'udp', 'icmp', '-1', 'all']),
-        the rule action ('allow' or 'deny') the CIDR of the IPv4 network range to allow or deny,
+        Each rule may contain the rule number (integer 1-32766), protocol (one of ['tcp', 'udp', 'icmp', 'ipv6-icmp', '-1', 'all']),
+        the rule action ('allow' or 'deny') the CIDR of the IPv4 or IPv6 network range to allow or deny,
         the ICMP type (-1 means all types), the ICMP code (-1 means all codes), the last port in the range for
         TCP or UDP protocols, and the first port in the range for TCP or UDP protocols.
         See examples.
@@ -104,9 +104,12 @@
         #                                             port from, port to
         - [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22]
         - [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80]
+        - [205, 'tcp', 'allow', '::/0', null, null, 80, 80]
         - [300, 'icmp', 'allow', '0.0.0.0/0', 0, 8]
+        - [305, 'ipv6-icmp', 'allow', '::/0', 0, 8]
     egress:
         - [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null]
+        - [105, 'all', 'allow', '::/0', null, null, null, null]
     state: 'present'
 
 - name: "Remove the ingress and egress rules - defaults to deny all"
@@ -163,12 +166,12 @@
 
 # VPC-supported IANA protocol numbers
 # http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
-PROTOCOL_NUMBERS = {'all': -1, 'icmp': 1, 'tcp': 6, 'udp': 17, }
+PROTOCOL_NUMBERS = {'all': -1, 'icmp': 1, 'tcp': 6, 'udp': 17, 'ipv6-icmp': 58}
 
 
 # Utility methods
 def icmp_present(entry):
-    if len(entry) == 6 and entry[1] == 'icmp' or entry[1] == 1:
+    if len(entry) == 6 and entry[1] in ['icmp', 'ipv6-icmp'] or entry[1] in [1, 58]:
         return True
 
 
@@ -291,13 +294,20 @@ def rules_changed(aws_rules, param_rules, Egress, nacl_id, client, module):
     return changed
 
 
+def is_ipv6(cidr):
+    return ':' in cidr
+
+
 def process_rule_entry(entry, Egress):
     params = dict()
     params['RuleNumber'] = entry[0]
     params['Protocol'] = str(PROTOCOL_NUMBERS[entry[1]])
     params['RuleAction'] = entry[2]
     params['Egress'] = Egress
-    params['CidrBlock'] = entry[3]
+    if is_ipv6(entry[3]):
+        params['Ipv6CidrBlock'] = entry[3]
+    else:
+        params['CidrBlock'] = entry[3]
     if icmp_present(entry):
         params['IcmpTypeCode'] = {"Type": int(entry[4]), "Code": int(entry[5])}
     else: