├── vars ├── Debian.yml ├── Archlinux.yml └── RedHat.yml ├── tests └── test.yml ├── defaults └── main.yml ├── handlers └── main.yml ├── templates ├── maps.j2 ├── verdict_maps.j2 ├── nftables.rules.j2 ├── chains.j2 └── sets.j2 ├── meta └── main.yml ├── CONTRIBUTING.md ├── tasks └── main.yml ├── .travis.yml ├── README.md └── LICENSE /vars/Debian.yml: -------------------------------------------------------------------------------- 1 | --- 2 | nftables_config_file: /etc/nftables.conf 3 | ... 4 | -------------------------------------------------------------------------------- /vars/Archlinux.yml: -------------------------------------------------------------------------------- 1 | --- 2 | nftables_config_file: "/etc/nftables.conf" 3 | ... 4 | -------------------------------------------------------------------------------- /vars/RedHat.yml: -------------------------------------------------------------------------------- 1 | --- 2 | nftables_config_file: "/etc/sysconfig/nftables.conf" 3 | ... 4 | -------------------------------------------------------------------------------- /tests/test.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - hosts: localhost 3 | remote_user: root 4 | roles: 5 | - under_test 6 | ... 7 | -------------------------------------------------------------------------------- /defaults/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | nftables_flush_ruleset: yes 3 | nftables_config_file: "/etc/nftables.conf" 4 | nftables_tables: [] 5 | ... 6 | -------------------------------------------------------------------------------- /handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Reload nftables 3 | become: yes 4 | service: 5 | name: nftables 6 | state: reloaded 7 | ... 8 | -------------------------------------------------------------------------------- /templates/maps.j2: -------------------------------------------------------------------------------- 1 | {# Please leave formatting as it is. #} 2 | {% for map in table.maps %} 3 | 4 | map {{ map.name }} { 5 | type {{ map.keys_type }}: {{ map.values_type }} 6 | {% if map.elements is defined %} 7 | {% for elem in map.elements %} 8 | {{ elem.key }}: {{ elem.value }} 9 | {% endfor %} 10 | {% endif %} 11 | } 12 | {% endfor %} 13 | -------------------------------------------------------------------------------- /templates/verdict_maps.j2: -------------------------------------------------------------------------------- 1 | {# Please leave formatting as it is. #} 2 | {% for vmap in table.verdict_maps %} 3 | 4 | map {{ vmap.name }} { 5 | type {{ vmap.keys_type }}: verdict 6 | {% if vmap.elements is defined %} 7 | {% for elem in vmap.elements %} 8 | {{ elem.key }}: {{ elem.verdict }} 9 | {% endfor %} 10 | {% endif %} 11 | } 12 | {% endfor %} 13 | -------------------------------------------------------------------------------- /meta/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | galaxy_info: 3 | author: François KUBLER 4 | description: Install and manage nftables. 5 | company: kblr 6 | license: Apache-2.0 7 | issue_tracker_url: https://github.com/Frzk/ansible-role-nftables/issues 8 | min_ansible_version: 2.4.2.0 9 | platforms: 10 | - name: Archlinux 11 | versions: 12 | - all 13 | - name: EL 14 | versions: 15 | - 7 16 | - name: Debian 17 | versions: 18 | - buster 19 | - sid 20 | - name: Ubuntu 21 | versions: 22 | - bionic 23 | galaxy_tags: 24 | - system 25 | - nftables 26 | - security 27 | - networking 28 | - firewall 29 | ... 30 | -------------------------------------------------------------------------------- /templates/nftables.rules.j2: -------------------------------------------------------------------------------- 1 | #jinja2: lstrip_blocks: True 2 | #!/usr/sbin/nft -f 3 | {{ ansible_managed | comment }} 4 | 5 | {% if nftables_flush_ruleset %} 6 | flush ruleset 7 | {% endif %} 8 | 9 | {% for table in nftables_tables %} 10 | table {{ table.family }} {{ table.name }} { 11 | 12 | {%- if table.sets is defined %} 13 | {% include "templates/sets.j2" %} 14 | {% endif %} 15 | 16 | {%- if table.maps is defined %} 17 | {% include "templates/maps.j2" %} 18 | {% endif %} 19 | 20 | {%- if table.verdict_maps is defined %} 21 | {% include "templates/verdict_maps.j2" %} 22 | {% endif %} 23 | 24 | {%- if table.chains is defined %} 25 | {% include "templates/chains.j2" %} 26 | {% endif %} 27 | } 28 | {% endfor %} 29 | -------------------------------------------------------------------------------- /templates/chains.j2: -------------------------------------------------------------------------------- 1 | {# Please leave formatting as it is. #} 2 | {% for chain in table.chains %} 3 | 4 | chain {{ chain.name }} { 5 | {% if chain.base is defined %} 6 | type {{ chain.base.type }} hook {{ chain.base.hook }} priority {{ chain.base.priority }}; 7 | {%- if chain.base.policy is defined %} policy {{ chain.base.policy }};{% endif %} 8 | {% endif %} 9 | 10 | {% if chain.rules is defined -%} 11 | {% for rule in chain.rules|sort(attribute="position") %} 12 | {% if rule.comment is defined %} 13 | # {{ rule.comment }} 14 | {% endif %} 15 | {{ rule.statement }} 16 | {% endfor %} 17 | {% endif %} 18 | } 19 | {% endfor %} 20 | -------------------------------------------------------------------------------- /templates/sets.j2: -------------------------------------------------------------------------------- 1 | {# Please leave formatting as it is. #} 2 | {% for set in table.sets %} 3 | 4 | set {{ set.name }} { 5 | type {{ set.type }} 6 | {% if set.timeout is defined %} 7 | timeout {{ set.timeout }} 8 | {% endif %} 9 | 10 | {%- if set.gc_interval is defined %} 11 | gc-interval {{ set.gc_interval }} 12 | {% endif %} 13 | 14 | {%- if set.size is defined %} 15 | size {{ set.size }} 16 | {% endif %} 17 | 18 | {%- if set.policy is defined %} 19 | policy {{ set.policy }} 20 | {% endif %} 21 | 22 | {%- if set.flags is defined and set.flags %} 23 | flags {{ set.flags | join(', ') }} 24 | {% endif %} 25 | 26 | {%- if set.elements is defined and set.elements %} 27 | elements = { {{ set.elements | join(', ') }} } 28 | {% endif %} 29 | } 30 | {% endfor %} 31 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # How to Contribute 2 | 3 | ## Pull Requests 4 | 5 | 1. Fork the ansible-role-nftables repository 6 | 2. Create a new branch for each feature or improvement 7 | 3. Send a pull request from each feature branch to the **develop** branch 8 | 9 | It is very important to separate new features or improvements into separate feature branches, and to send a 10 | pull request for each branch. This allows me to review and pull in new features or improvements individually. 11 | 12 | ## Bug Reports 13 | 14 | 1. Create an issue [here](https://github.com/Frzk/ansible-role-nftables/issues) 15 | 2. Add the `bug` label to the issue 16 | 3. Please provide as many details as you can (environment, steps to reproduce, config file, ...) 17 | 18 | ## Feature Requests 19 | 20 | Feature Requests are only for **NEW** features. For existing features, please make an Enhancement Request. 21 | 22 | 1. Create an issue [here](https://github.com/Frzk/ansible-role-nftables/issues) 23 | 2. Add the `feature request` label to the issue 24 | 3. Please describe the feature in a detailed way, with examples and use cases 25 | 26 | ## Enhancement Requests 27 | 28 | Enhancement Requests are only for **EXISTING** features. For a new feature, please make a Feature Request. 29 | 30 | 1. Create an issue [here](https://github.com/Frzk/ansible-role-nftables/issues) 31 | 2. Add the `enhancement` label to the issue 32 | 3. Describe your idea 33 | -------------------------------------------------------------------------------- /tasks/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Include OS specific configuration 3 | include_vars: "{{ item }}" 4 | with_first_found: 5 | - paths: 6 | - "vars" 7 | - files: 8 | - "{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml" 9 | - "{{ ansible_distribution }}.yml" 10 | - "{{ ansible_os_family }}.yml" 11 | skip: yes 12 | 13 | - name: Install 14 | become: yes 15 | package: 16 | name: nftables 17 | state: present 18 | 19 | - name: Set up configuration file 20 | become: yes 21 | template: 22 | src: templates/nftables.rules.j2 23 | dest: "{{ nftables_config_file }}" 24 | owner: root 25 | group: root 26 | mode: 0644 27 | # '--check' is not available on current major distros. Disabling temporarily. 28 | # validate: "nft --check --file %s" 29 | notify: Reload nftables 30 | 31 | - name: Disable conflicting services 32 | become: yes 33 | service: 34 | name: "{{ item }}" 35 | state: stopped 36 | enabled: no 37 | register: disable_service_result 38 | failed_when: (disable_service_result is failed) 39 | and ('Could not find the requested service' not in disable_service_result.msg) 40 | with_items: 41 | - iptables 42 | 43 | - name: Start service 44 | become: yes 45 | service: 46 | name: nftables 47 | state: started 48 | 49 | - name: Enable service 50 | become: yes 51 | service: 52 | name: nftables 53 | enabled: yes 54 | ... 55 | -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | --- 2 | sudo: required 3 | language: bash 4 | services: 5 | - docker 6 | 7 | # Build matrix 8 | env: 9 | - distribution: centos 10 | version: 7 11 | - distribution: debian 12 | version: 9 13 | - distribution: ubuntu 14 | version: 18.04 15 | 16 | before_install: 17 | # Pull the image corresponding to the environment vars from Docker Hub: 18 | - docker pull "kblr/${distribution}${version}-ansible:latest" 19 | 20 | script: 21 | # 0/ Run the container: 22 | - > 23 | docker run 24 | --name "${TRAVIS_COMMIT}.${distribution}-${version}" 25 | --detach 26 | --privileged 27 | --mount type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly 28 | --mount type=bind,source="$(pwd)",target=/etc/ansible/roles/under_test,readonly 29 | "kblr/${distribution}${version}-ansible:latest" 30 | 31 | # 1/ Check role syntax: 32 | - > 33 | docker exec "${TRAVIS_COMMIT}.${distribution}-${version}" 34 | ansible-playbook -v /etc/ansible/roles/under_test/tests/test.yml --syntax-check 35 | 36 | # 2/ Check first run: 37 | - > 38 | docker exec "${TRAVIS_COMMIT}.${distribution}-${version}" 39 | ansible-playbook -v /etc/ansible/roles/under_test/tests/test.yml 40 | 41 | # 3/ Check idempotence: 42 | - > 43 | docker exec "${TRAVIS_COMMIT}.${distribution}-${version}" 44 | ansible-playbook -v /etc/ansible/roles/under_test/tests/test.yml 45 | | grep -q 'changed=0.*failed=0' 46 | && (echo 'Idempotence test: pass' && exit 0) 47 | || (echo 'Idempotence test: fail' && exit 1) 48 | 49 | after_script: 50 | # Remove container: 51 | - docker rm -f "${TRAVIS_COMMIT}.${distribution}-${version}" 52 | 53 | notifications: 54 | webhooks: https://galaxy.ansible.com/api/v1/notifications/ 55 | ... 56 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Ansible Role: `nftables` 2 | 3 | [![Build Status](https://travis-ci.org/Frzk/ansible-role-nftables.svg?branch=master)](https://travis-ci.org/Frzk/ansible-role-nftables) 4 | 5 | This Ansible role allows you to install `nftables` and manage its configuration. 6 | 7 | For more information about `nftables`, please check [the official project page](http://netfilter.org/projects/nftables/index.html). 8 | 9 | 10 | ## Role variables 11 | 12 | Variables and *properties* in bold are mandatory. Others are optional. 13 | 14 | | Variable name | Description | Default value | 15 | | ------------------------ | -------------------------------------------------- | -------------------- | 16 | | `nftables_flush_ruleset` | Wether we should flush the current ruleset or not. | `yes` | 17 | | `nftables_config_file` | Path to the configuration file. | `/etc/nftables.conf` | 18 | | `nftables_tables` | A list of [table](#table-properties). | `[]` | 19 | 20 | 21 | ### table properties 22 | 23 | | Property name | Description | Default value | 24 | | -------------- | ----------------------------------------------------------------------------------------------------------- | ------------- | 25 | | **`name`** | Name of the table. | | 26 | | `family` | Address family of the table. If specified, must be either `ip`, `ip6`, `inet`, `arp`, `bridge` or `netdev`. | `ip` | 27 | | `sets` | A list of [set](#set-properties). | | 28 | | `maps` | A list of [map](#map-properties). | | 29 | | `verdict_maps` | A list of [verdict_map](#verdict_map-properties). | | 30 | | `chains` | A list of [chain](#chain-properties). | | 31 | 32 | [Documentation](https://manpages.debian.org/testing/nftables/nftables.8.en.html#TABLES) 33 | 34 | 35 | ### set properties 36 | 37 | | Property name | Description | 38 | | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | 39 | | **`name`** | Name of the set. | 40 | | **`type`** | Type of the elements contained in the set. Must be either `ipv4_addr`, `ipv6_addr`, `ether_addr`, `inet_service`, `inet_proto`, `icmp_type`, `icmpv6_type` or `mark`. | 41 | | `size` | Number of elements the set can contain. | 42 | | `policy` | The set selection policy. If specified, must be either `performance` or `memory`. | 43 | | `timeout` | How long the elements stay in the set. | 44 | | `flags` | A list of flags. If specified, must contain at least one of the following : `constant`, `interval`, `timeout`. | 45 | | `gc_interval` | Garbage collection interval. | 46 | | `elements` | A list of elements contained in the set. Elements must conform to the set `type`. | 47 | 48 | [Documentation](https://manpages.debian.org/nftables/nftables.8.en.html#SETS) 49 | 50 | 51 | ### map properties 52 | 53 | | Property name | Description | 54 | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | 55 | | **`name`** | Name of the map. | 56 | | **`keys_type`** | Type of the keys. Must be either `ipv4_addr`, `ipv6_addr`, `ether_addr`, `inet_service`, `inet_proto`, `icmp_type`, `icmpv6_type` or `mark`. | 57 | | **`values_type`** | Type of the values. Must be either `ipv4_addr`, `ipv6_addr`, `ether_addr`, `inet_service`, `inet_proto`, `mark`, `counter` or `quota`. | 58 | | `elements` | A list of [elements](#map-element-properties) contained in the map. Elements must conform to the map `keys_type` and `values_type`. | 59 | 60 | [Documentation](https://manpages.debian.org/nftables/nftables.8.en.html#MAPS) 61 | 62 | #### map element properties 63 | 64 | | Property name | Description | 65 | | --------------- | ------------------------------ | 66 | | **`key`** | Key value. | 67 | | **`value`** | Value associated with the key. | 68 | 69 | 70 | ### verdict_map properties 71 | 72 | A `verdict_map` is just a special case of `map` where the `values_type` is always `verdict`. As such, there is no `values_type` property. Also, elements contained in a `verdict_map` have a `verdict` property instead of the `value` property. 73 | 74 | | Property name | Description | 75 | | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | 76 | | **`name`** | Name of the map. | 77 | | **`keys_type`** | Type of the keys. Must be either `ipv4_addr`, `ipv6_addr`, `ether_addr`, `inet_service`, `inet_proto`, `icmp_type`, `icmpv6_type` or `mark`. | 78 | | `elements` | A list of [elements](#verdict_map-element-properties) contained in the verdict map. | 79 | 80 | #### verdict_map element properties 81 | 82 | | Property name | Description | 83 | | --------------- | -------------------------------- | 84 | | **`key`** | Key value. | 85 | | **`verdict`** | Verdict associated with the key. | 86 | 87 | 88 | ### chain properties 89 | 90 | | Property name | Description | 91 | | ------------- | --------------------------------------------------------- | 92 | | **`name`** | Name of the chain. | 93 | | `base` | [Base rule](#base-properties) for the chain. | 94 | | `rules` | List of [rules](#rule-properties) contained in the chain. | 95 | 96 | [Documentation](https://manpages.debian.org/nftables/nftables.8.en.html#CHAINS) 97 | 98 | #### base properties 99 | 100 | | Property name | Description | 101 | | -------------- | ------------------------------------------------------------------------------ | 102 | | **`type`** | The type of the chain. Must be either `filter`, `nat` or `route`. | 103 | | **`hook`** | Hook where the chain is attached. Available values depend on `type`. | 104 | | **`priority`** | Integer determining the order of the chains attached to the same `hook`. | 105 | | `policy` | Default policy for the chain. If specified, must be either `accept` or `drop`. | 106 | 107 | [Documentation](https://manpages.debian.org/nftables/nftables.8.en.html#CHAINS) 108 | 109 | #### rule properties 110 | 111 | [Documentation](https://manpages.debian.org/nftables/nftables.8.en.html#RULES) 112 | 113 | | Property name | Description | 114 | | --------------- | -------------------------------------------------------- | 115 | | **`position`** | Integer determining the order of the rules in the chain. | 116 | | **`statement`** | Rule statement. | 117 | | `comment` | A comment describing the rule. | 118 | 119 | 120 | ## Example 121 | 122 | Here is a small example of what your file should look like. 123 | 124 | **IMPORTANT**: DO NOT use this as your firewall ! 125 | 126 | ```yaml 127 | --- 128 | nftables_flush_ruleset: yes 129 | nftables_config_path: /etc/nftables.rules 130 | nftables_tables: 131 | - name: firewall 132 | family: inet 133 | 134 | sets: 135 | - name: "set1" 136 | type: 137 | size: 10 138 | policy: "performance" 139 | timeout: "1d" 140 | flags: 141 | - "timeout" 142 | - "interval" 143 | gc_interval: "12h" 144 | elements: 145 | - 192.0.2.1 146 | - 192.0.2.2 147 | 148 | maps: 149 | - name: "map1" 150 | keys_type: "inet_service" 151 | values_type: "ipv4_addr" 152 | elements: 153 | - key: ssh 154 | value: "192.0.2.10" 155 | - name: "map2" 156 | keys_type: "inet_service" 157 | values_type: "ipv4_addr" 158 | elements: 159 | - key: ftp 160 | value: "192.0.2.25" 161 | 162 | verdict_maps: 163 | - name: "vmap1" 164 | keys_type: "inet_service" 165 | elements: 166 | - key: "192.0.2.10" 167 | value: "accept" 168 | 169 | chains: 170 | - name: "My input filter" 171 | base: 172 | type: "filter" 173 | hook: "input" 174 | priority: 0 175 | policy: "drop" 176 | rules: 177 | - position: 2 178 | statement: "ct state invalid log prefix 'Invalid_IN: ' drop" 179 | comment: "Log and drop invalid packets." 180 | - position: 1 181 | statement: "iif lo accept" 182 | - position: 3 183 | statement: "ct state {established,related} accept" 184 | 185 | - name: "My output filter" 186 | base: 187 | type: "filter" 188 | hook: "output" 189 | priority: -10 190 | policy: "accept" 191 | rules: 192 | - position: 1 193 | statement: "ip daddr 192.0.2.100 counter" 194 | ... 195 | ``` 196 | 197 | 198 | ## Testing 199 | 200 | Testing involves the following steps: 201 | 1. Check the role syntax 202 | 2. Do a first run 203 | 3. Do a second run and check for idempotence. 204 | 205 | On the following OS: 206 | - Debian 9 207 | - CentOS 7 208 | - Ubuntu 18.04 209 | 210 | 211 | ## Contributing 212 | 213 | Code reviews, patches, comments, bug reports and feature requests are welcome. Please read the [Contributing Guide](CONTRIBUTING.md) for further details. 214 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | --------------------------------------------------------------------------------