New module - meraki_mx_l7_firewall (#55485)
* Initial commit for meraki_mx_l7_firewall module * Add argument checking * Sanity fixes * Fix crash and improve integration tests * Improved integration tests and coverage * Reformat response data - Module does not match argument structure of API - PR reformats the response to match Ansible arg spec - Improved integration tests * Fix reformatting for diffs * Create rename_* functions - is_update_required() ignores the key id - Meraki expects one of the keys to be id - Function temporarily renames key to appId to get around this * Tweak documentation and tests - Tests now do an include so each task doesn't need delegate_to * Fix which files I'm editing
This commit is contained in:
parent
f8f3986871
commit
3cdc667888
4 changed files with 1009 additions and 0 deletions
506
lib/ansible/modules/network/meraki/meraki_mx_l7_firewall.py
Normal file
506
lib/ansible/modules/network/meraki/meraki_mx_l7_firewall.py
Normal file
|
@ -0,0 +1,506 @@
|
||||||
|
#!/usr/bin/python
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
|
||||||
|
# Copyright: (c) 2019, Kevin Breit (@kbreit) <kevin.breit@kevinbreit.net>
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
|
||||||
|
from __future__ import absolute_import, division, print_function
|
||||||
|
__metaclass__ = type
|
||||||
|
|
||||||
|
ANSIBLE_METADATA = {
|
||||||
|
'metadata_version': '1.1',
|
||||||
|
'status': ['preview'],
|
||||||
|
'supported_by': 'community'
|
||||||
|
}
|
||||||
|
|
||||||
|
DOCUMENTATION = r'''
|
||||||
|
---
|
||||||
|
module: meraki_mx_l7_firewall
|
||||||
|
short_description: Manage MX appliance layer 7 firewalls in the Meraki cloud
|
||||||
|
version_added: "2.9"
|
||||||
|
description:
|
||||||
|
- Allows for creation, management, and visibility into layer 7 firewalls implemented on Meraki MX firewalls.
|
||||||
|
notes:
|
||||||
|
- Module assumes a complete list of firewall rules are passed as a parameter.
|
||||||
|
- If there is interest in this module allowing manipulation of a single firewall rule, please submit an issue against this module.
|
||||||
|
options:
|
||||||
|
state:
|
||||||
|
description:
|
||||||
|
- Query or modify a firewall rule.
|
||||||
|
choices: ['present', 'query']
|
||||||
|
default: present
|
||||||
|
type: str
|
||||||
|
net_name:
|
||||||
|
description:
|
||||||
|
- Name of network which MX firewall is in.
|
||||||
|
type: str
|
||||||
|
net_id:
|
||||||
|
description:
|
||||||
|
- ID of network which MX firewall is in.
|
||||||
|
type: str
|
||||||
|
rules:
|
||||||
|
description:
|
||||||
|
- List of layer 7 firewall rules.
|
||||||
|
type: list
|
||||||
|
suboptions:
|
||||||
|
policy:
|
||||||
|
description:
|
||||||
|
- Policy to apply if rule is hit.
|
||||||
|
choices: [deny]
|
||||||
|
default: deny
|
||||||
|
type: str
|
||||||
|
type:
|
||||||
|
description:
|
||||||
|
- Type of policy to apply.
|
||||||
|
choices: [application,
|
||||||
|
application_category,
|
||||||
|
blacklisted_countries,
|
||||||
|
host,
|
||||||
|
ip_range,
|
||||||
|
port,
|
||||||
|
whitelisted_countries]
|
||||||
|
type: str
|
||||||
|
application:
|
||||||
|
description:
|
||||||
|
- Application to filter.
|
||||||
|
suboptions:
|
||||||
|
name:
|
||||||
|
description:
|
||||||
|
- Name of application to filter as defined by Meraki.
|
||||||
|
type: str
|
||||||
|
id:
|
||||||
|
description:
|
||||||
|
- URI of application as defined by Meraki.
|
||||||
|
type: str
|
||||||
|
application_category:
|
||||||
|
description:
|
||||||
|
- Category of applications to filter.
|
||||||
|
suboptions:
|
||||||
|
name:
|
||||||
|
description:
|
||||||
|
- Name of application category to filter as defined by Meraki.
|
||||||
|
type: str
|
||||||
|
id:
|
||||||
|
description:
|
||||||
|
- URI of application category as defined by Meraki.
|
||||||
|
type: str
|
||||||
|
host:
|
||||||
|
description:
|
||||||
|
- FQDN of host to filter.
|
||||||
|
type: str
|
||||||
|
ip_range:
|
||||||
|
description:
|
||||||
|
- CIDR notation range of IP addresses to apply rule to.
|
||||||
|
- Port can be appended to range with a C(":").
|
||||||
|
type: str
|
||||||
|
port:
|
||||||
|
description:
|
||||||
|
- TCP or UDP based port to filter.
|
||||||
|
type: str
|
||||||
|
countries:
|
||||||
|
description:
|
||||||
|
- List of countries to whitelist or blacklist.
|
||||||
|
- The countries follow the two-letter ISO 3166-1 alpha-2 format.
|
||||||
|
type: list
|
||||||
|
categories:
|
||||||
|
description:
|
||||||
|
- When C(True), specifies that applications and application categories should be queried instead of firewall rules.
|
||||||
|
type: bool
|
||||||
|
author:
|
||||||
|
- Kevin Breit (@kbreit)
|
||||||
|
extends_documentation_fragment: meraki
|
||||||
|
'''
|
||||||
|
|
||||||
|
EXAMPLES = r'''
|
||||||
|
- name: Query firewall rules
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: abc123
|
||||||
|
org_name: YourOrg
|
||||||
|
net_name: YourNet
|
||||||
|
state: query
|
||||||
|
delegate_to: localhost
|
||||||
|
|
||||||
|
- name: Query applications and application categories
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: abc123
|
||||||
|
org_name: YourOrg
|
||||||
|
net_name: YourNet
|
||||||
|
categories: yes
|
||||||
|
state: query
|
||||||
|
delegate_to: localhost
|
||||||
|
|
||||||
|
- name: Set firewall rules
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: abc123
|
||||||
|
org_name: YourOrg
|
||||||
|
net_name: YourNet
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: whitelisted_countries
|
||||||
|
countries:
|
||||||
|
- US
|
||||||
|
- FR
|
||||||
|
- type: blacklisted_countries
|
||||||
|
countries:
|
||||||
|
- CN
|
||||||
|
- policy: deny
|
||||||
|
type: port
|
||||||
|
port: 8080
|
||||||
|
- type: port
|
||||||
|
port: 1234
|
||||||
|
- type: host
|
||||||
|
host: asdf.com
|
||||||
|
- type: application
|
||||||
|
application:
|
||||||
|
id: meraki:layer7/application/205
|
||||||
|
- type: application_category
|
||||||
|
application:
|
||||||
|
id: meraki:layer7/category/24
|
||||||
|
delegate_to: localhost
|
||||||
|
'''
|
||||||
|
|
||||||
|
RETURN = r'''
|
||||||
|
data:
|
||||||
|
description: Firewall rules associated to network.
|
||||||
|
returned: success
|
||||||
|
type: complex
|
||||||
|
contains:
|
||||||
|
rules:
|
||||||
|
description: Ordered list of firewall rules.
|
||||||
|
returned: success, when not querying applications
|
||||||
|
type: list
|
||||||
|
contains:
|
||||||
|
policy:
|
||||||
|
description: Action to apply when rule is hit.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: deny
|
||||||
|
type:
|
||||||
|
description: Type of rule category.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: applications
|
||||||
|
applications:
|
||||||
|
description: List of applications within a category.
|
||||||
|
type: list
|
||||||
|
contains:
|
||||||
|
id:
|
||||||
|
description: URI of application.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: Gmail
|
||||||
|
name:
|
||||||
|
description: Descriptive name of application.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: meraki:layer7/application/4
|
||||||
|
applicationCategory:
|
||||||
|
description: List of application categories within a category.
|
||||||
|
type: list
|
||||||
|
contains:
|
||||||
|
id:
|
||||||
|
description: URI of application.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: Gmail
|
||||||
|
name:
|
||||||
|
description: Descriptive name of application.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: meraki:layer7/application/4
|
||||||
|
port:
|
||||||
|
description: Port number in rule.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: 23
|
||||||
|
ipRange:
|
||||||
|
description: Range of IP addresses in rule.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: 1.1.1.0/23
|
||||||
|
whitelistedCountries:
|
||||||
|
description: Countries to be whitelisted.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: CA
|
||||||
|
blacklistedCountries:
|
||||||
|
description: Countries to be blacklisted.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: RU
|
||||||
|
application_categories:
|
||||||
|
description: List of application categories and applications.
|
||||||
|
type: list
|
||||||
|
returned: success, when querying applications
|
||||||
|
contains:
|
||||||
|
applications:
|
||||||
|
description: List of applications within a category.
|
||||||
|
type: list
|
||||||
|
contains:
|
||||||
|
id:
|
||||||
|
description: URI of application.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: Gmail
|
||||||
|
name:
|
||||||
|
description: Descriptive name of application.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: meraki:layer7/application/4
|
||||||
|
id:
|
||||||
|
description: URI of application category.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: Email
|
||||||
|
name:
|
||||||
|
description: Descriptive name of application category.
|
||||||
|
returned: success
|
||||||
|
type: string
|
||||||
|
sample: layer7/category/1
|
||||||
|
'''
|
||||||
|
|
||||||
|
import copy
|
||||||
|
import os
|
||||||
|
from ansible.module_utils.basic import AnsibleModule, json, env_fallback
|
||||||
|
from ansible.module_utils.common.dict_transformations import recursive_diff
|
||||||
|
from ansible.module_utils.network.meraki.meraki import MerakiModule, meraki_argument_spec
|
||||||
|
|
||||||
|
|
||||||
|
def get_applications(meraki, net_id):
|
||||||
|
path = meraki.construct_path('get_categories', net_id=net_id)
|
||||||
|
return meraki.request(path, method='GET')
|
||||||
|
|
||||||
|
|
||||||
|
def lookup_application(meraki, net_id, application):
|
||||||
|
response = get_applications(meraki, net_id)
|
||||||
|
for category in response['applicationCategories']:
|
||||||
|
if category['name'].lower() == application.lower():
|
||||||
|
return category['id']
|
||||||
|
for app in category['applications']:
|
||||||
|
if app['name'].lower() == application.lower():
|
||||||
|
return app['id']
|
||||||
|
meraki.fail_json(msg="No application or category named {0} found".format(application))
|
||||||
|
|
||||||
|
|
||||||
|
def assemble_payload(meraki, net_id, rule):
|
||||||
|
if rule['type'] == 'application':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': 'application',
|
||||||
|
}
|
||||||
|
if rule['application']['id']:
|
||||||
|
new_rule['value'] = {'id': rule['application']['id']}
|
||||||
|
elif rule['application']['name']:
|
||||||
|
new_rule['value'] = {'id': lookup_application(meraki, net_id, rule['application']['name'])}
|
||||||
|
elif rule['type'] == 'application_category':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': 'applicationCategory',
|
||||||
|
}
|
||||||
|
if rule['application']['id']:
|
||||||
|
new_rule['value'] = {'id': rule['application']['id']}
|
||||||
|
elif rule['application']['name']:
|
||||||
|
new_rule['value'] = {'id': lookup_application(meraki, net_id, rule['application']['name'])}
|
||||||
|
elif rule['type'] == 'ip_range':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': 'ipRange',
|
||||||
|
'value': rule['ip_range']}
|
||||||
|
elif rule['type'] == 'host':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': rule['type'],
|
||||||
|
'value': rule['host']}
|
||||||
|
elif rule['type'] == 'port':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': rule['type'],
|
||||||
|
'value': rule['port']}
|
||||||
|
elif rule['type'] == 'blacklisted_countries':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': 'blacklistedCountries',
|
||||||
|
'value': rule['countries']
|
||||||
|
}
|
||||||
|
elif rule['type'] == 'whitelisted_countries':
|
||||||
|
new_rule = {'policy': rule['policy'],
|
||||||
|
'type': 'whitelistedCountries',
|
||||||
|
'value': rule['countries']
|
||||||
|
}
|
||||||
|
return new_rule
|
||||||
|
|
||||||
|
|
||||||
|
def restructure_response(rules):
|
||||||
|
for rule in rules['rules']:
|
||||||
|
type = rule['type']
|
||||||
|
rule[type] = copy.deepcopy(rule['value'])
|
||||||
|
del rule['value']
|
||||||
|
return rules
|
||||||
|
|
||||||
|
|
||||||
|
def get_rules(meraki, net_id):
|
||||||
|
path = meraki.construct_path('get_all', net_id=net_id)
|
||||||
|
response = meraki.request(path, method='GET')
|
||||||
|
if meraki.status == 200:
|
||||||
|
return response
|
||||||
|
|
||||||
|
|
||||||
|
def rename_id_to_appid(rules):
|
||||||
|
for rule in rules['rules']:
|
||||||
|
print(rule['type'])
|
||||||
|
if rule['type'] == 'application' or rule['type'] == 'applicationCategory':
|
||||||
|
rule['value']['appId'] = rule['value'].pop('id')
|
||||||
|
return rules
|
||||||
|
|
||||||
|
|
||||||
|
def rename_appid_to_id(rules):
|
||||||
|
for rule in rules['rules']:
|
||||||
|
if rule['type'] == 'application' or rule['type'] == 'applicationCategory':
|
||||||
|
rule['value']['id'] = rule['value'].pop('appId')
|
||||||
|
return rules
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
# define the available arguments/parameters that a user can pass to
|
||||||
|
# the module
|
||||||
|
|
||||||
|
application_arg_spec = dict(id=dict(type='str'),
|
||||||
|
name=dict(type='str'),
|
||||||
|
)
|
||||||
|
|
||||||
|
rule_arg_spec = dict(policy=dict(type='str', choices=['deny'], default='deny'),
|
||||||
|
type=dict(type='str', choices=['application',
|
||||||
|
'application_category',
|
||||||
|
'blacklisted_countries',
|
||||||
|
'host',
|
||||||
|
'ip_range',
|
||||||
|
'port',
|
||||||
|
'whitelisted_countries']),
|
||||||
|
ip_range=dict(type='str'),
|
||||||
|
application=dict(type='dict', default=None, options=application_arg_spec),
|
||||||
|
host=dict(type='str'),
|
||||||
|
port=dict(type='str'),
|
||||||
|
countries=dict(type='list'),
|
||||||
|
)
|
||||||
|
|
||||||
|
argument_spec = meraki_argument_spec()
|
||||||
|
argument_spec.update(state=dict(type='str', choices=['present', 'query'], default='present'),
|
||||||
|
net_name=dict(type='str'),
|
||||||
|
net_id=dict(type='str'),
|
||||||
|
rules=dict(type='list', default=None, elements='dict', options=rule_arg_spec),
|
||||||
|
categories=dict(type='bool'),
|
||||||
|
)
|
||||||
|
|
||||||
|
# seed the result dict in the object
|
||||||
|
# we primarily care about changed and state
|
||||||
|
# change is if this module effectively modified the target
|
||||||
|
# state will include any data that you want your module to pass back
|
||||||
|
# for consumption, for example, in a subsequent task
|
||||||
|
result = dict(
|
||||||
|
changed=False,
|
||||||
|
)
|
||||||
|
# the AnsibleModule object will be our abstraction working with Ansible
|
||||||
|
# this includes instantiation, a couple of common attr would be the
|
||||||
|
# args/params passed to the execution, as well as if the module
|
||||||
|
# supports check mode
|
||||||
|
module = AnsibleModule(argument_spec=argument_spec,
|
||||||
|
supports_check_mode=True,
|
||||||
|
)
|
||||||
|
meraki = MerakiModule(module, function='mx_l7_firewall')
|
||||||
|
|
||||||
|
# check for argument completeness
|
||||||
|
if meraki.params['rules']:
|
||||||
|
for rule in meraki.params['rules']:
|
||||||
|
if rule['type'] == 'application' and rule['application'] is None:
|
||||||
|
meraki.fail_json(msg="application argument is required when type is application.")
|
||||||
|
elif rule['type'] == 'application_category' and rule['application'] is None:
|
||||||
|
meraki.fail_json(msg="application argument is required when type is application_category.")
|
||||||
|
elif rule['type'] == 'blacklisted_countries' and rule['countries'] is None:
|
||||||
|
meraki.fail_json(msg="countries argument is required when type is blacklisted_countries.")
|
||||||
|
elif rule['type'] == 'host' and rule['host'] is None:
|
||||||
|
meraki.fail_json(msg="host argument is required when type is host.")
|
||||||
|
elif rule['type'] == 'port' and rule['port'] is None:
|
||||||
|
meraki.fail_json(msg="port argument is required when type is port.")
|
||||||
|
elif rule['type'] == 'whitelisted_countries' and rule['countries'] is None:
|
||||||
|
meraki.fail_json(msg="countries argument is required when type is whitelisted_countries.")
|
||||||
|
|
||||||
|
meraki.params['follow_redirects'] = 'all'
|
||||||
|
|
||||||
|
query_urls = {'mx_l7_firewall': '/networks/{net_id}/l7FirewallRules/'}
|
||||||
|
query_category_urls = {'mx_l7_firewall': '/networks/{net_id}/l7FirewallRules/applicationCategories'}
|
||||||
|
update_urls = {'mx_l7_firewall': '/networks/{net_id}/l7FirewallRules/'}
|
||||||
|
|
||||||
|
meraki.url_catalog['get_all'].update(query_urls)
|
||||||
|
meraki.url_catalog['get_categories'] = (query_category_urls)
|
||||||
|
meraki.url_catalog['update'] = update_urls
|
||||||
|
|
||||||
|
payload = None
|
||||||
|
|
||||||
|
# manipulate or modify the state as needed (this is going to be the
|
||||||
|
# part where your module will do what it needs to do)
|
||||||
|
org_id = meraki.params['org_id']
|
||||||
|
orgs = None
|
||||||
|
if org_id is None:
|
||||||
|
orgs = meraki.get_orgs()
|
||||||
|
for org in orgs:
|
||||||
|
if org['name'] == meraki.params['org_name']:
|
||||||
|
org_id = org['id']
|
||||||
|
net_id = meraki.params['net_id']
|
||||||
|
if net_id is None:
|
||||||
|
if orgs is None:
|
||||||
|
orgs = meraki.get_orgs()
|
||||||
|
net_id = meraki.get_net_id(net_name=meraki.params['net_name'],
|
||||||
|
data=meraki.get_nets(org_id=org_id))
|
||||||
|
|
||||||
|
if meraki.params['state'] == 'query':
|
||||||
|
if meraki.params['categories'] is True: # Output only applications
|
||||||
|
meraki.result['data'] = get_applications(meraki, net_id)
|
||||||
|
else:
|
||||||
|
meraki.result['data'] = restructure_response(get_rules(meraki, net_id))
|
||||||
|
elif meraki.params['state'] == 'present':
|
||||||
|
rules = get_rules(meraki, net_id)
|
||||||
|
path = meraki.construct_path('get_all', net_id=net_id)
|
||||||
|
if meraki.params['rules']:
|
||||||
|
payload = {'rules': []}
|
||||||
|
for rule in meraki.params['rules']:
|
||||||
|
payload['rules'].append(assemble_payload(meraki, net_id, rule))
|
||||||
|
else:
|
||||||
|
payload = dict()
|
||||||
|
|
||||||
|
'''
|
||||||
|
The rename_* functions are needed because the key is id and
|
||||||
|
is_update_required() by default ignores id.
|
||||||
|
'''
|
||||||
|
rules = rename_id_to_appid(rules)
|
||||||
|
payload = rename_id_to_appid(payload)
|
||||||
|
if meraki.is_update_required(rules, payload):
|
||||||
|
rules = rename_appid_to_id(rules)
|
||||||
|
payload = rename_appid_to_id(payload)
|
||||||
|
if meraki.module.check_mode is True:
|
||||||
|
response = restructure_response(payload)
|
||||||
|
diff = recursive_diff(restructure_response(rules), response)
|
||||||
|
meraki.result['diff'] = {'before': diff[0],
|
||||||
|
'after': diff[1],
|
||||||
|
}
|
||||||
|
meraki.result['data'] = response
|
||||||
|
meraki.result['changed'] = True
|
||||||
|
meraki.exit_json(**meraki.result)
|
||||||
|
response = meraki.request(path, method='PUT', payload=json.dumps(payload))
|
||||||
|
response = restructure_response(response)
|
||||||
|
if meraki.status == 200:
|
||||||
|
diff = recursive_diff(restructure_response(rules), response)
|
||||||
|
meraki.result['diff'] = {'before': diff[0],
|
||||||
|
'after': diff[1],
|
||||||
|
}
|
||||||
|
meraki.result['data'] = response
|
||||||
|
meraki.result['changed'] = True
|
||||||
|
else:
|
||||||
|
rules = rename_appid_to_id(rules)
|
||||||
|
payload = rename_appid_to_id(payload)
|
||||||
|
if meraki.module.check_mode is True:
|
||||||
|
meraki.result['data'] = rules
|
||||||
|
meraki.result['changed'] = False
|
||||||
|
meraki.exit_json(**meraki.result)
|
||||||
|
meraki.result['data'] = payload
|
||||||
|
|
||||||
|
# in the event of a successful module execution, you will want to
|
||||||
|
# simple AnsibleModule.exit_json(), passing the key/value results
|
||||||
|
meraki.exit_json(**meraki.result)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == '__main__':
|
||||||
|
main()
|
2
test/integration/targets/meraki_mx_l7_firewall/aliases
Normal file
2
test/integration/targets/meraki_mx_l7_firewall/aliases
Normal file
|
@ -0,0 +1,2 @@
|
||||||
|
unsupported
|
||||||
|
|
|
@ -0,0 +1,7 @@
|
||||||
|
# Test code for the Meraki Organization module
|
||||||
|
# Copyright: (c) 2018, Kevin Breit (@kbreit)
|
||||||
|
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
---
|
||||||
|
- name: Run test cases
|
||||||
|
include: tests.yml ansible_connection=local
|
494
test/integration/targets/meraki_mx_l7_firewall/tasks/tests.yml
Normal file
494
test/integration/targets/meraki_mx_l7_firewall/tasks/tests.yml
Normal file
|
@ -0,0 +1,494 @@
|
||||||
|
# Test code for the Meraki Organization module
|
||||||
|
# Copyright: (c) 2018, Kevin Breit (@kbreit)
|
||||||
|
|
||||||
|
# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
|
||||||
|
---
|
||||||
|
- block:
|
||||||
|
- name: Test an API key is provided
|
||||||
|
fail:
|
||||||
|
msg: Please define an API key
|
||||||
|
when: auth_key is not defined
|
||||||
|
|
||||||
|
- name: Create network
|
||||||
|
meraki_network:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
type: appliance
|
||||||
|
|
||||||
|
- name: Query firewall rules
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: query
|
||||||
|
register: query
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: query
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- query.data is defined
|
||||||
|
|
||||||
|
- name: Query firewall application categories
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: query
|
||||||
|
categories: yes
|
||||||
|
register: query_categories
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- query_categories.data is defined
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range in check mode
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range_check
|
||||||
|
check_mode: yes
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: create_ip_range_check
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range_check is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: create_ip_range
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range is changed
|
||||||
|
- create_ip_range.data.rules | length == 1
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range with idempotency with check mode
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range_idempotent_check
|
||||||
|
check_mode: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range_idempotent_check is not changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range with idempotency
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range_idempotent
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range_idempotent is not changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP and port
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.1:23
|
||||||
|
register: create_ip_range_port
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: create_ip_range_port
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range_port is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: create_ip_range
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range is changed
|
||||||
|
- create_ip_range.data.rules | length == 1
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range with idempotency with check mode
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range_idempotent_check
|
||||||
|
check_mode: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range_idempotent_check is not changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for IP range with idempotency
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: ip_range
|
||||||
|
ip_range: 10.11.12.0/24
|
||||||
|
register: create_ip_range_idempotent
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- create_ip_range_idempotent is not changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for application
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application
|
||||||
|
application:
|
||||||
|
name: facebook
|
||||||
|
register: application_rule
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- application_rule is changed
|
||||||
|
- application_rule.data.rules is defined
|
||||||
|
|
||||||
|
- name: Create firewall rule for application via ID
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application
|
||||||
|
application:
|
||||||
|
id: meraki:layer7/application/205
|
||||||
|
register: application_rule_id
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- application_rule_id is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for invalid application
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application
|
||||||
|
application:
|
||||||
|
name: ansible
|
||||||
|
register: application_rule_invalid
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- name: Create firewall rule for application category
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application_category
|
||||||
|
application:
|
||||||
|
name: Advertising
|
||||||
|
register: application_category_rule
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: application_category_rule
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- application_category_rule is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for application category with ID and conflict
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application_category
|
||||||
|
application:
|
||||||
|
id: meraki:layer7/category/27
|
||||||
|
register: application_category_rule_id_conflict
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- application_category_rule_id_conflict is not changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for application category with ID
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application_category
|
||||||
|
application:
|
||||||
|
id: meraki:layer7/category/24
|
||||||
|
register: application_category_rule_id
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- application_category_rule_id is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for host
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: host
|
||||||
|
host: asdf.com
|
||||||
|
register: host_rule
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- host_rule is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for port
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: port
|
||||||
|
port: 1234
|
||||||
|
register: port_rule
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- port_rule is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for blacklisted countries
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: blacklisted_countries
|
||||||
|
countries:
|
||||||
|
- CA
|
||||||
|
- AX
|
||||||
|
register: blacklist_countries
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- blacklist_countries is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for whitelisted countries
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: whitelisted_countries
|
||||||
|
countries:
|
||||||
|
- US
|
||||||
|
- FR
|
||||||
|
register: whitelist_countries
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- whitelist_countries is changed
|
||||||
|
|
||||||
|
- name: Create firewall rule for whitelisted countries with idempotency
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: whitelisted_countries
|
||||||
|
countries:
|
||||||
|
- US
|
||||||
|
- FR
|
||||||
|
register: whitelist_countries_idempotent
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- whitelist_countries_idempotent is not changed
|
||||||
|
|
||||||
|
- name: Create multiple firewall rules
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application_category
|
||||||
|
application:
|
||||||
|
id: meraki:layer7/category/27
|
||||||
|
- type: blacklisted_countries
|
||||||
|
countries:
|
||||||
|
- CN
|
||||||
|
- policy: deny
|
||||||
|
type: port
|
||||||
|
port: 8080
|
||||||
|
register: multiple_rules
|
||||||
|
|
||||||
|
- debug:
|
||||||
|
var: multiple_rules
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- multiple_rules.data.rules | length == 3
|
||||||
|
- multiple_rules is changed
|
||||||
|
|
||||||
|
#########################################
|
||||||
|
## Tests for argument completeness ##
|
||||||
|
#########################################
|
||||||
|
|
||||||
|
- name: Test whitelisted_countries incomplete arguments
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: whitelisted_countries
|
||||||
|
register: error_whitelist
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- 'error_whitelist.msg == "countries argument is required when type is whitelisted_countries."'
|
||||||
|
|
||||||
|
- name: Test blacklisted_countries incomplete arguments
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: blacklisted_countries
|
||||||
|
register: error_blacklist
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- 'error_blacklist.msg == "countries argument is required when type is blacklisted_countries."'
|
||||||
|
|
||||||
|
- name: Test application_category incomplete arguments
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application_category
|
||||||
|
register: error_app_cat
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- 'error_app_cat.msg == "application argument is required when type is application_category."'
|
||||||
|
|
||||||
|
- name: Test application incomplete arguments
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: application
|
||||||
|
register: error_app_cat
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- 'error_app_cat.msg == "application argument is required when type is application."'
|
||||||
|
|
||||||
|
- name: Test host incomplete arguments
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: host
|
||||||
|
register: error_app_cat
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- 'error_app_cat.msg == "host argument is required when type is host."'
|
||||||
|
|
||||||
|
- name: Test port incomplete arguments
|
||||||
|
meraki_mx_l7_firewall:
|
||||||
|
auth_key: '{{ auth_key }}'
|
||||||
|
org_name: '{{test_org_name}}'
|
||||||
|
net_name: TestNetAppliance
|
||||||
|
state: present
|
||||||
|
rules:
|
||||||
|
- type: port
|
||||||
|
register: error_app_cat
|
||||||
|
ignore_errors: yes
|
||||||
|
|
||||||
|
- assert:
|
||||||
|
that:
|
||||||
|
- 'error_app_cat.msg == "port argument is required when type is port."'
|
||||||
|
|
||||||
|
#################
|
||||||
|
## Cleanup ##
|
||||||
|
#################
|
||||||
|
|
||||||
|
# always:
|
||||||
|
# - name: Delete network
|
||||||
|
# meraki_network:
|
||||||
|
# auth_key: '{{ auth_key }}'
|
||||||
|
# org_name: '{{test_org_name}}'
|
||||||
|
# net_name: TestNetAppliance
|
||||||
|
# state: absent
|
||||||
|
# delegate_to: localhost
|
Loading…
Reference in a new issue