From 9b8abc8a7fc677bd2ab58bbe19b228de533bf303 Mon Sep 17 00:00:00 2001 From: Ivan Bojer Date: Fri, 25 Aug 2017 08:35:35 -0700 Subject: [PATCH] panos_sag: static address group (#28041) * - Create a static address group object in the firewall used for policy rules. * PEP8 changes * add function to check for devicegrp name * fix exception handling * PEP8 fixes * update metadata_version --- CHANGELOG.md | 3 + .../modules/network/panos/panos_sag.py | 284 ++++++++++++++++++ 2 files changed, 287 insertions(+) create mode 100755 lib/ansible/modules/network/panos/panos_sag.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 840e022df5d..9aafdf1c56c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -510,6 +510,9 @@ Ansible Changes By Release * github_issue #### Storage + * nuage_vpsk +- panos + * panos_sag - purestorage * purefa_hg * purefa_host diff --git a/lib/ansible/modules/network/panos/panos_sag.py b/lib/ansible/modules/network/panos/panos_sag.py new file mode 100755 index 00000000000..f50c9eb824d --- /dev/null +++ b/lib/ansible/modules/network/panos/panos_sag.py @@ -0,0 +1,284 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage PaloAltoNetworks Firewall +# (c) 2016, techbizdev +# +# This file is part of Ansible +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . + +DOCUMENTATION = ''' +--- +module: panos_sag +short_description: Create a static address group. +description: + - Create a static address group object in the firewall used for policy rules. +author: "Vinay Venkataraghavan @vinayvenkat" +version_added: "2.4" +requirements: + - pan-python can be obtained from PyPi U(https://pypi.python.org/pypi/pan-python) + - pandevice can be obtained from PyPi U(https://pypi.python.org/pypi/pandevice) + - xmltodict can be obtained from PyPi U(https://pypi.python.org/pypi/xmltodict) +options: + ip_address: + description: + - IP address (or hostname) of PAN-OS device + required: true + default: null + password: + description: + - password for authentication + required: true + default: null + username: + description: + - username for authentication + required: false + default: "admin" + api_key: + description: + - API key that can be used instead of I(username)/I(password) credentials. + sag_name: + description: + - name of the dynamic address group + required: true + default: null + static_match_filter: + description: + - Static filter user by the address group + required: true + default: null + devicegroup: + description: > + - The name of the Panorama device group. The group must exist on Panorama. If device group is not defined + it is assumed that we are contacting a firewall. + required: false + default: None + description: + description: + - The purpose / objective of the static Address Group + required: false + default: null + tags: + description: + - Tags to be associated with the address group + required: false + default: null + commit: + description: + - commit if changed + required: false + default: true + operation: + description: + - The operation to perform Supported values are I(add)/I(list)/I(delete). + required: true + default: null +''' + +EXAMPLES = ''' +- name: sag + panos_sag: + ip_address: "192.168.1.1" + password: "admin" + sag_name: "sag-1" + static_value: ['test-addresses', ] + description: "A description for the static address group" + tags: ["tags to be associated with the group", ] +''' + +RETURN = ''' +# Default return values +''' + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +from ansible.module_utils.basic import AnsibleModule, get_exception + +try: + from pandevice import base + from pandevice import firewall + from pandevice import panorama + from pandevice import objects + HAS_LIB = True +except ImportError: + HAS_LIB = False + + +def get_devicegroup(device, devicegroup): + dg_list = device.refresh_devices() + for group in dg_list: + if isinstance(group, panorama.DeviceGroup): + if group.name == devicegroup: + return group + return False + + +def find_object(device, dev_group, obj_name, obj_type): + # Get the firewall objects + obj_type.refreshall(device) + if isinstance(device, firewall.Firewall): + addr = device.find(obj_name, obj_type) + return addr + elif isinstance(device, panorama.Panorama): + addr = device.find(obj_name, obj_type) + if addr is None: + if dev_group: + device.add(dev_group) + obj_type.refreshall(dev_group) + addr = dev_group.find(obj_name, obj_type) + return addr + else: + return False + + +def create_address_group_object(**kwargs): + """ + Create an Address object + + :param kwargs: key word arguments to instantiate AddressGroup object + @return False or ```objects.AddressObject``` + """ + ad_object = objects.AddressGroup( + name=kwargs['address_gp_name'], + static_value=kwargs['sag_match_filter'], + description=kwargs['description'], + tag=kwargs['tag_name'] + ) + if ad_object.static_value or ad_object.dynamic_value: + return ad_object + else: + return None + + +def add_address_group(device, dev_group, ag_object): + """ + Create a new dynamic address group object on the + PAN FW. + + :param device: Firewall Handle + :param dev_group: Panorama device group + :param ag_object: Address group object + """ + + if dev_group: + dev_group.add(ag_object) + else: + device.add(ag_object) + + exc = None + try: + ag_object.create() + except Exception: + exc = get_exception() + return False, exc + + return True, exc + + +def delete_address_group(device, dev_group, obj_name): + """ + + :param device: + :param dev_group: + :param obj_name: + :return: + """ + static_obj = find_object(device, dev_group, obj_name, objects.AddressGroup) + # If found, delete it + + if static_obj: + try: + static_obj.delete() + except Exception: + exc = get_exception() + return False, exc + return True, None + else: + return False, None + + +def main(): + argument_spec = dict( + ip_address=dict(required=True), + password=dict(required=True), + username=dict(default='admin'), + api_key=dict(no_log=True), + sag_match_filter=dict(type='list', required=False), + sag_name=dict(required=True), + commit=dict(type='bool', default=True), + devicegroup=dict(default=None), + description=dict(default=None), + tags=dict(type='list', default=[]), + operation=dict(type='str', required=True, choices=['add', 'list', 'delete']) + ) + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=False, + required_one_of=[['api_key', 'password']]) + if not HAS_LIB: + module.fail_json(msg='pan-python is required for this module') + + ip_address = module.params["ip_address"] + password = module.params["password"] + username = module.params['username'] + api_key = module.params['api_key'] + operation = module.params['operation'] + + ag_object = create_address_group_object(address_gp_name=module.params.get('sag_name', None), + sag_match_filter=module.params.get('sag_match_filter', None), + description=module.params.get('description', None), + tag_name=module.params.get('tags', None) + ) + commit = module.params['commit'] + + devicegroup = module.params['devicegroup'] + # Create the device with the appropriate pandevice type + device = base.PanDevice.create_from_device(ip_address, username, password, api_key=api_key) + + # If Panorama, validate the devicegroup + dev_group = None + if devicegroup and isinstance(device, panorama.Panorama): + dev_group = get_devicegroup(device, devicegroup) + if dev_group: + device.add(dev_group) + else: + module.fail_json(msg='\'%s\' device group not found in Panorama. Is the name correct?' % devicegroup) + + if operation == 'add': + result, exc = add_address_group(device, dev_group, ag_object) + + if result and commit: + try: + device.commit(sync=True) + except Exception: + exc = get_exception() + module.fail_json(msg=exc.message) + + elif operation == 'delete': + obj_name = module.params.get('sag_name', None) + result, exc = delete_address_group(device, dev_group, obj_name) + if not result and exc: + module.fail_json(msg=exc.message) + elif not result: + module.fail_json(msg="Specified object not found.") + else: + module.fail_json(changed=False, msg="Unsupported option.") + + module.exit_json(changed=True, msg="Address Group Operation Completed.") + + +if __name__ == '__main__': + main()