Current File : //lib/python2.7/site-packages/salt/proxy/panos.pyc
�
���^c @@ s d Z d d l m Z m Z m Z d d l Z d d l m Z d d l Z
d d l j j
Z d d l m Z d g Z i d d 6Z i Z e j e � Z d Z d � Z d
� Z d � Z d d � Z d
d � Z d � Z d � Z d � Z d � Z! d � Z" d S( u
Proxy Minion interface module for managing Palo Alto firewall devices
=====================================================================
.. versionadded:: 2018.3.0
:codeauthor: ``Spencer Ervin <spencer_ervin@hotmail.com>``
:maturity: new
:depends: none
:platform: unix
This proxy minion enables Palo Alto firewalls (hereafter referred to
as simply 'panos') to be treated individually like a Salt Minion.
The panos proxy leverages the XML API functionality on the Palo Alto
firewall. The Salt proxy must have access to the Palo Alto firewall on
HTTPS (tcp/443).
More in-depth conceptual reading on Proxy Minions can be found in the
:ref:`Proxy Minion <proxy-minion>` section of Salt's
documentation.
Configuration
=============
To use this integration proxy module, please configure the following:
Pillar
------
Proxy minions get their configuration from Salt's Pillar. Every proxy must
have a stanza in Pillar and a reference in the Pillar top-file that matches
the ID. There are four connection options available for the panos proxy module.
- Direct Device (Password)
- Direct Device (API Key)
- Panorama Pass-Through (Password)
- Panorama Pass-Through (API Key)
Direct Device (Password)
------------------------
The direct device configuration configures the proxy to connect directly to
the device with username and password.
.. code-block:: yaml
proxy:
proxytype: panos
host: <ip or dns name of panos host>
username: <panos username>
password: <panos password>
proxytype
^^^^^^^^^
The ``proxytype`` key and value pair is critical, as it tells Salt which
interface to load from the ``proxy`` directory in Salt's install hierarchy,
or from ``/srv/salt/_proxy`` on the Salt Master (if you have created your
own proxy module, for example). To use this panos Proxy Module, set this to
``panos``.
host
^^^^
The location, or ip/dns, of the panos host. Required.
username
^^^^^^^^
The username used to login to the panos host. Required.
password
^^^^^^^^
The password used to login to the panos host. Required.
Direct Device (API Key)
------------------------
Palo Alto devices allow for access to the XML API with a generated 'API key'_
instead of username and password.
.. _API key: https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/get-started-with-the-pan-os-xml-api/get-your-api-key
.. code-block:: yaml
proxy:
proxytype: panos
host: <ip or dns name of panos host>
apikey: <panos generated api key>
proxytype
^^^^^^^^^
The ``proxytype`` key and value pair is critical, as it tells Salt which
interface to load from the ``proxy`` directory in Salt's install hierarchy,
or from ``/srv/salt/_proxy`` on the Salt Master (if you have created your
own proxy module, for example). To use this panos Proxy Module, set this to
``panos``.
host
^^^^
The location, or ip/dns, of the panos host. Required.
apikey
^^^^^^
The generated XML API key for the panos host. Required.
Panorama Pass-Through (Password)
--------------------------------
The Panorama pass-through method sends all connections through the Panorama
management system. It passes the connections to the appropriate device using
the serial number of the Palo Alto firewall.
This option will reduce the number of connections that must be present for the
proxy server. It will only require a connection to the Panorama server.
The username and password will be for authentication to the Panorama server,
not the panos device.
.. code-block:: yaml
proxy:
proxytype: panos
serial: <serial number of panos host>
host: <ip or dns name of the panorama server>
username: <panorama server username>
password: <panorama server password>
proxytype
^^^^^^^^^
The ``proxytype`` key and value pair is critical, as it tells Salt which
interface to load from the ``proxy`` directory in Salt's install hierarchy,
or from ``/srv/salt/_proxy`` on the Salt Master (if you have created your
own proxy module, for example). To use this panos Proxy Module, set this to
``panos``.
serial
^^^^^^
The serial number of the panos host. Required.
host
^^^^
The location, or ip/dns, of the Panorama server. Required.
username
^^^^^^^^
The username used to login to the Panorama server. Required.
password
^^^^^^^^
The password used to login to the Panorama server. Required.
Panorama Pass-Through (API Key)
-------------------------------
The Panorama server can also utilize a generated 'API key'_ for authentication.
.. _API key: https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/get-started-with-the-pan-os-xml-api/get-your-api-key
.. code-block:: yaml
proxy:
proxytype: panos
serial: <serial number of panos host>
host: <ip or dns name of the panorama server>
apikey: <panos generated api key>
proxytype
^^^^^^^^^
The ``proxytype`` key and value pair is critical, as it tells Salt which
interface to load from the ``proxy`` directory in Salt's install hierarchy,
or from ``/srv/salt/_proxy`` on the Salt Master (if you have created your
own proxy module, for example). To use this panos Proxy Module, set this to
``panos``.
serial
^^^^^^
The serial number of the panos host. Required.
host
^^^^
The location, or ip/dns, of the Panorama server. Required.
apikey
^^^^^^^^
The generated XML API key for the Panorama server. Required.
i ( t absolute_importt print_functiont unicode_literalsN( t ElementTree( t sixu panosu Palo Altou vendorc C@ s t S( u7
Only return if all the modules are available.
( t __virtualname__( ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt __virtual__� s c C@ se | j j d d � } | rD | j j d d � | j j d d � n x | D] } t | � } qK W| S( u�
Removes dirtyID tags from the candidate config result. Palo Alto devices will make the candidate configuration with
a dirty ID after a change. This can cause unexpected results when parsing.
u dirtyIdu adminu timeN( t attribt popt Nonet _strip_dirty( t xmltreet dirtyt child( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyR
� s
c C@ s d | d k r! t j d � t Sd | d k rv d | d k rR t j d � t Sd | d k rv t j d � t Sn d j | d d � t d
<| d d t d <d | d k rS| d j d � t d <d | d k r t j d � d
t d <| d j d � t d <q�t j d � d t d <| d j d � t d <| d j d � t d <n� d | d k r�t j d � d t d <| d j d � t d <nE t j d � d t d <| d j d � t d <| d j d � t d <t j d � i d d 6d d 6} t | � t j d � t t d <d S( u�
This function gets called when the proxy starts up. For
panos devices, a determination is made on the connection type
and the appropriate connection details that must be cached.
u hostu proxyu- No 'host' key found in pillar for this proxy.u apikeyu usernameu1 No 'username' key found in pillar for this proxy.u passwordu2 No 'passwords' key found in pillar for this proxy.u https://{0}/api/u urlu serialu/ Selected pan_key method for panos proxy module.u pan_keyu methodu0 Selected pan_pass method for panos proxy module.u pan_passu/ Selected dev_key method for panos proxy module.u dev_keyu0 Selected dev_pass method for panos proxy module.u dev_passu* Attempting to connect to panos proxy host.u opu typeu+ <show><system><info></info></system></show>u cmdu+ Successfully connected to panos proxy host.u initializedN( t logt criticalt Falset formatt DETAILSt gett debugt callt True( t optst query( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt init� sF
c C@ sV d+ } y�t d d k rx i t d d 6} | j | � t d t d d | d d d
d d t d
t d t d t �} nbt d d k r� t d t d d t d d t d d | d d d
d d t d
t d t d t � } n� t d d k rWi t d d 6t d d 6} | j | � t d t d d | d d d
d d t d
t d t d t �} n� t d d k r�i t d d 6} | j | � t d t d d t d d t d d | d d d
d d t d
t d t d t � } n Wn% t k
r} t j j d � � n X| s t j j d � � n t
j | d � d, k rt
j | d � d k ret j j d � � qt
j | d � d k r�t j j d! � � qt
j | d � d" k r�t j j d# � � qt
j | d � d$ k r�t j j d% � � qt j j d � � n t j
| d& � } | d' d( k rF| d) d* k rFt | � } n t j | t � S(- uW
This function captures the query string and sends it to the Palo Alto device.
u methodu dev_keyu apikeyu keyu
http.queryu urlt datat methodu POSTt decode_typeu plaint decodet
verify_sslt statust raise_erroru dev_passt usernameu usernamet passwordu passwordu pan_keyu serialu targetu pan_passu+ Did not receive a valid response from host.u statusu 200u 201u 204u 400u< The server cannot process the request due to a client error.u 401up The server cannot process the request because it lacks valid authentication credentials for the target resource.u 403u, The server refused to authorize the request.u 404u* The requested resource could not be found.u textu typeu configu actionu getN( u 200u 201u 204( R R t updatet __utils__R R t KeyErrort saltt
exceptionst CommandExecutionErrorR t text_typet ETt
fromstringR
t xmlt to_dict( t payloadt rt conditional_payloadt errt xmldata( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyR 3 s�
u 0.0.0c C@ s> d t d k r! t d d } n t S| j d � } | j d � } y� t | d � t | d � k rj t St | d � t | d � k r� t St | d � t | d � k r� t St | d � t | d � k r� t St | d � t | d � k r� t St | d � t | d � k r t St SWn t k
r9} t SXd S( u�
Because different versions of Palo Alto support different command sets, this function
will return true if the current version of Palo Alto supports the required command.
u
sw-versionu grains_cacheu .i i i N( R R t splitt intR t Exception( t required_versiont current_versiont required_version_splitt current_version_splitR1 ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt is_required_version� s* c C@ s t j d t � S( u�
Since grains are loaded in many different places and some of those
places occur before the proxy can be initialized, return whether
our init() function has been called
u initialized( R R R ( ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt initialized� s c C@ sm t j d i � se t t d <y0 i d d 6d d 6} t | � d d t d <Wqe t k
ra } qe Xn t d S( u0
Get the grains from the proxied device
u grains_cacheu opu typeu+ <show><system><info></info></system></show>u cmdu resultu system( R R t GRAINS_CACHER R5 ( R R1 ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt grains� s
c C@ s d t d <t � S( u4
Refresh the grains from the proxied device
u grains_cacheN( R R R= ( ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt grains_refresh� s
c C@ sM y2 i d d 6d d 6} d t | � k r- t St SWn t k
rH } t SXd S( u>
Returns true if the device is reachable, else false.
u opu typeu+ <show><system><info></info></system></show>u cmdu resultN( R R R R5 ( R R1 ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt ping� s c C@ s t j d � d S( u_
Shutdown the connection to the proxy device. For this proxy,
shutdown is a no-op.
u Panos proxy shutdown() called.N( R R ( ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt shutdown� s (# t __doc__t
__future__R R R t loggingt salt._compatR R* t salt.exceptionsR& t salt.utils.xmlutilt utilst xmlutilR, t salt.extR t __proxyenabled__R< R t getLoggert __file__R R R R
R R R R: R; R= R> R? R@ ( ( ( s4 /usr/lib/python2.7/site-packages/salt/proxy/panos.pyt <module>� s*
5 Z $
Mini Shell