-
-
Notifications
You must be signed in to change notification settings - Fork 42
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
f057c97
commit 5e0578b
Showing
10 changed files
with
427 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| from ansible.module_utils.basic import AnsibleModule | ||
|
|
||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.base.api import \ | ||
| Session | ||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.base.cls import BaseModule | ||
|
|
||
|
|
||
| class Rule(BaseModule): | ||
| FIELD_ID = 'description' | ||
| CMDS = { | ||
| 'add': 'addUserRule', | ||
| 'set': 'setUserRule', | ||
| 'del': 'delUserRule', | ||
| 'search': 'searchUserRule', | ||
| 'detail': 'getUserRule', | ||
| 'toggle': 'toggleUserRule', | ||
| } | ||
| API_KEY = 'rule' | ||
| API_KEY_PATH = f'userDefinedRules.{API_KEY}' | ||
| API_MOD = 'ids' | ||
| API_CONT = 'settings' | ||
| API_CONT_REL = 'service' | ||
| API_CMD_REL = 'reloadRules' | ||
| FIELDS_CHANGE = ['source_ip', 'destination_ip', 'ssl_fingerprint', 'action', 'bypass'] | ||
| FIELDS_ALL = ['enabled', FIELD_ID] | ||
| FIELDS_ALL.extend(FIELDS_CHANGE) | ||
| FIELDS_TRANSLATE = { | ||
| 'source_ip': 'source', | ||
| 'destination_ip': 'destination', | ||
| 'ssl_fingerprint': 'fingerprint', | ||
| } | ||
| FIELDS_TYPING = { | ||
| 'bool': ['enabled', 'bypass'], | ||
| 'select': ['action'], | ||
| } | ||
| EXIST_ATTR = 'rule' | ||
| QUERY_MAX_RULES = 5000 | ||
|
|
||
| def __init__(self, module: AnsibleModule, result: dict, session: Session = None): | ||
| BaseModule.__init__(self=self, m=module, r=result, s=session) | ||
| self.rule = {} | ||
| self.exists = False | ||
|
|
||
| def check(self): | ||
| self._search_call() | ||
| self.r['diff']['after'] = self.b.build_diff(data=self.p) | ||
|
|
||
| def get_existing(self) -> list: | ||
| return self._search_call() | ||
|
|
||
| def _search_call(self) -> list: | ||
| # NOTE: workaround for issue with incomplete response-data from 'get' endpoint: | ||
| # https://github.com/opnsense/core/issues/7094 | ||
| existing = self.s.post(cnf={ | ||
| **self.call_cnf, | ||
| 'command': self.CMDS['search'], | ||
| 'data': {'current': 1, 'rowCount': self.QUERY_MAX_RULES, 'sort': self.FIELD_ID}, | ||
| })['rows'] | ||
|
|
||
| if self.FIELD_ID in self.p: # list module | ||
| for rule in existing: | ||
| if rule[self.FIELD_ID] == self.p[self.FIELD_ID]: | ||
| self.exists = True | ||
| self.call_cnf['params'] = [rule['uuid']] | ||
| # pylint: disable=W0212 | ||
| self.rule = self.b._simplify_existing( | ||
| self.s.get(cnf={ | ||
| **self.call_cnf, | ||
| 'command': self.CMDS['detail'], | ||
| })[self.API_KEY] | ||
| ) | ||
| self.rule['uuid'] = rule['uuid'] | ||
| self.r['diff']['before'] = self.rule | ||
|
|
||
| return existing |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| #!/usr/bin/env python3 | ||
|
|
||
| # Copyright: (C) 2023, AnsibleGuy <guy@ansibleguy.net> | ||
| # GNU General Public License v3.0+ (see https://www.gnu.org/licenses/gpl-3.0.txt) | ||
|
|
||
| # see: https://docs.opnsense.org/development/api/core/ids.html | ||
|
|
||
| from ansible.module_utils.basic import AnsibleModule | ||
|
|
||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.base.handler import \ | ||
| module_dependency_error, MODULE_EXCEPTIONS | ||
|
|
||
| try: | ||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.helper.wrapper import module_wrapper | ||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.helper.main import \ | ||
| diff_remove_empty | ||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.defaults.main import \ | ||
| OPN_MOD_ARGS, STATE_MOD_ARG, RELOAD_MOD_ARG | ||
| from ansible_collections.ansibleguy.opnsense.plugins.module_utils.main.ids_user_rule import Rule | ||
|
|
||
| except MODULE_EXCEPTIONS: | ||
| module_dependency_error() | ||
|
|
||
|
|
||
| # DOCUMENTATION = 'https://opnsense.ansibleguy.net/en/latest/modules/ids.html' | ||
| # EXAMPLES = 'https://opnsense.ansibleguy.net/en/latest/modules/ids.html' | ||
|
|
||
|
|
||
| def run_module(): | ||
| module_args = dict( | ||
| description=dict( | ||
| type='str', required=True, aliases=['name', 'desc'], | ||
| description='Unique rule name', | ||
| ), | ||
| source_ip=dict( | ||
| type='str', required=False, aliases=['source', 'src_ip', 'src'], default='', | ||
| description="Set the source IP or network to match. Leave this field empty for using 'any'", | ||
| ), | ||
| destination_ip=dict( | ||
| type='str', required=False, aliases=['destination', 'dst_ip', 'dst'], default='', | ||
| description="Set the destination IP or network to match. Leave this field empty for using 'any'", | ||
| ), | ||
| ssl_fingerprint=dict( | ||
| type='str', required=False, aliases=['fingerprint', 'ssl_fp'], default='', | ||
| description="The SSL fingerprint, for example: " | ||
| "'B5:E1:B3:70:5E:7C:FF:EB:92:C4:29:E5:5B:AC:2F:AE:70:17:E9:9E'", | ||
| ), | ||
| action=dict( | ||
| type='str', required=False, aliases=['a'], default='alert', | ||
| choices=['alert', 'drop', 'pass'], | ||
| description='Set action to perform here, only used when in IPS mode', | ||
| ), | ||
| bypass=dict( | ||
| type='bool', required=False, aliases=['bp'], default=False, | ||
| description='Set bypass keyword. Increases traffic throughput. Suricata reads a packet, ' | ||
| 'decodes it, checks it in the flow table. If the corresponding flow is local ' | ||
| 'bypassed then it simply skips all streaming, detection and output and the packet ' | ||
| 'goes directly out in IDS mode and to verdict in IPS mode', | ||
| ), | ||
| **STATE_MOD_ARG, | ||
| **RELOAD_MOD_ARG, | ||
| **OPN_MOD_ARGS, | ||
| ) | ||
|
|
||
| result = dict( | ||
| changed=False, | ||
| diff={ | ||
| 'before': {}, | ||
| 'after': {}, | ||
| } | ||
| ) | ||
|
|
||
| module = AnsibleModule( | ||
| argument_spec=module_args, | ||
| supports_check_mode=True, | ||
| ) | ||
|
|
||
| module_wrapper(Rule(module=module, result=result)) | ||
|
|
||
| result['diff'] = diff_remove_empty(result['diff']) | ||
| module.exit_json(**result) | ||
|
|
||
|
|
||
| def main(): | ||
| run_module() | ||
|
|
||
|
|
||
| if __name__ == '__main__': | ||
| main() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.