1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
|
#!/usr/bin/python
#
# Ansible module to manage IP addresses on fortios devices
# (c) 2017, Benjamin Jolivot <bjolivot@gmail.com>
#
# This file is part of Ansible
#
# Ansible is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# Ansible is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
#
ANSIBLE_METADATA = {
'status': ['preview'],
'supported_by': 'community',
'version': '1.0'
}
DOCUMENTATION = """
---
module: fortios_address_group
version_added: "2.3"
author: "Benjamin Jolivot (@bjolivot)"
short_description: Manage fortios firewall address group objects
description:
- This module provide management of firewall address groups on FortiOS devices.
extends_documentation_fragment: fortios
options:
name:
description:
- Name of the address group.
required: true
aliases:
- group_name
member:
description:
- Member(s) address name to add or delete.
required: true
aliases:
- members
state:
description:
- Specifies if address need to be added or deleted in group.
default: 'present'
choices: ['present', 'absent']
comment:
description:
- free text to describe address group.
notes:
- This module requires pyFG python library.
"""
EXAMPLES = """
- name: Add google DNS address object in dns_servers address group
fortios_address_group:
host: 192.168.0.254
username: admin
password: password
state: present
name: dns_servers
member: google_dns
comment: "Public DNS servers"
- name: Remove yahoo from trusted mail providers
fortios_address_group:
host: 192.168.0.254
username: admin
password: password
state: absent
name: trusted_mail_providers
member: yahoo_server
comment: "Trusted Email providers"
"""
RETURN = """
firewall_address_config:
description: full firewall adresses config string
returned: always
type: string
change_string:
description: The commands executed by the module
returned: only if config changed
type: string
"""
import re
import shlex
from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.pycompat24 import get_exception
from ansible.module_utils.fortios import fortios_argument_spec, fortios_required_if
from ansible.module_utils.fortios import backup
#check for pyFG lib
try:
from pyFG import FortiOS, FortiConfig
from pyFG.exceptions import CommandExecutionException, FailedCommit
HAS_PYFG=True
except:
HAS_PYFG=False
#regex for name validation
#chars must be letters, digits, - , _ , .
#must have between 1 and 63 chars
REG_VALID_NAME=re.compile(r'^[a-zA-Z0-9\.\-_]{1,63}$')
def is_invalid_name(input_str):
return not REG_VALID_NAME.match(input_str)
def main():
#define module params
argument_spec = dict(
state = dict(choices=['present', 'absent'], default='present'),
name = dict(aliases=['group_name'], required=True, type='str'),
member = dict(aliases=['members'], required=True, type='list'),
comment = dict(type='str'),
)
#merge global argument_spec from module_utils/fortios.py
argument_spec.update(fortios_argument_spec)
#declare module
module = AnsibleModule(
argument_spec=argument_spec,
supports_check_mode=True,
required_if=fortios_required_if,
)
#check params
for member in module.params['member'] + [module.params['name']]:
if is_invalid_name(member):
module.fail_json(msg="Bad argument value %s, must contain only letters, digits, -, _, ." % (member))
#prepare return dict
result = dict(changed=False)
# fail if PYFG not present
if not HAS_PYFG:
module.fail_json(msg='Could not import the python library pyFG required by this module')
#define device
f = FortiOS( module.params['host'],
username=module.params['username'],
password=module.params['password'],
timeout=module.params['timeout'],
vdom=module.params['vdom'])
path = 'firewall addrgrp'
#connect
try:
f.open()
except Exception:
e = get_exception()
module.fail_json(msg='Error connecting device. %s' % e)
#get config
try:
f.load_config(path=path)
result['firewall_address_config'] = f.running_config.to_text()
except Exception:
f.close()
e = get_exception()
module.fail_json(msg='Error reading running config. %s' % e)
#load group member list if group exists
group_members = []
try:
group_members = shlex.split(f.running_config[path][module.params['name']].get_param('member'))
except KeyError:
#the group don't exists
pass
#generate target group list
if module.params['state'] == 'absent':
group_members = set(group_members) - set(module.params['member'])
else:
#state == present
group_members = set(group_members) | set(module.params['member'])
#delete group if empty
if not group_members:
f.candidate_config[path].del_block(module.params['name'])
else:
#create addrgrp if not exist (when there is no address group)
if path not in f.candidate_config.to_text():
new_conf = FortiConfig(path,'config')
f.candidate_config[path] = new_conf
#process changes
new_grp = FortiConfig(module.params['name'], 'edit')
new_grp.set_param('member', " ".join(group_members) )
if module.params['comment'] is not None:
new_grp.set_param('comment', '"%s"' % module.params['comment'])
#add to candidate config
f.candidate_config[path][module.params['name']] = new_grp
#compare config
change_string = f.compare_config()
if change_string:
result['change_string'] = change_string
result['changed'] = True
#Commit if not check mode
if change_string and not module.check_mode:
try:
f.commit()
except FailedCommit:
#Something's wrong (rollback is automatic)
f.close()
e = get_exception()
module.fail_json(msg="Unable to commit change, check your args, the error was %s" % e.message)
module.exit_json(**result)
if __name__ == '__main__':
main()
|
