1#!/usr/local/bin/python3.8 2from __future__ import (absolute_import, division, print_function) 3# Copyright 2019-2020 Fortinet, Inc. 4# 5# This program is free software: you can redistribute it and/or modify 6# it under the terms of the GNU General Public License as published by 7# the Free Software Foundation, either version 3 of the License, or 8# (at your option) any later version. 9# 10# This program is distributed in the hope that it will be useful, 11# but WITHOUT ANY WARRANTY; without even the implied warranty of 12# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13# GNU General Public License for more details. 14# 15# You should have received a copy of the GNU General Public License 16# along with this program. If not, see <https://www.gnu.org/licenses/>. 17 18__metaclass__ = type 19 20ANSIBLE_METADATA = {'status': ['preview'], 21 'supported_by': 'community', 22 'metadata_version': '1.1'} 23 24DOCUMENTATION = ''' 25--- 26module: fortios_firewall_access_proxy_virtual_host 27short_description: Configure Access Proxy virtual hosts in Fortinet's FortiOS and FortiGate. 28description: 29 - This module is able to configure a FortiGate or FortiOS (FOS) device by allowing the 30 user to set and modify firewall feature and access_proxy_virtual_host category. 31 Examples include all parameters and values need to be adjusted to datasources before usage. 32 Tested with FOS v6.0.0 33version_added: "2.10" 34author: 35 - Link Zheng (@chillancezen) 36 - Jie Xue (@JieX19) 37 - Hongbin Lu (@fgtdev-hblu) 38 - Frank Shen (@frankshen01) 39 - Miguel Angel Munoz (@mamunozgonzalez) 40 - Nicolas Thomas (@thomnico) 41notes: 42 - Legacy fortiosapi has been deprecated, httpapi is the preferred way to run playbooks 43 44requirements: 45 - ansible>=2.9.0 46options: 47 access_token: 48 description: 49 - Token-based authentication. 50 Generated from GUI of Fortigate. 51 type: str 52 required: false 53 enable_log: 54 description: 55 - Enable/Disable logging for task. 56 type: bool 57 required: false 58 default: false 59 vdom: 60 description: 61 - Virtual domain, among those defined previously. A vdom is a 62 virtual instance of the FortiGate that can be configured and 63 used as a different unit. 64 type: str 65 default: root 66 67 state: 68 description: 69 - Indicates whether to create or remove the object. 70 type: str 71 required: true 72 choices: 73 - present 74 - absent 75 firewall_access_proxy_virtual_host: 76 description: 77 - Configure Access Proxy virtual hosts. 78 default: null 79 type: dict 80 suboptions: 81 host: 82 description: 83 - The host name. 84 type: str 85 host_type: 86 description: 87 - Type of host pattern. 88 type: str 89 choices: 90 - sub-string 91 - wildcard 92 name: 93 description: 94 - Virtual host name. 95 required: true 96 type: str 97 ssl_certificate: 98 description: 99 - SSL certificate for this host. Source vpn.certificate.local.name. 100 type: str 101''' 102 103EXAMPLES = ''' 104- hosts: fortigates 105 collections: 106 - fortinet.fortios 107 connection: httpapi 108 vars: 109 vdom: "root" 110 ansible_httpapi_use_ssl: yes 111 ansible_httpapi_validate_certs: no 112 ansible_httpapi_port: 443 113 tasks: 114 - name: Configure Access Proxy virtual hosts. 115 fortios_firewall_access_proxy_virtual_host: 116 vdom: "{{ vdom }}" 117 state: "present" 118 access_token: "<your_own_value>" 119 firewall_access_proxy_virtual_host: 120 host: "myhostname" 121 host_type: "sub-string" 122 name: "default_name_5" 123 ssl_certificate: "<your_own_value> (source vpn.certificate.local.name)" 124 125''' 126 127RETURN = ''' 128build: 129 description: Build number of the fortigate image 130 returned: always 131 type: str 132 sample: '1547' 133http_method: 134 description: Last method used to provision the content into FortiGate 135 returned: always 136 type: str 137 sample: 'PUT' 138http_status: 139 description: Last result given by FortiGate on last operation applied 140 returned: always 141 type: str 142 sample: "200" 143mkey: 144 description: Master key (id) used in the last call to FortiGate 145 returned: success 146 type: str 147 sample: "id" 148name: 149 description: Name of the table used to fulfill the request 150 returned: always 151 type: str 152 sample: "urlfilter" 153path: 154 description: Path of the table used to fulfill the request 155 returned: always 156 type: str 157 sample: "webfilter" 158revision: 159 description: Internal revision number 160 returned: always 161 type: str 162 sample: "17.0.2.10658" 163serial: 164 description: Serial number of the unit 165 returned: always 166 type: str 167 sample: "FGVMEVYYQT3AB5352" 168status: 169 description: Indication of the operation's result 170 returned: always 171 type: str 172 sample: "success" 173vdom: 174 description: Virtual domain used 175 returned: always 176 type: str 177 sample: "root" 178version: 179 description: Version of the FortiGate 180 returned: always 181 type: str 182 sample: "v5.6.3" 183 184''' 185from ansible.module_utils.basic import AnsibleModule 186from ansible.module_utils.connection import Connection 187from ansible_collections.fortinet.fortios.plugins.module_utils.fortios.fortios import FortiOSHandler 188from ansible_collections.fortinet.fortios.plugins.module_utils.fortios.fortios import check_legacy_fortiosapi 189from ansible_collections.fortinet.fortios.plugins.module_utils.fortios.fortios import schema_to_module_spec 190from ansible_collections.fortinet.fortios.plugins.module_utils.fortios.fortios import check_schema_versioning 191from ansible_collections.fortinet.fortios.plugins.module_utils.fortimanager.common import FAIL_SOCKET_MSG 192from ansible_collections.fortinet.fortios.plugins.module_utils.fortios.comparison import is_same_comparison 193from ansible_collections.fortinet.fortios.plugins.module_utils.fortios.comparison import serialize 194 195 196def filter_firewall_access_proxy_virtual_host_data(json): 197 option_list = ['host', 'host_type', 'name', 198 'ssl_certificate'] 199 dictionary = {} 200 201 for attribute in option_list: 202 if attribute in json and json[attribute] is not None: 203 dictionary[attribute] = json[attribute] 204 205 return dictionary 206 207 208def underscore_to_hyphen(data): 209 if isinstance(data, list): 210 for i, elem in enumerate(data): 211 data[i] = underscore_to_hyphen(elem) 212 elif isinstance(data, dict): 213 new_data = {} 214 for k, v in data.items(): 215 new_data[k.replace('_', '-')] = underscore_to_hyphen(v) 216 data = new_data 217 218 return data 219 220 221def firewall_access_proxy_virtual_host(data, fos): 222 vdom = data['vdom'] 223 224 state = data['state'] 225 226 firewall_access_proxy_virtual_host_data = data['firewall_access_proxy_virtual_host'] 227 filtered_data = underscore_to_hyphen(filter_firewall_access_proxy_virtual_host_data(firewall_access_proxy_virtual_host_data)) 228 229 if state == "present" or state is True: 230 return fos.set('firewall', 231 'access-proxy-virtual-host', 232 data=filtered_data, 233 vdom=vdom) 234 235 elif state == "absent": 236 return fos.delete('firewall', 237 'access-proxy-virtual-host', 238 mkey=filtered_data['name'], 239 vdom=vdom) 240 else: 241 fos._module.fail_json(msg='state must be present or absent!') 242 243 244def is_successful_status(status): 245 return status['status'] == "success" or \ 246 status['http_method'] == "DELETE" and status['http_status'] == 404 247 248 249def fortios_firewall(data, fos): 250 251 if data['firewall_access_proxy_virtual_host']: 252 resp = firewall_access_proxy_virtual_host(data, fos) 253 else: 254 fos._module.fail_json(msg='missing task body: %s' % ('firewall_access_proxy_virtual_host')) 255 256 return not is_successful_status(resp), \ 257 resp['status'] == "success" and \ 258 (resp['revision_changed'] if 'revision_changed' in resp else True), \ 259 resp 260 261 262versioned_schema = { 263 "type": "list", 264 "children": { 265 "ssl_certificate": { 266 "type": "string", 267 "revisions": { 268 "v7.0.0": True 269 } 270 }, 271 "host": { 272 "type": "string", 273 "revisions": { 274 "v7.0.0": True 275 } 276 }, 277 "host_type": { 278 "type": "string", 279 "options": [ 280 { 281 "value": "sub-string", 282 "revisions": { 283 "v7.0.0": True 284 } 285 }, 286 { 287 "value": "wildcard", 288 "revisions": { 289 "v7.0.0": True 290 } 291 } 292 ], 293 "revisions": { 294 "v7.0.0": True 295 } 296 }, 297 "name": { 298 "type": "string", 299 "revisions": { 300 "v7.0.0": True 301 } 302 } 303 }, 304 "revisions": { 305 "v7.0.0": True 306 } 307} 308 309 310def main(): 311 module_spec = schema_to_module_spec(versioned_schema) 312 mkeyname = 'name' 313 fields = { 314 "access_token": {"required": False, "type": "str", "no_log": True}, 315 "enable_log": {"required": False, "type": bool}, 316 "vdom": {"required": False, "type": "str", "default": "root"}, 317 "state": {"required": True, "type": "str", 318 "choices": ["present", "absent"]}, 319 "firewall_access_proxy_virtual_host": { 320 "required": False, "type": "dict", "default": None, 321 "options": { 322 } 323 } 324 } 325 for attribute_name in module_spec['options']: 326 fields["firewall_access_proxy_virtual_host"]['options'][attribute_name] = module_spec['options'][attribute_name] 327 if mkeyname and mkeyname == attribute_name: 328 fields["firewall_access_proxy_virtual_host"]['options'][attribute_name]['required'] = True 329 330 check_legacy_fortiosapi() 331 module = AnsibleModule(argument_spec=fields, 332 supports_check_mode=False) 333 334 versions_check_result = None 335 if module._socket_path: 336 connection = Connection(module._socket_path) 337 if 'access_token' in module.params: 338 connection.set_option('access_token', module.params['access_token']) 339 340 if 'enable_log' in module.params: 341 connection.set_option('enable_log', module.params['enable_log']) 342 else: 343 connection.set_option('enable_log', False) 344 fos = FortiOSHandler(connection, module, mkeyname) 345 versions_check_result = check_schema_versioning(fos, versioned_schema, "firewall_access_proxy_virtual_host") 346 347 is_error, has_changed, result = fortios_firewall(module.params, fos) 348 349 else: 350 module.fail_json(**FAIL_SOCKET_MSG) 351 352 if versions_check_result and versions_check_result['matched'] is False: 353 module.warn("Ansible has detected version mismatch between FortOS system and your playbook, see more details by specifying option -vvv") 354 355 if not is_error: 356 if versions_check_result and versions_check_result['matched'] is False: 357 module.exit_json(changed=has_changed, version_check_warning=versions_check_result, meta=result) 358 else: 359 module.exit_json(changed=has_changed, meta=result) 360 else: 361 if versions_check_result and versions_check_result['matched'] is False: 362 module.fail_json(msg="Error in repo", version_check_warning=versions_check_result, meta=result) 363 else: 364 module.fail_json(msg="Error in repo", meta=result) 365 366 367if __name__ == '__main__': 368 main() 369