File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/panos.cpython-310.pyc
Back
o ;j\� � @ s� d Z ddlZddlZddlZddlZddlmZ e�e �Z dZ dd� Z d�dd�Z d d � Zd d � Zd d� Zdd� Zdd� Zd�dd�Zd�dd�Zdd� Zd�dd�Zd�d d �Zd�d d �Zd�d!d"�Zd�d#d$�Zd%d&� Zd'd(� Z d)d*� Z d+d,� Z d-d.� Z d/d0� Z d1d2� Z!d3d4� Z"d5d6� Z#d7d8� Z$d9d:� Z%d;d<� Z&d=d>� Z'd?d@� Z(dAdB� Z)dCdD� Z*dEdF� Z+d�dHdI�Z,d�dJdK�Z-d�dLdM�Z.d�dNdO�Z/dPdQ� Z0dRdS� Z1dTdU� Z2dVdW� Z3dXdY� Z4dZd[� Z5d\d]� Z6d^d_� Z7d`da� Z8dbdc� Z9ddde� Z:dfdg� Z;dhdi� Z<djdk� Z=dldm� Z>dndo� Z?d�dpdq�Z@d�drds�ZAd�dtdu�ZBd�dvdw�ZCdxdy� ZDdzd{� ZEd|d}� ZFd~d� ZGd�d�� ZHd�d�� ZId�d�� ZJd�d�d��ZKd�d�� ZLd�d�� ZMd�d�� ZNd�d�d��ZOd�d�d��ZPd�d�d��ZQ d�d�d��ZRd�d�� ZSd�d�d��ZTd�d�� ZUd�d�d��ZVd�d�� ZWd�d�d��ZXd�d�d��ZYd�d�� ZZd�d�d��Z[d�d�d��Z\d�d�d��Z]d�d�d��Z^d�d�d��Z_d�d�d��Z`d�d�d��Zad�d�d��Zbd�d�d��Zc d�d�d��Zdd�d�d��Zed�d�d��Zfd�d�d��Zgd�dÄ Zhd�d�dƄZi d�d�dȄZjd�d�dʄZkdS )�a� Module to provide Palo Alto compatibility to Salt :codeauthor: ``Spencer Ervin <spencer_ervin@hotmail.com>`` :maturity: new :depends: none :platform: unix .. versionadded:: 2018.3.0 Configuration ============= This module accepts connection configuration details either as parameters, or as configuration settings in pillar as a Salt proxy. Options passed into opts will be ignored if options are passed into pillar. .. seealso:: :py:mod:`Palo Alto Proxy Module <salt.proxy.panos>` About ===== This execution module was designed to handle connections to a Palo Alto based firewall. This module adds support to send connections directly to the device through the XML API or through a brokered connection to Panorama. � N)�CommandExecutionError�panosc C sD zt jj�� rtd d dkrtW S W dS W dS ty! Y dS w )z0 Will load for the panos proxy minions. �proxyZ proxytyper )FzFThe panos execution module can only be loaded for panos proxy minions.)�salt�utils�platformZis_proxyZ__opts__�__virtualname__�KeyError� r r �F/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/panos.py� __virtual__* s �� ��r c C s~ | st d��td | �}d|v r=d|d v r=|d d }t|�d d d dkr9t�d� t|�d d d dks(t|�S |S )z� Executes a query that requires a job for completion. This function will wait for the job to complete and return the results. z!Query parameters cannot be empty.� panos.call�resultZjob�statusZFIN� )r � __proxy__�get_job�time�sleep)�query�response�jidr r r �_get_job_results: s �r c C � ddd�} t d | �S )z� Prevent other users from changing configuration until the lock is released. CLI Example: .. code-block:: bash salt '*' panos.add_config_lock �opz9<request><config-lock><add></add></config-lock></request>��type�cmdr �r �r r r r �add_config_lockP � � r c C r )z� Get anti-virus information from PaloAlto Networks server CLI Example: .. code-block:: bash salt '*' panos.check_antivirus r zN<request><anti-virus><upgrade><check></check></upgrade></anti-virus></request>r r r r r r r �check_antivirusc r! r" c C r )z� Get software information from PaloAlto Networks server. CLI Example: .. code-block:: bash salt '*' panos.check_software r zH<request><system><software><check></check></software></system></request>r r r r r r r �check_softwarev s � r# c C r )zy Clear all commit tasks. CLI Example: .. code-block:: bash salt '*' panos.clear_commit_tasks r z<<request><clear-commit-tasks></clear-commit-tasks></request>r r r r r r r �clear_commit_tasks� r! r$ c C � ddd�} t | �S )z� Commits the candidate configuration to the running configuration. CLI Example: .. code-block:: bash salt '*' panos.commit �commitz<commit></commit>r �r r r r r r& � s r& c C sB d}t d |�sdd�|�fS | sdS dd�| �d�}t d |�S ) a Deactivates an installed license. Required version 7.0.0 or greater. key_name(str): The file name of the license key installed. CLI Example: .. code-block:: bash salt '*' panos.deactivate_license key_name=License_File_Name.key �7.0.0�panos.is_required_versionF�AThe panos device requires version {} or greater for this command.�Fz You must specify a key_name.r zr<request><license><deactivate><key><features><member>{}</member></features></key></deactivate></license></request>r r �r �format)�key_name�_required_versionr r r r �deactivate_license� s ��� r0 c C s& | sdS dd| � d�d�}t d |�S )z� Remove license keys on disk. key_name(str): The file name of the license key to be deleted. CLI Example: .. code-block:: bash salt '*' panos.delete_license key_name=License_File_Name.key r+ r z<delete><license><key>z</key></license></delete>r r r )r. r r r r �delete_license� s � r1 c C r% )z� Download the most recent anti-virus package. CLI Example: .. code-block:: bash salt '*' panos.download_antivirus r ze<request><anti-virus><upgrade><download><latest></latest></download></upgrade></anti-virus></request>r r' r r r r �download_antivirus� s �r2 Fc C �V | st d��t|t�st d��|du r dd�| �d�}t|�S dd�| �d�}t|�S )az Download software packages by filename. Args: filename(str): The filename of the PANOS file to download. synch (bool): If true then the file will synch to the peer unit. CLI Example: .. code-block:: bash salt '*' panos.download_software_file PanOS_5000-8.0.0 salt '*' panos.download_software_file PanOS_5000-8.0.0 True z!Filename option must not be none.� Synch option must be boolean..Tr z]<request><system><software><download><file>{}</file></download></software></system></request>r z}<request><system><software><download><sync-to-peer>yes</sync-to-peer><file>{}</file></download></software></system></request>�r � isinstance�boolr- r )�filename�synchr r r r �download_software_file �& ����� r: c C r3 )an Download software packages by version number. Args: version(str): The version of the PANOS file to download. synch (bool): If true then the file will synch to the peer unit. CLI Example: .. code-block:: bash salt '*' panos.download_software_version 8.0.0 salt '*' panos.download_software_version 8.0.0 True � Version option must not be none.r4 Tr zc<request><system><software><download><version>{}</version></download></software></system></request>r z�<request><system><software><download><sync-to-peer>yes</sync-to-peer><version>{}</version></download></software></system></request>r5 )�versionr9 r r r r �download_software_version2 r; r> c C s, | sddd�}ndd� | �d�}td |�S )a Get new license(s) using from the Palo Alto Network Server. auth_code The license authorization code. CLI Example: .. code-block:: bash salt '*' panos.fetch_license salt '*' panos.fetch_license auth_code=foobar r z5<request><license><fetch></fetch></license></request>r zN<request><license><fetch><auth-code>{}</auth-code></fetch></license></request>r �r- r )Z auth_coder r r r � fetch_licensea s �� r@ �1c C � ddd� || �d�}td |�S )a� Get the candidate configuration for the specified get_address object. This will not return address objects that are marked as pre-defined objects. address(str): The name of the address object. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_address myhost salt '*' panos.get_address myhost 3 �config�getzi/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/address/entry[@name='{}']�r �action�xpathr r? )�address�vsysr r r r � get_address� � � rJ c C rB )a� Get the candidate configuration for the specified address group. This will not return address groups that are marked as pre-defined objects. addressgroup(str): The name of the address group. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_address_group foobar salt '*' panos.get_address_group foobar 3 rC rD zo/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/address-group/entry[@name='{}']rE r r? )Z addressgrouprI r r r r �get_address_group� rK rL c C r )z| Show active administrators. CLI Example: .. code-block:: bash salt '*' panos.get_admins_active r z <show><admins></admins></show>r r r r r r r �get_admins_active� � rM c C r )zv Show all administrators. CLI Example: .. code-block:: bash salt '*' panos.get_admins_all r z)<show><admins><all></all></admins></show>r r r r r r r �get_admins_all� rN rO c C r )z� Show information about available anti-virus packages. CLI Example: .. code-block:: bash salt '*' panos.get_antivirus_info r zL<request><anti-virus><upgrade><info></info></upgrade></anti-virus></request>r r r r r r r �get_antivirus_info� r! rP c C r )zl Show ARP information. CLI Example: .. code-block:: bash salt '*' panos.get_arp r z-<show><arp><entry name = 'all'/></arp></show>r r r r r r r �get_arp� rN rQ c C r )z� Show timeout information for this administrative session. CLI Example: .. code-block:: bash salt '*' panos.get_cli_idle_timeout r z5<show><cli><idle-timeout></idle-timeout></cli></show>r r r r r r r �get_cli_idle_timeout� r! rR c C r )z� Show cli administrative permissions. CLI Example: .. code-block:: bash salt '*' panos.get_cli_permissions r z3<show><cli><permissions></permissions></cli></show>r r r r r r r �get_cli_permissions rN rS c C r )z� Report filesystem disk space usage. CLI Example: .. code-block:: bash salt '*' panos.get_disk_usage r z7<show><system><disk-space></disk-space></system></show>r r r r r r r �get_disk_usage! r! rT c C � dddd�} t d | �S )z� Get the DNS server configuration from the candidate configuration. CLI Example: .. code-block:: bash salt '*' panos.get_dns_server_config rC rD z\/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/dns-setting/serversrE r r r r r r �get_dns_server_config4 � � rV c C rU )z� Get the domain name configuration from the candidate configuration. CLI Example: .. code-block:: bash salt '*' panos.get_domain_config rC rD zO/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/domainrE r r r r r r �get_domain_configH rW rX c C r )zz Show the DoS block-ip table. CLI Example: .. code-block:: bash salt '*' panos.get_dos_blocks r z;<show><dos-block-table><all></all></dos-block-table></show>r r r r r r r �get_dos_blocks\ r! rY c C r )z� Print FQDNs used in rules and their IPs. CLI Example: .. code-block:: bash salt '*' panos.get_fqdn_cache r z><request><system><fqdn><show></show></fqdn></system></request>r r r r r r r �get_fqdn_cacheo r! rZ c C rU )z� Get the high availability configuration. CLI Example: .. code-block:: bash salt '*' panos.get_ha_config rC rD zS/config/devices/entry[@name='localhost.localdomain']/deviceconfig/high-availabilityrE r r r r r r � get_ha_config� rW r[ c C r )z� Show high-availability link-monitoring state. CLI Example: .. code-block:: bash salt '*' panos.get_ha_link r zW<show><high-availability><link-monitoring></link-monitoring></high-availability></show>r r r r r r r � get_ha_link� r! r\ c C r )z� Show high-availability path-monitoring state. CLI Example: .. code-block:: bash salt '*' panos.get_ha_path r zW<show><high-availability><path-monitoring></path-monitoring></high-availability></show>r r r r r r r � get_ha_path� r! r] c C r )z� Show high-availability state information. CLI Example: .. code-block:: bash salt '*' panos.get_ha_state r zC<show><high-availability><state></state></high-availability></show>r r r r r r r � get_ha_state� � � r^ c C r )z� Show high-availability transition statistic information. CLI Example: .. code-block:: bash salt '*' panos.get_ha_transitions r zO<show><high-availability><transitions></transitions></high-availability></show>r r r r r r r �get_ha_transitions� r_ r` c C rU )z{ Get the hostname of the device. CLI Example: .. code-block:: bash salt '*' panos.get_hostname rC rD zQ/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/hostnamerE r r r r r r � get_hostname� rW ra �allc C � dd| � d�d�}t d |�S )a= Get the counter statistics for interfaces. Args: name (str): The name of the interface to view. By default, all interface statistics are viewed. CLI Example: .. code-block:: bash salt '*' panos.get_interface_counters salt '*' panos.get_interface_counters ethernet1/1 r z<show><counter><interface>z </interface></counter></show>r r r ��namer r r r �get_interface_counters� � � rf c C rc )a Show interface information. Args: name (str): The name of the interface to view. By default, all interface statistics are viewed. CLI Example: .. code-block:: bash salt '*' panos.get_interfaces salt '*' panos.get_interfaces ethernet1/1 r z<show><interface>z</interface></show>r r r rd r r r �get_interfaces rg rh c C �* | st d��dd| � d�d�}td |�S )z� List all a single job by ID. jid The ID of the job to retrieve. CLI Example: .. code-block:: bash salt '*' panos.get_job jid=15 zID option must not be none.r z<show><jobs><id>z</id></jobs></show>r r �r r )r r r r r r & s r c C s\ | � � dkr ddd�}n | � � dkrddd�}n| � � dkr$ddd�}ntd ��td |�S ) a� List all jobs on the device. state The state of the jobs to display. Valid options are all, pending, or processed. Pending jobs are jobs that are currently in a running or waiting state. Processed jobs are jobs that have completed execution. CLI Example: .. code-block:: bash salt '*' panos.get_jobs salt '*' panos.get_jobs state=pending rb r z%<show><jobs><all></all></jobs></show>r �pendingz-<show><jobs><pending></pending></jobs></show>Z processedz1<show><jobs><processed></processed></jobs></show>z7The state parameter must be all, pending, or processed.r )�lowerr r )�stater r r r �get_jobs< s �� rn c C r )zh Show LACP state. CLI Example: .. code-block:: bash salt '*' panos.get_lacp r zF<show><lacp><aggregate-ethernet>all</aggregate-ethernet></lacp></show>r r r r r r r �get_lacp^ r! ro c C r )z� Show information about owned license(s). CLI Example: .. code-block:: bash salt '*' panos.get_license_info r z3<request><license><info></info></license></request>r r r r r r r �get_license_infoq rN rp c C r )z� Show license token files for manual license deactivation. CLI Example: .. code-block:: bash salt '*' panos.get_license_tokens r z8<show><license-token-files></license-token-files></show>r r r r r r r �get_license_tokens� r! rq c C r )z Show lldp config for interfaces. CLI Example: .. code-block:: bash salt '*' panos.get_lldp_config r z.<show><lldp><config>all</config></lldp></show>r r r r r r r �get_lldp_config� rN rr c C r )z� Show lldp counters for interfaces. CLI Example: .. code-block:: bash salt '*' panos.get_lldp_counters r z2<show><lldp><counters>all</counters></lldp></show>r r r r r r r �get_lldp_counters� rN rs c C r )z� Show lldp local info for interfaces. CLI Example: .. code-block:: bash salt '*' panos.get_lldp_local r z,<show><lldp><local>all</local></lldp></show>r r r r r r r �get_lldp_local� rN rt c C r )z� Show lldp neighbors info for interfaces. CLI Example: .. code-block:: bash salt '*' panos.get_lldp_neighbors r z4<show><lldp><neighbors>all</neighbors></lldp></show>r r r r r r r �get_lldp_neighbors� r! ru c C sv t � } g }d| d vr |S t| d d d t�r,| d d d D ] }|�|d � q |S |�| d d d d � |S )z� Show all local administrator accounts. CLI Example: .. code-block:: bash salt '*' panos.get_local_admins Zusersr �entryre )�get_users_configr6 �list�append)Z admin_listr rv r r r �get_local_admins� s �rz c C r )zw Report the logdb quotas. CLI Example: .. code-block:: bash salt '*' panos.get_logdb_quota r z9<show><system><logdb-quota></logdb-quota></system></show>r r r r r r r �get_logdb_quota� r! r{ c C r )z| Get the master key properties. CLI Example: .. code-block:: bash salt '*' panos.get_master_key r zK<show><system><masterkey-properties></masterkey-properties></system></show>r r r r r r r �get_master_key r! r| c C rU )z� Get the NTP configuration from the candidate configuration. CLI Example: .. code-block:: bash salt '*' panos.get_ntp_config rC rD zT/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-serversrE r r r r r r �get_ntp_config rW r} c C r )z� Get list of configured NTP servers. CLI Example: .. code-block:: bash salt '*' panos.get_ntp_servers r z<show><ntp></ntp></show>r r r r r r r �get_ntp_servers+ rN r~ c C r )z� Show device operational mode setting. CLI Example: .. code-block:: bash salt '*' panos.get_operational_mode r z2<show><operational-mode></operational-mode></show>r r r r r r r �get_operational_mode; rN r c C r )z� Show panorama connection status. CLI Example: .. code-block:: bash salt '*' panos.get_panorama_status r z0<show><panorama-status></panorama-status></show>r r r r r r r �get_panorama_statusK rN r� c C rU )z� Get the IP addresses that are permitted to establish management connections to the device. CLI Example: .. code-block:: bash salt '*' panos.get_permitted_ips rC rD �U/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/permitted-iprE r r r r r r �get_permitted_ips[ rW r� c C rU )z� Get the platform model information and limitations. CLI Example: .. code-block:: bash salt '*' panos.get_platform rC rD z=/config/devices/entry[@name='localhost.localdomain']/platformrE r r r r r r � get_platformo rW r� c C s ddd| � d�d�}t d |�S )a= Get the configuration for the specified pre-defined application object. This will only return pre-defined application objects. application(str): The name of the pre-defined application object. CLI Example: .. code-block:: bash salt '*' panos.get_predefined_application saltstack rC rD z,/config/predefined/application/entry[@name='z']rE r r )� applicationr r r r �get_predefined_application� s � r� c C rB )aG Get the candidate configuration for the specified security rule. rulename(str): The name of the security rule. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_security_rule rule01 salt '*' panos.get_security_rule rule01 3 rC rD zy/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/rulebase/security/rules/entry[@name='{}']rE r r? )ZrulenamerI r r r r �get_security_rule� � � r� c C rB )a� Get the candidate configuration for the specified service object. This will not return services that are marked as pre-defined objects. service(str): The name of the service object. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_service tcp-443 salt '*' panos.get_service tcp-443 3 rC rD zi/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/service/entry[@name='{}']rE r r? )ZservicerI r r r r � get_service� rK r� c C rB )a� Get the candidate configuration for the specified service group. This will not return service groups that are marked as pre-defined objects. servicegroup(str): The name of the service group. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_service_group foobar salt '*' panos.get_service_group foobar 3 rC rD zo/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/service-group/entry[@name='{}']rE r r? )Z servicegrouprI r r r r �get_service_group� rK r� c C r )z Show device session statistics. CLI Example: .. code-block:: bash salt '*' panos.get_session_info r z-<show><session><info></info></session></show>r r r r r r r �get_session_info� rN r� c C rU )z� Get the SNMP configuration from the device. CLI Example: .. code-block:: bash salt '*' panos.get_snmp_config rC rD zU/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/snmp-settingrE r r r r r r �get_snmp_config rW r� c C r )z� Show information about available software packages. CLI Example: .. code-block:: bash salt '*' panos.get_software_info r zF<request><system><software><info></info></software></system></request>r r r r r r r �get_software_info r! r� c C r )z} Get the system date/time. CLI Example: .. code-block:: bash salt '*' panos.get_system_date_time r z <show><clock></clock></show>r r r r r r r �get_system_date_time' rN r� c C r )z� List important files in the system. CLI Example: .. code-block:: bash salt '*' panos.get_system_files r z-<show><system><files></files></system></show>r r r r r r r �get_system_files7 rN r� c C r )zz Get the system information. CLI Example: .. code-block:: bash salt '*' panos.get_system_info r z+<show><system><info></info></system></show>r r r r r r r �get_system_infoG rN r� c C r )zx Show system services. CLI Example: .. code-block:: bash salt '*' panos.get_system_services r z3<show><system><services></services></system></show>r r r r r r r �get_system_servicesW rN r� c C s, | r dd� | �d�}nddd�}td |�S )a/ Show the system state variables. mask Filters by a subtree or a wildcard. CLI Example: .. code-block:: bash salt '*' panos.get_system_state salt '*' panos.get_system_state mask=cfg.ha.config.enabled salt '*' panos.get_system_state mask=cfg.ha.* r z@<show><system><state><filter>{}</filter></state></system></show>r z-<show><system><state></state></system></show>r r? )�maskr r r r �get_system_stateg s �� r� c C s4 d} t d | �sdd�| �fS ddd�}t d |�S ) z� Retrieve a list of all uncommitted changes on the device. Requires PANOS version 8.0.0 or greater. CLI Example: .. code-block:: bash salt '*' panos.get_uncommitted_changes z8.0.0r) Fr* r z><show><config><list><changes></changes></list></config></show>r r r, )r/ r r r r �get_uncommitted_changes� s ��� r� c C rU )z� Get the local administrative user account configuration. CLI Example: .. code-block:: bash salt '*' panos.get_users_config rC rD z/config/mgt-config/usersrE r r r r r r rw � s rw c C r )zs Show all VLAN information. CLI Example: .. code-block:: bash salt '*' panos.get_vlans r z <show><vlan>all</vlan></show>r r r r r r r � get_vlans� rN r� � c C s dd| d�}t d |�S )z� Retrieve a specified xpath from the candidate configuration. xpath(str): The specified xpath in the candidate configuration. CLI Example: .. code-block:: bash salt '*' panos.get_xpath /config/shared/service rC rD rE r r )rG r r r r � get_xpath� s r� c C rB )a Get the candidate configuration for the specified zone. zone(str): The name of the zone. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_zone trust salt '*' panos.get_zone trust 2 rC rD zf/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/zone/entry[@name='{}']rE r r? )�zonerI r r r r �get_zone� r� r� c C s ddd� | �d�}td |�S )z� Get all the zones in the candidate configuration. vsys(str): The string representation of the VSYS ID. CLI Example: .. code-block:: bash salt '*' panos.get_zones salt '*' panos.get_zones 2 rC rD zT/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/zonerE r r? )rI r r r r � get_zones� s � r� c C sv | s |du r t d��|du rd}nd}|du rd}nd}|du r-dd�||�d�}t|�S dd �||| �d�}t|�S ) a Install anti-virus packages. Args: version(str): The version of the PANOS file to install. latest(bool): If true, the latest anti-virus file will be installed. The specified version option will be ignored. synch(bool): If true, the anti-virus will synch to the peer unit. skip_commit(bool): If true, the install will skip committing to the device. CLI Example: .. code-block:: bash salt '*' panos.install_antivirus 8.0.0 Fr< T�yes�nor z�<request><anti-virus><upgrade><install><commit>{}</commit><sync-to-peer>{}</sync-to-peer><version>latest</version></install></upgrade></anti-virus></request>r z�<request><anti-virus><upgrade><install><commit>{}</commit><sync-to-peer>{}</sync-to-peer><version>{}</version></install></upgrade></anti-virus></request>�r r- r )r= Zlatestr9 Z skip_commit�s�cr r r r �install_antivirus s. ����� r� c C r )zz Install the license key(s). CLI Example: .. code-block:: bash salt '*' panos.install_license r z9<request><license><install></install></license></request>r r r r r r r �install_licenseL r! r� c C s$ | st d��dd�| �d�}t|�S )z� Upgrade to a software package by version. Args: version(str): The version of the PANOS file to install. CLI Example: .. code-block:: bash salt '*' panos.install_license 8.0.0 r< r za<request><system><software><install><version>{}</version></install></software></system></request>r r� )r= r r r r �install_software_ s �� r� c C r )zn Reboot a running system. CLI Example: .. code-block:: bash salt '*' panos.reboot r z7<request><restart><system></system></restart></request>r r r r r r r �reboot} r! r� c C s8 t | t�s td��| rddd�}nddd�}td |�S )z� Force refreshes all FQDNs used in rules. force Forces all fqdn refresh CLI Example: .. code-block:: bash salt '*' panos.refresh_fqdn_cache salt '*' panos.refresh_fqdn_cache force=True z Force option must be boolean.r zV<request><system><fqdn><refresh><force>yes</force></refresh></fqdn></system></request>r zD<request><system><fqdn><refresh></refresh></fqdn></system></request>r )r6 r7 r r )�forcer r r r �refresh_fqdn_cache� s �� r� c C r )z� Release config lock previously held. CLI Example: .. code-block:: bash salt '*' panos.remove_config_lock r z?<request><config-lock><remove></remove></config-lock></request>r r r r r r r �remove_config_lock� r! r� c C s^ d}t d |�sdd�|�fS | std��|s dd�| �d�}n dd �|| �d�}t d |�S ) aB Resolve address to ip address. Required version 7.0.0 or greater. address Address name you want to resolve. vsys The vsys name. CLI Example: .. code-block:: bash salt '*' panos.resolve_address foo.bar.com salt '*' panos.resolve_address foo.bar.com vsys=2 r( r) Fr* z,FQDN to resolve must be provided as address.r z;<request><resolve><address>{}</address></resolve></request>r zJ<request><resolve><vsys>{}</vsys><address>{}</address></resolve></request>r )r r- r )rH rI r/ r r r r �resolve_address� s( ����� r� c C ri )z� Save device configuration to a named file. filename The filename to save the configuration to. CLI Example: .. code-block:: bash salt '*' panos.save_device_config foo.xml zFilename must not be empty.r z<save><config><to>z</to></config></save>r r rj )r8 r r r r �save_device_config� s � r� c C r )z� Save files needed to restore device to local disk. CLI Example: .. code-block:: bash salt '*' panos.save_device_state r z*<save><device-state></device-state></save>r r r r r r r �save_device_state rN r� c C sN | st d��i }dddd�| �d�}|�td |�� |du r%|�t� � |S ) a� Set the authentication profile of the Palo Alto proxy minion. A commit will be required before this is processed. CLI Example: Args: profile (str): The name of the authentication profile to set. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_authentication_profile foo salt '*' panos.set_authentication_profile foo deploy=True z%Profile name option must not be none.rC �setz_/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/authentication-profilez3<authentication-profile>{}</authentication-profile>�r rF rG �elementr T)r r- �updater r& )Zprofile�deploy�retr r r r �set_authentication_profile s �� r� c C �P | st d��i }dddd| � d�d�}|�td |�� |d u r&|�t� � |S ) a� Set the hostname of the Palo Alto proxy minion. A commit will be required before this is processed. CLI Example: Args: hostname (str): The hostname to set deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_hostname newhostname salt '*' panos.set_hostname newhostname deploy=True z!Hostname option must not be none.rC r� zH/config/devices/entry[@name='localhost.localdomain']/deviceconfig/systemz <hostname>z </hostname>r� r T�r r� r r& )�hostnamer� r� r r r r � set_hostnameK s � r� Tc C �h | du rd}n | du rd}nt d��i }dddd |� d �d �}|�td |�� |du r2|�t� � |S ) a� Enables or disables the ICMP management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_icmp salt '*' panos.set_management_icmp enabled=False deploy=True Tr� Fr� �3Invalid option provided for service enabled option.rC r� �P/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/servicez<disable-icmp>z</disable-icmp>r� r r� ��enabledr� �valuer� r r r r �set_management_icmps �" � � r� c C r� ) a� Enables or disables the HTTP management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_http salt '*' panos.set_management_http enabled=False deploy=True Tr� Fr� r� rC r� r� z<disable-http>z</disable-http>r� r r� r� r r r �set_management_http� r� r� c C r� ) a� Enables or disables the HTTPS management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_https salt '*' panos.set_management_https enabled=False deploy=True Tr� Fr� r� rC r� r� z<disable-https>z</disable-https>r� r r� r� r r r �set_management_https� r� r� c C r� ) a� Enables or disables the HTTP OCSP management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_ocsp salt '*' panos.set_management_ocsp enabled=False deploy=True Tr� Fr� r� rC r� r� z<disable-http-ocsp>z</disable-http-ocsp>r� r r� r� r r r �set_management_ocsp� r� r� c C r� ) a� Enables or disables the SNMP management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_snmp salt '*' panos.set_management_snmp enabled=False deploy=True Tr� Fr� r� rC r� r� z<disable-snmp>z</disable-snmp>r� r r� r� r r r �set_management_snmp# r� r� c C r� ) a� Enables or disables the SSH management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_ssh salt '*' panos.set_management_ssh enabled=False deploy=True Tr� Fr� r� rC r� r� z <disable-ssh>z</disable-ssh>r� r r� r� r r r �set_management_sshO r� r� c C r� ) a� Enables or disables the Telnet management service on the device. CLI Example: Args: enabled (bool): If true the service will be enabled. If false the service will be disabled. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_management_telnet salt '*' panos.set_management_telnet enabled=False deploy=True Tr� Fr� r� rC r� r� z<disable-telnet>z</disable-telnet>r� r r� r� r r r �set_management_telnet{ r� r� c C s� i }| dvr t j�d��|dvrt j�d��|dkr"|s"t j�d��|dkr.|s.t j�d��|dkr<|dvr<t j�d ��|dkr| d ksH| d kr_d d dd�|||�d�}|�dtd |�i� | dksg| d kr~d d dd�|||�d�}|�dtd |�i� nq|dkr�| d ks�| d kr�d d ddd�}|�dtd |�i� | dks�| d kr�d d ddd�}|�dtd |�i� n8|dkr�| d ks�| d kr�d d ddd�}|�dtd |�i� | dks�| d kr�d d ddd�}|�dtd |�i� |du r�|�t� � |S )a� Set the NTP authentication of the Palo Alto proxy minion. A commit will be required before this is processed. CLI Example: Args: target(str): Determines the target of the authentication. Valid options are primary, secondary, or both. authentication_type(str): The authentication type to be used. Valid options are symmetric, autokey, and none. key_id(int): The NTP authentication key ID. authentication_key(str): The authentication key. algorithm(str): The algorithm type to be used for a symmetric key. Valid options are md5 and sha1. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' ntp.set_authentication target=both authentication_type=autokey salt '*' ntp.set_authentication target=primary authentication_type=none salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5 salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5 deploy=True )�primary� secondary�bothz2Target option must be primary, secondary, or both.)� symmetric�autokey�nonez0Type option must be symmetric, autokey, or both.r� zIWhen using symmetric authentication, authentication_key must be provided.z=When using symmetric authentication, key_id must be provided.)�md5�sha1zCWhen using symmetric authentication, algorithm must be md5 or sha1.r� r� rC r� z{/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/primary-ntp-server/authentication-typez�<symmetric-key><algorithm><{0}><authentication-key>{1}</authentication-key></{0}></algorithm><key-id>{2}</key-id></symmetric-key>r� �primary_serverr r� z}/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/secondary-ntp-server/authentication-type�secondary_serverr� z <autokey/>r� z<none/>T)r � exceptionsr r- r� r r& )�targetZauthentication_typeZkey_idZauthentication_key� algorithmr� r� r r r r �set_ntp_authentication� s� "�� � �������� � �� � r� c C sx i }| rdddd� | �d�}|�dtd |�i� |r0dddd� |�d�}|�d td |�i� |d u r:|�t� � |S ) a� Set the NTP servers of the Palo Alto proxy minion. A commit will be required before this is processed. CLI Example: Args: primary_server(str): The primary NTP server IP address or FQDN. secondary_server(str): The secondary NTP server IP address or FQDN. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' ntp.set_servers 0.pool.ntp.org 1.pool.ntp.org salt '*' ntp.set_servers primary_server=0.pool.ntp.org secondary_server=1.pool.ntp.org salt '*' ntp.ser_servers 0.pool.ntp.org 1.pool.ntp.org deploy=True rC r� zg/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/primary-ntp-serverz+<ntp-server-address>{}</ntp-server-address>r� r� r zi/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/secondary-ntp-serverr� T)r- r� r r& )r� r� r� r� r r r r �set_ntp_servers= s, �� �� r� c C r� ) a� Add an IPv4 address or network to the permitted IP list. CLI Example: Args: address (str): The IPv4 address or network to allow access to add to the Palo Alto device. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_permitted_ip 10.0.0.1 salt '*' panos.set_permitted_ip 10.0.0.0/24 salt '*' panos.set_permitted_ip 10.0.0.1 deploy=True z!Address option must not be empty.rC r� r� z <entry name='z '></entry>r� r Tr� )rH r� r� r r r r �set_permitted_ipu s � r� c C r� ) a� Set the timezone of the Palo Alto proxy minion. A commit will be required before this is processed. CLI Example: Args: tz (str): The name of the timezone to set. deploy (bool): If true then commit the full candidate configuration, if false only set pending change. .. code-block:: bash salt '*' panos.set_timezone UTC salt '*' panos.set_timezone UTC deploy=True z&Timezone name option must not be none.rC r� zQ/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/timezonez <timezone>z </timezone>r� r Tr� )�tzr� r� r r r r � set_timezone� s � r� c C r )zr Shutdown a running system. CLI Example: .. code-block:: bash salt '*' panos.shutdown r z9<request><shutdown><system></system></shutdown></request>r r r r r r r �shutdown� r! r� �vr1c C sJ d}| r |d| � d�7 }|r|d|� d�7 }|d7 }d|d�}t d |�S ) a; Perform a route lookup within active route table (fib). ip (str): The destination IP address to test. vr (str): The name of the virtual router to test. CLI Example: .. code-block:: bash salt '*' panos.test_fib_route 4.2.2.2 salt '*' panos.test_fib_route 4.2.2.2 my-vr z<test><routing><fib-lookup>z<ip>z</ip>z<virtual-router>z</virtual-router>z </fib-lookup></routing></test>r r r r )�ipZvrrG r r r r �test_fib_route� s r� c C s� d} | r | d| � d�7 } |r| d|� d�7 } |r | d|� d�7 } |r*| d|� d �7 } |r4| d |� d �7 } |r>| d |� d �7 } |rH| d|� d�7 } |rR| d|� d�7 } | rX| d7 } | d7 } dd|� �| d�} t d | �S )a4 Checks which security policy as connection will match on the device. sourcezone (str): The source zone matched against the connection. destinationzone (str): The destination zone matched against the connection. source (str): The source address. This must be a single IP address. destination (str): The destination address. This must be a single IP address. protocol (int): The protocol number for the connection. This is the numerical representation of the protocol. port (int): The port number for the connection. application (str): The application that should be matched. category (str): The category that should be matched. vsys (int): The numerical representation of the VSYS ID. allrules (bool): Show all potential match rules until first allow rule. CLI Example: .. code-block:: bash salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22 salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22 vsys=2 z <test><security-policy-match>z<from>z</from>z<to>z</to>z<source>z </source>z <destination>z</destination>z <protocol>z </protocol>z<destination-port>z</destination-port>z <application>z</application>z <category>z </category>z<show-all>yes</show-all>z </security-policy-match></test>r rI )r rI r r r ) Z sourcezoneZdestinationzone�sourceZ destination�protocol�portr� �categoryrI ZallrulesrG r r r r �test_security_policy� s, , r� c C s( | st d��dd�| �d�}td |�S )z� Unlocks a locked administrator account. username Username of the administrator. CLI Example: .. code-block:: bash salt '*' panos.unlock_admin username=bob z!Username option must not be none.r zT<set><management-server><unlock><admin>{}</admin></unlock></management-server></set>r r )r r- r )�usernamer r r r � unlock_adminE s � r� )N)NF)NrA )rb )r� )r� rA )rA )NFFF)F)NN)TF)NNNNNF)NNF)Nr� ) NNNNNNNNrA F)l�__doc__�loggingr Zsalt.proxy.panosr Zsalt.utils.platformZsalt.exceptionsr � getLogger�__name__�logr r r r r" r# r$ r& r0 r1 r2 r: r> r@ rJ rL rM rO rP rQ rR rS rT rV rX rY rZ r[ r\ r] r^ r` ra rf rh r rn ro rp rq rr rs rt ru rz r{ r| r} r~ r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rw r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r �<module> s� & / / " �A " 2 + ( , , , , , ,- � 8 '& ! �P
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings