Skip to content
Draft
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 16 additions & 20 deletions src/network/paloalto/api/custom/api.pm
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ sub new {
'username:s' => { name => 'username', default => '' },
'password:s' => { name => 'password', default => '' },
'timeout:s' => { name => 'timeout', default => 30 },
'target:s' => { name => 'target', default => '' },
'unknown-http-status:s' => { name => 'unknown_http_status', default => '%{http_code} < 200 or %{http_code} >= 300' },
'warning-http-status:s' => { name => 'warning_http_status', default => '' },
'critical-http-status:s' => { name => 'critical_http_status', default => '' }
Expand All @@ -78,17 +79,10 @@ sub set_defaults {}
sub check_options {
my ($self, %options) = @_;

$self->{hostname} = $self->{option_results}->{hostname};
$self->{port} = $self->{option_results}->{port};
$self->{proto} = $self->{option_results}->{proto};
$self->{auth_type} = $self->{option_results}->{auth_type};
$self->{api_key} = $self->{option_results}->{api_key};
$self->{username} = $self->{option_results}->{username};
$self->{password} = $self->{option_results}->{password};
$self->{timeout} = $self->{option_results}->{timeout};
$self->{unknown_http_status} = $self->{option_results}->{unknown_http_status};
$self->{warning_http_status} = $self->{option_results}->{warning_http_status};
$self->{critical_http_status} = $self->{option_results}->{critical_http_status};
$self->{$_} = $self->{option_results}->{$_} foreach qw/hostname port proto timeout
auth_type api_key username password
target
unknown_http_status warning_http_status critical_http_status/;

$self->{output}->option_exit(short_msg => "Need to specify --hostname option.")
if $self->{hostname} eq '';
Expand Down Expand Up @@ -195,7 +189,8 @@ sub _http_request {
url_path => '/api/',
get_params => {
'type' => $options{type},
'cmd' => $options{cmd}
'cmd' => $options{cmd},
$self->{target} ? ( target => $self->{target} ) : ()
},
header => [
$self->_build_auth_header(),
Expand All @@ -215,20 +210,17 @@ sub _parse_xml {
$self->{output}->option_exit( short_msg => "API returns empty content [code: '" . $self->{http}->get_code() . "'] [message: '" . $self->{http}->get_message() . "']")
if is_empty($content);

$self->{output}->option_exit(short_msg => "Cannot find XML response in API reply.")
unless $content =~ /(<response status=["'](.*?)["']>.*<\/response>)/ms;

my ($xml, $status) = ($1, $2);
$self->{output}->option_exit(short_msg => "API response status: $status")
unless $status eq 'success';

my $result;
eval {
$result = XMLin($xml, ForceArray => $options{ForceArray} // [], KeyAttr => []);
$result = XMLin($content, ForceArray => $options{ForceArray} // [], KeyAttr => []);
};

$self->{output}->option_exit(short_msg => "Cannot decode XML response: $@")
if $@;

$self->{output}->option_exit(short_msg => "API response status: ".value_of($result, "->{status}", "UNKNOWN"))
unless ref $result eq 'HASH' && $result->{status} && $result->{status} eq 'success';

return $result->{result};
}

Expand Down Expand Up @@ -304,6 +296,10 @@ Also used with --auth-type=api-key to auto-generate or regenerate the API key.

Password.

=item B<--target>

Firewall serial number to monitor. Only applicable when the hostname points to Panorama.

=item B<--timeout>

HTTP request timeout in seconds (default: 30).
Expand Down
157 changes: 157 additions & 0 deletions src/network/paloalto/api/mode/panoramafirewalldiscovery.pm
Original file line number Diff line number Diff line change
@@ -0,0 +1,157 @@
#
# Copyright 2026-Present Centreon (http://www.centreon.com/)
#
# Centreon is a full-fledged industry-strength solution that meets
# the needs in IT infrastructure and application monitoring for
# service performance.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

package network::paloalto::api::mode::panoramafirewalldiscovery;

use base qw(centreon::plugins::mode);

use strict;
use warnings;

use centreon::plugins::misc qw/json_encode is_excluded/;

sub new {
my ($class, %options) = @_;
my $self = $class->SUPER::new(package => __PACKAGE__, %options);
bless $self, $class;

$options{options}->add_options(arguments => {
"prettify" => { name => 'prettify' },
'only-connected' => { name => 'only_connected' },
'include-name:s' => { name => 'include_name', default => '' },
'exclude-name:s' => { name => 'exclude_name', default => '' },
'include-model:s' => { name => 'include_model', default => '' },
'exclude-model:s' => { name => 'exclude_model', default => '' },
'include-ip-address:s' => { name => 'include_ip_address', default => '' },
'exclude-ip-address:s' => { name => 'exclude_ip_address', default => '' }
});

return $self;
}

sub check_options {
my ($self, %options) = @_;
$self->SUPER::init(%options);
}

sub manage_selection {
my ($self, %options) = @_;

$self->{output}->option_exit( short_msg => "The --target parameter is not allowed in this mode." )
if $options{custom}->{target};

my $filter = $self->{option_results}->{only_connected} ? 'connected' : 'all';
my $result = $self->{instances} = $options{custom}->request_api(
type => 'op',
cmd => "<show><devices><$filter></$filter></devices></show>",
ForceArray => [ 'entry' ]
);

$self->{devices} = [ ];

return unless $result && ref $result->{devices}->{entry} eq 'ARRAY';

foreach my $device (@{$result->{devices}->{entry}}) {
next unless $device->{serial};

my $item = {
Serial => $device->{serial},
Name => $device->{name} // '',
HostName => $device->{hostname} // '',
Connected => $device->{connected} // '',
Model => $device->{model} // '',
IpAddress => $device->{'ip-address'} // '',
};

next if is_excluded($item->{Name}, $self->{option_results}->{include_name}, $self->{option_results}->{exclude_name}, output => $self->{output}) ||
is_excluded($item->{Model}, $self->{option_results}->{include_model}, $self->{option_results}->{exclude_model}, output => $self->{output}) ||
is_excluded($item->{IpAddress}, $self->{option_results}->{include_ip_address}, $self->{option_results}->{exclude_ip_address}, output => $self->{output});

push @{$self->{devices}}, $item;
}
}

sub run {
my ($self, %options) = @_;

my $disco_stats;

$disco_stats->{start_time} = time();

$self->manage_selection(%options);

$disco_stats->{end_time} = time();
$disco_stats->{duration} = $disco_stats->{end_time} - $disco_stats->{start_time};
$disco_stats->{discovered_items} = @{$self->{devices}};
$disco_stats->{results} = $self->{devices};

my $encoded_data = json_encode($disco_stats,
prettify => $self->{option_results}->{prettify},
errstr => '{"code":"encode_error","message":"Cannot encode discovered data into JSON format"}');

$self->{output}->output_add(short_msg => $encoded_data);
$self->{output}->display(nolabel => 1, force_ignore_perfdata => 1);
$self->{output}->exit();
}
1;

__END__

=head1 MODE

Discover firewalls managed by Panorama.

=over 8

=item B<--only-connected>

Display only connected firewalls.

=item B<--include-name>

Filter firewall by name (can be a regex).

=item B<--exclude-name>

Exclude firewall by name (can be a regex).

=item B<--include-model>

Filter firewall by model (can be a regex).

=item B<--exclude-model>

Exclude firewall by model (can be a regex).

=item B<--include-ip-address>

Filter firewall by IP address (can be a regex).

=item B<--exclude-ip-address>

Exclude firewall IP by address (can be a regex).

=item B<--prettify>

Prettify JSON output.

=back

=cut
3 changes: 2 additions & 1 deletion src/network/paloalto/api/plugin.pm
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,8 @@ sub new {
'ha' => 'network::paloalto::api::mode::ha',
'licenses' => 'network::paloalto::api::mode::licenses',
'system' => 'network::paloalto::api::mode::system',
'ipsec' => 'network::paloalto::api::mode::ipsec'
'ipsec' => 'network::paloalto::api::mode::ipsec',
'panorama-firewall-discovery' => 'network::paloalto::api::mode::panoramafirewalldiscovery'
Comment thread
scresto31 marked this conversation as resolved.
Outdated
};

$self->{custom_modes}->{api} = 'network::paloalto::api::custom::api';
Expand Down
2 changes: 1 addition & 1 deletion tests/apps/backup/rubrik/graphql/rubrik-mockoon.json
Original file line number Diff line number Diff line change
Expand Up @@ -386,4 +386,4 @@
],
"data": [],
"callbacks": []
}
}
70 changes: 69 additions & 1 deletion tests/network/paloalto/api/mockoon-paloalto-api.json
Original file line number Diff line number Diff line change
Expand Up @@ -170,9 +170,16 @@
"value": "<system>",
"invert": false,
"operator": "regex"
},
{
"target": "query",
"modifier": "target",
"value": "",
"invert": false,
"operator": "null"
}
],
"rulesOperator": "OR",
"rulesOperator": "AND",
"disableTemplating": false,
"fallbackTo404": false,
"default": false,
Expand Down Expand Up @@ -210,6 +217,67 @@
"default": false,
"crudKey": "id",
"callbacks": []
},
{
"uuid": "046ba2be-d382-4255-a575-dd5894136b30",
"body": "<response status=\"success\">\n<result>\n<devices>\n<entry name=\"ANO1\">\n<serial>987654</serial>\n<connected>yes</connected>\n<unsupported-version>no</unsupported-version>\n<deactivated>no</deactivated>\n<hostname>DUMMY-1-VM</hostname>\n<ip-address>10.1.1.11</ip-address>\n<mac-addr />\n<uptime>81 days, 20:39:41</uptime>\n<family>vm</family>\n<model>PA-VM</model>\n<sw-version>6.1.3</sw-version>\n<app-version>555-3129</app-version>\n<av-version>2254-2693</av-version>\n<wildfire-version>91873-10.274</wildfire-version>\n<threat-version>555-3129</threat-version>\n<url-db>paulotonetworks</url-db>\n<url-filtering-version>2016.02.02.416</url-filtering-version>\n<logdb-version>6.1.3</logdb-version>\n<vpnclient-package-version />\n<global-protect-client-package-version>0.0.0</global-protect-client-package-version>\n<vpn-disable-mode>no</vpn-disable-mode>\n<operational-mode>normal</operational-mode>\n<multi-vsys>no</multi-vsys>\n</entry>\n<entry name=\"ANO2\">\n<serial>123456</serial>\n<connected>yes</connected>\n<unsupported-version>no</unsupported-version>\n<deactivated>no</deactivated>\n<hostname>DUMMY-2-VM</hostname>\n<ip-address>10.1.1.10</ip-address>\n<mac-addr />\n<uptime>81 days, 20:39:41</uptime>\n<family>vm</family>\n<model>PA-VM</model>\n<sw-version>6.1.3</sw-version>\n<app-version>555-3129</app-version>\n<av-version>2254-2693</av-version>\n<wildfire-version>91873-10.274</wildfire-version>\n<threat-version>555-3129</threat-version>\n<url-db>paulonetworks</url-db>\n<url-filtering-version>2016.02.02.416</url-filtering-version>\n<logdb-version>6.1.3</logdb-version>\n<vpnclient-package-version />\n<global-protect-client-package-version>0.0.0</global-protect-client-package-version>\n<vpn-disable-mode>no</vpn-disable-mode>\n<operational-mode>normal</operational-mode>\n<multi-vsys>no</multi-vsys>\n</entry>\n</devices>\n</result>\n</response>",
"latency": 0,
"statusCode": 200,
"label": "LIST PANORAMA FIREWALL",
"headers": [],
"bodyType": "INLINE",
"filePath": "",
"databucketID": "",
"sendFileAsBody": false,
"rules": [
{
"target": "query",
"modifier": "cmd",
"value": "<show><devices>",
"invert": false,
"operator": "regex"
}
],
"rulesOperator": "OR",
"disableTemplating": false,
"fallbackTo404": false,
"default": false,
"crudKey": "id",
"callbacks": []
},
{
"uuid": "bcff18d8-0202-46ed-816a-82de046dee3e",
"body": "<response status=\"success\">\n <result>\n <system>\n <hostname>firewall</hostname>\n <ip-address>10.41.0.8</ip-address>\n <netmask>255.255.224.0</netmask>\n <default-gateway>10.41.0.1</default-gateway>\n <is-dhcp>no</is-dhcp>\n <ipv6-address>unknown</ipv6-address>\n <ipv6-link-local-address>fe80::21c:17cf:feff:c04a/64</ipv6-link-local-address>\n <ipv6-default-gateway/>\n <mac-address>00:1b:17:fc:c0:4a</mac-address>\n <time>Tue Oct 27 13:39:09 2015</time>\n <uptime>12 days, 0:05:26</uptime>\n <devicename>pm-firewall</devicename>\n <family>3000</family>\n <model>PA-3020</model>\n <serial>001802000104</serial>\n <sw-version>1.PANORAMA</sw-version>\n <global-protect-client-package-version>2.0.0</global-protect-client-package-version>\n <app-version>537-2965</app-version>\n <app-release-date>2015/10/26 18:10:48</app-release-date>\n <av-version>2149-2586</av-version>\n <av-release-date>2015/10/26 15:31:55</av-release-date>\n <threat-version>537-2965</threat-version>\n <threat-release-date>2015/10/26 18:10:48</threat-release-date>\n <wf-private-version>0</wf-private-version>\n <wf-private-release-date>unknown</wf-private-release-date>\n <url-db>paloaltonetworks</url-db>\n <wildfire-version>80683-89773</wildfire-version>\n <wildfire-release-date>unknown</wildfire-release-date>\n <url-filtering-version>2015.10.27.226</url-filtering-version>\n <global-protect-datafile-version>1445974904</global-protect-datafile-version>\n <global-protect-datafile-release-date>2015/10/27 19:41:44</global-protect-datafile-release-date>\n <logdb-version>7.0.9</logdb-version>\n <platform-family>3000</platform-family>\n <vpn-disable-mode>off</vpn-disable-mode>\n <multi-vsys>on</multi-vsys>\n <operational-mode>normal</operational-mode>\n <device-certificate-status>Valid</device-certificate-status>\n </system>\n </result>\n</response>",
"latency": 0,
"statusCode": 200,
"label": "SYSTEM PANORAMA",
"headers": [],
"bodyType": "INLINE",
"filePath": "",
"databucketID": "",
"sendFileAsBody": false,
"rules": [
{
"target": "query",
"modifier": "cmd",
"value": "<system>",
"invert": false,
"operator": "regex"
},
{
"target": "query",
"modifier": "target",
"value": "",
"invert": true,
"operator": "null"
}
],
"rulesOperator": "AND",
"disableTemplating": false,
"fallbackTo404": false,
"default": false,
"crudKey": "id",
"callbacks": []
}
],
"responseMode": null,
Expand Down
Loading
Loading