diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 4b30e1d..a30ad9d 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -4,6 +4,68 @@ Check_Point.Mgmt Release Notes .. contents:: Topics +v7.0.0 +====== + +Release Summary +--------------- + +This is release 7.0.0 of ``check_point.mgmt``, released on 2026-08-11. + +Major Changes +------------- + +- New R82.20 modules + +Minor Changes +------------- + +- added new parameter 'additional_permission_profiles' to 'cp_mgmt_access_layer' module. +- added new parameter 'distribute_logs_between_all_active_servers' to the 'logs_settings' parameter of 'cp_mgmt_simple_gateway' module. +- added new parameter 'permissions_profiles' to 'cp_mgmt_threat_layer' module. +- added new parameters 'identity_awareness' and 'identity_awareness_settings' to 'cp_mgmt_simple_gateway' module. + +New Modules +----------- + +- check_point.mgmt.cp_mgmt_cloud_license_gateway_facts - Get cloud-license-gateway objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_cloud_license_pool_facts - Get cloud-license-pool objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_def_setting - Manages def-setting objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_def_setting_facts - Get def-setting objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_dlp_next_data_type - Manages dlp-next-data-type objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_dlp_next_data_type_facts - Get dlp-next-data-type objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_firewall_best_practice - Manages firewall-best-practice objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_firewall_best_practice_facts - Get firewall-best-practice objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_guideline - Manages guideline objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_guideline_cell_approvals - Manages guideline-cell-approvals objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_guideline_facts - Get guideline objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_prepare_software_package - Prepares the software package on target machines. +- check_point.mgmt.cp_mgmt_regulation - Manages regulation objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_regulation_facts - Get regulation objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_requirement - Manages requirement objects on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_requirement_facts - Get requirement objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_set_best_practice - Edit an existing Best Practice using object name, uid or best practice id. Activate or deactivate the best practice and its relevant objects. +- check_point.mgmt.cp_mgmt_set_cloud_license_gateway - Edit existing gateway license using name or uid. +- check_point.mgmt.cp_mgmt_set_cloud_license_pool - Edit existing pool using name. +- check_point.mgmt.cp_mgmt_set_cloud_license_scope - Set cloud license operational mode. +- check_point.mgmt.cp_mgmt_set_threat_emulation_file_type - Edit a Threat Emulation file type support settings. +- check_point.mgmt.cp_mgmt_set_threat_emulation_file_types - Edit support settings for multiple Threat Emulation file types in a single request. +- check_point.mgmt.cp_mgmt_set_threat_extraction_file_type - Edit a Threat Extraction file type support settings. +- check_point.mgmt.cp_mgmt_set_threat_extraction_file_types - Edit support settings for multiple Threat Extraction file types in a single request. +- check_point.mgmt.cp_mgmt_set_threat_protection_category - Edit existing object using object name or uid. +- check_point.mgmt.cp_mgmt_set_threat_protection_sub_category - Edit existing object using object name or uid. +- check_point.mgmt.cp_mgmt_show_ad_content - Retrieves Active Directory users, groups, and machines for an Account Unit. +- check_point.mgmt.cp_mgmt_show_cloud_license_scope - Show current cloud license mode. +- check_point.mgmt.cp_mgmt_show_dlp_next_data_types_repository_content - Retrieve all DLP Next Data Type Objects from Infinity portal. +- check_point.mgmt.cp_mgmt_show_guideline_cells - Showing guideline-cells metrics according to the given filters. +- check_point.mgmt.cp_mgmt_test_ai_agent_security_api_key - Test the validity of an AI Agent Security API key. +- check_point.mgmt.cp_mgmt_threat_emulation_file_type_facts - Get threat-emulation-file-type objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_threat_emulation_image_facts - Get threat-emulation-image objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_threat_extraction_file_type_facts - Get threat-extraction-file-type objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_threat_protection_category_facts - Get threat-protection-category objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_threat_protection_sub_category_facts - Get threat-protection-sub-category objects facts on Checkpoint over Web Services API +- check_point.mgmt.cp_mgmt_update_cloud_license - Updates the existing license with the new license string. + v6.9.0 ====== diff --git a/galaxy.yml b/galaxy.yml index 736871c..253c923 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -9,7 +9,7 @@ namespace: check_point name: mgmt # The version of the collection. Must be compatible with semantic versioning -version: 6.9.0 +version: 7.0.0 # The path to the Markdown (.md) readme file. This path is relative to the root of the collection readme: README.md diff --git a/plugins/module_utils/checkpoint.py b/plugins/module_utils/checkpoint.py index 62a4388..df69d5b 100644 --- a/plugins/module_utils/checkpoint.py +++ b/plugins/module_utils/checkpoint.py @@ -76,7 +76,15 @@ "ignore-errors", "ignore-warnings", "gateway-uid", - "url" + "url", + "guideline", + "approvals", + "from", + "from-type", + "to", + "to-type", + "policy-package", + "delete-scope" ] remove_from_set_payload = { @@ -277,7 +285,8 @@ def is_no_changes_command(command): def contains_show_identifier_param(payload): - identifier_params = ["name", "uid", "assigned-domain", "task-id", "signature", "url", "best-practice-id"] + identifier_params = ["name", "uid", "assigned-domain", "task-id", "signature", "url", "best-practice-id", + "gateway", "pool", "file-type-id", "file-type"] for param in identifier_params: if payload.get(param) is not None: return True diff --git a/plugins/modules/cp_mgmt_access_layer.py b/plugins/modules/cp_mgmt_access_layer.py index 317c38a..1973f1d 100644 --- a/plugins/modules/cp_mgmt_access_layer.py +++ b/plugins/modules/cp_mgmt_access_layer.py @@ -48,6 +48,13 @@ - Indicates whether to include a cleanup rule in the new layer. - Available from R80.10 management version. type: bool + additional_permission_profiles: + description: + - Collection of permission profiles identified by the name or UID. + - Available from R82.20 management version. + type: list + elements: str + version_added: "7.0.0" applications_and_url_filtering: description: - Whether to enable Applications & URL Filtering blade on the layer. @@ -122,7 +129,7 @@ - name: set-access-layer cp_mgmt_access_layer: applications_and_url_filtering: false - data_awareness: true + content_awareness: true name: New Layer 1 state: present @@ -150,6 +157,7 @@ def main(): argument_spec = dict( name=dict(type="str", required=True), add_default_rule=dict(type="bool"), + additional_permission_profiles=dict(type="list", elements="str"), applications_and_url_filtering=dict(type="bool"), content_awareness=dict(type="bool"), detect_using_x_forward_for=dict(type="bool"), diff --git a/plugins/modules/cp_mgmt_cloud_license_gateway_facts.py b/plugins/modules/cp_mgmt_cloud_license_gateway_facts.py new file mode 100644 index 0000000..cdd8b7d --- /dev/null +++ b/plugins/modules/cp_mgmt_cloud_license_gateway_facts.py @@ -0,0 +1,127 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_cloud_license_gateway_facts +short_description: Get cloud-license-gateway objects facts on Checkpoint over Web Services API +description: + - Get cloud-license-gateway objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + gateway: + description: + - Security gateway name or UID. + type: str + domain: + description: + - Domain name or UID of security gateway. Required when running from MDS context. + type: str + filter: + description: + - Search expression to filter objects by gateway name (supports substring matching). + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-cloud-license-gateway + cp_mgmt_cloud_license_gateway_facts: + gateway: GW_A + +- name: show-cloud-license-gateways + cp_mgmt_cloud_license_gateway_facts: +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + gateway=dict(type='str'), + domain=dict(type='str'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )) + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "cloud-license-gateway" + api_call_object_plural_version = "cloud-license-gateways" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_cloud_license_pool_facts.py b/plugins/modules/cp_mgmt_cloud_license_pool_facts.py new file mode 100644 index 0000000..96855c8 --- /dev/null +++ b/plugins/modules/cp_mgmt_cloud_license_pool_facts.py @@ -0,0 +1,127 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_cloud_license_pool_facts +short_description: Get cloud-license-pool objects facts on Checkpoint over Web Services API +description: + - Get cloud-license-pool objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + pool: + description: + - Pool name. + type: str + ck: + description: + - Certificate Key. Required to identify a specific pool when multiple pools share the same name. + type: str + filter: + description: + - Search expression to filter objects by gateway name (supports substring matching). + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-cloud-license-pool + cp_mgmt_cloud_license_pool_facts: + pool: VE-FIREWALL + +- name: show-cloud-license-pools + cp_mgmt_cloud_license_pool_facts: +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + pool=dict(type='str'), + ck=dict(type='str'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )) + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "cloud-license-pool" + api_call_object_plural_version = "cloud-license-pools" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_def_setting.py b/plugins/modules/cp_mgmt_def_setting.py new file mode 100644 index 0000000..b1ed35a --- /dev/null +++ b/plugins/modules/cp_mgmt_def_setting.py @@ -0,0 +1,196 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_def_setting +short_description: Manages def-setting objects on Checkpoint over Web Services API +description: + - Manages def-setting objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Object name. + type: str + required: True + data_type: + description: + - The data type of the setting. Defined when the object is created and cannot be changed afterwards. + type: str + choices: ['boolean', 'integer', 'string', 'list'] + assignments: + description: + - Assignments. + type: list + elements: dict + suboptions: + value: + description: + - The value of the setting. + type: str + description: + description: + - The description for this setting. + type: str + enabled: + description: + - If the setting is enabled. + type: bool + from_version: + description: + - The gateway version this setting applies from. + type: str + choices: ['earliest', 'latest', 'r77', 'r80', 'r81', 'r82'] + model: + description: + - The gateway model this setting applies to. + type: str + choices: ['all', 'quantum', 'spark'] + position: + description: + - The position of the setting. + type: str + choices: ['top', 'bottom', '1-1000'] + targets: + description: + - The Gateways or Clusters the assignment is applied to, identified by name or UID. + type: list + elements: str + to_version: + description: + - The gateway version this setting applies to. + type: str + choices: ['earliest', 'latest', 'r77', 'r80', 'r81', 'r82'] + color: + description: + - Color of the object. Should be one of existing colors. + type: str + choices: ['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', 'khaki', 'orchid', 'dark orange', 'dark sea green', + 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', + 'coral', 'sea green', 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', 'yellow'] + comments: + description: + - Comments string. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + tags: + description: + - Collection of tag identifiers. + type: list + elements: str + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-def-setting + cp_mgmt_def_setting: + assignments: + - description: Default for Quantum gateways + model: quantum + value: 'true' + - description: Default for Spark gateways + model: spark + value: 'false' + data_type: boolean + name: My Boolean Def Setting + state: present + +- name: set-def-setting + cp_mgmt_def_setting: + name: My Boolean Def Setting + state: present + +- name: delete-def-setting + cp_mgmt_def_setting: + name: My Boolean Def Setting + state: absent +""" + +RETURN = """ +cp_mgmt_def_setting: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + name=dict(type='str', required=True), + data_type=dict(type='str', choices=['boolean', 'integer', 'string', 'list']), + assignments=dict(type='list', elements='dict', options=dict( + value=dict(type='str'), + description=dict(type='str'), + enabled=dict(type='bool'), + from_version=dict(type='str', choices=['earliest', 'latest', 'r77', 'r80', 'r81', 'r82']), + model=dict(type='str', choices=['all', 'quantum', 'spark']), + position=dict(type='str', choices=['top', 'bottom', '1-1000']), + targets=dict(type='list', elements='str'), + to_version=dict(type='str', choices=['earliest', 'latest', 'r77', 'r80', 'r81', 'r82']) + )), + color=dict(type='str', choices=['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', + 'khaki', 'orchid', 'dark orange', 'dark sea green', 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', + 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', 'coral', 'sea green', + 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', + 'yellow']), + comments=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + tags=dict(type='list', elements='str'), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'def-setting' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_def_setting_facts.py b/plugins/modules/cp_mgmt_def_setting_facts.py new file mode 100644 index 0000000..31f102a --- /dev/null +++ b/plugins/modules/cp_mgmt_def_setting_facts.py @@ -0,0 +1,149 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_def_setting_facts +short_description: Get def-setting objects facts on Checkpoint over Web Services API +description: + - Get def-setting objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Object name. + This parameter is relevant only for getting a specific object. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + show_custom: + description: + - If true, only custom def-settings are shown. If false, only predefined def-settings are shown. When omitted, all def-settings are shown. + type: bool + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-def-setting + cp_mgmt_def_setting_facts: + name: New Def Setting 1 + +- name: show-def-settings + cp_mgmt_def_setting_facts: +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + name=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + show_custom=dict(type='bool'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "def-setting" + api_call_object_plural_version = "def-settings" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_dlp_next_data_type.py b/plugins/modules/cp_mgmt_dlp_next_data_type.py new file mode 100644 index 0000000..b63803e --- /dev/null +++ b/plugins/modules/cp_mgmt_dlp_next_data_type.py @@ -0,0 +1,142 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_dlp_next_data_type +short_description: Manages dlp-next-data-type objects on Checkpoint over Web Services API +description: + - Manages dlp-next-data-type objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + external_id: + description: + - DLP Next Data Type unique identifier in Infinity Portal. + type: str + name: + description: + - Object name. + type: str + required: True + tags: + description: + - Collection of tag identifiers. + type: list + elements: str + color: + description: + - Color of the object. Should be one of existing colors. + type: str + choices: ['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', 'khaki', 'orchid', 'dark orange', 'dark sea green', + 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', + 'coral', 'sea green', 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', 'yellow'] + comments: + description: + - Comments string. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-dlp-next-data-type + cp_mgmt_dlp_next_data_type: + name: ASIC or FPGA Designs + state: present + +- name: set-dlp-next-data-type + cp_mgmt_dlp_next_data_type: + comments: new dlp next data type + name: ASIC or FPGA Designs + state: present + +- name: delete-dlp-next-data-type + cp_mgmt_dlp_next_data_type: + name: ASIC or FPGA Designs + state: absent +""" + +RETURN = """ +cp_mgmt_dlp_next_data_type: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + external_id=dict(type='str'), + name=dict(type='str', required=True), + tags=dict(type='list', elements='str'), + color=dict(type='str', choices=['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', + 'khaki', 'orchid', 'dark orange', 'dark sea green', 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', + 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', 'coral', 'sea green', + 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', + 'yellow']), + comments=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str'), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'dlp-next-data-type' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_dlp_next_data_type_facts.py b/plugins/modules/cp_mgmt_dlp_next_data_type_facts.py new file mode 100644 index 0000000..f4906b9 --- /dev/null +++ b/plugins/modules/cp_mgmt_dlp_next_data_type_facts.py @@ -0,0 +1,146 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_dlp_next_data_type_facts +short_description: Get dlp-next-data-type objects facts on Checkpoint over Web Services API +description: + - Get dlp-next-data-type objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Object name. + This parameter is relevant only for getting a specific object. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-dlp-next-data-type + cp_mgmt_dlp_next_data_type_facts: + name: ASIC or FPGA Designs + +- name: show-dlp-next-data-types + cp_mgmt_dlp_next_data_type_facts: + limit: 1 + offset: 1 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + name=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "dlp-next-data-type" + api_call_object_plural_version = "dlp-next-data-types" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_firewall_best_practice.py b/plugins/modules/cp_mgmt_firewall_best_practice.py new file mode 100644 index 0000000..046d49a --- /dev/null +++ b/plugins/modules/cp_mgmt_firewall_best_practice.py @@ -0,0 +1,355 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_firewall_best_practice +short_description: Manages firewall-best-practice objects on Checkpoint over Web Services API +description: + - Manages firewall-best-practice objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Best Practice Name. + type: str + action_item: + description: + - To comply with Best Practice, do this action item. + type: str + description: + description: + - Description of the Best Practice. + type: str + enabled: + description: + - The activation status of the best practice. + type: bool + expiration: + description: + - Deactivation expiration settings.
Required only if enabled is set to false. + type: dict + suboptions: + comment: + description: + - The reason for deactivating the best practice. + type: str + expire_on: + description: + - When the deactivation expires. Date and time represented in international ISO 8601 format. Relevant only if mode is set to 'expire-on'. + type: str + mode: + description: + - Whether the deactivation never expires or expires on a specific date. + type: str + choices: ['never', 'expire-on'] + policy_range_percentage: + description: + - The percentage of the Rule Base to scan (0-100). + type: int + policy_range_position: + description: + - The direction of the scan. + type: str + choices: ['top', 'bottom'] + poor_condition: + description: + - Visibility of poor-result rules in the Relevant Objects pane. + type: str + choices: ['display rules that match', "display rules that don't match", "don't display rules"] + rule: + description: + - The rule criteria the firewall best practice evaluates against the rule base. Multi-set semantics on all match-list fields except name and comment. + type: dict + suboptions: + source: + description: + - Network objects to match in the rule Source column. + Identified by name or UID. + type: list + elements: str + negate_source: + description: + - Shows if the source values are negated. + type: bool + destination: + description: + - Network objects to match in the rule Destination column. + Identified by name or UID. + type: list + elements: str + negate_destination: + description: + - Shows if the destination values are negated. + type: bool + vpn: + description: + - VPN communities to match. + Identified by name or UID. + type: list + elements: str + negate_vpn: + description: + - Shows if the vpn values are negated. + type: bool + services_and_applications: + description: + - Services, applications, categories or sites to match. + Identified by name or UID. + type: list + elements: str + negate_services_and_applications: + description: + - Shows if the services and applications values are negated. + type: bool + install_on: + description: + - Security Gateways or Clusters the rule applies to. + Identified by name or UID. + type: list + elements: str + negate_install_on: + description: + - Shows if the install-on values are negated. + type: bool + time: + description: + - Time objects the rule applies to. + Identified by name or UID. + type: list + elements: str + negate_time: + description: + - Shows if the time values are negated. + type: bool + action: + description: + - Rule actions to match. + type: list + elements: str + negate_action: + description: + - Shows if the action values are negated. + type: bool + track: + description: + - Tracking methods to match. + type: list + elements: str + negate_track: + description: + - Shows if the track values are negated. + type: bool + hit_count: + description: + - Hit-count levels to match. + type: list + elements: str + negate_hit_count: + description: + - Shows if the hit-count values are negated. + type: bool + name_condition: + description: + - Match the rule name against a text condition. + type: dict + suboptions: + condition_type: + description: + - The condition type. + type: str + choices: ['any', 'blank', 'not blank', 'starts with', 'equals', 'ends with', 'contains'] + value: + description: + - The condition match string. Relevant only when the value of the 'condition-type' parameter is, 'Equals', 'Starts with', 'Ends + with', 'Contains'. + type: str + comment_condition: + description: + - Match the rule comment against a text condition. + type: dict + suboptions: + condition_type: + description: + - The condition type. + type: str + choices: ['any', 'blank', 'not blank', 'starts with', 'equals', 'ends with', 'contains'] + value: + description: + - The condition match string. Relevant only when the value of the 'condition-type' parameter is, 'Equals', 'Starts with', 'Ends + with', 'Contains'. + type: str + secure_condition: + description: + - Visibility of secure-result rules in the Relevant Objects pane. + type: str + choices: ['display rules that match', "display rules that don't match", "don't display rules"] + tolerance: + description: + - Number of matches allowed before a violation is created. Valid values, between 0 and 100.
Required only if + violation-condition is set to 'Rule found'. + type: int + violation_condition: + description: + - Define when a violation occurs, 'Rule found' means the criteria match a rule; 'Rule not found' means no rule matches. + type: str + choices: ['rule found', 'rule not found'] + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool + best_practice_id: + description: + - Best Practice ID. + type: str +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-firewall-best-practice + cp_mgmt_firewall_best_practice: + action_item: Define a clean-up rule at the end of the policy. + description: Checks that the rule base ends with a clean-up rule. + enabled: true + name: Clean-up rule defined in Access Policy + rule: + action: + - drop + destination: + - Any + hit_count: + - low + name_condition: + condition_type: contains + value: cleanup + source: + - Any + track: + - log + state: present + +- name: set-firewall-best-practice + cp_mgmt_firewall_best_practice: + best_practice_id: FW001 + enabled: false + expiration: + comment: Temporarily disabled pending policy review. + expire_on: '2026-12-31T14:30:00' + mode: expire-on + state: present + +- name: delete-firewall-best-practice + cp_mgmt_firewall_best_practice: + best_practice_id: FW001 + state: absent +""" + +RETURN = """ +cp_mgmt_firewall_best_practice: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + name=dict(type='str'), + action_item=dict(type='str'), + description=dict(type='str'), + enabled=dict(type='bool'), + expiration=dict(type='dict', options=dict( + comment=dict(type='str'), + expire_on=dict(type='str'), + mode=dict(type='str', choices=['never', 'expire-on']) + )), + policy_range_percentage=dict(type='int'), + policy_range_position=dict(type='str', choices=['top', 'bottom']), + poor_condition=dict(type='str', choices=['display rules that match', "display rules that don't match", "don't display rules"]), + rule=dict(type='dict', options=dict( + source=dict(type='list', elements='str'), + negate_source=dict(type='bool'), + destination=dict(type='list', elements='str'), + negate_destination=dict(type='bool'), + vpn=dict(type='list', elements='str'), + negate_vpn=dict(type='bool'), + services_and_applications=dict(type='list', elements='str'), + negate_services_and_applications=dict(type='bool'), + install_on=dict(type='list', elements='str'), + negate_install_on=dict(type='bool'), + time=dict(type='list', elements='str'), + negate_time=dict(type='bool'), + action=dict(type='list', elements='str'), + negate_action=dict(type='bool'), + track=dict(type='list', elements='str'), + negate_track=dict(type='bool'), + hit_count=dict(type='list', elements='str'), + negate_hit_count=dict(type='bool'), + name_condition=dict(type='dict', options=dict( + condition_type=dict(type='str', choices=['any', 'blank', 'not blank', 'starts with', 'equals', 'ends with', 'contains']), + value=dict(type='str') + )), + comment_condition=dict(type='dict', options=dict( + condition_type=dict(type='str', choices=['any', 'blank', 'not blank', 'starts with', 'equals', 'ends with', 'contains']), + value=dict(type='str') + )) + )), + secure_condition=dict(type='str', choices=['display rules that match', "display rules that don't match", "don't display rules"]), + tolerance=dict(type='int'), + violation_condition=dict(type='str', choices=['rule found', 'rule not found']), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool'), + best_practice_id=dict(type='str') + ) + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'firewall-best-practice' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_firewall_best_practice_facts.py b/plugins/modules/cp_mgmt_firewall_best_practice_facts.py new file mode 100644 index 0000000..350dc76 --- /dev/null +++ b/plugins/modules/cp_mgmt_firewall_best_practice_facts.py @@ -0,0 +1,181 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_firewall_best_practice_facts +short_description: Get firewall-best-practice objects facts on Checkpoint over Web Services API +description: + - Get firewall-best-practice objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + best_practice_id: + description: + - Best Practice ID. + type: str + name: + description: + - Best Practice Name. + This parameter is relevant only for getting a specific object. + type: str + show_regulations: + description: + - Show the applicable regulations of the Best Practice. + type: bool + show_relevant_objects: + description: + - Show the relevant objects of the Best Practice. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + filter_by: + description: + - Filter the result set by user-defined-only and status. + type: dict + suboptions: + status: + description: + - Filter by best-practice status. + type: list + elements: str + user_defined_only: + description: + - Restrict the result set to user-defined Firewall Best Practices. + type: bool + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-firewall-best-practice + cp_mgmt_firewall_best_practice_facts: + best_practice_id: FW001 + details_level: full + show_regulations: true + +- name: show-firewall-best-practices + cp_mgmt_firewall_best_practice_facts: + details_level: full + limit: 2 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + best_practice_id=dict(type='str'), + name=dict(type='str'), + show_regulations=dict(type='bool'), + show_relevant_objects=dict(type='bool'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + filter=dict(type='str'), + filter_by=dict(type='dict', options=dict( + status=dict(type='list', elements='str'), + user_defined_only=dict(type='bool') + )), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "firewall-best-practice" + api_call_object_plural_version = "firewall-best-practices" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_guideline.py b/plugins/modules/cp_mgmt_guideline.py new file mode 100644 index 0000000..7c6c2e8 --- /dev/null +++ b/plugins/modules/cp_mgmt_guideline.py @@ -0,0 +1,234 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_guideline +short_description: Manages guideline objects on Checkpoint over Web Services API +description: + - Manages guideline objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Object name. + type: str + required: True + access_layers: + description: + - Collection of access-layers (one or more) of the guideline, identified by name or UID. + type: list + elements: dict + suboptions: + access_layer: + description: + - Access-layer attached to guideline identified by the name or UID.if Access-Layer is in the global domain due to Global Assignment + Local domain Package is required. + type: str + policy_package: + description: + - Policy package context for the access-layer attached to guideline identified by the name or UID.Package will be ignored if the + access-layer is local. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain + only and with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + guideline_groups: + description: + - Collection of segments of the guideline. + type: list + elements: dict + suboptions: + name: + description: + - Network group name. + type: str + position: + description: + - Guideline-Group Position in the guideline. If a position is specified for one guideline-group, it is required for all guideline-groups. + type: str + cell_actions_override: + description: + - Cells that their action will override the default actions of the guideline. + type: list + elements: dict + suboptions: + from: + description: + - The segment identifier (name or UID) of the cell in the 'from' axis. The field is mandatory only if "from-type" is "network group". + type: str + from_type: + description: + - The type of the segment in the 'from' axis. + type: str + choices: ['network group', 'internet', 'other'] + to: + description: + - The segment identifier (name or UID) of the cell in the 'to' axis. The field is mandatory only if "to-type" is "network group". + type: str + to_type: + description: + - The type of the segment in the 'to' axis. + type: str + choices: ['network group', 'internet', 'other'] + action: + description: + - The action to be applied to the cell. The field is mandatory at add command. + type: str + choices: ['All traffic is allowed', 'All traffic is not allowed', 'Decide later'] + allowed_services: + description: + - Services (identified by name or UID) that are allowed in the cell. Relevant only if the action in the cell is 'All traffic is not + allowed'. To remove allowed-services call update with the same "All traffic is not allowed" action, or remove the cell-action-override. + type: list + elements: str + dereference_group_members: + description: + - Indicates whether to dereference "members" field by details level for every object in reply. + type: bool + show_membership: + description: + - Indicates whether to calculate and show "groups" field for every object in reply. + type: bool + color: + description: + - Color of the object. Should be one of existing colors. + type: str + choices: ['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', 'khaki', 'orchid', 'dark orange', 'dark sea green', + 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', + 'coral', 'sea green', 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', 'yellow'] + comments: + description: + - Comments string. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-guideline + cp_mgmt_guideline: + access_layers: + - Network + guideline_groups: + - name: DMZ + - name: Users networks + - name: Labs + name: Corporate policy + state: present + +- name: set-guideline + cp_mgmt_guideline: + name: Corporate policy + state: present + +- name: delete-guideline + cp_mgmt_guideline: + name: Corporate policy + state: absent +""" + +RETURN = """ +cp_mgmt_guideline: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + name=dict(type='str', required=True), + access_layers=dict(type='list', elements='dict', options=dict( + access_layer=dict(type='str'), + policy_package=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str') + )), + guideline_groups=dict(type='list', elements='dict', options=dict( + name=dict(type='str'), + position=dict(type='str') + )), + cell_actions_override=dict(type='list', elements='dict', options=dict( + from_type=dict(type='str', choices=['network group', 'internet', 'other']), + to=dict(type='str'), + to_type=dict(type='str', choices=['network group', 'internet', 'other']), + action=dict(type='str', choices=['All traffic is allowed', 'All traffic is not allowed', 'Decide later']), + allowed_services=dict(type='list', elements='str') + )), + dereference_group_members=dict(type='bool'), + show_membership=dict(type='bool'), + color=dict(type='str', choices=['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', + 'khaki', 'orchid', 'dark orange', 'dark sea green', 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', + 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', 'coral', 'sea green', + 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', + 'yellow']), + comments=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool') + ) + argument_spec['cell_actions_override']['options']['from'] = dict(type='str') + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'guideline' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_guideline_cell_approvals.py b/plugins/modules/cp_mgmt_guideline_cell_approvals.py new file mode 100644 index 0000000..24e69d6 --- /dev/null +++ b/plugins/modules/cp_mgmt_guideline_cell_approvals.py @@ -0,0 +1,180 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_guideline_cell_approvals +short_description: Manages guideline-cell-approvals objects on Checkpoint over Web Services API +description: + - Manages guideline-cell-approvals objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + guideline: + description: + - The guideline (identified by UID or name) in which we approve the violation. + type: str + approvals: + description: + - List of approved rules. + type: list + elements: dict + suboptions: + rules: + description: + - The full paths (pairs of layer and rule) of the approved rules. + type: list + elements: dict + suboptions: + layer: + description: + - The Layer identifier (name or UID). + type: str + rule: + description: + - The rule identifier (name if unique, rule position number in rule-base or UID). + type: str + from: + description: + - a "from" segment (identified by UID or name), or 'any' to approved the rule across all cells (possible only if "to" is also 'any'). This field + is mandatory if "from-type" is 'Network Group'. + type: str + from_type: + description: + - The type of the segment in the 'from' axis. + type: str + choices: ['network group', 'internet', 'other'] + to: + description: + - a "to" segment (identified by UID or name), or 'any' to approved the rule across all cells (possible only if "from" is also 'any'). This field + is mandatory if "to-type" is 'Network Group'. + type: str + to_type: + description: + - The type of the segment in the 'to' axis. + type: str + choices: ['network group', 'internet', 'other'] + comment: + description: + - New comment for the approvals. The same comment to all the requested approvals. + type: str + policy_package: + description: + - The policy package (identified by UID or name) in which we approve the violation. This field is mandatory only if the ordered-access-layer + (first layer in path) is from a global domain with AGP. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool + delete_scope: + description: + - Indicates whether to delete all the approval scope, or only remove the requested cell from the scope. Relevant only for guideline approvals. + type: str + choices: ['single cell', 'effected cells', 'guideline'] +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-guideline-cell-approvals + cp_mgmt_guideline_cell_approvals: + comment: This is approved for all segments + from: any + guideline: Corporate policy + state: present + to: any + +- name: set-guideline-cell-approvals + cp_mgmt_guideline_cell_approvals: + comment: This is approved for all segments, including future + from: any + guideline: Corporate policy + state: present + to: any + +- name: delete-guideline-cell-approvals + cp_mgmt_guideline_cell_approvals: + from: any + guideline: Corporate policy + state: absent + to: any +""" + +RETURN = """ +cp_mgmt_guideline_cell_approvals: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + guideline=dict(type='str'), + approvals=dict(type='list', elements='dict', options=dict( + rules=dict(type='list', elements='dict', options=dict( + layer=dict(type='str'), + rule=dict(type='str') + )) + )), + from_type=dict(type='str', choices=['network group', 'internet', 'other']), + to=dict(type='str'), + to_type=dict(type='str', choices=['network group', 'internet', 'other']), + comment=dict(type='str'), + policy_package=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool'), + delete_scope=dict(type='str', choices=['single cell', 'effected cells', 'guideline']) + ) + argument_spec['from'] = dict(type='str') + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'guideline-cell-approvals' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_guideline_facts.py b/plugins/modules/cp_mgmt_guideline_facts.py new file mode 100644 index 0000000..83fb5db --- /dev/null +++ b/plugins/modules/cp_mgmt_guideline_facts.py @@ -0,0 +1,218 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_guideline_facts +short_description: Get guideline objects facts on Checkpoint over Web Services API +description: + - Get guideline objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Object name. + This parameter is relevant only for getting a specific object. + type: str + show_indexing_status: + description: + - Control whether to show the indexing status of the guideline. + type: bool + indexing_status_layer: + description: + - Relevant only when show-indexing-status is true. The access-layer to show the indexing status of (identified by unique id or 'any' for all + attached access-layers). + type: str + dereference_group_members: + description: + - Indicates whether to dereference "members" field by details level for every object in reply. + type: bool + show_membership: + description: + - Indicates whether to calculate and show "groups" field for every object in reply. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + filter: + description: + - Additional filters for the query. + type: dict + suboptions: + access_layers: + description: + - List of access-layers identifiers to filter by. The query will return only guidelines that are attached to the given access-layers. + type: list + elements: str + layer_with_policy: + description: + - List of access-layer and policy-package pairs to filter by. For global access-layers, both access-layer and policy-package must match. + For local access-layers, only the access-layer needs to match. + type: list + elements: dict + suboptions: + access_layer: + description: + - Access-layer attached to guideline identified by the name or UID.if Access-Layer is in the global domain due to Global + Assignment Local domain Package is required. + type: str + policy_package: + description: + - Policy package context for the access-layer attached to guideline identified by the name or UID.Package will be ignored if the + access-layer is local. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully + detailed representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System + Domain only and with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + query: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object + Explorer. The logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a + textual search in name, comment, tags etc. + type: str + policy_packages: + description: + - List of local-domain policy packages identifiers to filter by, in case a guideline is attached to a layer with assigned global policy. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-guideline + cp_mgmt_guideline_facts: + name: Corporate policy + +- name: show-guidelines + cp_mgmt_guideline_facts: +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + name=dict(type='str'), + show_indexing_status=dict(type='bool'), + indexing_status_layer=dict(type='str'), + dereference_group_members=dict(type='bool'), + show_membership=dict(type='bool'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + filter=dict(type='dict', options=dict( + access_layers=dict(type='list', elements='str'), + layer_with_policy=dict(type='list', elements='dict', options=dict( + access_layer=dict(type='str'), + policy_package=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str') + )), + query=dict(type='str'), + policy_packages=dict(type='str') + )), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "guideline" + api_call_object_plural_version = "guidelines" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_prepare_software_package.py b/plugins/modules/cp_mgmt_prepare_software_package.py new file mode 100644 index 0000000..331128d --- /dev/null +++ b/plugins/modules/cp_mgmt_prepare_software_package.py @@ -0,0 +1,125 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_prepare_software_package +short_description: Prepares the software package on target machines. +description: + - Prepares the software package on target machines. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - The name of the software package. + type: str + required: True + targets: + description: + - On what targets to execute this command. Targets may be identified by their name, or object unique identifier. + type: list + elements: str + required: True + cluster_installation_settings: + description: + - Preparation settings for cluster. + type: dict + suboptions: + cluster_delay: + description: + - The delay between end of installation on one cluster members and start of installation on the next cluster member. + type: int + cluster_strategy: + description: + - The cluster installation strategy. + all-members - Install the package on all members in the cluster + non-active-members-and-failover - In the High Availability cluster, install the package only on the selected cluster members with the cluster state + 'Standby' and then failover from the current 'Active' member to one of the updated members + non-active-members-no-failover - In the High Availability cluster, install the package only on the selected cluster members with the cluster state + 'Standby' and then do not failover from the current 'Active' member to one of the updated members. + type: str + choices: ['all-members', 'non-active-members-and-failover', 'non-active-members-no-failover'] + concurrency_limit: + description: + - The number of targets, on which the same package is installed at the same time. + type: int + package_location: + description: + - The package repository. + type: str + choices: ['automatic', 'target-machine', 'central'] +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: prepare-software-package + cp_mgmt_prepare_software_package: + cluster_installation_settings: + cluster_strategy: non-active-members-no-failover + name: Check_Point_R80_40_JHF_MCD_DEMO_019_MAIN_Bundle_T1_VISIBLE_FULL.tgz + package_location: automatic + targets: + - corporate-gateway +""" + +RETURN = """ +cp_mgmt_prepare_software_package: + description: The checkpoint prepare-software-package output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + name=dict(type='str', required=True), + targets=dict(type='list', elements='str', required=True), + cluster_installation_settings=dict(type='dict', options=dict( + cluster_delay=dict(type='int'), + cluster_strategy=dict(type='str', choices=['all-members', 'non-active-members-and-failover', 'non-active-members-no-failover']) + )), + concurrency_limit=dict(type='int'), + package_location=dict(type='str', choices=['automatic', 'target-machine', 'central']) + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "prepare-software-package" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_regulation.py b/plugins/modules/cp_mgmt_regulation.py new file mode 100644 index 0000000..a230bc0 --- /dev/null +++ b/plugins/modules/cp_mgmt_regulation.py @@ -0,0 +1,161 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_regulation +short_description: Manages regulation objects on Checkpoint over Web Services API +description: + - Manages regulation objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Regulation name. + type: str + required: True + full_name: + description: + - Regulation full name. + type: str + enabled: + description: + - Determines if the regulation is enabled. + type: bool + show_requirements: + description: + - Show the requirements of the regulation. + type: bool + color: + description: + - Color of the object. Should be one of existing colors. + type: str + choices: ['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', 'khaki', 'orchid', 'dark orange', 'dark sea green', + 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', + 'coral', 'sea green', 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', 'yellow'] + comments: + description: + - Comments about this regulation. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + tags: + description: + - Collection of tag identifiers. + type: list + elements: str + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool + new_full_name: + description: + - Object new full name. Must be unique in the domain. + type: str +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-regulation + cp_mgmt_regulation: + comments: My compliance regulation + full_name: My New Regulation + name: MyReg + state: present + +- name: set-regulation + cp_mgmt_regulation: + comments: My compliance regulation. Disabled. + enabled: false + name: MyReg + new_full_name: My Regulation - disabled + state: present + +- name: delete-regulation + cp_mgmt_regulation: + name: MyReg + state: absent +""" + +RETURN = """ +cp_mgmt_regulation: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + name=dict(type='str', required=True), + full_name=dict(type='str'), + enabled=dict(type='bool'), + show_requirements=dict(type='bool'), + color=dict(type='str', choices=['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', + 'khaki', 'orchid', 'dark orange', 'dark sea green', 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', + 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', 'coral', 'sea green', + 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', + 'yellow']), + comments=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str'), + tags=dict(type='list', elements='str'), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool'), + new_full_name=dict(type='str') + ) + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'regulation' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_regulation_facts.py b/plugins/modules/cp_mgmt_regulation_facts.py new file mode 100644 index 0000000..fa446b6 --- /dev/null +++ b/plugins/modules/cp_mgmt_regulation_facts.py @@ -0,0 +1,172 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_regulation_facts +short_description: Get regulation objects facts on Checkpoint over Web Services API +description: + - Get regulation objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + full_name: + description: + - Regulation full name. + type: str + name: + description: + - Regulation name. + This parameter is relevant only for getting a specific object. + type: str + show_requirements: + description: + - Show the requirements of the regulation. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + filter_by: + description: + - Filter the regulations based on the selected filters. + type: dict + suboptions: + enabled_only: + description: + - Shows only the enabled regulations. + type: bool + user_defined_only: + description: + - Shows only the user-defined regulations. + type: bool + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-regulation + cp_mgmt_regulation_facts: + name: MyReg + +- name: show-regulations + cp_mgmt_regulation_facts: + limit: 3 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + full_name=dict(type='str'), + name=dict(type='str'), + show_requirements=dict(type='bool'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + filter=dict(type='str'), + filter_by=dict(type='dict', options=dict( + enabled_only=dict(type='bool'), + user_defined_only=dict(type='bool') + )), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "regulation" + api_call_object_plural_version = "regulations" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_requirement.py b/plugins/modules/cp_mgmt_requirement.py new file mode 100644 index 0000000..ccaed52 --- /dev/null +++ b/plugins/modules/cp_mgmt_requirement.py @@ -0,0 +1,172 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_requirement +short_description: Manages requirement objects on Checkpoint over Web Services API +description: + - Manages requirement objects on Checkpoint devices including creating, updating and removing objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - Requirement name. + type: str + required: True + regulation: + description: + - The regulation this requirement belongs to, identified by name or uid. + type: str + best_practices: + description: + - The UIDs or IDs of the relevant best practices for the requirement. + type: list + elements: str + color: + description: + - Color of the object. Should be one of existing colors. + type: str + choices: ['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', 'khaki', 'orchid', 'dark orange', 'dark sea green', + 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', + 'coral', 'sea green', 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', 'yellow'] + comments: + description: + - The requirement comments. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + tags: + description: + - Collection of tag identifiers. + type: list + elements: str + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool + requirement_data: + description: + - Requirement data. + type: dict + suboptions: + name: + description: + - Name of the requirement. + type: str + regulation: + description: + - The regulation the requirement belongs to, identified by name or uid. + type: str + new_regulation: + description: + - The new regulation for this requirement, identified by name or uid. + type: str +extends_documentation_fragment: check_point.mgmt.checkpoint_objects +""" + +EXAMPLES = """ +- name: add-requirement + cp_mgmt_requirement: + comments: My New Requirement + name: MyReq + regulation: MyReg + state: present + +- name: set-requirement + cp_mgmt_requirement: + comments: My new comments + name: MyReq + state: present + +- name: delete-requirement + cp_mgmt_requirement: + name: MyReq + state: absent +""" + +RETURN = """ +cp_mgmt_requirement: + description: The checkpoint object created or updated. + returned: always, except when deleting the object. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_objects, api_call + + +def main(): + argument_spec = dict( + name=dict(type='str', required=True), + regulation=dict(type='str'), + best_practices=dict(type='list', elements='str'), + color=dict(type='str', choices=['aquamarine', 'black', 'blue', 'crete blue', 'burlywood', 'cyan', 'dark green', + 'khaki', 'orchid', 'dark orange', 'dark sea green', 'pink', 'turquoise', 'dark blue', 'firebrick', 'brown', + 'forest green', 'gold', 'dark gold', 'gray', 'dark gray', 'light green', 'lemon chiffon', 'coral', 'sea green', + 'sky blue', 'magenta', 'purple', 'slate blue', 'violet red', 'navy blue', 'olive', 'orange', 'red', 'sienna', + 'yellow']), + comments=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str'), + tags=dict(type='list', elements='str'), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool'), + requirement_data=dict(type='dict', options=dict( + name=dict(type='str'), + regulation=dict(type='str') + )), + new_regulation=dict(type='str') + ) + argument_spec.update(checkpoint_argument_spec_for_objects) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + api_call_object = 'requirement' + + result = api_call(module, api_call_object) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_requirement_facts.py b/plugins/modules/cp_mgmt_requirement_facts.py new file mode 100644 index 0000000..65c9fac --- /dev/null +++ b/plugins/modules/cp_mgmt_requirement_facts.py @@ -0,0 +1,180 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_requirement_facts +short_description: Get requirement objects facts on Checkpoint over Web Services API +description: + - Get requirement objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + requirement_data: + description: + - Requirement data. + type: dict + suboptions: + name: + description: + - Name of the requirement. + type: str + regulation: + description: + - The regulation the requirement belongs to, identified by name or uid. + type: str + name: + description: + - Requirement name. + This parameter is relevant only for getting a specific object. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + filter_by: + description: + - Filter the requirements based on the selected filters. + type: dict + suboptions: + regulation: + description: + - Regulation name or uid. Shows only requirements that are part of this regulation. + type: list + elements: str + user_defined_only: + description: + - Shows only the user-defined regulations. + type: bool + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-requirement + cp_mgmt_requirement_facts: + name: MyReq + +- name: show-requirements + cp_mgmt_requirement_facts: + limit: 3 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + requirement_data=dict(type='dict', options=dict( + name=dict(type='str'), + regulation=dict(type='str') + )), + name=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + filter=dict(type='str'), + filter_by=dict(type='dict', options=dict( + regulation=dict(type='list', elements='str'), + user_defined_only=dict(type='bool') + )), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "requirement" + api_call_object_plural_version = "requirements" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_best_practice.py b/plugins/modules/cp_mgmt_set_best_practice.py new file mode 100644 index 0000000..de9b7c8 --- /dev/null +++ b/plugins/modules/cp_mgmt_set_best_practice.py @@ -0,0 +1,169 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_best_practice +short_description: Edit an existing Best Practice using object name, uid or best practice id. Activate or deactivate the best practice and its relevant objects. +description: + - Edit an existing Best Practice using object name, uid or best practice id. Activate or deactivate the best practice and its relevant objects. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + best_practice_id: + description: + - Best Practice ID. + type: str + name: + description: + - Best Practice Name. + type: str + active: + description: + - The activation status of the best practice. + type: bool + deactivation_comment: + description: + - The reason for deactivating the best practice.
Required only if active is set to false. + type: str + deactivation_expiration_date: + description: + - When the deactivation expires. Date and time represented in international ISO 8601 format. Relevant only if deactivation-mode is set to 'expire-on'. + type: str + deactivation_mode: + description: + - Whether the deactivation never expires or expires on a specific date.
Required only if active is set to false. + type: str + choices: ['never', 'expire-on'] + relevant_objects: + description: + - The relevant objects to activate or deactivate, each with its own deactivation settings. Supports the 'update' action only. + type: dict + suboptions: + update: + description: + - Updates a value from a collection + type: dict + suboptions: + name: + description: + - The name of the relevant object to update, as shown in the 'show-best-practice' reply. For a security gateway relevant object, + this is the security gateway name; for an access rule relevant object, this is the layer name. + type: str + deactivation_comment: + description: + - The reason for deactivating the relevant object.
Required only if enabled is set to false. + type: str + deactivation_expiration_date: + description: + - When the deactivation expires. Date and time represented in international ISO 8601 format. Relevant only if deactivation-mode + is set to 'expire-on'. + type: str + deactivation_mode: + description: + - Whether the deactivation never expires or expires on a specific date.
Required only if enabled is set to false. + type: str + choices: ['never', 'expire-on'] + enabled: + description: + - The activation status of the relevant object in the Compliance scan. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-best-practice + cp_mgmt_set_best_practice: + best_practice_id: FW164 + relevant_objects: + update: + deactivation_comment: Gateway excluded from this check. + deactivation_mode: never + enabled: false + name: gw1 +""" + +RETURN = """ +cp_mgmt_set_best_practice: + description: The checkpoint set-best-practice output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + best_practice_id=dict(type='str'), + name=dict(type='str'), + active=dict(type='bool'), + deactivation_comment=dict(type='str'), + deactivation_expiration_date=dict(type='str'), + deactivation_mode=dict(type='str', choices=['never', 'expire-on']), + relevant_objects=dict(type='dict', options=dict( + update=dict(type='dict', options=dict( + name=dict(type='str'), + deactivation_comment=dict(type='str'), + deactivation_expiration_date=dict(type='str'), + deactivation_mode=dict(type='str', choices=['never', 'expire-on']), + enabled=dict(type='bool') + )) + )), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-best-practice" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_cloud_license_gateway.py b/plugins/modules/cp_mgmt_set_cloud_license_gateway.py new file mode 100644 index 0000000..18b9a1d --- /dev/null +++ b/plugins/modules/cp_mgmt_set_cloud_license_gateway.py @@ -0,0 +1,91 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_cloud_license_gateway +short_description: Edit existing gateway license using name or uid. +description: + - Edit existing gateway license using name or uid. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + gateway: + description: + - Security gateway name or UID to set. + type: str + required: True + enable_auto_distribution: + description: + - Enable or disable auto distribution of cloud licenses for the specified gateway. + type: bool + required: True + domain: + description: + - Domain name or UID for the gateway. Required when running from MDS context. + type: str +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-cloud-license-gateway + cp_mgmt_set_cloud_license_gateway: + enable_auto_distribution: true + gateway: Gateway_0.0.0.0 +""" + +RETURN = """ +cp_mgmt_set_cloud_license_gateway: + description: The checkpoint set-cloud-license-gateway output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + gateway=dict(type='str', required=True), + enable_auto_distribution=dict(type='bool', required=True), + domain=dict(type='str') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-cloud-license-gateway" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_cloud_license_pool.py b/plugins/modules/cp_mgmt_set_cloud_license_pool.py new file mode 100644 index 0000000..ff6adf1 --- /dev/null +++ b/plugins/modules/cp_mgmt_set_cloud_license_pool.py @@ -0,0 +1,117 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_cloud_license_pool +short_description: Edit existing pool using name. +description: + - Edit existing pool using name. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + pool: + description: + - Pool name. + type: str + required: True + ck: + description: + - Contract Key. Required to identify a specific pool when multiple pools share the same name. + type: str + default_pool: + description: + - Set pool to default. This value can only be changed from false to true. To disable the current default pool, you must set a different pool as + the default. + type: bool + choices: ['true'] + migrate_gateways: + description: + - Move gateways from current default pool to the new default pool. Required when default-pool parameter is set to true. + type: bool + assigned_gateways: + description: + - Attach security gateways to the pool. The attached gateways will use licenses from this pool. + type: list + elements: dict + suboptions: + gateway: + description: + - Gateway name or uid. + type: str + domain: + description: + - Domain name or uid. Required when running from MDS context. + type: str +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-cloud-license-pool + cp_mgmt_set_cloud_license_pool: + assigned_gateways: + - gateway: GW_A + - gateway: GW_B + pool: VE-NGTX +""" + +RETURN = """ +cp_mgmt_set_cloud_license_pool: + description: The checkpoint set-cloud-license-pool output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + pool=dict(type='str', required=True), + ck=dict(type='str'), + default_pool=dict(type='bool', choices=['true']), + migrate_gateways=dict(type='bool'), + assigned_gateways=dict(type='list', elements='dict', options=dict( + gateway=dict(type='str'), + domain=dict(type='str') + )) + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-cloud-license-pool" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_cloud_license_scope.py b/plugins/modules/cp_mgmt_set_cloud_license_scope.py new file mode 100644 index 0000000..aa63eda --- /dev/null +++ b/plugins/modules/cp_mgmt_set_cloud_license_scope.py @@ -0,0 +1,80 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_cloud_license_scope +short_description: Set cloud license operational mode. +description: + - Set cloud license operational mode. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + mode: + description: + - Set cloud license scope mode. + type: str + choices: ['mds', 'domain'] + required: True +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-cloud-license-scope + cp_mgmt_set_cloud_license_scope: + mode: mds +""" + +RETURN = """ +cp_mgmt_set_cloud_license_scope: + description: The checkpoint set-cloud-license-scope output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + mode=dict(type='str', choices=['mds', 'domain'], required=True) + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-cloud-license-scope" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_threat_emulation_file_type.py b/plugins/modules/cp_mgmt_set_threat_emulation_file_type.py new file mode 100644 index 0000000..da36b5d --- /dev/null +++ b/plugins/modules/cp_mgmt_set_threat_emulation_file_type.py @@ -0,0 +1,89 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_threat_emulation_file_type +short_description: Edit a Threat Emulation file type support settings. +description: + - Edit a Threat Emulation file type support settings. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + file_type_id: + description: + - File type id. + type: str + file_type: + description: + - File type extension. + type: str + enabled: + description: + - Enable support for Threat Emulation. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-threat-emulation-file-type + cp_mgmt_set_threat_emulation_file_type: + enabled: false + file_type: pdf +""" + +RETURN = """ +cp_mgmt_set_threat_emulation_file_type: + description: The checkpoint set-threat-emulation-file-type output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + file_type_id=dict(type='str'), + file_type=dict(type='str'), + enabled=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-threat-emulation-file-type" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_threat_emulation_file_types.py b/plugins/modules/cp_mgmt_set_threat_emulation_file_types.py new file mode 100644 index 0000000..4722f53 --- /dev/null +++ b/plugins/modules/cp_mgmt_set_threat_emulation_file_types.py @@ -0,0 +1,126 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_threat_emulation_file_types +short_description: Edit support settings for multiple Threat Emulation file types in a single request. +description: + - Edit support settings for multiple Threat Emulation file types in a single request. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + file_types: + description: + - List of Threat Emulation file type updates. Each entry sets 'enabled' on the file type identified by 'file-type-id' or 'file-type'. + type: list + elements: dict + suboptions: + file_type_id: + description: + - File type id. + type: str + file_type: + description: + - File type extension. + type: str + enabled: + description: + - Enable support for Threat Emulation. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-threat-emulation-file-types + cp_mgmt_set_threat_emulation_file_types: + file_types: + - enabled: false + file_type: pdf + - enabled: true + file_type: docx + - enabled: true + file_type_id: 6c7f5a1f-1234-4abc-89aa-0b1c2d3e4f56 +""" + +RETURN = """ +cp_mgmt_set_threat_emulation_file_types: + description: The checkpoint set-threat-emulation-file-types output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + file_types=dict(type='list', elements='dict', options=dict( + file_type_id=dict(type='str'), + file_type=dict(type='str'), + enabled=dict(type='bool') + )), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str'), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-threat-emulation-file-types" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_threat_extraction_file_type.py b/plugins/modules/cp_mgmt_set_threat_extraction_file_type.py new file mode 100644 index 0000000..906aa7e --- /dev/null +++ b/plugins/modules/cp_mgmt_set_threat_extraction_file_type.py @@ -0,0 +1,89 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_threat_extraction_file_type +short_description: Edit a Threat Extraction file type support settings. +description: + - Edit a Threat Extraction file type support settings. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + file_type_id: + description: + - File type id. + type: str + file_type: + description: + - File type extension. + type: str + enabled: + description: + - Enable support for Threat Extraction. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-threat-extraction-file-type + cp_mgmt_set_threat_extraction_file_type: + enabled: false + file_type: pdf +""" + +RETURN = """ +cp_mgmt_set_threat_extraction_file_type: + description: The checkpoint set-threat-extraction-file-type output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + file_type_id=dict(type='str'), + file_type=dict(type='str'), + enabled=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-threat-extraction-file-type" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_threat_extraction_file_types.py b/plugins/modules/cp_mgmt_set_threat_extraction_file_types.py new file mode 100644 index 0000000..c780be1 --- /dev/null +++ b/plugins/modules/cp_mgmt_set_threat_extraction_file_types.py @@ -0,0 +1,126 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_threat_extraction_file_types +short_description: Edit support settings for multiple Threat Extraction file types in a single request. +description: + - Edit support settings for multiple Threat Extraction file types in a single request. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + file_types: + description: + - List of Threat Extraction file type updates. Each entry sets 'enabled' on the file type identified by 'file-type-id' or 'file-type'. + type: list + elements: dict + suboptions: + file_type_id: + description: + - File type id. + type: str + file_type: + description: + - File type extension. + type: str + enabled: + description: + - Enable support for Threat Extraction. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + ignore_warnings: + description: + - Apply changes ignoring warnings. + type: bool + ignore_errors: + description: + - Apply changes ignoring errors. You won't be able to publish such a changes. If ignore-warnings flag was omitted - warnings will also be ignored. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-threat-extraction-file-types + cp_mgmt_set_threat_extraction_file_types: + file_types: + - enabled: false + file_type: pdf + - enabled: true + file_type: docx + - enabled: true + file_type_id: 5b8e4a0e-9876-4cba-8aa9-0b1c2d3e4f56 +""" + +RETURN = """ +cp_mgmt_set_threat_extraction_file_types: + description: The checkpoint set-threat-extraction-file-types output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + file_types=dict(type='list', elements='dict', options=dict( + file_type_id=dict(type='str'), + file_type=dict(type='str'), + enabled=dict(type='bool') + )), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str'), + ignore_warnings=dict(type='bool'), + ignore_errors=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-threat-extraction-file-types" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_threat_protection_category.py b/plugins/modules/cp_mgmt_set_threat_protection_category.py new file mode 100644 index 0000000..6840c58 --- /dev/null +++ b/plugins/modules/cp_mgmt_set_threat_protection_category.py @@ -0,0 +1,127 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_threat_protection_category +short_description: Edit existing object using object name or uid. +description: + - Edit existing object using object name or uid. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - The Category name. + type: str + blade: + description: + - The blade this category belongs to. Required when using 'name'. + type: str + show_profiles: + description: + - Indicates whether to calculate and show "profiles" field in reply. + type: bool + all_profiles: + description: + - Apply action to all profiles. Default, true. + type: bool + action: + description: + - Action to apply to all profiles. Required when all-profiles is true. + type: str + choices: ['ask', 'prevent', 'detect', 'inactive', 'restore'] + overrides: + description: + - Overrides per profile for this protection. Required when all-profiles is false. + type: list + elements: dict + suboptions: + action: + description: + - Action to apply for the specified profile. + type: str + choices: ['ask', 'prevent', 'detect', 'inactive', 'restore'] + profile: + description: + - Profile name or UID. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-threat-protection-category + cp_mgmt_set_threat_protection_category: + action: detect + blade: anti-bot + name: Reputation IPs +""" + +RETURN = """ +cp_mgmt_set_threat_protection_category: + description: The checkpoint set-threat-protection-category output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + name=dict(type='str'), + blade=dict(type='str'), + show_profiles=dict(type='bool'), + all_profiles=dict(type='bool'), + action=dict(type='str', choices=['ask', 'prevent', 'detect', 'inactive', 'restore']), + overrides=dict(type='list', elements='dict', options=dict( + action=dict(type='str', choices=['ask', 'prevent', 'detect', 'inactive', 'restore']), + profile=dict(type='str') + )), + details_level=dict(type='str', choices=['uid', 'standard', 'full']) + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-threat-protection-category" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_set_threat_protection_sub_category.py b/plugins/modules/cp_mgmt_set_threat_protection_sub_category.py new file mode 100644 index 0000000..ac492bd --- /dev/null +++ b/plugins/modules/cp_mgmt_set_threat_protection_sub_category.py @@ -0,0 +1,121 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_set_threat_protection_sub_category +short_description: Edit existing object using object name or uid. +description: + - Edit existing object using object name or uid. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - The sub-category's name. + type: str + all_profiles: + description: + - Apply action to all profiles. Default, true. + type: bool + show_profiles: + description: + - Indicates whether to calculate and show "profiles" field in reply. + type: bool + action: + description: + - Action to apply to all profiles. Required when all-profiles is true. + type: str + choices: ['ask', 'prevent', 'detect', 'inactive', 'restore'] + overrides: + description: + - Overrides per profile for this protection. Required when all-profiles is false. + type: list + elements: dict + suboptions: + action: + description: + - Action to apply for the specified profile. + type: str + choices: ['ask', 'prevent', 'detect', 'inactive', 'restore'] + profile: + description: + - Profile name or UID. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: set-threat-protection-sub-category + cp_mgmt_set_threat_protection_sub_category: + action: prevent + name: Backdoor.WIN32.FoggyWeb.B +""" + +RETURN = """ +cp_mgmt_set_threat_protection_sub_category: + description: The checkpoint set-threat-protection-sub-category output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + name=dict(type='str'), + all_profiles=dict(type='bool'), + show_profiles=dict(type='bool'), + action=dict(type='str', choices=['ask', 'prevent', 'detect', 'inactive', 'restore']), + overrides=dict(type='list', elements='dict', options=dict( + action=dict(type='str', choices=['ask', 'prevent', 'detect', 'inactive', 'restore']), + profile=dict(type='str') + )), + details_level=dict(type='str', choices=['uid', 'standard', 'full']) + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "set-threat-protection-sub-category" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_show_ad_content.py b/plugins/modules/cp_mgmt_show_ad_content.py new file mode 100644 index 0000000..ce7257a --- /dev/null +++ b/plugins/modules/cp_mgmt_show_ad_content.py @@ -0,0 +1,148 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_show_ad_content +short_description: Retrieves Active Directory users, groups, and machines for an Account Unit. +description: + - Retrieves Active Directory users, groups, and machines for an Account Unit. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + account_unit: + description: + - Name or UID of the Active Directory Account Unit to query. + type: str + required: True + filter: + description: + - Filters the returned entities. + type: dict + suboptions: + text: + description: + - Search text. entities matching any of the values are returned. + type: list + elements: str + exact_match: + description: + - When true, uses equality match on attributes. When false, uses substring match. Not applicable when 'search-in' is 'anr'. + type: bool + search_in: + description: + - AD attributes to search in. An entity is returned if text matches in any of the specified attributes. Set to 'anr' to use Ambiguous + Name Resolution - an AD server-side feature that searches across multiple indexed attributes simultaneously. 'anr' cannot be combined with other + attributes. + type: list + elements: str + fetch_users: + description: + - When true, includes user entities in the results. + type: bool + fetch_groups: + description: + - When true, includes group entities in the results. + type: bool + fetch_machines: + description: + - When true, includes machine entities in the results. + type: bool + fetch_direct_groups: + description: + - When true, returns the direct (first-level) groups each entity belongs to in 'member-of'. + type: bool + use_cursor: + description: + - When true, enables cursor pagination using LDAP Simple Paged Results. The response carries 'next-cursor', which the caller passes back as + 'cursor' on subsequent requests to fetch the next batch. Cannot be combined with 'offset'. When 'use-cursor' is true, 'total' is not returned in the + response. + type: bool + cursor: + description: + - Opaque pagination cursor from a previous response's 'next-cursor'. Omit on the first call of a cursor walk. Requires 'use-cursor' to be true. + type: str + limit: + description: + - The maximal number of returned results. + type: int + offset: + description: + - Number of the results to initially skip. Cannot be combined with 'use-cursor' set to true. + type: int +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: show-ad-content + cp_mgmt_show_ad_content: + account_unit: MyActiveDirectory + limit: 4 +""" + +RETURN = """ +cp_mgmt_show_ad_content: + description: The checkpoint show-ad-content output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + account_unit=dict(type='str', required=True), + filter=dict(type='dict', options=dict( + text=dict(type='list', elements='str'), + exact_match=dict(type='bool'), + search_in=dict(type='list', elements='str'), + fetch_users=dict(type='bool'), + fetch_groups=dict(type='bool'), + fetch_machines=dict(type='bool') + )), + fetch_direct_groups=dict(type='bool'), + use_cursor=dict(type='bool'), + cursor=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "show-ad-content" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_show_cloud_license_scope.py b/plugins/modules/cp_mgmt_show_cloud_license_scope.py new file mode 100644 index 0000000..0b6e2d0 --- /dev/null +++ b/plugins/modules/cp_mgmt_show_cloud_license_scope.py @@ -0,0 +1,72 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_show_cloud_license_scope +short_description: Show current cloud license mode. +description: + - Show current cloud license mode. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: {} +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: show-cloud-license-scope + cp_mgmt_show_cloud_license_scope: +""" + +RETURN = """ +cp_mgmt_show_cloud_license_scope: + description: The checkpoint show-cloud-license-scope output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "show-cloud-license-scope" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_show_dlp_next_data_types_repository_content.py b/plugins/modules/cp_mgmt_show_dlp_next_data_types_repository_content.py new file mode 100644 index 0000000..c5df620 --- /dev/null +++ b/plugins/modules/cp_mgmt_show_dlp_next_data_types_repository_content.py @@ -0,0 +1,100 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_show_dlp_next_data_types_repository_content +short_description: Retrieve all DLP Next Data Type Objects from Infinity portal. +description: + - Retrieve all DLP Next Data Type Objects from Infinity portal. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + filter: + description: + - Filter by object name in repository. + type: str + limit: + description: + - The maximal number of returned results. + type: int + offset: + description: + - Number of the results to initially skip. + type: int + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: show-dlp-next-data-types-repository-content + cp_mgmt_show_dlp_next_data_types_repository_content: + limit: 1 +""" + +RETURN = """ +cp_mgmt_show_dlp_next_data_types_repository_content: + description: The checkpoint show-dlp-next-data-types-repository-content output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "show-dlp-next-data-types-repository-content" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_show_guideline_cells.py b/plugins/modules/cp_mgmt_show_guideline_cells.py new file mode 100644 index 0000000..eddd8d7 --- /dev/null +++ b/plugins/modules/cp_mgmt_show_guideline_cells.py @@ -0,0 +1,174 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_show_guideline_cells +short_description: Showing guideline-cells metrics according to the given filters. +description: + - Showing guideline-cells metrics according to the given filters. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + guideline: + description: + - The guideline the user wish to view (identified by name or UID). + type: str + required: True + access_layer: + description: + - The access layer context for the guideline metrics display. + The access-layer must be attached to the guideline. + type: dict + required: True + suboptions: + access_layer: + description: + - Access-layer attached to guideline identified by the name or UID.if Access-Layer is in the global domain due to Global Assignment + Local domain Package is required. + type: str + policy_package: + description: + - Policy package context for the access-layer attached to guideline identified by the name or UID.Package will be ignored if the + access-layer is local. + type: str + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain + only and with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + filters: + description: + - The filters are used to filter the cells and services that will be returned in the response. + 'any' value in both 'from' and 'to' filters will return the whole matrix. + type: dict + suboptions: + from: + description: + - The source segment of the cell (identified by name or UID). + In case the value is 'any', entire row will be returned. Relevant only for 'Network Group' type. + type: str + to: + description: + - The destination segment of the cell (identified by name or UID). + In case the value is 'any', entire column will be returned. Relevant only for 'Network Group' type. + type: str + from_type: + description: + - The type of the segment in the 'from' axis. + type: str + choices: ['network group', 'internet', 'other'] + to_type: + description: + - The type of the segment in the 'to' axis. + type: str + choices: ['network group', 'internet', 'other'] + services: + description: + - The services that will be used while calculating the metrics (identified by name or UID). + type: list + elements: str + show_count: + description: + - Set of metrics type. The rules categories to return in the response. + type: list + elements: str + show_rules: + description: + - This field is used to control whether to show the rules paths in the response. This field should be set to true only when the 'from' and 'to' + filters fields are not 'any'. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: show-guideline-cells + cp_mgmt_show_guideline_cells: + access_layer: + access_layer: Network + details_level: uid + guideline: Corporate policy +""" + +RETURN = """ +cp_mgmt_show_guideline_cells: + description: The checkpoint show-guideline-cells output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + guideline=dict(type='str', required=True), + access_layer=dict(type='dict', options=dict( + access_layer=dict(type='str'), + policy_package=dict(type='str'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + domains_to_process=dict(type='list', elements='str') + ), required=True), + filters=dict(type='dict', options=dict( + to=dict(type='str'), + from_type=dict(type='str', choices=['network group', 'internet', 'other']), + to_type=dict(type='str', choices=['network group', 'internet', 'other']), + services=dict(type='list', elements='str') + )), + show_count=dict(type='list', elements='str'), + show_rules=dict(type='bool'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']) + ) + argument_spec['filters']['options']['from'] = dict(type='str') + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "show-guideline-cells" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_simple_gateway.py b/plugins/modules/cp_mgmt_simple_gateway.py index b54b379..5b8da3b 100644 --- a/plugins/modules/cp_mgmt_simple_gateway.py +++ b/plugins/modules/cp_mgmt_simple_gateway.py @@ -110,6 +110,459 @@ description: - N/A type: int + identity_awareness: + description: + - Identity awareness blade enabled. + type: bool + version_added: "7.0.0" + identity_awareness_settings: + description: + - Gateway Identity Awareness settings. + type: dict + version_added: "7.0.0" + suboptions: + browser_based_authentication: + description: + - Enable Browser Based Authentication source. + type: bool + browser_based_authentication_settings: + description: + - Browser Based Authentication settings. + type: dict + suboptions: + authentication_settings: + description: + - Authentication Settings for Browser Based Authentication. + type: dict + suboptions: + authentication_method: + description: + - Authentication method. + type: str + choices: ['username and password', 'defined on user record', 'identity provider', 'radius'] + identity_provider: + description: + - Identity provider object identified by the name or UID. Must be set when "authentication-method" was selected to be "identity provider". + type: list + elements: str + radius: + description: + - Radius server object identified by the name or UID. Must be set when "authentication-method" was selected to be "radius". + type: str + users_directories: + description: + - Users directories. + type: dict + suboptions: + external_user_profile: + description: + - External user profile. + type: bool + internal_users: + description: + - Internal users. + type: bool + users_from_external_directories: + description: + - Users from external directories. + type: str + choices: ['all gateways directories', 'specific', 'none'] + specific: + description: + - LDAP AU objects identified by the name or UID. Must be set when "users-from-external-directories" was selected to be "specific". + type: list + elements: str + browser_based_authentication_portal_settings: + description: + - Browser Based Authentication portal settings. + type: dict + suboptions: + portal_web_settings: + description: + - Configuration of the portal web settings. + type: dict + suboptions: + aliases: + description: + - List of URL aliases that are redirected to the main portal URL. + type: list + elements: str + ip_address: + description: + - Optional, IP address for the web portal to use, if your DNS server fails to resolve the main portal URL. + Note, If your DNS server resolves the main portal URL, this IP address is ignored. + type: str + main_url: + description: + - The main URL for the web portal. + type: str + certificate_settings: + description: + - Configuration of the portal certificate settings. + type: dict + suboptions: + base64_certificate: + description: + - The certificate file encoded in Base64 with padding. + This file must be in the *.p12 format. + type: str + base64_password: + description: + - Password (encoded in Base64 with padding) for the certificate file. + type: str + accessibility: + description: + - Configuration of the portal access settings. + type: dict + suboptions: + allow_access_from: + description: + - Allowed access to the web portal (based on interfaces, or security policy). + type: str + choices: ['rule_base', 'internal_interfaces', 'all_interfaces'] + internal_access_settings: + description: + - Configuration of the additional portal access settings for internal interfaces only. + type: dict + suboptions: + undefined: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'. + type: bool + dmz: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'. + type: bool + vpn: + description: + - Controls portal access settings for interfaces that are part of a VPN Encryption Domain. + type: bool + identity_agent: + description: + - Enable Identity Agent source. + type: bool + identity_agent_settings: + description: + - Identity Agent settings. + type: dict + suboptions: + agents_interval_keepalive: + description: + - Agents send keepalive period (minutes). + type: int + user_reauthenticate_interval: + description: + - Agent reauthenticate time interval (minutes). + type: int + authentication_settings: + description: + - Authentication Settings for Identity Agent. + type: dict + suboptions: + authentication_method: + description: + - Authentication method. + type: str + choices: ['username and password', 'defined on user record', 'radius'] + radius: + description: + - Radius server object identified by the name or UID. Must be set when "authentication-method" was selected to be "radius". + type: str + users_directories: + description: + - Users directories. + type: dict + suboptions: + external_user_profile: + description: + - External user profile. + type: bool + internal_users: + description: + - Internal users. + type: bool + users_from_external_directories: + description: + - Users from external directories. + type: str + choices: ['all gateways directories', 'specific', 'none'] + specific: + description: + - LDAP AU objects identified by the name or UID. Must be set when "users-from-external-directories" was selected to be "specific". + type: list + elements: str + identity_agent_portal_settings: + description: + - Identity Agent accessibility settings. + type: dict + suboptions: + accessibility: + description: + - Configuration of the portal access settings. + type: dict + suboptions: + allow_access_from: + description: + - Allowed access to the web portal (based on interfaces, or security policy). + type: str + choices: ['rule_base', 'internal_interfaces', 'all_interfaces'] + internal_access_settings: + description: + - Configuration of the additional portal access settings for internal interfaces only. + type: dict + suboptions: + undefined: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'. + type: bool + dmz: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'. + type: bool + vpn: + description: + - Controls portal access settings for interfaces that are part of a VPN Encryption Domain. + type: bool + identity_based_enforcement: + description: + - ON, Configures this object as a PEP-only object - identity-based enforcement (PEP) is enabled.
OFF, Configures this object as a + PDP-only object - identity-based enforcement is disabled. + type: str + choices: ['on', 'off'] + identity_collector: + description: + - Enable Identity Collector source. + type: bool + identity_collector_settings: + description: + - Identity Collector settings. + type: dict + suboptions: + authentication_settings: + description: + - Authentication Settings for Identity Collector. + type: dict + suboptions: + users_directories: + description: + - Users directories. + type: dict + suboptions: + external_user_profile: + description: + - External user profile. + type: bool + internal_users: + description: + - Internal users. + type: bool + users_from_external_directories: + description: + - Users from external directories. + type: str + choices: ['all gateways directories', 'specific', 'none'] + specific: + description: + - LDAP AU objects identified by the name or UID. Must be set when "users-from-external-directories" was selected to be "specific". + type: list + elements: str + authorized_clients: + description: + - Authorized Clients. + type: list + elements: dict + suboptions: + client: + description: + - Host / Network Group Name or UID. + type: str + client_secret: + description: + - Client Secret. + type: str + client_access_permissions: + description: + - Identity Collector accessibility settings. + type: dict + suboptions: + accessibility: + description: + - Configuration of the portal access settings. + type: dict + suboptions: + allow_access_from: + description: + - Allowed access to the web portal (based on interfaces, or security policy). + type: str + choices: ['rule_base', 'internal_interfaces', 'all_interfaces'] + internal_access_settings: + description: + - Configuration of the additional portal access settings for internal interfaces only. + type: dict + suboptions: + undefined: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'. + type: bool + dmz: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'. + type: bool + vpn: + description: + - Controls portal access settings for interfaces that are part of a VPN Encryption Domain. + type: bool + identity_sharing_settings: + description: + - Identity sharing settings. + type: dict + suboptions: + share_with_other_gateways: + description: + - Enable identity sharing with other gateways. + type: bool + receive_from_infinity_identity: + description: + - Enable receiving identities from Infinity Identity. + type: bool + receive_from_other_gateways: + description: + - Enable receiving identity from other gateways. + type: bool + receive_from: + description: + - Gateway(s) to receive identity from. + type: list + elements: str + cache_mode: + description: + - True, In case of connectivity loss from the Policy-Decision-Point (PDP), extend Identity cache up-to + "cache-mode-duration".
False, Identity Cache Mode is disabled, in case of connectivity loss from the Policy-Decision-Point, existing + Identities will be lost immediately. + type: dict + suboptions: + override_profile: + description: + - Override profile of global configuration. + type: bool + value: + description: + - Override value.
Required only for 'override-profile' is True. + type: bool + cache_mode_duration: + description: + - Time limit for keeping Identities in the cache. + type: dict + suboptions: + override_profile: + description: + - Override profile of global configuration. + type: bool + value: + description: + - Override value.
Required only for 'override-profile' is True. + Valid values are in the range 1-2880. + type: int + scaled_sharing: + description: + - Enable Scaled Sharing. + type: bool + identity_web_api: + description: + - Enable Identity Web API source. + type: bool + identity_web_api_settings: + description: + - Identity Web API settings. + type: dict + suboptions: + authentication_settings: + description: + - Authentication Settings for Identity Web Api. + type: dict + suboptions: + users_directories: + description: + - Users directories. + type: dict + suboptions: + external_user_profile: + description: + - External user profile. + type: bool + internal_users: + description: + - Internal users. + type: bool + users_from_external_directories: + description: + - Users from external directories. + type: str + choices: ['all gateways directories', 'specific', 'none'] + specific: + description: + - LDAP AU objects identified by the name or UID. Must be set when "users-from-external-directories" was selected to be "specific". + type: list + elements: str + authorized_clients: + description: + - Authorized Clients. + type: list + elements: dict + suboptions: + client: + description: + - Host / Network Group Name or UID. + type: str + client_secret: + description: + - Client Secret. + type: str + client_access_permissions: + description: + - Identity Web Api accessibility settings. + type: dict + suboptions: + accessibility: + description: + - Configuration of the portal access settings. + type: dict + suboptions: + allow_access_from: + description: + - Allowed access to the web portal (based on interfaces, or security policy). + type: str + choices: ['rule_base', 'internal_interfaces', 'all_interfaces'] + internal_access_settings: + description: + - Configuration of the additional portal access settings for internal interfaces only. + type: dict + suboptions: + undefined: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'Undefined'. + type: bool + dmz: + description: + - Controls portal access settings for internal interfaces, whose topology is set to 'DMZ'. + type: bool + vpn: + description: + - Controls portal access settings for interfaces that are part of a VPN Encryption Domain. + type: bool + proxy_settings: + description: + - Identity-Awareness Proxy settings. + type: dict + suboptions: + detect_using_x_forward_for: + description: + - Whether to use X-Forward-For HTTP header, which is added by the proxy server to keep track of the original source IP. + type: bool + remote_access: + description: + - Enable Remote Access Identity source. + type: bool interfaces: description: - Network interfaces. When a gateway is updated with a new interfaces, the existing interfaces are removed. @@ -352,6 +805,11 @@ description: - N/A type: bool + distribute_logs_between_all_active_servers: + description: + - Distribute logs between all active servers. + type: bool + version_added: "7.0.0" forward_logs_to_log_server: description: - N/A @@ -582,6 +1040,137 @@ def main(): memory_pool_size=dict(type="int"), ), ), + identity_awareness=dict(type="bool"), + identity_awareness_settings=dict(type="dict", options=dict( + browser_based_authentication=dict(type="bool"), + browser_based_authentication_settings=dict(type="dict", options=dict( + authentication_settings=dict(type="dict", options=dict( + authentication_method=dict(type="str", choices=["username and password", "defined on user record", "identity provider", "radius"]), + identity_provider=dict(type="list", elements="str"), + radius=dict(type="str"), + users_directories=dict(type="dict", options=dict( + external_user_profile=dict(type="bool"), + internal_users=dict(type="bool"), + users_from_external_directories=dict(type="str", choices=["all gateways directories", "specific", "none"]), + specific=dict(type="list", elements="str") + )) + )), + browser_based_authentication_portal_settings=dict(type="dict", options=dict( + portal_web_settings=dict(type="dict", options=dict( + aliases=dict(type="list", elements="str"), + ip_address=dict(type="str"), + main_url=dict(type="str") + )), + certificate_settings=dict(type="dict", options=dict( + base64_certificate=dict(type="str"), + base64_password=dict(type="str", no_log=True) + )), + accessibility=dict(type="dict", options=dict( + allow_access_from=dict(type="str", choices=["rule_base", "internal_interfaces", "all_interfaces"]), + internal_access_settings=dict(type="dict", options=dict( + undefined=dict(type="bool"), + dmz=dict(type="bool"), + vpn=dict(type="bool") + )) + )) + )) + )), + identity_agent=dict(type="bool"), + identity_agent_settings=dict(type="dict", options=dict( + agents_interval_keepalive=dict(type="int"), + user_reauthenticate_interval=dict(type="int"), + authentication_settings=dict(type="dict", options=dict( + authentication_method=dict(type="str", choices=["username and password", "defined on user record", "radius"]), + radius=dict(type="str"), + users_directories=dict(type="dict", options=dict( + external_user_profile=dict(type="bool"), + internal_users=dict(type="bool"), + users_from_external_directories=dict(type="str", choices=["all gateways directories", "specific", "none"]), + specific=dict(type="list", elements="str") + )) + )), + identity_agent_portal_settings=dict(type="dict", options=dict( + accessibility=dict(type="dict", options=dict( + allow_access_from=dict(type="str", choices=["rule_base", "internal_interfaces", "all_interfaces"]), + internal_access_settings=dict(type="dict", options=dict( + undefined=dict(type="bool"), + dmz=dict(type="bool"), + vpn=dict(type="bool") + )) + )) + )) + )), + identity_based_enforcement=dict(type="str", choices=["on", "off"]), + identity_collector=dict(type="bool"), + identity_collector_settings=dict(type="dict", options=dict( + authentication_settings=dict(type="dict", options=dict( + users_directories=dict(type="dict", options=dict( + external_user_profile=dict(type="bool"), + internal_users=dict(type="bool"), + users_from_external_directories=dict(type="str", choices=["all gateways directories", "specific", "none"]), + specific=dict(type="list", elements="str") + )) + )), + authorized_clients=dict(type="list", elements="dict", options=dict( + client=dict(type="str"), + client_secret=dict(type="str", no_log=True) + )), + client_access_permissions=dict(type="dict", options=dict( + accessibility=dict(type="dict", options=dict( + allow_access_from=dict(type="str", choices=["rule_base", "internal_interfaces", "all_interfaces"]), + internal_access_settings=dict(type="dict", options=dict( + undefined=dict(type="bool"), + dmz=dict(type="bool"), + vpn=dict(type="bool") + )) + )) + )) + )), + identity_sharing_settings=dict(type="dict", options=dict( + share_with_other_gateways=dict(type="bool"), + receive_from_infinity_identity=dict(type="bool"), + receive_from_other_gateways=dict(type="bool"), + receive_from=dict(type="list", elements="str"), + cache_mode=dict(type="dict", options=dict( + override_profile=dict(type="bool"), + value=dict(type="bool") + )), + cache_mode_duration=dict(type="dict", options=dict( + override_profile=dict(type="bool"), + value=dict(type="int") + )), + scaled_sharing=dict(type="bool") + )), + identity_web_api=dict(type="bool"), + identity_web_api_settings=dict(type="dict", options=dict( + authentication_settings=dict(type="dict", options=dict( + users_directories=dict(type="dict", options=dict( + external_user_profile=dict(type="bool"), + internal_users=dict(type="bool"), + users_from_external_directories=dict(type="str", choices=["all gateways directories", "specific", "none"]), + specific=dict(type="list", elements="str") + )) + )), + authorized_clients=dict(type="list", elements="dict", options=dict( + client=dict(type="str"), + client_secret=dict(type="str", no_log=True) + )), + client_access_permissions=dict(type="dict", options=dict( + accessibility=dict(type="dict", options=dict( + allow_access_from=dict(type="str", choices=["rule_base", "internal_interfaces", "all_interfaces"]), + internal_access_settings=dict(type="dict", options=dict( + undefined=dict(type="bool"), + dmz=dict(type="bool"), + vpn=dict(type="bool") + )) + )) + )) + )), + proxy_settings=dict(type="dict", options=dict( + detect_using_x_forward_for=dict(type="bool") + )), + remote_access=dict(type="bool") + )), interfaces=dict( type="list", elements="dict", @@ -741,6 +1330,7 @@ def main(): delete_when_free_disk_space_below=dict(type="bool"), delete_when_free_disk_space_below_threshold=dict(type="int"), detect_new_citrix_ica_application_names=dict(type="bool"), + distribute_logs_between_all_active_servers=dict(type="bool"), forward_logs_to_log_server=dict(type="bool"), forward_logs_to_log_server_name=dict(type="str"), forward_logs_to_log_server_schedule_name=dict(type="str"), diff --git a/plugins/modules/cp_mgmt_test_ai_agent_security_api_key.py b/plugins/modules/cp_mgmt_test_ai_agent_security_api_key.py new file mode 100644 index 0000000..dbb9617 --- /dev/null +++ b/plugins/modules/cp_mgmt_test_ai_agent_security_api_key.py @@ -0,0 +1,79 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_test_ai_agent_security_api_key +short_description: Test the validity of an AI Agent Security API key. +description: + - Test the validity of an AI Agent Security API key. Optionally validates that a project ID belongs to the key. The management server sends a test + request to AI Agent Security and returns whether the key (and project) is valid. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + project_id: + description: + - Optional AI Agent Security project ID to validate. If provided, also verifies the project belongs to the API key. + type: str +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: test-ai-agent-security-api-key + cp_mgmt_test_ai_agent_security_api_key: + project_id: 550e8400-e29b-41d4-a716-446655440000 +""" + +RETURN = """ +cp_mgmt_test_ai_agent_security_api_key: + description: The checkpoint test-ai-agent-security-api-key output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + project_id=dict(type='str') + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "test-ai-agent-security-api-key" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_threat_emulation_file_type_facts.py b/plugins/modules/cp_mgmt_threat_emulation_file_type_facts.py new file mode 100644 index 0000000..63d0878 --- /dev/null +++ b/plugins/modules/cp_mgmt_threat_emulation_file_type_facts.py @@ -0,0 +1,136 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_threat_emulation_file_type_facts +short_description: Get threat-emulation-file-type objects facts on Checkpoint over Web Services API +description: + - Get threat-emulation-file-type objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + file_type_id: + description: + - File type id. + type: str + file_type: + description: + - File type extension. + type: str + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-threat-emulation-file-type + cp_mgmt_threat_emulation_file_type_facts: + file_type: pdf + +- name: show-threat-emulation-file-types + cp_mgmt_threat_emulation_file_type_facts: + limit: 50 + offset: 0 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + file_type_id=dict(type='str'), + file_type=dict(type='str'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "threat-emulation-file-type" + api_call_object_plural_version = "threat-emulation-file-types" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_threat_emulation_image_facts.py b/plugins/modules/cp_mgmt_threat_emulation_image_facts.py new file mode 100644 index 0000000..5743e2a --- /dev/null +++ b/plugins/modules/cp_mgmt_threat_emulation_image_facts.py @@ -0,0 +1,137 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_threat_emulation_image_facts +short_description: Get threat-emulation-image objects facts on Checkpoint over Web Services API +description: + - Get threat-emulation-image objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + image_id: + description: + - Image id. + type: str + name: + description: + - Image name. + This parameter is relevant only for getting a specific object. + type: str + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-threat-emulation-image + cp_mgmt_threat_emulation_image_facts: + name: Win10_64b + +- name: show-threat-emulation-images + cp_mgmt_threat_emulation_image_facts: + limit: 50 + offset: 0 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + image_id=dict(type='str'), + name=dict(type='str'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "threat-emulation-image" + api_call_object_plural_version = "threat-emulation-images" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_threat_extraction_file_type_facts.py b/plugins/modules/cp_mgmt_threat_extraction_file_type_facts.py new file mode 100644 index 0000000..bdd7d1d --- /dev/null +++ b/plugins/modules/cp_mgmt_threat_extraction_file_type_facts.py @@ -0,0 +1,136 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_threat_extraction_file_type_facts +short_description: Get threat-extraction-file-type objects facts on Checkpoint over Web Services API +description: + - Get threat-extraction-file-type objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + file_type_id: + description: + - File type id. + type: str + file_type: + description: + - File type extension. + type: str + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-threat-extraction-file-type + cp_mgmt_threat_extraction_file_type_facts: + file_type: pdf + +- name: show-threat-extraction-file-types + cp_mgmt_threat_extraction_file_type_facts: + limit: 50 + offset: 0 +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + file_type_id=dict(type='str'), + file_type=dict(type='str'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "threat-extraction-file-type" + api_call_object_plural_version = "threat-extraction-file-types" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_threat_layer.py b/plugins/modules/cp_mgmt_threat_layer.py index 27d923c..b8540e5 100644 --- a/plugins/modules/cp_mgmt_threat_layer.py +++ b/plugins/modules/cp_mgmt_threat_layer.py @@ -48,6 +48,13 @@ - Indicates whether to include a default rule in the new layer. - Available from R80.10 management version. type: bool + permissions_profiles: + description: + - Collection of permission profile identifiers. Each can be a name or UUID. + - Available from R82.20 management version. + type: list + elements: str + version_added: "7.0.0" tags: description: - Collection of tag identifiers. @@ -111,6 +118,7 @@ def main(): argument_spec = dict( name=dict(type="str", required=True), add_default_rule=dict(type="bool"), + permissions_profiles=dict(type="list", elements="str"), tags=dict(type="list", elements="str"), color=dict( type="str", diff --git a/plugins/modules/cp_mgmt_threat_protection_category_facts.py b/plugins/modules/cp_mgmt_threat_protection_category_facts.py new file mode 100644 index 0000000..0e3c5f1 --- /dev/null +++ b/plugins/modules/cp_mgmt_threat_protection_category_facts.py @@ -0,0 +1,155 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_threat_protection_category_facts +short_description: Get threat-protection-category objects facts on Checkpoint over Web Services API +description: + - Get threat-protection-category objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - The Category name. + This parameter is relevant only for getting a specific object. + type: str + blade: + description: + - The blade this category belongs to. Required when using 'name'. + type: str + show_profiles: + description: + - Indicates whether to calculate and show "profiles" field in reply. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-threat-protection-category + cp_mgmt_threat_protection_category_facts: + blade: anti-bot + name: Reputation IPs + +- name: show-threat-protection-categories + cp_mgmt_threat_protection_category_facts: +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + name=dict(type='str'), + blade=dict(type='str'), + show_profiles=dict(type='bool'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "threat-protection-category" + api_call_object_plural_version = "threat-protection-categories" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_threat_protection_sub_category_facts.py b/plugins/modules/cp_mgmt_threat_protection_sub_category_facts.py new file mode 100644 index 0000000..e108638 --- /dev/null +++ b/plugins/modules/cp_mgmt_threat_protection_sub_category_facts.py @@ -0,0 +1,160 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_threat_protection_sub_category_facts +short_description: Get threat-protection-sub-category objects facts on Checkpoint over Web Services API +description: + - Get threat-protection-sub-category objects facts on Checkpoint devices. + - All operations are performed over Web Services API. + - This module handles both operations, get a specific object and get several objects, + For getting a specific object use the parameter 'name'. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + name: + description: + - The sub-category's name. + This parameter is relevant only for getting a specific object. + type: str + show_profiles: + description: + - Indicates whether to calculate and show "profiles" field in reply. + type: bool + details_level: + description: + - The level of detail for some of the fields in the response can vary from showing only the UID value of the object to a fully detailed + representation of the object. + type: str + choices: ['uid', 'standard', 'full'] + category: + description: + - Parent category id or name. When using name, 'blade' is also required. Note, For IPS category use 'threat-protection'. + type: str + blade: + description: + - The blade this category belongs to. Required when using category by name. + type: str + filter: + description: + - Search expression to filter objects by. The provided text should be exactly the same as it would be given in SmartConsole Object Explorer. The + logical operators in the expression ('AND', 'OR') should be provided in capital letters. The search involves both a IP search and a textual search in + name, comment, tags etc. + type: str + limit: + description: + - The maximal number of returned results. + This parameter is relevant only for getting few objects. + type: int + offset: + description: + - Number of the results to initially skip. + This parameter is relevant only for getting few objects. + type: int + order: + description: + - Sorts the results by search criteria. Automatically sorts the results by Name, in the ascending order. + This parameter is relevant only for getting few objects. + type: list + elements: dict + suboptions: + ASC: + description: + - Sorts results by the given field in ascending order. + type: str + choices: ['name'] + DESC: + description: + - Sorts results by the given field in descending order. + type: str + choices: ['name'] + domains_to_process: + description: + - Indicates which domains to process the commands on. It cannot be used with the details-level full, must be run from the System Domain only and + with ignore-warnings true. Valid values are, CURRENT_DOMAIN, ALL_DOMAINS_ON_THIS_SERVER. + type: list + elements: str + show_only_local_domain: + description: + - Indicates whether the query should return only objects from the current local domain. This parameter is only valid for local domain. + type: bool +extends_documentation_fragment: check_point.mgmt.checkpoint_facts +""" + +EXAMPLES = """ +- name: show-threat-protection-sub-category + cp_mgmt_threat_protection_sub_category_facts: + name: Backdoor.WIN32.FoggyWeb.B + +- name: show-threat-protection-sub-categories + cp_mgmt_threat_protection_sub_category_facts: + category: '5' +""" + +RETURN = """ +ansible_facts: + description: The checkpoint object facts. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_facts, api_call_facts + + +def main(): + argument_spec = dict( + name=dict(type='str'), + show_profiles=dict(type='bool'), + details_level=dict(type='str', choices=['uid', 'standard', 'full']), + category=dict(type='str'), + blade=dict(type='str'), + filter=dict(type='str'), + limit=dict(type='int'), + offset=dict(type='int'), + order=dict(type='list', elements='dict', options=dict( + ASC=dict(type='str', choices=['name']), + DESC=dict(type='str', choices=['name']) + )), + domains_to_process=dict(type='list', elements='str'), + show_only_local_domain=dict(type='bool') + ) + argument_spec.update(checkpoint_argument_spec_for_facts) + + module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=True) + + api_call_object = "threat-protection-sub-category" + api_call_object_plural_version = "threat-protection-sub-categories" + + result = api_call_facts(module, api_call_object, api_call_object_plural_version) + module.exit_json(ansible_facts=result) + + +if __name__ == '__main__': + main() diff --git a/plugins/modules/cp_mgmt_update_cloud_license.py b/plugins/modules/cp_mgmt_update_cloud_license.py new file mode 100644 index 0000000..0e0319c --- /dev/null +++ b/plugins/modules/cp_mgmt_update_cloud_license.py @@ -0,0 +1,81 @@ +#!/usr/bin/python +# -*- coding: utf-8 -*- +# +# Ansible module to manage CheckPoint Firewall (c) 2019 +# +# Ansible is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# Ansible is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Ansible. If not, see . +# + +from __future__ import (absolute_import, division, print_function) + +__metaclass__ = type + +ANSIBLE_METADATA = {'metadata_version': '1.1', + 'status': ['preview'], + 'supported_by': 'community'} + +DOCUMENTATION = """ +--- +module: cp_mgmt_update_cloud_license +short_description: Updates the existing license with the new license string. +description: + - When updating existing license in user center, a new license string will be provided. This api will update the existing license with the new license + string. + - All operations are performed over Web Services API. + - Available from R82.20 management version. +version_added: "7.0.0" +author: "Dor Berenstein (@chkp-dorbe)" +options: + license: + description: + - The updated license string received from the User Center - without 'cplic put'. + type: str + required: True +extends_documentation_fragment: check_point.mgmt.checkpoint_commands +""" + +EXAMPLES = """ +- name: update-cloud-license + cp_mgmt_update_cloud_license: + license: 192.168.1.2 31Dec2026 dTTTTTT-WWWWWW-SSSSSSS-QQQQQQ CPSG-VE+5 CPBS-BECE CPSB-DFW + CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-ADNC CPSB-SSLVWPN-5 CK-66666666 +""" + +RETURN = """ +cp_mgmt_update_cloud_license: + description: The checkpoint update-cloud-license output. + returned: always. + type: dict +""" + +from ansible.module_utils.basic import AnsibleModule +from ansible_collections.check_point.mgmt.plugins.module_utils.checkpoint import checkpoint_argument_spec_for_commands, api_command + + +def main(): + argument_spec = dict( + license=dict(type='str', required=True) + ) + argument_spec.update(checkpoint_argument_spec_for_commands) + + module = AnsibleModule(argument_spec=argument_spec) + + command = "update-cloud-license" + + result = api_command(module, command) + module.exit_json(**result) + + +if __name__ == '__main__': + main()