Introducing module firewall_alias #137

KiLLuuuhh · 2024-07-05T07:30:44Z

This pull requests introduces the module firewall_alias to the puzzle.opnsense collection.

With this new module, user will be able to:

set name for alias
set different alias types of content such as:
- host
- network
- port
- url
- urltable
- geoip
- networkgroup
- macaddress
- bgpasn
- dynamicipv6host
- opnvpngroup
- internal
- external
Set content and validate content of the types above.
Enable statistics for the alias.
Set a description for the alias.
Set the refresh frequency for a urltable.
Set the interface for dynamicipv6host.

Disclaimer: We are aware that this module is also offered by Ansibleguy. However, we have decided to develop it independently due to compatibility issues with the different versions we support.

nerrehmit · 2024-07-12T19:31:16Z

While testing your changes against a live opnsense 24.1 installation I found a couple of things. I'm going to report them individually so that you can comment/ close them each on their own.

nerrehmit · 2024-07-12T19:35:19Z

I was able to set a host alias with spaces in the name.
However updating it within opnsense then gave me an error upon save. Here is the ansible snippet that worked:

  - name: set google dns alias
    puzzle.opnsense.firewall_alias:
      name: google DNS Server
      type: host
      content: 8.8.8.8
      description: The dns servers that google uses
      state: present

plugins/modules/firewall_alias.py

nerrehmit · 2024-07-12T19:41:52Z

BGP ASN aliases added through ansible do not display a Type, compared to BGP ASN Aliases added through the UI as you can see in the screenshot:

EDIT: fixed by updates to the module ✔️

nerrehmit · 2024-07-12T19:43:16Z

running ansible against an opnsense instance with a manually added BGP ASN alias errors out like this:

An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ValueError: 'FirewallAliasType' enum not found for 'asn'
fatal: [opnsense]: FAILED! => {
    "changed": false,
    "rc": 1
}

MSG:

MODULE FAILURE
See stdout/stderr for the exact error


MODULE_STDOUT:

Traceback (most recent call last):
  File "/root/.ansible/tmp/ansible-tmp-1720813227.9266646-65215-109775695243004/AnsiballZ_firewall_alias.py", line 107, in <module>
    _ansiballz_main()
  File "/root/.ansible/tmp/ansible-tmp-1720813227.9266646-65215-109775695243004/AnsiballZ_firewall_alias.py", line 99, in _ansiballz_main
    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
  File "/root/.ansible/tmp/ansible-tmp-1720813227.9266646-65215-109775695243004/AnsiballZ_firewall_alias.py", line 47, in invoke_module
    runpy.run_module(mod_name='ansible_collections.puzzle.opnsense.plugins.modules.firewall_alias', init_globals=dict(_module_fqn='ansible_collections.puzzle.opnsense.plugins.modules.firewall_alias', _modlib_path=modlib_path),
  File "<frozen runpy>", line 226, in run_module
  File "<frozen runpy>", line 98, in _run_module_code
  File "<frozen runpy>", line 88, in _run_code
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/modules/firewall_alias.py", line 273, in <module>
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/modules/firewall_alias.py", line 232, in main
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 275, in __init__
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 288, in _load_aliases
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 288, in <listcomp>
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 174, in from_xml
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 118, in __init__
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 131, in __post_init__
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/enum_utils.py", line 39, in from_string
ValueError: 'FirewallAliasType' enum not found for 'asn'

EDIT: fixed by updates to the module ✔️

nerrehmit · 2024-07-12T20:00:44Z

We should definitely explain the "refreshfrequency" a bit more. This input is considered fractions of a day. So a value of "0.5" leads to 12 hours, "1.1" to 1d 2.4h.
The smallest possible value is "0.0003" which leads to 0.01h in the UI, so a refresh about every minute. This is the opnsense minimum according to https://forum.opnsense.org/index.php?topic=15483.0
I think we should have an example using that key.

Also this value only shows up in the UI if you configure type "urltable" but the module accepts it for other types. Not sure if that could lead to problems down the line?

nerrehmit · 2024-07-12T20:03:31Z

the BGP ASN type alias offers a selection for IPv4 and/or IPv6 when done through the UI. We do not have that option in our module yet. We should either add that functionality or mention that restriction in the docs to prevent any surprises for users.

KiLLuuuhh · 2024-07-15T06:56:13Z

BGP ASN aliases added through ansible do not display a Type, compared to BGP ASN Aliases added through the UI as you can see in the screenshot:

fixed in 64ba9b0.

KiLLuuuhh · 2024-07-15T06:56:37Z

running ansible against an opnsense instance with a manually added BGP ASN alias errors out like this:

An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ValueError: 'FirewallAliasType' enum not found for 'asn'
fatal: [opnsense]: FAILED! => {
    "changed": false,
    "rc": 1
}

MSG:

MODULE FAILURE
See stdout/stderr for the exact error


MODULE_STDOUT:

Traceback (most recent call last):
  File "/root/.ansible/tmp/ansible-tmp-1720813227.9266646-65215-109775695243004/AnsiballZ_firewall_alias.py", line 107, in <module>
    _ansiballz_main()
  File "/root/.ansible/tmp/ansible-tmp-1720813227.9266646-65215-109775695243004/AnsiballZ_firewall_alias.py", line 99, in _ansiballz_main
    invoke_module(zipped_mod, temp_path, ANSIBALLZ_PARAMS)
  File "/root/.ansible/tmp/ansible-tmp-1720813227.9266646-65215-109775695243004/AnsiballZ_firewall_alias.py", line 47, in invoke_module
    runpy.run_module(mod_name='ansible_collections.puzzle.opnsense.plugins.modules.firewall_alias', init_globals=dict(_module_fqn='ansible_collections.puzzle.opnsense.plugins.modules.firewall_alias', _modlib_path=modlib_path),
  File "<frozen runpy>", line 226, in run_module
  File "<frozen runpy>", line 98, in _run_module_code
  File "<frozen runpy>", line 88, in _run_code
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/modules/firewall_alias.py", line 273, in <module>
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/modules/firewall_alias.py", line 232, in main
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 275, in __init__
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 288, in _load_aliases
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 288, in <listcomp>
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 174, in from_xml
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 118, in __init__
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/firewall_alias_utils.py", line 131, in __post_init__
  File "/tmp/ansible_puzzle.opnsense.firewall_alias_payload_qmsbwmar/ansible_puzzle.opnsense.firewall_alias_payload.zip/ansible_collections/puzzle/opnsense/plugins/module_utils/enum_utils.py", line 39, in from_string
ValueError: 'FirewallAliasType' enum not found for 'asn'

fixed in 64ba9b0.

KiLLuuuhh · 2024-07-31T07:33:13Z

the BGP ASN type alias offers a selection for IPv4 and/or IPv6 when done through the UI. We do not have that option in our module yet. We should either add that functionality or mention that restriction in the docs to prevent any surprises for users.

fixed in 944146b.

DonGiovanni83

I have some minor change requests and proposals, but overall it looks good

plugins/module_utils/firewall_alias_utils.py

plugins/modules/firewall_alias.py

Co-authored-by: Fabio Bertagna <33524186+DonGiovanni83@users.noreply.github.com>

DonGiovanni83

Looks good 👍🏼

KiLLuuuhh self-assigned this Jul 5, 2024

KiLLuuuhh requested a review from DonGiovanni83 July 11, 2024 14:50

KiLLuuuhh marked this pull request as ready for review July 11, 2024 14:50

nerrehmit reviewed Jul 12, 2024

View reviewed changes

plugins/modules/firewall_alias.py Outdated Show resolved Hide resolved

nerrehmit reviewed Jul 12, 2024

View reviewed changes

plugins/modules/firewall_alias.py Outdated Show resolved Hide resolved

KiLLuuuhh force-pushed the introducing-aliases branch from 63b14ae to f139dc0 Compare July 15, 2024 06:30

KiLLuuuhh requested a review from nerrehmit July 31, 2024 12:55

KiLLuuuhh force-pushed the introducing-aliases branch from aaf0433 to e5a9bba Compare August 7, 2024 10:38

KiLLuuuhh added 13 commits August 16, 2024 12:38

created molecule file

f762e0a

created verify file

c93103c

renaming aliases to alias

166c143

renaming aliases to alias

f5aaddf

first draft of test_firewall_alias

75ac1fe

removed unused file test_firewall_aliases

7430e9c

renaming

4413758

finished test_firewall_alias_from_xml unit test

d545ab4

added test_firewall_rule_alias_to_etree unit test

f112f72

added to_etree function

72596bd

finished test_firewall_alias_from_ansible_module_params_simple unit test

5025580

added from_ansible_module_params classmethod

2661ba0

added FirewallAliasSet unit test

432931c

KiLLuuuhh added 14 commits August 16, 2024 12:38

fixed typos

13e9f20

fixed type asn

78a4953

added test to verify type asn fix

f7e1c22

fixed authgroup type

9fdbad8

fixed setting of authgroup

6b2892f

added two new test cases

2080066

added toetree tests to check asn protocol

c8609c3

added tests to fix protocol assignment

6696b74

added MaximumTableEntries validation

ab803d2

fixed hostname validation

bf85706

updated converage

badc0f8

fixed linter errors

b5bb037

added molcue instance

a4e2198

updated module_index to support version 24.7 of the alias module

0e67877

KiLLuuuhh force-pushed the introducing-aliases branch from e5a9bba to 0e67877 Compare August 16, 2024 10:44

added missing maximumtableentries entry

99353f1

DonGiovanni83 requested changes Aug 19, 2024

View reviewed changes

KiLLuuuhh and others added 8 commits August 19, 2024 14:31

Update plugins/module_utils/firewall_alias_utils.py

96a2f9b

Co-authored-by: Fabio Bertagna <33524186+DonGiovanni83@users.noreply.github.com>

Update plugins/module_utils/firewall_alias_utils.py

798ada4

Co-authored-by: Fabio Bertagna <33524186+DonGiovanni83@users.noreply.github.com>

Update plugins/module_utils/firewall_alias_utils.py

b43be64

Co-authored-by: Fabio Bertagna <33524186+DonGiovanni83@users.noreply.github.com>

Update plugins/module_utils/firewall_alias_utils.py

5d9314e

Co-authored-by: Fabio Bertagna <33524186+DonGiovanni83@users.noreply.github.com>

applied @dongovanni's requests

a899ed1

restructred firewall_alias

f9e7dfb

restructred firewall_alias_utils version compatibility checks

f4833aa

removed unused import

4cff1ab

KiLLuuuhh requested a review from DonGiovanni83 August 20, 2024 06:29

updated version_added entry

8a74c4b

DonGiovanni83 reviewed Aug 20, 2024

View reviewed changes

DonGiovanni83 approved these changes Aug 20, 2024

View reviewed changes

KiLLuuuhh merged commit 0416c70 into puzzle:main Aug 20, 2024
30 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introducing module firewall_alias #137

Introducing module firewall_alias #137

KiLLuuuhh commented Jul 5, 2024 •

edited

Loading

nerrehmit commented Jul 12, 2024

nerrehmit commented Jul 12, 2024

nerrehmit commented Jul 12, 2024 •

edited

Loading

nerrehmit commented Jul 12, 2024 •

edited

Loading

nerrehmit commented Jul 12, 2024

nerrehmit commented Jul 12, 2024

KiLLuuuhh commented Jul 15, 2024

KiLLuuuhh commented Jul 15, 2024

KiLLuuuhh commented Jul 31, 2024

DonGiovanni83 left a comment

DonGiovanni83 left a comment

Introducing module firewall_alias #137

Introducing module firewall_alias #137

Conversation

KiLLuuuhh commented Jul 5, 2024 • edited Loading

nerrehmit commented Jul 12, 2024

nerrehmit commented Jul 12, 2024

nerrehmit commented Jul 12, 2024 • edited Loading

nerrehmit commented Jul 12, 2024 • edited Loading

nerrehmit commented Jul 12, 2024

nerrehmit commented Jul 12, 2024

KiLLuuuhh commented Jul 15, 2024

KiLLuuuhh commented Jul 15, 2024

KiLLuuuhh commented Jul 31, 2024

DonGiovanni83 left a comment

Choose a reason for hiding this comment

DonGiovanni83 left a comment

Choose a reason for hiding this comment

KiLLuuuhh commented Jul 5, 2024 •

edited

Loading

nerrehmit commented Jul 12, 2024 •

edited

Loading

nerrehmit commented Jul 12, 2024 •

edited

Loading