server/lib/deltacloud/drivers/fgcp/fgcp_driver.rb
# FW rule creation not supported:
# fgcp backend requires a mandatory rule id to create (insert) a new rule
# into the existing accept/deny rules. Also, the first two digits of the
# five digit rule identify what from and to network segment (e.g. Internet
# to DMZ, or Secure2 to Secure1) the rule applies to.
# The current Deltacloud firewall collection API does not cover such
# functionality so it was deemed not suitable to implement.
#  def create_firewall_rule(credentials, opts={})
#    p opts
#  end
FW rule creation not supported:
fgcp backend requires a mandatory rule id to create (insert) a new rule
into the existing accept/deny rules. Also, the first two digits of the
five digit rule identify what from and to network segment  the rule applies to.
The current Deltacloud firewall collection API does not cover such
functionality so it was deemed not suitable to implement.
def create_firewall_rule(credentials, opts={})
p opts
end
FW rule creation not supported : fgcp backend requires a mandatory rule id to create ( insert ) a new rule into the existing accept / deny rules . Also the first two digits of the five digit rule identify what from and to network segment the rule applies to . The current Deltacloud firewall collection API does not cover such functionality so it was deemed not suitable to implement . def create_firewall_rule ( credentials opts = {} ) p opts end
def delete_firewall_rule(credentials, opts={})
    safely do
      client = new_client(credentials)
      conf_xml_old = <<-"eofwopxml"
<?xml version="1.0" encoding ="UTF-8"?>
<Request>
  <configuration>
    <firewall_policy>
    </firewall_policy>
  </configuration>
</Request>
eofwopxml
      fw = client.get_efm_configuration(opts[:firewall], 'FW_POLICY', conf_xml_old)
      rule50000_log = 'On'
      fw['efm'][0]['firewall'][0]['directions'][0]['direction'].reject! do |direction|
        direction['policies'][0]['policy'].reject! do |policy|
          rule_id = policy['id'][0]
          policy['id'][0] = rule_id[2..4]
          rule50000_log = policy['log'][0] if rule_id == '50000'
          if not policy['dstService'][0] == 'NONE'
            policy.delete('dstType')
            policy.delete('dstPort')
            policy.delete('protocol')
          end
          rule_id == opts[:rule_id] or rule_id == '50000'
        end
        direction['policies'][0]['policy'].empty?
      end
      fw['efm'][0]['firewall'][0]['directions'][0]['direction'] << {
        'policies' => [
          'policy' => [
            'log' => [ rule50000_log ]
          ]
        ]
      }
      new_rules = {
        'configuration'   => [
          'firewall_policy' => [
            'directions'      => fw['efm'][0]['firewall'][0]['directions']
        ]
      ]}
      conf_xml_new = XmlSimple.xml_out(new_rules,
        'RootName' => 'Request'
        )
      conf_xml_new.gsub!(/(<(to|from)>).+(INTERNET|INTRANET)/, '\1\3')
      client.update_efm_configuration(opts[:firewall], 'FW_POLICY', conf_xml_new)
    end
  end
def delete_firewall_rule ( credentials , opts = { } ) safely do client = new_client ( credentials ) conf_xml_old = <<-"eofwopxml" 
<?xml version="1.0" encoding ="UTF-8"?>
<Request>
  <configuration>
    <firewall_policy>
    </firewall_policy>
  </configuration>
</Request>
 eofwopxml fw = client . get_efm_configuration ( opts [ :firewall ] , 'FW_POLICY' , conf_xml_old ) rule50000_log = 'On' fw [ 'efm' ] [ 0 ] [ 'firewall' ] [ 0 ] [ 'directions' ] [ 0 ] [ 'direction' ] . reject! do | direction | direction [ 'policies' ] [ 0 ] [ 'policy' ] . reject! do | policy | rule_id = policy [ 'id' ] [ 0 ] policy [ 'id' ] [ 0 ] = rule_id [ 2 .. 4 ] rule50000_log = policy [ 'log' ] [ 0 ] if rule_id == '50000' if not policy [ 'dstService' ] [ 0 ] == 'NONE' policy . delete ( 'dstType' ) policy . delete ( 'dstPort' ) policy . delete ( 'protocol' ) end rule_id == opts [ :rule_id ] or rule_id == '50000' end direction [ 'policies' ] [ 0 ] [ 'policy' ] . empty? end fw [ 'efm' ] [ 0 ] [ 'firewall' ] [ 0 ] [ 'directions' ] [ 0 ] [ 'direction' ] << { 'policies' => [ 'policy' => [ 'log' => [ rule50000_log ] ] ] } new_rules = { 'configuration' => [ 'firewall_policy' => [ 'directions' => fw [ 'efm' ] [ 0 ] [ 'firewall' ] [ 0 ] [ 'directions' ] ] ] } conf_xml_new = XmlSimple . xml_out ( new_rules , 'RootName' => 'Request' ) conf_xml_new . gsub! ( / (<(to|from)>).+(INTERNET|INTRANET) / , '\1\3' ) client . update_efm_configuration ( opts [ :firewall ] , 'FW_POLICY' , conf_xml_new ) end end
FW rule creation not supported:
fgcp backend requires a mandatory rule id to create (insert) a new rule
into the existing accept/deny rules.
FW rule creation not supported : fgcp backend requires a mandatory rule id to create ( insert ) a new rule into the existing accept / deny rules .
# retrieve current FW rules, delete rule, send back to API server # retrieve current rules # delete specified rule and special rule 50000 (handled later) # need to use (final) 3 digit id # storage rule 50000's log attribute for later # some elements not allowed if service is NTP, DNS, etc. # add entry for 50000 special rule # create FW configuration xml file with new rules
credentials
<not_specific>
opts
<not_specific>