HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/panos.cpython-310.pyc
o

�N�g\��@s�dZddlZddlZddlZddlZddlmZe�e	�Z
dZdd�Zd�dd�Z
d	d
�Zdd�Zd
d�Zdd�Zdd�Zd�dd�Zd�dd�Zdd�Zd�dd�Zd�dd�Zd�dd�Zd�d!d"�Zd�d#d$�Zd%d&�Zd'd(�Zd)d*�Zd+d,�Zd-d.�Zd/d0�Z d1d2�Z!d3d4�Z"d5d6�Z#d7d8�Z$d9d:�Z%d;d<�Z&d=d>�Z'd?d@�Z(dAdB�Z)dCdD�Z*dEdF�Z+d�dHdI�Z,d�dJdK�Z-d�dLdM�Z.d�dNdO�Z/dPdQ�Z0dRdS�Z1dTdU�Z2dVdW�Z3dXdY�Z4dZd[�Z5d\d]�Z6d^d_�Z7d`da�Z8dbdc�Z9ddde�Z:dfdg�Z;dhdi�Z<djdk�Z=dldm�Z>dndo�Z?d�dpdq�Z@d�drds�ZAd�dtdu�ZBd�dvdw�ZCdxdy�ZDdzd{�ZEd|d}�ZFd~d�ZGd�d��ZHd�d��ZId�d��ZJd�d�d��ZKd�d��ZLd�d��ZMd�d��ZNd�d�d��ZOd�d�d��ZPd�d�d��ZQ				d�d�d��ZRd�d��ZSd�d�d��ZTd�d��ZUd�d�d��ZVd�d��ZWd�d�d��ZXd�d�d��ZYd�d��ZZd�d�d��Z[d�d�d��Z\d�d�d��Z]d�d�d��Z^d�d�d��Z_d�d�d��Z`d�d�d��Zad�d�d��Zbd�d�d��Zc						d�d�d��Zdd�d�d��Zed�d�d��Zfd�d�d��Zgd�dÄZhd�d�dƄZi									 	d�d�dȄZjd�d�dʄZkdS)�a�
Module to provide Palo Alto compatibility to Salt

:codeauthor: ``Spencer Ervin <spencer_ervin@hotmail.com>``
:maturity:   new
:depends:    none
:platform:   unix

.. versionadded:: 2018.3.0

Configuration
=============

This module accepts connection configuration details either as
parameters, or as configuration settings in pillar as a Salt proxy.
Options passed into opts will be ignored if options are passed into pillar.

.. seealso::
    :py:mod:`Palo Alto Proxy Module <salt.proxy.panos>`

About
=====

This execution module was designed to handle connections to a Palo Alto based
firewall. This module adds support to send connections directly to the device
through the XML API or through a brokered connection to Panorama.

�N)�CommandExecutionError�panoscCsDztjj��rtdddkrtWSWdSWdSty!YdSw)z0
    Will load for the panos proxy minions.
    �proxyZ	proxytyper)FzFThe panos execution module can only be loaded for panos proxy minions.)�salt�utils�platformZis_proxyZ__opts__�__virtualname__�KeyError�r
r
�F/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/panos.py�__virtual__*s����rcCs~|std��td|�}d|vr=d|dvr=|dd}t|�ddddkr9t�d�t|�ddddks(t|�S|S)z�
    Executes a query that requires a job for completion. This function will wait for the job to complete
    and return the results.
    z!Query parameters cannot be empty.�
panos.call�resultZjob�statusZFIN�)r�	__proxy__�get_job�time�sleep)�query�response�jidr
r
r�_get_job_results:s
�rcC�ddd�}td|�S)z�
    Prevent other users from changing configuration until the lock is released.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.add_config_lock

    �opz9<request><config-lock><add></add></config-lock></request>��type�cmdr
�r�rr
r
r�add_config_lockP��r cCr)z�
    Get anti-virus information from PaloAlto Networks server

    CLI Example:

    .. code-block:: bash

        salt '*' panos.check_antivirus

    rzN<request><anti-virus><upgrade><check></check></upgrade></anti-virus></request>rr
rrr
r
r�check_antiviruscr!r"cCr)z�
    Get software information from PaloAlto Networks server.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.check_software

    rzH<request><system><software><check></check></software></system></request>rr
rrr
r
r�check_softwarevs�r#cCr)zy
    Clear all commit tasks.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.clear_commit_tasks

    rz<<request><clear-commit-tasks></clear-commit-tasks></request>rr
rrr
r
r�clear_commit_tasks�r!r$cC�ddd�}t|�S)z�
    Commits the candidate configuration to the running configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.commit

    �commitz<commit></commit>r�rrr
r
rr&�s
r&cCsBd}td|�sdd�|�fS|sdSdd�|�d�}td	|�S)
a	
    Deactivates an installed license.
    Required version 7.0.0 or greater.

    key_name(str): The file name of the license key installed.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.deactivate_license key_name=License_File_Name.key

    �7.0.0�panos.is_required_versionF�AThe panos device requires version {} or greater for this command.�FzYou must specify a key_name.rzr<request><license><deactivate><key><features><member>{}</member></features></key></deactivate></license></request>rr
�r�format)�key_name�_required_versionrr
r
r�deactivate_license�s���r0cCs&|sdSdd|�d�d�}td|�S)z�
    Remove license keys on disk.

    key_name(str): The file name of the license key to be deleted.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.delete_license key_name=License_File_Name.key

    r+rz<delete><license><key>z</key></license></delete>rr
r)r.rr
r
r�delete_license�s
�r1cCr%)z�
    Download the most recent anti-virus package.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.download_antivirus

    rze<request><anti-virus><upgrade><download><latest></latest></download></upgrade></anti-virus></request>rr'rr
r
r�download_antivirus�s�r2FcC�V|std��t|t�std��|durdd�|�d�}t|�Sdd�|�d�}t|�S)az
    Download software packages by filename.

    Args:
        filename(str): The filename of the PANOS file to download.

        synch (bool): If true then the file will synch to the peer unit.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.download_software_file PanOS_5000-8.0.0
        salt '*' panos.download_software_file PanOS_5000-8.0.0 True

    z!Filename option must not be none.�Synch option must be boolean..Trz]<request><system><software><download><file>{}</file></download></software></system></request>rz}<request><system><software><download><sync-to-peer>yes</sync-to-peer><file>{}</file></download></software></system></request>�r�
isinstance�boolr-r)�filename�synchrr
r
r�download_software_file�&
�����
r:cCr3)an
    Download software packages by version number.

    Args:
        version(str): The version of the PANOS file to download.

        synch (bool): If true then the file will synch to the peer unit.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.download_software_version 8.0.0
        salt '*' panos.download_software_version 8.0.0 True

    � Version option must not be none.r4Trzc<request><system><software><download><version>{}</version></download></software></system></request>rz�<request><system><software><download><sync-to-peer>yes</sync-to-peer><version>{}</version></download></software></system></request>r5)�versionr9rr
r
r�download_software_version2r;r>cCs,|sddd�}ndd�|�d�}td|�S)a
    Get new license(s) using from the Palo Alto Network Server.

    auth_code
        The license authorization code.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.fetch_license
        salt '*' panos.fetch_license auth_code=foobar

    rz5<request><license><fetch></fetch></license></request>rzN<request><license><fetch><auth-code>{}</auth-code></fetch></license></request>r
�r-r)Z	auth_coderr
r
r�
fetch_licenseas��r@�1cC� ddd�||�d�}td|�S)a�
    Get the candidate configuration for the specified get_address object. This will not return address objects that are
    marked as pre-defined objects.

    address(str): The name of the address object.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_address myhost
        salt '*' panos.get_address myhost 3

    �config�getzi/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/address/entry[@name='{}']�r�action�xpathr
r?)�address�vsysrr
r
r�get_address���	rJcCrB)a�
    Get the candidate configuration for the specified address group. This will not return address groups that are
    marked as pre-defined objects.

    addressgroup(str): The name of the address group.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_address_group foobar
        salt '*' panos.get_address_group foobar 3

    rCrDzo/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/address-group/entry[@name='{}']rEr
r?)ZaddressgrouprIrr
r
r�get_address_group�rKrLcCr)z|
    Show active administrators.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_admins_active

    rz<show><admins></admins></show>rr
rrr
r
r�get_admins_active��
rMcCr)zv
    Show all administrators.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_admins_all

    rz)<show><admins><all></all></admins></show>rr
rrr
r
r�get_admins_all�rNrOcCr)z�
    Show information about available anti-virus packages.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_antivirus_info

    rzL<request><anti-virus><upgrade><info></info></upgrade></anti-virus></request>rr
rrr
r
r�get_antivirus_info�r!rPcCr)zl
    Show ARP information.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_arp

    rz-<show><arp><entry name = 'all'/></arp></show>rr
rrr
r
r�get_arp�rNrQcCr)z�
    Show timeout information for this administrative session.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_cli_idle_timeout

    rz5<show><cli><idle-timeout></idle-timeout></cli></show>rr
rrr
r
r�get_cli_idle_timeout�r!rRcCr)z�
    Show cli administrative permissions.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_cli_permissions

    rz3<show><cli><permissions></permissions></cli></show>rr
rrr
r
r�get_cli_permissionsrNrScCr)z�
    Report filesystem disk space usage.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_disk_usage

    rz7<show><system><disk-space></disk-space></system></show>rr
rrr
r
r�get_disk_usage!r!rTcC�dddd�}td|�S)z�
    Get the DNS server configuration from the candidate configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_dns_server_config

    rCrDz\/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/dns-setting/serversrEr
rrr
r
r�get_dns_server_config4�
�rVcCrU)z�
    Get the domain name configuration from the candidate configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_domain_config

    rCrDzO/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/domainrEr
rrr
r
r�get_domain_configHrWrXcCr)zz
    Show the DoS block-ip table.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_dos_blocks

    rz;<show><dos-block-table><all></all></dos-block-table></show>rr
rrr
r
r�get_dos_blocks\r!rYcCr)z�
    Print FQDNs used in rules and their IPs.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_fqdn_cache

    rz><request><system><fqdn><show></show></fqdn></system></request>rr
rrr
r
r�get_fqdn_cacheor!rZcCrU)z�
    Get the high availability configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_ha_config

    rCrDzS/config/devices/entry[@name='localhost.localdomain']/deviceconfig/high-availabilityrEr
rrr
r
r�
get_ha_config�rWr[cCr)z�
     Show high-availability link-monitoring state.

     CLI Example:

    .. code-block:: bash

         salt '*' panos.get_ha_link

    rzW<show><high-availability><link-monitoring></link-monitoring></high-availability></show>rr
rrr
r
r�get_ha_link�r!r\cCr)z�
    Show high-availability path-monitoring state.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_ha_path

    rzW<show><high-availability><path-monitoring></path-monitoring></high-availability></show>rr
rrr
r
r�get_ha_path�r!r]cCr)z�
    Show high-availability state information.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_ha_state

    rzC<show><high-availability><state></state></high-availability></show>rr
rrr
r
r�get_ha_state��
�r^cCr)z�
    Show high-availability transition statistic information.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_ha_transitions

    rzO<show><high-availability><transitions></transitions></high-availability></show>rr
rrr
r
r�get_ha_transitions�r_r`cCrU)z{
    Get the hostname of the device.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_hostname

    rCrDzQ/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/hostnamerEr
rrr
r
r�get_hostname�rWra�allcC�dd|�d�d�}td|�S)a=
    Get the counter statistics for interfaces.

    Args:
        name (str): The name of the interface to view. By default, all interface statistics are viewed.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_interface_counters
        salt '*' panos.get_interface_counters ethernet1/1

    rz<show><counter><interface>z</interface></counter></show>rr
r��namerr
r
r�get_interface_counters��
�rfcCrc)a
    Show interface information.

    Args:
        name (str): The name of the interface to view. By default, all interface statistics are viewed.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_interfaces
        salt '*' panos.get_interfaces ethernet1/1

    rz<show><interface>z</interface></show>rr
rrdr
r
r�get_interfacesrgrhcC�*|std��dd|�d�d�}td|�S)z�
    List all a single job by ID.

    jid
        The ID of the job to retrieve.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_job jid=15

    zID option must not be none.rz<show><jobs><id>z</id></jobs></show>rr
�rr)rrr
r
rr&srcCs\|��dkrddd�}n|��dkrddd�}n|��dkr$ddd�}ntd	��td
|�S)a�
    List all jobs on the device.

    state
        The state of the jobs to display. Valid options are all, pending, or processed. Pending jobs are jobs
        that are currently in a running or waiting state. Processed jobs are jobs that have completed
        execution.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_jobs
        salt '*' panos.get_jobs state=pending

    rbrz%<show><jobs><all></all></jobs></show>r�pendingz-<show><jobs><pending></pending></jobs></show>Z	processedz1<show><jobs><processed></processed></jobs></show>z7The state parameter must be all, pending, or processed.r
)�lowerrr)�staterr
r
r�get_jobs<s��rncCr)zh
    Show LACP state.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_lacp

    rzF<show><lacp><aggregate-ethernet>all</aggregate-ethernet></lacp></show>rr
rrr
r
r�get_lacp^r!rocCr)z�
    Show information about owned license(s).

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_license_info

    rz3<request><license><info></info></license></request>rr
rrr
r
r�get_license_infoqrNrpcCr)z�
    Show license token files for manual license deactivation.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_license_tokens

    rz8<show><license-token-files></license-token-files></show>rr
rrr
r
r�get_license_tokens�r!rqcCr)z
    Show lldp config for interfaces.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_lldp_config

    rz.<show><lldp><config>all</config></lldp></show>rr
rrr
r
r�get_lldp_config�rNrrcCr)z�
    Show lldp counters for interfaces.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_lldp_counters

    rz2<show><lldp><counters>all</counters></lldp></show>rr
rrr
r
r�get_lldp_counters�rNrscCr)z�
    Show lldp local info for interfaces.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_lldp_local

    rz,<show><lldp><local>all</local></lldp></show>rr
rrr
r
r�get_lldp_local�rNrtcCr)z�
    Show lldp neighbors info for interfaces.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_lldp_neighbors

    rz4<show><lldp><neighbors>all</neighbors></lldp></show>rr
rrr
r
r�get_lldp_neighbors�r!rucCsvt�}g}d|dvr
|St|dddt�r,|dddD]	}|�|d�q |S|�|dddd�|S)z�
    Show all local administrator accounts.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_local_admins

    Zusersr�entryre)�get_users_configr6�list�append)Z
admin_listrrvr
r
r�get_local_admins�s�rzcCr)zw
    Report the logdb quotas.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_logdb_quota

    rz9<show><system><logdb-quota></logdb-quota></system></show>rr
rrr
r
r�get_logdb_quota�r!r{cCr)z|
    Get the master key properties.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_master_key

    rzK<show><system><masterkey-properties></masterkey-properties></system></show>rr
rrr
r
r�get_master_keyr!r|cCrU)z�
    Get the NTP configuration from the candidate configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_ntp_config

    rCrDzT/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-serversrEr
rrr
r
r�get_ntp_configrWr}cCr)z�
    Get list of configured NTP servers.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_ntp_servers

    rz<show><ntp></ntp></show>rr
rrr
r
r�get_ntp_servers+rNr~cCr)z�
    Show device operational mode setting.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_operational_mode

    rz2<show><operational-mode></operational-mode></show>rr
rrr
r
r�get_operational_mode;rNrcCr)z�
    Show panorama connection status.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_panorama_status

    rz0<show><panorama-status></panorama-status></show>rr
rrr
r
r�get_panorama_statusKrNr�cCrU)z�
    Get the IP addresses that are permitted to establish management connections to the device.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_permitted_ips

    rCrD�U/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/permitted-iprEr
rrr
r
r�get_permitted_ips[rWr�cCrU)z�
    Get the platform model information and limitations.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_platform

    rCrDz=/config/devices/entry[@name='localhost.localdomain']/platformrEr
rrr
r
r�get_platformorWr�cCs ddd|�d�d�}td|�S)a=
    Get the configuration for the specified pre-defined application object. This will only return pre-defined
    application objects.

    application(str): The name of the pre-defined application object.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_predefined_application saltstack

    rCrDz,/config/predefined/application/entry[@name='z']rEr
r)�applicationrr
r
r�get_predefined_application�s

�r�cCrB)aG
    Get the candidate configuration for the specified security rule.

    rulename(str): The name of the security rule.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_security_rule rule01
        salt '*' panos.get_security_rule rule01 3

    rCrDzy/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/rulebase/security/rules/entry[@name='{}']rEr
r?)ZrulenamerIrr
r
r�get_security_rule���	r�cCrB)a�
    Get the candidate configuration for the specified service object. This will not return services that are marked
    as pre-defined objects.

    service(str): The name of the service object.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_service tcp-443
        salt '*' panos.get_service tcp-443 3

    rCrDzi/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/service/entry[@name='{}']rEr
r?)ZservicerIrr
r
r�get_service�rKr�cCrB)a�
    Get the candidate configuration for the specified service group. This will not return service groups that are
    marked as pre-defined objects.

    servicegroup(str): The name of the service group.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_service_group foobar
        salt '*' panos.get_service_group foobar 3

    rCrDzo/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/service-group/entry[@name='{}']rEr
r?)ZservicegrouprIrr
r
r�get_service_group�rKr�cCr)z
    Show device session statistics.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_session_info

    rz-<show><session><info></info></session></show>rr
rrr
r
r�get_session_info�rNr�cCrU)z�
    Get the SNMP configuration from the device.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_snmp_config

    rCrDzU/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/snmp-settingrEr
rrr
r
r�get_snmp_configrWr�cCr)z�
    Show information about available software packages.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_software_info

    rzF<request><system><software><info></info></software></system></request>rr
rrr
r
r�get_software_infor!r�cCr)z}
    Get the system date/time.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_system_date_time

    rz<show><clock></clock></show>rr
rrr
r
r�get_system_date_time'rNr�cCr)z�
    List important files in the system.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_system_files

    rz-<show><system><files></files></system></show>rr
rrr
r
r�get_system_files7rNr�cCr)zz
    Get the system information.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_system_info

    rz+<show><system><info></info></system></show>rr
rrr
r
r�get_system_infoGrNr�cCr)zx
    Show system services.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_system_services

    rz3<show><system><services></services></system></show>rr
rrr
r
r�get_system_servicesWrNr�cCs,|rdd�|�d�}nddd�}td|�S)a/
    Show the system state variables.

    mask
        Filters by a subtree or a wildcard.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_system_state
        salt '*' panos.get_system_state mask=cfg.ha.config.enabled
        salt '*' panos.get_system_state mask=cfg.ha.*

    rz@<show><system><state><filter>{}</filter></state></system></show>rz-<show><system><state></state></system></show>r
r?)�maskrr
r
r�get_system_stategs��
	r�cCs4d}td|�sdd�|�fSddd�}td|�S)	z�
    Retrieve a list of all uncommitted changes on the device.
    Requires PANOS version 8.0.0 or greater.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_uncommitted_changes

    z8.0.0r)Fr*rz><show><config><list><changes></changes></list></config></show>rr
r,)r/rr
r
r�get_uncommitted_changes�s���r�cCrU)z�
    Get the local administrative user account configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_users_config

    rCrDz/config/mgt-config/usersrEr
rrr
r
rrw�srwcCr)zs
    Show all VLAN information.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_vlans

    rz<show><vlan>all</vlan></show>rr
rrr
r
r�	get_vlans�rNr��cCsdd|d�}td|�S)z�
    Retrieve a specified xpath from the candidate configuration.

    xpath(str): The specified xpath in the candidate configuration.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_xpath /config/shared/service

    rCrDrEr
r)rGrr
r
r�	get_xpath�s
r�cCrB)a
    Get the candidate configuration for the specified zone.

    zone(str): The name of the zone.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_zone trust
        salt '*' panos.get_zone trust 2

    rCrDzf/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/zone/entry[@name='{}']rEr
r?)�zonerIrr
r
r�get_zone�r�r�cCsddd�|�d�}td|�S)z�
    Get all the zones in the candidate configuration.

    vsys(str): The string representation of the VSYS ID.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.get_zones
        salt '*' panos.get_zones 2

    rCrDzT/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/zonerEr
r?)rIrr
r
r�	get_zones�s�	r�cCsv|s
|dur
td��|durd}nd}|durd}nd}|dur-dd�||�d�}t|�Sdd	�|||�d�}t|�S)
a
    Install anti-virus packages.

    Args:
        version(str): The version of the PANOS file to install.

        latest(bool): If true, the latest anti-virus file will be installed.
                      The specified version option will be ignored.

        synch(bool): If true, the anti-virus will synch to the peer unit.

        skip_commit(bool): If true, the install will skip committing to the device.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.install_antivirus 8.0.0

    Fr<T�yes�norz�<request><anti-virus><upgrade><install><commit>{}</commit><sync-to-peer>{}</sync-to-peer><version>latest</version></install></upgrade></anti-virus></request>rz�<request><anti-virus><upgrade><install><commit>{}</commit><sync-to-peer>{}</sync-to-peer><version>{}</version></install></upgrade></anti-virus></request>�rr-r)r=Zlatestr9Zskip_commit�s�crr
r
r�install_antiviruss.�����r�cCr)zz
    Install the license key(s).

    CLI Example:

    .. code-block:: bash

        salt '*' panos.install_license

    rz9<request><license><install></install></license></request>rr
rrr
r
r�install_licenseLr!r�cCs$|std��dd�|�d�}t|�S)z�
    Upgrade to a software package by version.

    Args:
        version(str): The version of the PANOS file to install.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.install_license 8.0.0

    r<rza<request><system><software><install><version>{}</version></install></software></system></request>rr�)r=rr
r
r�install_software_s��
r�cCr)zn
    Reboot a running system.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.reboot

    rz7<request><restart><system></system></restart></request>rr
rrr
r
r�reboot}r!r�cCs8t|t�s	td��|rddd�}nddd�}td|�S)z�
    Force refreshes all FQDNs used in rules.

    force
        Forces all fqdn refresh

    CLI Example:

    .. code-block:: bash

        salt '*' panos.refresh_fqdn_cache
        salt '*' panos.refresh_fqdn_cache force=True

    zForce option must be boolean.rzV<request><system><fqdn><refresh><force>yes</force></refresh></fqdn></system></request>rzD<request><system><fqdn><refresh></refresh></fqdn></system></request>r
)r6r7rr)�forcerr
r
r�refresh_fqdn_cache�s
��r�cCr)z�
    Release config lock previously held.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.remove_config_lock

    rz?<request><config-lock><remove></remove></config-lock></request>rr
rrr
r
r�remove_config_lock�r!r�cCs^d}td|�sdd�|�fS|std��|s dd�|�d�}n	dd	�||�d�}td
|�S)aB
    Resolve address to ip address.
    Required version 7.0.0 or greater.

    address
        Address name you want to resolve.

    vsys
        The vsys name.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.resolve_address foo.bar.com
        salt '*' panos.resolve_address foo.bar.com vsys=2

    r(r)Fr*z,FQDN to resolve must be provided as address.rz;<request><resolve><address>{}</address></resolve></request>rzJ<request><resolve><vsys>{}</vsys><address>{}</address></resolve></request>r
)rr-r)rHrIr/rr
r
r�resolve_address�s(�����r�cCri)z�
    Save device configuration to a named file.

    filename
        The filename to save the configuration to.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.save_device_config foo.xml

    zFilename must not be empty.rz<save><config><to>z</to></config></save>rr
rj)r8rr
r
r�save_device_config�s
�r�cCr)z�
    Save files needed to restore device to local disk.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.save_device_state

    rz*<save><device-state></device-state></save>rr
rrr
r
r�save_device_staterNr�cCsN|std��i}dddd�|�d�}|�td|��|dur%|�t��|S)	a�
    Set the authentication profile of the Palo Alto proxy minion. A commit will be required before this is processed.

    CLI Example:

    Args:
        profile (str): The name of the authentication profile to set.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_authentication_profile foo
        salt '*' panos.set_authentication_profile foo deploy=True

    z%Profile name option must not be none.rC�setz_/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/authentication-profilez3<authentication-profile>{}</authentication-profile>�rrFrG�elementr
T)rr-�updaterr&)Zprofile�deploy�retrr
r
r�set_authentication_profile s��r�cC�P|std��i}dddd|�d�d�}|�td|��|d	ur&|�t��|S)
a�
    Set the hostname of the Palo Alto proxy minion. A commit will be required before this is processed.

    CLI Example:

    Args:
        hostname (str): The hostname to set

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_hostname newhostname
        salt '*' panos.set_hostname newhostname deploy=True

    z!Hostname option must not be none.rCr�zH/config/devices/entry[@name='localhost.localdomain']/deviceconfig/systemz
<hostname>z</hostname>r�r
T�rr�rr&)�hostnamer�r�rr
r
r�set_hostnameKs
�	r�TcC�h|durd}n|durd}ntd��i}dddd	|�d
�d�}|�td|��|dur2|�t��|S)
a�
    Enables or disables the ICMP management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_icmp
        salt '*' panos.set_management_icmp enabled=False deploy=True

    Tr�Fr��3Invalid option provided for service enabled option.rCr��P/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/servicez<disable-icmp>z</disable-icmp>r�r
r���enabledr��valuer�rr
r
r�set_management_icmps�"�
�r�cCr�)
a�
    Enables or disables the HTTP management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_http
        salt '*' panos.set_management_http enabled=False deploy=True

    Tr�Fr�r�rCr�r�z<disable-http>z</disable-http>r�r
r�r�r
r
r�set_management_http�r�r�cCr�)
a�
    Enables or disables the HTTPS management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_https
        salt '*' panos.set_management_https enabled=False deploy=True

    Tr�Fr�r�rCr�r�z<disable-https>z</disable-https>r�r
r�r�r
r
r�set_management_https�r�r�cCr�)
a�
    Enables or disables the HTTP OCSP management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_ocsp
        salt '*' panos.set_management_ocsp enabled=False deploy=True

    Tr�Fr�r�rCr�r�z<disable-http-ocsp>z</disable-http-ocsp>r�r
r�r�r
r
r�set_management_ocsp�r�r�cCr�)
a�
    Enables or disables the SNMP management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_snmp
        salt '*' panos.set_management_snmp enabled=False deploy=True

    Tr�Fr�r�rCr�r�z<disable-snmp>z</disable-snmp>r�r
r�r�r
r
r�set_management_snmp#r�r�cCr�)
a�
    Enables or disables the SSH management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_ssh
        salt '*' panos.set_management_ssh enabled=False deploy=True

    Tr�Fr�r�rCr�r�z
<disable-ssh>z</disable-ssh>r�r
r�r�r
r
r�set_management_sshOr�r�cCr�)
a�
    Enables or disables the Telnet management service on the device.

    CLI Example:

    Args:
        enabled (bool): If true the service will be enabled. If false the service will be disabled.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_management_telnet
        salt '*' panos.set_management_telnet enabled=False deploy=True

    Tr�Fr�r�rCr�r�z<disable-telnet>z</disable-telnet>r�r
r�r�r
r
r�set_management_telnet{r�r�cCs�i}|dvrtj�d��|dvrtj�d��|dkr"|s"tj�d��|dkr.|s.tj�d��|dkr<|dvr<tj�d	��|dkr|d
ksH|dkr_dd
dd�|||�d�}|�dtd|�i�|dksg|dkr~dd
dd�|||�d�}|�dtd|�i�nq|dkr�|d
ks�|dkr�dd
ddd�}|�dtd|�i�|dks�|dkr�dd
ddd�}|�dtd|�i�n8|dkr�|d
ks�|dkr�dd
ddd�}|�dtd|�i�|dks�|dkr�dd
ddd�}|�dtd|�i�|dur�|�t��|S)a�
    Set the NTP authentication of the Palo Alto proxy minion. A commit will be required before this is processed.

    CLI Example:

    Args:
        target(str): Determines the target of the authentication. Valid options are primary, secondary, or both.

        authentication_type(str): The authentication type to be used. Valid options are symmetric, autokey, and none.

        key_id(int): The NTP authentication key ID.

        authentication_key(str): The authentication key.

        algorithm(str): The algorithm type to be used for a symmetric key. Valid options are md5 and sha1.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' ntp.set_authentication target=both authentication_type=autokey
        salt '*' ntp.set_authentication target=primary authentication_type=none
        salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5
        salt '*' ntp.set_authentication target=both authentication_type=symmetric key_id=15 authentication_key=mykey algorithm=md5 deploy=True

    )�primary�	secondary�bothz2Target option must be primary, secondary, or both.)�	symmetric�autokey�nonez0Type option must be symmetric, autokey, or both.r�zIWhen using symmetric authentication, authentication_key must be provided.z=When using symmetric authentication, key_id must be provided.)�md5�sha1zCWhen using symmetric authentication, algorithm must be md5 or sha1.r�r�rCr�z{/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/primary-ntp-server/authentication-typez�<symmetric-key><algorithm><{0}><authentication-key>{1}</authentication-key></{0}></algorithm><key-id>{2}</key-id></symmetric-key>r��primary_serverr
r�z}/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/secondary-ntp-server/authentication-type�secondary_serverr�z
<autokey/>r�z<none/>T)r�
exceptionsrr-r�rr&)�targetZauthentication_typeZkey_idZauthentication_key�	algorithmr�r�rr
r
r�set_ntp_authentication�s�"�����������	�	��	�	r�cCsxi}|rdddd�|�d�}|�dtd|�i�|r0dddd�|�d�}|�d	td|�i�|d
ur:|�t��|S)a�
    Set the NTP servers of the Palo Alto proxy minion. A commit will be required before this is processed.

    CLI Example:

    Args:
        primary_server(str): The primary NTP server IP address or FQDN.

        secondary_server(str): The secondary NTP server IP address or FQDN.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' ntp.set_servers 0.pool.ntp.org 1.pool.ntp.org
        salt '*' ntp.set_servers primary_server=0.pool.ntp.org secondary_server=1.pool.ntp.org
        salt '*' ntp.ser_servers 0.pool.ntp.org 1.pool.ntp.org deploy=True

    rCr�zg/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/primary-ntp-serverz+<ntp-server-address>{}</ntp-server-address>r�r�r
zi/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/ntp-servers/secondary-ntp-serverr�T)r-r�rr&)r�r�r�r�rr
r
r�set_ntp_servers=	s,����r�cCr�)
a�
    Add an IPv4 address or network to the permitted IP list.

    CLI Example:

    Args:
        address (str): The IPv4 address or network to allow access to add to the Palo Alto device.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_permitted_ip 10.0.0.1
        salt '*' panos.set_permitted_ip 10.0.0.0/24
        salt '*' panos.set_permitted_ip 10.0.0.1 deploy=True

    z!Address option must not be empty.rCr�r�z
<entry name='z
'></entry>r�r
Tr�)rHr�r�rr
r
r�set_permitted_ipu	s
�r�cCr�)
a�
    Set the timezone of the Palo Alto proxy minion. A commit will be required before this is processed.

    CLI Example:

    Args:
        tz (str): The name of the timezone to set.

        deploy (bool): If true then commit the full candidate configuration, if false only set pending change.

    .. code-block:: bash

        salt '*' panos.set_timezone UTC
        salt '*' panos.set_timezone UTC deploy=True

    z&Timezone name option must not be none.rCr�zQ/config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/timezonez
<timezone>z</timezone>r�r
Tr�)�tzr�r�rr
r
r�set_timezone�	s
�r�cCr)zr
    Shutdown a running system.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.shutdown

    rz9<request><shutdown><system></system></shutdown></request>rr
rrr
r
r�shutdown�	r!r��vr1cCsJd}|r|d|�d�7}|r|d|�d�7}|d7}d|d�}td	|�S)
a;
    Perform a route lookup within active route table (fib).

    ip (str): The destination IP address to test.

    vr (str): The name of the virtual router to test.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.test_fib_route 4.2.2.2
        salt '*' panos.test_fib_route 4.2.2.2 my-vr

    z<test><routing><fib-lookup>z<ip>z</ip>z<virtual-router>z</virtual-router>z</fib-lookup></routing></test>rrr
r)�ipZvrrGrr
r
r�test_fib_route�	s
r�c
Cs�d}
|r|
d|�d�7}
|r|
d|�d�7}
|r |
d|�d�7}
|r*|
d|�d	�7}
|r4|
d
|�d�7}
|r>|
d|�d
�7}
|rH|
d|�d�7}
|rR|
d|�d�7}
|	rX|
d7}
|
d7}
dd|��|
d�}td|�S)a4
    Checks which security policy as connection will match on the device.

    sourcezone (str): The source zone matched against the connection.

    destinationzone (str): The destination zone matched against the connection.

    source (str): The source address. This must be a single IP address.

    destination (str): The destination address. This must be a single IP address.

    protocol (int): The protocol number for the connection. This is the numerical representation of the protocol.

    port (int): The port number for the connection.

    application (str): The application that should be matched.

    category (str): The category that should be matched.

    vsys (int): The numerical representation of the VSYS ID.

    allrules (bool): Show all potential match rules until first allow rule.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22
        salt '*' panos.test_security_policy sourcezone=trust destinationzone=untrust protocol=6 port=22 vsys=2

    z<test><security-policy-match>z<from>z</from>z<to>z</to>z<source>z	</source>z
<destination>z</destination>z
<protocol>z</protocol>z<destination-port>z</destination-port>z
<application>z</application>z
<category>z</category>z<show-all>yes</show-all>z</security-policy-match></test>rrI)rrIrr
r)Z
sourcezoneZdestinationzone�sourceZdestination�protocol�portr��categoryrIZallrulesrGrr
r
r�test_security_policy�	s,,r�cCs(|std��dd�|�d�}td|�S)z�
    Unlocks a locked administrator account.

    username
        Username of the administrator.

    CLI Example:

    .. code-block:: bash

        salt '*' panos.unlock_admin username=bob

    z!Username option must not be none.rzT<set><management-server><unlock><admin>{}</admin></unlock></management-server></set>rr
)rr-r)�usernamerr
r
r�unlock_adminE
s�r�)N)NF)NrA)rb)r�)r�rA)rA)NFFF)F)NN)TF)NNNNNF)NNF)Nr�)
NNNNNNNNrAF)l�__doc__�loggingrZsalt.proxy.panosrZsalt.utils.platformZsalt.exceptionsr�	getLogger�__name__�logrrrr r"r#r$r&r0r1r2r:r>r@rJrLrMrOrPrQrRrSrTrVrXrYrZr[r\r]r^r`rarfrhrrnrorprqrrrsrtrurzr{r|r}r~rr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rwr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r
r
r
r�<module>s�



&

/
/
 




"








�A

"

2

+
(
,
,
,
,
,
,-
�

8
'&
!
�P