illumio-pylo 0.2.5__py3-none-any.whl

illumio_pylo/Ruleset.py

@@ -0,0 +1,306 @@
+from typing import Optional, List, Union, Dict
+
+import illumio_pylo as pylo
+from .API.JsonPayloadTypes import RuleObjectJsonStructure, RulesetObjectJsonStructure, \
+    RulesetScopeEntryLineJsonStructure
+import re
+
+ruleset_id_extraction_regex = re.compile(r"^/orgs/([0-9]+)/sec_policy/([0-9]+)?(draft)?/rule_sets/(?P<id>[0-9]+)$")
+
+
+class RulesetScope:
+
+    def __init__(self, owner: 'pylo.Ruleset'):
+        self.owner: 'pylo.Ruleset' = owner
+        self.scope_entries: Dict['pylo.RulesetScopeEntry', 'pylo.RulesetScopeEntry'] = {}
+
+    def load_from_json(self, data: List[List[RulesetScopeEntryLineJsonStructure]]):
+        for scope_json in data:
+            scope_entry = pylo.RulesetScopeEntry(self)
+            scope_entry.load_from_json(scope_json)
+            self.scope_entries[scope_entry] = scope_entry
+
+    def get_all_scopes_str(self, label_separator='|', scope_separator="\n", use_href: bool = False):
+        result = ''
+        for scope in self.scope_entries.keys():
+            if len(result) < 1:
+                result += scope.to_string(label_separator,use_href=use_href)
+            else:
+                result += scope_separator
+                result += scope.to_string(label_separator,use_href=use_href)
+
+        return result
+
+    def has_at_least_one_all_all_all(self) -> bool:
+        for scope_entry in self.scope_entries:
+            if scope_entry.is_all_all_all():
+                return True
+        return False
+
+class RulesetScopeEntry:
+
+    def __init__(self, owner: 'pylo.RulesetScope'):
+        self.owner: pylo.RulesetScope = owner
+        self._labels: Dict[str, Union['pylo.Label', 'pylo.LabelGroup']] = {}
+
+    def load_from_json(self, data: List[RulesetScopeEntryLineJsonStructure]):
+        #log.error(pylo.nice_json(data))
+        l_store = self.owner.owner.owner.owner.LabelStore
+        for label_json in data:
+            label_entry = label_json.get('label')
+            if label_entry is None:
+                label_entry = label_json.get('label_group')
+                if label_entry is None:
+                    raise pylo.PyloEx("Cannot find 'label' or 'label_group' entry in scope: {}".format(pylo.nice_json(label_json)))
+            href_entry = label_entry.get('href')
+            if href_entry is None:
+                raise pylo.PyloEx("Cannot find 'href' entry in scope: {}".format(pylo.nice_json(data)))
+
+            label = l_store.find_by_href(href_entry)
+            if label is None:
+                raise pylo.PyloEx("Cannot find label with href '{}' in Ruleset '{}' scope: {}".format(href_entry,
+                                                                                                      self.owner.owner.name,
+                                                                                      pylo.nice_json(data)))
+
+            if label.type not in self.owner.owner.owner.owner.LabelStore.label_types_as_set:
+                raise pylo.PyloEx("Unsupported label type '{}' named '{}' in scope of ruleset '{}'/'{}'".format(label.type_string(),
+                                                                                                                label.name,
+                                                                                                                self.owner.owner.href,
+                                                                                                                self.owner.owner.name))
+            self._labels[label.type] = label
+
+    @property
+    def labels(self) -> List[Union['pylo.Label', 'pylo.LabelGroup']]:
+        """
+        Return a copy of the labels list
+        """
+        return list(self._labels.values())
+
+    @property
+    def labels_sorted_by_type(self) -> List[Union['pylo.Label', 'pylo.LabelGroup']]:
+        """
+        Return a copy of the labels list sorted by type which are defined by the LabelStore
+        """
+        return pylo.LabelStore.Utils.list_sort_by_type(self._labels.values(), self.owner.owner.owner.owner.LabelStore.label_types)
+
+    @property
+    def labels_by_type(self) -> Dict[str, Union['pylo.Label', 'pylo.LabelGroup']]:
+        """
+        Return a copy of the labels dict keyed by label type
+        :return:
+        """
+        return self._labels.copy()
+
+    @property
+    def labels_by_href(self) -> Dict[str, Union['pylo.Label', 'pylo.LabelGroup']]:
+        """
+        Return labels dict keyed by label href
+        :return:
+        """
+        return {label.href: label for label in self._labels.values()}
+
+
+    def to_string(self, label_separator = '|', use_href=False):
+        string = 'All' + label_separator
+        if self.app_label is not None:
+            if use_href:
+                string = self.app_label.href + label_separator
+            else:
+                string = self.app_label.name + label_separator
+
+        if self.env_label is None:
+            string += 'All' + label_separator
+        else:
+            if use_href:
+                string += self.env_label.href + label_separator
+            else:
+                string += self.env_label.name + label_separator
+
+        if self.loc_label is None:
+            string += 'All'
+        else:
+            if use_href:
+                string += self.loc_label.href
+            else:
+                string += self.loc_label.name
+
+        return string
+
+    def is_all_all_all(self):
+        return len(self._labels) == 0
+
+    @property
+    def loc_label(self) -> Optional['pylo.Label']:
+        """
+        @deprecated
+        :return:
+        """
+        return self._labels.get('loc')
+
+    @property
+    def env_label(self) -> Optional['pylo.Label']:
+        """
+        @deprecated
+        :return:
+        """
+        return self._labels.get('env')
+
+    @property
+    def app_label(self) -> Optional['pylo.Label']:
+        """
+        @deprecated
+        :return:
+        """
+        return self._labels.get('app')
+
+
+class Ruleset:
+
+    name: str
+    href: Optional[str]
+    description: str
+
+    def __init__(self, owner: 'pylo.RulesetStore'):
+        self.owner: 'pylo.RulesetStore' = owner
+        self.href: Optional[str] = None
+        self.name: str = ''
+        self.description: str = ''
+        self.scopes: 'pylo.RulesetScope' = pylo.RulesetScope(self)
+        # must keep an ordered list of rules while the dict by href is there for quick searches
+        self._rules_by_href: Dict[str, 'pylo.Rule'] = {}
+        self._rules: List['pylo.Rule'] = []
+
+    @property
+    def rules(self):
+        """
+        Return a copy of the rules list
+        :return:
+        """
+        return self._rules.copy()
+
+    @property
+    def rules_by_href(self):
+        """
+        Return a copy of the rules dict keyed by href
+        :return:
+        """
+        return self._rules_by_href.copy()
+
+    @property
+    def rules_ordered_by_type(self):
+        """
+        Return a list of rules ordered by type (Intra Scope First)
+        :return:
+        """
+        rules: List[pylo.Rule] = []
+        for rule in self._rules:
+            if rule.is_intra_scope():
+                rules.append(rule)
+        for rule in self._rules:
+            if not rule.is_intra_scope():
+                rules.append(rule)
+        return rules
+
+
+    def load_from_json(self, data: RulesetObjectJsonStructure):
+        if 'name' not in data:
+            raise pylo.PyloEx("Cannot find Ruleset name in JSON data: \n" + pylo.Helpers.nice_json(data))
+        self.name = data['name']
+
+        if 'href' not in data:
+            raise pylo.PyloEx("Cannot find Ruleset href in JSON data: \n" + pylo.Helpers.nice_json(data))
+        self.href = data['href']
+
+        scopes_json = data.get('scopes')
+        if scopes_json is None:
+            raise pylo.PyloEx("Cannot find Ruleset scope in JSON data: \n" + pylo.Helpers.nice_json(data))
+
+        self.description = data.get('description')
+        if self.description is None:
+            self.description = ''
+
+        self.scopes.load_from_json(scopes_json)
+
+        if 'rules' in data:
+            for rule_data in data['rules']:
+                self.load_single_rule_from_json(rule_data)
+
+    def load_single_rule_from_json(self, rule_data: RuleObjectJsonStructure) -> 'pylo.Rule':
+        new_rule = pylo.Rule(self)
+        new_rule.load_from_json(rule_data)
+        self._rules_by_href[new_rule.href] = new_rule
+        self._rules.append(new_rule)
+        return new_rule
+
+    def api_delete_rule(self, rule_or_href: Union[str, 'pylo.Rule']):
+        """
+
+        :param rule_or_href: HRef string or a Rule object to be deleted
+        """
+        href = rule_or_href
+        if isinstance(rule_or_href, pylo.Rule):
+            href = rule_or_href.href
+
+        find_object = self._rules_by_href.get(href)
+        if find_object is None:
+            raise pylo.PyloEx("Cannot delete a Rule with href={} which is not part of ruleset {}/{}".format(href, self.name, self.href))
+
+        self.owner.owner.connector.objects_rule_delete(href)
+        del self._rules_by_href[href]
+        self._rules.remove(find_object)
+
+    def api_create_rule(self, intra_scope: bool,
+                        consumers: List['pylo.RuleActorsAcceptableTypes'],
+                        providers: List['pylo.RuleActorsAcceptableTypes'],
+                        services: List[Union['pylo.Service', 'pylo.DirectServiceInRule']],
+                        description='', machine_auth=False, secure_connect=False, enabled=True,
+                        stateless=False, consuming_security_principals=None,
+                        resolve_consumers_as_virtual_services=True, resolve_consumers_as_workloads=True,
+                        resolve_providers_as_virtual_services=True, resolve_providers_as_workloads=True) -> 'pylo.Rule':
+        if consuming_security_principals is None:
+            consuming_security_principals = []
+
+        new_rule_json = self.owner.owner.connector.objects_rule_create(
+            intra_scope=intra_scope, ruleset_href=self.href,
+            consumers=consumers, providers=providers, services=services,
+            description=description, machine_auth=machine_auth, secure_connect=secure_connect, enabled=enabled,
+            stateless=stateless, consuming_security_principals=consuming_security_principals,
+            resolve_consumers_as_virtual_services=resolve_consumers_as_virtual_services,
+            resolve_consumers_as_workloads=resolve_consumers_as_workloads,
+            resolve_providers_as_virtual_services=resolve_providers_as_virtual_services,
+            resolve_providers_as_workloads=resolve_providers_as_workloads
+        )
+
+        return self.load_single_rule_from_json(new_rule_json)
+
+    def count_rules(self) -> int:
+        return len(self._rules)
+
+    def extract_id_from_href(self) -> int:
+        match = ruleset_id_extraction_regex.match(self.href)
+        if match is None:
+            raise pylo.PyloEx("Cannot extract ruleset_id from href '{}'".format(self.href))
+
+        return int(match.group("id"))
+
+    def get_ruleset_url(self, pce_fqdn: str = None, pce_port: int = None) -> str:
+        if pce_fqdn is None or pce_port is None:
+            connector = pylo.find_connector_or_die(self)
+            if pce_fqdn is None:
+                pce_fqdn = connector.hostname
+            if pce_port is None:
+                pce_port = connector.port
+
+        return 'https://{}:{}/#/rulesets/{}/draft/rules/'.format(pce_fqdn, pce_port, self.extract_id_from_href())
+
+    def api_set_name(self, new_name: str):
+        find_collision = self.owner.find_ruleset_by_name(new_name)
+        if find_collision is not self:
+            raise pylo.PyloEx("A Ruleset with name '{}' already exists".format(new_name))
+
+        self.owner.owner.connector.objects_ruleset_update(self.href, update_data={'name': new_name})
+        self.name = new_name
+
+    def api_set_description(self, new_description: str):
+        self.owner.owner.connector.objects_ruleset_update(self.href, update_data={'description': new_description})
+        self.description = new_description

illumio_pylo/RulesetStore.py

@@ -0,0 +1,101 @@
+from typing import Optional, List, Union, Dict
+
+import illumio_pylo as pylo
+from illumio_pylo import log, Organization, PyloEx, Rule, Ruleset
+from .Helpers import nice_json
+
+
+class RulesetStore:
+
+    def __init__(self, owner: 'pylo.Organization'):
+        self.owner: pylo.Organization = owner
+        self._items_by_href: Dict[str, 'pylo.Ruleset'] = {}
+
+    @property
+    def rulesets(self) -> List['pylo.Ruleset']:
+        """
+        :return: a copy of the list of rulesets
+        """
+        return list(self._items_by_href.values())
+
+    @property
+    def rulesets_dict_by_href(self) -> Dict[str, 'pylo.Ruleset']:
+        """
+        :return: a copy of the dict of rulesets by href
+        :return:
+        """
+        return self._items_by_href.copy()
+
+    def count_rulesets(self) -> int:
+        return len(self._items_by_href)
+
+    def count_rules(self) -> int:
+        count = 0
+        for ruleset in self._items_by_href.values():
+            count += ruleset.count_rules()
+
+        return count
+
+    def load_rulesets_from_json(self, data):
+        for json_item in data:
+            self.load_single_ruleset_from_json(json_item)
+
+    def load_single_ruleset_from_json(self, json_item):
+        new_item = Ruleset(self)
+        new_item.load_from_json(json_item)
+
+        if new_item.href in self._items_by_href:
+            raise PyloEx(
+                "A Ruleset with href '%s' already exists in the table, please check your JSON data for consistency. JSON:\n%s"
+                % (new_item.href, nice_json(json_item)))
+
+        self._items_by_href[new_item.href] = new_item
+
+        log.debug("Found Ruleset '%s' with href '%s'" % (new_item.name, new_item.href))
+
+        return new_item
+
+    def find_rule_by_href(self, href: str) -> Optional['pylo.Rule']:
+        for ruleset in self._items_by_href.values():
+            rule = ruleset.rules_by_href.get(href)
+            if rule is not None:
+                return rule
+
+        return None
+
+    def find_ruleset_by_name(self, name: str, case_sensitive=True) -> Optional['pylo.Ruleset']:
+        used_name = name
+        if case_sensitive:
+            used_name = name.lower()
+
+        for ruleset in self._items_by_href.values():
+            if ruleset.name.lower() == used_name:
+                return ruleset
+
+        return None
+
+    def api_create_ruleset(self, name: str,
+                           scope_app: 'pylo.Label' = None,
+                           scope_env: 'pylo.Label' = None,
+                           scope_loc: 'pylo.Label' = None,
+                           description: str = '', enabled: bool = True) -> 'pylo.Ruleset':
+
+        con = self.owner.connector
+        json_item = con.objects_ruleset_create(name, scope_app, scope_env, scope_loc, description, enabled)
+        return self.load_single_ruleset_from_json(json_item)
+
+    def api_delete_ruleset(self, ruleset: Union[str, 'pylo.Ruleset']):
+        """
+
+        :param ruleset: should be href string or a Ruleset object
+        """
+        href = ruleset
+        if isinstance(ruleset, Ruleset):
+            href = ruleset.href
+
+        find_object = self._items_by_href.get(href)
+        if find_object is None:
+            raise PyloEx("Cannot delete a Ruleset with href={} which is not part of this RulesetStore".format(href))
+
+        self.owner.connector.objects_ruleset_delete(href)
+        del self._items_by_href[href]

illumio_pylo/SecurityPrincipal.py

@@ -0,0 +1,62 @@
+from typing import Optional
+import illumio_pylo as pylo
+from .Helpers import nice_json
+from illumio_pylo import log
+
+
+class SecurityPrincipal(pylo.ReferenceTracker):
+    def __init__(self, name: str, href: str, owner: 'pylo.SecurityPrincipalStore'):
+        pylo.ReferenceTracker.__init__(self)
+        self.owner: 'pylo.SecurityPrincipalStore' = owner
+        self.name: str = name
+        self.href: str = href
+        self.sid: Optional[str] = None
+        self.deleted: bool = False
+
+        self.raw_json = None
+
+    def load_from_json(self, data):
+        self.raw_json = data
+        # print(pylo.nice_json(data))
+
+        self.sid = data['sid']
+        self.deleted = data['deleted']
+
+
+
+class SecurityPrincipalStore:
+    def __init__(self, owner: 'pylo.Organization'):
+        self.owner = owner
+        self.itemsByHRef = {}  # type: dict[str,pylo.SecurityPrincipal]
+
+    def load_principals_from_json(self, json_list):
+        for json_item in json_list:
+            if 'name' not in json_item or 'href' not in json_item:
+                raise pylo.PyloEx("Cannot find 'value'/name or href for SecurityPrincipal in JSON:\n" + nice_json(json_item))
+
+            new_item_name = json_item['name']
+            new_item_href = json_item['href']
+
+            # SecurityPrincipals's name is None when it's provided by VEN through its hostname until it's manually overwritten
+            # (eventually) by someone. In such a case, you need to use hostname instead
+            if new_item_name is None:
+                if 'hostname' not in json_item:
+                    raise pylo.PyloEx("Cannot find 'value'/hostname in JSON:\n" + nice_json(json_item))
+                new_item_name = json_item['hostname']
+
+            new_item = pylo.SecurityPrincipal(new_item_name, new_item_href, self)
+            new_item.load_from_json(json_item)
+
+            if new_item_href in self.itemsByHRef:
+                raise pylo.PyloEx("A SecurityPrincipal with href '%s' already exists in the table", new_item_href)
+
+            self.itemsByHRef[new_item_href] = new_item
+
+            log.debug("Found SecurityPrincipal '%s' with href '%s'", new_item_name, new_item_href)
+
+    def find_by_href(self, href: str) -> Optional[SecurityPrincipal]:
+        return self.itemsByHRef.get(href)
+
+
+
+