Improve firewall support

[beittenc]

The current firewall support is limited only to listing. We should expose more functionality in order to make this manager (and related CLI module) more useful.

[bodenr]

+1... not sure whats avail in the SLAPI off hand, but would be nice if such support could lend itself as a stepping stone to supporting security-group type APIs in the jumpgate project

[anasouma]

Will start working on this issue.

[anasouma]

Nathan and @sudorandom let me know your thoughts on what you want implemented here:

1 - Add support for both standard and dedicated firewalls
2 - sl firewall list

3 - sl firewall detail id (--cci, --server, --vlan) : type of firewall is needed otherwise, we will end up making additional calls in the code to determine what the firewall id correspond to.

4 - sl firewall add id (--cci, --server, --vlan) : add a firewall and attach to the specified resource of type specified.
for example: sl firewall add 267846 --cci -> add a standard firewall to the specified cci

$ sl firewall add 3968276 --cci
This action will incur charges on your account. Continue? [y/N]: y

---

Product: 10Mbps Hardware Firewall
Price: 49$ monthly

---

SoftLayerAPIError(SoftLayer_Exception_Public): test2.softlayer.com is already protected by a hardware firewall.

4 - sl firewall delete id (--cci | --server | --vlan)
Delete firewall with id specified.

5 - sl firewall edit id (--cci | --server | --vlan)
will retrieve the list of firewall rules, add them to the default editor, and let the user change them... once complete, the updated rules will be sent to the api server.

for example:
sl firewall edit 3078 --vlan

let me know ur thoughts...

[sudorandom]

@anasouma

1. +1
2. I'm thinking the shape of this table should change. I think for every row in the "firewall id/details" table there should be a row in the base table. In my mind, the columns would look like this:

• id (firewall id)
• type
• features
• server_id

I'm not even sure if these columns are really needed:

• vlan_id
• vlan_number

If this seems off-base let me know because I might be misunderstanding how this data looks.

3. I'm concerned about how wide this table is and the order is a little funny. Maybe this is a bit better:

• action: allow
• protocol: tcp
• dest: any:80, any:1-65535, 74.51.212.221:1-65535
• dest_mask: 255.255.255.255
• src: 0.0.0.0
• src_mask: 255.255.255

5. I'm confused about the mechanics of this. Does it open up an editor with JSON in it for the user to edit?

[anasouma]

@sudorandom,
on 2) I tried to keep what originally was there and expand on it... in any case, i changed it to what you requested, I agree its cleaner now.

osadmin@smartcloudpvc:~/git/softlayer-python$ sl firewall list
:.............:..................:..........:................:
: firewall id :       type       : features : server/vlan id :
:.............:..................:..........:................:
:     3080    : VLAN - dedicated :    HA    :     361652     :
:    26664    :  CCI - standard  :          :    3895386     :
:    26692    :  CCI - standard  :          :    3968276     :
:    26496    :  CCI - standard  :          :    3950278     :
:    26690    :  CCI - standard  :          :    3968272     :
:.............:..................:..........:................:

on 3) Changed based on your suggestion: see below

osadmin@smartcloudpvc:~/git/softlayer-python$ sl firewall detail 26690 --cci
:...:........:..........:......................:.................:.........:..........:
: # : action : protocol :     destination      :    dest_mask    :  src_ip : src_mask :
:...:........:..........:......................:.................:.........:..........:
: 1 : permit :   tcp    : any on server:1:1024 : 255.255.255.255 : 0.0.0.0 : 0.0.0.0  :
:...:........:..........:......................:.................:.........:..........:

on 5) yes originally i anticipated just throw json on there and have the user manually edit/expand accordingly. If you prefer instead that i just have those in a list format like you have in the comment, and then parse it back to python dictionary, i can. let me know what makes more sense. The api itself takes an array of dict rules... how we present those to the users, for their input, should be easy to implement.

[sudorandom]

@anasouma this is awesome, Wissam.

3. I'm not 100% on what I suggested for 3 in regard to how the port range is represented. One additional comment is that it will read better if source were before destination so it would read like the following: "permit TCP from source (with mask) to access destination (with mask) on some port range

4. Hm... Something like this may work:

action: permit
destination_ip_address: any
...
version: 4

============
action: deny
destination_ip_address: any
...

I'm not 100% sold on this, but I feel like editing JSON might be a little harsh. On the other hand, the user is editing firewall rules so requiring knowledge of JSON syntax isn't so unreasonable.

[anasouma]

See here:

Editing:

[underscorephil]

+1

[sudorandom]

@anasouma +1 this is awesome. This almost makes up for you using nano.

[anasouma]

lol nano isn't that bad!

pull in request here: #301

[underscorephil]

Pulled in #301