view release on metacpan or  search on metacpan

lib/Firewall/Config/Initialize.pm  view on Meta::CPAN

#------------------------------------------------------------------------------
sub initFirewall {
  my ( $self, $param ) = @_;
  my $conf;
  my $fwId   = $param->{fwId};
  my $fwInfo = $self->getFwInfo($fwId);

  # say dumper $fwInfo;
  my $fwName = $fwInfo->{$fwId}{fwName};
  my $fwType = $fwInfo->{$fwId}->{fwType};
  my $vdom   = $fwInfo->{$fwId}->{vdom};
  if ( $param->{initType} eq 'connect' ) {
    eval { $conf = $self->getConfById( $fwInfo->{$fwId} ); };
    if ( !!$@ ) {
      $@ =~ /^(?<error>.+?)\s+at\s+/im;
      my $err = $+{error};
      my $sql = "update fw_info set fw_state=3,fw_error='$err' where fw_id = $fwId";
      $self->dbi->execute($sql);
      return {success => 0, reason => $err};
    }
  }
  elsif ( $param->{initType} eq 'import' ) {
    if ( open( my $file_h, $param->{file} ) ) {
      my @config;
      while ( my $str = <$file_h> ) {
        chomp $str;
        push @config, $str;
      }
      $conf = Firewall::Config::Content::Static->new(
        fwId   => $fwId,
        fwName => $fwName,
        config => \@config,
        fwType => $fwType
      );
    }
    else {
      my $sql = "update fw_info set fw_state=3,fw_error='open file $param->{file} fail' where fw_id = $fwId";
      $self->dbi->execute($sql);
      return {success => 0, reason => "open file $param->{file} fail"};
    }
  }

  eval { $self->saveAndParseConfig( {fwId => $fwId, type => $fwType, conf => $conf, vdom => $vdom} ); };
  if ( !!$@ ) {

    # confess $@;
    $@ =~ /^(?<error>.+?)\s+at\s+/im;
    my $err = $+{error};
    my $sql = "update fw_info set fw_state=3,fw_error='$err' where fw_id = $fwId";
    $self->dbi->execute($sql);
    return {success => 0, reason => $err};
  }
  my $sql = "update fw_info set fw_state=2 where fw_id = $fwId";
  $self->dbi->execute($sql);
  return {success => 1};
}

#------------------------------------------------------------------------------
# 更新防火墙网段信息
#------------------------------------------------------------------------------
sub updateNetwork {
  my ( $self, $fwId ) = @_;

  my @tables = ( 'fw_network_main', 'fw_network_private' );
  for my $table (@tables) {
    my $sql      = "select fw_id,zone,addr_range from $table where fw_id=$fwId";
    my $networks = $self->dbi->execute($sql)->all;
    for my $network ( @{$networks} ) {
      my ( $min, $max );
      if ( $network->{addr_range} =~ /\d+\.\d+\.\d+\.\d+\/\d+/ ) {
        my ( $ip, $mask ) = split( '/', $network->{addr_range} );
        ( $min, $max ) = Firewall::Utils::Ip->new->getRangeFromIpMask( $ip, $mask );
      }
      elsif ( $network->{addr_range} =~ /\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+/ ) {
        my ( $minIp, $maxIp ) = split( '-', $network->{addr_range} );
        ( $min, $max ) = Firewall::Utils::Ip->new->getRangeFromIpRange( $minIp, $maxIp );
      }
      else {
        return {success => 0, reason => "ipaddr format is wrong!"};
      }
      my $sql
        = "update $table set addr_min=$min,addr_max=$max where fw_id = :fwId and zone= :zone and addr_range= :range";
      $self->dbi->execute( $sql,
        {fwId => $network->{fw_id}, zone => $network->{zone}, range => $network->{addr_range}} );
    }
  }
  $self->dbi->disconnect;
  return {success => 1};
}

#------------------------------------------------------------------------------
# 保存并解析防火墙配置，结构化数据入库
#------------------------------------------------------------------------------
sub saveAndParseConfig {
  my ( $self, $param ) = @_;
  my ( $fwId, $type, $conf ) = @{$param}{qw/fwId type conf/};
  my $sonDbi = $self->dbi->clone;

  my $predefinedService;
  eval(
    "use Firewall::Config::Dao::PredefinedService::$type; \$predefinedService = Firewall::Config::Dao::PredefinedService::$type->new( dbi => \$sonDbi )"
  );
  confess $@ if !!$@;
  $predefinedService = $predefinedService->load($fwId);

  use Firewall::Config::Dao::Config;
  my $daoConf         = Firewall::Config::Dao::Config->new( dbi => $sonDbi, conf => $conf );
  my $isConfigChanged = $daoConf->save;

  #return unless $isConfigChanged;

  my $parser;
  eval(
    "use Firewall::Config::Parser::$type; \$parser = Firewall::Config::Parser::$type->new(config => \$conf, preDefinedService => \$predefinedService);"
  );
  confess $@ if !!$@;

  if ( $type eq 'Fortinet' ) {
    $parser->{vdom} = $param->{vdom} // 'root';
  }
  $parser->parse();