diff --git a/roles/api/files/replace_metadata.json b/roles/api/files/replace_metadata.json index 7bee67483..804c11450 100644 --- a/roles/api/files/replace_metadata.json +++ b/roles/api/files/replace_metadata.json @@ -3545,6 +3545,9 @@ "change_time", "unique_name" ], + "computed_fields": [ + "cl_rule_relevant_for_tenant" + ], "filter": {} } }, @@ -3572,6 +3575,9 @@ "change_time", "docu_time" ], + "computed_fields": [ + "cl_rule_relevant_for_tenant" + ], "filter": {}, "allow_aggregations": true } @@ -3631,6 +3637,9 @@ "change_time", "docu_time" ], + "computed_fields": [ + "cl_rule_relevant_for_tenant" + ], "filter": {} }, "comment": "" @@ -3757,6 +3766,9 @@ "change_time", "unique_name" ], + "computed_fields": [ + "cl_rule_relevant_for_tenant" + ], "filter": {}, "allow_aggregations": true } @@ -9308,6 +9320,7 @@ "hide_in_gui", "mgm_id", "mgm_name", + "mgm_uid", "multi_device_manager_id" ], "filter": { @@ -10556,6 +10569,12 @@ "schema": "public" }, "object_relationships": [ + { + "name": "owner_lifecycle_state", + "using": { + "foreign_key_constraint_on": "owner_lifecycle_state_id" + } + }, { "name": "tenant", "using": { @@ -11250,7 +11269,21 @@ "table": { "name": "owner_lifecycle_state", "schema": "public" - } + }, + "array_relationships": [ + { + "name": "owners", + "using": { + "foreign_key_constraint_on": { + "column": "owner_lifecycle_state_id", + "table": { + "name": "owner", + "schema": "public" + } + } + } + } + ] }, { "table": { @@ -14625,6 +14658,18 @@ } } }, + { + "name": "rule_to_zones", + "using": { + "foreign_key_constraint_on": { + "column": "rule_id", + "table": { + "name": "rule_to_zone", + "schema": "public" + } + } + } + }, { "name": "rule_enforced_on_gateways", "using": { @@ -14673,6 +14718,18 @@ } } }, + { + "name": "rule_from_zones", + "using": { + "foreign_key_constraint_on": { + "column": "rule_id", + "table": { + "name": "rule_from_zone", + "schema": "public" + } + } + } + }, { "name": "rule_svc_resolveds", "using": { @@ -14837,6 +14894,7 @@ "permission": { "columns": [ "parent_rule_id", + "removed", "rule_create", "rule_id", "rule_last_seen", @@ -14844,6 +14902,7 @@ "xlate_rule", "access_rule", "active", + "is_global", "nat_rule", "rule_disabled", "rule_dst_neg", @@ -14858,6 +14917,7 @@ "dev_id", "last_change_admin", "mgm_id", + "rulebase_id", "rule_from_zone", "rule_num", "rule_to_zone", @@ -14890,6 +14950,7 @@ "permission": { "columns": [ "parent_rule_id", + "removed", "rule_create", "rule_id", "rule_last_seen", @@ -14897,6 +14958,7 @@ "xlate_rule", "access_rule", "active", + "is_global", "nat_rule", "rule_disabled", "rule_dst_neg", @@ -14911,6 +14973,7 @@ "dev_id", "last_change_admin", "mgm_id", + "rulebase_id", "rule_from_zone", "rule_num", "rule_to_zone", @@ -14996,47 +15059,48 @@ "role": "middleware-server", "permission": { "columns": [ + "parent_rule_id", + "removed", + "rule_create", + "rule_id", + "rule_last_seen", + "xlate_rule", "access_rule", - "action_id", "active", + "is_global", + "nat_rule", + "rule_disabled", + "rule_dst_neg", + "rule_implied", + "rule_src_neg", + "rule_svc_neg", + "rule_installon", + "rule_name", + "rule_ruleid", + "rule_time", + "action_id", "dev_id", "last_change_admin", "mgm_id", - "nat_rule", - "parent_rule_id", + "rulebase_id", + "rule_from_zone", + "rule_num", + "rule_to_zone", + "track_id", + "rule_custom_fields", + "rule_num_numeric", "parent_rule_type", - "removed", "rule_action", "rule_comment", - "rule_create", - "rule_custom_fields", - "rule_disabled", "rule_dst", - "rule_dst_neg", "rule_dst_refs", - "rule_from_zone", "rule_head_text", - "rule_id", - "rule_implied", - "rule_installon", - "rule_last_seen", - "rule_name", - "rule_num", - "rule_num_numeric", - "rule_ruleid", "rule_src", - "rule_src_neg", "rule_src_refs", "rule_svc", - "rule_svc_neg", "rule_svc_refs", - "rule_time", - "rule_to_zone", "rule_track", - "rule_uid", - "rulebase_id", - "track_id", - "xlate_rule" + "rule_uid" ], "computed_fields": [ "rule_relevant_for_tenant" @@ -15050,6 +15114,7 @@ "permission": { "columns": [ "parent_rule_id", + "removed", "rule_create", "rule_id", "rule_last_seen", @@ -15057,6 +15122,7 @@ "xlate_rule", "access_rule", "active", + "is_global", "nat_rule", "rule_disabled", "rule_dst_neg", @@ -15071,6 +15137,7 @@ "dev_id", "last_change_admin", "mgm_id", + "rulebase_id", "rule_from_zone", "rule_num", "rule_to_zone", @@ -15126,39 +15193,47 @@ "removed", "xlate_rule", "access_rule", - "active", - "nat_rule", - "rule_disabled", - "rule_dst_neg", - "rule_implied", - "rule_src_neg", - "rule_svc_neg", - "rule_installon", - "rule_name", - "rule_ruleid", - "rule_time", "action_id", + "active", "dev_id", + "is_global", "last_change_admin", "mgm_id", - "rule_from_zone", - "rule_num", - "rule_to_zone", - "track_id", - "rule_custom_fields", - "rule_num_numeric", + "nat_rule", + "parent_rule_id", "parent_rule_type", + "removed", "rule_action", "rule_comment", + "rule_create", + "rule_custom_fields", + "rule_disabled", "rule_dst", + "rule_dst_neg", "rule_dst_refs", + "rule_from_zone", "rule_head_text", + "rule_id", + "rule_implied", + "rule_installon", + "rule_last_seen", + "rule_name", + "rule_num", + "rule_num_numeric", + "rule_ruleid", "rule_src", + "rule_src_neg", "rule_src_refs", "rule_svc", + "rule_svc_neg", "rule_svc_refs", + "rule_time", + "rule_to_zone", "rule_track", - "rule_uid" + "rule_uid", + "rulebase_id", + "track_id", + "xlate_rule" ], "computed_fields": [ "rule_relevant_for_tenant" @@ -15190,6 +15265,7 @@ "permission": { "columns": [ "parent_rule_id", + "removed", "rule_create", "rule_id", "rule_last_seen", @@ -15197,6 +15273,7 @@ "xlate_rule", "access_rule", "active", + "is_global", "nat_rule", "rule_disabled", "rule_dst_neg", @@ -15211,6 +15288,7 @@ "dev_id", "last_change_admin", "mgm_id", + "rulebase_id", "rule_from_zone", "rule_num", "rule_to_zone", @@ -15260,6 +15338,7 @@ "permission": { "columns": [ "parent_rule_id", + "removed", "rule_create", "rule_id", "rule_last_seen", @@ -15267,6 +15346,7 @@ "xlate_rule", "access_rule", "active", + "is_global", "nat_rule", "rule_disabled", "rule_dst_neg", @@ -15281,6 +15361,7 @@ "dev_id", "last_change_admin", "mgm_id", + "rulebase_id", "rule_from_zone", "rule_num", "rule_to_zone", @@ -15336,32 +15417,20 @@ }, { "table": { - "name": "rule_enforced_on_gateway", + "name": "rule_to_zone", "schema": "public" }, "object_relationships": [ { - "name": "device", - "using": { - "foreign_key_constraint_on": "dev_id" - } - }, - { - "name": "importControlByRemoved", - "using": { - "foreign_key_constraint_on": "removed" - } - }, - { - "name": "import_control", + "name": "rule", "using": { - "foreign_key_constraint_on": "created" + "foreign_key_constraint_on": "rule_id" } }, { - "name": "rule", + "name": "zone", "using": { - "foreign_key_constraint_on": "rule_id" + "foreign_key_constraint_on": "zone_id" } } ], @@ -15373,8 +15442,8 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ] }, "comment": "" @@ -15387,10 +15456,11 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], - "filter": {} + "filter": {}, + "allow_aggregations": true }, "comment": "" }, @@ -15400,8 +15470,8 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], "filter": {}, "allow_aggregations": true @@ -15414,10 +15484,11 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], - "filter": {} + "filter": {}, + "allow_aggregations": true }, "comment": "" }, @@ -15427,8 +15498,21 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" + ], + "filter": {} + }, + "comment": "" + }, + { + "role": "modeller", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" ], "filter": {}, "allow_aggregations": true @@ -15441,14 +15525,11 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], - "filter": { - "dev_id": { - "_in": "x-hasura-visible-devices" - } - } + "filter": {}, + "allow_aggregations": true }, "comment": "" }, @@ -15458,14 +15539,11 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], - "filter": { - "dev_id": { - "_in": "x-hasura-visible-devices" - } - } + "filter": {}, + "allow_aggregations": true }, "comment": "" }, @@ -15475,8 +15553,8 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], "filter": {}, "allow_aggregations": true @@ -15491,8 +15569,8 @@ "columns": [ "created", "removed", - "dev_id", - "rule_id" + "rule_id", + "zone_id" ], "filter": {}, "check": {} @@ -15512,12 +15590,188 @@ }, { "table": { - "name": "rule_from", + "name": "rule_enforced_on_gateway", "schema": "public" }, "object_relationships": [ { - "name": "importControlByRfLastSeen", + "name": "device", + "using": { + "foreign_key_constraint_on": "dev_id" + } + }, + { + "name": "importControlByRemoved", + "using": { + "foreign_key_constraint_on": "removed" + } + }, + { + "name": "import_control", + "using": { + "foreign_key_constraint_on": "created" + } + }, + { + "name": "rule", + "using": { + "foreign_key_constraint_on": "rule_id" + } + } + ], + "insert_permissions": [ + { + "role": "importer", + "permission": { + "check": {}, + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ] + }, + "comment": "" + } + ], + "select_permissions": [ + { + "role": "auditor", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": {} + }, + "comment": "" + }, + { + "role": "fw-admin", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "importer", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": {} + }, + "comment": "" + }, + { + "role": "middleware-server", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "recertifier", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": { + "dev_id": { + "_in": "x-hasura-visible-devices" + } + } + }, + "comment": "" + }, + { + "role": "reporter", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": { + "dev_id": { + "_in": "x-hasura-visible-devices" + } + } + }, + "comment": "" + }, + { + "role": "reporter-viewall", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + } + ], + "update_permissions": [ + { + "role": "importer", + "permission": { + "columns": [ + "created", + "removed", + "dev_id", + "rule_id" + ], + "filter": {}, + "check": {} + }, + "comment": "" + } + ], + "delete_permissions": [ + { + "role": "importer", + "permission": { + "filter": {} + }, + "comment": "" + } + ] + }, + { + "table": { + "name": "rule_from", + "schema": "public" + }, + "object_relationships": [ + { + "name": "importControlByRfLastSeen", "using": { "foreign_key_constraint_on": "rf_last_seen" } @@ -15584,15 +15838,16 @@ "role": "auditor", "permission": { "columns": [ + "active", + "negated", "obj_id", + "removed", "rf_create", "rf_last_seen", "removed", "rule_from_id", "rule_id", - "user_id", - "active", - "negated" + "user_id" ], "computed_fields": [ "rule_from_relevant_for_tenant" @@ -15605,15 +15860,16 @@ "role": "fw-admin", "permission": { "columns": [ + "active", + "negated", "obj_id", + "removed", "rf_create", "rf_last_seen", "removed", "rule_from_id", "rule_id", - "user_id", - "active", - "negated" + "user_id" ], "computed_fields": [ "rule_from_relevant_for_tenant" @@ -15658,6 +15914,9 @@ "rule_id", "user_id" ], + "computed_fields": [ + "rule_from_relevant_for_tenant" + ], "filter": {} }, "comment": "" @@ -15667,6 +15926,7 @@ "permission": { "columns": [ "obj_id", + "removed", "rf_create", "rf_last_seen", "removed", @@ -15709,15 +15969,16 @@ "role": "recertifier", "permission": { "columns": [ + "active", + "negated", "obj_id", + "removed", "rf_create", "rf_last_seen", "removed", "rule_from_id", "rule_id", - "user_id", - "active", - "negated" + "user_id" ], "computed_fields": [ "rule_from_relevant_for_tenant" @@ -15753,6 +16014,7 @@ "permission": { "columns": [ "obj_id", + "removed", "rf_create", "rf_last_seen", "removed", @@ -15796,6 +16058,7 @@ "permission": { "columns": [ "obj_id", + "removed", "rf_create", "rf_last_seen", "removed", @@ -16441,13 +16704,13 @@ "role": "auditor", "permission": { "columns": [ - "rule_id", - "svc_id", "active", + "negated", + "removed", "rs_create", "rs_last_seen", - "removed", - "negated" + "rule_id", + "svc_id" ], "filter": {} } @@ -16456,13 +16719,14 @@ "role": "fw-admin", "permission": { "columns": [ + "active", + "negated", + "removed", "rs_create", "rs_last_seen", "removed", "rule_id", - "svc_id", - "active", - "negated" + "svc_id" ], "filter": {} } @@ -16504,13 +16768,13 @@ "role": "modeller", "permission": { "columns": [ - "rule_id", - "svc_id", "active", + "negated", + "removed", "rs_create", "rs_last_seen", - "removed", - "negated" + "rule_id", + "svc_id" ], "filter": {}, "allow_aggregations": true @@ -16520,13 +16784,13 @@ "role": "recertifier", "permission": { "columns": [ - "rule_id", - "svc_id", "active", + "negated", + "removed", "rs_create", "rs_last_seen", - "removed", - "negated" + "rule_id", + "svc_id" ], "filter": {}, "allow_aggregations": true @@ -16536,13 +16800,13 @@ "role": "reporter", "permission": { "columns": [ - "rule_id", - "svc_id", "active", + "negated", + "removed", "rs_create", "rs_last_seen", - "removed", - "negated" + "rule_id", + "svc_id" ], "filter": {}, "allow_aggregations": true @@ -16552,13 +16816,13 @@ "role": "reporter-viewall", "permission": { "columns": [ - "rule_id", - "svc_id", "active", + "negated", + "removed", "rs_create", "rs_last_seen", - "removed", - "negated" + "rule_id", + "svc_id" ], "filter": {} } @@ -16593,6 +16857,179 @@ } ] }, + { + "table": { + "name": "rule_from_zone", + "schema": "public" + }, + "object_relationships": [ + { + "name": "rule", + "using": { + "foreign_key_constraint_on": "rule_id" + } + }, + { + "name": "zone", + "using": { + "foreign_key_constraint_on": "zone_id" + } + } + ], + "insert_permissions": [ + { + "role": "importer", + "permission": { + "check": {}, + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ] + }, + "comment": "" + } + ], + "select_permissions": [ + { + "role": "auditor", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "fw-admin", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "importer", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "middleware-server", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {} + }, + "comment": "" + }, + { + "role": "modeller", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "recertifier", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "reporter", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + }, + { + "role": "reporter-viewall", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "allow_aggregations": true + }, + "comment": "" + } + ], + "update_permissions": [ + { + "role": "importer", + "permission": { + "columns": [ + "created", + "removed", + "rule_id", + "zone_id" + ], + "filter": {}, + "check": {} + }, + "comment": "" + } + ], + "delete_permissions": [ + { + "role": "importer", + "permission": { + "filter": {} + }, + "comment": "" + } + ] + }, { "table": { "name": "rule_svc_resolved", @@ -16842,15 +17279,16 @@ "role": "auditor", "permission": { "columns": [ + "active", + "negated", "obj_id", + "removed", "rt_create", "rt_last_seen", "removed", "rule_id", "rule_to_id", - "user_id", - "active", - "negated" + "user_id" ], "computed_fields": [ "rule_to_relevant_for_tenant" @@ -16865,6 +17303,7 @@ "active", "negated", "obj_id", + "removed", "rt_create", "rt_last_seen", "removed", @@ -16914,6 +17353,9 @@ "rule_to_id", "user_id" ], + "computed_fields": [ + "rule_to_relevant_for_tenant" + ], "filter": {} } }, @@ -16924,6 +17366,7 @@ "active", "negated", "obj_id", + "removed", "rt_create", "rt_last_seen", "removed", @@ -16964,15 +17407,16 @@ "role": "recertifier", "permission": { "columns": [ + "active", + "negated", "obj_id", + "removed", "rt_create", "rt_last_seen", "removed", "rule_id", "rule_to_id", - "user_id", - "active", - "negated" + "user_id" ], "computed_fields": [ "rule_to_relevant_for_tenant" @@ -17010,6 +17454,7 @@ "active", "negated", "obj_id", + "removed", "rt_create", "rt_last_seen", "removed", @@ -17050,15 +17495,16 @@ "role": "reporter-viewall", "permission": { "columns": [ + "active", + "negated", "obj_id", + "removed", "rt_create", "rt_last_seen", "removed", "rule_id", "rule_to_id", - "user_id", - "active", - "negated" + "user_id" ], "computed_fields": [ "rule_to_relevant_for_tenant" @@ -17610,7 +18056,6 @@ "created", "removed", "from_rule_id", - "removed", "is_global", "is_initial", "is_section", @@ -23847,6 +24292,30 @@ } } }, + { + "name": "rule_to_zones", + "using": { + "foreign_key_constraint_on": { + "column": "zone_id", + "table": { + "name": "rule_to_zone", + "schema": "public" + } + } + } + }, + { + "name": "rule_from_zones", + "using": { + "foreign_key_constraint_on": { + "column": "zone_id", + "table": { + "name": "rule_from_zone", + "schema": "public" + } + } + } + }, { "name": "rules", "using": { diff --git a/roles/common/files/fwo-api-calls/import/rollbackImport.graphql b/roles/common/files/fwo-api-calls/import/rollbackImport.graphql index 401951609..d0f99c0cf 100644 --- a/roles/common/files/fwo-api-calls/import/rollbackImport.graphql +++ b/roles/common/files/fwo-api-calls/import/rollbackImport.graphql @@ -1,5 +1,4 @@ mutation rollbackImport($importId: bigint!) { - delete_rule(where: {rule_create: {_eq: $importId}}) { affected_rows } delete_rulebase(where: {created: {_eq: $importId}}) { affected_rows } delete_rulebase_link(where: {created: {_eq: $importId}}) { affected_rows } delete_object(where: {obj_create: {_eq: $importId}}) { affected_rows } @@ -18,7 +17,10 @@ mutation rollbackImport($importId: bigint!) { delete_rule_nwobj_resolved(where: {created: {_eq: $importId}}) { affected_rows } delete_rule_svc_resolved(where: {created: {_eq: $importId}}) { affected_rows } delete_rule_user_resolved(where: {created: {_eq: $importId}}) { affected_rows } + delete_rule_from_zone(where: {created: {_eq: $importId}}) { affected_rows } + delete_rule_to_zone(where: {created: {_eq: $importId}}) { affected_rows } delete_rule_enforced_on_gateway(where: {created: {_eq: $importId}}) { affected_rows } + delete_rule(where: {rule_create: {_eq: $importId}}) { affected_rows } update_rule(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } update_rulebase(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } update_rulebase_link(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } @@ -38,6 +40,8 @@ mutation rollbackImport($importId: bigint!) { update_rule_nwobj_resolved(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } update_rule_svc_resolved(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } update_rule_user_resolved(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } + update_rule_from_zone(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } + update_rule_to_zone(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } update_rule_enforced_on_gateway(where: {removed: {_eq: $importId}}, _set: {removed: null}) { affected_rows } delete_import_control(where: {control_id: {_eq: $importId}}) { affected_rows } } diff --git a/roles/common/files/fwo-api-calls/report/getManagementForLatestNormalizedConfig.graphql b/roles/common/files/fwo-api-calls/report/getManagementForLatestNormalizedConfig.graphql index e096dc810..d9d1eb9f8 100644 --- a/roles/common/files/fwo-api-calls/report/getManagementForLatestNormalizedConfig.graphql +++ b/roles/common/files/fwo-api-calls/report/getManagementForLatestNormalizedConfig.graphql @@ -120,11 +120,15 @@ fragment ruleFragment on rule { rule_last_hit } rule_comment - src_zone: zone { - zone_name + rule_from_zones { + zone { + zone_name + } } - dst_zone: zoneByRuleToZone { - zone_name + rule_to_zones { + zone { + zone_name + } } section_header: rule_head_text } diff --git a/roles/common/files/fwo-api-calls/report/getManagementForNormalizedConfig.graphql b/roles/common/files/fwo-api-calls/report/getManagementForNormalizedConfig.graphql index 3588d6409..f54b0e978 100644 --- a/roles/common/files/fwo-api-calls/report/getManagementForNormalizedConfig.graphql +++ b/roles/common/files/fwo-api-calls/report/getManagementForNormalizedConfig.graphql @@ -167,11 +167,15 @@ fragment ruleFragment on rule { rule_last_hit } rule_comment - src_zone: zone { - zone_name + rule_from_zones { + zone { + zone_name + } } - dst_zone: zoneByRuleToZone { - zone_name + rule_to_zones { + zone { + zone_name + } } section_header: rule_head_text } @@ -193,6 +197,7 @@ fragment deviceFragment on device { } fragment ruleBaseLinkFragment on rulebase_link { + gw_id rule { rule_uid } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetails.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetails.graphql index e12d06b5d..26c5cb136 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetails.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetails.graphql @@ -9,10 +9,12 @@ fragment ruleDetails on rule { rule_comment rule_track rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_from_zones { + zone { + zone_name + zone_id + } + } active rule_create rule_last_seen @@ -41,9 +43,11 @@ fragment ruleDetails on rule { ...networkObjectDetails } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { active: { _eq: $active } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesNew.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesNew.graphql index f175d8b5f..56ffcb18a 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesNew.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesNew.graphql @@ -7,10 +7,12 @@ rule_comment rule_track rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_from_zones { + zone { + zone_name + zone_id + } + } rule_metadatum { rule_metadata_id rule_created @@ -49,9 +51,11 @@ ...networkObjectDetailsChangesNew } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { active: { _eq: $active } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesOld.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesOld.graphql index 41401eeab..3f9f72418 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesOld.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsChangesOld.graphql @@ -7,10 +7,12 @@ rule_comment rule_track rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_from_zones { + zone { + zone_name + zone_id + } + } rule_metadatum { rule_metadata_id rule_created @@ -49,9 +51,11 @@ ...networkObjectDetailsChangesOld } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { active: { _eq: $active } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsForReport.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsForReport.graphql index 46cb4cbde..1b4113046 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsForReport.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleDetailsForReport.graphql @@ -7,11 +7,13 @@ section_header: rule_head_text rule_comment rule_track - rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_disabled + rule_from_zones { + zone { + zone_name + zone_id + } + } rule_metadatum { rule_metadata_id rule_created @@ -51,9 +53,11 @@ ...networkObjectDetails } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { rt_create: { _lte: $import_id_end } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleOverview.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleOverview.graphql index 8414b1052..08d3e9b5f 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleOverview.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleOverview.graphql @@ -8,10 +8,12 @@ fragment ruleOverview on rule { rule_comment rule_track rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_from_zones { + zone { + zone_name + zone_id + } + } rule_metadatum { rule_metadata_id rule_created @@ -52,9 +54,11 @@ fragment ruleOverview on rule { ...networkObjectOverview } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { rt_create: { _lte: $import_id_end } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesNew.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesNew.graphql index 424f40298..0e6c7f10d 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesNew.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesNew.graphql @@ -7,10 +7,12 @@ fragment ruleOverviewChangesNew on rule { rule_comment rule_track rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_from_zones { + zone { + zone_name + zone_id + } + } rule_metadatum { rule_metadata_id rule_created @@ -46,9 +48,11 @@ fragment ruleOverviewChangesNew on rule { ...networkObjectOverview } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { active: { _eq: $active } diff --git a/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesOld.graphql b/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesOld.graphql index 50bec8130..4a19c3b1e 100644 --- a/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesOld.graphql +++ b/roles/common/files/fwo-api-calls/rule/fragments/ruleOverviewChangesOld.graphql @@ -7,10 +7,12 @@ fragment ruleOverviewChangesOld on rule { rule_comment rule_track rule_disabled - src_zone: zone { - zone_name - zone_id - } + rule_from_zones { + zone { + zone_name + zone_id + } + } rule_metadatum { rule_metadata_id rule_created @@ -46,9 +48,11 @@ fragment ruleOverviewChangesOld on rule { ...networkObjectOverview } } - dst_zone: zoneByRuleToZone { - zone_name - zone_id + rule_to_zones { + zone { + zone_name + zone_id + } } rule_tos(where: { active: { _eq: $active } diff --git a/roles/common/files/fwo-api-calls/rule/insertRuleRefs.graphql b/roles/common/files/fwo-api-calls/rule/insertRuleRefs.graphql index 153f64e02..85cb22b2b 100644 --- a/roles/common/files/fwo-api-calls/rule/insertRuleRefs.graphql +++ b/roles/common/files/fwo-api-calls/rule/insertRuleRefs.graphql @@ -5,6 +5,8 @@ mutation insertRuleRefs( $ruleNwObjResolveds: [rule_nwobj_resolved_insert_input!]! $ruleSvcResolveds: [rule_svc_resolved_insert_input!]! $ruleUserResolveds: [rule_user_resolved_insert_input!]! + $ruleFromZones: [rule_from_zone_insert_input!]! + $ruleToZones: [rule_to_zone_insert_input!]! ) { insert_rule_from(objects: $ruleFroms) { affected_rows @@ -24,4 +26,10 @@ mutation insertRuleRefs( insert_rule_user_resolved(objects: $ruleUserResolveds) { affected_rows } + insert_rule_from_zone(objects: $ruleFromZones) { + affected_rows + } + insert_rule_to_zone(objects: $ruleToZones) { + affected_rows + } } \ No newline at end of file diff --git a/roles/common/files/fwo-api-calls/rule/updateRuleRefs.graphql b/roles/common/files/fwo-api-calls/rule/updateRuleRefs.graphql index 088bfffe3..5c8664105 100644 --- a/roles/common/files/fwo-api-calls/rule/updateRuleRefs.graphql +++ b/roles/common/files/fwo-api-calls/rule/updateRuleRefs.graphql @@ -6,6 +6,8 @@ mutation updateRuleRefs( $ruleNwObjResolveds: [rule_nwobj_resolved_bool_exp!] $ruleSvcResolveds: [rule_svc_resolved_bool_exp!]! $ruleUserResolveds: [rule_user_resolved_bool_exp!]! + $ruleFromZones: [rule_from_zone_bool_exp!] + $ruleToZones: [rule_to_zone_bool_exp!] ) { update_rule_from(where: { _or: $ruleFroms @@ -58,4 +60,20 @@ mutation updateRuleRefs( }) { affected_rows } + update_rule_from_zone(where: { + _or: $ruleFromZones + removed: {_is_null: true} + }, _set: { + removed: $importId + }) { + affected_rows + } + update_rule_to_zone(where: { + _or: $ruleToZones + removed: {_is_null: true} + }, _set: { + removed: $importId + }) { + affected_rows + } } \ No newline at end of file diff --git a/roles/database/files/sql/creation/fworch-create-foreign-keys.sql b/roles/database/files/sql/creation/fworch-create-foreign-keys.sql index 814c594ff..4f9225c2b 100755 --- a/roles/database/files/sql/creation/fworch-create-foreign-keys.sql +++ b/roles/database/files/sql/creation/fworch-create-foreign-keys.sql @@ -114,6 +114,11 @@ Alter table "rulebase_link" add CONSTRAINT fk_rulebase_link_created_import_contr Alter table "rulebase_link" add CONSTRAINT fk_rulebase_link_removed_import_control_control_id foreign key ("removed") references "import_control" ("control_id") on update restrict on delete cascade; +ALTER TABLE "rule_to_zone" +ADD CONSTRAINT fk_rule_to_zone_rule_id_rule_rule_id FOREIGN KEY ("rule_id") REFERENCES "rule" ("rule_id"); +ALTER TABLE "rule_to_zone" +ADD CONSTRAINT fk_rule_to_zone_zone_id_zone_zone_id FOREIGN KEY ("zone_id") REFERENCES "zone" ("zone_id"); + Alter table "rule_from" add foreign key ("obj_id") references "object" ("obj_id") on update restrict on delete cascade; Alter table "rule_from" add foreign key ("rf_create") references "import_control" ("control_id") on update restrict on delete cascade; Alter table "rule_from" add foreign key ("rf_last_seen") references "import_control" ("control_id") on update restrict on delete cascade; @@ -143,6 +148,11 @@ Alter table "rule_service" add foreign key ("rs_last_seen") references "import_ Alter table "rule_service" add foreign key ("rule_id") references "rule" ("rule_id") on update restrict on delete cascade; Alter table "rule_service" add foreign key ("svc_id") references "service" ("svc_id") on update restrict on delete cascade; +ALTER TABLE "rule_from_zone" +ADD CONSTRAINT fk_rule_from_zone_rule_id_rule_rule_id FOREIGN KEY ("rule_id") REFERENCES "rule" ("rule_id"); +ALTER TABLE "rule_from_zone" +ADD CONSTRAINT fk_rule_from_zone_zone_id_zone_zone_id FOREIGN KEY ("zone_id") REFERENCES "zone" ("zone_id"); + Alter table "rule_svc_resolved" add foreign key ("svc_id") references "service" ("svc_id") on update restrict on delete cascade; Alter table "rule_svc_resolved" add foreign key ("rule_id") references "rule" ("rule_id") on update restrict on delete cascade; Alter table "rule_svc_resolved" add foreign key ("mgm_id") references "management" ("mgm_id") on update restrict on delete cascade; diff --git a/roles/database/files/sql/creation/fworch-create-tables.sql b/roles/database/files/sql/creation/fworch-create-tables.sql index e444db197..98b945543 100755 --- a/roles/database/files/sql/creation/fworch-create-tables.sql +++ b/roles/database/files/sql/creation/fworch-create-tables.sql @@ -349,6 +349,26 @@ Create table "zone" primary key ("zone_id") ); +--crosstabulation rule zone for source +Create table "rule_from_zone" +( + "rule_id" BIGINT NOT NULL, + "zone_id" Integer NOT NULL, + "created" BIGINT NOT NULL, + "removed" BIGINT, + primary key (rule_id, zone_id, created) +); + +--crosstabulation rule zone for destination +Create table "rule_to_zone" +( + "rule_id" BIGINT NOT NULL, + "zone_id" Integer NOT NULL, + "created" BIGINT NOT NULL, + "removed" BIGINT, + primary key (rule_id, zone_id, created) +); + Create table "usr" ( "user_id" BIGSERIAL PRIMARY KEY, diff --git a/roles/database/files/upgrade/9.0.sql b/roles/database/files/upgrade/9.0.sql index 725ad8031..10093fca7 100644 --- a/roles/database/files/upgrade/9.0.sql +++ b/roles/database/files/upgrade/9.0.sql @@ -1677,10 +1677,149 @@ ON CONFLICT (config_key, config_user) DO NOTHING; -- ALTER TABLE "rule_to" DROP COLUMN IF EXISTS "rt_last_seen"; -- ALTER TABLE "rule_service" DROP COLUMN IF EXISTS "rs_last_seen"; + +-- add crosstabulations rules with zone for source and destination + +--crosstabulation rule zone for source +Create table IF NOT EXISTS "rule_from_zone" +( + "rule_id" BIGINT NOT NULL, + "zone_id" Integer NOT NULL, + "created" BIGINT NOT NULL, + "removed" BIGINT, + primary key (rule_id, zone_id, created) +); + +--crosstabulation rule zone for destination +Create table IF NOT EXISTS "rule_to_zone" +( + "rule_id" BIGINT NOT NULL, + "zone_id" Integer NOT NULL, + "created" BIGINT NOT NULL, + "removed" BIGINT, + primary key (rule_id, zone_id, created) +); + +--crosstabulation rule zone for destination FKs +ALTER TABLE "rule_to_zone" +DROP CONSTRAINT IF EXISTS fk_rule_to_zone_rule_id_rule_rule_id; +ALTER TABLE "rule_to_zone" +DROP CONSTRAINT IF EXISTS fk_rule_to_zone_zone_id_zone_zone_id; + +ALTER TABLE "rule_to_zone" +ADD CONSTRAINT fk_rule_to_zone_rule_id_rule_rule_id FOREIGN KEY ("rule_id") REFERENCES "rule" ("rule_id"); +ALTER TABLE "rule_to_zone" +ADD CONSTRAINT fk_rule_to_zone_zone_id_zone_zone_id FOREIGN KEY ("zone_id") REFERENCES "zone" ("zone_id"); + +--crosstabulation rule zone for source FKs +ALTER TABLE "rule_from_zone" +DROP CONSTRAINT IF EXISTS fk_rule_from_zone_rule_id_rule_rule_id; +ALTER TABLE "rule_from_zone" +DROP CONSTRAINT IF EXISTS fk_rule_from_zone_zone_id_zone_zone_id; + +ALTER TABLE "rule_from_zone" +ADD CONSTRAINT fk_rule_from_zone_rule_id_rule_rule_id FOREIGN KEY ("rule_id") REFERENCES "rule" ("rule_id"); +ALTER TABLE "rule_from_zone" +ADD CONSTRAINT fk_rule_from_zone_zone_id_zone_zone_id FOREIGN KEY ("zone_id") REFERENCES "zone" ("zone_id"); + + +-- initial fill script for rule_from_zones and rule_to_zones +DO $$ +DECLARE + inserted_source INT := 0; + inserted_destination INT := 0; + remaining_source INT:= 0; + remaining_destination INT:= 0; + col_exists_source BOOLEAN; + col_exists_destination BOOLEAN; + count_from_zone_in_rule_after_update INT:= 0; + count_to_zone_in_rule_after_update INT:= 0; + + +BEGIN + -- Check column rule_from_zone exists + SELECT EXISTS ( + SELECT 1 + FROM information_schema.columns + WHERE table_name='rule' + AND column_name='rule_from_zone' + ) INTO col_exists_source; + + -- Check column rule_to_zone exists + SELECT EXISTS ( + SELECT 1 + FROM information_schema.columns + WHERE table_name='rule' + AND column_name='rule_to_zone' + ) INTO col_exists_destination; + + IF col_exists_source AND NOT EXISTS (SELECT 1 FROM rule_from_zone) THEN + INSERT INTO rule_from_zone (rule_id, zone_id, created, removed) + SELECT rule_id, rule_from_zone, rule_create, removed + FROM rule + WHERE rule_from_zone IS NOT NULL; + GET DIAGNOSTICS inserted_source = ROW_COUNT; + + -- Count the existing rule_from_zone and rule_to_zone + SELECT COUNT(*) INTO remaining_source + FROM rule + WHERE rule_from_zone IS NOT NULL; + + ELSE + -- RAISE NOTICE 'Table does not exist or is not empty'; + END IF; + + IF col_exists_destination AND NOT EXISTS (SELECT 1 FROM rule_to_zone) THEN + INSERT INTO rule_to_zone (rule_id, zone_id, created, removed) + SELECT rule_id, rule_to_zone, rule_create, removed + FROM rule + WHERE rule_to_zone IS NOT NULL; + GET DIAGNOSTICS inserted_destination = ROW_COUNT; + + -- Count the existing rule_from_zone and rule_to_zone + SELECT COUNT(*) INTO remaining_destination + FROM rule + WHERE rule_to_zone IS NOT NULL; + + ELSE + -- RAISE NOTICE 'Table does not exist or is not empty'; + END IF; + + IF (col_exists_source OR col_exists_destination) AND + (remaining_source + remaining_destination = inserted_source + inserted_destination) Then + UPDATE rule + SET rule_from_zone = NULL, + rule_to_zone = NULL + WHERE rule_from_zone IS NOT NULL + OR rule_to_zone IS NOT NULL; + END IF; + + IF (col_exists_source OR col_exists_destination) Then + SELECT COUNT(*) INTO count_from_zone_in_rule_after_update FROM rule WHERE rule_from_zone IS NOT NULL; + SELECT COUNT(*) INTO count_to_zone_in_rule_after_update FROM rule WHERE rule_to_zone IS NOT NULL; + + IF count_from_zone_in_rule_after_update > 0 OR count_to_zone_in_rule_after_update > 0 THEN + RAISE EXCEPTION 'Cannot drop columns: non-null values remain (from_zone: %, to_zone: %)', count_from_zone_in_rule_after_update, count_to_zone_in_rule_after_update; + END IF; + + END IF; + + --ALTER TABLE rule + --DROP CONSTRAINT IF EXISTS rule_rule_from_zone_fkey, + --DROP CONSTRAINT IF EXISTS rule_rule_to_zone_fkey; + + --For dropping columns needed Views to be dropped/replaced where columns are included + --ALTER TABLE rule + --DROP COLUMN IF EXISTS rule_from_zone, + --DROP COLUMN IF EXISTS rule_to_zone; +END +$$; + + insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device) VALUES (28,'Cisco Asa','9','Cisco','',false,true,false) ON CONFLICT (dev_typ_id) DO NOTHING; insert into stm_dev_typ (dev_typ_id,dev_typ_name,dev_typ_version,dev_typ_manufacturer,dev_typ_predef_svc,dev_typ_is_multi_mgmt,dev_typ_is_mgmt,is_pure_routing_device) VALUES (29,'Cisco Asa on FirePower','9','Cisco','',false,true,false) - ON CONFLICT (dev_typ_id) DO NOTHING; \ No newline at end of file + ON CONFLICT (dev_typ_id) DO NOTHING; diff --git a/roles/importer/files/importer/fortiadom5ff/fmgr_zone.py b/roles/importer/files/importer/fortiadom5ff/fmgr_zone.py index 1677cbfdf..f46809f11 100644 --- a/roles/importer/files/importer/fortiadom5ff/fmgr_zone.py +++ b/roles/importer/files/importer/fortiadom5ff/fmgr_zone.py @@ -65,4 +65,4 @@ def find_zones_in_normalized_config(native_zone_list : list, normalized_config_a break if not was_zone_found: raise FwoNormalizedConfigParseError('Could not find zone ' + nativ_zone + ' in normalized config.') - return zone_out_list + return sorted(zone_out_list) diff --git a/roles/importer/files/importer/model_controllers/fwconfig_import_rule.py b/roles/importer/files/importer/model_controllers/fwconfig_import_rule.py index 244f3c601..a004a930b 100644 --- a/roles/importer/files/importer/model_controllers/fwconfig_import_rule.py +++ b/roles/importer/files/importer/model_controllers/fwconfig_import_rule.py @@ -34,6 +34,8 @@ class RefType(Enum): NWOBJ_RESOLVED = "rule_nwobj_resolved" SVC_RESOLVED = "rule_svc_resolved" USER_RESOLVED = "rule_user_resolved" + SRC_ZONE = "rule_from_zone" + DST_ZONE = "rule_to_zone" # this class is used for importing rules and rule refs into the FWO API class FwConfigImportRule(): @@ -251,6 +253,11 @@ def get_rule_refs(self, rule, is_prev=False) -> dict[RefType, list[str]]: froms = [] tos = [] users = [] + nwobj_resolveds = [] + svc_resolveds = [] + user_resolveds = [] + from_zones = [] + to_zones = [] for src_ref in rule.rule_src_refs.split(fwo_const.list_delimiter): user_ref = None if fwo_const.user_delimiter in src_ref: @@ -272,13 +279,17 @@ def get_rule_refs(self, rule, is_prev=False) -> dict[RefType, list[str]]: nwobj_resolveds = self.group_flats_mapper.get_network_object_flats([ref[0] for ref in froms + tos]) svc_resolveds = self.group_flats_mapper.get_service_object_flats(svcs) user_resolveds = self.group_flats_mapper.get_user_flats(users) + from_zones = rule.rule_src_zone.split(fwo_const.list_delimiter) if rule.rule_src_zone else [] + to_zones = rule.rule_dst_zone.split(fwo_const.list_delimiter) if rule.rule_dst_zone else [] return { RefType.SRC: froms, RefType.DST: tos, RefType.SVC: svcs, RefType.NWOBJ_RESOLVED: nwobj_resolveds, RefType.SVC_RESOLVED: svc_resolveds, - RefType.USER_RESOLVED: user_resolveds + RefType.USER_RESOLVED: user_resolveds, + RefType.SRC_ZONE: from_zones, + RefType.DST_ZONE: to_zones } def get_ref_objs(self, ref_type, ref_uid, prev_config: FwConfigNormalized): @@ -286,11 +297,16 @@ def get_ref_objs(self, ref_type, ref_uid, prev_config: FwConfigNormalized): nwobj_uid, user_uid = ref_uid return (prev_config.network_objects.get(nwobj_uid, None), prev_config.users.get(user_uid, None) if user_uid else None), \ (self.normalized_config.network_objects.get(nwobj_uid, None), self.normalized_config.users.get(user_uid, None) if user_uid else None) - if ref_type == RefType.NWOBJ_RESOLVED: + elif ref_type == RefType.NWOBJ_RESOLVED: return prev_config.network_objects.get(ref_uid, None), self.normalized_config.network_objects.get(ref_uid, None) - if ref_type == RefType.SVC or ref_type == RefType.SVC_RESOLVED: + elif ref_type == RefType.SVC or ref_type == RefType.SVC_RESOLVED: return prev_config.service_objects.get(ref_uid, None), self.normalized_config.service_objects.get(ref_uid, None) - return prev_config.users.get(ref_uid, None), self.normalized_config.users.get(ref_uid, None) + elif ref_type == RefType.USER_RESOLVED: + return prev_config.users.get(ref_uid, None), self.normalized_config.users.get(ref_uid, None) + elif ref_type == RefType.SRC_ZONE or ref_type == RefType.DST_ZONE: + return prev_config.zone_objects.get(ref_uid, None), self.normalized_config.zone_objects.get(ref_uid, None) + else: + raise FwoImporterError(f"unknown ref type: {ref_type}") def get_ref_remove_statement(self, ref_type, rule_uid, ref_uid): if ref_type == RefType.SRC or ref_type == RefType.DST: @@ -327,6 +343,15 @@ def get_ref_remove_statement(self, ref_type, rule_uid, ref_uid): {"user_id": {"_eq": self.uid2id_mapper.get_user_id(ref_uid, before_update=True)}} ] } + elif ref_type == RefType.SRC_ZONE or ref_type == RefType.DST_ZONE: + return { + "_and": [ + {"rule_id": {"_eq": self.uid2id_mapper.get_rule_id(rule_uid, before_update=True)}}, + {"zone_id": {"_eq": self.uid2id_mapper.get_zone_object_id(ref_uid, before_update=True)}} + ] + } + else: + raise FwoImporterError(f"unknown ref type: {ref_type}") def get_outdated_refs_to_remove(self, prev_rule: RuleNormalized, rule: RuleNormalized|None, prev_config, remove_all): @@ -379,7 +404,9 @@ def remove_outdated_refs(self, prev_config: FwConfigNormalized): 'ruleServices': all_refs_to_remove[RefType.SVC], 'ruleNwObjResolveds': all_refs_to_remove[RefType.NWOBJ_RESOLVED], 'ruleSvcResolveds': all_refs_to_remove[RefType.SVC_RESOLVED], - 'ruleUserResolveds': all_refs_to_remove[RefType.USER_RESOLVED] + 'ruleUserResolveds': all_refs_to_remove[RefType.USER_RESOLVED], + 'ruleFromZones': all_refs_to_remove[RefType.SRC_ZONE], + 'ruleToZones': all_refs_to_remove[RefType.DST_ZONE], } try: @@ -447,6 +474,12 @@ def get_ref_add_statement(self, ref_type, rule, ref_uid): "user_id": self.uid2id_mapper.get_user_id(ref_uid), "created": self.import_details.ImportId, } + elif ref_type == RefType.SRC_ZONE or ref_type == RefType.DST_ZONE: + return { + "rule_id": self.uid2id_mapper.get_rule_id(rule.rule_uid), + "zone_id": self.uid2id_mapper.get_zone_object_id(ref_uid), + "created": self.import_details.ImportId, + } def get_new_refs_to_add(self, rule, prev_rule, prev_config, add_all): @@ -497,7 +530,9 @@ def add_new_refs(self, prev_config: FwConfigNormalized): 'ruleServices': all_refs_to_add[RefType.SVC], 'ruleNwObjResolveds': all_refs_to_add[RefType.NWOBJ_RESOLVED], 'ruleSvcResolveds': all_refs_to_add[RefType.SVC_RESOLVED], - 'ruleUserResolveds': all_refs_to_add[RefType.USER_RESOLVED] + 'ruleUserResolveds': all_refs_to_add[RefType.USER_RESOLVED], + 'ruleFromZones': all_refs_to_add[RefType.SRC_ZONE], + 'ruleToZones': all_refs_to_add[RefType.DST_ZONE] } try: @@ -1170,22 +1205,6 @@ def prepare_rules_for_import(self, rules: list[RuleNormalized], rulebase_uid: st return prepared_rules def prepare_single_rule_for_import(self, rule: RuleNormalized, importDetails: ImportStateController, rulebase_id: int) -> Rule: - rule_from_zone_id = None - if rule.rule_src_zone is not None: - from_zones = rule.rule_src_zone.split(fwo_const.list_delimiter) - if len(from_zones) > 1: - logger = getFwoLogger() - logger.warning(f"rule {rule.rule_uid} has multiple source zones defined, only the first one will be used") - rule_from_zone_id = self.uid2id_mapper.get_zone_object_id(from_zones[0]) - - rule_to_zone_id = None - if rule.rule_dst_zone is not None: - to_zones = rule.rule_dst_zone.split(fwo_const.list_delimiter) - if len(to_zones) > 1: - logger = getFwoLogger() - logger.warning(f"rule {rule.rule_uid} has multiple destination zones defined, only the first one will be used") - rule_to_zone_id = self.uid2id_mapper.get_zone_object_id(to_zones[0]) - rule_for_import = Rule( mgm_id=importDetails.MgmDetails.CurrentMgmId, rule_num=rule.rule_num, @@ -1208,8 +1227,8 @@ def prepare_single_rule_for_import(self, rule: RuleNormalized, importDetails: Im rule_implied=rule.rule_implied, # parent_rule_id=rule.parent_rule_id, rule_comment=rule.rule_comment, - rule_from_zone=rule_from_zone_id, - rule_to_zone=rule_to_zone_id, + rule_from_zone=None, #TODO: to be removed or changed to string of joined zone names + rule_to_zone=None, #TODO: to be removed or changed to string of joined zone names access_rule=True, nat_rule=False, is_global=False, diff --git a/roles/importer/files/importer/models/rule.py b/roles/importer/files/importer/models/rule.py index 214d21b4d..85b1d10f6 100644 --- a/roles/importer/files/importer/models/rule.py +++ b/roles/importer/files/importer/models/rule.py @@ -66,15 +66,10 @@ class RuleNormalized(BaseModel): def __eq__(self, other): if not isinstance(other, RuleNormalized): return NotImplemented - # Compare all fields except 'last_hit' and 'rule_num' + # Compare all fields except 'last_hit' and 'rule_num' and zones + # Zones are excluded because they are currently not written to the rule directly, + # only linked through rule_from_zone and rule_to_zone tables (similar to _resolved tables) exclude = {"last_hit", "rule_num", "rule_src_zone", "rule_dst_zone"} - # TODO: need to handle zones like this until we can import multiple zones properly - if self.rule_src_zone and other.rule_src_zone and \ - self.rule_src_zone.split(list_delimiter)[0] != other.rule_src_zone.split(list_delimiter)[0]: - return False - if self.rule_dst_zone and other.rule_dst_zone and \ - self.rule_dst_zone.split(list_delimiter)[0] != other.rule_dst_zone.split(list_delimiter)[0]: - return False self_dict = self.model_dump(exclude=exclude) other_dict = other.model_dump(exclude=exclude) return self_dict == other_dict diff --git a/roles/lib/files/FWO.Data/Device.cs b/roles/lib/files/FWO.Data/Device.cs index a772ecf87..3855f88bb 100644 --- a/roles/lib/files/FWO.Data/Device.cs +++ b/roles/lib/files/FWO.Data/Device.cs @@ -1,7 +1,6 @@ using System.Text.Json.Serialization; using FWO.Basics; using Newtonsoft.Json; -using FWO.Basics; namespace FWO.Data { diff --git a/roles/lib/files/FWO.Data/NormalizedRule.cs b/roles/lib/files/FWO.Data/NormalizedRule.cs index 6a167c6af..7e9beb4c9 100644 --- a/roles/lib/files/FWO.Data/NormalizedRule.cs +++ b/roles/lib/files/FWO.Data/NormalizedRule.cs @@ -130,10 +130,10 @@ public static NormalizedRule FromRule(Rule rule) ParentRuleUid = rule.ParentRule?.Uid, LastHit = lastHitFormatted, RuleComment = rule.Comment, - RuleSrcZone = rule.SourceZone?.Name, - RuleDstZone = rule.DestinationZone?.Name, + RuleSrcZone = rule.RuleFromZones?.Length > 0 ? string.Join("|", rule.RuleFromZones.Select(z => z.Content.Name).Order()) : null, + RuleDstZone = rule.RuleToZones?.Length > 0 ? string.Join("|", rule.RuleToZones.Select(z => z.Content.Name).Order()) : null, RuleHeadText = rule.SectionHeader }; - } + } } } diff --git a/roles/lib/files/FWO.Data/Rule.cs b/roles/lib/files/FWO.Data/Rule.cs index b361fea0b..ecf81914b 100644 --- a/roles/lib/files/FWO.Data/Rule.cs +++ b/roles/lib/files/FWO.Data/Rule.cs @@ -47,8 +47,8 @@ public class Rule [JsonProperty("rule_src_refs"), JsonPropertyName("rule_src_refs")] public string SourceRefs { get; set; } = ""; - [JsonProperty("src_zone"), JsonPropertyName("src_zone")] - public NetworkZone? SourceZone { get; set; } = new(); + [JsonProperty("rule_from_zones"), JsonPropertyName("rule_from_zones")] + public ZoneWrapper[] RuleFromZones { get; set; } = []; [JsonProperty("rule_froms"), JsonPropertyName("rule_froms")] public NetworkLocation[] Froms { get; set; } = []; @@ -62,8 +62,8 @@ public class Rule [JsonProperty("rule_dst_refs"), JsonPropertyName("rule_dst_refs")] public string DestinationRefs { get; set; } = ""; - [JsonProperty("dst_zone"), JsonPropertyName("dst_zone")] - public NetworkZone? DestinationZone { get; set; } = new(); + [JsonProperty("rule_to_zones"), JsonPropertyName("rule_to_zones")] + public ZoneWrapper[] RuleToZones { get; set; } = []; [JsonProperty("rule_tos"), JsonPropertyName("rule_tos")] public NetworkLocation[] Tos { get; set; } = []; @@ -168,11 +168,11 @@ public Rule(Rule rule) Service = rule.Service; SourceNegated = rule.SourceNegated; Source = rule.Source; - SourceZone = rule.SourceZone; + RuleFromZones = rule.RuleFromZones; Froms = rule.Froms; DestinationNegated = rule.DestinationNegated; Destination = rule.Destination; - DestinationZone = rule.DestinationZone; + RuleToZones = rule.RuleToZones; Tos = rule.Tos; Action = rule.Action; Track = rule.Track; diff --git a/roles/lib/files/FWO.Data/ZoneWrapper.cs b/roles/lib/files/FWO.Data/ZoneWrapper.cs new file mode 100644 index 000000000..aeef1a99e --- /dev/null +++ b/roles/lib/files/FWO.Data/ZoneWrapper.cs @@ -0,0 +1,16 @@ +using Newtonsoft.Json; +using System; +using System.Collections.Generic; +using System.Linq; +using System.Text; +using System.Text.Json.Serialization; +using System.Threading.Tasks; + +namespace FWO.Data +{ + public class ZoneWrapper + { + [JsonProperty("zone"), JsonPropertyName("zone")] + public NetworkZone Content { get; set; } = new NetworkZone(); + } +} diff --git a/roles/lib/files/FWO.Report.Filter/DynGraphqlQuery.cs b/roles/lib/files/FWO.Report.Filter/DynGraphqlQuery.cs index 17b96bac9..fc5c80867 100644 --- a/roles/lib/files/FWO.Report.Filter/DynGraphqlQuery.cs +++ b/roles/lib/files/FWO.Report.Filter/DynGraphqlQuery.cs @@ -419,6 +419,11 @@ private static void SetDeviceFilter(ref DynGraphqlQuery query, DeviceFilter? dev } private static string GetDevWhereFilter(ref DynGraphqlQuery query, DeviceFilter? deviceFilter) { + if (deviceFilter == null || deviceFilter.Managements == null) + { + return devWhereStringStart + devWhereStringEnd; + } + string devWhereStatement = devWhereStringStart; bool first = true; @@ -426,6 +431,8 @@ private static string GetDevWhereFilter(ref DynGraphqlQuery query, DeviceFilter? foreach (ManagementSelect mgmt in deviceFilter.Managements) { + if (mgmt.Devices == null) continue; + foreach (DeviceSelect dev in mgmt.Devices) { if (dev.Selected) diff --git a/roles/lib/files/FWO.Report/Display/RuleChangeDisplayCsv.cs b/roles/lib/files/FWO.Report/Display/RuleChangeDisplayCsv.cs index f3b651737..2644ba368 100644 --- a/roles/lib/files/FWO.Report/Display/RuleChangeDisplayCsv.cs +++ b/roles/lib/files/FWO.Report/Display/RuleChangeDisplayCsv.cs @@ -1,4 +1,4 @@ -using FWO.Basics; +using FWO.Basics; using FWO.Data; using FWO.Config.Api; using FWO.Report.Filter; @@ -41,9 +41,9 @@ public string DisplaySourceZone(RuleChange ruleChange) { switch (ruleChange.ChangeAction) { - case 'D': return OutputCsv(DisplaySourceZone(ruleChange.OldRule)); - case 'I': return OutputCsv(DisplaySourceZone(ruleChange.NewRule)); - case 'C': return OutputCsv(DisplayDiff(DisplaySourceZone(ruleChange.OldRule), DisplaySourceZone(ruleChange.NewRule))); + case 'D': return OutputCsv(ListNetworkZones(ruleChange.OldRule.RuleFromZones.Select(z => z.Content).ToArray())); + case 'I': return OutputCsv(ListNetworkZones(ruleChange.NewRule.RuleFromZones.Select(z => z.Content).ToArray())); + case 'C': return OutputCsv(DisplayDiff(ListNetworkZones(ruleChange.OldRule.RuleFromZones.Select(z => z.Content).ToArray()), ListNetworkZones(ruleChange.NewRule.RuleFromZones.Select(z => z.Content).ToArray()))); default: return ","; } } @@ -63,9 +63,9 @@ public string DisplayDestinationZone(RuleChange ruleChange) { switch (ruleChange.ChangeAction) { - case 'D': return OutputCsv(DisplayDestinationZone(ruleChange.OldRule)); - case 'I': return OutputCsv(DisplayDestinationZone(ruleChange.NewRule)); - case 'C': return OutputCsv(DisplayDiff(DisplayDestinationZone(ruleChange.OldRule), DisplayDestinationZone(ruleChange.NewRule))); + case 'D': return OutputCsv(ListNetworkZones(ruleChange.OldRule.RuleToZones.Select(z => z.Content).ToArray())); + case 'I': return OutputCsv(ListNetworkZones(ruleChange.NewRule.RuleToZones.Select(z => z.Content).ToArray())); + case 'C': return OutputCsv(DisplayDiff(ListNetworkZones(ruleChange.OldRule.RuleToZones.Select(z => z.Content).ToArray()), ListNetworkZones(ruleChange.NewRule.RuleToZones.Select(z => z.Content).ToArray()))); default: return ","; } } diff --git a/roles/lib/files/FWO.Report/Display/RuleChangeDisplayHtml.cs b/roles/lib/files/FWO.Report/Display/RuleChangeDisplayHtml.cs index b22988715..b65a3cb69 100644 --- a/roles/lib/files/FWO.Report/Display/RuleChangeDisplayHtml.cs +++ b/roles/lib/files/FWO.Report/Display/RuleChangeDisplayHtml.cs @@ -1,4 +1,4 @@ -using FWO.Data; +using FWO.Data; using FWO.Logging; using FWO.Config.Api; using FWO.Report; @@ -42,9 +42,9 @@ public string DisplaySourceZone(RuleChange ruleChange) { switch (ruleChange.ChangeAction) { - case 'D': return OutputHtmlDeleted(DisplaySourceZone(ruleChange.OldRule)); - case 'I': return OutputHtmlAdded(DisplaySourceZone(ruleChange.NewRule)); - case 'C': return DisplayDiff(DisplaySourceZone(ruleChange.OldRule), DisplaySourceZone(ruleChange.NewRule)); + case 'D': return OutputHtmlDeleted(DisplaySourceZones(ruleChange.OldRule)); + case 'I': return OutputHtmlAdded(DisplaySourceZones(ruleChange.NewRule)); + case 'C': return DisplayDiff(DisplaySourceZones(ruleChange.OldRule), DisplaySourceZones(ruleChange.NewRule)); default: ThrowErrorUnknowChangeAction(ruleChange.ChangeAction); return ""; } } @@ -66,9 +66,9 @@ public string DisplayDestinationZone(RuleChange ruleChange) { switch (ruleChange.ChangeAction) { - case 'D': return OutputHtmlDeleted(DisplayDestinationZone(ruleChange.OldRule)); - case 'I': return OutputHtmlAdded(DisplayDestinationZone(ruleChange.NewRule)); - case 'C': return DisplayDiff(DisplayDestinationZone(ruleChange.OldRule), DisplayDestinationZone(ruleChange.NewRule)); + case 'D': return OutputHtmlDeleted(DisplayDestinationZones(ruleChange.OldRule)); + case 'I': return OutputHtmlAdded(DisplayDestinationZones(ruleChange.NewRule)); + case 'C': return DisplayDiff(DisplayDestinationZones(ruleChange.OldRule), DisplayDestinationZones(ruleChange.NewRule)); default: ThrowErrorUnknowChangeAction(ruleChange.ChangeAction); return ""; } } diff --git a/roles/lib/files/FWO.Report/Display/RuleChangeDisplayJson.cs b/roles/lib/files/FWO.Report/Display/RuleChangeDisplayJson.cs index c02810d91..51073c543 100644 --- a/roles/lib/files/FWO.Report/Display/RuleChangeDisplayJson.cs +++ b/roles/lib/files/FWO.Report/Display/RuleChangeDisplayJson.cs @@ -1,4 +1,4 @@ -using FWO.Basics; +using FWO.Basics; using FWO.Data; using FWO.Config.Api; using FWO.Report.Filter; @@ -37,13 +37,13 @@ public string DisplayName(RuleChange ruleChange) } } - public string DisplaySourceZone(RuleChange ruleChange) + public string DisplaySourceZones(RuleChange ruleChange) { switch (ruleChange.ChangeAction) { - case 'D': return DisplaySourceZone(ruleChange.OldRule.SourceZone?.Name); - case 'I': return DisplaySourceZone(ruleChange.NewRule.SourceZone?.Name); - case 'C': return DisplaySourceZone(DisplayDiff(ruleChange.OldRule.SourceZone?.Name, ruleChange.NewRule.SourceZone?.Name)); + case 'D': return DisplayRuleSourceZones(ruleChange.OldRule.RuleFromZones.Select(z => z.Content).ToArray()); + case 'I': return DisplayRuleSourceZones(ruleChange.NewRule.RuleFromZones.Select(z => z.Content).ToArray()); + case 'C': return DisplayJsonArray("source zones", DisplayArrayDiff(ListNetworkZones(ruleChange.OldRule.RuleFromZones.Select(z => z.Content).ToArray()), ListNetworkZones(ruleChange.NewRule.RuleFromZones.Select(z => z.Content).ToArray()))); default: return ""; } } @@ -73,13 +73,13 @@ public string DisplaySource(RuleChange ruleChange, ReportType reportType) } } - public string DisplayDestinationZone(RuleChange ruleChange) + public string DisplayDestinationZones(RuleChange ruleChange) { switch (ruleChange.ChangeAction) { - case 'D': return DisplayDestinationZone(ruleChange.OldRule.DestinationZone?.Name); - case 'I': return DisplayDestinationZone(ruleChange.NewRule.DestinationZone?.Name); - case 'C': return DisplayDestinationZone(DisplayDiff(ruleChange.OldRule.DestinationZone?.Name, ruleChange.NewRule.DestinationZone?.Name)); + case 'D': return DisplayRuleDestinationZones(ruleChange.OldRule.RuleToZones.Select(z => z.Content).ToArray()); + case 'I': return DisplayRuleDestinationZones(ruleChange.NewRule.RuleToZones.Select(z => z.Content).ToArray()); + case 'C': return DisplayJsonArray("destination zones", DisplayArrayDiff(ListNetworkZones(ruleChange.OldRule.RuleToZones.Select(z => z.Content).ToArray()), ListNetworkZones(ruleChange.NewRule.RuleToZones.Select(z => z.Content).ToArray()))); default: return ""; } } diff --git a/roles/lib/files/FWO.Report/Display/RuleDisplayBase.cs b/roles/lib/files/FWO.Report/Display/RuleDisplayBase.cs index c3e95ffb2..873f8e4e0 100644 --- a/roles/lib/files/FWO.Report/Display/RuleDisplayBase.cs +++ b/roles/lib/files/FWO.Report/Display/RuleDisplayBase.cs @@ -1,4 +1,4 @@ -using System.Text; +using System.Text; using FWO.Basics; using FWO.Data; using FWO.Config.Api; @@ -80,14 +80,54 @@ public static string DisplayName(Rule rule) return rule.Name ?? ""; } - public static string DisplaySourceZone(Rule rule) + public static string DisplaySourceZones(Rule rule) { - return rule.SourceZone != null ? rule.SourceZone.Name : ""; + if (rule.RuleFromZones.Length != 0) + { + string ruleZones = ""; + bool notFirst = false; + + foreach (ZoneWrapper zoneWrapper in rule.RuleFromZones) + { + if (notFirst) + { + ruleZones += "
"; + } + + ruleZones += zoneWrapper.Content.Name; + notFirst = true; + } + return ruleZones; + } + else + { + return ""; + } } - public static string DisplayDestinationZone(Rule rule) + public static string DisplayDestinationZones(Rule rule) { - return rule.DestinationZone != null ? rule.DestinationZone.Name : ""; + if (rule.RuleToZones.Length != 0) + { + string ruleZones = ""; + bool notFirst = false; + + foreach (ZoneWrapper zoneWrapper in rule.RuleToZones) + { + if (notFirst) + { + ruleZones += "
"; + } + + ruleZones += zoneWrapper.Content.Name; + notFirst = true; + } + return ruleZones; + } + else + { + return ""; + } } public static string DisplayAction(Rule rule) diff --git a/roles/lib/files/FWO.Report/Display/RuleDisplayCsv.cs b/roles/lib/files/FWO.Report/Display/RuleDisplayCsv.cs index 3b42266a4..d57f1c1f2 100644 --- a/roles/lib/files/FWO.Report/Display/RuleDisplayCsv.cs +++ b/roles/lib/files/FWO.Report/Display/RuleDisplayCsv.cs @@ -1,4 +1,4 @@ -using FWO.Basics; +using FWO.Basics; using FWO.Data; using FWO.Config.Api; using System.Text; @@ -29,7 +29,7 @@ public string DisplayNameCsv(Rule rule) public string DisplaySourceZoneCsv(Rule rule) { - return OutputCsv(DisplaySourceZone(rule)); + return OutputCsv(ListNetworkZones(rule.RuleFromZones.Select(z => z.Content).ToArray())); } public string DisplaySourceCsv(Rule rule, ReportType reportType) @@ -39,7 +39,7 @@ public string DisplaySourceCsv(Rule rule, ReportType reportType) public string DisplayDestinationZoneCsv(Rule rule) { - return OutputCsv(DisplayDestinationZone(rule)); + return OutputCsv(ListNetworkZones(rule.RuleToZones.Select(z => z.Content).ToArray())); } public string DisplayDestinationCsv(Rule rule, ReportType reportType) @@ -159,5 +159,15 @@ private string DisplaySourceOrDestination(Rule rule, ReportType reportType , boo return result.ToString(); } + + protected string ListNetworkZones(NetworkZone[] networkZones) + { + List displayedZones = new List(); + foreach (NetworkZone networkZone in networkZones) + { + displayedZones.Add(Quote(networkZone.Name)); + } + return string.Join(",", displayedZones); + } } } diff --git a/roles/lib/files/FWO.Report/Display/RuleDisplayJson.cs b/roles/lib/files/FWO.Report/Display/RuleDisplayJson.cs index a576455ab..9e4077edd 100644 --- a/roles/lib/files/FWO.Report/Display/RuleDisplayJson.cs +++ b/roles/lib/files/FWO.Report/Display/RuleDisplayJson.cs @@ -1,4 +1,4 @@ -using FWO.Basics; +using FWO.Basics; using FWO.Data; using FWO.Config.Api; using FWO.Report.Filter; @@ -36,9 +36,9 @@ public string DisplayName(string? name) return DisplayJsonString("name", name); } - public string DisplaySourceZone(string? sourceZone) + public string DisplayRuleSourceZones(NetworkZone[] networkZones) { - return DisplayJsonString("source zone", sourceZone); + return DisplayJsonArray("source zones", ListNetworkZones(networkZones)); } public string DisplaySourceNegated(bool sourceNegated) @@ -51,9 +51,9 @@ public string DisplaySource(Rule rule, ReportType reportType) return DisplayJsonArray("source", ListNetworkLocations(rule, reportType, true)); } - public string DisplayDestinationZone(string? destinationZone) + public string DisplayRuleDestinationZones(NetworkZone[] networkZones) { - return DisplayJsonString("destination zone", destinationZone); + return DisplayJsonArray("destination zones", ListNetworkZones(networkZones)); } public string DisplayDestinationNegated(bool destinationNegated) @@ -128,5 +128,15 @@ protected string ListServices(Rule rule, ReportType reportType) } return ""; } + + protected string ListNetworkZones(NetworkZone[] networkZones) + { + List displayedZones = new List(); + foreach (NetworkZone networkZone in networkZones) + { + displayedZones.Add(Quote(networkZone.Name)); + } + return string.Join(",", displayedZones); + } } } diff --git a/roles/lib/files/FWO.Report/ReportChanges.cs b/roles/lib/files/FWO.Report/ReportChanges.cs index 6629d9617..38e22b8a5 100644 --- a/roles/lib/files/FWO.Report/ReportChanges.cs +++ b/roles/lib/files/FWO.Report/ReportChanges.cs @@ -293,10 +293,10 @@ private string ExportResolvedChangesToJson() report.Append(ruleChangeDisplayJson.DisplayChangeTime(ruleChange)); report.Append(ruleChangeDisplayJson.DisplayChangeAction(ruleChange)); report.Append(ruleChangeDisplayJson.DisplayName(ruleChange)); - report.Append(ruleChangeDisplayJson.DisplaySourceZone(ruleChange)); + report.Append(ruleChangeDisplayJson.DisplaySourceZones(ruleChange)); report.Append(ruleChangeDisplayJson.DisplaySourceNegated(ruleChange)); report.Append(ruleChangeDisplayJson.DisplaySource(ruleChange, ReportType)); - report.Append(ruleChangeDisplayJson.DisplayDestinationZone(ruleChange)); + report.Append(ruleChangeDisplayJson.DisplayDestinationZones(ruleChange)); report.Append(ruleChangeDisplayJson.DisplayDestinationNegated(ruleChange)); report.Append(ruleChangeDisplayJson.DisplayDestination(ruleChange, ReportType)); report.Append(ruleChangeDisplayJson.DisplayServiceNegated(ruleChange)); diff --git a/roles/lib/files/FWO.Report/ReportNatRules.cs b/roles/lib/files/FWO.Report/ReportNatRules.cs index 1d7381862..542557b34 100644 --- a/roles/lib/files/FWO.Report/ReportNatRules.cs +++ b/roles/lib/files/FWO.Report/ReportNatRules.cs @@ -1,4 +1,4 @@ -using FWO.Basics; +using FWO.Basics; using FWO.Config.Api; using FWO.Data; using FWO.Report.Filter; @@ -93,9 +93,9 @@ private void AppendNatRuleForDeviceHtml(ref StringBuilder report, int chapterNum report.AppendLine(""); report.AppendLine($"{RuleDisplayBase.DisplayNumber(rule)}"); report.AppendLine($"{RuleDisplayBase.DisplayName(rule)}"); - report.AppendLine($"{RuleDisplayBase.DisplaySourceZone(rule)}"); + report.AppendLine($"{RuleDisplayBase.DisplaySourceZones(rule)}"); report.AppendLine($"{ruleDisplay.DisplaySource(rule, OutputLocation.export, ReportType, chapterNumber)}"); - report.AppendLine($"{RuleDisplayBase.DisplayDestinationZone(rule)}"); + report.AppendLine($"{RuleDisplayBase.DisplayDestinationZones(rule)}"); report.AppendLine($"{ruleDisplay.DisplayDestination(rule, OutputLocation.export, ReportType, chapterNumber)}"); report.AppendLine($"{ruleDisplay.DisplayServices(rule, OutputLocation.export, ReportType, chapterNumber)}"); report.AppendLine($"{ruleDisplay.DisplayTranslatedSource(rule, OutputLocation.export, chapterNumber)}"); diff --git a/roles/lib/files/FWO.Report/ReportRules.cs b/roles/lib/files/FWO.Report/ReportRules.cs index 1e2121d67..4b2a15bcf 100644 --- a/roles/lib/files/FWO.Report/ReportRules.cs +++ b/roles/lib/files/FWO.Report/ReportRules.cs @@ -603,9 +603,9 @@ private void AppendRulesForRulebaseHtml(ref StringBuilder report, RulebaseLink r report.AppendLine($"{RuleDisplayHtml.DisplayLastHit(rule.Metadata)}"); } report.AppendLine($"{RuleDisplayBase.DisplayName(rule)}"); - report.AppendLine($"{RuleDisplayBase.DisplaySourceZone(rule)}"); + report.AppendLine($"{RuleDisplayBase.DisplaySourceZones(rule)}"); report.AppendLine($"{ruleDisplayHtml.DisplaySource(rule, OutputLocation.export, ReportType, chapterNumber)}"); - report.AppendLine($"{RuleDisplayBase.DisplayDestinationZone(rule)}"); + report.AppendLine($"{RuleDisplayBase.DisplayDestinationZones(rule)}"); report.AppendLine($"{ruleDisplayHtml.DisplayDestination(rule, OutputLocation.export, ReportType, chapterNumber)}"); report.AppendLine($"{ruleDisplayHtml.DisplayServices(rule, OutputLocation.export, ReportType, chapterNumber)}"); report.AppendLine($"{RuleDisplayBase.DisplayAction(rule)}"); diff --git a/roles/tests-unit/files/FWO.Test/ExportTest.cs b/roles/tests-unit/files/FWO.Test/ExportTest.cs index cbf5b9444..06ca742c1 100644 --- a/roles/tests-unit/files/FWO.Test/ExportTest.cs +++ b/roles/tests-unit/files/FWO.Test/ExportTest.cs @@ -1,4 +1,4 @@ -using NUnit.Framework; +using NUnit.Framework; using NUnit.Framework.Legacy; using FWO.Logging; using FWO.Report; @@ -170,7 +170,7 @@ public void ChangesGenerateHtml() ReportData = ConstructChangeReport(false) }; - string expectedHtmlResult = "Changes Report

Changes Report

Change Time: from: 2023-04-19T15:00:04Z, until: 2023-04-20T15:00:04Z (UTC)

Generated on: Z (UTC)

Devices: TestMgt [TestDev]

Filter: TestFilter


Table of content


TestMgt


TestDev

Change TimeChange TypeNameSource ZoneSourceDestination ZoneDestinationServicesActionTrackEnabledUidComment
05.04.2023 12:00:00Rule added

TestRule1

srczn

 TestIp1 (1.2.3.4/32)
 TestIp2 (127.0.0.1/32)

dstzn

 TestIpRange (1.2.3.4-1.2.3.5)

 TestService1 (443/TCP)

accept

none

Y

uid1

comment1

05.04.2023 12:00:00Rule modifiedTestRule1srczn

 TestIp2 (127.0.0.1/32)

deleted:

 TestIp1 (1.2.3.4/32)

added:

 TestIp1Changed (2.3.4.5)

dstzn

 TestIpRange (1.2.3.4-1.2.3.5)

added:

 TestIpNew (10.0.6.0/24)

deleted:

 TestService1 (443/TCP)

added:

not
 TestService1 (443/TCP)

acceptnoneYdeleted:

uid1

deleted:

comment1

added:

new comment

05.04.2023 12:00:00Rule modifiedTestRule2not
 TestUser1@ TestIp1 (1.2.3.4/32)
 TestUser1@ TestIp2 (127.0.0.1/32)
deleted:

not
 TestUser2@ TestIpRange (1.2.3.4-1.2.3.5)

added:

 TestUser2@ TestIpRange (1.2.3.4-1.2.3.5)

deleted:

not
 TestService2 (6666-7777/UDP)

added:

 TestService2 (6666-7777/UDP)

denynonedeleted:

Y

added:

N

uid2:123comment2
05.04.2023 12:00:00Rule deleted

TestRule2

not
 TestUser1@ TestIp1 (1.2.3.4/32)
 TestUser1@ TestIp2 (127.0.0.1/32)

not
 TestUser2@ TestIpRange (1.2.3.4-1.2.3.5)

not
 TestService2 (6666-7777/UDP)

deny

none

Y

uid2:123

comment2


"; + string expectedHtmlResult = "Changes Report

Changes Report

Change Time: from: 2023-04-19T15:00:04Z, until: 2023-04-20T15:00:04Z (UTC)

Generated on: Z (UTC)

Devices: TestMgt [TestDev]

Filter: TestFilter


Table of content


TestMgt


TestDev

Change TimeChange TypeNameSource ZoneSourceDestination ZoneDestinationServicesActionTrackEnabledUidComment
05.04.2023 12:00:00Rule added

TestRule1

srczn1
srczn2
srczn3

 TestIp1 (1.2.3.4/32)
 TestIp2 (127.0.0.1/32)

dstzn1
dstzn2
dstzn3

 TestIpRange (1.2.3.4-1.2.3.5)

 TestService1 (443/TCP)

accept

none

Y

uid1

comment1

05.04.2023 12:00:00Rule modifiedTestRule1srczn1
srczn2
srczn3

 TestIp2 (127.0.0.1/32)

deleted:

 TestIp1 (1.2.3.4/32)

added:

 TestIp1Changed (2.3.4.5)

dstzn1
dstzn2
dstzn3

 TestIpRange (1.2.3.4-1.2.3.5)

added:

 TestIpNew (10.0.6.0/24)

deleted:

 TestService1 (443/TCP)

added:

not
 TestService1 (443/TCP)

acceptnoneYdeleted:

uid1

deleted:

comment1

added:

new comment

05.04.2023 12:00:00Rule modifiedTestRule2not
 TestUser1@ TestIp1 (1.2.3.4/32)
 TestUser1@ TestIp2 (127.0.0.1/32)
deleted:

not
 TestUser2@ TestIpRange (1.2.3.4-1.2.3.5)

added:

 TestUser2@ TestIpRange (1.2.3.4-1.2.3.5)

deleted:

not
 TestService2 (6666-7777/UDP)

added:

 TestService2 (6666-7777/UDP)

denynonedeleted:

Y

added:

N

uid2:123comment2
05.04.2023 12:00:00Rule deleted

TestRule2

not
 TestUser1@ TestIp1 (1.2.3.4/32)
 TestUser1@ TestIp2 (127.0.0.1/32)

not
 TestUser2@ TestIpRange (1.2.3.4-1.2.3.5)

not
 TestService2 (6666-7777/UDP)

deny

none

Y

uid2:123

comment2


"; string reportHtml = RemoveLinebreaks(RemoveGenDate(reportChanges.ExportToHtml(), true)); @@ -189,7 +189,7 @@ public void ResolvedChangesGenerateHtml() ReportData = ConstructChangeReport(true) }; - string expectedHtmlResult = "Changes Report (resolved)

Changes Report (resolved)

Change Time: from: 2023-04-19T15:00:04Z, until: 2023-04-20T15:00:04Z (UTC)

Generated on: Z (UTC)

Devices: TestMgt [TestDev]

Filter: TestFilter


Table of content


TestMgt


TestDev

Change TimeChange TypeNameSource ZoneSourceDestination ZoneDestinationServicesActionTrackEnabledUidComment
05.04.2023 12:00:00Rule added

TestRule1

srczn

TestIp1 (1.2.3.4/32)
TestIp2 (127.0.0.1/32)

dstzn

TestIpRange (1.2.3.4-1.2.3.5)

TestService1 (443/TCP)

accept

none

Y

uid1

comment1

05.04.2023 12:00:00Rule modifiedTestRule1srczn

TestIp2 (127.0.0.1/32)

deleted:

TestIp1 (1.2.3.4/32)

added:

TestIp1Changed (2.3.4.5)

dstzn

TestIpRange (1.2.3.4-1.2.3.5)

added:

TestIpNew (10.0.6.0/24)

deleted:

TestService1 (443/TCP)

added:

not
TestService1 (443/TCP)

acceptnoneYdeleted:

uid1

deleted:

comment1

added:

new comment

05.04.2023 12:00:00Rule modifiedTestRule2not
TestUser1@TestIp1 (1.2.3.4/32)
TestUser1@TestIp2 (127.0.0.1/32)
deleted:

not
TestUser2@TestIpRange (1.2.3.4-1.2.3.5)

added:

TestUser2@TestIpRange (1.2.3.4-1.2.3.5)

deleted:

not
TestService2 (6666-7777/UDP)

added:

TestService2 (6666-7777/UDP)

denynonedeleted:

Y

added:

N

uid2:123comment2
05.04.2023 12:00:00Rule deleted

TestRule2

not
TestUser1@TestIp1 (1.2.3.4/32)
TestUser1@TestIp2 (127.0.0.1/32)

not
TestUser2@TestIpRange (1.2.3.4-1.2.3.5)

not
TestService2 (6666-7777/UDP)

deny

none

Y

uid2:123

comment2


"; + string expectedHtmlResult = "Changes Report (resolved)

Changes Report (resolved)

Change Time: from: 2023-04-19T15:00:04Z, until: 2023-04-20T15:00:04Z (UTC)

Generated on: Z (UTC)

Devices: TestMgt [TestDev]

Filter: TestFilter


Table of content


TestMgt


TestDev

Change TimeChange TypeNameSource ZoneSourceDestination ZoneDestinationServicesActionTrackEnabledUidComment
05.04.2023 12:00:00Rule added

TestRule1

srczn1
srczn2
srczn3

TestIp1 (1.2.3.4/32)
TestIp2 (127.0.0.1/32)

dstzn1
dstzn2
dstzn3

TestIpRange (1.2.3.4-1.2.3.5)

TestService1 (443/TCP)

accept

none

Y

uid1

comment1

05.04.2023 12:00:00Rule modifiedTestRule1srczn1
srczn2
srczn3

TestIp2 (127.0.0.1/32)

deleted:

TestIp1 (1.2.3.4/32)

added:

TestIp1Changed (2.3.4.5)

dstzn1
dstzn2
dstzn3

TestIpRange (1.2.3.4-1.2.3.5)

added:

TestIpNew (10.0.6.0/24)

deleted:

TestService1 (443/TCP)

added:

not
TestService1 (443/TCP)

acceptnoneYdeleted:

uid1

deleted:

comment1

added:

new comment

05.04.2023 12:00:00Rule modifiedTestRule2not
TestUser1@TestIp1 (1.2.3.4/32)
TestUser1@TestIp2 (127.0.0.1/32)
deleted:

not
TestUser2@TestIpRange (1.2.3.4-1.2.3.5)

added:

TestUser2@TestIpRange (1.2.3.4-1.2.3.5)

deleted:

not
TestService2 (6666-7777/UDP)

added:

TestService2 (6666-7777/UDP)

denynonedeleted:

Y

added:

N

uid2:123comment2
05.04.2023 12:00:00Rule deleted

TestRule2

not
TestUser1@TestIp1 (1.2.3.4/32)
TestUser1@TestIp2 (127.0.0.1/32)

not
TestUser2@TestIpRange (1.2.3.4-1.2.3.5)

not
TestService2 (6666-7777/UDP)

deny

none

Y

uid2:123

comment2


"; string reportHtml = RemoveLinebreaks(RemoveGenDate(reportChanges.ExportToHtml(), true)); @@ -208,7 +208,7 @@ public void ResolvedChangesTechGenerateHtml() ReportData = ConstructChangeReport(true) }; - string expectedHtmlResult = "Changes Report (technical)

Changes Report (technical)

Change Time: from: 2023-04-19T15:00:04Z, until: 2023-04-20T15:00:04Z (UTC)

Generated on: Z (UTC)

Devices: TestMgt [TestDev]

Filter: TestFilter


Table of content


TestMgt


TestDev

Change TimeChange TypeNameSource ZoneSourceDestination ZoneDestinationServicesActionTrackEnabledUidComment
05.04.2023 12:00:00Rule added

TestRule1

srczn

1.2.3.4/32
127.0.0.1/32

dstzn

1.2.3.4-1.2.3.5

443/TCP

accept

none

Y

uid1

comment1

05.04.2023 12:00:00Rule modifiedTestRule1srczn

127.0.0.1/32

deleted:

1.2.3.4/32

added:

2.3.4.5

dstzn

1.2.3.4-1.2.3.5

added:

10.0.6.0/24

deleted:

443/TCP

added:

not
443/TCP

acceptnoneYdeleted:

uid1

deleted:

comment1

added:

new comment

05.04.2023 12:00:00Rule modifiedTestRule2not
TestUser1@1.2.3.4/32
TestUser1@127.0.0.1/32
deleted:

not
TestUser2@1.2.3.4-1.2.3.5

added:

TestUser2@1.2.3.4-1.2.3.5

deleted:

not
6666-7777/UDP

added:

6666-7777/UDP

denynonedeleted:

Y

added:

N

uid2:123comment2
05.04.2023 12:00:00Rule deleted

TestRule2

not
TestUser1@1.2.3.4/32
TestUser1@127.0.0.1/32

not
TestUser2@1.2.3.4-1.2.3.5

not
6666-7777/UDP

deny

none

Y

uid2:123

comment2


"; + string expectedHtmlResult = "Changes Report (technical)

Changes Report (technical)

Change Time: from: 2023-04-19T15:00:04Z, until: 2023-04-20T15:00:04Z (UTC)

Generated on: Z (UTC)

Devices: TestMgt [TestDev]

Filter: TestFilter


Table of content


TestMgt


TestDev

Change TimeChange TypeNameSource ZoneSourceDestination ZoneDestinationServicesActionTrackEnabledUidComment
05.04.2023 12:00:00Rule added

TestRule1

srczn1
srczn2
srczn3

1.2.3.4/32
127.0.0.1/32

dstzn1
dstzn2
dstzn3

1.2.3.4-1.2.3.5

443/TCP

accept

none

Y

uid1

comment1

05.04.2023 12:00:00Rule modifiedTestRule1srczn1
srczn2
srczn3

127.0.0.1/32

deleted:

1.2.3.4/32

added:

2.3.4.5

dstzn1
dstzn2
dstzn3

1.2.3.4-1.2.3.5

added:

10.0.6.0/24

deleted:

443/TCP

added:

not
443/TCP

acceptnoneYdeleted:

uid1

deleted:

comment1

added:

new comment

05.04.2023 12:00:00Rule modifiedTestRule2not
TestUser1@1.2.3.4/32
TestUser1@127.0.0.1/32
deleted:

not
TestUser2@1.2.3.4-1.2.3.5

added:

TestUser2@1.2.3.4-1.2.3.5

deleted:

not
6666-7777/UDP

added:

6666-7777/UDP

denynonedeleted:

Y

added:

N

uid2:123comment2
05.04.2023 12:00:00Rule deleted

TestRule2

not
TestUser1@1.2.3.4/32
TestUser1@127.0.0.1/32

not
TestUser2@1.2.3.4-1.2.3.5

not
6666-7777/UDP

deny

none

Y

uid2:123

comment2


"; string reportHtml = RemoveLinebreaks(RemoveGenDate(reportChanges.ExportToHtml(), true)); @@ -734,6 +734,10 @@ private static ServiceWrapper[] InitServices(NetworkService service, bool resolv private static Rule InitRule1(bool resolved) { + var srcZoneNames = new[] { "srczn1", "srczn2", "srczn3" }; + var dstZoneNames = new[] { "dstzn1", "dstzn2", "dstzn3" }; + + return new Rule() { Name = "TestRule1", @@ -743,10 +747,10 @@ private static Rule InitRule1(bool resolved) DisplayOrderNumber = 1, Track = "none", Uid = "uid1", - SourceZone = new NetworkZone() { Name = "srczn" }, + RuleFromZones = srcZoneNames.Select(name => new ZoneWrapper { Content = new NetworkZone { Name = name } }).ToArray(), SourceNegated = false, Froms = InitFroms(resolved), - DestinationZone = new NetworkZone() { Name = "dstzn" }, + RuleToZones = dstZoneNames.Select(name => new ZoneWrapper { Content = new NetworkZone { Name = name } }).ToArray(), DestinationNegated = false, Tos = InitTos(resolved), ServiceNegated = false, diff --git a/roles/ui/files/FWO.UI/Pages/Reporting/Report.razor b/roles/ui/files/FWO.UI/Pages/Reporting/Report.razor index d4f1347a3..cf2588cb1 100644 --- a/roles/ui/files/FWO.UI/Pages/Reporting/Report.razor +++ b/roles/ui/files/FWO.UI/Pages/Reporting/Report.razor @@ -250,9 +250,9 @@ private ReportBase? currentReport; - private FWO.Ui.Shared.TabSet rsbTabset; + private FWO.Ui.Shared.TabSet? rsbTabset; private Sidebar? deviceSelectionSidebar; - private FWO.Ui.Shared.AnchorNavToRSB anchorNavToRSB; + private FWO.Ui.Shared.AnchorNavToRSB? anchorNavToRSB; private string filterFeedbackStart = ""; private string filterFeedbackError = ""; diff --git a/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRules.razor b/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRules.razor index e055df97f..6e29bfbd2 100644 --- a/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRules.razor +++ b/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRules.razor @@ -97,9 +97,9 @@ @if (SelectedReportType != ReportType.VarianceAnalysis && !HandleAsVariance) { - + } @@ -110,9 +110,9 @@ @if (SelectedReportType != ReportType.VarianceAnalysis && !HandleAsVariance) { - + } diff --git a/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRulesForDiff.razor b/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRulesForDiff.razor index a013334ca..df7f22a5d 100644 --- a/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRulesForDiff.razor +++ b/roles/ui/files/FWO.UI/Pages/Reporting/ReportedRulesForDiff.razor @@ -12,6 +12,11 @@ + + + + + +