services/firewall
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add prefix to rules for easy identification
Build and Push Container / build-and-push (push) Successful in 18s
Details

Browse Source
This commit is contained in:
ducoterra
2026-08-02 11:09:54 -04:00
parent 11389edf72
commit 870c5cc363
4 changed files with 38 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.py
+30 -18
View File
@@ -28,6 +28,7 @@ import requests
import yaml
from dotenv import load_dotenv
from config import RULE_NAME_PREFIX
from ip_lookup import get_ipv4, get_ipv6
from unifi_firewall import (
FirewallPolicy,
@@ -260,11 +261,12 @@ def process_rule(
) -> RuleChange:
"""Process a single firewall rule: create, update, or skip."""
rule_name = rule.get("name", "unnamed")
prefixed_name = f"{RULE_NAME_PREFIX}{rule_name}"
ip_version = rule.get("ip_version", "IPV4")
source_zone = rule.get("source_zone", "WAN")
dest_zone = rule.get("dest_zone", "LAN")
logger.info("=== Processing rule: %s ===", rule_name)
logger.info("=== Processing rule: %s ===", prefixed_name)
# Get zone IDs
src_zone_id = zone_map.get(source_zone)
@@ -273,36 +275,46 @@ def process_rule(
if not src_zone_id:
error_msg = f"Source zone '{source_zone}' not found"
logger.error(error_msg)
return {"rule_name": rule_name, "action": "failed", "ip": public_ip, "error": error_msg}
return {"rule_name": prefixed_name, "action": "failed", "ip": public_ip, "error": error_msg}
if not dst_zone_id:
error_msg = f"Destination zone '{dest_zone}' not found"
logger.error(error_msg)
return {"rule_name": rule_name, "action": "failed", "ip": public_ip, "error": error_msg}
return {"rule_name": prefixed_name, "action": "failed", "ip": public_ip, "error": error_msg}
# Find existing policy by name
# Find existing policy by prefixed name
try:
existing_policies = list_policies(session, host, site_id, name_filter=rule_name)
existing_policies = list_policies(session, host, site_id, name_filter=prefixed_name)
except Exception as e: # noqa: BLE001
error_msg = f"Failed to list policies: {e}"
logger.error(error_msg)
return {"rule_name": rule_name, "action": "failed", "ip": public_ip, "error": error_msg}
return {"rule_name": prefixed_name, "action": "failed", "ip": public_ip, "error": error_msg}
existing_policy = existing_policies[0] if existing_policies else None
# Migration: if not found by prefixed name, search for unprefixed name
if not existing_policy:
try:
existing_policies = list_policies(session, host, site_id, name_filter=rule_name)
existing_policy = existing_policies[0] if existing_policies else None
except Exception as e: # noqa: BLE001
error_msg = f"Failed to list policies: {e}"
logger.error(error_msg)
return {"rule_name": prefixed_name, "action": "failed", "ip": public_ip, "error": error_msg}
# Check if policy exists and matches config
if existing_policy:
if policy_matches_config(existing_policy, rule, zone_map, public_ip):
logger.info("Rule '%s' already matches config, skipping", rule_name)
return {"rule_name": rule_name, "action": "skipped", "ip": public_ip, "error": None}
logger.info("Rule '%s' already matches config, skipping", prefixed_name)
return {"rule_name": prefixed_name, "action": "skipped", "ip": public_ip, "error": None}
# Update existing policy (IP or other attributes changed)
existing_ip = get_source_ip_from_policy(existing_policy)
logger.info("Rule '%s' exists but config changed (current IP: %s, desired IP: %s), updating",
rule_name, existing_ip, public_ip)
prefixed_name, existing_ip, public_ip)
try:
payload = build_policy_payload(
name=rule_name,
name=prefixed_name,
source_ip=public_ip,
ip_version=ip_version, # type: ignore[arg-type]
src_zone_id=src_zone_id,
@@ -316,18 +328,18 @@ def process_rule(
enabled=rule.get("enabled", True),
)
update_policy(session, host, site_id, existing_policy["id"], payload)
logger.info("Rule '%s' updated successfully", rule_name)
return {"rule_name": rule_name, "action": "updated", "ip": public_ip, "error": None}
logger.info("Rule '%s' updated successfully", prefixed_name)
return {"rule_name": prefixed_name, "action": "updated", "ip": public_ip, "error": None}
except Exception as e: # noqa: BLE001
error_msg = f"Failed to update rule: {e}"
logger.error(error_msg)
return {"rule_name": rule_name, "action": "failed", "ip": public_ip, "error": error_msg}
return {"rule_name": prefixed_name, "action": "failed", "ip": public_ip, "error": error_msg}
# Create new policy
logger.info("Rule '%s' does not exist, creating with IP %s", rule_name, public_ip)
logger.info("Rule '%s' does not exist, creating with IP %s", prefixed_name, public_ip)
try:
payload = build_policy_payload(
name=rule_name,
name=prefixed_name,
source_ip=public_ip,
ip_version=ip_version, # type: ignore[arg-type]
src_zone_id=src_zone_id,
@@ -341,12 +353,12 @@ def process_rule(
enabled=rule.get("enabled", True),
)
create_policy(session, host, site_id, payload)
logger.info("Rule '%s' created successfully", rule_name)
return {"rule_name": rule_name, "action": "created", "ip": public_ip, "error": None}
logger.info("Rule '%s' created successfully", prefixed_name)
return {"rule_name": prefixed_name, "action": "created", "ip": public_ip, "error": None}
except Exception as e: # noqa: BLE001
error_msg = f"Failed to create rule: {e}"
logger.error(error_msg)
return {"rule_name": rule_name, "action": "failed", "ip": public_ip, "error": error_msg}
return {"rule_name": prefixed_name, "action": "failed", "ip": public_ip, "error": error_msg}
def main() -> None: