Skip to content

Commit c1879d0

Browse files
jdrew82jdrew82
authored
Citrix NetScaler Parser (#153)
* feat: Add parser for Citrix NetScaler * test: ✅ Add compliance tests for NetScaler * docs: 📝 Update docs to add NetScaler parser to list * test: ✅ Add tests for cmdPolicy and ssl features * docs: 📝 Add documentation around parent/child missing in NS parser * docs: 📝 Fix indentation in documentation * revert: Revert indentation * revert: Revert deleted empty line Co-authored-by: Justin Drew <jdrew82@users.noreply.github.com>
1 parent 0ef3d37 commit c1879d0

10 files changed

Lines changed: 462 additions & 1 deletion

File tree

‎docs/dev/dev_config.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ The "ltm rule" configuration sections are not uniform nor standardized; therefor
2222

2323
The section banners have been simplified to extract the section header itself. This means that `echo "System Configuration"` will be converted to just "System Configuration".
2424

25+
### Citrix NetScaler Parser
26+
27+
As the NetScaler configuration uses each line to make a specific configuration change there is no support for parent/child relationships in the parser.
28+
2529
### Duplicate Line Detection
2630

2731
In some circumstances replacing lines, such as secrets without uniqueness in the replacement, will result in duplicated lines that are invalid configuration, such as::
@@ -68,4 +72,4 @@ There are a series of considerations documented below, when developing a new par
6872
- Generally a class method should provide a `comment_chars` and `banner_start` as well as sometimes `banner_end`.
6973
- Generally on the `__init__` should call the `build_config_relationship` method.
7074
- Often can inherit directly from `CiscoConfigParser`.
71-
- Observe the existing patterns, make use of `super`, and inheritance to reuse existing code.
75+
- Observe the existing patterns, make use of `super`, and inheritance to reuse existing code.

‎docs/dev/include_parser_list.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
| cisco_asa | netutils.config.parser.ASAConfigParser |
77
| cisco_ios | netutils.config.parser.IOSConfigParser |
88
| cisco_nxos | netutils.config.parser.NXOSConfigParser |
9+
| citrix_netscaler | netutils.config.parser.NetscalerConfigParser |
910
| fortinet_fortios | netutils.config.parser.FortinetConfigParser |
1011
| juniper_junos | netutils.config.parser.JunosConfigParser |
1112
| linux | netutils.config.parser.LINUXConfigParser |

‎netutils/config/compliance.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
"cisco_asa": parser.ASAConfigParser,
1616
"fortinet_fortios": parser.FortinetConfigParser,
1717
"nokia_sros": parser.NokiaConfigParser,
18+
"citrix_netscaler": parser.NetscalerConfigParser,
1819
}
1920

2021
# TODO: Once support for 3.7 is dropped, there should be a typing.TypedDict for this which should then also be used

‎netutils/config/parser.py‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1172,3 +1172,15 @@ def config_lines_only(self) -> str:
11721172
config_lines.append(line.rstrip())
11731173
self._config = "\n".join(config_lines)
11741174
return self._config
1175+
1176+
1177+
class NetscalerConfigParser(BaseSpaceConfigParser):
1178+
"""Netscaler config parser."""
1179+
1180+
comment_chars: t.List[str] = []
1181+
banner_start: t.List[str] = []
1182+
1183+
@property
1184+
def banner_end(self) -> str:
1185+
"""Demarcate End of Banner char(s)."""
1186+
raise NotImplementedError("Netscaler platform doesn't have a banner.")

‎tests/unit/mock/config/compliance/compliance/citrix_netscaler/netscaler_basic_backup.txt‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#NS13.0 Build 84.11
2+
# Last modified Fri Dec 31 12:00:01 2021
3+
set system parameter -promptString "%u@%h-%T" -maxClient 40 -doppler DISABLED
4+
set ns httpProfile nshttp_default_profile -dropInvalReqs ENABLED
5+
set ns param -timezone "GMT+00:00-UTC"
6+
set ssl service nshttps-::1l-443 -ssl3 disabled -tls1 disabled
7+
set ssl service nshttps-127.0.0.1-443 -ssl3 disabled -tls1 disabled
8+
set ssl parameter -defaultProfile ENABLED
9+
enable ns feature WL SP LB CS SSL CF REWRITE RESPONDER
10+
add route 192.168.0.0 255.255.0.0
11+
set ns encryptionParams -method AES256 -keyValue abcdef1234 -encrypted -encryptmethod ENCMTHD_3 -kek -suffix some_string
12+
set system user nsroot abcdef1234 -encrypted -hashmethod SHA512 -externalAuth DISABLED -timeout 900
13+
set HA node -failSafe ON
14+
set ns rpcNode 203.0.113.1 -password abcdef1234 -encrypted -encryptmethod ENCMTHD_3 -kek -suffix some_string -srcIP 203.0.113.1
15+
set ns rpcNode 203.0.113.1 -password abcdef1234 -encrypted -encryptmethod ENCMTHD_3 -kek -suffix some_string -srcIP 203.0.113.1
16+
add authentication tacacsAction AAA_ACT_TACACS_01 -serverIP 203.0.113.1 -authTimeout 10 -tacacsSecret abcdef1234 -authorization OFF -accounting ON -groupAttrName memberof
17+
add authentication tacacsAction AAA_ACT_TACACS_02 -serverIP 203.0.113.1 -authTimeout 10 -tacacsSecret abcdef1234 -authorization OFF -accounting ON -groupAttrName memberof
18+
add authentication Policy AAA_POL_TACACS_01 -rule true -action AAA_ACT_TACACS_01
19+
add authentication Policy AAA_POL_TACACS_02 -rule true -action AAA_ACT_TACACS_02
20+
bind system global AAA_POL_TACACS_01 -priority 10 -gotoPriorityExpression NEXT
21+
bind system global AAA_POL_TACACS_02 -priority 20 -gotoPriorityExpression NEXT
22+
add system group Admin -timeout 900
23+
bind system group Admin -policyName superuser 100
24+
add system group Support -timeout 900
25+
bind system group Support -policyName XX-CMD-read-only 100
26+
bind system group Support -policyName XX-CMD-partition-read-only 110
27+
add system group Networking -timeout 900
28+
bind system group Networking -policyName XX-CMD-operator 100
29+
bind system group Networking -policyName XX-CMD-partition-operator 110
30+
add system cmdPolicy XX-CMD-read-only ALLOW (^man.*)|(^show\s+(\?!system)(\?!configstatus)(\?!audit messages)(\?!techsupport).*)|(^stat.*)
31+
add system cmdPolicy XX-CMD-operator ALLOW (^show.*)|(^stat.*)|(^(enable|disable) (server|service).*)
32+
add system cmdPolicy XX-CMD-partition-read-only ALLOW (^man.*)|(^switch)|(^show\s+(\?!system)(\?!configstatus)(\?!audit messages)(\?!techsupport).*)|(^stat.*)
33+
add system cmdPolicy XX-CMD-partition-operator ALLOW (^man.*)|(^switch)|(^show\s+(\?!system)(\?!configstatus)(\?!audit messages)(\?!techsupport).*)|(^stat.*)|(^(enable|disable) (server|service).*)
34+
set audit syslogParams -userDefinedAuditlog YES
35+
set audit nslogParams -userDefinedAuditlog YES
36+
add audit syslogAction sys_act_fdi_rsyslog 203.0.113.1 -logLevel EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFORMATIONAL -timeZone LOCAL_TIME -userDefinedAuditlog YES -transport UDP
37+
add audit syslogPolicy sys_pol_fdi true sys_act_fdi_rsyslog
38+
bind audit syslogGlobal -policyName sys_pol_fdi -priority 2000000010
39+
set snmp alarm CPU-USAGE -thresholdValue 95 -normalValue 35 -severity Informational
40+
set snmp alarm HA-STATE-CHANGE -severity Informational
41+
set snmp alarm IP-CONFLICT -severity Warning
42+
set snmp alarm MEMORY -thresholdValue 95 -normalValue 35 -severity Critical
43+
set snmp alarm POWER-SUPPLY-FAILURE -severity Minor
44+
set snmp alarm SSL-CARD-FAILED -severity Minor
45+
set snmp alarm SSL-CERT-EXPIRY -severity Warning
46+
add snmp view READ 1 -type included
47+
add snmp group NETMON-GROUP authpriv -readViewName READ
48+
add snmp user monitoring -group NETMON-GROUP -authType SHA -authpasswd abcdef1234 -privType AES -privpasswd abcdef1234
49+
add ssl cipher XX-CIPHER-GROUP_1.0_v01
50+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
51+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
52+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384
53+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
54+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-ECDHE-RSA-AES256-SHA
55+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-ECDHE-RSA-AES128-SHA
56+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-DHE-RSA-AES256-GCM-SHA384
57+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-DHE-RSA-AES128-GCM-SHA256
58+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA
59+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA
60+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-AES-256-CBC-SHA
61+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-AES-128-CBC-SHA
62+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName SSL3-DES-CBC3-SHA
63+
add ssl cipher XX-CIPHER-GROUP_1.2_v01
64+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
65+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
66+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384
67+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
68+
add ssl cipher XX-CIPHER-GROUP_1.2_v02
69+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-CHACHA20-POLY1305
70+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
71+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
72+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384
73+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
74+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1-ECDHE-RSA-AES256-SHA
75+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1-ECDHE-RSA-AES128-SHA
76+
add ssl cipher XX-CIPHER-LIST_256
77+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 -cipherPriority 1
78+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384 -cipherPriority 2
79+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1-ECDHE-RSA-AES256-SHA -cipherPriority 3
80+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-AES256-GCM-SHA384 -cipherPriority 4
81+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-AES-256-SHA256 -cipherPriority 5
82+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1-AES-256-CBC-SHA -cipherPriority 6
83+
add ssl profile XX-SSL-Profile_1.0_v01 -eRSA ENABLED -eRSACount 1800 -sessReuse ENABLED -sessTimeout 1800 -ssl3 DISABLED -denySSLReneg ALL
84+
add ssl profile XX-SSL-Profile_1.2_v01 -eRSA ENABLED -eRSACount 1800 -sessReuse ENABLED -sessTimeout 1800 -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -denySSLReneg ALL
85+
add ssl profile XX-SSL-Profile_1.2_v02 -eRSA ENABLED -eRSACount 1800 -sessReuse ENABLED -sessTimeout 1800 -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -denySSLReneg NONSECURE

‎tests/unit/mock/config/compliance/compliance/citrix_netscaler/netscaler_basic_feature.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
features = [
2+
{"name": "user", "ordered": False, "section": ["set system user "]},
3+
{"name": "cmdPolicy", "ordered": False, "section": ["add system cmdPolicy "]},
4+
{"name": "ssl", "ordered": False, "section": ["add ssl ", "bind ssl "]},
5+
]

‎tests/unit/mock/config/compliance/compliance/citrix_netscaler/netscaler_basic_intended.txt‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
set system user nsroot abcdef1234 -encrypted -hashmethod SHA512 -externalAuth DISABLED -timeout 900
2+
add system cmdPolicy XX-CMD-read-only ALLOW (^man.*)|(^show\s+(\?!system)(\?!configstatus)(\?!audit messages)(\?!techsupport).*)|(^stat.*)
3+
add system cmdPolicy XX-CMD-operator ALLOW (^show.*)|(^stat.*)|(^(enable|disable) (server|service).*)
4+
add system cmdPolicy XX-CMD-partition-read-only ALLOW (^man.*)|(^switch)|(^show\s+(\?!system)(\?!configstatus)(\?!audit messages)(\?!techsupport).*)|(^stat.*)
5+
add system cmdPolicy XX-CMD-partition-operator ALLOW (^man.*)|(^switch)|(^show\s+(\?!system)(\?!configstatus)(\?!audit messages)(\?!techsupport).*)|(^stat.*)|(^(enable|disable) (server|service).*)
6+
add ssl cipher XX-CIPHER-GROUP_1.0_v01
7+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
8+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
9+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384
10+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
11+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-ECDHE-RSA-AES256-SHA
12+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-ECDHE-RSA-AES128-SHA
13+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-DHE-RSA-AES256-GCM-SHA384
14+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1.2-DHE-RSA-AES128-GCM-SHA256
15+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA
16+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA
17+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-AES-256-CBC-SHA
18+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName TLS1-AES-128-CBC-SHA
19+
bind ssl cipher XX-CIPHER-GROUP_1.0_v01 -cipherName SSL3-DES-CBC3-SHA
20+
add ssl cipher XX-CIPHER-GROUP_1.2_v01
21+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
22+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
23+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384
24+
bind ssl cipher XX-CIPHER-GROUP_1.2_v01 -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
25+
add ssl cipher XX-CIPHER-GROUP_1.2_v02
26+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-CHACHA20-POLY1305
27+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384
28+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
29+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384
30+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
31+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1-ECDHE-RSA-AES256-SHA
32+
bind ssl cipher XX-CIPHER-GROUP_1.0_v03 -cipherName TLS1-ECDHE-RSA-AES128-SHA
33+
add ssl cipher XX-CIPHER-LIST_256
34+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 -cipherPriority 1
35+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-ECDHE-RSA-AES-256-SHA384 -cipherPriority 2
36+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1-ECDHE-RSA-AES256-SHA -cipherPriority 3
37+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-AES256-GCM-SHA384 -cipherPriority 4
38+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1.2-AES-256-SHA256 -cipherPriority 5
39+
bind ssl cipher XX-CIPHER-LIST_256 -cipherName TLS1-AES-256-CBC-SHA -cipherPriority 6
40+
add ssl profile XX-SSL-Profile_1.0_v01 -eRSA ENABLED -eRSACount 1800 -sessReuse ENABLED -sessTimeout 1800 -ssl3 DISABLED -denySSLReneg ALL
41+
add ssl profile XX-SSL-Profile_1.2_v01 -eRSA ENABLED -eRSACount 1800 -sessReuse ENABLED -sessTimeout 1800 -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -denySSLReneg ALL
42+
add ssl profile XX-SSL-Profile_1.2_v02 -eRSA ENABLED -eRSACount 1800 -sessReuse ENABLED -sessTimeout 1800 -ssl3 DISABLED -tls1 DISABLED -tls11 DISABLED -denySSLReneg NONSECURE

0 commit comments

Comments
 (0)