python-SNS-API

A Python client for the Stormshield Network Security appliance SSL API.

Note: this module requires python3.7 or later.

API usage

fromstormshield.sns.sslclientimportSSLClientclient=SSLClient(
host="10.0.0.254", port=443,
user='admin', password='password',
sslverifyhost=False)
response=client.send_command("SYSTEM PROPERTY")
ifresponse:
model=response.data['Result']['Model']
version=response.data['Result']['Version']
print("Model: {}".format(model))
print("Firmware version: {}".format(version))
else:
print("Command failed: {}".format(response.output))
client.disconnect()

• Note: Starting from the 5.0 firmware, a custom CA is used by default by the SSL API. To continue to connect checking the certificate authority of the appliance, the "SNS-WebServer-default-authority" CA must be retrieved from each appliance, then added to a cabundle.pem file. Alternatively, CA verification can be bypassed using sslverifypeer=False argument to SSLClient().

Command results

Command results are available in text, xml or python structure formats:

>>>response=client.send_command("CONFIG NTP SERVER LIST")
>>>print(response.output)
101code=00a01000msg="Begin"format="section_line"
[Result]
name=ntp1.stormshieldcs.eukeynum=nonetype=hostname=ntp2.stormshieldcs.eukeynum=nonetype=host100code=00a00100msg="Ok">>>print(response.xml)
<?xmlversion="1.0"?><nwscode="100"msg="OK"><serverdret="101"code="00a01000"msg="Begin"><dataformat="section_line"><sectiontitle="Result"><line><keyname="name"value="ntp1.stormshieldcs.eu"/><keyname="keynum"value="none"/><keyname="type"value="host"/></line><line><keyname="name"value="ntp2.stormshieldcs.eu"/><keyname="keynum"value="none"/><keyname="type"value="host"/></line></section></data></serverd><serverdret="100"code="00a00100"msg="Ok"></serverd></nws>>>>print(response.data)
{'Result': [{'name': 'ntp1.stormshieldcs.eu', 'keynum': 'none', 'type': 'host'}, {'name': 'ntp2.stormshieldcs.eu', 'keynum': 'none', 'type': 'host'}]}

The keys of the data property are case insensitive, response.data['Result'][0]['name'] and response.data['ReSuLt'][0]['NaMe'] will return the same value.

Results token are also available via response.parser.get() method which accepts a default parameter to return if the token is not present.

>>>print(response.output)
101code=00a01000msg="Begin"format="section"
[Server]
1=dns1.google.com2=dns2.google.com100code=00a00100msg="Ok">>>print(response.data['Server']['3'])
Traceback (mostrecentcalllast):
File"<stdin>", line1, in<module>File"/usr/local/lib/python3.7/site-packages/requests/structures.py", line52, in__getitem__returnself._store[key.lower()][1]
KeyError: '3'>>>print(response.parser.get(section='Server', token='3', default=None))
None

File upload/download

Files can be downloaded to or uploaded from the client host by adding a redirection to a file with '>' or '<' at the end of the configuration command.

>>>client.send_command("CONFIG BACKUP list=all > /tmp/mybackup.na")
100code=00a00100msg="Ok"

snscli

snscli is a python cli for executing configuration commands and scripts on Stormshield Network Security appliances.

• Output format can be chosen between section/ini or xml
• File upload and download available with adding < upload or > download at the end of the command
• Client can execute script files using --script option.
• Comments are allowed with #

$ snscli --host <utm>

$ snscli --host <utm> --user admin --password admin --script config.script

Concerning the SSL validation:

• For the first connection to a new appliance, ssl host name verification can be bypassed with --no-sslverifyhost option.

• To connect to a known appliance with the default certificate use --host <serial> --ip <ip address> to validate the peer certificate.

• If a custom CA and certificate is installed, use --host myfirewall.tld --cabundle <ca.pem>. CA bundle should contain at least the root CA.

• For client certificate authentication, the expected format is a PEM file with the certificate and the unencrypted key concatenated.

• Note: Starting from the 5.0 firmware, a custom CA is used by default by the SSL API. To continue to connect checking the certificate authority of the appliance, the "SNS-WebServer-default-authority" CA must be retrieved from each appliance, then added to a cabundle.pem file. Alternatively, CA verification can be bypassed using --no-sslverifypeer option.

Proxy

The library and snscli tool support HTTP and SOCKS proxies, use --proxy scheme://user:password@host:port option.

Build

$ python3 setup.py sdist bdist_wheel

Install

From PyPI:

$ pip3 install stormshield.sns.sslclient

From source:

$ python3 setup.py install

Tests

Warning: some tests require a remote SNS appliance.

$ PASSWORD=password APPLIANCE=10.0.0.254 tox

To run one test:

tox -- tests/test_format_ini

To run snscli from the source folder without install:

$ PYTHONPATH=. python3 stormshield/sns/cli.py --help

Links

• Stormshield corporate website
• CLI commands reference guide
• Python SNS API example scripts