Web server is listening for connections on port 8080. When someone connects if will fetch ACL attached to interface lxc-sshd-5 and display all objects permitted as source on this interface both on console and web page.
To run this we will need node.js installed which is not hard thing to do. All instructions and latest packages for multiple platforms are available on Node.js website. You will wide documentation there as well.
To open connection function https.request() is executed. Response header is displayed on console – no error handling is deployed in this script.
HTTPS client operates on callback function that is fed by variable containing everything that HTTPS server, in our case it’s ASA, sends back to client. This variable is named res in this example. HTTPS server can also result several events (it’s displayed in Node.js documentation). We will focus on two of those named 'data' and 'end'.
But what we really want to get in response is called ExtendedACE. This object can be nested so in response one ExtendedACE can contain other items of that type. Full description is available in REST API documentation on any firewall running REST API (check Cisco ASA REST API – Part I: Getting started post). Mandatory ones are marked.
By using function JSON.parse() we can convert an array to JSON structure. When we do that we can easily refer to objects by names. It’s making code easier to read in my opinion and it’s easy to refer to particular value if we know JSON structure we are using.
Code below is valuable in one more way – not may examples on Internet cover multi layer JSON structures. In our example the we have array of 'item' JSON objects which will differ in types. So first we execute ForEach() method on ‘items’ then by ‘if’ we are determining which value of nested JSON object we display. ForEach() can be replaced by /code>’for’ or 'while' loops but this approach is much more efficient and cleraner for the code.
To refer to particular value we just refer it by using it’s name, of course remembering about structure of JSON variable.
Last part is our own HTTP server used for handling incoming requests. Many developers says that using 'express' HTTP server available as external library is much easier but for this example built-in one is sufficient.
Yes, that’s all. Inside we put all the code for REST API, at the end we define listening port.
Of you remember description of initial configuration of my lab (check Cisco ASA REST API – Lab topology and programming language) no ACLs are defined by default. For purpose of this test access-list lxc-sshd-5_access_in is added to interface lxc-sshd-5. Access list contain three types of objects defined as Source IP Address – object, object-group and IP Address.
If no error or command prompt is displayed our servers is running. Now we can connect via web broser to http://127.0.0.1:8080.
Let’s first look at terminal. We can see information about execution statusCode and headers that has been passed to firewall. We left this output in our script. Below the line we see six entries representing objects configured as source of traffic.
If we look at web browser same list is available and displayed as static web page.
Code of the script is available on GitHub.