golden hour

/opt/saltstack/salt/lib/python3.10/site-packages/salt/states

File/Folder	Size	Actions
__init__.py	25 B
__pycache__	-
acme.py	5.08 KB
alias.py	2.49 KB
alternatives.py	6.75 KB
ansiblegate.py	7.93 KB
apache.py	3.95 KB
apache_conf.py	2.72 KB
apache_module.py	2.73 KB
apache_site.py	2.66 KB
aptpkg.py	1.42 KB
archive.py	68.24 KB
artifactory.py	6.84 KB
at.py	7.48 KB
augeas.py	10.57 KB
aws_sqs.py	2.59 KB
azurearm_compute.py	11.78 KB
azurearm_dns.py	26.05 KB
azurearm_network.py	89.12 KB
azurearm_resource.py	28.23 KB
beacon.py	7.58 KB
bigip.py	96.63 KB
blockdev.py	5.13 KB
boto3_elasticache.py	48.01 KB
boto3_elasticsearch.py	32.58 KB
boto3_route53.py	37.54 KB
boto3_sns.py	12.69 KB
boto_apigateway.py	82.83 KB
boto_asg.py	31.93 KB
boto_cfn.py	11.53 KB
boto_cloudfront.py	6.01 KB
boto_cloudtrail.py	13.18 KB
boto_cloudwatch_alarm.py	6.4 KB
boto_cloudwatch_event.py	12.33 KB
boto_cognitoidentity.py	13.69 KB
boto_datapipeline.py	18.5 KB
boto_dynamodb.py	29.32 KB
boto_ec2.py	71.98 KB
boto_elasticache.py	16.75 KB
boto_elasticsearch_domain.py	12.27 KB
boto_elb.py	55.1 KB
boto_elbv2.py	12.19 KB
boto_iam.py	69.16 KB
boto_iam_role.py	27.12 KB
boto_iot.py	25.33 KB
boto_kinesis.py	16.69 KB
boto_kms.py	12.11 KB
boto_lambda.py	35.52 KB
boto_lc.py	11.04 KB
boto_rds.py	26 KB
boto_route53.py	19.49 KB
boto_s3.py	9.32 KB
boto_s3_bucket.py	24.67 KB
boto_secgroup.py	32.62 KB
boto_sns.py	8.92 KB
boto_sqs.py	7.97 KB
boto_vpc.py	62.23 KB
bower.py	8.26 KB
btrfs.py	10.34 KB
cabal.py	5.73 KB
ceph.py	1.9 KB
chef.py	3.76 KB
chocolatey.py	16.15 KB
chronos_job.py	4.6 KB
cimc.py	14.32 KB
cisconso.py	3.14 KB
cloud.py	14.4 KB
cmd.py	40.92 KB
composer.py	8.38 KB
consul.py	5.4 KB
cron.py	23.39 KB
cryptdev.py	6.17 KB
csf.py	9.98 KB
cyg.py	7.05 KB
ddns.py	4.2 KB
debconfmod.py	6.33 KB
dellchassis.py	24.49 KB
disk.py	6.49 KB
docker_container.py	85.27 KB
docker_image.py	16.7 KB
docker_network.py	36.78 KB
docker_volume.py	6.72 KB
drac.py	4.17 KB
dvs.py	26.29 KB
elasticsearch.py	20.38 KB
elasticsearch_index.py	3.25 KB
elasticsearch_index_template.py	3.67 KB
environ.py	5.81 KB
eselect.py	2.27 KB
esxcluster.py	22.4 KB
esxdatacenter.py	4.44 KB
esxi.py	63.07 KB
esxvm.py	20.11 KB
etcd_mod.py	11 KB
ethtool.py	9.88 KB
event.py	2.48 KB
file.py	316.7 KB
firewall.py	1.33 KB
firewalld.py	26.08 KB
gem.py	7.13 KB
git.py	123.85 KB
github.py	27.25 KB
glance_image.py	2.26 KB
glassfish.py	21.47 KB
glusterfs.py	12.21 KB
gnomedesktop.py	7.47 KB
gpg.py	5.28 KB
grafana.py	12.11 KB
grafana4_dashboard.py	17.31 KB
grafana4_datasource.py	6.15 KB
grafana4_org.py	7.73 KB
grafana4_user.py	5.52 KB
grafana_dashboard.py	17.74 KB
grafana_datasource.py	5.31 KB
grains.py	15.57 KB
group.py	9.84 KB
heat.py	9.69 KB
helm.py	10.39 KB
hg.py	6.33 KB
highstate_doc.py	1.41 KB
host.py	8.64 KB
http.py	7.46 KB
icinga2.py	9.07 KB
idem.py	3.91 KB
ifttt.py	2.12 KB
incron.py	5.71 KB
influxdb08_database.py	2.85 KB
influxdb08_user.py	3.39 KB
influxdb_continuous_query.py	2.83 KB
influxdb_database.py	2.11 KB
influxdb_retention_policy.py	4.82 KB
influxdb_user.py	4.84 KB
infoblox_a.py	4.24 KB
infoblox_cname.py	4.19 KB
infoblox_host_record.py	6.59 KB
infoblox_range.py	6.85 KB
ini_manage.py	12.67 KB
ipmi.py	8.42 KB
ipset.py	9.66 KB
iptables.py	27.65 KB
jboss7.py	23.95 KB
jenkins.py	3.36 KB
junos.py	17.78 KB
kapacitor.py	6.46 KB
kernelpkg.py	6.42 KB
keyboard.py	2.01 KB
keystone.py	27.12 KB
keystone_domain.py	2.81 KB
keystone_endpoint.py	4.69 KB
keystone_group.py	3.25 KB
keystone_project.py	3.36 KB
keystone_role.py	2.33 KB
keystone_role_grant.py	4.08 KB
keystone_service.py	2.89 KB
keystone_user.py	3.47 KB
keystore.py	5.67 KB
kmod.py	8.59 KB
kubernetes.py	24.87 KB
layman.py	2.44 KB
ldap.py	19.78 KB
libcloud_dns.py	5.7 KB
libcloud_loadbalancer.py	5.66 KB
libcloud_storage.py	5.13 KB
linux_acl.py	24.42 KB
locale.py	2.52 KB
logadm.py	4.67 KB
logrotate.py	3.86 KB
loop.py	7.74 KB
lvm.py	13.33 KB
lvs_server.py	6.28 KB
lvs_service.py	4.38 KB
lxc.py	22.17 KB
lxd.py	7.88 KB
lxd_container.py	22.25 KB
lxd_image.py	10.59 KB
lxd_profile.py	7.11 KB
mac_assistive.py	1.55 KB
mac_keychain.py	5.59 KB
mac_xattr.py	3.15 KB
macdefaults.py	2.65 KB
macpackage.py	6.76 KB
makeconf.py	6.87 KB
marathon_app.py	4.45 KB
mdadm_raid.py	6.41 KB
memcached.py	3.95 KB
modjk.py	2.84 KB
modjk_worker.py	6.49 KB
module.py	18.64 KB
mongodb_database.py	1.65 KB
mongodb_user.py	6.26 KB
monit.py	2.68 KB
mount.py	50.32 KB
mssql_database.py	3 KB
mssql_login.py	3.64 KB
mssql_role.py	2.37 KB
mssql_user.py	3.51 KB
msteams.py	2.53 KB
mysql_database.py	6.05 KB
mysql_grants.py	8.49 KB
mysql_query.py	13.07 KB
mysql_user.py	9.51 KB
net_napalm_yang.py	9.15 KB
netacl.py	31.92 KB
netconfig.py	33.42 KB
netntp.py	12.51 KB
netsnmp.py	11.33 KB
netusers.py	16.1 KB
network.py	23.97 KB
neutron_network.py	3.96 KB
neutron_secgroup.py	4 KB
neutron_secgroup_rule.py	4.75 KB
neutron_subnet.py	4.29 KB
nexus.py	4.97 KB
nfs_export.py	4.92 KB
nftables.py	19.5 KB
npm.py	11.21 KB
ntp.py	2.12 KB
nxos.py	10.37 KB
nxos_upgrade.py	3.5 KB
openstack_config.py	3.26 KB
openvswitch_bridge.py	4.36 KB
openvswitch_db.py	2.24 KB
openvswitch_port.py	17.24 KB
opsgenie.py	4.07 KB
pagerduty.py	1.89 KB
pagerduty_escalation_policy.py	5.42 KB
pagerduty_schedule.py	6.09 KB
pagerduty_service.py	3.93 KB
pagerduty_user.py	1.18 KB
panos.py	48.13 KB
pbm.py	20.46 KB
pcs.py	36.46 KB
pdbedit.py	3.43 KB
pecl.py	3.65 KB
pip_state.py	38.55 KB
pkg.py	138.08 KB
pkgbuild.py	11.37 KB
pkgng.py	685 B
pkgrepo.py	27.53 KB
portage_config.py	5.01 KB
ports.py	5.65 KB
postgres_cluster.py	4.19 KB
postgres_database.py	6.08 KB
postgres_extension.py	5.68 KB
postgres_group.py	8.52 KB
postgres_initdb.py	2.84 KB
postgres_language.py	3.94 KB
postgres_privileges.py	7.86 KB
postgres_schema.py	4.34 KB
postgres_tablespace.py	6.62 KB
postgres_user.py	9.49 KB
powerpath.py	2.34 KB
probes.py	15.06 KB
process.py	1.32 KB
proxy.py	4.94 KB
pushover.py	3.13 KB
pyenv.py	6.07 KB
pyrax_queues.py	2.97 KB
quota.py	1.4 KB
rabbitmq_cluster.py	1.84 KB
rabbitmq_plugin.py	2.77 KB
rabbitmq_policy.py	4.59 KB
rabbitmq_upstream.py	7.9 KB
rabbitmq_user.py	8.89 KB
rabbitmq_vhost.py	3.04 KB
rbac_solaris.py	6.67 KB
rbenv.py	7.36 KB
rdp.py	1.28 KB
redismod.py	4.76 KB
reg.py	19.22 KB
restconf.py	6.41 KB
rsync.py	4.45 KB
rvm.py	6.56 KB
salt_proxy.py	1.34 KB
saltmod.py	33.12 KB
saltutil.py	8.91 KB
schedule.py	12.47 KB
selinux.py	18.61 KB
serverdensity_device.py	6.41 KB
service.py	37.89 KB
slack.py	4.98 KB
smartos.py	44.83 KB
smtp.py	2.3 KB
snapper.py	7.24 KB
solrcloud.py	4.48 KB
splunk.py	4.32 KB
splunk_search.py	3.17 KB
sqlite3.py	14.7 KB
ssh_auth.py	19.57 KB
ssh_known_hosts.py	7.92 KB
stateconf.py	494 B
status.py	2.21 KB
statuspage.py	17.29 KB
supervisord.py	10.48 KB
svn.py	8.14 KB
sysctl.py	4.11 KB
sysfs.py	2.13 KB
syslog_ng.py	2.97 KB
sysrc.py	2.82 KB
telemetry_alert.py	7.04 KB
test.py	13.09 KB
testinframod.py	1.35 KB
timezone.py	3.42 KB
tls.py	1.81 KB
tomcat.py	9.72 KB
trafficserver.py	8.82 KB
tuned.py	3.32 KB
uptime.py	1.87 KB
user.py	38.63 KB
vagrant.py	11.4 KB
vault.py	3.28 KB
vbox_guest.py	4.05 KB
victorops.py	3.32 KB
virt.py	80.41 KB
virtualenv_mod.py	11.21 KB
webutil.py	3.89 KB
win_certutil.py	4.8 KB
win_dacl.py	7.96 KB
win_dism.py	14.97 KB
win_dns_client.py	8.32 KB
win_firewall.py	6.87 KB
win_iis.py	31.56 KB
win_lgpo.py	24.99 KB
win_lgpo_reg.py	10.96 KB
win_license.py	1.6 KB
win_network.py	14.18 KB
win_path.py	6.39 KB
win_pki.py	5.56 KB
win_powercfg.py	3.79 KB
win_servermanager.py	10.4 KB
win_shortcut.py	7.81 KB
win_smtp_server.py	10.01 KB
win_snmp.py	6.64 KB
win_system.py	13.78 KB
win_wua.py	16.27 KB
win_wusa.py	3.53 KB
winrepo.py	2.74 KB
wordpress.py	4.82 KB
x509.py	27.86 KB
x509_v2.py	64.78 KB
xml.py	1.75 KB
xmpp.py	2.61 KB
zabbix_action.py	9.35 KB
zabbix_host.py	27.25 KB
zabbix_hostgroup.py	5.64 KB
zabbix_mediatype.py	16.89 KB
zabbix_template.py	35.14 KB
zabbix_user.py	17.6 KB
zabbix_usergroup.py	9.64 KB
zabbix_usermacro.py	9.69 KB
zabbix_valuemap.py	8.11 KB
zcbuildout.py	5.16 KB
zenoss.py	2.89 KB
zfs.py	34.48 KB
zk_concurrency.py	5.81 KB
zone.py	46.48 KB
zookeeper.py	11.55 KB
zpool.py	13.4 KB

Edit: panos.py

"""
A state module to manage Palo Alto network devices.

:codeauthor: ``Spencer Ervin <spencer_ervin@hotmail.com>``
:maturity:   new
:depends:    none
:platform:   unix

About
=====
This state module was designed to handle connections to a Palo Alto based
firewall. This module relies on the Palo Alto proxy module to interface with the devices.

This state module is designed to give extreme flexibility in the control over XPATH values on the PANOS device. It
exposes the core XML API commands and allows state modules to chain complex XPATH commands.

Below is an example of how to construct a security rule and move to the top of the policy. This will take a config
lock to prevent execution during the operation, then remove the lock. After the XPATH has been deployed, it will
commit to the device.

.. code-block:: yaml

panos/takelock:
        panos.add_config_lock
    panos/service_tcp_22:
        panos.set_config:
            - xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/service
            - value: <entry name='tcp-22'><protocol><tcp><port>22</port></tcp></protocol></entry>
            - commit: False
    panos/create_rule1:
        panos.set_config:
            - xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules
            - value: '
              <entry name="rule1">
                <from><member>trust</member></from>
                <to><member>untrust</member></to>
                <source><member>10.0.0.1</member></source>
                <destination><member>10.0.1.1</member></destination>
                <service><member>tcp-22</member></service>
                <application><member>any</member></application>
                <action>allow</action>
                <disabled>no</disabled>
              </entry>'
            - commit: False
    panos/moveruletop:
        panos.move_config:
            - xpath: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']
            - where: top
            - commit: False
    panos/removelock:
        panos.remove_config_lock
    panos/commit:
        panos.commit_config

Version Specific Configurations
===============================
Palo Alto devices running different versions will have different supported features and different command structures. In
order to account for this, the proxy module can be leveraged to check if the panos device is at a specific revision
level.

The proxy['panos.is_required_version'] method will check if a panos device is currently running a version equal or
greater than the passed version. For example, proxy['panos.is_required_version']('7.0.0') would match both 7.1.0 and
8.0.0.

.. code-block:: jinja

{% if proxy['panos.is_required_version']('8.0.0') %}
    panos/deviceconfig/system/motd-and-banner:
      panos.set_config:
        - xpath: /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system/motd-and-banner
        - value: |
          <banner-header>BANNER TEXT</banner-header>
          <banner-header-color>color2</banner-header-color>
          <banner-header-text-color>color18</banner-header-text-color>
          <banner-header-footer-match>yes</banner-header-footer-match>
        - commit: False
    {% endif %}

.. seealso::
    :py:mod:`Palo Alto Proxy Module <salt.proxy.panos>`

"""

import logging
import xml.etree.ElementTree as ET

import salt.utils.xmlutil as xml

log = logging.getLogger(__name__)

def __virtual__():
    if "panos.commit" in __salt__:
        return True
    return (False, "panos module could not be loaded")

def _build_members(members, anycheck=False):
    """
    Builds a member formatted string for XML operation.

"""
    if isinstance(members, list):

# This check will strip down members to a single any statement
        if anycheck and "any" in members:
            return "<member>any</member>"
        response = ""
        for m in members:
            response += "<member>{}</member>".format(m)
        return response
    else:
        return "<member>{}</member>".format(members)

def _default_ret(name):
    """
    Set the default response values.

"""
    ret = {"name": name, "changes": {}, "commit": None, "result": False, "comment": ""}
    return ret

def _edit_config(xpath, element):
    """
    Sends an edit request to the device.

"""
    query = {"type": "config", "action": "edit", "xpath": xpath, "element": element}

response = __proxy__["panos.call"](query)

return _validate_response(response)

def _get_config(xpath):
    """
    Retrieves an xpath from the device.

"""
    query = {"type": "config", "action": "get", "xpath": xpath}

response = __proxy__["panos.call"](query)

return response

def _move_after(xpath, target):
    """
    Moves an xpath to the after of its section.

"""
    query = {
        "type": "config",
        "action": "move",
        "xpath": xpath,
        "where": "after",
        "dst": target,
    }

response = __proxy__["panos.call"](query)

return _validate_response(response)

def _move_before(xpath, target):
    """
    Moves an xpath to the bottom of its section.

"""
    query = {
        "type": "config",
        "action": "move",
        "xpath": xpath,
        "where": "before",
        "dst": target,
    }

response = __proxy__["panos.call"](query)

return _validate_response(response)

def _move_bottom(xpath):
    """
    Moves an xpath to the bottom of its section.

"""
    query = {"type": "config", "action": "move", "xpath": xpath, "where": "bottom"}

response = __proxy__["panos.call"](query)

return _validate_response(response)

def _move_top(xpath):
    """
    Moves an xpath to the top of its section.

"""
    query = {"type": "config", "action": "move", "xpath": xpath, "where": "top"}

response = __proxy__["panos.call"](query)

return _validate_response(response)

def _set_config(xpath, element):
    """
    Sends a set request to the device.

"""
    query = {"type": "config", "action": "set", "xpath": xpath, "element": element}

response = __proxy__["panos.call"](query)

return _validate_response(response)

def _validate_response(response):
    """
    Validates a response from a Palo Alto device. Used to verify success of commands.

"""
    if not response:
        return False, "Unable to validate response from device."
    elif "msg" in response:
        if "line" in response["msg"]:
            if response["msg"]["line"] == "already at the top":
                return True, response
            elif response["msg"]["line"] == "already at the bottom":
                return True, response
            else:
                return False, response
        elif response["msg"] == "command succeeded":
            return True, response
        else:
            return False, response
    elif "status" in response:
        if response["status"] == "success":
            return True, response
        else:
            return False, response
    else:
        return False, response

def add_config_lock(name):
    """
    Prevent other users from changing configuration until the lock is released.

SLS Example:

.. code-block:: yaml

panos/takelock:
            panos.add_config_lock

"""
    ret = _default_ret(name)

ret.update({"changes": __salt__["panos.add_config_lock"](), "result": True})

return ret

def address_exists(
    name,
    addressname=None,
    vsys=1,
    ipnetmask=None,
    iprange=None,
    fqdn=None,
    description=None,
    commit=False,
):
    """
    Ensures that an address object exists in the configured state. If it does not exist or is not configured with the
    specified attributes, it will be adjusted to match the specified values.

This module will only process a single address type (ip-netmask, ip-range, or fqdn). It will process the specified
    value if the following order: ip-netmask, ip-range, fqdn. For proper execution, only specify a single address
    type.

addressname(str): The name of the address object.  The name is case-sensitive and can have up to 31 characters,
    which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on
    Panorama, unique within its device group and any ancestor or descendant device groups.

vsys(str): The string representation of the VSYS ID. Defaults to VSYS 1.

ipnetmask(str): The IPv4 or IPv6 address or IP address range using the format ip_address/mask or ip_address where
    the mask is the number of significant binary digits used for the network portion of the address. Ideally, for IPv6,
    you specify only the network portion, not the host portion.

iprange(str): A range of addresses using the format ip_address–ip_address where both addresses can be  IPv4 or both
    can be IPv6.

fqdn(str): A fully qualified domain name format. The FQDN initially resolves at commit time. Entries are
    subsequently refreshed when the firewall performs a check every 30 minutes; all changes in the IP address for the
    entries are picked up at the refresh cycle.

description(str): A description for the policy (up to 255 characters).

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/address/h-10.10.10.10:
            panos.address_exists:
              - addressname: h-10.10.10.10
              - vsys: 1
              - ipnetmask: 10.10.10.10
              - commit: False

panos/address/10.0.0.1-10.0.0.50:
            panos.address_exists:
              - addressname: r-10.0.0.1-10.0.0.50
              - vsys: 1
              - iprange: 10.0.0.1-10.0.0.50
              - commit: False

panos/address/foo.bar.com:
            panos.address_exists:
              - addressname: foo.bar.com
              - vsys: 1
              - fqdn: foo.bar.com
              - description: My fqdn object
              - commit: False

"""
    ret = _default_ret(name)

if not addressname:
        ret.update({"comment": "The service name field must be provided."})
        return ret

# Check if address object currently exists
    address = __salt__["panos.get_address"](addressname, vsys)["result"]

if address and "entry" in address:
        address = address["entry"]
    else:
        address = {}

element = ""

# Verify the arguments
    if ipnetmask:
        element = "<ip-netmask>{}</ip-netmask>".format(ipnetmask)
    elif iprange:
        element = "<ip-range>{}</ip-range>".format(iprange)
    elif fqdn:
        element = "<fqdn>{}</fqdn>".format(fqdn)
    else:
        ret.update({"comment": "A valid address type must be specified."})
        return ret

if description:
        element += "<description>{}</description>".format(description)

full_element = "<entry name='{}'>{}</entry>".format(addressname, element)

new_address = xml.to_dict(ET.fromstring(full_element), True)

if address == new_address:
        ret.update(
            {
                "comment": "Address object already exists. No changes required.",
                "result": True,
            }
        )
        return ret
    else:
        xpath = (
            "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/address/"
            "entry[@name='{}']".format(vsys, addressname)
        )

result, msg = _edit_config(xpath, full_element)

if not result:
            ret.update({"comment": msg})
            return ret

if commit is True:
        ret.update(
            {
                "changes": {"before": address, "after": new_address},
                "commit": __salt__["panos.commit"](),
                "comment": "Address object successfully configured.",
                "result": True,
            }
        )
    else:
        ret.update(
            {
                "changes": {"before": address, "after": new_address},
                "comment": "Service object successfully configured.",
                "result": True,
            }
        )

return ret

def address_group_exists(
    name, groupname=None, vsys=1, members=None, description=None, commit=False
):
    """
    Ensures that an address group object exists in the configured state. If it does not exist or is not configured with
    the specified attributes, it will be adjusted to match the specified values.

This module will enforce group membership. If a group exists and contains members this state does not include,
    those members will be removed and replaced with the specified members in the state.

groupname(str): The name of the address group object.  The name is case-sensitive and can have up to 31 characters,
    which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on
    Panorama, unique within its device group and any ancestor or descendant device groups.

vsys(str): The string representation of the VSYS ID. Defaults to VSYS 1.

members(str, list): The members of the address group. These must be valid address objects or address groups on the
    system that already exist prior to the execution of this state.

description(str): A description for the policy (up to 255 characters).

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/address-group/my-group:
            panos.address_group_exists:
              - groupname: my-group
              - vsys: 1
              - members:
                - my-address-object
                - my-other-address-group
              - description: A group that needs to exist
              - commit: False

"""
    ret = _default_ret(name)

if not groupname:
        ret.update({"comment": "The group name field must be provided."})
        return ret

# Check if address group object currently exists
    group = __salt__["panos.get_address_group"](groupname, vsys)["result"]

if group and "entry" in group:
        group = group["entry"]
    else:
        group = {}

# Verify the arguments
    if members:
        element = "<static>{}</static>".format(_build_members(members, True))
    else:
        ret.update({"comment": "The group members must be provided."})
        return ret

if description:
        element += "<description>{}</description>".format(description)

full_element = "<entry name='{}'>{}</entry>".format(groupname, element)

new_group = xml.to_dict(ET.fromstring(full_element), True)

if group == new_group:
        ret.update(
            {
                "comment": "Address group object already exists. No changes required.",
                "result": True,
            }
        )
        return ret
    else:
        xpath = (
            "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/address-group/"
            "entry[@name='{}']".format(vsys, groupname)
        )

result, msg = _edit_config(xpath, full_element)

if not result:
            ret.update({"comment": msg})
            return ret

if commit is True:
        ret.update(
            {
                "changes": {"before": group, "after": new_group},
                "commit": __salt__["panos.commit"](),
                "comment": "Address group object successfully configured.",
                "result": True,
            }
        )
    else:
        ret.update(
            {
                "changes": {"before": group, "after": new_group},
                "comment": "Address group object successfully configured.",
                "result": True,
            }
        )

return ret

def clone_config(name, xpath=None, newname=None, commit=False):
    """
    Clone a specific XPATH and set it to a new name.

xpath(str): The XPATH of the configuration API tree to clone.

newname(str): The new name of the XPATH clone.

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/clonerule:
            panos.clone_config:
              - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules&from=/config/devices/
              entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']
              - value: rule2
              - commit: True

"""
    ret = _default_ret(name)

if not xpath:
        return ret

if not newname:
        return ret

query = {"type": "config", "action": "clone", "xpath": xpath, "newname": newname}

result, response = _validate_response(__proxy__["panos.call"](query))

ret.update({"changes": response, "result": result})

if not result:
        return ret

if commit is True:
        ret.update({"commit": __salt__["panos.commit"](), "result": True})

return ret

def commit_config(name):
    """
    Commits the candidate configuration to the running configuration.

SLS Example:

.. code-block:: yaml

panos/commit:
            panos.commit_config

"""
    ret = _default_ret(name)

ret.update({"commit": __salt__["panos.commit"](), "result": True})

return ret

def delete_config(name, xpath=None, commit=False):
    """
    Deletes a Palo Alto XPATH to a specific value.

Use the xpath parameter to specify the location of the object to be deleted.

xpath(str): The XPATH of the configuration API tree to control.

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/deletegroup:
            panos.delete_config:
              - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='test']
              - commit: True

"""
    ret = _default_ret(name)

if not xpath:
        return ret

query = {"type": "config", "action": "delete", "xpath": xpath}

result, response = _validate_response(__proxy__["panos.call"](query))

ret.update({"changes": response, "result": result})

if not result:
        return ret

if commit is True:
        ret.update({"commit": __salt__["panos.commit"](), "result": True})

return ret

def download_software(name, version=None, synch=False, check=False):
    """
    Ensures that a software version is downloaded.

version(str): The software version to check. If this version is not already downloaded, it will attempt to download
    the file from Palo Alto.

synch(bool): If true, after downloading the file it will be synched to its peer.

check(bool): If true, the PANOS device will first attempt to pull the most recent software inventory list from Palo
    Alto.

SLS Example:

.. code-block:: yaml

panos/version8.0.0:
            panos.download_software:
              - version: 8.0.0
              - synch: False
              - check: True

"""
    ret = _default_ret(name)

if check is True:
        __salt__["panos.check_software"]()

versions = __salt__["panos.get_software_info"]()["result"]

if (
        "sw-updates" not in versions
        or "versions" not in versions["sw-updates"]
        or "entry" not in versions["sw-updates"]["versions"]
    ):
        ret.update(
            {
                "comment": "Software version is not found in the local software list.",
                "result": False,
            }
        )
        return ret

for entry in versions["sw-updates"]["versions"]["entry"]:
        if entry["version"] == version and entry["downloaded"] == "yes":
            ret.update(
                {"comment": "Software version is already downloaded.", "result": True}
            )
        return ret

ret.update(
        {
            "changes": __salt__["panos.download_software_version"](
                version=version, synch=synch
            )
        }
    )

versions = __salt__["panos.get_software_info"]()["result"]

if (
        "sw-updates" not in versions
        or "versions" not in versions["sw-updates"]
        or "entry" not in versions["sw-updates"]["versions"]
    ):
        ret.update({"result": False})
        return ret

for entry in versions["sw-updates"]["versions"]["entry"]:
        if entry["version"] == version and entry["downloaded"] == "yes":
            ret.update({"result": True})
        return ret

return ret

def edit_config(name, xpath=None, value=None, commit=False):
    """
    Edits a Palo Alto XPATH to a specific value. This will always overwrite the existing value, even if it is not
    changed.

You can replace an existing object hierarchy at a specified location in the configuration with a new value. Use
    the xpath parameter to specify the location of the object, including the node to be replaced.

This is the recommended state to enforce configurations on a xpath.

xpath(str): The XPATH of the configuration API tree to control.

value(str): The XML value to edit. This must be a child to the XPATH.

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/addressgroup:
            panos.edit_config:
              - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address-group/entry[@name='test']
              - value: <static><entry name='test'><member>abc</member><member>xyz</member></entry></static>
              - commit: True

"""
    ret = _default_ret(name)

# Verify if the current XPATH is equal to the specified value.
    # If we are equal, no changes required.
    xpath_split = xpath.split("/")

# Retrieve the head of the xpath for validation.
    if len(xpath_split) > 0:
        head = xpath_split[-1]
        if "[" in head:
            head = head.split("[")[0]

current_element = __salt__["panos.get_xpath"](xpath)["result"]

if head and current_element and head in current_element:
        current_element = current_element[head]
    else:
        current_element = {}

new_element = xml.to_dict(ET.fromstring(value), True)

if current_element == new_element:
        ret.update(
            {
                "comment": "XPATH is already equal to the specified value.",
                "result": True,
            }
        )
        return ret

result, msg = _edit_config(xpath, value)

ret.update({"comment": msg, "result": result})

if not result:
        return ret

if commit is True:
        ret.update(
            {
                "changes": {"before": current_element, "after": new_element},
                "commit": __salt__["panos.commit"](),
                "result": True,
            }
        )
    else:
        ret.update(
            {
                "changes": {"before": current_element, "after": new_element},
                "result": True,
            }
        )

return ret

def move_config(name, xpath=None, where=None, dst=None, commit=False):
    """
    Moves a XPATH value to a new location.

Use the xpath parameter to specify the location of the object to be moved, the where parameter to
    specify type of move, and dst parameter to specify the destination path.

xpath(str): The XPATH of the configuration API tree to move.

where(str): The type of move to execute. Valid options are after, before, top, bottom. The after and before
    options will require the dst option to specify the destination of the action. The top action will move the
    XPATH to the top of its structure. The botoom action will move the XPATH to the bottom of its structure.

dst(str): Optional. Specifies the destination to utilize for a move action. This is ignored for the top
    or bottom action.

commit(bool): If true the firewall will commit the changes, if false do not commit changes. If the operation is
    not successful, it will not commit.

SLS Example:

.. code-block:: yaml

panos/moveruletop:
            panos.move_config:
              - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']
              - where: top
              - commit: True

panos/moveruleafter:
            panos.move_config:
              - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='rule1']
              - where: after
              - dst: rule2
              - commit: True

"""
    ret = _default_ret(name)

if not xpath:
        return ret

if not where:
        return ret

if where == "after":
        result, msg = _move_after(xpath, dst)
    elif where == "before":
        result, msg = _move_before(xpath, dst)
    elif where == "top":
        result, msg = _move_top(xpath)
    elif where == "bottom":
        result, msg = _move_bottom(xpath)

ret.update({"result": result, "comment": msg})

if not result:
        return ret

if commit is True:
        ret.update({"commit": __salt__["panos.commit"](), "result": True})

return ret

def remove_config_lock(name):
    """
    Release config lock previously held.

SLS Example:

.. code-block:: yaml

panos/takelock:
            panos.remove_config_lock

"""
    ret = _default_ret(name)

ret.update({"changes": __salt__["panos.remove_config_lock"](), "result": True})

return ret

def rename_config(name, xpath=None, newname=None, commit=False):
    """
    Rename a Palo Alto XPATH to a specific value. This will always rename the value even if a change is not needed.

xpath(str): The XPATH of the configuration API tree to control.

newname(str): The new name of the XPATH value.

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/renamegroup:
            panos.rename_config:
              - xpath: /config/devices/entry/vsys/entry[@name='vsys1']/address/entry[@name='old_address']
              - value: new_address
              - commit: True

"""
    ret = _default_ret(name)

if not xpath:
        return ret

if not newname:
        return ret

query = {"type": "config", "action": "rename", "xpath": xpath, "newname": newname}

result, response = _validate_response(__proxy__["panos.call"](query))

ret.update({"changes": response, "result": result})

if not result:
        return ret

if commit is True:
        ret.update({"commit": __salt__["panos.commit"](), "result": True})

return ret

def security_rule_exists(
    name,
    rulename=None,
    vsys="1",
    action=None,
    disabled=None,
    sourcezone=None,
    destinationzone=None,
    source=None,
    destination=None,
    application=None,
    service=None,
    description=None,
    logsetting=None,
    logstart=None,
    logend=None,
    negatesource=None,
    negatedestination=None,
    profilegroup=None,
    datafilter=None,
    fileblock=None,
    spyware=None,
    urlfilter=None,
    virus=None,
    vulnerability=None,
    wildfire=None,
    move=None,
    movetarget=None,
    commit=False,
):
    """
    Ensures that a security rule exists on the device. Also, ensure that all configurations are set appropriately.

This method will create the rule if it does not exist. If the rule does exist, it will ensure that the
    configurations are set appropriately.

If the rule does not exist and is created, any value that is not provided will be provided as the default.
    The action, to, from, source, destination, application, and service fields are mandatory and must be provided.

This will enforce the exact match of the rule. For example, if the rule is currently configured with the log-end
    option, but this option is not specified in the state method, it will be removed and reset to the system default.

It is strongly recommended to specify all options to ensure proper operation.

When defining the profile group settings, the device can only support either a profile group or individual settings.
    If both are specified, the profile group will be preferred and the individual settings are ignored. If neither are
    specified, the value will be set to system default of none.

rulename(str): The name of the security rule.  The name is case-sensitive and can have up to 31 characters, which
    can be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama,
    unique within its device group and any ancestor or descendant device groups.

vsys(str): The string representation of the VSYS ID. Defaults to VSYS 1.

action(str): The action that the security rule will enforce. Valid options are: allow, deny, drop, reset-client,
    reset-server, reset-both.

disabled(bool): Controls if the rule is disabled. Set 'True' to disable and 'False' to enable.

sourcezone(str, list): The source zone(s). The value 'any' will match all zones.

destinationzone(str, list): The destination zone(s). The value 'any' will match all zones.

source(str, list): The source address(es). The value 'any' will match all addresses.

destination(str, list): The destination address(es). The value 'any' will match all addresses.

application(str, list): The application(s) matched. The value 'any' will match all applications.

service(str, list): The service(s) matched. The value 'any' will match all services. The value
    'application-default' will match based upon the application defined ports.

description(str): A description for the policy (up to 255 characters).

logsetting(str): The name of a valid log forwarding profile.

logstart(bool): Generates a traffic log entry for the start of a session (disabled by default).

logend(bool): Generates a traffic log entry for the end of a session (enabled by default).

negatesource(bool): Match all but the specified source addresses.

negatedestination(bool): Match all but the specified destination addresses.

profilegroup(str): A valid profile group name.

datafilter(str): A valid data filter profile name. Ignored with the profilegroup option set.

fileblock(str): A valid file blocking profile name. Ignored with the profilegroup option set.

spyware(str): A valid spyware profile name. Ignored with the profilegroup option set.

urlfilter(str): A valid URL filtering profile name. Ignored with the profilegroup option set.

virus(str): A valid virus profile name. Ignored with the profilegroup option set.

vulnerability(str): A valid vulnerability profile name. Ignored with the profilegroup option set.

wildfire(str): A valid vulnerability profile name. Ignored with the profilegroup option set.

move(str): An optional argument that ensure the rule is moved to a specific location. Valid options are 'top',
    'bottom', 'before', or 'after'. The 'before' and 'after' options require the use of the 'movetarget' argument
    to define the location of the move request.

movetarget(str): An optional argument that defines the target of the move operation if the move argument is
    set to 'before' or 'after'.

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/rulebase/security/rule01:
            panos.security_rule_exists:
              - rulename: rule01
              - vsys: 1
              - action: allow
              - disabled: False
              - sourcezone: untrust
              - destinationzone: trust
              - source:
                - 10.10.10.0/24
                - 1.1.1.1
              - destination:
                - 2.2.2.2-2.2.2.4
              - application:
                - any
              - service:
                - tcp-25
              - description: My test security rule
              - logsetting: logprofile
              - logstart: False
              - logend: True
              - negatesource: False
              - negatedestination: False
              - profilegroup: myprofilegroup
              - move: top
              - commit: False

panos/rulebase/security/rule01:
            panos.security_rule_exists:
              - rulename: rule01
              - vsys: 1
              - action: allow
              - disabled: False
              - sourcezone: untrust
              - destinationzone: trust
              - source:
                - 10.10.10.0/24
                - 1.1.1.1
              - destination:
                - 2.2.2.2-2.2.2.4
              - application:
                - any
              - service:
                - tcp-25
              - description: My test security rule
              - logsetting: logprofile
              - logstart: False
              - logend: False
              - datafilter: foobar
              - fileblock: foobar
              - spyware: foobar
              - urlfilter: foobar
              - virus: foobar
              - vulnerability: foobar
              - wildfire: foobar
              - move: after
              - movetarget: rule02
              - commit: False
    """
    ret = _default_ret(name)

if not rulename:
        return ret

# Check if rule currently exists
    rule = __salt__["panos.get_security_rule"](rulename, vsys)["result"]

if rule and "entry" in rule:
        rule = rule["entry"]
    else:
        rule = {}

# Build the rule element
    element = ""
    if sourcezone:
        element += "<from>{}</from>".format(_build_members(sourcezone, True))
    else:
        ret.update({"comment": "The sourcezone field must be provided."})
        return ret

if destinationzone:
        element += "<to>{}</to>".format(_build_members(destinationzone, True))
    else:
        ret.update({"comment": "The destinationzone field must be provided."})
        return ret

if source:
        element += "<source>{}</source>".format(_build_members(source, True))
    else:
        ret.update({"comment": "The source field must be provided."})
        return

if destination:
        element += "<destination>{}</destination>".format(
            _build_members(destination, True)
        )
    else:
        ret.update({"comment": "The destination field must be provided."})
        return ret

if application:
        element += "<application>{}</application>".format(
            _build_members(application, True)
        )
    else:
        ret.update({"comment": "The application field must be provided."})
        return ret

if service:
        element += "<service>{}</service>".format(_build_members(service, True))
    else:
        ret.update({"comment": "The service field must be provided."})
        return ret

if action:
        element += "<action>{}</action>".format(action)
    else:
        ret.update({"comment": "The action field must be provided."})
        return ret

if disabled is not None:
        if disabled:
            element += "<disabled>yes</disabled>"
        else:
            element += "<disabled>no</disabled>"

if description:
        element += "<description>{}</description>".format(description)

if logsetting:
        element += "<log-setting>{}</log-setting>".format(logsetting)

if logstart is not None:
        if logstart:
            element += "<log-start>yes</log-start>"
        else:
            element += "<log-start>no</log-start>"

if logend is not None:
        if logend:
            element += "<log-end>yes</log-end>"
        else:
            element += "<log-end>no</log-end>"

if negatesource is not None:
        if negatesource:
            element += "<negate-source>yes</negate-source>"
        else:
            element += "<negate-source>no</negate-source>"

if negatedestination is not None:
        if negatedestination:
            element += "<negate-destination>yes</negate-destination>"
        else:
            element += "<negate-destination>no</negate-destination>"

# Build the profile settings
    profile_string = None
    if profilegroup:
        profile_string = "<group><member>{}</member></group>".format(profilegroup)
    else:
        member_string = ""
        if datafilter:
            member_string += (
                "<data-filtering><member>{}</member></data-filtering>".format(
                    datafilter
                )
            )
        if fileblock:
            member_string += (
                "<file-blocking><member>{}</member></file-blocking>".format(fileblock)
            )
        if spyware:
            member_string += "<spyware><member>{}</member></spyware>".format(spyware)
        if urlfilter:
            member_string += (
                "<url-filtering><member>{}</member></url-filtering>".format(urlfilter)
            )
        if virus:
            member_string += "<virus><member>{}</member></virus>".format(virus)
        if vulnerability:
            member_string += (
                "<vulnerability><member>{}</member></vulnerability>".format(
                    vulnerability
                )
            )
        if wildfire:
            member_string += (
                "<wildfire-analysis><member>{}</member></wildfire-analysis>".format(
                    wildfire
                )
            )
        if member_string != "":
            profile_string = "<profiles>{}</profiles>".format(member_string)

if profile_string:
        element += "<profile-setting>{}</profile-setting>".format(profile_string)

full_element = "<entry name='{}'>{}</entry>".format(rulename, element)

new_rule = xml.to_dict(ET.fromstring(full_element), True)

config_change = False

if rule == new_rule:
        ret.update({"comment": "Security rule already exists. No changes required."})
    else:
        config_change = True
        xpath = (
            "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/rulebase/"
            "security/rules/entry[@name='{}']".format(vsys, rulename)
        )

result, msg = _edit_config(xpath, full_element)

if not result:
            ret.update({"comment": msg})
            return ret

ret.update(
            {
                "changes": {"before": rule, "after": new_rule},
                "comment": "Security rule verified successfully.",
            }
        )

if move:
        movepath = (
            "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/rulebase/"
            "security/rules/entry[@name='{}']".format(vsys, rulename)
        )
        move_result = False
        move_msg = ""
        if move == "before" and movetarget:
            move_result, move_msg = _move_before(movepath, movetarget)
        elif move == "after":
            move_result, move_msg = _move_after(movepath, movetarget)
        elif move == "top":
            move_result, move_msg = _move_top(movepath)
        elif move == "bottom":
            move_result, move_msg = _move_bottom(movepath)

if config_change:
            ret.update(
                {"changes": {"before": rule, "after": new_rule, "move": move_msg}}
            )
        else:
            ret.update({"changes": {"move": move_msg}})

if not move_result:
            ret.update({"comment": move_msg})
            return ret

if commit is True:
        ret.update({"commit": __salt__["panos.commit"](), "result": True})
    else:
        ret.update({"result": True})

return ret

def service_exists(
    name,
    servicename=None,
    vsys=1,
    protocol=None,
    port=None,
    description=None,
    commit=False,
):
    """
    Ensures that a service object exists in the configured state. If it does not exist or is not configured with the
    specified attributes, it will be adjusted to match the specified values.

servicename(str): The name of the security object.  The name is case-sensitive and can have up to 31 characters,
    which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on
    Panorama, unique within its device group and any ancestor or descendant device groups.

vsys(str): The string representation of the VSYS ID. Defaults to VSYS 1.

protocol(str): The protocol that is used by the service object. The only valid options are tcp and udp.

port(str): The port number that is used by the service object. This can be specified as a single integer or a
    valid range of ports.

description(str): A description for the policy (up to 255 characters).

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/service/tcp-80:
            panos.service_exists:
              - servicename: tcp-80
              - vsys: 1
              - protocol: tcp
              - port: 80
              - description: Hypertext Transfer Protocol
              - commit: False

panos/service/udp-500-550:
            panos.service_exists:
              - servicename: udp-500-550
              - vsys: 3
              - protocol: udp
              - port: 500-550
              - commit: False

"""
    ret = _default_ret(name)

if not servicename:
        ret.update({"comment": "The service name field must be provided."})
        return ret

# Check if service object currently exists
    service = __salt__["panos.get_service"](servicename, vsys)["result"]

if service and "entry" in service:
        service = service["entry"]
    else:
        service = {}

# Verify the arguments
    if not protocol and protocol not in ["tcp", "udp"]:
        ret.update({"comment": "The protocol must be provided and must be tcp or udp."})
        return ret
    if not port:
        ret.update({"comment": "The port field must be provided."})
        return ret

element = "<protocol><{0}><port>{1}</port></{0}></protocol>".format(protocol, port)

if description:
        element += "<description>{}</description>".format(description)

full_element = "<entry name='{}'>{}</entry>".format(servicename, element)

new_service = xml.to_dict(ET.fromstring(full_element), True)

if service == new_service:
        ret.update(
            {
                "comment": "Service object already exists. No changes required.",
                "result": True,
            }
        )
        return ret
    else:
        xpath = (
            "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/service/"
            "entry[@name='{}']".format(vsys, servicename)
        )

result, msg = _edit_config(xpath, full_element)

if not result:
            ret.update({"comment": msg})
            return ret

if commit is True:
        ret.update(
            {
                "changes": {"before": service, "after": new_service},
                "commit": __salt__["panos.commit"](),
                "comment": "Service object successfully configured.",
                "result": True,
            }
        )
    else:
        ret.update(
            {
                "changes": {"before": service, "after": new_service},
                "comment": "Service object successfully configured.",
                "result": True,
            }
        )

return ret

def service_group_exists(
    name, groupname=None, vsys=1, members=None, description=None, commit=False
):
    """
    Ensures that a service group object exists in the configured state. If it does not exist or is not configured with
    the specified attributes, it will be adjusted to match the specified values.

This module will enforce group membership. If a group exists and contains members this state does not include,
    those members will be removed and replaced with the specified members in the state.

groupname(str): The name of the service group object.  The name is case-sensitive and can have up to 31 characters,
    which an be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on
    Panorama, unique within its device group and any ancestor or descendant device groups.

vsys(str): The string representation of the VSYS ID. Defaults to VSYS 1.

members(str, list): The members of the service group. These must be valid service objects or service groups on the
    system that already exist prior to the execution of this state.

description(str): A description for the policy (up to 255 characters).

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/service-group/my-group:
            panos.service_group_exists:
              - groupname: my-group
              - vsys: 1
              - members:
                - tcp-80
                - custom-port-group
              - description: A group that needs to exist
              - commit: False

"""
    ret = _default_ret(name)

if not groupname:
        ret.update({"comment": "The group name field must be provided."})
        return ret

# Check if service group object currently exists
    group = __salt__["panos.get_service_group"](groupname, vsys)["result"]

if group and "entry" in group:
        group = group["entry"]
    else:
        group = {}

# Verify the arguments
    if members:
        element = "<members>{}</members>".format(_build_members(members, True))
    else:
        ret.update({"comment": "The group members must be provided."})
        return ret

if description:
        element += "<description>{}</description>".format(description)

full_element = "<entry name='{}'>{}</entry>".format(groupname, element)

new_group = xml.to_dict(ET.fromstring(full_element), True)

if group == new_group:
        ret.update(
            {
                "comment": "Service group object already exists. No changes required.",
                "result": True,
            }
        )
        return ret
    else:
        xpath = (
            "/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys{}']/service-group/"
            "entry[@name='{}']".format(vsys, groupname)
        )

result, msg = _edit_config(xpath, full_element)

if not result:
            ret.update({"comment": msg})
            return ret

if commit is True:
        ret.update(
            {
                "changes": {"before": group, "after": new_group},
                "commit": __salt__["panos.commit"](),
                "comment": "Service group object successfully configured.",
                "result": True,
            }
        )
    else:
        ret.update(
            {
                "changes": {"before": group, "after": new_group},
                "comment": "Service group object successfully configured.",
                "result": True,
            }
        )

return ret

def set_config(name, xpath=None, value=None, commit=False):
    """
    Sets a Palo Alto XPATH to a specific value. This will always overwrite the existing value, even if it is not
    changed.

You can add or create a new object at a specified location in the configuration hierarchy. Use the xpath parameter
    to specify the location of the object in the configuration

xpath(str): The XPATH of the configuration API tree to control.

value(str): The XML value to set. This must be a child to the XPATH.

commit(bool): If true the firewall will commit the changes, if false do not commit changes.

SLS Example:

.. code-block:: yaml

panos/hostname:
            panos.set_config:
              - xpath: /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system
              - value: <hostname>foobar</hostname>
              - commit: True

"""
    ret = _default_ret(name)

result, msg = _set_config(xpath, value)

ret.update({"comment": msg, "result": result})

if not result:
        return ret

if commit is True:
        ret.update({"commit": __salt__["panos.commit"](), "result": True})

return ret