File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/__pycache__/capirca_acl.cpython-310.pyc
Back
o ;jן � @ s� d Z ddlZddlZddlZddlZddlZe�e�Z zddl Z ddl Z ddl Z ddl Z dZW n ey: dZY nw dZdgZdd� Zi d g �d g �d g �d g �d d�dd�dg �dg �dg �dg �dg �dg �dg �dd�dd�dg �dd�i dd�dg �d g �d g �d g �d g �d d�d!g �d"d�d#g �d$g �d%g �d&g �d'g �d(d�d)d�d*d��i d+g �d,d�d-g �d.d�d/g �d0d�d1d�d2g �d3g �d4d�d5g �d6g �d7g �d8d�d9g �d:g �d;d��dg g dddddddd<� �Zg d=�Zi Ze�rFe jjjZd>d?� Zeed@e� ed�Z e e �D ] Z e e dA��s%e � dB��s%e e �!� k�r'�qe"e e �ee < �qG dCdD� dDe jjj#�Z$G dEdF� dFe jjj�Z%dGdH� Z&dIdJ� Z'dKdL� Z(dMdN� Z)dOdP� Z*dQdR� Z+dkdSdT�Z,dUdV� Z-dldWdX�Z. Y dmdZd[�Z/ Y dnd\d]�Z0 ^dod_d`�Z1 Y ^ dpdadb�Z2 Y ^dqdcdd�Z3 Y ^drdedf�Z4dsdgdh�Z5 dsdidj�Z6dS )ta� Capirca ACL =========== Generate ACL (firewall) configuration for network devices. .. versionadded:: 2017.7.0 :codeauthor: Mircea Ulinic <ping@mirceaulinic.net> & Robert Ankeny <robankeny@google.com> :maturity: new :depends: capirca :platform: unix Dependencies ------------ The firewall configuration is generated by Capirca_. .. _Capirca: https://github.com/google/capirca To install Capirca, execute: ``pip install capirca``. � NTF�capirca�*c C s t rtS dS )z8 This module requires at least Capirca to work. )Fz2The capirca module (capirca_acl) cannot be loaded.)� HAS_CAPIRCA�__virtualname__� r r �L/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/capirca_acl.py� __virtual__: s r �action�address�address_excludeZcommentZcounterZ expiration�destination_addressZdestination_address_exclude�destination_portZdestination_prefixZforwarding_classZforwarding_class_except�loggingZlog_nameZ loss_priority�option�ownerZpolicer�portZ precedenceZ principals�protocolZprotocol_exceptZqosZpan_applicationZrouting_instance�source_address�source_address_exclude� source_portZ source_prefixZverbatimZ packet_lengthZfragment_offsetZ hop_limitZ icmp_typeZ icmp_codeZ ether_typeZtraffic_class_countZ traffic_typeZ translatedZdscp_setZ dscp_matchZ dscp_except�next_ipZflexible_match_rangeZsource_prefix_exceptZdestination_prefix_exceptZvpnZ source_tagZdestination_tagZsource_interface) Zdestination_interface�platformZplatform_exclude�timeoutZ flattened�flattened_addr�flattened_saddr�flattened_daddr�priorityZttl) r r r r r r r r r c C s d S �Nr )�self�objr r r � _add_object� s r � AddObject�__func__�_c @ � e Zd ZdZdd� ZdS )�_PolicyzW Extending the Capirca Policy class to allow inserting custom filters. c C s g | _ d| _d S )N� )�filters�filename)r r r r �__init__� s z_Policy.__init__N��__name__� __module__� __qualname__�__doc__r) r r r r r% � � r% c @ r$ )�_Termz\ Extending the Capirca Term class to allow setting field valued on the fly. c C s" t �� D ] \}}t| ||� qd S r )� _TERM_FIELDS�items�setattr)r �field�defaultr r r r) � s �z_Term.__init__Nr* r r r r r0 � r/ r0 c C s� t �d| � t�tj�D ]1\}}|| kr=t�|�r=t�|�D ] \}}t�|�r<t|tj j j �r<t �d|| � | S q q t � d| � dS )z� Given a specific platform (under the Capirca conventions), return the generator class. The generator class is identified looking under the <platform> module for a class inheriting the `ACLGenerator` class. zUsing platform: %sz"Identified Capirca class %s for %sz3Unable to identify any Capirca plaform class for %sN) �log�debug�inspect� getmembersr ZaclgenZismoduleZisclass� issubclass�libZ aclgeneratorZ ACLGenerator�error)r �mod_nameZmod_objZ plat_obj_nameZplat_objr r r �_import_platform_generator� s � � �r> c C sl t rt S d} z#tjj�dd��}tjj�|�� �} W d � n1 s#w Y W n tyG } zt � d� t � |� t W Y d}~S d}~ww t � d�}| � � D ]b}|�|�}|r�t|�� �dkr�|�� \}}}} |t vrug g d�t |< z t | d �t|�� W n' ty� } zt � | � t � d � t � |� t � d |� W Y d} ~ nd} ~ ww t | d �|� qQt S ) ar Build a map of services based on the IANA assignment list: http://www.iana.org/assignments/port-numbers It will load the /etc/services file and will build the mapping on the fly, similar to the Capirca's SERVICES file: https://github.com/google/capirca/blob/master/def/SERVICES.svc As this module is be available on Unix systems only, we'll read the services from /etc/services. In the worst case, the user will not be able to specify the services shortcut and they will need to specify the protocol / port combination using the source_port / destination_port & protocol fields. r& z /etc/services�rNz"Unable to read from /etc/services:z(^([a-zA-Z0-9-]+)\s+(\d+)\/(tcp|udp)(.*)$� )r r r zDid not read that properly:zCPlease report the above error: %s does not seem a valid port value!r )� _SERVICES�salt�utils�filesZfopenZ stringutilsZ to_unicode�read�OSErrorr6 r< �re�compile� splitlines�search�len�groups�append�int� ValueError) Z services_txtZsrv_fZioeZ service_rgx�lineZ service_rgx_sZsrv_namer r r# Zverrr r r �_get_services_mapping� sH �� �� ��� �rQ c C s. t � }| |v r|| d r|| d d S | S )zb Look into services and return the port value using the service name as lookup value. r r )rQ )r Zservicesr r r �_translate_port s rR c C s g }|| v r | | }|du r|S t |ttf�rj|dv r`g }|D ]}t |ttf�s0|�||f� q |�|� q g }|D ] \}}t |t�sGt|�}t |t�sPt|�}|�||f� q:tt|| ��S tt|t|� ��S |dv r�t |t�swt|�}tt|||fg ��S tt||g ��S )z! Return the object list. N)r r )� isinstance�tuple�listrM rN rR �set) Zdict_� field_name�valueZ prev_valueZportvalr Ztranslated_portvalZ port_startZport_endr r r � _make_it_list s4 rY c C s� i }t � }| �� D ]�\}}|dkrf|rft|t�r t|||�}t�d� t�|� |D ] }|rJ||v rJt|d|| d �|d< t|d|| d �|d< q*t�d� t�|�d�� t�d� t�|�d�� q |dkr�|r�t|t�rwt|||�}t�d � t�|� |D ] }|r�||v r�t|d || d �|d < t|d|| d �|d< q�t�d � t�|�d�� t�d � t�|�d�� q |tv r�|r�|t| kr�tt| t �r�t|||�}|t v r�g }|D ] }|� t j jj�|�� q�|d d � }|||< q |S )z� Cleanup the term opts: - strip Null and empty valuee, defaulting their value to their base definition from _TERM_FIELDS - convert to `nacaddr.IP` fields from `_IP_FILEDS` - create lists for those fields requiring it �source_servicez#Processing special source services:r r r zBBuilt source_port field, after processing special source services:z?Built protocol field, after processing special source services:�destination_servicez(Processing special destination services:r zGBuilt source_port field, after processing special destination services:zDBuilt protocol field, after processing special destination services:N)rQ r2 rS �strrY r6 r7 �getr1 rU � _IP_FILEDSrM r r; �policyZnacaddrZIP)� term_optsZ clean_optsZ _servicesr4 rX ZserviceZ ip_values�addrr r r �_clean_term_optsF sp ���� ����� �rb c C s: | si S | D ]}|rt |t�sq||v r|| S qi S )zK Find an dictionary in a list of dictionaries, given its main key. )rS �dict)�lst�key�eler r r �_lookup_element� s �rg c C s t d | ||d�}|S )z> Retrieve the pillar data from the right environment. z pillar.get�� pillarenv�saltenv)Z__salt__)� pillar_keyri rj � pillar_cfgr r r �_get_pillar_cfg� s �rm c C s* g }| D ]}|rt |t�r|�|� q|S )z2 Return a list of non-empty dictionaries. )rS rc rM )rd Zcleanrf r r r �_cleanup� s �rn c C s� t | �} t |�}| s|sg S | s|r|S | r|s| S g }g }g }| D ] }t|tt|���r3|�|� q"|r;|�|� q"|sB|�|� q"|D ] }tt|��}t||�r_t| |�}|�||i� qE|�|� qE|sl|�|� |S )a< Merge lists of dictionaries. Each element of the list is a dictionary having one single key. That key is then used as unique lookup. The first element list has higher priority than the second. When there's an overlap between the two lists, it won't change the position, but the content. )rn rg �next�iterrM �extend) �first�second�prepend�overlapsZmergedZappendedrf Zele_keyZ ele_val_firstr r r �_merge_list_of_dict� s8 � rv �aclc K s� t �d|| � t� }||_i }|r2t| ||||d�}t �d� t �|� t|�}t �d� t �|� t �d� t �|� t �d� t|�}t �|� t �d� |�|� t �|� |�� D ] \} } t|| | � q]t �d� t �t |�� |S ) zK Return an instance of the ``_Term`` class given the term options. z-Generating config for term %s under filter %s)rk rj ri zMerging with pillar data:zCleaning up pillar data:zReceived processing opts:z Cleaning up processing opts:zFinal term opts:z Term config:) r6 r7 r0 �name�get_term_pillarrb �updater2 r3 r\ ) � filter_name� term_namerk ri rj � merge_pillar� term_fields�termr` r4 rX r r r �_get_term_object� s< � r� c C sL t � }g }|s g }|D ]s}|rt|t�sq tt|�� ��\} } tjj� � } | | g} | � dd�} | r<t i | | �} | � | � tjj� | �}| �|� g }| �dg �D ]&}|rqt|t�rqtt|�� ��\}}t| |f||||d�|��}|�|� qP|�| |f� q ||_t�d� t�t|�� t| �}||d�}t�d| � t�t|�� |S )zO Return an instance of the ``_Policy`` class given the filters config. �optionsN�terms)rk ri rj r} zPolicy config:� z Generating policy config for %s:)r% rS rc ro rp r2 r r; r_ �Header�poprY rq ZTargetr! r] r� rM r' r6 r7 r\ r> )r r' rk ri rj r} r_ Zpolicy_filtersZfilter_r{ Z filter_config�headerZ target_opts�filter_options�targetZ filter_termsZterm_r| r~ r Zplatform_generatorZ policy_configr r r �_get_policy_object sR ��� r� �%Y/%m/%dc C s� t j �� �|�}g }| �� D ]:}d|v r!|sq|�dd|� d��}d|v r2|s(q|�dd|� d��}d|v rC|s9q|�dd|� d��}|�|� qd�|�S ) ad Refactor revision tag comments. Capirca generates the filter text having the following tag keys: - $Id:$ - $Revision:$ - $Date:$ This function goes through all the config lines and replaces those tags with the content requested by the user. If a certain value is not provided, the corresponding tag will be stripped. z$Id:$z$Id: z $z $Revision:$z $Revision: z$Date:$z$Date: � )�datetime�now�strftimerI �replacerM �join)�text� revision_id� revision_no� revision_date�revision_date_format� timestampZnew_textrP r r r � _revision_tag? s" r� c K sr g }|i i}|| � |� || � ti d| �ti d| �d�� |�|� |s(g }t| |||||||d|| | | d� S )a_ Return the configuration of a single policy term. platform The name of the Capirca platform. filter_name The name of the policy filter. term_name The name of the term. filter_options Additional filter options. These options are platform-specific. E.g.: ``inet6``, ``bridge``, ``object-group``, See the complete list of options_. .. _options: https://github.com/google/capirca/wiki/Policy-format#header-section pillar_key: ``acl`` The key in the pillar containing the default attributes values. Default: ``acl``. If the pillar contains the following structure: .. code-block:: yaml firewall: - my-filter: terms: - my-term: source_port: 1234 source_address: - 1.2.3.4/32 - 5.6.7.8/32 The ``pillar_key`` field would be specified as ``firewall``. pillarenv Query the master to generate fresh pillar data on the fly, specifically from the requested pillar environment. saltenv Included only for compatibility with :conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored. merge_pillar: ``True`` Merge the CLI variables with the pillar. Default: ``True``. revision_id Add a comment in the term config having the description for the changes applied. revision_no The revision count. revision_date: ``True`` Boolean flag: display the date when the term configuration was generated. Default: ``True``. revision_date_format: ``%Y/%m/%d`` The date format to be used when generating the perforce data. Default: ``%Y/%m/%d`` (<year>/<month>/<day>). source_service A special service to choose from. This is a helper so the user is able to select a source just using the name, instead of specifying a source_port and protocol. As this module is available on Unix platforms only, it reads the IANA_ port assignment from ``/etc/services``. If the user requires additional shortcuts to be referenced, they can add entries under ``/etc/services``, which can be managed using the :mod:`file state <salt.states.file>`. .. _IANA: http://www.iana.org/assignments/port-numbers destination_service A special service to choose from. This is a helper so the user is able to select a source just using the name, instead of specifying a destination_port and protocol. Allows the same options as ``source_service``. term_fields Term attributes. To see what fields are supported, please consult the list of supported keywords_. Some platforms have few other optional_ keywords. .. _keywords: https://github.com/google/capirca/wiki/Policy-format#keywords .. _optional: https://github.com/google/capirca/wiki/Policy-format#optionally-supported-keywords .. note:: The following fields are accepted: - action - address - address_exclude - comment - counter - expiration - destination_address - destination_address_exclude - destination_port - destination_prefix - forwarding_class - forwarding_class_except - logging - log_name - loss_priority - option - policer - port - precedence - principals - protocol - protocol_except - qos - pan_application - routing_instance - source_address - source_address_exclude - source_port - source_prefix - verbatim - packet_length - fragment_offset - hop_limit - icmp_type - ether_type - traffic_class_count - traffic_type - translated - dscp_set - dscp_match - dscp_except - next_ip - flexible_match_range - source_prefix_except - destination_prefix_except - vpn - source_tag - destination_tag - source_interface - destination_interface - flattened - flattened_addr - flattened_saddr - flattened_daddr - priority .. note:: The following fields can be also a single value and a list of values: - action - address - address_exclude - comment - destination_address - destination_address_exclude - destination_port - destination_prefix - forwarding_class - forwarding_class_except - logging - option - port - precedence - principals - protocol - protocol_except - pan_application - source_address - source_address_exclude - source_port - source_prefix - verbatim - icmp_type - ether_type - traffic_type - dscp_match - dscp_except - flexible_match_range - source_prefix_except - destination_prefix_except - source_tag - destination_tag - source_service - destination_service Example: ``destination_address`` can be either defined as: .. code-block:: yaml destination_address: 172.17.17.1/24 or as a list of destination IP addresses: .. code-block:: yaml destination_address: - 172.17.17.1/24 - 172.17.19.1/24 or a list of services to be matched: .. code-block:: yaml source_service: - ntp - snmp - ldap - bgpd .. note:: The port fields ``source_port`` and ``destination_port`` can be used as above to select either a single value, either a list of values, but also they can select port ranges. Example: .. code-block:: yaml source_port: - [1000, 2000] - [3000, 4000] With the configuration above, the user is able to select the 1000-2000 and 3000-4000 source port ranges. CLI Example: .. code-block:: bash salt '*' capirca.get_term_config arista filter-name term-name source_address=1.2.3.4 destination_address=5.6.7.8 action=accept Output Example: .. code-block:: text ! $Date: 2017/03/22 $ no ip access-list filter-name ip access-list filter-name remark term-name permit ip host 1.2.3.4 host 5.6.7.8 exit rZ r[ )rZ r[ T) r� r� rk ri rj r} �only_lower_merger� r� r� r� )rz rY rM �get_filter_config)r r{ r| r� rk ri rj r} r� r� r� r� rZ r[ r~ r� r r r r �get_term_configj s: } ��� �r� c C s� |sg }|sg }|r/| s/t |||d�}t||�}|p |�dd�}|r/|�dg �}t|||d�}g }|�|ti ||�|d�i� t| |||||d| | | | d� S ) a� Return the configuration of a policy filter. platform The name of the Capirca platform. filter_name The name of the policy filter. filter_options Additional filter options. These options are platform-specific. See the complete list of options_. .. _options: https://github.com/google/capirca/wiki/Policy-format#header-section terms List of terms for this policy filter. If not specified or empty, will try to load the configuration from the pillar, unless ``merge_pillar`` is set as ``False``. prepend: ``True`` When ``merge_pillar`` is set as ``True``, the final list of terms generated by merging the terms from ``terms`` with those defined in the pillar (if any): new terms are prepended at the beginning, while existing ones will preserve the position. To add the new terms at the end of the list, set this argument to ``False``. pillar_key: ``acl`` The key in the pillar containing the default attributes values. Default: ``acl``. pillarenv Query the master to generate fresh pillar data on the fly, specifically from the requested pillar environment. saltenv Included only for compatibility with :conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored. merge_pillar: ``True`` Merge the CLI variables with the pillar. Default: ``True``. only_lower_merge: ``False`` Specify if it should merge only the terms fields. Otherwise it will try to merge also filters fields. Default: ``False``. revision_id Add a comment in the filter config having the description for the changes applied. revision_no The revision count. revision_date: ``True`` Boolean flag: display the date when the filter configuration was generated. Default: ``True``. revision_date_format: ``%Y/%m/%d`` The date format to be used when generating the perforce data. Default: ``%Y/%m/%d`` (<year>/<month>/<day>). CLI Example: .. code-block:: bash salt '*' capirca.get_filter_config ciscoxr my-filter pillar_key=netacl Output Example: .. code-block:: text ! $Id:$ ! $Date:$ ! $Revision:$ no ipv4 access-list my-filter ipv4 access-list my-filter remark $Id:$ remark my-term deny ipv4 any eq 1234 any deny ipv4 any eq 1235 any remark my-other-term permit tcp any range 5678 5680 any exit The filter configuration has been loaded from the pillar, having the following structure: .. code-block:: yaml netacl: - my-filter: terms: - my-term: source_port: [1234, 1235] action: reject - my-other-term: source_port: - [5678, 5680] protocol: tcp action: accept �rj ri r� Nr� �rt )r� r� T) r' rk ri rj r} r� r� r� r� r� )rm rg r� r] rv rM rY �get_policy_config)r r{ r� r� rt rk ri rj r} r� r� r� r� r� Zacl_pillar_cfg�filter_pillar_cfgZ pillar_termsr' r r r r� � sH o� � ����r� c C sZ |sg }|r|st |||d�} t|| |d�}t| |||||d�} t| �}t||| | | d�S )a� Return the configuration of the whole policy. platform The name of the Capirca platform. filters List of filters for this policy. If not specified or empty, will try to load the configuration from the pillar, unless ``merge_pillar`` is set as ``False``. prepend: ``True`` When ``merge_pillar`` is set as ``True``, the final list of filters generated by merging the filters from ``filters`` with those defined in the pillar (if any): new filters are prepended at the beginning, while existing ones will preserve the position. To add the new filters at the end of the list, set this argument to ``False``. pillar_key: ``acl`` The key in the pillar containing the default attributes values. Default: ``acl``. pillarenv Query the master to generate fresh pillar data on the fly, specifically from the requested pillar environment. saltenv Included only for compatibility with :conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored. merge_pillar: ``True`` Merge the CLI variables with the pillar. Default: ``True``. only_lower_merge: ``False`` Specify if it should merge only the filters and terms fields. Otherwise it will try to merge everything at the policy level. Default: ``False``. revision_id Add a comment in the policy config having the description for the changes applied. revision_no The revision count. revision_date: ``True`` Boolean flag: display the date when the policy configuration was generated. Default: ``True``. revision_date_format: ``%Y/%m/%d`` The date format to be used when generating the perforce data. Default: ``%Y/%m/%d`` (<year>/<month>/<day>). CLI Example: .. code-block:: bash salt '*' capirca.get_policy_config juniper pillar_key=netacl Output Example: .. code-block:: text firewall { family inet { replace: /* ** $Id:$ ** $Date:$ ** $Revision:$ ** */ filter my-filter { term my-term { from { source-port [ 1234 1235 ]; } then { reject; } } term my-other-term { from { protocol tcp; source-port 5678-5680; } then accept; } } } } firewall { family inet { replace: /* ** $Id:$ ** $Date:$ ** $Revision:$ ** */ filter my-other-filter { interface-specific; term dummy-term { from { protocol [ tcp udp ]; } then { reject; } } } } } The policy configuration has been loaded from the pillar, having the following structure: .. code-block:: yaml netacl: - my-filter: options: - not-interface-specific terms: - my-term: source_port: [1234, 1235] action: reject - my-other-term: source_port: - [5678, 5680] protocol: tcp action: accept - my-other-filter: terms: - dummy-term: protocol: - tcp - udp action: reject r� r� )r' rk ri rj r} )r� r� r� r� )rm rv r� r\ r� )r r' rt rk ri rj r} r� r� r� r� r� Zpolicy_pillar_cfgZ policy_objectZ policy_textr r r r� s0 ���r� c C s t |||d�}t|| �S )a� Helper that can be used inside a state SLS, in order to get the filter configuration given its name. filter_name The name of the filter. pillar_key The root key of the whole policy config. pillarenv Query the master to generate fresh pillar data on the fly, specifically from the requested pillar environment. saltenv Included only for compatibility with :conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored. rh )rm rg )r{ rk ri rj rl r r r �get_filter_pillar� s r� c C s* t | |||d�}|�dg �}t||�}|S )aw Helper that can be used inside a state SLS, in order to get the term configuration given its name, under a certain filter uniquely identified by its name. filter_name The name of the filter. term_name The name of the term. pillar_key: ``acl`` The root key of the whole policy config. Default: ``acl``. pillarenv Query the master to generate fresh pillar data on the fly, specifically from the requested pillar environment. saltenv Included only for compatibility with :conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored. )rk ri rj r� )r� r] rg )r{ r| rk ri rj r� Zterm_pillar_cfgr` r r r ry � s � ry )NN)T)rw NNT)Nrw NNT)NNTr� ) Nrw NNTNNTr� NN) NNTrw NNTFNNTr� ) NTrw NNTFNNTr� )rw NN)7r. r� r8 r rG Zsalt.utils.filesrB � getLogger�__file__r6 r Zcapirca.aclgenZcapirca.lib.aclgeneratorZcapirca.lib.policyr � ImportErrorr Z__proxyenabled__r r1 r^ rA r; r_ ZTermZ _TempTermr r3 Z dumy_term�dir�item�hasattr� startswith�lower�getattr�Policyr% r0 r> rQ rR rY rb rg rm rn rv r� r� r� r� r� r� r� ry r r r r �<module> s� ��������� � � � � ��������������� � � � � �!�"�#�$�%�&�'�(�)�*�+�,�-�.�/�0�1�2�3�4�D & 0 1I . �/ �7 �/ � � � 2�
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings