Current File : //usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyc
�
���^c
@@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z e j e
� Z d d l m
Z
y: d d l Z d d l Z d d l Z d d l Z e Z Wn e k
r� e Z n Xd d l Z d Z d g Z d � Z i= g d 6g d 6g d
6g d 6e d 6e d
6g d 6g d 6g d 6g d 6g d 6g d 6g d 6e d 6e d 6g d 6e d 6e d 6g d 6g d 6g d 6g d 6g d 6e d 6g d 6e d! 6g d" 6g d# 6g d$ 6g d% 6g d& 6e d' 6e d( 6e d) 6g d* 6e d+ 6g d, 6e d- 6g d. 6e d/ 6e d0 6g d1 6g d2 6e d3 6g d4 6g d5 6g d6 6e d7 6g d8 6g d9 6e d: 6e d; 6g d< 6g d= 6e d> 6e d? 6e d@ 6e dA 6e dB 6e dC 6e dD 6Z d" d# d d d
d@ dA dB d3 g Z i Z e r�e j j j! Z" dE � Z# e$ e" dF e# � e" e � Z% x] e& e% � D]O Z' e( e' dG � p;e' j) dH � p;e' e' j* � k rDqn e+ e% e' � e e' <qWdI e j j j, f dJ � � YZ- dK e j j j! f dL � � YZ. n dM � Z/ dN � Z0 dO � Z1 dP � Z2 dQ � Z3 dR � Z4 e e dS � Z5 dT � Z6 e dU � Z7 dV e e e dW � Z8 e dV e e e dX � Z9 e e e dY dZ � Z: e dV e e e e e e dY e e d[ � Z; e e e dV e e e e e e e dY d\ � Z< e e dV e e e e e e e dY d] � Z= dV e e d^ � Z> dV e e d_ � Z? d S(` u�
Capirca ACL
===========
Generate ACL (firewall) configuration for network devices.
.. versionadded:: 2017.7.0
:codeauthor: Mircea Ulinic <mircea@cloudflare.com> & Robert Ankeny <robankeny@google.com>
:maturity: new
:depends: capirca
:platform: unix
Dependencies
------------
The firewall configuration is generated by Capirca_.
.. _Capirca: https://github.com/google/capirca
To install Capirca, execute: ``pip install capirca``.
i ( t absolute_importt print_functiont unicode_literalsN( t sixu capircau *c C@ s t r
t St d f Sd S( u8
This module requires at least Capirca to work.
u2 The capirca module (capirca_acl) cannot be loaded.N( t HAS_CAPIRCAt __virtualname__t False( ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt __virtual__< s u actionu addressu address_excludeu commentu counteru
expirationu destination_addressu destination_address_excludeu destination_portu destination_prefixu forwarding_classu forwarding_class_exceptu loggingu log_nameu
loss_priorityu optionu owneru policeru portu
precedenceu
principalsu protocolu protocol_exceptu qosu pan_applicationu routing_instanceu source_addressu source_address_excludeu source_portu
source_prefixu verbatimu
packet_lengthu fragment_offsetu hop_limitu icmp_typeu icmp_codeu
ether_typeu traffic_class_countu traffic_typeu
translatedu dscp_setu
dscp_matchu dscp_exceptu next_ipu flexible_match_rangeu source_prefix_exceptu destination_prefix_exceptu vpnu
source_tagu destination_tagu source_interfaceu destination_interfaceu platformu platform_excludeu timeoutu flattenedu flattened_addru flattened_saddru flattened_daddru priorityu ttlc C@ s d S( N( ( t selft obj( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _add_object� s u AddObjectu __func__u _t _Policyc B@ s e Z d Z d � Z RS( uW
Extending the Capirca Policy class to allow inserting custom filters.
c C@ s g | _ d | _ d S( Nu ( t filterst filename( R ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt __init__� s ( t __name__t
__module__t __doc__R ( ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyR � s t _Termc B@ s e Z d Z d � Z RS( u\
Extending the Capirca Term class to allow setting field valued on the fly.
c C@ s4 x- t j t � D] \ } } t | | | � q Wd S( N( R t iteritemst _TERM_FIELDSt setattr( R t fieldt default( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyR � s ( R R R R ( ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyR � s c
C@ s� t j d j d | � � x� t j t j � D]� \ } } | | k r, t j | � r, xj t j | � D]V \ } } t j | � rc t | t j
j j � rc t j d j d | d | � � | Sqc Wq, q, Wt j
d j d | � � d S( u�
Given a specific platform (under the Capirca conventions),
return the generator class.
The generator class is identified looking under the <platform> module
for a class inheriting the `ACLGenerator` class.
u Using platform: {plat}t platu) Identified Capirca class {cls} for {plat}t clsu7 Unable to identify any Capirca plaform class for {plat}N( t logt debugt formatt inspectt
getmemberst capircat aclgent ismodulet isclasst
issubclasst libt aclgeneratort ACLGeneratort error( t platformt mod_namet mod_objt
plat_obj_namet plat_obj( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _import_platform_generator� s '
c C@ s� t r
t Sd } y@ t j j j d d � �" } t j j j | j � � } Wd QXWn. t k
r� } t j
d � t j
| � t SXt j d � } x
| j
� D]� } | j | � } | r� t | j � � d k r� | j � \ } } } } | t k ri g d 6g d 6t | <n y t | d j t | � � WnS t k
r�}
t j
|
� t j
d
� t j
| � t j
d j d | � � n Xt | d j | � q� q� Wt S(
ur
Build a map of services based on the IANA assignment list:
http://www.iana.org/assignments/port-numbers
It will load the /etc/services file and will build the mapping on the fly,
similar to the Capirca's SERVICES file:
https://github.com/google/capirca/blob/master/def/SERVICES.svc
As this module is be available on Unix systems only,
we'll read the services from /etc/services.
In the worst case, the user will not be able to specify the
services shortcut and they will need to specify the protocol / port combination
using the source_port / destination_port & protocol fields.
u u
/etc/servicesu rNu" Unable to read from /etc/services:u( ^([a-zA-Z0-9-]+)\s+(\d+)\/(tcp|udp)(.*)$i u portu protocolu Did not read that properly:uG Please report the above error: {port} does not seem a valid port value!t port( t _SERVICESt saltt utilst filest fopent stringutilst
to_unicodet readt IOErrorR R' t ret compilet
splitlinest searcht lent groupst appendt intt
ValueErrorR ( t services_txtt srv_ft ioet service_rgxt linet
service_rgx_st srv_nameR. t protocolt _t verr( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _get_services_mapping� s8 %
c C@ s7 t � } | | k r3 | | d r3 | | d d S| S( ub
Look into services and return the port value using the
service name as lookup value.
u porti ( RK ( R. t services( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _translate_port s c C@ s� g } | | k r | | } n | d k r/ | St | t t f � r9| d k r g } xF | D]> } t | t t f � s� | j | | f � q] | j | � q] Wg } xc | D][ \ } } t | t � s� t | � } n t | t � s� t | � } n | j | | f � q� Wt t | | � � St t | t | � � � S| d k r�t | t � sct | � } n t t | | | f g � � St t | | g � � S( u!
Return the object list.
u source_portu destination_portN( u source_portu destination_port( u source_portu destination_port( t Nonet
isinstancet tuplet listR> R? RM t set( t dict_t
field_namet valuet
prev_valuet portvalR. t translated_portvalt
port_startt port_end( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt
_make_it_list s6
c
C@ s� i } t � } x�t j | � D]�\ } } | d k r)| r)t | t j � rd t | | | � } n t j d � t j | � x_ | D]W } | r� | | k r� t | d | | d � | d <t | d | | d � | d <q� q� Wt j d � t j | j d � � t j d � t j | j d � � q | d k r'| r't | t j � rbt | | | � } n t j d � t j | � x_ | D]W } | r�| | k r�t | d
| | d � | d
<t | d | | d � | d <q�q�Wt j d � t j | j d � � t j d � t j | j d � � q | t k r | r | t | k r t t | t
� rqt | | | � } n | t k r�g } xH | D]@ } t j r�t j
| � } n | j t j j j j | � � q�W| } n | | | <q q W| S(
u�
Cleanup the term opts:
- strip Null and empty valuee, defaulting their value to their base definition from _TERM_FIELDS
- convert to `nacaddr.IP` fields from `_IP_FILEDS`
- create lists for those fields requiring it
u source_serviceu# Processing special source services:u source_portu portu protocoluB Built source_port field, after processing special source services:u? Built protocol field, after processing special source services:u destination_serviceu( Processing special destination services:u destination_portuG Built source_port field, after processing special destination services:uD Built protocol field, after processing special destination services:( RK R R RO t string_typesR[ R R t getR RQ t
_IP_FILEDSt PY2t text_typeR> R R$ t policyt nacaddrt IP( t term_optst
clean_optst _servicesR RU t servicet ip_valuest addr( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _clean_term_optsE sb
"
#
c C@ s` | s
i SxO | D]G } | s t | t � r4 q n | j � d | k r | j � d Sq Wi S( uK
Find an dictionary in a list of dictionaries, given its main key.
i ( RO t dictt keyst values( t lstt keyt ele( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _lookup_element� s
c C@ s t d | d | d | �} | S( u>
Retrieve the pillar data from the right environment.
u
pillar.gett pillarenvt saltenv( t __salt__( t
pillar_keyRr Rs t
pillar_cfg( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _get_pillar_cfg� s
c C@ s@ g } x3 | D]+ } | r
t | t � r
| j | � q
q
W| S( u2
Return a list of non-empty dictionaries.
( RO Rk R> ( Rn t cleanRp ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _cleanup� s
c C@ sA t | � } t | � } | r* | r* g S| r; | r; | S| rL | rL | Sg } g } g } xc | D][ } t | | j � d � r� | j | � qe | r� | j | � qe | se | j | � qe qe Wx` | D]X } | j � d } t | | � rt | | � } | j i | | 6� q� | j | � q� W| s=| j | � n | S( u<
Merge lists of dictionaries.
Each element of the list is a dictionary having one single key.
That key is then used as unique lookup.
The first element list has higher priority than the second.
When there's an overlap between the two lists,
it won't change the position, but the content.
i ( Ry Rq Rl R> t extend( t firstt secondt prependt overlapst mergedt appendedRp t ele_keyt
ele_val_first( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _merge_list_of_dict� s6
u aclc K@ s_ t j d j d | d | � � t � } | | _ i } | r� t | | d | d | d | �} t j d � t j | � t | � } t j d � t j | � n t j d � t j | � t j d
� t | � } t j | � t j d � | j | � t j | � x- t j | � D] \ } }
t
| | |
� qWt j d � t j t j | � � | S(
uK
Return an instance of the ``_Term`` class given the term options.
u7 Generating config for term {tname} under filter {fname}t tnamet fnameRu Rs Rr u Merging with pillar data:u Cleaning up pillar data:u Received processing opts:u Cleaning up processing opts:u Final term opts:u Term config:( R R R R t namet get_term_pillarRj t updateR R R R` ( t filter_namet term_nameRu Rr Rs t merge_pillart term_fieldst termRd R RU ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _get_term_object� s<
c C@ s t � } g } | s g } n xj| D]b} | s% t | t � rH q% n | j � d } | j � d }
t j j j � } | | g } |
j d d � }
|
r� t i | |
� }
| j |
� n t j j j
| � } | j | � g } x� |
j d g � D]u } | rct | t � rc| j � d } | j � d } t | | d | d | d | d | | �} n | j | � q� W| j | | f � q% W| | _ t j d � t j t j | � � t | � } | | d � } t j d
j d | � � t j t j | � � | S(
uO
Return an instance of the ``_Policy`` class given the filters config.
i u optionsu termsRu Rr Rs R� u Policy config:i u( Generating policy config for {platform}:R( N( R RO Rk Rl Rm R R$ Ra t Headert popRN R[ Rz t Targett AddObjectR] R� R> R R R R R` R- R ( R( R Ru Rr Rs R� Ra t policy_filterst filter_R� t
filter_configt headert target_optst filter_optionst targett filter_termst term_R� R� R� t platform_generatort
policy_config( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt _get_policy_object sT
u %Y/%m/%dc C@ s� t j j � j | � } g } x� | j � D]� } d | k rj | sI q+ n | j d d j d | � � } n d | k r� | s� q+ n | j d d j d | � � } n d | k r� | s� q+ n | j d d j d | � � } n | j | � q+ Wd
j | � S( ud
Refactor revision tag comments.
Capirca generates the filter text having the following tag keys:
- $Id:$
- $Revision:$
- $Date:$
This function goes through all the config lines and replaces
those tags with the content requested by the user.
If a certain value is not provided, the corresponding tag will be stripped.
u $Id:$u $Id: {rev_id} $t rev_idu $Revision:$u $Revision: {rev_no} $t rev_nou $Date:$u
$Date: {ts} $t tsu
( t datetimet nowt strftimeR: t replaceR R> t join( t textt revision_idt revision_not
revision_datet revision_date_formatt timestampt new_textRE ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt
_revision_tag@ s" ! ! !c K@ s� g } i i | 6} | | j | � | | j i t i d | � d 6t i d |
� d 6� | j | � | sw g } n t | | d | d | d | d | d | d | d t d
| d | d |
d
| � S( u_
Return the configuration of a single policy term.
platform
The name of the Capirca platform.
filter_name
The name of the policy filter.
term_name
The name of the term.
filter_options
Additional filter options. These options are platform-specific.
E.g.: ``inet6``, ``bridge``, ``object-group``,
See the complete list of options_.
.. _options: https://github.com/google/capirca/wiki/Policy-format#header-section
pillar_key: ``acl``
The key in the pillar containing the default attributes values. Default: ``acl``.
If the pillar contains the following structure:
.. code-block:: yaml
firewall:
- my-filter:
terms:
- my-term:
source_port: 1234
source_address:
- 1.2.3.4/32
- 5.6.7.8/32
The ``pillar_key`` field would be specified as ``firewall``.
pillarenv
Query the master to generate fresh pillar data on the fly,
specifically from the requested pillar environment.
saltenv
Included only for compatibility with
:conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored.
merge_pillar: ``True``
Merge the CLI variables with the pillar. Default: ``True``.
revision_id
Add a comment in the term config having the description for the changes applied.
revision_no
The revision count.
revision_date: ``True``
Boolean flag: display the date when the term configuration was generated. Default: ``True``.
revision_date_format: ``%Y/%m/%d``
The date format to be used when generating the perforce data. Default: ``%Y/%m/%d`` (<year>/<month>/<day>).
source_service
A special service to choose from. This is a helper so the user is able to
select a source just using the name, instead of specifying a source_port and protocol.
As this module is available on Unix platforms only,
it reads the IANA_ port assignment from ``/etc/services``.
If the user requires additional shortcuts to be referenced, they can add entries under ``/etc/services``,
which can be managed using the :mod:`file state <salt.states.file>`.
.. _IANA: http://www.iana.org/assignments/port-numbers
destination_service
A special service to choose from. This is a helper so the user is able to
select a source just using the name, instead of specifying a destination_port and protocol.
Allows the same options as ``source_service``.
term_fields
Term attributes.
To see what fields are supported, please consult the list of supported keywords_.
Some platforms have few other optional_ keywords.
.. _keywords: https://github.com/google/capirca/wiki/Policy-format#keywords
.. _optional: https://github.com/google/capirca/wiki/Policy-format#optionally-supported-keywords
.. note::
The following fields are accepted:
- action
- address
- address_exclude
- comment
- counter
- expiration
- destination_address
- destination_address_exclude
- destination_port
- destination_prefix
- forwarding_class
- forwarding_class_except
- logging
- log_name
- loss_priority
- option
- policer
- port
- precedence
- principals
- protocol
- protocol_except
- qos
- pan_application
- routing_instance
- source_address
- source_address_exclude
- source_port
- source_prefix
- verbatim
- packet_length
- fragment_offset
- hop_limit
- icmp_type
- ether_type
- traffic_class_count
- traffic_type
- translated
- dscp_set
- dscp_match
- dscp_except
- next_ip
- flexible_match_range
- source_prefix_except
- destination_prefix_except
- vpn
- source_tag
- destination_tag
- source_interface
- destination_interface
- flattened
- flattened_addr
- flattened_saddr
- flattened_daddr
- priority
.. note::
The following fields can be also a single value and a list of values:
- action
- address
- address_exclude
- comment
- destination_address
- destination_address_exclude
- destination_port
- destination_prefix
- forwarding_class
- forwarding_class_except
- logging
- option
- port
- precedence
- principals
- protocol
- protocol_except
- pan_application
- source_address
- source_address_exclude
- source_port
- source_prefix
- verbatim
- icmp_type
- ether_type
- traffic_type
- dscp_match
- dscp_except
- flexible_match_range
- source_prefix_except
- destination_prefix_except
- source_tag
- destination_tag
- source_service
- destination_service
Example: ``destination_address`` can be either defined as:
.. code-block:: yaml
destination_address: 172.17.17.1/24
or as a list of destination IP addresses:
.. code-block:: yaml
destination_address:
- 172.17.17.1/24
- 172.17.19.1/24
or a list of services to be matched:
.. code-block:: yaml
source_service:
- ntp
- snmp
- ldap
- bgpd
.. note::
The port fields ``source_port`` and ``destination_port`` can be used as above to select either
a single value, either a list of values, but also they can select port ranges. Example:
.. code-block:: yaml
source_port:
- [1000, 2000]
- [3000, 4000]
With the configuration above, the user is able to select the 1000-2000 and 3000-4000 source port ranges.
CLI Example:
.. code-block:: bash
salt '*' capirca.get_term_config arista filter-name term-name source_address=1.2.3.4 destination_address=5.6.7.8 action=accept
Output Example:
.. code-block:: text
! $Date: 2017/03/22 $
no ip access-list filter-name
ip access-list filter-name
remark term-name
permit ip host 1.2.3.4 host 5.6.7.8
exit
u source_serviceu destination_serviceR� t termsRu Rr Rs R� t only_lower_mergeR� R� R� R� ( R� R[ R> t get_filter_configt True( R( R� R� R� Ru Rr Rs R� R� R� R� R� t source_servicet destination_serviceR� R� R� ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt get_term_configh s. �
c C@ s | s g } n | s g } n | r� | r� t | d | d | �} t | | � } | pg | j d d � } | r� | j d g � } t | | d | �} q� n g } | j i i t i | | � d 6| d 6| 6� t | d | d | d | d | d | d t d
|
d | d | d
|
�
S( u�
Return the configuration of a policy filter.
platform
The name of the Capirca platform.
filter_name
The name of the policy filter.
filter_options
Additional filter options. These options are platform-specific.
See the complete list of options_.
.. _options: https://github.com/google/capirca/wiki/Policy-format#header-section
terms
List of terms for this policy filter.
If not specified or empty, will try to load the configuration from the pillar,
unless ``merge_pillar`` is set as ``False``.
prepend: ``True``
When ``merge_pillar`` is set as ``True``, the final list of terms generated by merging
the terms from ``terms`` with those defined in the pillar (if any): new terms are prepended
at the beginning, while existing ones will preserve the position. To add the new terms
at the end of the list, set this argument to ``False``.
pillar_key: ``acl``
The key in the pillar containing the default attributes values. Default: ``acl``.
pillarenv
Query the master to generate fresh pillar data on the fly,
specifically from the requested pillar environment.
saltenv
Included only for compatibility with
:conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored.
merge_pillar: ``True``
Merge the CLI variables with the pillar. Default: ``True``.
only_lower_merge: ``False``
Specify if it should merge only the terms fields. Otherwise it will try
to merge also filters fields. Default: ``False``.
revision_id
Add a comment in the filter config having the description for the changes applied.
revision_no
The revision count.
revision_date: ``True``
Boolean flag: display the date when the filter configuration was generated. Default: ``True``.
revision_date_format: ``%Y/%m/%d``
The date format to be used when generating the perforce data. Default: ``%Y/%m/%d`` (<year>/<month>/<day>).
CLI Example:
.. code-block:: bash
salt '*' capirca.get_filter_config ciscoxr my-filter pillar_key=netacl
Output Example:
.. code-block:: text
! $Id:$
! $Date:$
! $Revision:$
no ipv4 access-list my-filter
ipv4 access-list my-filter
remark $Id:$
remark my-term
deny ipv4 any eq 1234 any
deny ipv4 any eq 1235 any
remark my-other-term
permit tcp any range 5678 5680 any
exit
The filter configuration has been loaded from the pillar, having the following structure:
.. code-block:: yaml
netacl:
- my-filter:
terms:
- my-term:
source_port: [1234, 1235]
action: reject
- my-other-term:
source_port:
- [5678, 5680]
protocol: tcp
action: accept
Rs Rr u optionsu termsR} R Ru R� R� R� R� R� R� N(
Rw Rq R� RN R] R� R> R[ t get_policy_configR� ( R( R� R� R� R} Ru Rr Rs R� R� R� R� R� R� t acl_pillar_cfgt filter_pillar_cfgt pillar_termsR ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyR� ~ s: m
c
C@ s� | s g } n | rL | rL t | d | d | �} t | | d | �} n t | d | d | d | d | d | �}
t j |
� } t | d | d | d |
d
| �S( u�
Return the configuration of the whole policy.
platform
The name of the Capirca platform.
filters
List of filters for this policy.
If not specified or empty, will try to load the configuration from the pillar,
unless ``merge_pillar`` is set as ``False``.
prepend: ``True``
When ``merge_pillar`` is set as ``True``, the final list of filters generated by merging
the filters from ``filters`` with those defined in the pillar (if any): new filters are prepended
at the beginning, while existing ones will preserve the position. To add the new filters
at the end of the list, set this argument to ``False``.
pillar_key: ``acl``
The key in the pillar containing the default attributes values. Default: ``acl``.
pillarenv
Query the master to generate fresh pillar data on the fly,
specifically from the requested pillar environment.
saltenv
Included only for compatibility with
:conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored.
merge_pillar: ``True``
Merge the CLI variables with the pillar. Default: ``True``.
only_lower_merge: ``False``
Specify if it should merge only the filters and terms fields. Otherwise it will try
to merge everything at the policy level. Default: ``False``.
revision_id
Add a comment in the policy config having the description for the changes applied.
revision_no
The revision count.
revision_date: ``True``
Boolean flag: display the date when the policy configuration was generated. Default: ``True``.
revision_date_format: ``%Y/%m/%d``
The date format to be used when generating the perforce data. Default: ``%Y/%m/%d`` (<year>/<month>/<day>).
CLI Example:
.. code-block:: bash
salt '*' capirca.get_policy_config juniper pillar_key=netacl
Output Example:
.. code-block:: text
firewall {
family inet {
replace:
/*
** $Id:$
** $Date:$
** $Revision:$
**
*/
filter my-filter {
term my-term {
from {
source-port [ 1234 1235 ];
}
then {
reject;
}
}
term my-other-term {
from {
protocol tcp;
source-port 5678-5680;
}
then accept;
}
}
}
}
firewall {
family inet {
replace:
/*
** $Id:$
** $Date:$
** $Revision:$
**
*/
filter my-other-filter {
interface-specific;
term dummy-term {
from {
protocol [ tcp udp ];
}
then {
reject;
}
}
}
}
}
The policy configuration has been loaded from the pillar, having the following structure:
.. code-block:: yaml
netacl:
- my-filter:
options:
- not-interface-specific
terms:
- my-term:
source_port: [1234, 1235]
action: reject
- my-other-term:
source_port:
- [5678, 5680]
protocol: tcp
action: accept
- my-other-filter:
terms:
- dummy-term:
protocol:
- tcp
- udp
action: reject
Rs Rr R} R Ru R� R� R� R� R� ( Rw R� R� R R` R� ( R( R R} Ru Rr Rs R� R� R� R� R� R� t policy_pillar_cfgt
policy_objectt policy_text( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyR� s& �
c C@ s% t | d | d | �} t | | � S( u�
Helper that can be used inside a state SLS,
in order to get the filter configuration given its name.
filter_name
The name of the filter.
pillar_key
The root key of the whole policy config.
pillarenv
Query the master to generate fresh pillar data on the fly,
specifically from the requested pillar environment.
saltenv
Included only for compatibility with
:conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored.
Rr Rs ( Rw Rq ( R� Ru Rr Rs Rv ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt get_filter_pillar� s c C@ sC t | d | d | d | �} | j d g � } t | | � } | S( uw
Helper that can be used inside a state SLS,
in order to get the term configuration given its name,
under a certain filter uniquely identified by its name.
filter_name
The name of the filter.
term_name
The name of the term.
pillar_key: ``acl``
The root key of the whole policy config. Default: ``acl``.
pillarenv
Query the master to generate fresh pillar data on the fly,
specifically from the requested pillar environment.
saltenv
Included only for compatibility with
:conf_minion:`pillarenv_from_saltenv`, and is otherwise ignored.
Ru Rr Rs u terms( R� R] Rq ( R� R� Ru Rr Rs R� t term_pillar_cfgRd ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyR� � s (@ R t
__future__R R R R8 R t loggingR� t getLoggert __file__R t salt.extR R t capirca.aclgent capirca.lib.policyt capirca.lib.aclgeneratorR� R t ImportErrorR t salt.utils.filesR0 R t __proxyenabled__R RN R R^ R/ R$ Ra t Termt _TempTermR
R t dumy_termt dirt itemt hasattrt
startswitht lowert getattrt PolicyR R R- RK RM R[ Rj Rq Rw Ry R� R� R� R� R� R� R� R� R� ( ( ( s< /usr/lib/python2.7/site-packages/salt/modules/capirca_acl.pyt <module> sL
0 " / 3 F
- ( 5 ' � � �
Mini Shell