Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capirca doesn't render established keyword for Cisco object-group syntax #186

Open
mpenning opened this issue May 30, 2020 · 0 comments
Open

Comments

@mpenning
Copy link
Contributor

When using Cisco's object-group option, the established keyword is not rendered... you can reproduce with this script

from capirca.lib.policy import ParsePolicy
from capirca.lib.naming import Naming

from capirca.lib.cisco import Cisco

defs = Naming()
defs.ParseServiceList([
    'SVC1 = 80/tcp 443/tcp',
    'SVC2 = 25/tcp',
    'ALL_SVC = SVC1 SVC2',
    ])
defs.ParseNetworkList([
    'LAN1 = 172.16.1.0/24',
    'LAN2 = 172.16.2.0/24',
    'LAN = LAN1 LAN2',
    ])

acl ="""
header {
  comment:: "Demo of capirca acl DSL"
  target:: cisco ACL_IN object-group
}
term test-permit-established {
  protocol:: tcp
  option:: tcp-established
  action:: accept
}
term allow-to-lan {
  destination-address:: LAN
  protocol:: tcp
  source-port:: ALL_SVC
  action:: accept
}
"""

pp = ParsePolicy(acl, defs)
cisco_acl = Cisco(pp, exp_info=0)
print(cisco_acl)

When I run this (capirca version 1.122 and python 3.7.0) the established keyword is not rendered under test-render-established...

object-group network ipv4 LAN
 172.16.1.0/24
 172.16.2.0/24
exit

object-group port 25-25
 eq 25
exit

object-group port 80-80
 eq 80
exit

object-group port 443-443
 eq 443
exit

! $Id:$
! $Date:$
! $Revision:$
no ip access-list extended ACL_IN
ip access-list extended ACL_IN
 remark $Id:$
 remark Demo of capirca acl DSL


 remark test-permit-established
 permit tcp any any


 remark allow-to-lan
 permit tcp any port-group 25-25 net-group LAN
 permit tcp any port-group 80-80 net-group LAN
 permit tcp any port-group 443-443 net-group LAN

exit

If I change the script to use Cisco extended, the established keyword is correctly rendered.

@mpenning mpenning changed the title Capirca doesn't render established keyword for object-group syntax Capirca doesn't render established keyword for Cisco object-group syntax May 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant