def testManyDestinationAddresses(self): self.naming.GetNetAddr.return_value = [ nacaddr.IPv4('172.16.0.0/24'), nacaddr.IPv4('172.17.0.0/24') ] acl = ipset.Ipset( policy.ParsePolicy(GOOD_HEADER_1 + GOOD_TERM_2, self.naming), EXP_INFO) result = str(acl) self.assertIn( 'create good-term-2-dst hash:net family inet hashsize ' '4 maxelem 4', result) self.assertIn('add good-term-2-dst 172.16.0.0/24', result) self.assertIn('add good-term-2-dst 172.17.0.0/24', result) self.assertIn('-m set --match-set good-term-2-dst dst', result) self.assertNotIn('-s ', result) self.naming.GetNetAddr.assert_called_once_with('EXTERNAL')
def testManySourceAddresses(self): self.naming.GetNetAddr.return_value = [ nacaddr.IPv4('10.0.0.0/24'), nacaddr.IPv4('10.1.0.0/24') ] acl = ipset.Ipset( policy.ParsePolicy(GOOD_HEADER_1 + GOOD_TERM_1, self.naming), EXP_INFO) result = str(acl) self.assertIn( 'create good-term-1-src hash:net family inet hashsize' ' 4 maxelem 4', result) self.assertIn('add good-term-1-src 10.0.0.0/24', result) self.assertIn('add good-term-1-src 10.1.0.0/24', result) self.assertIn('-m set --match-set good-term-1-src src', result) self.assertNotIn('-s ', result) self.naming.GetNetAddr.assert_called_once_with('INTERNAL')
def testManySourceAndDestinationAddresses(self): self.naming.GetNetAddr('INTERNAL').InAnyOrder().AndReturn( [nacaddr.IPv4('10.0.0.0/24'), nacaddr.IPv4('10.1.0.0/24')]) self.naming.GetNetAddr('EXTERNAL').InAnyOrder().AndReturn( [nacaddr.IPv4('172.16.0.0/24'), nacaddr.IPv4('172.17.0.0/24')]) self.mox.ReplayAll() acl = ipset.Ipset(policy.ParsePolicy(GOOD_HEADER_1 + GOOD_TERM_3, self.naming), EXP_INFO) result = str(acl) self.assertIn('create good-term-3-src hash:net family inet hashsize ' '4 maxelem 4', result) self.assertIn('create good-term-3-dst hash:net family inet hashsize ' '4 maxelem 4', result) self.assertIn('add good-term-3-src 10.0.0.0/24', result) self.assertIn('add good-term-3-src 10.1.0.0/24', result) self.assertIn('add good-term-3-dst 172.16.0.0/24', result) self.assertIn('add good-term-3-dst 172.17.0.0/24', result) self.assertIn('-m set --match-set good-term-3-src src', result) self.assertIn('-m set --match-set good-term-3-dst dst', result) self.assertNotIn('-s ', result) self.assertNotIn('-d ', result)
def testManySourceAndDestinationAddresses(self): self.naming.GetNetAddr.side_effect = [ [nacaddr.IPv4('10.0.0.0/24'), nacaddr.IPv4('10.1.0.0/24')], [nacaddr.IPv4('172.16.0.0/24'), nacaddr.IPv4('172.17.0.0/24')]] acl = ipset.Ipset(policy.ParsePolicy(GOOD_HEADER_1 + GOOD_TERM_3, self.naming), EXP_INFO) result = str(acl) self.assertIn('create good-term-3-src hash:net family inet hashsize ' '4 maxelem 4', result) self.assertIn('create good-term-3-dst hash:net family inet hashsize ' '4 maxelem 4', result) self.assertIn('add good-term-3-src 10.0.0.0/24', result) self.assertIn('add good-term-3-src 10.1.0.0/24', result) self.assertIn('add good-term-3-dst 172.16.0.0/24', result) self.assertIn('add good-term-3-dst 172.17.0.0/24', result) self.assertIn('-m set --match-set good-term-3-src src', result) self.assertIn('-m set --match-set good-term-3-dst dst', result) self.assertNotIn('-s ', result) self.assertNotIn('-d ', result) self.naming.GetNetAddr.assert_has_calls([ mock.call('INTERNAL'), mock.call('EXTERNAL')])
def RenderFile(input_file, output_directory, definitions, exp_info, write_files): """Render a single file. Args: input_file: the name of the input policy file. output_directory: the directory in which we place the rendered file. definitions: the definitions from naming.Naming(). exp_info: print a info message when a term is set to expire in that many weeks. write_files: a list of file tuples, (output_file, acl_text), to write """ logging.debug('rendering file: %s into %s', input_file, output_directory) pol = None jcl = False acl = False asacl = False aacl = False bacl = False eacl = False gcefw = False ips = False ipt = False spd = False nsx = False pcap_accept = False pcap_deny = False pf = False srx = False jsl = False nft = False win_afw = False xacl = False paloalto = False try: conf = open(input_file).read() logging.debug('opened and read %s', input_file) except IOError as e: logging.warn('bad file: \n%s', e) raise try: pol = policy.ParsePolicy(conf, definitions, optimize=FLAGS.optimize, base_dir=FLAGS.base_directory, shade_check=FLAGS.shade_check) except policy.ShadingError as e: logging.warn('shading errors for %s:\n%s', input_file, e) return except (policy.Error, naming.Error): raise ACLParserError( 'Error parsing policy file %s:\n%s%s' % (input_file, sys.exc_info()[0], sys.exc_info()[1])) platforms = set() for header in pol.headers: platforms.update(header.platforms) if 'juniper' in platforms: jcl = copy.deepcopy(pol) if 'cisco' in platforms: acl = copy.deepcopy(pol) if 'ciscoasa' in platforms: asacl = copy.deepcopy(pol) if 'brocade' in platforms: bacl = copy.deepcopy(pol) if 'arista' in platforms: eacl = copy.deepcopy(pol) if 'aruba' in platforms: aacl = copy.deepcopy(pol) if 'ipset' in platforms: ips = copy.deepcopy(pol) if 'iptables' in platforms: ipt = copy.deepcopy(pol) if 'nsxv' in platforms: nsx = copy.deepcopy(pol) if 'packetfilter' in platforms: pf = copy.deepcopy(pol) if 'pcap' in platforms: pcap_accept = copy.deepcopy(pol) pcap_deny = copy.deepcopy(pol) if 'speedway' in platforms: spd = copy.deepcopy(pol) if 'srx' in platforms: srx = copy.deepcopy(pol) if 'srxlo' in platforms: jsl = copy.deepcopy(pol) if 'windows_advfirewall' in platforms: win_afw = copy.deepcopy(pol) if 'ciscoxr' in platforms: xacl = copy.deepcopy(pol) if 'nftables' in platforms: nft = copy.deepcopy(pol) if 'gce' in platforms: gcefw = copy.deepcopy(pol) if 'paloalto' in platforms: paloalto = copy.deepcopy(pol) if not output_directory.endswith('/'): output_directory += '/' try: if jcl: acl_obj = juniper.Juniper(jcl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if srx: acl_obj = junipersrx.JuniperSRX(srx, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if acl: acl_obj = cisco.Cisco(acl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if asacl: acl_obj = ciscoasa.CiscoASA(acl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if aacl: acl_obj = aruba.Aruba(aacl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if bacl: acl_obj = brocade.Brocade(bacl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if eacl: acl_obj = arista.Arista(eacl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if ips: acl_obj = ipset.Ipset(ips, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if ipt: acl_obj = iptables.Iptables(ipt, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if nsx: acl_obj = nsxv.Nsxv(nsx, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if spd: acl_obj = speedway.Speedway(spd, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if pcap_accept: acl_obj = pcap.PcapFilter(pcap_accept, exp_info) RenderACL(str(acl_obj), '-accept' + acl_obj.SUFFIX, output_directory, input_file, write_files) if pcap_deny: acl_obj = pcap.PcapFilter(pcap_deny, exp_info, invert=True) RenderACL(str(acl_obj), '-deny' + acl_obj.SUFFIX, output_directory, input_file, write_files) if pf: acl_obj = packetfilter.PacketFilter(pf, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if win_afw: acl_obj = windows_advfirewall.WindowsAdvFirewall(win_afw, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if jsl: acl_obj = srxlo.SRXlo(jsl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if xacl: acl_obj = ciscoxr.CiscoXR(xacl, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if nft: acl_obj = nftables.Nftables(nft, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if gcefw: acl_obj = gce.GCE(gcefw, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) if paloalto: acl_obj = paloaltofw.PaloAltoFW(paloalto, exp_info) RenderACL(str(acl_obj), acl_obj.SUFFIX, output_directory, input_file, write_files) # TODO(robankeny) add additional errors. except (juniper.Error, junipersrx.Error, cisco.Error, ipset.Error, iptables.Error, speedway.Error, pcap.Error, aclgenerator.Error, aruba.Error, nftables.Error, gce.Error): raise ACLGeneratorError( 'Error generating target ACL for %s:\n%s%s' % (input_file, sys.exc_info()[0], sys.exc_info()[1]))
def render_filters(source_file, definitions_obj, shade_check, exp_info): count = 0 [(eacl, aacl, bacl, jcl, acl, asa, xacl, ipt, ips, pf, spd, spk, srx, dem) ] = [(False, False, False, False, False, False, False, False, False, False, False, False, False, False)] pol = policy.ParsePolicy(open(source_file).read(), definitions_obj, shade_check=shade_check) for header in pol.headers: if 'arista' in header.platforms: eacl = copy.deepcopy(pol) if 'aruba' in header.platforms: aacl = copy.deepcopy(pol) if 'brocade' in header.platforms: bacl = copy.deepcopy(pol) if 'juniper' in header.platforms: jcl = copy.deepcopy(pol) if 'cisco' in header.platforms: acl = copy.deepcopy(pol) if 'ciscoasa' in header.platforms: asa = copy.deepcopy(pol) if 'ciscoxr' in header.platforms: xacl = copy.deepcopy(pol) if 'iptables' in header.platforms: ipt = copy.deepcopy(pol) if 'ipset' in header.platforms: ips = copy.deepcopy(pol) if 'packetfilter' in header.platforms: pf = copy.deepcopy(pol) if 'speedway' in header.platforms: spd = copy.deepcopy(pol) # SRX needs to be un-optimized for correct building of the address book # entries. if 'srx' in header.platforms: unoptimized_pol = policy.ParsePolicy(open(source_file).read(), definitions_obj, optimize=False) srx = copy.deepcopy(unoptimized_pol) if 'demo' in header.platforms: dem = copy.deepcopy(pol) if eacl: fw = arista.Arista(eacl, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if aacl: fw = aruba.Aruba(aacl, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if bacl: fw = brocade.Brocade(bacl, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if jcl: fw = juniper.Juniper(jcl, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if acl: fw = cisco.Cisco(acl, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if asa: fw = ciscoasa.CiscoASA(asa, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if xacl: fw = ciscoxr.CiscoXR(xacl, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if ipt: fw = iptables.Iptables(ipt, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if ips: fw = ipset.Ipset(ips, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if pf: fw = packetfilter.PacketFilter(pf, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if spd: fw = speedway.Speedway(spd, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if srx: fw = junipersrx.JuniperSRX(srx, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 if dem: fw = demo.Demo(dem, exp_info) do_output_filter(str(fw), filter_name(source_file, fw._SUFFIX)) count += 1 return count
def testBuildWarningTokens(self): pol1 = ipset.Ipset(policy.ParsePolicy(GOOD_HEADER_1 + GOOD_TERM_4, self.naming), EXP_INFO) st, sst = pol1._BuildTokens() self.assertEquals(st, SUPPORTED_TOKENS) self.assertEquals(sst, SUPPORTED_SUB_TOKENS)