def main():
# TODO(robankeny): Lets move this to gflags
usage = 'usage: %prog [options] arg'
_parser = OptionParser(usage)
_parser.add_option('--definitions-directory', dest='definitions',
help='definitions directory', default='./def')
_parser.add_option('-p', '--policy-file', dest='pol',
help='policy file', default='./policies/sample.pol')
_parser.add_option('-d', '--destination', dest='dst',
help='destination IP', default='200.1.1.1')
_parser.add_option('-s', '--source', dest='src',
help='source IP', default='any')
_parser.add_option('--proto', '--protocol', dest='proto',
help='Protocol (tcp, udp, icmp, etc.)', default='tcp')
_parser.add_option('--dport', '--destination-port', dest='dport',
help='destination port', default='80')
_parser.add_option('--sport', '--source-port', dest='sport',
help='source port', default='1025')
(FLAGS, unused_args) = _parser.parse_args()
defs = naming.Naming(FLAGS.definitions)
policy_obj = policy.ParsePolicy(open(FLAGS.pol).read(), defs)
check = aclcheck.AclCheck(policy_obj, src=FLAGS.src, dst=FLAGS.dst,
sport=FLAGS.sport, dport=FLAGS.dport,
proto=FLAGS.proto)
print(str(check))
def testAclCheck(self):
srcip = '172.16.1.1'
dstip = '10.2.2.10'
sport = '10000'
dport = '22'
proto = 'tcp'
check = aclcheck.AclCheck(self.pol, src=srcip, dst=dstip, sport=sport,
dport=dport, proto=proto)
matches = check.Matches()
# Check correct number of matches
self.assertEqual(len(matches), 3)
# Check correct actions
self.assertEqual(matches[0].action, 'next') # term-1
self.assertEqual(matches[1].action, 'accept') # term-2
self.assertEqual(matches[2].action, 'accept') # term-3
# Check for correct 'possibles'
self.assertEqual(matches[0].possibles, []) # term-1
self.assertEqual(matches[1].possibles,
['first-frag', 'frag-offset', 'packet-length', 'tcp-est']
) # term-2
self.assertEqual(matches[2].possibles, []) # term-3
# Check which term names match
self.assertEqual(matches[0].term, 'term-1')
self.assertEqual(matches[1].term, 'term-2')
self.assertEqual(matches[2].term, 'term-3')
# term-4 should never match
self.assertNotIn('term-4', str(matches))
self.assertNotIn('term-5', str(matches))
def testExactMatches(self):
check = aclcheck.AclCheck(self.pol, '172.16.1.1', '10.1.1.1', '1025',
'22', 'tcp')
matches = check.ExactMatches()
self.assertEqual(len(matches), 1)