Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capirca correct keyword for fragment is confused and is-fragment doesn't work for Cisco targets #187

Open
mpenning opened this issue May 30, 2020 · 0 comments

Comments

@mpenning
Copy link
Contributor

mpenning commented May 30, 2020

The online docs say that is-fragment is a valid option value for Cisco rules, but I get the following error when I use is-fragment for Cisco ACLs under Capirca=1.122:

Traceback (most recent call last):
  File "test_cisco_acl.py", line 37, in <module>
    cisco_acl = Cisco(pp, exp_info=0)
  File "/opt/virtual_env/py37_test/lib/python3.7/site-packages/capirca/lib/aclgenerator.py", line 325, in __init__
    raise UnsupportedFilterError('\n %s' % '\n'.join(all_err))
capirca.lib.aclgenerator.UnsupportedFilterError:
 test-deny-ip-fragments contains unsupported keywords (is-fragment) for target cisco in policy

The online docs say is-fragment is the proper keyword, but cisco.py seems to only recognize fragments option... What's more, the Juniper unit tests use is-fragment in the Term while the Cisco unit tests use fragments in the Term. For all the obvious reasons, we need to make the fragment keyword consistent for all targets.

Test script to reproduce...

from capirca.lib.policy import ParsePolicy
from capirca.lib.naming import Naming

from capirca.lib.cisco import Cisco

defs = Naming()
defs.ParseServiceList([
    'SVC1 = 80/tcp 443/tcp',
    'SVC2 = 25/tcp',
    'ALL_SVC = SVC1 SVC2',
    ])
defs.ParseNetworkList([
    'LAN1 = 172.16.1.0/24',
    'LAN2 = 172.16.2.0/24',
    'LAN = LAN1 LAN2',
    ])

## Reproduce problem with `option:: is-fragment` for Cisco targets
acl ="""
header {
  comment:: "Demo of capirca acl DSL"
  target:: cisco ACL_IN extended
}
term test-deny-ip-fragments {
  option:: is-fragment
  action:: deny
}
term allow-to-lan {
  destination-address:: LAN
  protocol:: tcp
  source-port:: ALL_SVC
  action:: accept
}
"""

pp = ParsePolicy(acl, defs)
cisco_acl = Cisco(pp, exp_info=0)
print(cisco_acl)
@mpenning mpenning changed the title Capirca doesn't allow use of 'is-fragment' under Cisco IOS Capirca correct keyword for fragment is confused and is-fragment doesn't work for Cisco targets May 30, 2020
mpenning added a commit to mpenning/capirca that referenced this issue May 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant