google / google/capirca

Capirca correct keyword for `fragment` is confused and `is-fragment` doesn't work for Cisco targets

Open
#187 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
857
Forks
213
PR merge metrics
No merged PRs in 30d

Description

The [online docs](https://github.com/google/capirca/wiki/Policy-format) say that `is-fragment` is a valid option value for Cisco rules, but I get the following error when I use `is-fragment` for Cisco ACLs under Capirca=1.122:

```
Traceback (most recent call last):
File "test_cisco_acl.py", line 37, in
cisco_acl = Cisco(pp, exp_info=0)
File "/opt/virtual_env/py37_test/lib/python3.7/site-packages/capirca/lib/aclgenerator.py", line 325, in __init__
raise UnsupportedFilterError('\n %s' % '\n'.join(all_err))
capirca.lib.aclgenerator.UnsupportedFilterError:
test-deny-ip-fragments contains unsupported keywords (is-fragment) for target cisco in policy
```

The online docs say `is-fragment` is the proper keyword, but `cisco.py` seems to only recognize `fragments` option... What's more, the Juniper unit tests use `is-fragment` in the Term while the Cisco unit tests use `fragments` in the Term. For all the obvious reasons, we need to make the fragment keyword consistent for all targets.

Test script to reproduce...

```python
from capirca.lib.policy import ParsePolicy
from capirca.lib.naming import Naming

from capirca.lib.cisco import Cisco

defs = Naming()
defs.ParseServiceList([
'SVC1 = 80/tcp 443/tcp',
'SVC2 = 25/tcp',
'ALL_SVC = SVC1 SVC2',
])
defs.ParseNetworkList([
'LAN1 = 172.16.1.0/24',
'LAN2 = 172.16.2.0/24',
'LAN = LAN1 LAN2',
])

## Reproduce problem with `option:: is-fragment` for Cisco targets
acl ="""
header {
comment:: "Demo of capirca acl DSL"
target:: cisco ACL_IN extended
}
term test-deny-ip-fragments {
option:: is-fragment
action:: deny
}
term allow-to-lan {
destination-address:: LAN
protocol:: tcp
source-port:: ALL_SVC
action:: accept
}
"""

pp = ParsePolicy(acl, defs)
cisco_acl = Cisco(pp, exp_info=0)
print(cisco_acl)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.