Skip to content

commonism/acltk

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

acltk

This library is meant to parse Cisco ACLs and apply filters on them.

INSTALLATION

Install

  • python 3.8
  • tatsu 5.5

OPERATION

from acltk import ACLConfig, cafBlock
config = ACLConfig.parse("acl.conf")
filter = cafBlock.parse("filter.caf")
r = cafBlock.run(config)

See examples/ for examples.

  • acl-filter.py - shows how to create acl filters manually. python3 examples/acl-filter.py tests/acl/all.conf
  • caf-filter.py - shows how to use acls combined with caf filters python3 examples/caf-filter.py tests/caf/nested.caf tests/acl/all.conf
  • render/static.py - jinja enabled rendering of the acls
  • render/dynamic.py - flask based webservice for rendering/filtering

CAF

caf is the Cisco ACL Filter language, designed to filter Cisco ACLs. Currently you can filter ACLs by

  • id name
  • ip src|dst {addr ["/" netmask]}+
  • ip src|dst ANY ANY4 ANY6 any any4 any6
  • ip ... "ANY*" is special, it will filter out "any" rules.

e.g.

(
    ip src ANY
    ip dst ANY
)

will match any any rule such as access-list inside_in permit tcp any any port 53

There are set operations defined on these sets, valid operations are: union intersect except

You can use braces to preference operations properly

( id A except ip src ANY ) union ( id B except ip src ANY )

C++ style multi line comments can be used to document caf filters.

/* we want all rules matching 10.1.0.0/24 on ids outside_in and inside_in
   without the rules matching any any
   without the rules which apply for 10.2.0.0/24
*/
(
    /* rules for 10.1.0.0/24 */
    (
        id outside_in
        ip dst 10.1.0.0/24
    )
    union
    (
        id inside_in
        ip src 10.1.0.0/24
    )
)
except
(
    (   /* any any */
        ip src ANY
        ip dst ANY
    )
)
except
(
    ip dst 10.2.0.0/24
    union
    ip src 10.2.0.0/24
)

DEVELOPMENT

Environment

python3 -m venv ~/venv-acltk/

Running unittests

In order to generate the all.txt config from the template all.jinja2 the test_acl.py has to be run,

cd tests/
PYTHONPATH=../lib/ ~/venv-acltk/bin/python -m unittest test_acl.py

it has to be re-run after changes made to all.jinja2 so all.txt gets updated.

Updating the Semtantics

Changes to the grammar require regeneration of the Semantics

for i in caf fwsm ios; do ~/venv-acltk/bin/tatsu --generate-parser --name $i --outfile lib/acltk/$i.py lib/acltk/$i.bnf; done

About

Cisco ACL parsing & filtering toolkit

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published