mirror of
https://github.com/ansible-collections/community.general.git
synced 2024-09-14 20:13:21 +02:00
1750 lines
74 KiB
Python
1750 lines
74 KiB
Python
#!/usr/bin/python
|
|
#
|
|
# This file is part of Ansible
|
|
#
|
|
# Ansible is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Ansible is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
|
|
#
|
|
|
|
from __future__ import (absolute_import, division, print_function)
|
|
__metaclass__ = type
|
|
|
|
ANSIBLE_METADATA = {'metadata_version': '1.1',
|
|
'status': ['preview'],
|
|
'supported_by': 'community'}
|
|
|
|
DOCUMENTATION = '''
|
|
---
|
|
module: ce_acl_advance
|
|
short_description: Manages advanced ACL configuration on HUAWEI CloudEngine switches.
|
|
description:
|
|
- Manages advanced ACL configurations on HUAWEI CloudEngine switches.
|
|
author:
|
|
- wangdezhuang (@QijunPan)
|
|
notes:
|
|
- This module requires the netconf system service be enabled on the remote device being managed.
|
|
- Recommended connection is C(netconf).
|
|
- This module also works with C(local) connections for legacy playbooks.
|
|
options:
|
|
state:
|
|
description:
|
|
- Specify desired state of the resource.
|
|
required: false
|
|
default: present
|
|
choices: ['present','absent','delete_acl']
|
|
acl_name:
|
|
description:
|
|
- ACL number or name.
|
|
For a numbered rule group, the value ranging from 3000 to 3999 indicates a advance ACL.
|
|
For a named rule group, the value is a string of 1 to 32 case-sensitive characters starting
|
|
with a letter, spaces not supported.
|
|
required: true
|
|
acl_num:
|
|
description:
|
|
- ACL number.
|
|
The value is an integer ranging from 3000 to 3999.
|
|
acl_step:
|
|
description:
|
|
- ACL step.
|
|
The value is an integer ranging from 1 to 20. The default value is 5.
|
|
acl_description:
|
|
description:
|
|
- ACL description.
|
|
The value is a string of 1 to 127 characters.
|
|
rule_name:
|
|
description:
|
|
- Name of a basic ACL rule.
|
|
The value is a string of 1 to 32 characters.
|
|
rule_id:
|
|
description:
|
|
- ID of a basic ACL rule in configuration mode.
|
|
The value is an integer ranging from 0 to 4294967294.
|
|
rule_action:
|
|
description:
|
|
- Matching mode of basic ACL rules.
|
|
choices: ['permit','deny']
|
|
protocol:
|
|
description:
|
|
- Protocol type.
|
|
choices: ['ip', 'icmp', 'igmp', 'ipinip', 'tcp', 'udp', 'gre', 'ospf']
|
|
source_ip:
|
|
description:
|
|
- Source IP address.
|
|
The value is a string of 0 to 255 characters.The default value is 0.0.0.0.
|
|
The value is in dotted decimal notation.
|
|
src_mask:
|
|
description:
|
|
- Source IP address mask.
|
|
The value is an integer ranging from 1 to 32.
|
|
src_pool_name:
|
|
description:
|
|
- Name of a source pool.
|
|
The value is a string of 1 to 32 characters.
|
|
dest_ip:
|
|
description:
|
|
- Destination IP address.
|
|
The value is a string of 0 to 255 characters.The default value is 0.0.0.0.
|
|
The value is in dotted decimal notation.
|
|
dest_mask:
|
|
description:
|
|
- Destination IP address mask.
|
|
The value is an integer ranging from 1 to 32.
|
|
dest_pool_name:
|
|
description:
|
|
- Name of a destination pool.
|
|
The value is a string of 1 to 32 characters.
|
|
src_port_op:
|
|
description:
|
|
- Range type of the source port.
|
|
choices: ['lt','eq', 'gt', 'range']
|
|
src_port_begin:
|
|
description:
|
|
- Start port number of the source port.
|
|
The value is an integer ranging from 0 to 65535.
|
|
src_port_end:
|
|
description:
|
|
- End port number of the source port.
|
|
The value is an integer ranging from 0 to 65535.
|
|
src_port_pool_name:
|
|
description:
|
|
- Name of a source port pool.
|
|
The value is a string of 1 to 32 characters.
|
|
dest_port_op:
|
|
description:
|
|
- Range type of the destination port.
|
|
choices: ['lt','eq', 'gt', 'range']
|
|
dest_port_begin:
|
|
description:
|
|
- Start port number of the destination port.
|
|
The value is an integer ranging from 0 to 65535.
|
|
dest_port_end:
|
|
description:
|
|
- End port number of the destination port.
|
|
The value is an integer ranging from 0 to 65535.
|
|
dest_port_pool_name:
|
|
description:
|
|
- Name of a destination port pool.
|
|
The value is a string of 1 to 32 characters.
|
|
frag_type:
|
|
description:
|
|
- Type of packet fragmentation.
|
|
choices: ['fragment', 'clear_fragment']
|
|
precedence:
|
|
description:
|
|
- Data packets can be filtered based on the priority field.
|
|
The value is an integer ranging from 0 to 7.
|
|
tos:
|
|
description:
|
|
- ToS value on which data packet filtering is based.
|
|
The value is an integer ranging from 0 to 15.
|
|
dscp:
|
|
description:
|
|
- Differentiated Services Code Point.
|
|
The value is an integer ranging from 0 to 63.
|
|
icmp_name:
|
|
description:
|
|
- ICMP name.
|
|
choices: ['unconfiged', 'echo', 'echo-reply', 'fragmentneed-DFset', 'host-redirect',
|
|
'host-tos-redirect', 'host-unreachable', 'information-reply', 'information-request',
|
|
'net-redirect', 'net-tos-redirect', 'net-unreachable', 'parameter-problem',
|
|
'port-unreachable', 'protocol-unreachable', 'reassembly-timeout', 'source-quench',
|
|
'source-route-failed', 'timestamp-reply', 'timestamp-request', 'ttl-exceeded',
|
|
'address-mask-reply', 'address-mask-request', 'custom']
|
|
icmp_type:
|
|
description:
|
|
- ICMP type. This parameter is available only when the packet protocol is ICMP.
|
|
The value is an integer ranging from 0 to 255.
|
|
icmp_code:
|
|
description:
|
|
- ICMP message code. Data packets can be filtered based on the ICMP message code.
|
|
The value is an integer ranging from 0 to 255.
|
|
ttl_expired:
|
|
description:
|
|
- Whether TTL Expired is matched, with the TTL value of 1.
|
|
type: bool
|
|
default: 'no'
|
|
vrf_name:
|
|
description:
|
|
- VPN instance name.
|
|
The value is a string of 1 to 31 characters.The default value is _public_.
|
|
syn_flag:
|
|
description:
|
|
- TCP flag value.
|
|
The value is an integer ranging from 0 to 63.
|
|
tcp_flag_mask:
|
|
description:
|
|
- TCP flag mask value.
|
|
The value is an integer ranging from 0 to 63.
|
|
established:
|
|
description:
|
|
- Match established connections.
|
|
type: bool
|
|
default: 'no'
|
|
time_range:
|
|
description:
|
|
- Name of a time range in which an ACL rule takes effect.
|
|
rule_description:
|
|
description:
|
|
- Description about an ACL rule.
|
|
igmp_type:
|
|
description:
|
|
- Internet Group Management Protocol.
|
|
choices: ['host-query', 'mrouter-adver', 'mrouter-solic', 'mrouter-termi', 'mtrace-resp', 'mtrace-route',
|
|
'v1host-report', 'v2host-report', 'v2leave-group', 'v3host-report']
|
|
log_flag:
|
|
description:
|
|
- Flag of logging matched data packets.
|
|
type: bool
|
|
default: 'no'
|
|
'''
|
|
|
|
EXAMPLES = '''
|
|
|
|
- name: CloudEngine advance acl test
|
|
hosts: cloudengine
|
|
connection: local
|
|
gather_facts: no
|
|
vars:
|
|
cli:
|
|
host: "{{ inventory_hostname }}"
|
|
port: "{{ ansible_ssh_port }}"
|
|
username: "{{ username }}"
|
|
password: "{{ password }}"
|
|
transport: cli
|
|
|
|
tasks:
|
|
|
|
- name: "Config ACL"
|
|
ce_acl_advance:
|
|
state: present
|
|
acl_name: 3200
|
|
provider: "{{ cli }}"
|
|
|
|
- name: "Undo ACL"
|
|
ce_acl_advance:
|
|
state: delete_acl
|
|
acl_name: 3200
|
|
provider: "{{ cli }}"
|
|
|
|
- name: "Config ACL advance rule"
|
|
ce_acl_advance:
|
|
state: present
|
|
acl_name: test
|
|
rule_name: test_rule
|
|
rule_id: 111
|
|
rule_action: permit
|
|
protocol: tcp
|
|
source_ip: 10.10.10.10
|
|
src_mask: 24
|
|
frag_type: fragment
|
|
provider: "{{ cli }}"
|
|
|
|
- name: "Undo ACL advance rule"
|
|
ce_acl_advance:
|
|
state: absent
|
|
acl_name: test
|
|
rule_name: test_rule
|
|
rule_id: 111
|
|
rule_action: permit
|
|
protocol: tcp
|
|
source_ip: 10.10.10.10
|
|
src_mask: 24
|
|
frag_type: fragment
|
|
provider: "{{ cli }}"
|
|
'''
|
|
|
|
RETURN = '''
|
|
changed:
|
|
description: check to see if a change was made on the device
|
|
returned: always
|
|
type: bool
|
|
sample: true
|
|
proposed:
|
|
description: k/v pairs of parameters passed into module
|
|
returned: always
|
|
type: dict
|
|
sample: {"acl_name": "test", "state": "delete_acl"}
|
|
existing:
|
|
description: k/v pairs of existing aaa server
|
|
returned: always
|
|
type: dict
|
|
sample: {"aclNumOrName": "test", "aclType": "Advance"}
|
|
end_state:
|
|
description: k/v pairs of aaa params after module execution
|
|
returned: always
|
|
type: dict
|
|
sample: {}
|
|
updates:
|
|
description: command sent to the device
|
|
returned: always
|
|
type: list
|
|
sample: ["undo acl name test"]
|
|
'''
|
|
|
|
from xml.etree import ElementTree
|
|
from ansible.module_utils.basic import AnsibleModule
|
|
from ansible_collections.community.general.plugins.module_utils.network.cloudengine.ce import get_nc_config, set_nc_config, ce_argument_spec, check_ip_addr
|
|
|
|
|
|
# get acl
|
|
CE_GET_ACL_HEADER = """
|
|
<filter type="subtree">
|
|
<acl xmlns="http://www.huawei.com/netconf/vrp" content-version="1.0" format-version="1.0">
|
|
<aclGroups>
|
|
<aclGroup>
|
|
<aclNumOrName></aclNumOrName>
|
|
"""
|
|
CE_GET_ACL_TAIL = """
|
|
</aclGroup>
|
|
</aclGroups>
|
|
</acl>
|
|
</filter>
|
|
"""
|
|
# merge acl
|
|
CE_MERGE_ACL_HEADER = """
|
|
<config>
|
|
<acl xmlns="http://www.huawei.com/netconf/vrp" content-version="1.0" format-version="1.0">
|
|
<aclGroups>
|
|
<aclGroup operation="merge">
|
|
<aclNumOrName>%s</aclNumOrName>
|
|
"""
|
|
CE_MERGE_ACL_TAIL = """
|
|
</aclGroup>
|
|
</aclGroups>
|
|
</acl>
|
|
</config>
|
|
"""
|
|
# delete acl
|
|
CE_DELETE_ACL_HEADER = """
|
|
<config>
|
|
<acl xmlns="http://www.huawei.com/netconf/vrp" content-version="1.0" format-version="1.0">
|
|
<aclGroups>
|
|
<aclGroup operation="delete">
|
|
<aclNumOrName>%s</aclNumOrName>
|
|
"""
|
|
CE_DELETE_ACL_TAIL = """
|
|
</aclGroup>
|
|
</aclGroups>
|
|
</acl>
|
|
</config>
|
|
"""
|
|
|
|
# get acl advance rule
|
|
CE_GET_ACL_ADVANCE_RULE_HEADER = """
|
|
<filter type="subtree">
|
|
<acl xmlns="http://www.huawei.com/netconf/vrp" content-version="1.0" format-version="1.0">
|
|
<aclGroups>
|
|
<aclGroup>
|
|
<aclNumOrName>%s</aclNumOrName>
|
|
<aclRuleAdv4s>
|
|
<aclRuleAdv4>
|
|
<aclRuleName></aclRuleName>
|
|
"""
|
|
CE_GET_ACL_ADVANCE_RULE_TAIL = """
|
|
</aclRuleAdv4>
|
|
</aclRuleAdv4s>
|
|
</aclGroup>
|
|
</aclGroups>
|
|
</acl>
|
|
</filter>
|
|
"""
|
|
# merge acl advance rule
|
|
CE_MERGE_ACL_ADVANCE_RULE_HEADER = """
|
|
<config>
|
|
<acl xmlns="http://www.huawei.com/netconf/vrp" content-version="1.0" format-version="1.0">
|
|
<aclGroups>
|
|
<aclGroup>
|
|
<aclNumOrName>%s</aclNumOrName>
|
|
<aclRuleAdv4s>
|
|
<aclRuleAdv4 operation="merge">
|
|
<aclRuleName>%s</aclRuleName>
|
|
"""
|
|
CE_MERGE_ACL_ADVANCE_RULE_TAIL = """
|
|
</aclRuleAdv4>
|
|
</aclRuleAdv4s>
|
|
</aclGroup>
|
|
</aclGroups>
|
|
</acl>
|
|
</config>
|
|
"""
|
|
# delete acl advance rule
|
|
CE_DELETE_ACL_ADVANCE_RULE_HEADER = """
|
|
<config>
|
|
<acl xmlns="http://www.huawei.com/netconf/vrp" content-version="1.0" format-version="1.0">
|
|
<aclGroups>
|
|
<aclGroup>
|
|
<aclNumOrName>%s</aclNumOrName>
|
|
<aclRuleAdv4s>
|
|
<aclRuleAdv4 operation="delete">
|
|
<aclRuleName>%s</aclRuleName>
|
|
"""
|
|
CE_DELETE_ACL_ADVANCE_RULE_TAIL = """
|
|
</aclRuleAdv4>
|
|
</aclRuleAdv4s>
|
|
</aclGroup>
|
|
</aclGroups>
|
|
</acl>
|
|
</config>
|
|
"""
|
|
|
|
|
|
PROTOCOL_NUM = {"ip": "0",
|
|
"icmp": "1",
|
|
"igmp": "2",
|
|
"ipinip": "4",
|
|
"tcp": "6",
|
|
"udp": "17",
|
|
"gre": "47",
|
|
"ospf": "89"}
|
|
|
|
IGMP_TYPE_NUM = {"host-query": "17",
|
|
"mrouter-adver": "48",
|
|
"mrouter-solic": "49",
|
|
"mrouter-termi": "50",
|
|
"mtrace-resp": "30",
|
|
"mtrace-route": "31",
|
|
"v1host-report": "18",
|
|
"v2host-report": "22",
|
|
"v2leave-group": "23",
|
|
"v3host-report": "34"}
|
|
|
|
|
|
def get_wildcard_mask(mask):
|
|
""" convert mask length to ip address wildcard mask, i.e. 24 to 0.0.0.255 """
|
|
|
|
mask_int = ["255"] * 4
|
|
value = int(mask)
|
|
|
|
if value > 32:
|
|
return None
|
|
if value < 8:
|
|
mask_int[0] = str(int(~(0xFF << (8 - value % 8)) & 0xFF))
|
|
if value >= 8:
|
|
mask_int[0] = '0'
|
|
mask_int[1] = str(int(~(0xFF << (16 - (value % 16))) & 0xFF))
|
|
if value >= 16:
|
|
mask_int[1] = '0'
|
|
mask_int[2] = str(int(~(0xFF << (24 - (value % 24))) & 0xFF))
|
|
if value >= 24:
|
|
mask_int[2] = '0'
|
|
mask_int[3] = str(int(~(0xFF << (32 - (value % 32))) & 0xFF))
|
|
if value == 32:
|
|
mask_int[3] = '0'
|
|
|
|
return '.'.join(mask_int)
|
|
|
|
|
|
class AdvanceAcl(object):
|
|
""" Manages advance acl configuration """
|
|
|
|
def __init__(self, **kwargs):
|
|
""" Class init """
|
|
|
|
# argument spec
|
|
argument_spec = kwargs["argument_spec"]
|
|
self.spec = argument_spec
|
|
self.module = AnsibleModule(argument_spec=self.spec, supports_check_mode=True)
|
|
|
|
# module args
|
|
self.state = self.module.params['state']
|
|
self.acl_name = self.module.params['acl_name'] or None
|
|
self.acl_num = self.module.params['acl_num'] or None
|
|
self.acl_type = None
|
|
self.acl_step = self.module.params['acl_step'] or None
|
|
self.acl_description = self.module.params['acl_description'] or None
|
|
self.rule_name = self.module.params['rule_name'] or None
|
|
self.rule_id = self.module.params['rule_id'] or None
|
|
self.rule_action = self.module.params['rule_action'] or None
|
|
self.protocol = self.module.params['protocol'] or None
|
|
self.protocol_num = None
|
|
self.source_ip = self.module.params['source_ip'] or None
|
|
self.src_mask = self.module.params['src_mask'] or None
|
|
self.src_wild = None
|
|
self.src_pool_name = self.module.params['src_pool_name'] or None
|
|
self.dest_ip = self.module.params['dest_ip'] or None
|
|
self.dest_mask = self.module.params['dest_mask'] or None
|
|
self.dest_wild = None
|
|
self.dest_pool_name = self.module.params['dest_pool_name'] or None
|
|
self.src_port_op = self.module.params['src_port_op'] or None
|
|
self.src_port_begin = self.module.params['src_port_begin'] or None
|
|
self.src_port_end = self.module.params['src_port_end'] or None
|
|
self.src_port_pool_name = self.module.params[
|
|
'src_port_pool_name'] or None
|
|
self.dest_port_op = self.module.params['dest_port_op'] or None
|
|
self.dest_port_begin = self.module.params['dest_port_begin'] or None
|
|
self.dest_port_end = self.module.params['dest_port_end'] or None
|
|
self.dest_port_pool_name = self.module.params[
|
|
'dest_port_pool_name'] or None
|
|
self.frag_type = self.module.params['frag_type'] or None
|
|
self.precedence = self.module.params['precedence'] or None
|
|
self.tos = self.module.params['tos'] or None
|
|
self.dscp = self.module.params['dscp'] or None
|
|
self.icmp_name = self.module.params['icmp_name'] or None
|
|
self.icmp_type = self.module.params['icmp_type'] or None
|
|
self.icmp_code = self.module.params['icmp_code'] or None
|
|
self.ttl_expired = self.module.params['ttl_expired']
|
|
self.vrf_name = self.module.params['vrf_name'] or None
|
|
self.syn_flag = self.module.params['syn_flag'] or None
|
|
self.tcp_flag_mask = self.module.params['tcp_flag_mask'] or None
|
|
self.established = self.module.params['established']
|
|
self.time_range = self.module.params['time_range'] or None
|
|
self.rule_description = self.module.params['rule_description'] or None
|
|
self.igmp_type = self.module.params['igmp_type'] or None
|
|
self.igmp_type_num = None
|
|
self.log_flag = self.module.params['log_flag']
|
|
|
|
self.precedence_name = dict()
|
|
self.precedence_name["0"] = "routine"
|
|
self.precedence_name["1"] = "priority"
|
|
self.precedence_name["2"] = "immediate"
|
|
self.precedence_name["3"] = "flash"
|
|
self.precedence_name["4"] = "flash-override"
|
|
self.precedence_name["5"] = "critical"
|
|
self.precedence_name["6"] = "internet"
|
|
self.precedence_name["7"] = "network"
|
|
|
|
# cur config
|
|
self.cur_acl_cfg = dict()
|
|
self.cur_advance_rule_cfg = dict()
|
|
|
|
# state
|
|
self.changed = False
|
|
self.updates_cmd = list()
|
|
self.results = dict()
|
|
self.proposed = dict()
|
|
self.existing = dict()
|
|
self.end_state = dict()
|
|
|
|
def netconf_get_config(self, conf_str):
|
|
""" Get configure by netconf """
|
|
|
|
xml_str = get_nc_config(self.module, conf_str)
|
|
|
|
return xml_str
|
|
|
|
def netconf_set_config(self, conf_str):
|
|
""" Set configure by netconf """
|
|
|
|
xml_str = set_nc_config(self.module, conf_str)
|
|
|
|
return xml_str
|
|
|
|
def get_protocol_num(self):
|
|
""" Get protocol num by name """
|
|
|
|
if self.protocol:
|
|
self.protocol_num = PROTOCOL_NUM.get(self.protocol)
|
|
|
|
def get_igmp_type_num(self):
|
|
""" Get igmp type num by type """
|
|
|
|
if self.igmp_type:
|
|
self.igmp_type_num = IGMP_TYPE_NUM.get(self.igmp_type)
|
|
|
|
def check_acl_args(self):
|
|
""" Check acl invalid args """
|
|
|
|
need_cfg = False
|
|
find_flag = False
|
|
self.cur_acl_cfg["acl_info"] = []
|
|
|
|
if self.acl_name:
|
|
|
|
if self.acl_name.isdigit():
|
|
if int(self.acl_name) < 3000 or int(self.acl_name) > 3999:
|
|
self.module.fail_json(
|
|
msg='Error: The value of acl_name is out of [3000-3999] for advance ACL.')
|
|
|
|
if self.acl_num:
|
|
self.module.fail_json(
|
|
msg='Error: The acl_name is digit, so should not input acl_num at the same time.')
|
|
else:
|
|
|
|
self.acl_type = "Advance"
|
|
|
|
if len(self.acl_name) < 1 or len(self.acl_name) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of acl_name is out of [1 - 32].')
|
|
|
|
if self.state == "present":
|
|
if not self.acl_num and not self.acl_type and not self.rule_name:
|
|
self.module.fail_json(
|
|
msg='Error: Please input acl_num or acl_type when config ACL.')
|
|
|
|
if self.acl_num:
|
|
if self.acl_num.isdigit():
|
|
if int(self.acl_num) < 3000 or int(self.acl_num) > 3999:
|
|
self.module.fail_json(
|
|
msg='Error: The value of acl_name is out of [3000-3999] for advance ACL.')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The acl_num is not digit.')
|
|
|
|
if self.acl_step:
|
|
if self.acl_step.isdigit():
|
|
if int(self.acl_step) < 1 or int(self.acl_step) > 20:
|
|
self.module.fail_json(
|
|
msg='Error: The value of acl_step is out of [1 - 20].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The acl_step is not digit.')
|
|
|
|
if self.acl_description:
|
|
if len(self.acl_description) < 1 or len(self.acl_description) > 127:
|
|
self.module.fail_json(
|
|
msg='Error: The len of acl_description is out of [1 - 127].')
|
|
|
|
conf_str = CE_GET_ACL_HEADER
|
|
|
|
if self.acl_type:
|
|
conf_str += "<aclType></aclType>"
|
|
if self.acl_num or self.acl_name.isdigit():
|
|
conf_str += "<aclNumber></aclNumber>"
|
|
if self.acl_step:
|
|
conf_str += "<aclStep></aclStep>"
|
|
if self.acl_description:
|
|
conf_str += "<aclDescription></aclDescription>"
|
|
|
|
conf_str += CE_GET_ACL_TAIL
|
|
recv_xml = self.netconf_get_config(conf_str=conf_str)
|
|
|
|
if "<data/>" in recv_xml:
|
|
find_flag = False
|
|
|
|
else:
|
|
xml_str = recv_xml.replace('\r', '').replace('\n', '').\
|
|
replace('xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"', "").\
|
|
replace('xmlns="http://www.huawei.com/netconf/vrp"', "")
|
|
|
|
root = ElementTree.fromstring(xml_str)
|
|
|
|
# parse acl
|
|
acl_info = root.findall(
|
|
"acl/aclGroups/aclGroup")
|
|
if acl_info:
|
|
for tmp in acl_info:
|
|
tmp_dict = dict()
|
|
for site in tmp:
|
|
if site.tag in ["aclNumOrName", "aclType", "aclNumber", "aclStep", "aclDescription"]:
|
|
tmp_dict[site.tag] = site.text
|
|
|
|
self.cur_acl_cfg["acl_info"].append(tmp_dict)
|
|
|
|
if self.cur_acl_cfg["acl_info"]:
|
|
find_list = list()
|
|
for tmp in self.cur_acl_cfg["acl_info"]:
|
|
cur_cfg_dict = dict()
|
|
exist_cfg_dict = dict()
|
|
|
|
if self.acl_name:
|
|
if self.acl_name.isdigit() and tmp.get("aclNumber"):
|
|
cur_cfg_dict["aclNumber"] = self.acl_name
|
|
exist_cfg_dict["aclNumber"] = tmp.get("aclNumber")
|
|
else:
|
|
cur_cfg_dict["aclNumOrName"] = self.acl_name
|
|
exist_cfg_dict["aclNumOrName"] = tmp.get("aclNumOrName")
|
|
if self.acl_type:
|
|
cur_cfg_dict["aclType"] = self.acl_type
|
|
exist_cfg_dict["aclType"] = tmp.get("aclType")
|
|
if self.acl_num:
|
|
cur_cfg_dict["aclNumber"] = self.acl_num
|
|
exist_cfg_dict["aclNumber"] = tmp.get("aclNumber")
|
|
if self.acl_step:
|
|
cur_cfg_dict["aclStep"] = self.acl_step
|
|
exist_cfg_dict["aclStep"] = tmp.get("aclStep")
|
|
if self.acl_description:
|
|
cur_cfg_dict["aclDescription"] = self.acl_description
|
|
exist_cfg_dict["aclDescription"] = tmp.get("aclDescription")
|
|
|
|
if cur_cfg_dict == exist_cfg_dict:
|
|
find_bool = True
|
|
else:
|
|
find_bool = False
|
|
find_list.append(find_bool)
|
|
for mem in find_list:
|
|
if mem:
|
|
find_flag = True
|
|
break
|
|
else:
|
|
find_flag = False
|
|
else:
|
|
find_flag = False
|
|
|
|
if self.state == "present":
|
|
need_cfg = bool(not find_flag)
|
|
elif self.state == "delete_acl":
|
|
need_cfg = bool(find_flag)
|
|
else:
|
|
need_cfg = False
|
|
|
|
self.cur_acl_cfg["need_cfg"] = need_cfg
|
|
|
|
def check_advance_rule_args(self):
|
|
""" Check advance rule invalid args """
|
|
|
|
need_cfg = False
|
|
find_flag = False
|
|
self.cur_advance_rule_cfg["adv_rule_info"] = []
|
|
|
|
if self.acl_name:
|
|
|
|
if self.state == "absent":
|
|
if not self.rule_name:
|
|
self.module.fail_json(
|
|
msg='Error: Please input rule_name when state is absent.')
|
|
|
|
# config rule
|
|
if self.rule_name:
|
|
if len(self.rule_name) < 1 or len(self.rule_name) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of rule_name is out of [1 - 32].')
|
|
|
|
if self.state != "delete_acl" and not self.rule_id:
|
|
self.module.fail_json(
|
|
msg='Error: Please input rule_id.')
|
|
|
|
if self.rule_id:
|
|
if self.rule_id.isdigit():
|
|
if int(self.rule_id) < 0 or int(self.rule_id) > 4294967294:
|
|
self.module.fail_json(
|
|
msg='Error: The value of rule_id is out of [0 - 4294967294].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The rule_id is not digit.')
|
|
|
|
if self.rule_action and not self.protocol:
|
|
self.module.fail_json(
|
|
msg='Error: The rule_action and the protocol must input at the same time.')
|
|
|
|
if not self.rule_action and self.protocol:
|
|
self.module.fail_json(
|
|
msg='Error: The rule_action and the protocol must input at the same time.')
|
|
|
|
if self.protocol:
|
|
self.get_protocol_num()
|
|
|
|
if self.source_ip:
|
|
if not check_ip_addr(self.source_ip):
|
|
self.module.fail_json(
|
|
msg='Error: The source_ip %s is invalid.' % self.source_ip)
|
|
if not self.src_mask:
|
|
self.module.fail_json(
|
|
msg='Error: Please input src_mask.')
|
|
|
|
if self.src_mask:
|
|
if self.src_mask.isdigit():
|
|
if int(self.src_mask) < 1 or int(self.src_mask) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The value of src_mask is out of [1 - 32].')
|
|
self.src_wild = get_wildcard_mask(self.src_mask)
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The src_mask is not digit.')
|
|
|
|
if self.src_pool_name:
|
|
if len(self.src_pool_name) < 1 or len(self.src_pool_name) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of src_pool_name is out of [1 - 32].')
|
|
|
|
if self.dest_ip:
|
|
if not check_ip_addr(self.dest_ip):
|
|
self.module.fail_json(
|
|
msg='Error: The dest_ip %s is invalid.' % self.dest_ip)
|
|
if not self.dest_mask:
|
|
self.module.fail_json(
|
|
msg='Error: Please input dest_mask.')
|
|
|
|
if self.dest_mask:
|
|
if self.dest_mask.isdigit():
|
|
if int(self.dest_mask) < 1 or int(self.dest_mask) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The value of dest_mask is out of [1 - 32].')
|
|
self.dest_wild = get_wildcard_mask(self.dest_mask)
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_mask is not digit.')
|
|
|
|
if self.dest_pool_name:
|
|
if len(self.dest_pool_name) < 1 or len(self.dest_pool_name) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of dest_pool_name is out of [1 - 32].')
|
|
|
|
if self.src_port_op:
|
|
if self.src_port_op == "lt":
|
|
if not self.src_port_end:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_end must input.')
|
|
if self.src_port_begin:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_begin should not input.')
|
|
if self.src_port_op == "eq" or self.src_port_op == "gt":
|
|
if not self.src_port_begin:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_begin must input.')
|
|
if self.src_port_end:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_end should not input.')
|
|
if self.src_port_op == "range":
|
|
if not self.src_port_begin or not self.src_port_end:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_begin and src_port_end must input.')
|
|
|
|
if self.src_port_begin:
|
|
if self.src_port_begin.isdigit():
|
|
if int(self.src_port_begin) < 0 or int(self.src_port_begin) > 65535:
|
|
self.module.fail_json(
|
|
msg='Error: The value of src_port_begin is out of [0 - 65535].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_begin is not digit.')
|
|
|
|
if self.src_port_end:
|
|
if self.src_port_end.isdigit():
|
|
if int(self.src_port_end) < 0 or int(self.src_port_end) > 65535:
|
|
self.module.fail_json(
|
|
msg='Error: The value of src_port_end is out of [0 - 65535].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The src_port_end is not digit.')
|
|
|
|
if self.src_port_pool_name:
|
|
if len(self.src_port_pool_name) < 1 or len(self.src_port_pool_name) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of src_port_pool_name is out of [1 - 32].')
|
|
|
|
if self.dest_port_op:
|
|
if self.dest_port_op == "lt":
|
|
if not self.dest_port_end:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_end must input.')
|
|
if self.dest_port_begin:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_begin should not input.')
|
|
if self.dest_port_op == "eq" or self.dest_port_op == "gt":
|
|
if not self.dest_port_begin:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_begin must input.')
|
|
if self.dest_port_end:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_end should not input.')
|
|
if self.dest_port_op == "range":
|
|
if not self.dest_port_begin or not self.dest_port_end:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_begin and dest_port_end must input.')
|
|
|
|
if self.dest_port_begin:
|
|
if self.dest_port_begin.isdigit():
|
|
if int(self.dest_port_begin) < 0 or int(self.dest_port_begin) > 65535:
|
|
self.module.fail_json(
|
|
msg='Error: The value of dest_port_begin is out of [0 - 65535].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_begin is not digit.')
|
|
|
|
if self.dest_port_end:
|
|
if self.dest_port_end.isdigit():
|
|
if int(self.dest_port_end) < 0 or int(self.dest_port_end) > 65535:
|
|
self.module.fail_json(
|
|
msg='Error: The value of dest_port_end is out of [0 - 65535].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The dest_port_end is not digit.')
|
|
|
|
if self.dest_port_pool_name:
|
|
if len(self.dest_port_pool_name) < 1 or len(self.dest_port_pool_name) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of dest_port_pool_name is out of [1 - 32].')
|
|
|
|
if self.precedence:
|
|
if self.precedence.isdigit():
|
|
if int(self.precedence) < 0 or int(self.precedence) > 7:
|
|
self.module.fail_json(
|
|
msg='Error: The value of precedence is out of [0 - 7].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The precedence is not digit.')
|
|
|
|
if self.tos:
|
|
if self.tos.isdigit():
|
|
if int(self.tos) < 0 or int(self.tos) > 15:
|
|
self.module.fail_json(
|
|
msg='Error: The value of tos is out of [0 - 15].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The tos is not digit.')
|
|
|
|
if self.dscp:
|
|
if self.dscp.isdigit():
|
|
if int(self.dscp) < 0 or int(self.dscp) > 63:
|
|
self.module.fail_json(
|
|
msg='Error: The value of dscp is out of [0 - 63].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The dscp is not digit.')
|
|
|
|
if self.icmp_type:
|
|
if self.icmp_type.isdigit():
|
|
if int(self.icmp_type) < 0 or int(self.icmp_type) > 255:
|
|
self.module.fail_json(
|
|
msg='Error: The value of icmp_type is out of [0 - 255].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The icmp_type is not digit.')
|
|
|
|
if self.icmp_code:
|
|
if self.icmp_code.isdigit():
|
|
if int(self.icmp_code) < 0 or int(self.icmp_code) > 255:
|
|
self.module.fail_json(
|
|
msg='Error: The value of icmp_code is out of [0 - 255].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The icmp_code is not digit.')
|
|
|
|
if self.vrf_name:
|
|
if len(self.vrf_name) < 1 or len(self.vrf_name) > 31:
|
|
self.module.fail_json(
|
|
msg='Error: The len of vrf_name is out of [1 - 31].')
|
|
|
|
if self.syn_flag:
|
|
if self.syn_flag.isdigit():
|
|
if int(self.syn_flag) < 0 or int(self.syn_flag) > 63:
|
|
self.module.fail_json(
|
|
msg='Error: The value of syn_flag is out of [0 - 63].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The syn_flag is not digit.')
|
|
|
|
if self.tcp_flag_mask:
|
|
if self.tcp_flag_mask.isdigit():
|
|
if int(self.tcp_flag_mask) < 0 or int(self.tcp_flag_mask) > 63:
|
|
self.module.fail_json(
|
|
msg='Error: The value of tcp_flag_mask is out of [0 - 63].')
|
|
else:
|
|
self.module.fail_json(
|
|
msg='Error: The tcp_flag_mask is not digit.')
|
|
|
|
if self.time_range:
|
|
if len(self.time_range) < 1 or len(self.time_range) > 32:
|
|
self.module.fail_json(
|
|
msg='Error: The len of time_range is out of [1 - 32].')
|
|
|
|
if self.rule_description:
|
|
if len(self.rule_description) < 1 or len(self.rule_description) > 127:
|
|
self.module.fail_json(
|
|
msg='Error: The len of rule_description is out of [1 - 127].')
|
|
|
|
if self.igmp_type:
|
|
self.get_igmp_type_num()
|
|
|
|
conf_str = CE_GET_ACL_ADVANCE_RULE_HEADER % self.acl_name
|
|
|
|
if self.rule_id:
|
|
conf_str += "<aclRuleID></aclRuleID>"
|
|
if self.rule_action:
|
|
conf_str += "<aclAction></aclAction>"
|
|
if self.protocol:
|
|
conf_str += "<aclProtocol></aclProtocol>"
|
|
if self.source_ip:
|
|
conf_str += "<aclSourceIp></aclSourceIp>"
|
|
if self.src_wild:
|
|
conf_str += "<aclSrcWild></aclSrcWild>"
|
|
if self.src_pool_name:
|
|
conf_str += "<aclSPoolName></aclSPoolName>"
|
|
if self.dest_ip:
|
|
conf_str += "<aclDestIp></aclDestIp>"
|
|
if self.dest_wild:
|
|
conf_str += "<aclDestWild></aclDestWild>"
|
|
if self.dest_pool_name:
|
|
conf_str += "<aclDPoolName></aclDPoolName>"
|
|
if self.src_port_op:
|
|
conf_str += "<aclSrcPortOp></aclSrcPortOp>"
|
|
if self.src_port_begin:
|
|
conf_str += "<aclSrcPortBegin></aclSrcPortBegin>"
|
|
if self.src_port_end:
|
|
conf_str += "<aclSrcPortEnd></aclSrcPortEnd>"
|
|
if self.src_port_pool_name:
|
|
conf_str += "<aclSPortPoolName></aclSPortPoolName>"
|
|
if self.dest_port_op:
|
|
conf_str += "<aclDestPortOp></aclDestPortOp>"
|
|
if self.dest_port_begin:
|
|
conf_str += "<aclDestPortB></aclDestPortB>"
|
|
if self.dest_port_end:
|
|
conf_str += "<aclDestPortE></aclDestPortE>"
|
|
if self.dest_port_pool_name:
|
|
conf_str += "<aclDPortPoolName></aclDPortPoolName>"
|
|
if self.frag_type:
|
|
conf_str += "<aclFragType></aclFragType>"
|
|
if self.precedence:
|
|
conf_str += "<aclPrecedence></aclPrecedence>"
|
|
if self.tos:
|
|
conf_str += "<aclTos></aclTos>"
|
|
if self.dscp:
|
|
conf_str += "<aclDscp></aclDscp>"
|
|
if self.icmp_name:
|
|
conf_str += "<aclIcmpName></aclIcmpName>"
|
|
if self.icmp_type:
|
|
conf_str += "<aclIcmpType></aclIcmpType>"
|
|
if self.icmp_code:
|
|
conf_str += "<aclIcmpCode></aclIcmpCode>"
|
|
conf_str += "<aclTtlExpired></aclTtlExpired>"
|
|
if self.vrf_name:
|
|
conf_str += "<vrfName></vrfName>"
|
|
if self.syn_flag:
|
|
conf_str += "<aclSynFlag></aclSynFlag>"
|
|
if self.tcp_flag_mask:
|
|
conf_str += "<aclTcpFlagMask></aclTcpFlagMask>"
|
|
conf_str += "<aclEstablished></aclEstablished>"
|
|
if self.time_range:
|
|
conf_str += "<aclTimeName></aclTimeName>"
|
|
if self.rule_description:
|
|
conf_str += "<aclRuleDescription></aclRuleDescription>"
|
|
if self.igmp_type:
|
|
conf_str += "<aclIgmpType></aclIgmpType>"
|
|
conf_str += "<aclLogFlag></aclLogFlag>"
|
|
|
|
conf_str += CE_GET_ACL_ADVANCE_RULE_TAIL
|
|
recv_xml = self.netconf_get_config(conf_str=conf_str)
|
|
|
|
if "<data/>" in recv_xml:
|
|
find_flag = False
|
|
|
|
else:
|
|
xml_str = recv_xml.replace('\r', '').replace('\n', '').\
|
|
replace('xmlns="urn:ietf:params:xml:ns:netconf:base:1.0"', "").\
|
|
replace('xmlns="http://www.huawei.com/netconf/vrp"', "")
|
|
|
|
root = ElementTree.fromstring(xml_str)
|
|
|
|
# parse advance rule
|
|
adv_rule_info = root.findall(
|
|
"acl/aclGroups/aclGroup/aclRuleAdv4s/aclRuleAdv4")
|
|
if adv_rule_info:
|
|
for tmp in adv_rule_info:
|
|
tmp_dict = dict()
|
|
for site in tmp:
|
|
if site.tag in ["aclRuleName", "aclRuleID", "aclAction", "aclProtocol", "aclSourceIp",
|
|
"aclSrcWild", "aclSPoolName", "aclDestIp", "aclDestWild",
|
|
"aclDPoolName", "aclSrcPortOp", "aclSrcPortBegin", "aclSrcPortEnd",
|
|
"aclSPortPoolName", "aclDestPortOp", "aclDestPortB", "aclDestPortE",
|
|
"aclDPortPoolName", "aclFragType", "aclPrecedence", "aclTos",
|
|
"aclDscp", "aclIcmpName", "aclIcmpType", "aclIcmpCode", "aclTtlExpired",
|
|
"vrfName", "aclSynFlag", "aclTcpFlagMask", "aclEstablished",
|
|
"aclTimeName", "aclRuleDescription", "aclIgmpType", "aclLogFlag"]:
|
|
tmp_dict[site.tag] = site.text
|
|
|
|
self.cur_advance_rule_cfg[
|
|
"adv_rule_info"].append(tmp_dict)
|
|
|
|
if self.cur_advance_rule_cfg["adv_rule_info"]:
|
|
for tmp in self.cur_advance_rule_cfg["adv_rule_info"]:
|
|
find_flag = True
|
|
|
|
if self.rule_name and tmp.get("aclRuleName") != self.rule_name:
|
|
find_flag = False
|
|
if self.rule_id and tmp.get("aclRuleID") != self.rule_id:
|
|
find_flag = False
|
|
if self.rule_action and tmp.get("aclAction") != self.rule_action:
|
|
find_flag = False
|
|
if self.protocol and tmp.get("aclProtocol") != self.protocol_num:
|
|
find_flag = False
|
|
if self.source_ip:
|
|
tmp_src_ip = self.source_ip.split(".")
|
|
tmp_src_wild = self.src_wild.split(".")
|
|
tmp_addr_item = []
|
|
for idx in range(4):
|
|
item1 = 255 - int(tmp_src_wild[idx])
|
|
item2 = item1 & int(tmp_src_ip[idx])
|
|
tmp_addr_item.append(item2)
|
|
tmp_addr = "%s.%s.%s.%s" % (tmp_addr_item[0], tmp_addr_item[1],
|
|
tmp_addr_item[2], tmp_addr_item[3])
|
|
if tmp_addr != tmp.get("aclSourceIp"):
|
|
find_flag = False
|
|
if self.src_wild and tmp.get("aclSrcWild") != self.src_wild:
|
|
find_flag = False
|
|
if self.src_pool_name and tmp.get("aclSPoolName") != self.src_pool_name:
|
|
find_flag = False
|
|
if self.dest_ip:
|
|
tmp_src_ip = self.dest_ip.split(".")
|
|
tmp_src_wild = self.dest_wild.split(".")
|
|
tmp_addr_item = []
|
|
for idx in range(4):
|
|
item1 = 255 - int(tmp_src_wild[idx])
|
|
item2 = item1 & int(tmp_src_ip[idx])
|
|
tmp_addr_item.append(item2)
|
|
tmp_addr = "%s.%s.%s.%s" % (tmp_addr_item[0], tmp_addr_item[1],
|
|
tmp_addr_item[2], tmp_addr_item[3])
|
|
if tmp_addr != tmp.get("aclDestIp"):
|
|
find_flag = False
|
|
if self.dest_wild and tmp.get("aclDestWild") != self.dest_wild:
|
|
find_flag = False
|
|
if self.dest_pool_name and tmp.get("aclDPoolName") != self.dest_pool_name:
|
|
find_flag = False
|
|
if self.src_port_op and tmp.get("aclSrcPortOp") != self.src_port_op:
|
|
find_flag = False
|
|
if self.src_port_begin and tmp.get("aclSrcPortBegin") != self.src_port_begin:
|
|
find_flag = False
|
|
if self.src_port_end and tmp.get("aclSrcPortEnd") != self.src_port_end:
|
|
find_flag = False
|
|
if self.src_port_pool_name and tmp.get("aclSPortPoolName") != self.src_port_pool_name:
|
|
find_flag = False
|
|
if self.dest_port_op and tmp.get("aclDestPortOp") != self.dest_port_op:
|
|
find_flag = False
|
|
if self.dest_port_begin and tmp.get("aclDestPortB") != self.dest_port_begin:
|
|
find_flag = False
|
|
if self.dest_port_end and tmp.get("aclDestPortE") != self.dest_port_end:
|
|
find_flag = False
|
|
if self.dest_port_pool_name and tmp.get("aclDPortPoolName") != self.dest_port_pool_name:
|
|
find_flag = False
|
|
frag_type = "clear_fragment" if tmp.get("aclFragType") is None else tmp.get("aclFragType")
|
|
if self.frag_type and frag_type != self.frag_type:
|
|
find_flag = False
|
|
if self.precedence and tmp.get("aclPrecedence") != self.precedence:
|
|
find_flag = False
|
|
if self.tos and tmp.get("aclTos") != self.tos:
|
|
find_flag = False
|
|
if self.dscp and tmp.get("aclDscp") != self.dscp:
|
|
find_flag = False
|
|
if self.icmp_name and tmp.get("aclIcmpName") != self.icmp_name:
|
|
find_flag = False
|
|
if self.icmp_type and tmp.get("aclIcmpType") != self.icmp_type:
|
|
find_flag = False
|
|
if self.icmp_code and tmp.get("aclIcmpCode") != self.icmp_code:
|
|
find_flag = False
|
|
if tmp.get("aclTtlExpired").lower() != str(self.ttl_expired).lower():
|
|
find_flag = False
|
|
if self.vrf_name and tmp.get("vrfName") != self.vrf_name:
|
|
find_flag = False
|
|
if self.syn_flag and tmp.get("aclSynFlag") != self.syn_flag:
|
|
find_flag = False
|
|
if self.tcp_flag_mask and tmp.get("aclTcpFlagMask") != self.tcp_flag_mask:
|
|
find_flag = False
|
|
if self.protocol == "tcp" and \
|
|
tmp.get("aclEstablished").lower() != str(self.established).lower():
|
|
find_flag = False
|
|
if self.time_range and tmp.get("aclTimeName") != self.time_range:
|
|
find_flag = False
|
|
if self.rule_description and tmp.get("aclRuleDescription") != self.rule_description:
|
|
find_flag = False
|
|
if self.igmp_type and tmp.get("aclIgmpType") != self.igmp_type_num:
|
|
find_flag = False
|
|
if tmp.get("aclLogFlag").lower() != str(self.log_flag).lower():
|
|
find_flag = False
|
|
|
|
if find_flag:
|
|
break
|
|
else:
|
|
find_flag = False
|
|
|
|
if self.state == "present":
|
|
need_cfg = bool(not find_flag)
|
|
elif self.state == "absent":
|
|
need_cfg = bool(find_flag)
|
|
else:
|
|
need_cfg = False
|
|
|
|
self.cur_advance_rule_cfg["need_cfg"] = need_cfg
|
|
|
|
def get_proposed(self):
|
|
""" Get proposed state """
|
|
|
|
self.proposed["state"] = self.state
|
|
|
|
if self.acl_name:
|
|
self.proposed["acl_name"] = self.acl_name
|
|
if self.acl_num:
|
|
self.proposed["acl_num"] = self.acl_num
|
|
if self.acl_step:
|
|
self.proposed["acl_step"] = self.acl_step
|
|
if self.acl_description:
|
|
self.proposed["acl_description"] = self.acl_description
|
|
if self.rule_name:
|
|
self.proposed["rule_name"] = self.rule_name
|
|
if self.rule_id:
|
|
self.proposed["rule_id"] = self.rule_id
|
|
if self.rule_action:
|
|
self.proposed["rule_action"] = self.rule_action
|
|
if self.protocol:
|
|
self.proposed["protocol"] = self.protocol
|
|
if self.source_ip:
|
|
self.proposed["source_ip"] = self.source_ip
|
|
if self.src_mask:
|
|
self.proposed["src_mask"] = self.src_mask
|
|
if self.src_pool_name:
|
|
self.proposed["src_pool_name"] = self.src_pool_name
|
|
if self.dest_ip:
|
|
self.proposed["dest_ip"] = self.dest_ip
|
|
if self.dest_mask:
|
|
self.proposed["dest_mask"] = self.dest_mask
|
|
if self.dest_pool_name:
|
|
self.proposed["dest_pool_name"] = self.dest_pool_name
|
|
if self.src_port_op:
|
|
self.proposed["src_port_op"] = self.src_port_op
|
|
if self.src_port_begin:
|
|
self.proposed["src_port_begin"] = self.src_port_begin
|
|
if self.src_port_end:
|
|
self.proposed["src_port_end"] = self.src_port_end
|
|
if self.src_port_pool_name:
|
|
self.proposed["src_port_pool_name"] = self.src_port_pool_name
|
|
if self.dest_port_op:
|
|
self.proposed["dest_port_op"] = self.dest_port_op
|
|
if self.dest_port_begin:
|
|
self.proposed["dest_port_begin"] = self.dest_port_begin
|
|
if self.dest_port_end:
|
|
self.proposed["dest_port_end"] = self.dest_port_end
|
|
if self.dest_port_pool_name:
|
|
self.proposed["dest_port_pool_name"] = self.dest_port_pool_name
|
|
if self.frag_type:
|
|
self.proposed["frag_type"] = self.frag_type
|
|
if self.precedence:
|
|
self.proposed["precedence"] = self.precedence
|
|
if self.tos:
|
|
self.proposed["tos"] = self.tos
|
|
if self.dscp:
|
|
self.proposed["dscp"] = self.dscp
|
|
if self.icmp_name:
|
|
self.proposed["icmp_name"] = self.icmp_name
|
|
if self.icmp_type:
|
|
self.proposed["icmp_type"] = self.icmp_type
|
|
if self.icmp_code:
|
|
self.proposed["icmp_code"] = self.icmp_code
|
|
if self.ttl_expired:
|
|
self.proposed["ttl_expired"] = self.ttl_expired
|
|
if self.vrf_name:
|
|
self.proposed["vrf_name"] = self.vrf_name
|
|
if self.syn_flag:
|
|
self.proposed["syn_flag"] = self.syn_flag
|
|
if self.tcp_flag_mask:
|
|
self.proposed["tcp_flag_mask"] = self.tcp_flag_mask
|
|
self.proposed["established"] = self.established
|
|
if self.time_range:
|
|
self.proposed["time_range"] = self.time_range
|
|
if self.rule_description:
|
|
self.proposed["rule_description"] = self.rule_description
|
|
if self.igmp_type:
|
|
self.proposed["igmp_type"] = self.igmp_type
|
|
self.proposed["log_flag"] = self.log_flag
|
|
|
|
def get_existing(self):
|
|
""" Get existing state """
|
|
|
|
self.existing["acl_info"] = self.cur_acl_cfg["acl_info"]
|
|
self.existing["adv_rule_info"] = self.cur_advance_rule_cfg[
|
|
"adv_rule_info"]
|
|
|
|
def get_end_state(self):
|
|
""" Get end state """
|
|
|
|
self.check_acl_args()
|
|
self.end_state["acl_info"] = self.cur_acl_cfg["acl_info"]
|
|
|
|
self.check_advance_rule_args()
|
|
self.end_state["adv_rule_info"] = self.cur_advance_rule_cfg[
|
|
"adv_rule_info"]
|
|
if self.end_state == self.existing:
|
|
self.changed = False
|
|
self.updates_cmd = list()
|
|
|
|
def merge_acl(self):
|
|
""" Merge acl operation """
|
|
|
|
conf_str = CE_MERGE_ACL_HEADER % self.acl_name
|
|
|
|
if self.acl_type:
|
|
conf_str += "<aclType>%s</aclType>" % self.acl_type
|
|
if self.acl_num:
|
|
conf_str += "<aclNumber>%s</aclNumber>" % self.acl_num
|
|
if self.acl_step:
|
|
conf_str += "<aclStep>%s</aclStep>" % self.acl_step
|
|
if self.acl_description:
|
|
conf_str += "<aclDescription>%s</aclDescription>" % self.acl_description
|
|
|
|
conf_str += CE_MERGE_ACL_TAIL
|
|
|
|
recv_xml = self.netconf_set_config(conf_str=conf_str)
|
|
|
|
if "<ok/>" not in recv_xml:
|
|
self.module.fail_json(msg='Error: Merge acl failed.')
|
|
|
|
if self.acl_name.isdigit():
|
|
cmd = "acl number %s" % self.acl_name
|
|
else:
|
|
if self.acl_type and not self.acl_num:
|
|
cmd = "acl name %s %s" % (self.acl_name, self.acl_type.lower())
|
|
elif self.acl_type and self.acl_num:
|
|
cmd = "acl name %s number %s" % (self.acl_name, self.acl_num)
|
|
elif not self.acl_type and self.acl_num:
|
|
cmd = "acl name %s number %s" % (self.acl_name, self.acl_num)
|
|
self.updates_cmd.append(cmd)
|
|
|
|
if self.acl_description:
|
|
cmd = "description %s" % self.acl_description
|
|
self.updates_cmd.append(cmd)
|
|
|
|
if self.acl_step:
|
|
cmd = "step %s" % self.acl_step
|
|
self.updates_cmd.append(cmd)
|
|
|
|
self.changed = True
|
|
|
|
def delete_acl(self):
|
|
""" Delete acl operation """
|
|
|
|
conf_str = CE_DELETE_ACL_HEADER % self.acl_name
|
|
|
|
if self.acl_type:
|
|
conf_str += "<aclType>%s</aclType>" % self.acl_type
|
|
if self.acl_num:
|
|
conf_str += "<aclNumber>%s</aclNumber>" % self.acl_num
|
|
if self.acl_step:
|
|
conf_str += "<aclStep>%s</aclStep>" % self.acl_step
|
|
if self.acl_description:
|
|
conf_str += "<aclDescription>%s</aclDescription>" % self.acl_description
|
|
|
|
conf_str += CE_DELETE_ACL_TAIL
|
|
|
|
recv_xml = self.netconf_set_config(conf_str=conf_str)
|
|
|
|
if "<ok/>" not in recv_xml:
|
|
self.module.fail_json(msg='Error: Delete acl failed.')
|
|
|
|
if self.acl_description:
|
|
cmd = "undo description"
|
|
self.updates_cmd.append(cmd)
|
|
|
|
if self.acl_step:
|
|
cmd = "undo step"
|
|
self.updates_cmd.append(cmd)
|
|
|
|
if self.acl_name.isdigit():
|
|
cmd = "undo acl number %s" % self.acl_name
|
|
else:
|
|
cmd = "undo acl name %s" % self.acl_name
|
|
self.updates_cmd.append(cmd)
|
|
|
|
self.changed = True
|
|
|
|
def merge_adv_rule(self):
|
|
""" Merge advance rule operation """
|
|
|
|
conf_str = CE_MERGE_ACL_ADVANCE_RULE_HEADER % (
|
|
self.acl_name, self.rule_name)
|
|
|
|
if self.rule_id:
|
|
conf_str += "<aclRuleID>%s</aclRuleID>" % self.rule_id
|
|
if self.rule_action:
|
|
conf_str += "<aclAction>%s</aclAction>" % self.rule_action
|
|
if self.protocol:
|
|
conf_str += "<aclProtocol>%s</aclProtocol>" % self.protocol_num
|
|
if self.source_ip:
|
|
conf_str += "<aclSourceIp>%s</aclSourceIp>" % self.source_ip
|
|
if self.src_wild:
|
|
conf_str += "<aclSrcWild>%s</aclSrcWild>" % self.src_wild
|
|
if self.src_pool_name:
|
|
conf_str += "<aclSPoolName>%s</aclSPoolName>" % self.src_pool_name
|
|
if self.dest_ip:
|
|
conf_str += "<aclDestIp>%s</aclDestIp>" % self.dest_ip
|
|
if self.dest_wild:
|
|
conf_str += "<aclDestWild>%s</aclDestWild>" % self.dest_wild
|
|
if self.dest_pool_name:
|
|
conf_str += "<aclDPoolName>%s</aclDPoolName>" % self.dest_pool_name
|
|
if self.src_port_op:
|
|
conf_str += "<aclSrcPortOp>%s</aclSrcPortOp>" % self.src_port_op
|
|
if self.src_port_begin:
|
|
conf_str += "<aclSrcPortBegin>%s</aclSrcPortBegin>" % self.src_port_begin
|
|
if self.src_port_end:
|
|
conf_str += "<aclSrcPortEnd>%s</aclSrcPortEnd>" % self.src_port_end
|
|
if self.src_port_pool_name:
|
|
conf_str += "<aclSPortPoolName>%s</aclSPortPoolName>" % self.src_port_pool_name
|
|
if self.dest_port_op:
|
|
conf_str += "<aclDestPortOp>%s</aclDestPortOp>" % self.dest_port_op
|
|
if self.dest_port_begin:
|
|
conf_str += "<aclDestPortB>%s</aclDestPortB>" % self.dest_port_begin
|
|
if self.dest_port_end:
|
|
conf_str += "<aclDestPortE>%s</aclDestPortE>" % self.dest_port_end
|
|
if self.dest_port_pool_name:
|
|
conf_str += "<aclDPortPoolName>%s</aclDPortPoolName>" % self.dest_port_pool_name
|
|
if self.frag_type:
|
|
conf_str += "<aclFragType>%s</aclFragType>" % self.frag_type
|
|
if self.precedence:
|
|
conf_str += "<aclPrecedence>%s</aclPrecedence>" % self.precedence
|
|
if self.tos:
|
|
conf_str += "<aclTos>%s</aclTos>" % self.tos
|
|
if self.dscp:
|
|
conf_str += "<aclDscp>%s</aclDscp>" % self.dscp
|
|
if self.icmp_name:
|
|
conf_str += "<aclIcmpName>%s</aclIcmpName>" % self.icmp_name
|
|
if self.icmp_type:
|
|
conf_str += "<aclIcmpType>%s</aclIcmpType>" % self.icmp_type
|
|
if self.icmp_code:
|
|
conf_str += "<aclIcmpCode>%s</aclIcmpCode>" % self.icmp_code
|
|
conf_str += "<aclTtlExpired>%s</aclTtlExpired>" % str(self.ttl_expired).lower()
|
|
if self.vrf_name:
|
|
conf_str += "<vrfName>%s</vrfName>" % self.vrf_name
|
|
if self.syn_flag:
|
|
conf_str += "<aclSynFlag>%s</aclSynFlag>" % self.syn_flag
|
|
if self.tcp_flag_mask:
|
|
conf_str += "<aclTcpFlagMask>%s</aclTcpFlagMask>" % self.tcp_flag_mask
|
|
if self.protocol == "tcp":
|
|
conf_str += "<aclEstablished>%s</aclEstablished>" % str(self.established).lower()
|
|
if self.time_range:
|
|
conf_str += "<aclTimeName>%s</aclTimeName>" % self.time_range
|
|
if self.rule_description:
|
|
conf_str += "<aclRuleDescription>%s</aclRuleDescription>" % self.rule_description
|
|
if self.igmp_type:
|
|
conf_str += "<aclIgmpType>%s</aclIgmpType>" % self.igmp_type_num
|
|
conf_str += "<aclLogFlag>%s</aclLogFlag>" % str(self.log_flag).lower()
|
|
|
|
conf_str += CE_MERGE_ACL_ADVANCE_RULE_TAIL
|
|
|
|
recv_xml = self.netconf_set_config(conf_str=conf_str)
|
|
|
|
if "<ok/>" not in recv_xml:
|
|
self.module.fail_json(msg='Error: Merge acl base rule failed.')
|
|
|
|
if self.rule_action and self.protocol:
|
|
cmd = "rule"
|
|
if self.rule_id:
|
|
cmd += " %s" % self.rule_id
|
|
cmd += " %s" % self.rule_action
|
|
cmd += " %s" % self.protocol
|
|
if self.dscp:
|
|
cmd += " dscp %s" % self.dscp
|
|
if self.tos:
|
|
cmd += " tos %s" % self.tos
|
|
if self.source_ip and self.src_wild:
|
|
cmd += " source %s %s" % (self.source_ip, self.src_wild)
|
|
if self.src_pool_name:
|
|
cmd += " source-pool %s" % self.src_pool_name
|
|
if self.src_port_op:
|
|
cmd += " source-port"
|
|
if self.src_port_op == "lt":
|
|
cmd += " lt %s" % self.src_port_end
|
|
elif self.src_port_op == "eq":
|
|
cmd += " eq %s" % self.src_port_begin
|
|
elif self.src_port_op == "gt":
|
|
cmd += " gt %s" % self.src_port_begin
|
|
elif self.src_port_op == "range":
|
|
cmd += " range %s %s" % (self.src_port_begin,
|
|
self.src_port_end)
|
|
if self.src_port_pool_name:
|
|
cmd += " source-port-pool %s" % self.src_port_pool_name
|
|
if self.dest_ip and self.dest_wild:
|
|
cmd += " destination %s %s" % (self.dest_ip, self.dest_wild)
|
|
if self.dest_pool_name:
|
|
cmd += " destination-pool %s" % self.dest_pool_name
|
|
if self.dest_port_op:
|
|
cmd += " destination-port"
|
|
if self.dest_port_op == "lt":
|
|
cmd += " lt %s" % self.dest_port_end
|
|
elif self.dest_port_op == "eq":
|
|
cmd += " eq %s" % self.dest_port_begin
|
|
elif self.dest_port_op == "gt":
|
|
cmd += " gt %s" % self.dest_port_begin
|
|
elif self.dest_port_op == "range":
|
|
cmd += " range %s %s" % (self.dest_port_begin,
|
|
self.dest_port_end)
|
|
if self.dest_port_pool_name:
|
|
cmd += " destination-port-pool %s" % self.dest_port_pool_name
|
|
if self.frag_type == "fragment":
|
|
cmd += " fragment-type fragment"
|
|
if self.precedence:
|
|
cmd += " precedence %s" % self.precedence_name[self.precedence]
|
|
|
|
if self.protocol == "icmp":
|
|
if self.icmp_name:
|
|
cmd += " icmp-type %s" % self.icmp_name
|
|
elif self.icmp_type and self.icmp_code:
|
|
cmd += " icmp-type %s %s" % (self.icmp_type, self.icmp_code)
|
|
elif self.icmp_type:
|
|
cmd += " icmp-type %s" % self.icmp_type
|
|
if self.protocol == "tcp":
|
|
if self.syn_flag:
|
|
cmd += " tcp-flag %s" % self.syn_flag
|
|
if self.tcp_flag_mask:
|
|
cmd += " mask %s" % self.tcp_flag_mask
|
|
if self.established:
|
|
cmd += " established"
|
|
if self.protocol == "igmp":
|
|
if self.igmp_type:
|
|
cmd += " igmp-type %s" % self.igmp_type
|
|
if self.time_range:
|
|
cmd += " time-range %s" % self.time_range
|
|
if self.vrf_name:
|
|
cmd += " vpn-instance %s" % self.vrf_name
|
|
if self.ttl_expired:
|
|
cmd += " ttl-expired"
|
|
if self.log_flag:
|
|
cmd += " logging"
|
|
self.updates_cmd.append(cmd)
|
|
|
|
if self.rule_description:
|
|
cmd = "rule %s description %s" % (
|
|
self.rule_id, self.rule_description)
|
|
self.updates_cmd.append(cmd)
|
|
|
|
self.changed = True
|
|
|
|
def delete_adv_rule(self):
|
|
""" Delete advance rule operation """
|
|
|
|
conf_str = CE_DELETE_ACL_ADVANCE_RULE_HEADER % (
|
|
self.acl_name, self.rule_name)
|
|
|
|
if self.rule_id:
|
|
conf_str += "<aclRuleID>%s</aclRuleID>" % self.rule_id
|
|
if self.rule_action:
|
|
conf_str += "<aclAction>%s</aclAction>" % self.rule_action
|
|
if self.protocol:
|
|
conf_str += "<aclProtocol>%s</aclProtocol>" % self.protocol_num
|
|
if self.source_ip:
|
|
conf_str += "<aclSourceIp>%s</aclSourceIp>" % self.source_ip
|
|
if self.src_wild:
|
|
conf_str += "<aclSrcWild>%s</aclSrcWild>" % self.src_wild
|
|
if self.src_pool_name:
|
|
conf_str += "<aclSPoolName>%s</aclSPoolName>" % self.src_pool_name
|
|
if self.dest_ip:
|
|
conf_str += "<aclDestIp>%s</aclDestIp>" % self.dest_ip
|
|
if self.dest_wild:
|
|
conf_str += "<aclDestWild>%s</aclDestWild>" % self.dest_wild
|
|
if self.dest_pool_name:
|
|
conf_str += "<aclDPoolName>%s</aclDPoolName>" % self.dest_pool_name
|
|
if self.src_port_op:
|
|
conf_str += "<aclSrcPortOp>%s</aclSrcPortOp>" % self.src_port_op
|
|
if self.src_port_begin:
|
|
conf_str += "<aclSrcPortBegin>%s</aclSrcPortBegin>" % self.src_port_begin
|
|
if self.src_port_end:
|
|
conf_str += "<aclSrcPortEnd>%s</aclSrcPortEnd>" % self.src_port_end
|
|
if self.src_port_pool_name:
|
|
conf_str += "<aclSPortPoolName>%s</aclSPortPoolName>" % self.src_port_pool_name
|
|
if self.dest_port_op:
|
|
conf_str += "<aclDestPortOp>%s</aclDestPortOp>" % self.dest_port_op
|
|
if self.dest_port_begin:
|
|
conf_str += "<aclDestPortB>%s</aclDestPortB>" % self.dest_port_begin
|
|
if self.dest_port_end:
|
|
conf_str += "<aclDestPortE>%s</aclDestPortE>" % self.dest_port_end
|
|
if self.dest_port_pool_name:
|
|
conf_str += "<aclDPortPoolName>%s</aclDPortPoolName>" % self.dest_port_pool_name
|
|
if self.frag_type:
|
|
conf_str += "<aclFragType>%s</aclFragType>" % self.frag_type
|
|
if self.precedence:
|
|
conf_str += "<aclPrecedence>%s</aclPrecedence>" % self.precedence
|
|
if self.tos:
|
|
conf_str += "<aclTos>%s</aclTos>" % self.tos
|
|
if self.dscp:
|
|
conf_str += "<aclDscp>%s</aclDscp>" % self.dscp
|
|
if self.icmp_name:
|
|
conf_str += "<aclIcmpName>%s</aclIcmpName>" % self.icmp_name
|
|
if self.icmp_type:
|
|
conf_str += "<aclIcmpType>%s</aclIcmpType>" % self.icmp_type
|
|
if self.icmp_code:
|
|
conf_str += "<aclIcmpCode>%s</aclIcmpCode>" % self.icmp_code
|
|
conf_str += "<aclTtlExpired>%s</aclTtlExpired>" % str(self.ttl_expired).lower()
|
|
if self.vrf_name:
|
|
conf_str += "<vrfName>%s</vrfName>" % self.vrf_name
|
|
if self.syn_flag:
|
|
conf_str += "<aclSynFlag>%s</aclSynFlag>" % self.syn_flag
|
|
if self.tcp_flag_mask:
|
|
conf_str += "<aclTcpFlagMask>%s</aclTcpFlagMask>" % self.tcp_flag_mask
|
|
if self.protocol == "tcp":
|
|
conf_str += "<aclEstablished>%s</aclEstablished>" % str(self.established).lower()
|
|
if self.time_range:
|
|
conf_str += "<aclTimeName>%s</aclTimeName>" % self.time_range
|
|
if self.rule_description:
|
|
conf_str += "<aclRuleDescription>%s</aclRuleDescription>" % self.rule_description
|
|
if self.igmp_type:
|
|
conf_str += "<aclIgmpType>%s</aclIgmpType>" % self.igmp_type
|
|
conf_str += "<aclLogFlag>%s</aclLogFlag>" % str(self.log_flag).lower()
|
|
|
|
conf_str += CE_DELETE_ACL_ADVANCE_RULE_TAIL
|
|
|
|
recv_xml = self.netconf_set_config(conf_str=conf_str)
|
|
|
|
if "<ok/>" not in recv_xml:
|
|
self.module.fail_json(msg='Error: Delete acl base rule failed.')
|
|
|
|
if self.rule_description:
|
|
if self.acl_name.isdigit():
|
|
cmd = "acl number %s" % self.acl_name
|
|
else:
|
|
cmd = "acl name %s" % self.acl_name
|
|
self.updates_cmd.append(cmd)
|
|
|
|
cmd = "undo rule %s description" % self.rule_id
|
|
self.updates_cmd.append(cmd)
|
|
|
|
if self.rule_id:
|
|
if self.acl_name.isdigit():
|
|
cmd = "acl number %s" % self.acl_name
|
|
else:
|
|
cmd = "acl name %s" % self.acl_name
|
|
self.updates_cmd.append(cmd)
|
|
|
|
cmd = "undo rule %s" % self.rule_id
|
|
self.updates_cmd.append(cmd)
|
|
elif self.rule_action and self.protocol:
|
|
if self.acl_name.isdigit():
|
|
cmd = "acl number %s" % self.acl_name
|
|
else:
|
|
cmd = "acl name %s" % self.acl_name
|
|
self.updates_cmd.append(cmd)
|
|
|
|
cmd = "undo rule"
|
|
cmd += " %s" % self.rule_action
|
|
cmd += " %s" % self.protocol
|
|
if self.dscp:
|
|
cmd += " dscp %s" % self.dscp
|
|
if self.tos:
|
|
cmd += " tos %s" % self.tos
|
|
if self.source_ip and self.src_mask:
|
|
cmd += " source %s %s" % (self.source_ip, self.src_mask)
|
|
if self.src_pool_name:
|
|
cmd += " source-pool %s" % self.src_pool_name
|
|
if self.src_port_op:
|
|
cmd += " source-port"
|
|
if self.src_port_op == "lt":
|
|
cmd += " lt %s" % self.src_port_end
|
|
elif self.src_port_op == "eq":
|
|
cmd += " eq %s" % self.src_port_begin
|
|
elif self.src_port_op == "gt":
|
|
cmd += " gt %s" % self.src_port_begin
|
|
elif self.src_port_op == "range":
|
|
cmd += " range %s %s" % (self.src_port_begin,
|
|
self.src_port_end)
|
|
if self.src_port_pool_name:
|
|
cmd += " source-port-pool %s" % self.src_port_pool_name
|
|
if self.dest_ip and self.dest_mask:
|
|
cmd += " destination %s %s" % (self.dest_ip, self.dest_mask)
|
|
if self.dest_pool_name:
|
|
cmd += " destination-pool %s" % self.dest_pool_name
|
|
if self.dest_port_op:
|
|
cmd += " destination-port"
|
|
if self.dest_port_op == "lt":
|
|
cmd += " lt %s" % self.dest_port_end
|
|
elif self.dest_port_op == "eq":
|
|
cmd += " eq %s" % self.dest_port_begin
|
|
elif self.dest_port_op == "gt":
|
|
cmd += " gt %s" % self.dest_port_begin
|
|
elif self.dest_port_op == "range":
|
|
cmd += " range %s %s" % (self.dest_port_begin,
|
|
self.dest_port_end)
|
|
if self.dest_port_pool_name:
|
|
cmd += " destination-port-pool %s" % self.dest_port_pool_name
|
|
if self.frag_type == "fragment":
|
|
cmd += " fragment-type fragment"
|
|
if self.precedence:
|
|
cmd += " precedence %s" % self.precedence_name[self.precedence]
|
|
if self.time_range:
|
|
cmd += " time-range %s" % self.time_range
|
|
if self.vrf_name:
|
|
cmd += " vpn-instance %s" % self.vrf_name
|
|
if self.ttl_expired:
|
|
cmd += " ttl-expired"
|
|
if self.log_flag:
|
|
cmd += " logging"
|
|
self.updates_cmd.append(cmd)
|
|
|
|
self.changed = True
|
|
|
|
def work(self):
|
|
""" Main work function """
|
|
|
|
self.check_acl_args()
|
|
self.check_advance_rule_args()
|
|
self.get_proposed()
|
|
self.get_existing()
|
|
|
|
if self.state == "present":
|
|
if self.cur_acl_cfg["need_cfg"]:
|
|
self.merge_acl()
|
|
if self.cur_advance_rule_cfg["need_cfg"]:
|
|
self.merge_adv_rule()
|
|
|
|
elif self.state == "absent":
|
|
if self.cur_advance_rule_cfg["need_cfg"]:
|
|
self.delete_adv_rule()
|
|
|
|
elif self.state == "delete_acl":
|
|
if self.cur_acl_cfg["need_cfg"]:
|
|
self.delete_acl()
|
|
|
|
self.get_end_state()
|
|
|
|
self.results['changed'] = self.changed
|
|
self.results['proposed'] = self.proposed
|
|
self.results['existing'] = self.existing
|
|
self.results['end_state'] = self.end_state
|
|
self.results['updates'] = self.updates_cmd
|
|
|
|
self.module.exit_json(**self.results)
|
|
|
|
|
|
def main():
|
|
""" Module main """
|
|
|
|
argument_spec = dict(
|
|
state=dict(choices=['present', 'absent',
|
|
'delete_acl'], default='present'),
|
|
acl_name=dict(type='str', required=True),
|
|
acl_num=dict(type='str'),
|
|
acl_step=dict(type='str'),
|
|
acl_description=dict(type='str'),
|
|
rule_name=dict(type='str'),
|
|
rule_id=dict(type='str'),
|
|
rule_action=dict(choices=['permit', 'deny']),
|
|
protocol=dict(choices=['ip', 'icmp', 'igmp',
|
|
'ipinip', 'tcp', 'udp', 'gre', 'ospf']),
|
|
source_ip=dict(type='str'),
|
|
src_mask=dict(type='str'),
|
|
src_pool_name=dict(type='str'),
|
|
dest_ip=dict(type='str'),
|
|
dest_mask=dict(type='str'),
|
|
dest_pool_name=dict(type='str'),
|
|
src_port_op=dict(choices=['lt', 'eq', 'gt', 'range']),
|
|
src_port_begin=dict(type='str'),
|
|
src_port_end=dict(type='str'),
|
|
src_port_pool_name=dict(type='str'),
|
|
dest_port_op=dict(choices=['lt', 'eq', 'gt', 'range']),
|
|
dest_port_begin=dict(type='str'),
|
|
dest_port_end=dict(type='str'),
|
|
dest_port_pool_name=dict(type='str'),
|
|
frag_type=dict(choices=['fragment', 'clear_fragment']),
|
|
precedence=dict(type='str'),
|
|
tos=dict(type='str'),
|
|
dscp=dict(type='str'),
|
|
icmp_name=dict(choices=['unconfiged', 'echo', 'echo-reply', 'fragmentneed-DFset', 'host-redirect',
|
|
'host-tos-redirect', 'host-unreachable', 'information-reply', 'information-request',
|
|
'net-redirect', 'net-tos-redirect', 'net-unreachable', 'parameter-problem',
|
|
'port-unreachable', 'protocol-unreachable', 'reassembly-timeout', 'source-quench',
|
|
'source-route-failed', 'timestamp-reply', 'timestamp-request', 'ttl-exceeded',
|
|
'address-mask-reply', 'address-mask-request', 'custom']),
|
|
icmp_type=dict(type='str'),
|
|
icmp_code=dict(type='str'),
|
|
ttl_expired=dict(required=False, default=False, type='bool'),
|
|
vrf_name=dict(type='str'),
|
|
syn_flag=dict(type='str'),
|
|
tcp_flag_mask=dict(type='str'),
|
|
established=dict(required=False, default=False, type='bool'),
|
|
time_range=dict(type='str'),
|
|
rule_description=dict(type='str'),
|
|
igmp_type=dict(choices=['host-query', 'mrouter-adver', 'mrouter-solic', 'mrouter-termi', 'mtrace-resp',
|
|
'mtrace-route', 'v1host-report', 'v2host-report', 'v2leave-group', 'v3host-report']),
|
|
log_flag=dict(required=False, default=False, type='bool')
|
|
)
|
|
|
|
argument_spec.update(ce_argument_spec)
|
|
module = AdvanceAcl(argument_spec=argument_spec)
|
|
module.work()
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main()
|