Rafactoring ACL attributes #464
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Release 0.2.0
* Add ASA parser Co-authored-by: Justin Drew <jdrew82@users.noreply.github.com>
* Add BASE_INTERFACES for hp_comware & checkpoint Co-authored-by: Josef Fuchs <josef.fuchs@pankl.com>
prep for 0.2.1 release
release 0.2.1
Adds docs for readthedocs
…ion_docs Updated attribution and contribution doc start-lines
move sphinx to dev dep, update docs, update metadata
* Small performance enhancers - remove redundant call to `str` - `get_all_host` list to generator to avoid memory overhead of very large lists * Add lookup table for netmasks There are only 32 + 128 valid IPv4/6 netmasks, so I created a lookup table for easy validation. If there are concerns about the memory overhead, a computed version is easy enough to implement. * Make netutils dual-stack I modified functions where I could to make them compatible with IPv6. Per [RFC4291](https://datatracker.ietf.org/doc/html/rfc4291#section-4), I have assumed any addresses in the ::/8 range are IPv4. The one exception is `cidr_to_netmask`. I added a v6 version of that function. * Modify/add tests for proposed functionality
* remove count_bits tests * Remove count_bits in favor of simpler/faster function
* interface_range_expansion function added
Co-authored-by: Adam Byczkowski <38091261+qduk@users.noreply.github.com>
Co-authored-by: Adam Byczkowski <38091261+qduk@users.noreply.github.com>
Add interface sorting support.
Remove the requests package
* Added ability to create interface lists
* add tcp/udp port mapper
* Added document page for lib_mappings * Updated lib mapping description and added README for pypi * Update Scrapli variable name to include lib_mapper
mzbroch
requested review from
abates,
itdependsnetworks,
jeffkala and
qduk
as code owners
netutils/acl.py
Outdated
| return str(item.deny) # pylint: disable=undefined-loop-variable | ||
| if item.match(rule): # mzb: bugfix | ||
| return True # mzb: change to bool | ||
| return False # pylint: disable=undefined-loop-variable |
Contributor
There was a problem hiding this comment.
I had this as string as most vendors have more than just permit or deny, this is Palo's
allow
deny
drop
reset client
reset server
reset client and server
Contributor
Author
There was a problem hiding this comment.
IMO match method should return only True/False if the rule is/not matched by the check. This should only check if A contains B.
Contributor
There was a problem hiding this comment.
I think it is reasonable to have different levels.
Contributor
Author
There was a problem hiding this comment.
I think, I see this in a little different way :
def match_action(action, match_action):
deny_actions = ['deny', 'drop', 'reset client', 'reset server', ...]
if action in deny_actions and match_action in deny_actions:
return True
else:
return False
I would really like to avoid putting opinionated logic into generic match resolution while we provide easily extensible framework
LoneStar-Swish
force-pushed
the
develop
branch
from
a275d73 to
7db22a5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Nonevalues:src_ip': None, 'dst_ip': None, 'action': None}