Cisco ASA: Add enable_dsmo header option

capirca/lib/ciscoasa.py

@@ -29,6 +29,7 @@
 from capirca.lib import aclgenerator
 from capirca.lib import cisco
 from capirca.lib import nacaddr
+from capirca.lib import summarizer
 
 
 _ACTION_TABLE = {
@@ -64,12 +65,13 @@ class NoCiscoPolicyError(Error):
 class Term(cisco.Term):
   """A single ACL Term."""
 
-  def __init__(self, term, filter_name, af=4):
+  def __init__(self, term, filter_name, af=4, enable_dsmo=False):
     self.term = term
     self.filter_name = filter_name
     self.options = []
     assert af in (4, 6)
     self.af = af
+    self.enable_dsmo = enable_dsmo
 
   def __str__(self):
     # Verify platform specific terms. Skip whole term if platform does not
@@ -123,6 +125,8 @@ def __str__(self):
         source_address = nacaddr.ExcludeAddrs(
             source_address,
             source_address_exclude)
+      if len(source_address) > 1 and self.enable_dsmo:
+        source_address = summarizer.Summarize(source_address)
     else:
       # source address not set
       source_address = ['any']
@@ -137,6 +141,8 @@ def __str__(self):
         destination_address = nacaddr.ExcludeAddrs(
             destination_address,
             destination_address_exclude)
+      if len(destination_address) > 1 and self.enable_dsmo:
+        destination_address = summarizer.Summarize(destination_address)
     else:
       # destination address not set
       destination_address = ['any']
@@ -184,6 +190,8 @@ def __str__(self):
                        (saddr == 'any')) and
                       ((isinstance(daddr, nacaddr.IPv4)) or (daddr == 'any'))):
                     do_output = True
+                  elif isinstance(saddr, summarizer.DSMNet) or isinstance(daddr, summarizer.DSMNet):
+                    do_output = True
                 if self.af == 6:
                   if (((isinstance(saddr, nacaddr.IPv6)) or
                        (saddr == 'any')) and
@@ -252,6 +260,16 @@ def _TermletToStr(self, filter_name, action, proto, saddr, sport, daddr,
       else:
         daddr = 'host %s' % (daddr.network_address)
 
+    if isinstance(saddr, summarizer.DSMNet):
+      saddr = '%s %s' % summarizer.ToDottedQuad(saddr, negate=False)
+      if saddr.endswith('255.255.255.255'):
+        saddr = f'host {saddr.split()[0]}'
+
+    if isinstance(daddr, summarizer.DSMNet):
+      daddr = '%s %s' % summarizer.ToDottedQuad(daddr, negate=False)
+      if daddr.endswith('255.255.255.255'):
+        daddr = f'host {daddr.split()[0]}'
+
     # fix ports
     if not sport:
       sport = ''
@@ -325,7 +343,8 @@ def _TranslatePolicy(self, pol, exp_info):
     exp_info_date = current_date + datetime.timedelta(weeks=exp_info)
 
     for header, terms in self.policy.filters:
-      filter_name = header.FilterName('ciscoasa')
+      filter_options = header.FilterOptions(self._PLATFORM)
+      filter_name = header.FilterName(self._PLATFORM)
 
       new_terms = []
       # now add the terms
@@ -339,7 +358,8 @@ def _TranslatePolicy(self, pol, exp_info):
                             'will not be rendered.', term.name, filter_name)
             continue
 
-        new_terms.append(str(Term(term, filter_name)))
+        enable_dsmo = len(filter_options) > 1 and 'enable_dsmo' in filter_options[1:]
+        new_terms.append(str(Term(term, filter_name, enable_dsmo=enable_dsmo)))
 
       self.ciscoasa_policies.append((header, filter_name, new_terms))
 

tests/lib/ciscoasa_test.py

@@ -22,6 +22,7 @@
 import unittest
 
 from capirca.lib import ciscoasa
+from capirca.lib import nacaddr
 from capirca.lib import naming
 from capirca.lib import policy
 import mock
@@ -34,6 +35,13 @@
 }
 """
 
+GOOD_DSMO_HEADER = """
+header {
+  comment:: "this is a test acl"
+  target:: ciscoasa test-filter enable_dsmo
+}
+"""
+
 GOOD_TERM_1 = """
 term good-term-1 {
   verbatim:: ciscoasa "mary had a little lamb"
@@ -49,6 +57,14 @@
 }
 """
 
+GOOD_DSMO_TERM = """
+term good-dsmo-term {
+  protocol:: tcp
+  destination-address:: SOME_HOST
+  action:: accept
+}
+"""
+
 SUPPORTED_TOKENS = {
     'action',
     'comment',
@@ -144,6 +160,19 @@ def testBuildWarningTokens(self):
     self.assertEqual(st, SUPPORTED_TOKENS)
     self.assertEqual(sst, SUPPORTED_SUB_TOKENS)
 
+  def testDsmo(self):
+    addr_list = list()
+    for octet in range(0, 256):
+      net = nacaddr.IP('192.168.' + str(octet) + '.64/27')
+      addr_list.append(net)
+    self.naming.GetNetAddr.return_value = addr_list
+
+    acl = ciscoasa.CiscoASA(policy.ParsePolicy(GOOD_DSMO_HEADER + GOOD_DSMO_TERM,
+                                               self.naming), EXP_INFO)
+    self.assertIn('permit tcp any 192.168.0.64 255.255.0.224', str(acl))
+
+    self.naming.GetNetAddr.assert_called_once_with('SOME_HOST')
+
 
 if __name__ == '__main__':
   unittest.main()