Package: capirca-xlate
capirca-xlatecapirca-xlateis a library for writing network ACL policies in YAML
format and converting them to thecapircaformat for
platform-specific ACL generation.  It will take an ACL policy like this:---name:"allowtointernet"comment:|Denies all traffic to internal IPs except established tcp replies.Also denies access to certain public allocations.Ideal for some internal lab/testing types of subnets that arenot well trusted, but allowing internal users to access.Apply to ingress interface (to filter traffic coming from lab)targets:-platform:cisconxoptions:-extendedaces:-name: accept-dhcp comment:Optional - allow forwarding of DHCP requests.destination_ports:-DHCPprotocols:-udpaction:accept-name:accept-to-honestdns {comment:Allow name resolution using honestdns.destination_addresses:-GOOGLE_DNSdestination_ports:-DNSprotocols:-udpaction:accept-name:accept-tcp-repliescomment:Allow tcp replies to internal hosts.destination_addresses:-INTERNALprotocols:-tcpoptions:-tcp-establishedaction:accept-name:deny-to-internalcomment:Deny access to rfc1918/internal.destination_addresses:-INTERNALaction:deny-name:deny-to-specific_hostscomment:Deny access to specified public.destination_addresses:-WEB_SERVERS-MAIL_SERVERSaction:deny-name:default-permitcomment:Allow what's left.action:acceptAnd transform it into thecapircaplyformat below:header {
  comment:: "Denies all traffic to internal IPs except established tcp replies."
  comment:: "Also denies access to certain public allocations."
  
  comment:: "Ideal for some internal lab/testing types of subnets that are"
  comment:: "not well trusted, but allowing internal users to access."
  
  comment:: "Apply to ingress interface (to filter traffic coming from lab)"
  
  target:: cisconx allowtointernet extended
}

term accept-dhcp {
  comment:: "Optional - allow forwarding of DHCP requests."
  destination-port:: DHCP
  protocol:: udp
  action:: accept
}
term accept-to-honestdns { {
  comment:: "Allow name resolution using honestdns."
  destination-address:: GOOGLE_DNS
  destination-port:: DNS
  protocol:: udp
  action:: accept
}
term accept-tcp-replies {
  comment:: "Allow tcp replies to internal hosts."
  destination-address:: INTERNAL
  protocol:: tcp
  option:: tcp-established
  action:: accept
}
term deny-to-internal {
  comment:: "Deny access to rfc1918/internal."
  destination-address:: INTERNAL
  action:: deny
}
term deny-to-specific_hosts {
  comment:: "Deny access to specified public."
  destination-address:: WEB_SERVERS MAIL_SERVERS
  action:: deny
}
term default-permit {
  comment:: "Allow what's left."
  action:: accept
}UsageUsingcapirca_xlateis straightforward.  There are two functions
for loading data and three functions for generatingply-formatted
policies/definitions.  The below is a complete example.frompathlibimportPathimportcapirca_xlate.xlateacl=capirca_xlate.xlate.load_acl(Path('example_acl.yml'))definitions=capirca_xlate.xlate.load_def(Path('example_def.yml'))print(capirca_xlate.xlate.xlate_net(definitions))print(capirca_xlate.xlate.xlate_svc(definitions))print(capirca_xlate.xlate.xlate_acl(acl))You can look at theacl_schema.yamlanddefinitions_schema.yamlfiles in this repo to get a better sense of how to structure your data.
These schemas are updated when the code is updated.Project State and ReasoningAt this time, all functionality should be consideredalpha.  This
is currently a library, not an end-user CLI tool.  It can be used to
create an end-user CLI tool, but because policies can be arranged and
described in a wide variety of ways, the focus for now is on providing
the library to manage your own policies the way you want/need.This library very heavily leverages types.  It does this to ensure
definitions and policies will be rendered to something valid.  For
example, it will prevent you from generating the following:DNS = 53/udp
HTTP = 80/tcp
ALL = DNS
      HTTP
      SSHThis istechnicallyvalid syntax, but because there is no definition
ofSSH,capircawill ultimately fail to generate the ACL.
Additionally, IPv4 and IPv6 addresses must be valid network addresses in
CIDR notation, because this is whatcapircaexpects.  Other
validations exist, too, such as ensuring you don't typotcp-establishedas anoptions.  Finally, it is opinionated in the
its data is structured.  The structure of the data is not a 1:1 mapping
ofcapirca.  For example, in thecapircaplyformat, multiple
references to addresses are simply separated by a blank space ().
However, this library expects multiple addresses to be unique items in a
list.Everything in this library is exposed for the developer.  Althougth the
primary intent is to allow for translating between a YAML-based spec and
the officialplyspec, the data is modeled with classes exposed in
such a way that the original source of the data is largely irrelevant.
For example, you could write code that fetched the source data from a
SQL data base, then created the necessary objects (ACLandDefinitions) with the appropriate fields, then pass those objects to
the template rendering functions (capirca_xlate.xlate.xlate_acl(),capirca_xlate.xlate.xlate_net(), andcapirca_xlate.xlate.xlate_svc()) and get theply-formatted string
back.Thexlate_*functions return thecapircaplyformat back as a
string.  They do not write to disk.  This is to enable flexibility for
developers to programmatically leverage tools such ascapirca_xlate,capirca, andnornirornetmikofor full end-to-end ACL automation
without needing to repeatedly read from and write to disk.Feature Supportcapircahas a wide variety of options and features, some of which are
platform-specific.capirca_xlatedoes not support all of these.  It
currently supports common features and options, but not vendor- or
platform-specific features, such asfrom-zoneandto-zone.TODOAdd a licenseAdd testsAdd more examplesShow examples of non-YAML source dataShow examples of integrating withnornir