access-control-python3-v1 0.0.7
ACL_Manager_v2
License: MIT
Requires Python: >=3, <4

# Telnyx ACL Manager (TAM)
> Managing ACLs has never been easier!

**TAM** is a tool born out of the need to automate and parallelize the addition and deletion of host prefixes in the `ACL.EDGE-INGRESS` extended access-list present on all `.*ER.*` network devices in the Telnyx backbone. 

## Installation

#### Requirements

- python 3.x.x
- pip3
- git

```sh
pip3 install "git+ssh://github.com/team-telnyx/network.git#egg=tam&subdirectory=telnyx_acl_manager_v2" --user
```

or

```shell
git clone https://github.com/team-telnyx/network.git
cd network/telnyx_acl_manager_v2
pip3 install . --user
```

This will provide you with the `tam-cli` tool, with which you can call the tool (duh) assuming your `$PATH` is setup correctly (you might need to close and reopen the terminal window)

To upgrade if you used the first install method:
```shell
pip3 install --upgrade "git+ssh://github.com/team-telnyx/network.git#egg=tam&subdirectory=telnyx_acl_manager_v2" --user
```

or

```shell
cd <repo-folder>
git pull --rebase
pip3 install . --user
```
## Usage example

```sh
> tam-cli --help
usage: tam-cli [-h] (--block BLOCK | --remove-blocked-ip REMOVE_BLOCKED_IP)
               [--threads THREADS] [--devices DEVICES] [--acl ACL]

Tool to modify ingress ACLs in backbone edge devices

optional arguments:
  -h, --help            show this help message and exit
  --block BLOCK, -b BLOCK
                        The IP address to block, e.g. 1.1.1.1
  --remove-blocked-ip REMOVE_BLOCKED_IP, -r REMOVE_BLOCKED_IP
                        The IP address to be allowed again, e.g. 1.1.1.1
  --threads THREADS, -t THREADS
                        How many devices at a time
  --devices DEVICES, -d DEVICES
                        Specify the REGEX for which devices to execute on,
                        defaults to ".*er.*"
  --acl ACL, -a ACL     The name of the ACL to modify, defaults to "ACL.EDGE-
                        INGRESS"
```



`--block` and `--remove-blocked-ip` are the two operations available (at this time) for the tool. As the name implies, the first option blocks a specifc `/32` IP address while the second one removed a previously blocked prefix (so it permits it again). All IPs need to be provided without CIDR (it is assumed it's a /32 already)

**Important:** The tool operates by adding or removing Cisco configuration lines such as `<seq no> deny ip host <ip> any `. If the IP has been blocked with a different config line, the tool will not remove that configuration.

There are a few assumptions made:

- By default, the ACL that wil be modified is `ACL.EDGE-INGRESS`, usually present on `.*ER.*` network devices. The user can specify a different ACL if need be.
- By default, we operate on **all** ER devices for consistency. This can be changed by specifying a *regex* with the `--devices` or `-d` flag. Make sure to use quotes (`"`) when specifying the regex, otherwise your terminal might interpret it as a shell command. Don't worry on whether or not you got the regex right, as the tool will display a list of devices on which it will act before actualy doing anything.

Here's a demo:

[![asciicast](https://asciinema.org/a/4QBZhSyUUXyv1zF7W17gf1yRj.svg)](https://asciinema.org/a/4QBZhSyUUXyv1zF7W17gf1yRj)

## Development setup

TBD

## Release History
* 0.2.0
    * Slack will be notified at the end of a run with the result, which will be posted in the `#tena_general_bot_log` channel. This is a first, crude implementation which might have bugs. 
* 0.1.0
    * better error handling
    * generally faster and in some operations 2x as fast as before
* 0.0.3
    * bugfix for the -r operation giving a false positive
* 0.0.2
    * improved speed by 50%, now deployments take 1.30 minutes on average instead of 2.30.
* 0.0.1
    * very much an alpha release
* 0.0.5
    * Python3 compatible version

## Future Features

- Better error handling (🤦)
- Faster
- Add detection of already-configured IPs (at the moment we just re-configure)
- ...