# Path: capirca/lib/aclgenerator.py
# class Error(Exception):
# class NoPlatformPolicyError(Error):
# class UnknownIcmpTypeError(Error):
# class MismatchIcmpInetError(Error):
# class EstablishedError(Error):
# class UnsupportedAFError(Error):
# class DuplicateTermError(Error):
# class UnsupportedFilterError(Error):
# class UnsupportedTargetOptionError(Error):
# class TermNameTooLongError(Error):
# class Term:
# class ACLGenerator:
#   ICMP_TYPE = policy.Term.ICMP_TYPE
#   PROTO_MAP = {'hopopt': 0,
#                'icmp': 1,
#                'igmp': 2,
#                'ggp': 3,
#                'ipip': 4,
#                'tcp': 6,
#                'egp': 8,
#                'igp': 9,
#                'udp': 17,
#                'rdp': 27,
#                'ipv6': 41,
#                'ipv6-route': 43,
#                'fragment': 44,
#                'rsvp': 46,
#                'gre': 47,
#                'esp': 50,
#                'ah': 51,
#                'icmpv6': 58,
#                'ipv6-nonxt': 59,
#                'ipv6-opts': 60,
#                'ospf': 89,
#                'pim': 103,
#                'vrrp': 112,
#                'l2tp': 115,
#                'sctp': 132,
#                'udplite': 136,
#                'all': -1,  # Used for GCE default deny, do not use in pol file.
#               }
#   AF_MAP = {'inet': 4,
#             'inet6': 6,
#             'bridge': 4  # if this doesn't exist, output includes v4 & v6
#            }
#   ALWAYS_PROTO_NUM = ['ipip']
#   PROTO_MAP_BY_NUMBER = dict([(v, k) for (k, v) in PROTO_MAP.items()])
#   AF_MAP_BY_NUMBER = dict([(v, k) for (k, v) in AF_MAP.items()])
#   NO_AF_LOG_ADDR = string.Template('Term $term will not be rendered, as it has'
#                                    ' $direction address match specified but no'
#                                    ' $direction addresses of $af address family'
#                                    ' are present.')
#   NO_AF_LOG_PROTO = string.Template('Term $term will not be rendered, as it has'
#                                     ' $proto match specified but the ACL is of'
#                                     ' $af address family.')
#   _PLATFORM = None
#   _DEFAULT_PROTOCOL = 'ip'
#   _SUPPORTED_AF = {'inet', 'inet6'}
#   _FILTER_BLACKLIST = {}
#   WARN_IF_UNSUPPORTED = {
#       'restrict_address_family',
#       'counter',
#       'destination_tag',
#       'filter_term',
#       'logging',
#       'loss_priority',
#       'owner',
#       'qos',
#       'routing_instance',
#       'policer',
#       'source_tag'
#   }
#   _ABBREVIATION_TABLE = [
#       # Service abbreviations first.
#       ('experiment', 'EXP'),
#       ('wifi-radius', 'W-R'),
#       ('customer', 'CUST'),
#       ('server', 'SRV'),
#       # Next, common routing terms
#       ('global', 'GBL'),
#       ('google', 'GOOG'),
#       ('service', 'SVC'),
#       ('router', 'RTR'),
#       ('internal', 'INT'),
#       ('external', 'EXT'),
#       ('transit', 'TRNS'),
#       ('management', 'MGMT'),
#       # State info
#       ('established', 'EST'),
#       ('unreachable', 'UNR'),
#       ('fragment', 'FRAG'),
#       ('accept', 'ACC'),
#       ('discard', 'DISC'),
#       ('reject', 'REJ'),
#       ('replies', 'RPL'),
#       ('request', 'REQ'),
#   ]
#   _TERM_MAX_LENGTH = 62
#   def __init__(self, term):
#   def NormalizeAddressFamily(self, af):
#   def NormalizeIcmpTypes(self, icmp_types, protocols, af):
#   def __init__(self, pol, exp_info):
#   def _TranslatePolicy(self, pol, exp_info):
#   def _BuildTokens(self):
#   def _GetSupportedTokens(self):
#   def FixHighPorts(self, term, af='inet', all_protocols_stateful=False):
#   def FixTermLength(self, term_name, abbreviate=False, truncate=False):
# def ProtocolNameToNumber(protocols, proto_to_num, name_to_num_map):
# def AddRepositoryTags(prefix='', rid=True, date=True, revision=True,
#                       wrap=False):
# def WrapWords(textlist, size, joiner='\n'):


import datetime
from absl import logging
from capirca.lib import aclgenerator

This generate a pcap packet filter expression that either:
  1) Matches (i.e., captures), the packets that match the ACCEPT clauses
     specified in a given policy, or
  2) Matches the packets that match opposite of that, i.e., the DENY or REJECT
     clauses.
Support tcp flags matching and icmptypes, including ipv6/icmpv6, but not much
else past the standard addres, port, and protocol conditions.

Note that this is still alpha and will likely require more testing prior to
having more confidence in it.

Stolen liberally from packetfilter.py.
"""




class Error(Exception):
  """Base error class."""


class UnsupportedActionError(Error):
  """Raised when we see an unsupported action."""


class UnsupportedTargetOptionError(Error):
  """Raised when we see an unsupported option."""



# Path: capirca/lib/aclgenerator.py
# class Error(Exception):
# class NoPlatformPolicyError(Error):
# class UnknownIcmpTypeError(Error):
# class MismatchIcmpInetError(Error):
# class EstablishedError(Error):
# class UnsupportedAFError(Error):
# class DuplicateTermError(Error):
# class UnsupportedFilterError(Error):
# class UnsupportedTargetOptionError(Error):
# class TermNameTooLongError(Error):
# class Term:
# class ACLGenerator:
#   ICMP_TYPE = policy.Term.ICMP_TYPE
#   PROTO_MAP = {'hopopt': 0,
#                'icmp': 1,
#                'igmp': 2,
#                'ggp': 3,
#                'ipip': 4,
#                'tcp': 6,
#                'egp': 8,
#                'igp': 9,
#                'udp': 17,
#                'rdp': 27,
#                'ipv6': 41,
#                'ipv6-route': 43,
#                'fragment': 44,
#                'rsvp': 46,
#                'gre': 47,
#                'esp': 50,
#                'ah': 51,
#                'icmpv6': 58,
#                'ipv6-nonxt': 59,
#                'ipv6-opts': 60,
#                'ospf': 89,
#                'pim': 103,
#                'vrrp': 112,
#                'l2tp': 115,
#                'sctp': 132,
#                'udplite': 136,
#                'all': -1,  # Used for GCE default deny, do not use in pol file.
#               }
#   AF_MAP = {'inet': 4,
#             'inet6': 6,
#             'bridge': 4  # if this doesn't exist, output includes v4 & v6
#            }
#   ALWAYS_PROTO_NUM = ['ipip']
#   PROTO_MAP_BY_NUMBER = dict([(v, k) for (k, v) in PROTO_MAP.items()])
#   AF_MAP_BY_NUMBER = dict([(v, k) for (k, v) in AF_MAP.items()])
#   NO_AF_LOG_ADDR = string.Template('Term $term will not be rendered, as it has'
#                                    ' $direction address match specified but no'
#                                    ' $direction addresses of $af address family'
#                                    ' are present.')
#   NO_AF_LOG_PROTO = string.Template('Term $term will not be rendered, as it has'
#                                     ' $proto match specified but the ACL is of'
#                                     ' $af address family.')
#   _PLATFORM = None
#   _DEFAULT_PROTOCOL = 'ip'
#   _SUPPORTED_AF = {'inet', 'inet6'}
#   _FILTER_BLACKLIST = {}
#   WARN_IF_UNSUPPORTED = {
#       'restrict_address_family',
#       'counter',
#       'destination_tag',
#       'filter_term',
#       'logging',
#       'loss_priority',
#       'owner',
#       'qos',
#       'routing_instance',
#       'policer',
#       'source_tag'
#   }
#   _ABBREVIATION_TABLE = [
#       # Service abbreviations first.
#       ('experiment', 'EXP'),
#       ('wifi-radius', 'W-R'),
#       ('customer', 'CUST'),
#       ('server', 'SRV'),
#       # Next, common routing terms
#       ('global', 'GBL'),
#       ('google', 'GOOG'),
#       ('service', 'SVC'),
#       ('router', 'RTR'),
#       ('internal', 'INT'),
#       ('external', 'EXT'),
#       ('transit', 'TRNS'),
#       ('management', 'MGMT'),
#       # State info
#       ('established', 'EST'),
#       ('unreachable', 'UNR'),
#       ('fragment', 'FRAG'),
#       ('accept', 'ACC'),
#       ('discard', 'DISC'),
#       ('reject', 'REJ'),
#       ('replies', 'RPL'),
#       ('request', 'REQ'),
#   ]
#   _TERM_MAX_LENGTH = 62
#   def __init__(self, term):
#   def NormalizeAddressFamily(self, af):
#   def NormalizeIcmpTypes(self, icmp_types, protocols, af):
#   def __init__(self, pol, exp_info):
#   def _TranslatePolicy(self, pol, exp_info):
#   def _BuildTokens(self):
#   def _GetSupportedTokens(self):
#   def FixHighPorts(self, term, af='inet', all_protocols_stateful=False):
#   def FixTermLength(self, term_name, abbreviate=False, truncate=False):
# def ProtocolNameToNumber(protocols, proto_to_num, name_to_num_map):
# def AddRepositoryTags(prefix='', rid=True, date=True, revision=True,
#                       wrap=False):
# def WrapWords(textlist, size, joiner='\n'):


# Path: capirca/lib/pcap.py
import datetime
from absl import logging
from capirca.lib import aclgenerator


This generate a pcap packet filter expression that either:
  1) Matches (i.e., captures), the packets that match the ACCEPT clauses
     specified in a given policy, or
  2) Matches the packets that match opposite of that, i.e., the DENY or REJECT
     clauses.
Support tcp flags matching and icmptypes, including ipv6/icmpv6, but not much
else past the standard addres, port, and protocol conditions.

Note that this is still alpha and will likely require more testing prior to
having more confidence in it.

Stolen liberally from packetfilter.py.
"""




class Error(Exception):
  """Base error class."""


class UnsupportedActionError(Error):
  """Raised when we see an unsupported action."""


class UnsupportedTargetOptionError(Error):
  """Raised when we see an unsupported option."""



class Term(aclgenerator.Term):