Merge pull request #276 from kevinsteves:br13

PiperOrigin-RevId: 376864098

Author: Capirca Team

capirca/lib/paloaltofw.py

@@ -141,12 +141,14 @@ class ServiceMap(object):
   def __init__(self):
     self.entries = {}
 
-  def get_service_name(self, term_name, src_ports, ports, protocol):
+  def get_service_name(self, term_name, src_ports, ports, protocol, prefix=None):
     """Returns service name based on the provided ports and protocol."""
     if (src_ports, ports, protocol) in self.entries:
       return self.entries[(src_ports, ports, protocol)]["name"]
 
-    service_name = "service-%s-%s" % (term_name, protocol)
+    if prefix is None:
+      prefix = "service-"
+    service_name = "%s%s-%s" % (prefix, term_name, protocol)
 
     if len(service_name) > 63:
       raise PaloAltoFWNameTooLongError(
@@ -268,6 +270,21 @@ def pan_ports(ports):
         if service_name not in self.options["service"]:
           self.options["service"].append(service_name)
 
+    elif "tcp" in term.protocol or "udp" in term.protocol:
+      for p in term.protocol:
+        if p not in ["tcp", "udp"]:
+          logging.warning(
+            "WARNING: Term %s in policy %s>%s contains port-less tcp "
+            "and/or udp with protocol %s.  Move %s to another term.",
+            term.name, self.options["from_zone"][0],
+            self.options["to_zone"][0], p, p)
+          continue
+        ports = pan_ports([("0", "65535")])
+        # use prefix "" to avoid service name clash with term named "any"
+        service_name = service_map.get_service_name("any", (), ports, p, "")
+        if service_name not in self.options["service"]:
+          self.options["service"].append(service_name)
+
     if term.protocol:
       # Add application "any" to all terms, unless ICMP/ICMPv6
       for proto_name in term.protocol:

tests/lib/paloaltofw_test.py

@@ -933,6 +933,41 @@ def testPanPorts(self):
     x = paloalto.config.findtext(PATH_SERVICE + path)
     self.assertEqual(x, "123", output)
 
+    T = """
+  protocol:: tcp
+"""
+
+    pol = policy.ParsePolicy(POL % T, definitions)
+    paloalto = paloaltofw.PaloAltoFW(pol, EXP_INFO)
+    output = str(paloalto)
+    name = "any-tcp"
+    path = "/entry[@name='%s']/protocol/tcp/port" % name
+    x = paloalto.config.findtext(PATH_SERVICE + path)
+    self.assertEqual(x, "0-65535", output)
+    path = "/entry[@name='%s']/protocol/tcp/source-port" % name
+    x = paloalto.config.find(PATH_SERVICE + path)
+    self.assertIsNone(x, output)
+
+    T = """
+  protocol:: tcp udp
+"""
+
+    pol = policy.ParsePolicy(POL % T, definitions)
+    paloalto = paloaltofw.PaloAltoFW(pol, EXP_INFO)
+    output = str(paloalto)
+    name = "any-tcp"
+    path = "/entry[@name='%s']/protocol/tcp/port" % name
+    x = paloalto.config.findtext(PATH_SERVICE + path)
+    self.assertEqual(x, "0-65535", output)
+    name = "any-udp"
+    path = "/entry[@name='%s']/protocol/udp/port" % name
+    x = paloalto.config.findtext(PATH_SERVICE + path)
+    self.assertEqual(x, "0-65535", output)
+    x = paloalto.config.findall(PATH_RULES +
+                                "/entry[@name='rule-1']/service/member")
+    services = {elem.text for elem in x}
+    self.assertEqual({"any-tcp", "any-udp"}, services, output)
+
 
 if __name__ == '__main__':
   unittest.main()