%global _empty_manifest_terminate_build 0 Name: python-capirca Version: 2.0.9 Release: 1 Summary: Capirca License: Apache License, Version 2.0 URL: https://github.com/google/capirca/ Source0: https://mirrors.nju.edu.cn/pypi/web/packages/6a/21/2f7a20f2da1f7785f2236fdb4f000e79b5f4cb65eacd09c191700f3c9702/capirca-2.0.9.tar.gz BuildArch: noarch Requires: python3-absl-py Requires: python3-ply Requires: python3-mock Requires: python3-six Requires: python3-PyYAML %description /def/NETWORK.net | a list of **network objects** definitions /def/SERVICES.svc | a list of **service objects** definitions Each network or service definition file has a very simple structure. A token is defined, e.g. `GUEST_NET`, followed by an equal sign, then followed by a definition, e.g. `10.10.10.0/24`, and optional description field, e.g. `# guest network range`. ``` GUEST_NET = 10.10.10.0/24 # guest network range ``` The tool populates the **access control policy** from `.pol` files in a particular directory, e.g. [`policies/`](./policies/). The tool searches recursively for `.pol` files and add them to the policy, .e.g `.pol` files are located in [`policies/pol`](./policies/pol). Additionally, the `.pol` files MAY reference other policy definition files located outside of the directory by using `include` directive. Please see [Includes](#includes) section for documentation. ### Network Objects The files with `.net` extension contain the definitions of network objects, e.g. IP networks and hosts. The following definition creates `INTERNAL` and `RFC1918` network objects in the object definitions, whether `INTERNAL` references the IP ranges of RFC 1918 defined in the `RFC1918`. ``` RFC1918 = 10.0.0.0/8 # non-public 172.16.0.0/12 # non-public 192.168.0.0/16 # non-public INTERNAL = RFC1918 ``` [Back to Top](#table-of-contents) ### Service Objects The files with `.svc` extension contain the definitions of service objects, e.g. ports and protocols. ``` DNS = 53/tcp # transfers 53/udp # queries ``` [Back to Top](#table-of-contents) ### Object Nesting The nesting of tokens is permitted only when both tokens are of the same type. The referencing of a "network" object by "service" object is not allowed, and vice versa. The examples of nesting of the network and service object follow. ``` HTTP = 80/tcp # common web HTTPS = 443/tcp # SSL web HTTP_8080 = 8080/tcp # web on non-standard port WEB_SERVICES = HTTP HTTP_8080 HTTPS # all our web services DB_SERVICES = 3306/tcp # allow db access HTTPS # and SSL access NYC_NETWORK = 200.1.1.0/24 # New York office ATL_NETWORK = 200.2.1.0/24 # Atlanta office DEN_NETWORK = 200.5.1.0/24 # Denver office REMOTE_OFFICES = NYC_NETWORK ATL_NETWORK DEN_NETWORK ``` The network objects may reference both IPv4 and IPv6 addresses at the same time. ``` LOOPBACK = 127.0.0.1/32 # loopback in IPv4 LINKLOCAL = FE80::/10 # IPv6 link local address NYC_NETWORK = 172.16.1.0/24 # NYC IPv4 2620:0:10A1::/48 # NYC IPv6 ``` [Back to Top](#table-of-contents) ### Anatomy of a policy file A policy file (/policies/pol/something.pol) has the security policy written using capirca specific meta-language and format. There are specific sections (e.g: header) that tell capirca how to generate the output configuration of the security policy. #### Headers The header section defines: * **target** firewall platforms (which ACL generator to use) * passes **additional arguments** to the generator responsible for that platform. A single header may have many targets within a section. It will result in multiple outputs being generated for that policy. #### Terms The **term** sections defines the access control rules within an ACL, it contains keywords followed by an object (service or network) and policy decision ("action" keyword). The term section specifies the network flow metadata for ACL matching. * Addresses * Ports * Protocols * Action (allow/deny) Inside a `term` a mandatory keyword will be found followed by an object token for rule evaluation. #### Tokens Tokens are the names of services and networks loaded from the object definitions. Example: %package -n python3-capirca Summary: Capirca Provides: python-capirca BuildRequires: python3-devel BuildRequires: python3-setuptools BuildRequires: python3-pip %description -n python3-capirca /def/NETWORK.net | a list of **network objects** definitions /def/SERVICES.svc | a list of **service objects** definitions Each network or service definition file has a very simple structure. A token is defined, e.g. `GUEST_NET`, followed by an equal sign, then followed by a definition, e.g. `10.10.10.0/24`, and optional description field, e.g. `# guest network range`. ``` GUEST_NET = 10.10.10.0/24 # guest network range ``` The tool populates the **access control policy** from `.pol` files in a particular directory, e.g. [`policies/`](./policies/). The tool searches recursively for `.pol` files and add them to the policy, .e.g `.pol` files are located in [`policies/pol`](./policies/pol). Additionally, the `.pol` files MAY reference other policy definition files located outside of the directory by using `include` directive. Please see [Includes](#includes) section for documentation. ### Network Objects The files with `.net` extension contain the definitions of network objects, e.g. IP networks and hosts. The following definition creates `INTERNAL` and `RFC1918` network objects in the object definitions, whether `INTERNAL` references the IP ranges of RFC 1918 defined in the `RFC1918`. ``` RFC1918 = 10.0.0.0/8 # non-public 172.16.0.0/12 # non-public 192.168.0.0/16 # non-public INTERNAL = RFC1918 ``` [Back to Top](#table-of-contents) ### Service Objects The files with `.svc` extension contain the definitions of service objects, e.g. ports and protocols. ``` DNS = 53/tcp # transfers 53/udp # queries ``` [Back to Top](#table-of-contents) ### Object Nesting The nesting of tokens is permitted only when both tokens are of the same type. The referencing of a "network" object by "service" object is not allowed, and vice versa. The examples of nesting of the network and service object follow. ``` HTTP = 80/tcp # common web HTTPS = 443/tcp # SSL web HTTP_8080 = 8080/tcp # web on non-standard port WEB_SERVICES = HTTP HTTP_8080 HTTPS # all our web services DB_SERVICES = 3306/tcp # allow db access HTTPS # and SSL access NYC_NETWORK = 200.1.1.0/24 # New York office ATL_NETWORK = 200.2.1.0/24 # Atlanta office DEN_NETWORK = 200.5.1.0/24 # Denver office REMOTE_OFFICES = NYC_NETWORK ATL_NETWORK DEN_NETWORK ``` The network objects may reference both IPv4 and IPv6 addresses at the same time. ``` LOOPBACK = 127.0.0.1/32 # loopback in IPv4 LINKLOCAL = FE80::/10 # IPv6 link local address NYC_NETWORK = 172.16.1.0/24 # NYC IPv4 2620:0:10A1::/48 # NYC IPv6 ``` [Back to Top](#table-of-contents) ### Anatomy of a policy file A policy file (/policies/pol/something.pol) has the security policy written using capirca specific meta-language and format. There are specific sections (e.g: header) that tell capirca how to generate the output configuration of the security policy. #### Headers The header section defines: * **target** firewall platforms (which ACL generator to use) * passes **additional arguments** to the generator responsible for that platform. A single header may have many targets within a section. It will result in multiple outputs being generated for that policy. #### Terms The **term** sections defines the access control rules within an ACL, it contains keywords followed by an object (service or network) and policy decision ("action" keyword). The term section specifies the network flow metadata for ACL matching. * Addresses * Ports * Protocols * Action (allow/deny) Inside a `term` a mandatory keyword will be found followed by an object token for rule evaluation. #### Tokens Tokens are the names of services and networks loaded from the object definitions. Example: %package help Summary: Development documents and examples for capirca Provides: python3-capirca-doc %description help /def/NETWORK.net | a list of **network objects** definitions /def/SERVICES.svc | a list of **service objects** definitions Each network or service definition file has a very simple structure. A token is defined, e.g. `GUEST_NET`, followed by an equal sign, then followed by a definition, e.g. `10.10.10.0/24`, and optional description field, e.g. `# guest network range`. ``` GUEST_NET = 10.10.10.0/24 # guest network range ``` The tool populates the **access control policy** from `.pol` files in a particular directory, e.g. [`policies/`](./policies/). The tool searches recursively for `.pol` files and add them to the policy, .e.g `.pol` files are located in [`policies/pol`](./policies/pol). Additionally, the `.pol` files MAY reference other policy definition files located outside of the directory by using `include` directive. Please see [Includes](#includes) section for documentation. ### Network Objects The files with `.net` extension contain the definitions of network objects, e.g. IP networks and hosts. The following definition creates `INTERNAL` and `RFC1918` network objects in the object definitions, whether `INTERNAL` references the IP ranges of RFC 1918 defined in the `RFC1918`. ``` RFC1918 = 10.0.0.0/8 # non-public 172.16.0.0/12 # non-public 192.168.0.0/16 # non-public INTERNAL = RFC1918 ``` [Back to Top](#table-of-contents) ### Service Objects The files with `.svc` extension contain the definitions of service objects, e.g. ports and protocols. ``` DNS = 53/tcp # transfers 53/udp # queries ``` [Back to Top](#table-of-contents) ### Object Nesting The nesting of tokens is permitted only when both tokens are of the same type. The referencing of a "network" object by "service" object is not allowed, and vice versa. The examples of nesting of the network and service object follow. ``` HTTP = 80/tcp # common web HTTPS = 443/tcp # SSL web HTTP_8080 = 8080/tcp # web on non-standard port WEB_SERVICES = HTTP HTTP_8080 HTTPS # all our web services DB_SERVICES = 3306/tcp # allow db access HTTPS # and SSL access NYC_NETWORK = 200.1.1.0/24 # New York office ATL_NETWORK = 200.2.1.0/24 # Atlanta office DEN_NETWORK = 200.5.1.0/24 # Denver office REMOTE_OFFICES = NYC_NETWORK ATL_NETWORK DEN_NETWORK ``` The network objects may reference both IPv4 and IPv6 addresses at the same time. ``` LOOPBACK = 127.0.0.1/32 # loopback in IPv4 LINKLOCAL = FE80::/10 # IPv6 link local address NYC_NETWORK = 172.16.1.0/24 # NYC IPv4 2620:0:10A1::/48 # NYC IPv6 ``` [Back to Top](#table-of-contents) ### Anatomy of a policy file A policy file (/policies/pol/something.pol) has the security policy written using capirca specific meta-language and format. There are specific sections (e.g: header) that tell capirca how to generate the output configuration of the security policy. #### Headers The header section defines: * **target** firewall platforms (which ACL generator to use) * passes **additional arguments** to the generator responsible for that platform. A single header may have many targets within a section. It will result in multiple outputs being generated for that policy. #### Terms The **term** sections defines the access control rules within an ACL, it contains keywords followed by an object (service or network) and policy decision ("action" keyword). The term section specifies the network flow metadata for ACL matching. * Addresses * Ports * Protocols * Action (allow/deny) Inside a `term` a mandatory keyword will be found followed by an object token for rule evaluation. #### Tokens Tokens are the names of services and networks loaded from the object definitions. Example: %prep %autosetup -n capirca-2.0.9 %build %py3_build %install %py3_install install -d -m755 %{buildroot}/%{_pkgdocdir} if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi pushd %{buildroot} if [ -d usr/lib ]; then find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst fi if [ -d usr/lib64 ]; then find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst fi if [ -d usr/bin ]; then find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst fi if [ -d usr/sbin ]; then find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst fi touch doclist.lst if [ -d usr/share/man ]; then find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst fi popd mv %{buildroot}/filelist.lst . mv %{buildroot}/doclist.lst . %files -n python3-capirca -f filelist.lst %dir %{python3_sitelib}/* %files help -f doclist.lst %{_docdir}/* %changelog * Tue Apr 11 2023 Python_Bot - 2.0.9-1 - Package Spec generated