original_docstring: Convert a SecurityGroupRule to VPP ACL rule.
  
          Arguments:
          r - SecurityGroupRule NamedTuple Object
          SecurityGroupRule = namedtuple(
                                  'SecurityGroupRule',
                                   ['is_ipv6',
                                   'remote_ip_addr',
                                   'ip_prefix_len',
                                   'protocol',
                                   'port_min',
                                   'port_max'])
          TODO(ijw): is_ipv6 appears to be the v6-ness of remote_ip_addr
          d - Direction:  0 ==> ingress, 1 ==> egress
          Default == 2
          Return: VPP-formatted ACL Rule
          
docstring: Convert a SecurityGroupRule to VPP ACL rule.
docstring_tokens: Convert a SecurityGroupRule to VPP ACL rule .
code: def _to_acl_rule(self, r, d):
          """Convert a SecurityGroupRule to VPP ACL rule.
  
          Arguments:
          r - SecurityGroupRule NamedTuple Object
          SecurityGroupRule = namedtuple(
                                  'SecurityGroupRule',
                                   ['is_ipv6',
                                   'remote_ip_addr',
                                   'ip_prefix_len',
                                   'protocol',
                                   'port_min',
                                   'port_max'])
          TODO(ijw): is_ipv6 appears to be the v6-ness of remote_ip_addr
          d - Direction:  0 ==> ingress, 1 ==> egress
          Default == 2
          Return: VPP-formatted ACL Rule
          """
          acl_rule = {}
          # a - Permit-Action: 1 == permit, 2 == reflexive;
          if not reflexive_acls:
              a = 1
          # Enable reflexive ACLs for all TCP/UDP and IP traffic
          elif r.protocol in [6, 17, 0]:
              a = 2
          else:
              a = 1  # Disable reflexive for other traffic such as ICMP etc.
          acl_rule['is_permit'] = a
          acl_rule['proto'] = r.protocol
          # for ingress: secgroup remote_ip == Source IP
          # for egress: secgroup remote_ip == Destination IP
          # Port ranges are always destination port ranges for TCP/UDP
          # Set source port range to permit all ranges from 0 to 65535
          if d == 0:
              # OpenStack may provide an interface with subnet (i.e. an
              # address *on* a network and not an address *of* the
              # network).  VPP requires the network address.
              acl_rule['src_prefix'] = \
                  ip_interface((r.remote_ip_addr, r.ip_prefix_len,)).network
              acl_rule['dst_prefix'] = \
                  ip_network("::/0" if r.is_ipv6 else "0.0.0.0/0")
          else:
              acl_rule['src_prefix'] = \
                  ip_network("::/0" if r.is_ipv6 else "0.0.0.0/0")
              # OpenStack may provide an interface with subnet (i.e. an
              # address *on* a network and not an address *of* the
              # network).  VPP requires the network address.
              acl_rule['dst_prefix'] = \
                  ip_interface((r.remote_ip_addr, r.ip_prefix_len,)).network
          # Handle ICMP/ICMPv6
          if r.protocol in [1, 58]:
              if r.port_min == -1:  # All ICMP Types and Codes [0-255]
                  acl_rule['srcport_or_icmptype_first'] = 0
                  acl_rule['srcport_or_icmptype_last'] = 255
                  acl_rule['dstport_or_icmpcode_first'] = 0
                  acl_rule['dstport_or_icmpcode_last'] = 255
              elif r.port_max == -1:  # All ICMP codes for an ICMP Type
                  acl_rule['srcport_or_icmptype_first'] = r.port_min
                  acl_rule['srcport_or_icmptype_last'] = r.port_min
                  acl_rule['dstport_or_icmpcode_first'] = 0
                  acl_rule['dstport_or_icmpcode_last'] = 255
              else:  # port_min == ICMP Type and port_max == ICMP Code
                  acl_rule['srcport_or_icmptype_first'] = r.port_min
                  acl_rule['srcport_or_icmptype_last'] = r.port_min
                  acl_rule['dstport_or_icmpcode_first'] = r.port_max
                  acl_rule['dstport_or_icmpcode_last'] = r.port_max
          # Handle TCP/UDP protocols
          elif r.protocol in [6, 17]:
              acl_rule['dstport_or_icmpcode_first'] = \
                  default_if_none(r.port_min, 0)
              acl_rule['dstport_or_icmpcode_last'] = \
                  default_if_none(r.port_max, 65535)
              # Allow all ranges for source ports
              acl_rule['srcport_or_icmptype_first'] = 0
              acl_rule['srcport_or_icmptype_last'] = 65535
          # Handle all protocols - All IPv4 and IPv6 TCP/UDP traffic
          elif r.protocol == 0:
              acl_rule['dstport_or_icmpcode_first'] = 0
              acl_rule['dstport_or_icmpcode_last'] = 65535
              acl_rule['srcport_or_icmptype_first'] = 0
              acl_rule['srcport_or_icmptype_last'] = 65535
          return acl_rule
code_tokens: def _to_acl_rule ( self , r , d ) : acl_rule = { } if not reflexive_acls : a = 1 elif r . protocol in [ 6 , 17 , 0 ] : a = 2 else : a = 1 acl_rule [ 'is_permit' ] = a acl_rule [ 'proto' ] = r . protocol if d == 0 : acl_rule [ 'src_prefix' ] = ip_interface ( ( r . remote_ip_addr , r . ip_prefix_len , ) ) . network acl_rule [ 'dst_prefix' ] = ip_network ( "::/0" if r . is_ipv6 else "0.0.0.0/0" ) else : acl_rule [ 'src_prefix' ] = ip_network ( "::/0" if r . is_ipv6 else "0.0.0.0/0" ) acl_rule [ 'dst_prefix' ] = ip_interface ( ( r . remote_ip_addr , r . ip_prefix_len , ) ) . network if r . protocol in [ 1 , 58 ] : if r . port_min == - 1 : acl_rule [ 'srcport_or_icmptype_first' ] = 0 acl_rule [ 'srcport_or_icmptype_last' ] = 255 acl_rule [ 'dstport_or_icmpcode_first' ] = 0 acl_rule [ 'dstport_or_icmpcode_last' ] = 255 elif r . port_max == - 1 : acl_rule [ 'srcport_or_icmptype_first' ] = r . port_min acl_rule [ 'srcport_or_icmptype_last' ] = r . port_min acl_rule [ 'dstport_or_icmpcode_first' ] = 0 acl_rule [ 'dstport_or_icmpcode_last' ] = 255 else : acl_rule [ 'srcport_or_icmptype_first' ] = r . port_min acl_rule [ 'srcport_or_icmptype_last' ] = r . port_min acl_rule [ 'dstport_or_icmpcode_first' ] = r . port_max acl_rule [ 'dstport_or_icmpcode_last' ] = r . port_max elif r . protocol in [ 6 , 17 ] : acl_rule [ 'dstport_or_icmpcode_first' ] = default_if_none ( r . port_min , 0 ) acl_rule [ 'dstport_or_icmpcode_last' ] = default_if_none ( r . port_max , 65535 ) acl_rule [ 'srcport_or_icmptype_first' ] = 0 acl_rule [ 'srcport_or_icmptype_last' ] = 65535 elif r . protocol == 0 : acl_rule [ 'dstport_or_icmpcode_first' ] = 0 acl_rule [ 'dstport_or_icmpcode_last' ] = 65535 acl_rule [ 'srcport_or_icmptype_first' ] = 0 acl_rule [ 'srcport_or_icmptype_last' ] = 65535 return acl_rule
short_docstring: Convert a SecurityGroupRule to VPP ACL rule.
short_docstring_tokens: Convert a SecurityGroupRule to VPP ACL rule .
comment: """Convert a SecurityGroupRule to VPP ACL rule.
  
          Arguments:
          r - SecurityGroupRule NamedTuple Object
          SecurityGroupRule = namedtuple(
                                  'SecurityGroupRule',
                                   ['is_ipv6',
                                   'remote_ip_addr',
                                   'ip_prefix_len',
                                   'protocol',
                                   'port_min',
                                   'port_max'])
          TODO(ijw): is_ipv6 appears to be the v6-ness of remote_ip_addr
          d - Direction:  0 ==> ingress, 1 ==> egress
          Default == 2
          Return: VPP-formatted ACL Rule
          """$SEP$# a - Permit-Action: 1 == permit, 2 == reflexive;$SEP$# Enable reflexive ACLs for all TCP/UDP and IP traffic$SEP$# Disable reflexive for other traffic such as ICMP etc.$SEP$# for ingress: secgroup remote_ip == Source IP$SEP$# for egress: secgroup remote_ip == Destination IP$SEP$# Port ranges are always destination port ranges for TCP/UDP$SEP$# Set source port range to permit all ranges from 0 to 65535$SEP$# OpenStack may provide an interface with subnet (i.e. an$SEP$# address *on* a network and not an address *of* the$SEP$# network).  VPP requires the network address.$SEP$# OpenStack may provide an interface with subnet (i.e. an$SEP$# address *on* a network and not an address *of* the$SEP$# network).  VPP requires the network address.$SEP$# Handle ICMP/ICMPv6$SEP$# All ICMP Types and Codes [0-255]$SEP$# All ICMP codes for an ICMP Type$SEP$# port_min == ICMP Type and port_max == ICMP Code$SEP$# Handle TCP/UDP protocols$SEP$# Allow all ranges for source ports$SEP$# Handle all protocols - All IPv4 and IPv6 TCP/UDP traffic