class Error(Exception):
class NoPlatformPolicyError(Error):
class UnknownIcmpTypeError(Error):
class MismatchIcmpInetError(Error):
class EstablishedError(Error):
class UnsupportedAFError(Error):
class DuplicateTermError(Error):
class UnsupportedFilterError(Error):
class UnsupportedTargetOptionError(Error):
class TermNameTooLongError(Error):
class Term:
class ACLGenerator:
  ICMP_TYPE = policy.Term.ICMP_TYPE
  PROTO_MAP = {'hopopt': 0,
               'icmp': 1,
               'igmp': 2,
               'ggp': 3,
               'ipip': 4,
               'tcp': 6,
               'egp': 8,
               'igp': 9,
               'udp': 17,
               'rdp': 27,
               'ipv6': 41,
               'ipv6-route': 43,
               'fragment': 44,
               'rsvp': 46,
               'gre': 47,
               'esp': 50,
               'ah': 51,
               'icmpv6': 58,
               'ipv6-nonxt': 59,
               'ipv6-opts': 60,
               'ospf': 89,
               'pim': 103,
               'vrrp': 112,
               'l2tp': 115,
               'sctp': 132,
               'udplite': 136,
               'all': -1,  # Used for GCE default deny, do not use in pol file.
              }
  AF_MAP = {'inet': 4,
            'inet6': 6,
            'bridge': 4  # if this doesn't exist, output includes v4 & v6
           }
  ALWAYS_PROTO_NUM = ['ipip']
  PROTO_MAP_BY_NUMBER = dict([(v, k) for (k, v) in PROTO_MAP.items()])
  AF_MAP_BY_NUMBER = dict([(v, k) for (k, v) in AF_MAP.items()])
  NO_AF_LOG_ADDR = string.Template('Term $term will not be rendered, as it has'
                                   ' $direction address match specified but no'
                                   ' $direction addresses of $af address family'
                                   ' are present.')
  NO_AF_LOG_PROTO = string.Template('Term $term will not be rendered, as it has'
                                    ' $proto match specified but the ACL is of'
                                    ' $af address family.')
  _PLATFORM = None
  _DEFAULT_PROTOCOL = 'ip'
  _SUPPORTED_AF = {'inet', 'inet6'}
  _FILTER_BLACKLIST = {}
  WARN_IF_UNSUPPORTED = {
      'restrict_address_family',
      'counter',
      'destination_tag',
      'filter_term',
      'logging',
      'loss_priority',
      'owner',
      'qos',
      'routing_instance',
      'policer',
      'source_tag'
  }
  _ABBREVIATION_TABLE = [
      # Service abbreviations first.
      ('experiment', 'EXP'),
      ('wifi-radius', 'W-R'),
      ('customer', 'CUST'),
      ('server', 'SRV'),
      # Next, common routing terms
      ('global', 'GBL'),
      ('google', 'GOOG'),
      ('service', 'SVC'),
      ('router', 'RTR'),
      ('internal', 'INT'),
      ('external', 'EXT'),
      ('transit', 'TRNS'),
      ('management', 'MGMT'),
      # State info
      ('established', 'EST'),
      ('unreachable', 'UNR'),
      ('fragment', 'FRAG'),
      ('accept', 'ACC'),
      ('discard', 'DISC'),
      ('reject', 'REJ'),
      ('replies', 'RPL'),
      ('request', 'REQ'),
  ]
  _TERM_MAX_LENGTH = 62
  def __init__(self, term):
  def NormalizeAddressFamily(self, af):
  def NormalizeIcmpTypes(self, icmp_types, protocols, af):
  def __init__(self, pol, exp_info):
  def _TranslatePolicy(self, pol, exp_info):
  def _BuildTokens(self):
  def _GetSupportedTokens(self):
  def FixHighPorts(self, term, af='inet', all_protocols_stateful=False):
  def FixTermLength(self, term_name, abbreviate=False, truncate=False):
def ProtocolNameToNumber(protocols, proto_to_num, name_to_num_map):
def AddRepositoryTags(prefix='', rid=True, date=True, revision=True,
                      wrap=False):
def WrapWords(textlist, size, joiner='\n'): class Error(Exception):
class UnsupportedEosAccessListError(Error):
class Arista(cisco.Cisco):
  _PLATFORM = 'arista'
  SUFFIX = '.eacl'
  _PROTO_INT = False
  def _AppendTargetByFilterType(self, filter_name, filter_type): INDENT_STR = " " * 3  # 3 spaces
TERM_INDENT = 2 * INDENT_STR
MATCH_INDENT = 3 * INDENT_STR
ACTION_INDENT = 4 * INDENT_STR
MAX_COMMENT_LENGTH = 60
  _PLATFORM = "arista_tp"
  _ACTIONS = {
      "accept": "",
      "deny": "drop",
      "reject": "drop",  # unsupported action, convert to drop
      "reject-with-tcp-rst": "drop",  # ibid
      # "next": "continue",
  }
  AF_MAP = {
      "inet": 4,
      "inet6": 6,
  }
  _TERM_TYPE = {
      "inet": {
          "addr_fam": "ipv4",
      },
      "inet6": {
          "addr_fam": "ipv6",
      },
  }
  _AF_MAP = {"inet": 4, "inet6": 6}
  _DEFAULT_PROTOCOL = "ip"
  _PLATFORM = "arista_tp"
  _SUPPORTED_AF = frozenset(("inet", "inet6", "mixed"))
  _TERM = Term
  _LOGGING = set()
  SUFFIX = ".atp"
class Error(Exception):
class TcpEstablishedWithNonTcpError(Error):
class AristaTpFragmentInV6Error(Error):
class Config:
class Term(aclgenerator.Term):
class AristaTrafficPolicy(aclgenerator.ACLGenerator):
  def __init__(self):
  def __str__(self):
  def Append(self, line_indent, line, verbatim=False):
  def __init__(self, term, term_type, noverbose):
  def __str__(self):
  def _reflowComments(self, comments, max_length):
  def _processPorts(self, term):
  def _processICMP(self, term):
  def _processProtocol(self, term_type, term, flags):
  def _processProtocolExcept(self, term_type, term, flags):
  def _processTermOptions(self, term, options):
  def _Group(self, group, lc=True):
    def _FormattedGroup(el, lc=True):
  def _BuildTokens(self):
  def _MinimizePrefixes(self, include, exclude):
  def _GenPrefixFieldset(self, direction, name, pfxs, ex_pfxs, af):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self): _PLATFORM = 'aruba'
_COMMENT_MARKER = '#'
_TERMINATOR_MARKER = '!'
  _ANY_STR = 'any'
  _ALIAS_STR = 'alias'
  _IPV6_START_STR = 'ipv6'
  _NET_DEST_STR = 'netdestination'
  _NEGATOR = 'no'
  _SRC_NETDEST_SUF = '_src'
  _DST_NETDEST_SUF = '_dst'
  _NETWORK_STRING = 'network'
  _HOST_STRING = 'host'
  _USER_STR = 'user'
  _SOURCE_IS_USER_OPT_STR = 'source-is-user'
  _DESTINATION_IS_USER_OPT_STR = 'destination-is-user'
  _NEGATE_OPT_STR = 'negate'
  _IDENT = '  '
  _COMMENT_LINE_LENGTH = 70
  _ACTIONS = {
      'accept': 'permit',
      'deny': 'deny',
  }
  _PROTOCOL_MAP = {
      'icmp': 1,
      'gre': 47,
      'esp': 50,
  }
  SUFFIX = '.aacl'
  _ACL_LINE_HEADER = 'ip access-list session'
class Error(Exception):
class Term(aclgenerator.Term):
class Aruba(aclgenerator.ACLGenerator):
  def __init__(self, term, filter_type, verbose=True):
  def __str__(self):
  def _GenerateNetdest(self, addr_netdestid, addresses, af):
  def _GenerateNetworkOrHostTokens(self, address):
  def _GeneratePortTokens(self, protocols, ports):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self): class Brocade(cisco.Cisco):
  _PLATFORM = 'brocade'
  SUFFIX = '.bacl'
  _PROTO_INT = False
  _TERM_REMARK = False _ACTION_TABLE = {
    'accept': 'permit',
    'deny': 'deny',
    'reject': 'deny',
    'next': '! next',
    'reject-with-tcp-rst': 'deny',  # tcp rst not supported
}
_COMMENT_MAX_WIDTH = 70
  _PORTS_TCP = {
      179: 'bgp',
      19: 'chargen',
      514: 'cmd',
      13: 'daytime',
      9: 'discard',
      53: 'domain',
      7: 'echo',
      512: 'exec',
      79: 'finger',
      21: 'ftp',
      20: 'ftp-data',
      70: 'gopher',
      443: 'https',
      113: 'ident',
      194: 'irc',
      543: 'klogin',
      544: 'kshell',
      389: 'ldap',
      636: 'ldaps',
      513: 'login',
      515: 'lpd',
      2049: 'nfs',
      119: 'nntp',
      496: 'pim-auto-rp',
      109: 'pop2',
      110: 'pop3',
      1723: 'pptp',
      25: 'smtp',
      22: 'ssh',
      111: 'sunrpc',
      49: 'tacacs',
      517: 'talk',
      23: 'telnet',
      540: 'uucp',
      43: 'whois',
      80: 'www',
  }
  _PORTS_UDP = {
      512: 'biff',
      68: 'bootpc',
      67: 'bootps',
      9: 'discard',
      195: 'dnsix',
      53: 'domain',
      7: 'echo',
      500: 'isakmp',
      434: 'mobile-ip',
      42: 'nameserver',
      138: 'netbios-dgm',
      137: 'netbios-ns',
      2049: 'nfs',
      123: 'ntp',
      496: 'pim-auto-rp',
      520: 'rip',
      161: 'snmp',
      162: 'snmptrap',
      111: 'sunrpc',
      514: 'syslog',
      49: 'tacacs',
      517: 'talk',
      69: 'tftp',
      37: 'time',
      513: 'who',
      177: 'xdmcp',
  }
  _TYPES_ICMP = {
      6: 'alternate-address',
      31: 'conversion-error',
      8: 'echo',
      0: 'echo-reply',
      16: 'information-reply',
      15: 'information-request',
      18: 'mask-reply',
      17: 'mask-request',
      32: 'mobile-redirect',
      12: 'parameter-problem',
      5: 'redirect',
      9: 'router-advertisement',
      10: 'router-solicitation',
      4: 'source-quench',
      11: 'time-exceeded',
      14: 'timestamp-reply',
      13: 'timestamp-request',
      30: 'traceroute',
      3: 'unreachable',
  }
  _CISCO_PORTS_TCP = {
      5190: 'aol',
      1494: 'citrix-ica',
      2748: 'ctiqbe',
      1720: 'h323',
      101: 'hostname',
      143: 'imap4',
      750: 'kerberos',
      1352: 'lotusnotes',
      139: 'netbios-ssn',
      5631: 'pcanywhere-data',
      1521: 'sqlnet',
  }
  _CISCO_PORTS_UDP = {
      750: 'kerberos',
      5632: 'pcanywhere-status',
      1645: 'radius',
      1646: 'radius-acct',
      5510: 'secureid-udp',
  }
  _ARISTA_PORTS_TCP = {
      143: 'imap',
      88: 'kerberos',
  }
  _ARISTA_PORTS_UDP = {
      88: 'kerberos',
      1812: 'radius',
      1813: 'radius-acct',
  }
  _PORT_MAP = {
      'cisco': {
          'tcp': _CISCO_PORTS_TCP,
          'udp': _CISCO_PORTS_UDP,
          'icmp': _TYPES_ICMP
      },
      'arista': {
          'tcp': _ARISTA_PORTS_TCP,
          'udp': _ARISTA_PORTS_UDP,
          'icmp': _TYPES_ICMP
      }
  }
  ALLOWED_PROTO_STRINGS = ['eigrp', 'gre', 'icmp', 'igmp', 'igrp', 'ip',
                           'ipinip', 'nos', 'pim', 'tcp', 'udp',
                           'sctp', 'ahp']
  IPV4_ADDRESS = Union[nacaddr.IPv4, ipaddress.IPv4Network]
  IPV6_ADDRESS = Union[nacaddr.IPv6, ipaddress.IPv6Network]
  _PROTO_INT = True
  _PLATFORM = 'cisco'
  _DEFAULT_PROTOCOL = 'ip'
  SUFFIX = '.acl'
  _PROTO_INT = True
  _TERM_REMARK = True
class Error(Exception):
class CiscoDuplicateTermError(Error):
class CiscoNextIpError(Error):
class UnsupportedCiscoAccessListError(Error):
class StandardAclTermError(Error):
class ExtendedACLTermError(Error):
class TermStandard:
class ObjectGroup:
class PortMap:
class Term(aclgenerator.Term):
class ObjectGroupTerm(Term):
class Cisco(aclgenerator.ACLGenerator):
  def __init__(self, term, filter_name, platform='cisco', verbose=True):
  def __str__(self):
  def __init__(self):
  def valid(self):
  def AddTerm(self, term):
  def AddName(self, filter_name):
  def __str__(self):
  def GetProtocol(port_num, proto, platform='cisco'):
  def __init__(self, term, af=4, proto_int=True, enable_dsmo=False,
               term_remark=True, platform='cisco', verbose=True):
  def __str__(self):
  def _GetIpString(self, addr):
  def _FormatPort(self, port, proto):
  def _FixOptions(self, proto, option):
  def _TermletToStr(self, action, proto, saddr, sport, daddr, dport,
                    icmp_type, icmp_code, option):
  def _FixConsecutivePorts(self, port_list):
  def __init__(self, term, filter_name, platform='cisco', verbose=True):
  def __str__(self):
  def _TermletToStr(self, action, proto, saddr, sport, daddr, dport):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def _GetObjectGroupTerm(self, term, filter_name, verbose=True):
  def _AppendTargetByFilterType(self, filter_name, filter_type):
  def _RepositoryTagsHelper(self, target=None, filter_type='', filter_name=''):
  def __str__(self): _ACTION_TABLE = {
    'accept': 'permit',
    'deny': 'deny',
    'reject': 'deny',
    'next': '! next',
    'reject-with-tcp-rst': 'deny',  # tcp rst not supported
    }
  _PLATFORM = 'ciscoasa'
  _DEFAULT_PROTOCOL = 'ip'
  SUFFIX = '.asa'
class Error(Exception):
class UnsupportedCiscoAccessListError(Error):
class StandardAclTermError(Error):
class NoCiscoPolicyError(Error):
class Term(cisco.Term):
class CiscoASA(aclgenerator.ACLGenerator):
  def __init__(self, term, filter_name, af=4):
  def __str__(self):
  def _TermletToStr(self, filter_name, action, proto, saddr, sport, daddr,
                    dport, icmp_type, option):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self): class Error(Exception):
class UnsupportedNXosAccessListError(Error):
class CiscoNX(cisco.Cisco):
  _PLATFORM = 'cisconx'
  SUFFIX = '.nxacl'
  _PROTO_INT = False
  def _RepositoryTagsHelper(self, target=None, filter_type='', filter_name=''):
  def _AppendTargetByFilterType(self, filter_name, filter_type): class CiscoXR(cisco.Cisco):
class CiscoXRObjectGroupTerm(cisco.ObjectGroupTerm):
  _PLATFORM = 'ciscoxr'
  _DEFAULT_PROTOCOL = 'ip'
  SUFFIX = '.xacl'
  _PROTO_INT = False
  ALLOWED_PROTO_STRINGS = cisco.Term.ALLOWED_PROTO_STRINGS + ['pcp', 'esp']
  def _AppendTargetByFilterType(self, filter_name, filter_type):
  def _BuildTokens(self):
  def _GetObjectGroupTerm(self, term, filter_name, verbose=True): class Error(Exception):
class ExceededMaxTermsError(Error):
class UnsupportedFilterTypeError(Error):
class Term(aclgenerator.Term):
class CloudArmor(aclgenerator.ACLGenerator):
  _MAX_IP_RANGES_PER_TERM = 5
  ACTION_MAP = {'accept': 'allow',
                'deny': 'deny(404)'}
  _MAX_TERM_COMMENT_LENGTH = 64
  _PLATFORM = 'cloudarmor'
  SUFFIX = '.gca'
  _SUPPORTED_AF = set(('inet', 'inet6', 'mixed'))
  _MAX_RULES_PER_POLICY = 200
  _RULECOUNT_WARN_THRESHOLD = 190
  _FILTER_OPTIONS_MAP = {'filter_type': 0}
  def __init__(self, term, address_family='inet', verbose=True):
  def __str__(self):
  def ConvertToDict(self, priority_index):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self): class Error(Exception):
class GceFirewallError(Error):
class ExceededAttributeCountError(Error):
class Term(gcp.Term):
class GCE(gcp.GCP):
def IsDefaultDeny(term):
def GetNextPriority(priority):
  def __init__(self, term, inet_version='inet', policy_inet_version='inet'):
  def __str__(self):
  def _validateDirection(self):
  def ConvertToDict(self):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self):
def GetAttributeCount(dict_term: Dict[str, Any]) -> int:
  ACTION_MAP = {'accept': 'allowed',
                'deny': 'denied'}
  _TERM_ADDRESS_LIMIT = 256
  _TERM_SOURCE_TAGS_LIMIT = 30
  _TERM_TARGET_TAGS_LIMIT = 70
  _TERM_PORTS_LIMIT = 256
  _TERM_NAME_RE = re.compile(r'^[a-z]([-a-z0-9]*[a-z0-9])?$')
  _ALLOW_PROTO_NAME = frozenset(
      ['tcp', 'udp', 'icmp', 'esp', 'ah', 'ipip', 'sctp',
       'all'  # Needed for default deny, do not use in policy file.
      ])
  ALWAYS_PROTO_NUM = set(gcp.Term.PROTO_MAP.keys()) - _ALLOW_PROTO_NAME
  _PLATFORM = 'gce'
  SUFFIX = '.gce'
  _SUPPORTED_AF = frozenset(('inet', 'inet6', 'mixed'))
  _ANY_IP = {
      'inet': nacaddr.IP('0.0.0.0/0'),
      'inet6': nacaddr.IP('::/0'),
  }
  _TERM_MAX_LENGTH = 53
  _GOOD_DIRECTION = ['INGRESS', 'EGRESS']
  _OPTIONAL_SUPPORTED_KEYWORDS = set(['expiration',
                                      'destination_tag',
                                      'source_tag']) class ExceededCostError(gcp.Error):
class DifferentPolicyNameError(gcp.Error):
class ApiVersionSyntaxMap:
class Term(gcp.Term):
class HierarchicalFirewall(gcp.GCP):
  SYNTAX_MAP = {
      'beta': {
          'display_name': 'displayName',
          'dest_ip_range': 'destIpRanges',
          'src_ip_range': 'srcIpRanges',
          'layer_4_config': 'layer4Configs'
      },
      'ga': {
          'display_name': 'shortName',
          'dest_ip_range': 'destIpRanges',
          'src_ip_range': 'srcIpRanges',
          'layer_4_config': 'layer4Configs'
      }
  }
  ACTION_MAP = {'accept': 'allow', 'next': 'goto_next'}
  _MAX_TERM_COMMENT_LENGTH = 64
  _TARGET_RESOURCE_FORMAT = 'https://www.googleapis.com/compute/v1/projects/{}/global/networks/{}'
  _TERM_ADDRESS_LIMIT = 256
  _TERM_TARGET_RESOURCES_LIMIT = 256
  _TERM_DESTINATION_PORTS_LIMIT = 256
  SUFFIX = '.gcphf'
  _ANY_IP = {
      'inet': nacaddr.IP('0.0.0.0/0'),
      'inet6': nacaddr.IP('::/0'),
  }
  _PLATFORM = 'gcp_hf'
  _SUPPORTED_AF = frozenset(['inet', 'inet6', 'mixed'])
  _SUPPORTED_API_VERSION = frozenset(['beta', 'ga'])
  _DEFAULT_MAXIMUM_COST = 100
  def __init__(self,
               term,
               address_family='inet',
               policy_inet_version='inet',
               api_version='beta'):
  def _ValidateTerm(self):
  def ConvertToDict(self, priority_index):
  def __str__(self):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
def GetRuleTupleCount(dict_term: Dict[str, Any], api_version): class Error(Exception):
class Term(iptables.Term):
class Ipset(iptables.Iptables):
  _PLATFORM = 'ipset'
  _SET_MAX_LENGTH = 31
  _POSTJUMP_FORMAT = None
  _PREJUMP_FORMAT = None
  _TERM_FORMAT = None
  _COMMENT_FORMAT = string.Template(
      '-A $filter -m comment --comment "$comment"')
  _FILTER_TOP_FORMAT = string.Template('-A $filter')
  _PLATFORM = 'ipset'
  _SET_TYPE = 'hash:net'
  SUFFIX = '.ips'
  _TERM = Term
  _MARKER_BEGIN = '# begin:ipset-rules'
  _MARKER_END = '# end:ipset-rules'
  _GOOD_OPTIONS = ['nostate', 'abbreviateterms', 'truncateterms', 'noverbose',
                   'exists']
  def __init__(self, *args, **kwargs):
  def _CalculateAddresses(self, src_addr_list, src_addr_exclude_list,
                          dst_addr_list, dst_addr_exclude_list):
  def _CalculateAddrList(self, addr_list, addr_exclude_list,
                         target_af, direction):
  def _GenerateAddressStatement(self, src_addr, dst_addr):
  def _GenerateSetName(self, term_name, suffix):
  def __str__(self):
  def _GenerateSetConfig(self, term): class Term(aclgenerator.Term):
class Iptables(aclgenerator.ACLGenerator):
class Error(Exception):
class BadPortsError(Error):
class UnsupportedFilterError(Error):
class NoIptablesPolicyError(Error):
class TcpEstablishedError(Error):
class EstablishedError(Error):
class UnsupportedDefaultActionError(Error):
class UnsupportedTargetOptionError(Error):
class LimitButNoLogError(Error):
  _PLATFORM = 'iptables'
  _POSTJUMP_FORMAT = None
  _PREJUMP_FORMAT = Template('-A $filter -j $term')
  _TERM_FORMAT = Template('-N $term')
  _COMMENT_FORMAT = Template('-A $term -m comment --comment "$comment"')
  _FILTER_TOP_FORMAT = Template('-A $term')
  _LOG_FORMAT = Template('-j LOG --log-prefix $term')
  _PROTO_TABLE = {
      'icmpv6': '-p ipv6-icmp',
      'icmp': '-p icmp',
      'tcp': '-p tcp',
      'udp': '-p udp',
      'all': '-p all',
      'esp': '-p esp',
      'ah': '-p ah',
      'gre': '-p gre',
      }
  _TCP_FLAGS_TABLE = {
      'syn': 'SYN',
      'ack': 'ACK',
      'fin': 'FIN',
      'rst': 'RST',
      'urg': 'URG',
      'psh': 'PSH',
      'all': 'ALL',
      'none': 'NONE',
      }
  _KNOWN_OPTIONS_MATCHERS = {
      # '! -f' also matches non-fragmented packets.
      'first-fragment': '-m u32 --u32 4&0x3FFF=0x2000',
      'initial': '--syn',
      'tcp-initial': '--syn',
      'sample': '',
      }
  _PLATFORM = 'iptables'
  _DEFAULT_PROTOCOL = 'all'
  SUFFIX = ''
  _RENDER_PREFIX = None
  _RENDER_SUFFIX = None
  _DEFAULTACTION_FORMAT = '-P %s %s'
  _DEFAULTACTION_FORMAT_CUSTOM_CHAIN = '-N %s'
  _DEFAULT_ACTION = 'DROP'
  _TERM = Term
  _TERM_MAX_LENGTH = 24
  _GOOD_FILTERS = ['INPUT', 'OUTPUT', 'FORWARD']
  _GOOD_OPTIONS = ['nostate', 'abbreviateterms', 'truncateterms', 'noverbose']
  def __init__(self, term, filter_name, trackstate, filter_action, af='inet',
               verbose=True):
  def __str__(self):
  def _CalculateAddresses(self, term_saddr, exclude_saddr,
                          term_daddr, exclude_daddr):
  def _FormatPart(self, protocol, saddr, sport, daddr, dport, options,
                  tcp_flags, icmp_type, code, track_flags, sint, dint, log_hits,
                  action):
  def _GenerateAddressStatement(self, saddr, daddr):
  def _GeneratePortStatement(self, ports, source=False, dest=False):
  def _SetDefaultAction(self):
  def __init__(self, pol, exp_info):
  def _BuildTokens(self):
  def _WarnIfCustomTarget(self, target):
  def _TranslatePolicy(self, pol, exp_info):
  def SetTarget(self, target, action=None):
  def __str__(self): class Error(Exception):
class JuniperTermPortProtocolError(Error):
class TcpEstablishedWithNonTcpError(Error):
class JuniperDuplicateTermError(Error):
class UnsupportedFilterError(Error):
class PrecedenceError(Error):
class JuniperIndentationError(Error):
class JuniperNextIpError(Error):
class JuniperMultipleTerminatingActionError(Error):
class JuniperFragmentInV6Error(Error):
class Config:
class Term(aclgenerator.Term):
class Juniper(aclgenerator.ACLGenerator):
  def __init__(self, indent=0, tabstop=4):
  def __str__(self):
  def Append(self, line, verbatim=False):
  def __init__(self, term, term_type, enable_dsmo, noverbose):
  def __str__(self):
  def NextIpCheck(next_ip, term_name):
  def CheckTerminatingAction(self):
  def _MinimizePrefixes(self, include, exclude):
  def _Comment(self, addr, exclude=False, line_length=132):
  def _Group(self, group, lc=True):
    def _FormattedGroup(el, lc=True):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self):
  _PLATFORM = 'juniper'
  _DEFAULT_INDENT = 12
  ACTIONS = {'accept': 'accept',
             'deny': 'discard',
             'reject': 'reject',
             'next': 'next term',
             'reject-with-tcp-rst': 'reject tcp-reset',
             'encapsulate': 'encapsulate'}
  _TERM_TYPE = {'inet': {'addr': 'address',
                         'saddr': 'source-address',
                         'daddr': 'destination-address',
                         'protocol': 'protocol',
                         'protocol-except': 'protocol-except',
                         'tcp-est': 'tcp-established'},
                'inet6': {'addr': 'address',
                          'saddr': 'source-address',
                          'daddr': 'destination-address',
                          'protocol': 'next-header',
                          'protocol-except': 'next-header-except',
                          'tcp-est': 'tcp-established'},
                'bridge': {'addr': 'ip-address',
                           'saddr': 'ip-source-address',
                           'daddr': 'ip-destination-address',
                           'protocol': 'ip-protocol',
                           'protocol-except': 'ip-protocol-except',
                           'tcp-est': 'tcp-flags "(ack|rst)"'}
              }
  _PLATFORM = 'juniper'
  _DEFAULT_PROTOCOL = 'ip'
  _SUPPORTED_AF = frozenset(('inet', 'inet6', 'bridge', 'mixed'))
  _TERM = Term
  SUFFIX = '.jcl' MAX_IDENTIFIER_LEN = 55  # It is really 63, but leaving room for added chars
  _PLATFORM = 'msmpc'
  _DEFAULT_INDENT = 20
  _ACTIONS = {'accept': 'accept', 'deny': 'discard', 'reject': 'reject'}
  _SUPPORTED_PROTOCOL_NAMES = (
      'ah',
      'egp',
      'esp',
      'gre',
      'icmp',
      'icmpv6',
      'igmp',
      'ipip',
      #'node', A pseudo-protocol which may require additional handling
      'ospf',
      'pim',
      'rsvp',
      'sctp',
      'tcp',
      'udp')
  _PLATFORM = 'msmpc'
  SUFFIX = '.msmpc'
  _SUPPORTED_AF = frozenset(('inet', 'inet6', 'mixed'))
  _AF_MAP = {'inet': 4, 'inet6': 6, 'mixed': None}
  _AF_ICMP_MAP = {'icmp': 'inet', 'icmpv6': 'inet6'}
  _SUPPORTED_DIRECTION = {
      '': 'input-output',
      'ingress': 'input',
      'egress': 'output',
  }
  _OPTIONAL_SUPPORTED_KEYWORDS = frozenset([
      'expiration',
  ])
class Term(juniper.Term):
class JuniperMSMPC(aclgenerator.ACLGenerator):
class Error(Exception):
class JuniperMSMPCFilterError(Error):
class ConflictingApplicationSetsError(Error):
class ConflictingTargetOptionsError(Error):
class UnsupportedHeaderError(Error):
  def __init__(self, term, term_type, noverbose, filter_name):
  def __str__(self):
  def __init__(self, pol, exp_info):
  def _BuildTokens(self):
  def _BuildPort(self, ports):
  def _GenerateApplications(self, filter_name):
  def _TranslatePolicy(self, pol, exp_info):
  def _Group(self, group, lc=True):
    def _FormattedGroup(el, lc=True):
  def __str__(self): ICMP_TERM_LIMIT = 8
  ACTIONS = {'accept': 'permit',
             'deny': 'deny',
             'reject': 'reject',
             'count': 'count',
             'log': 'log',
             'expresspath': 'services-offload',
             'dscp': 'dscp'}
  _PLATFORM = 'srx'
  SUFFIX = '.srx'
  _SUPPORTED_AF = set(('inet', 'inet6', 'mixed'))
  _ZONE_ADDR_BOOK = 'address-book-zone'
  _GLOBAL_ADDR_BOOK = 'address-book-global'
  _ADDRESSBOOK_TYPES = set((_ZONE_ADDR_BOOK, _GLOBAL_ADDR_BOOK))
  _EXPRESSPATH = 'expresspath'
  _NOVERBOSE = 'noverbose'
  _SUPPORTED_TARGET_OPTIONS = set((_ZONE_ADDR_BOOK, _GLOBAL_ADDR_BOOK,
                                   _EXPRESSPATH, _NOVERBOSE))
  _AF_MAP = {'inet': (4,),
             'inet6': (6,),
             'mixed': (4, 6)}
  _AF_ICMP_MAP = {'icmp': 'inet',
                  'icmpv6': 'inet6'}
  INDENT = '    '
  _MAX_HEADER_COMMENT_LENGTH = 71
  _ADDRESS_LENGTH_LIMIT = 1023
  _IPV6_SIZE = 4
def JunipersrxList(name, data):
  def __init__(self, indent, *args, **kwargs):
  def IndentAppend(self, size, data):
  def __init__(self, term, from_zone, to_zone, expresspath=False, verbose=True):
  def __str__(self):
  def _Group(self, group):
    def _FormattedGroup(el):
  def __init__(self, pol, exp_info):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def _FixLargePolices(self, terms, address_family):
    def Chunks(l):
  def _BuildAddressBook(self, zone, address):
  def _SortAddressBookNumCheck(self, item):
  def _BuildPort(self, ports):
  def _GenerateAddressBook(self):
  def _GenerateApplications(self):
  def __str__(self):
class Error(Exception):
class UnsupportedFilterError(Error):
class UnsupportedHeaderError(Error):
class SRXDuplicateTermError(Error):
class SRXVerbatimError(Error):
class SRXOptionError(Error):
class MixedAddrBookTypesError(Error):
class ConflictingTargetOptionsError(Error):
class ConflictingApplicationSetsError(Error):
class IndentList(list):
class Term(aclgenerator.Term):
class JuniperSRX(aclgenerator.ACLGenerator): class Error(Exception):
class K8sNetworkPolicyError(Error):
class ExceededAttributeCountError(Error):
class Term(aclgenerator.Term):
class K8s(aclgenerator.ACLGenerator):
def IsDefaultDeny(term):
def GetNextPriority(priority):
  def __init__(self, term):
  def __str__(self):
  def _validateDirection(self):
  def ConvertToDict(self):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self):
  _API_VERSION = 'networking.k8s.io/v1'
  _RESOURCE_KIND = 'NetworkPolicy'
  _TERM_NAME_RE = re.compile(r'^[a-z0-9]([a-z0-9-\.]){0,251}[a-z0-9]$')
  _TERM_MAX_LENGTH = 253
  PROTO_MAP = {
      'tcp': 6,
      'udp': 17,
      'sctp': 132,
      'all': -1,  # Used for default deny
  }
  _API_VERSION = 'networking.k8s.io/v1'
  _RESOURCE_KIND = 'NetworkPolicyList'
  _PLATFORM = 'k8s'
  SUFFIX = '.yml'
  _SUPPORTED_AF = frozenset(('mixed'))
  _GOOD_DIRECTION = ['INGRESS', 'EGRESS']
  _OPTIONAL_SUPPORTED_KEYWORDS = frozenset(['expiration']) class Error(Exception):
class NamespaceCollisionError(Error):
class BadNetmaskTypeError(Error):
class NoDefinitionsError(Error):
class ParseError(Error):
class UndefinedAddressError(Error):
class UndefinedServiceError(Error):
class UndefinedPortError(Error):
class UnexpectedDefinitionTypeError(Error):
class NamingSyntaxError(Error):
class _ItemUnit:
class Naming:
  def __init__(self, symbol):
  def __init__(self, naming_dir=None, naming_file=None, naming_type=None):
  def _CheckUnseen(self, def_type):
  def GetIpParents(self, query):
  def GetServiceParents(self, query):
  def GetNetParents(self, query):
  def _GetParents(self, query, query_group):
  def GetNetChildren(self, query):
  def _GetChildren(self, query, query_group):
  def _IsIpFormat(self, item):
  def GetServiceNames(self):
  def GetService(self, query):
  def GetPortParents(self, query, proto):
  def GetServiceByProto(self, query, proto):
  def GetNetAddr(self, token):
  def GetNet(self, query):
  def _Parse(self, defdirectory, def_type):
  def _ParseFile(self, file_handle, def_type):
  def ParseServiceList(self, data):
  def ParseNetworkList(self, data):
  def _ParseLine(self, line, definition_type): class Error(Exception):
class InvalidTargetOption(Error):
class InvalidAddressFamily(Error):
class Term(aclgenerator.Term):
class Nftables(aclgenerator.ACLGenerator):
  _PLATFORM = 'nftables'
  _ACTIONS = {'accept': 'accept',
              'deny': 'drop',
              'reject': 'reject',
              'next': 'continue',
              'reject-with-tcp-rst': 'reject with tcp reset'}
  MAX_CHARACTERS = 128
  SUFFIX = '.nft'
  _PLATFORM = 'nftables'
  _TERM = Term
  _VALID_ADDRESS_FAMILIES = {'inet': 'ip', 'inet6': 'ip6', 'mixed': 'inet'}
  _VALID_HOOK_NAMES = set(['prerouting', 'input', 'forward',
                           'output', 'postrouting'])
  def __init__(self, term, af):
  def __str__(self):
  def _CalculateAddrs(self, addr_list, addr_exclude_list):
  def _FormatMatch(self, match):
  def _BuildTokens(self):
  def _TranslatePolicy(self, policy, expiration):
  def __str__(self): _ACTION_TABLE = {
    'accept': 'allow',
    'deny': 'deny',
    'reject': 'reject',
    'reject-with-tcp-rst': 'reject',  # tcp rst not supported
}
_XML_TABLE = {
    'actionStart': '<action>',
    'actionEnd': '</action>',
    'srcIpv4Start': '<source><type>Ipv4Address</type><value>',
    'srcIpv4End': '</value></source>',
    'destIpv4Start': '<destination><type>Ipv4Address</type><value>',
    'destIpv4End': '</value></destination>',
    'protocolStart': '<protocol>',
    'protocolEnd': '</protocol>',
    'serviceStart': '<service>',
    'serviceEnd': '</service>',
    'appliedToStart': '<appliedTo><type>SecurityGroup</type><value>',
    'appliedToEnd': '</value></appliedTo>',
    'srcPortStart': '<sourcePort>',
    'srcPortEnd': '</sourcePort>',
    'destPortStart': '<destinationPort>',
    'destPortEnd': '</destinationPort>',
    'icmpTypeStart': '<subProtocol>',
    'icmpTypeEnd': '</subProtocol>',
    'logTrue': '<loggingEnabled>true</loggingEnabled>',
    'logFalse': '<loggingEnabled>false</loggingEnabled>',
    'sectionStart': '<section>',
    'sectionEnd': '</section>',
    'nameStart': '<name>',
    'nameEnd': '</name>',
    'srcIpv6Start': '<source><type>Ipv6Address</type><value>',
    'srcIpv6End': '</value></source>',
    'destIpv6Start': '<destination><type>Ipv6Address</type><value>',
    'destIpv6End': '</value></destination>',
    'noteStart': '<notes>',
    'noteEnd': '</notes>',
}
_NSXV_SUPPORTED_KEYWORDS = [
    'name',
    'action',
    'comment',
    'destination_address',
    'destination_address_exclude',
    'destination_port',
    'expiration',
    'icmp_type',
    'protocol',
    'source_address',
    'source_address_exclude',
    'source_port',
    'expiration',
    'logging'
]
  _PLATFORM = 'nsxv'
  _DEFAULT_PROTOCOL = 'ip'
  SUFFIX = '.nsx'
  _OPTIONAL_SUPPORTED_KEYWORDS = set(['expiration',
                                      'logging',
                                     ])
  _FILTER_OPTIONS_DICT = {}
class Error(Exception):
class UnsupportedNsxvAccessListError(Error):
class NsxvAclTermError(Error):
class NsxvDuplicateTermError(Error):
class Term(aclgenerator.Term):
class Nsxv(aclgenerator.ACLGenerator):
  def __init__(self, term, filter_type, applied_to=None, af=4):
  def __str__(self):
  def _ServiceToString(self, proto, sports, dports, icmp_types):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def _ParseFilterOptions(self, filter_options):
  def __str__(self): class Error(Exception):
class OcFirewallError(Error):
class ExceededAttributeCountError(Error):
class Term(aclgenerator.Term):
class OpenConfig(aclgenerator.ACLGenerator):
def RecursiveDict():
  def __init__(self, term, inet_version='inet'):
  def __str__(self):
  def ConvertToDict(self):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self):
  ACTION_MAP = {'accept': 'ACCEPT',
                'deny': 'DROP',
                'reject': 'REJECT'}
  _ALLOW_PROTO_NAME = frozenset(
      ['tcp', 'udp', 'icmp', 'esp', 'ah', 'ipip', 'sctp'])
  AF_RENAME = { 4: 'ipv4',
                6: 'ipv6',
              }
  _PLATFORM = 'openconfig'
  SUFFIX = '.oacl'
  _SUPPORTED_AF = frozenset(('inet', 'inet6', 'mixed')) class Error(Exception):
class DuplicateTermError(Error):
class DuplicateShortenedTableNameError(Error):
class UnsupportedProtoError(Error):
class Term(aclgenerator.Term):
class PacketFilter(aclgenerator.ACLGenerator):
  _PLATFORM = 'packetfilter'
  _ACTION_TABLE = {
      'accept': 'pass',
      'deny': 'block drop',
      'reject': 'block return',
      'next': 'pass',
      }
  _LOG_TABLE = {
      '': 'log',
      'in': 'log',
      'out': 'log',
      }
  _QUICK_TABLE = {
      'accept': 'quick',
      'deny': 'quick',
      'reject': 'quick',
      'next': '',
      }
  _DIRECTION_TABLE = {
      '': '',
      'in': 'in',
      'out': 'out',
      }
  _TCP_FLAGS_TABLE = {
      'syn': 'S',
      'ack': 'A',
      'fin': 'F',
      'rst': 'R',
      'urg': 'U',
      'psh': 'P',
      'all': 'SAFRUP',
      'none': 'NONE',
      }
  _PROTO_TABLE = {
      'icmpv6': 'ipv6-icmp',
      }
  _UNSUPPORTED_PROTOS = ['hopopt']
  _DEF_MAX_LENGTH = 31
  _PLATFORM = 'packetfilter'
  _DEFAULT_PROTOCOL = 'all'
  SUFFIX = '.pf'
  _TERM = Term
  def __init__(self, term, filter_name, stateful=True, af='inet', direction=''):
  def __str__(self):
  def _CheckAddressAf(self, addrs):
  def _FormatPart(self, action, direction, log, af, proto, src_addr, src_port,
                  dst_addr, dst_port, tcp_flags_set, tcp_flags_check,
                  icmp_types, options, stateful):
  def _GenerateProtoStatement(self, protocols):
  def _GenerateAddrStatement(self, addrs, exclude_addrs):
  def _GeneratePortStatement(self, ports):
  def _SetDefaultAction(self):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self): class Error(Exception):
class UnsupportedFilterError(Error):
class UnsupportedHeaderError(Error):
class PaloAltoFWDuplicateTermError(Error):
class PaloAltoFWUnsupportedProtocolError(Error):
class PaloAltoFWVerbatimError(Error):
class PaloAltoFWOptionError(Error):
class PaloAltoFWDuplicateServiceError(Error):
class PaloAltoFWNameTooLongError(Error):
class PaloAltoFWBadIcmpTypeError(Error):
class ServiceMap:
class Rule:
class PaloAltoFW(aclgenerator.ACLGenerator):
  def __init__(self):
  def get_service_name(self, term_name, src_ports, ports, protocol, prefix=None):
  def __init__(self, from_zone, to_zone, term, service_map):
  def TermToOptions(from_zone, to_zone, term, service_map):
    def pan_ports(ports):
  def __init__(self, pol, exp_info):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def _BuildAddressBook(self, zone, address):
  def _SortAddressBookNumCheck(self, item):
  def _BuildPort(self, ports):
  def __str__(self):
    MAX_ZONE_LENGTH = 31
    ACTIONS = {
      "accept": "allow",
      "deny": "deny",
      "reject": "reset-client",
      "reject-with-tcp-rst": "reset-client",
    }
  _PLATFORM = "paloalto"
  SUFFIX = ".xml"
  _SUPPORTED_AF = set(("inet", "inet6", "mixed"))
  _AF_MAP = {"inet": (4,), "inet6": (6,), "mixed": (4, 6)}
  _TERM_MAX_LENGTH = 31
  _SUPPORTED_PROTO_NAMES = [
      "tcp",
      "udp",
      "icmp",
      "icmpv6",
      "sctp",
      "igmp",
      "gre",
      "ah",
      "esp",
  ]
  _MAX_RULE_DESCRIPTION_LENGTH = 1024
  _MAX_TAG_COMMENTS_LENGTH = 1023
  _TAG_NAME_FORMAT = "{from_zone}_{to_zone}_policy-comment-{num}"
  _MAX_RULE_SRC_DST_MEMBERS = 65535
  INDENT = "  "
    ANY_IPV4_RANGE = "0.0.0.0-255.255.255.255" class Error(Exception):
class UnsupportedActionError(Error):
class UnsupportedTargetOptionError(Error):
class Term(aclgenerator.Term):
class PcapFilter(aclgenerator.ACLGenerator):
  _PLATFORM = 'pcap'
  _ACTION_TABLE = {
      'accept': '',
      'deny': '',
      'reject': '',
      'next': '',
      }
  _TCP_FLAGS_TABLE = {
      'syn': 'tcp-syn',
      'ack': 'tcp-ack',
      'fin': 'tcp-fin',
      'rst': 'tcp-rst',
      'urg': 'tcp-urg',
      'psh': 'tcp-push',
      'all': '(tcp-syn|tcp-ack|tcp-fin|tcp-rst|tcp-urg|tcp-push)',
      'none': '(tcp-syn&tcp-ack&tcp-fin&tcp-rst&tcp-urg&tcp-push)',
      }
  _PROTO_TABLE = {
      'ah': 'proto \\ah',
      'esp': 'proto \\esp',
      'icmp': 'proto \\icmp',
      'icmpv6': 'icmp6',
      'ip': 'proto \\ip',
      'ip6': 'ip6',
      'igmp': 'proto \\igmp',
      'igrp': 'igrp',
      'pim': 'proto \\pim',
      'tcp': 'proto \\tcp',
      'udp': 'proto \\udp',
      # bpf supports "\vrrp", but some winpcap version dont' recognize it,
      # so use the IANA protocol number for it:
      'vrrp': 'proto 112',
      'hopopt': 'ip6 protochain 0',
      }
  _PLATFORM = 'pcap'
  _DEFAULT_PROTOCOL = 'all'
  SUFFIX = '.pcap'
  _TERM = Term
  def __init__(self, term, filter_name, af='inet', direction=''):
  def __str__(self):
  def _CheckAddressAf(self, addrs):
  def JoinConditionals(condition_list, operator):
  def _GenerateAddrStatement(self, addrs, exclude_addrs):
  def _GenerateProtoStatement(self, protocols):
  def _GeneratePortStatement(self, ports, direction):
  def _GenerateTcpOptions(self, options):
  def _GenerateIcmpType(self, icmp_types, icmp_code):
  def __init__(self, *args, **kwargs):
  def _BuildTokens(self):
  def _TranslatePolicy(self, pol, exp_info):
  def __str__(self): DEFINITIONS = None
DEFAULT_DEFINITIONS = './def'
ACTIONS = set(('accept', 'count', 'deny', 'reject', 'next',
               'reject-with-tcp-rst'))
PROTOS_WITH_PORTS = frozenset(('tcp', 'udp', 'udplite', 'sctp'))
_FLEXIBLE_MATCH_RANGE_ATTRIBUTES = {'byte-offset',
                                    'bit-offset',
                                    'bit-length',
                                    'match-start',
                                    'range',
                                    'range-except',
                                    'flexible-range-name'}
_FLEXIBLE_MATCH_START_OPTIONS = {'layer-3', 'layer-4', 'payload'}
_LOGGING = set(('true', 'True', 'syslog', 'local', 'disable', 'log-both'))
_OPTIMIZE = True
_SHADE_CHECK = False
_MAX_TTL = 255
_MIN_TTL = 0
  ICMP_TYPE = {4: {'echo-reply': 0,
                   'unreachable': 3,
                   'source-quench': 4,
                   'redirect': 5,
                   'alternate-address': 6,
                   'echo-request': 8,
                   'router-advertisement': 9,
                   'router-solicitation': 10,
                   'time-exceeded': 11,
                   'parameter-problem': 12,
                   'timestamp-request': 13,
                   'timestamp-reply': 14,
                   'information-request': 15,
                   'information-reply': 16,
                   'mask-request': 17,
                   'mask-reply': 18,
                   'conversion-error': 31,
                   'mobile-redirect': 32,
                  },
               6: {'destination-unreachable': 1,
                   'packet-too-big': 2,
                   'time-exceeded': 3,
                   'parameter-problem': 4,
                   'echo-request': 128,
                   'echo-reply': 129,
                   'multicast-listener-query': 130,
                   'multicast-listener-report': 131,
                   'multicast-listener-done': 132,
                   'router-solicit': 133,
                   'router-advertisement': 134,
                   'neighbor-solicit': 135,
                   'neighbor-advertisement': 136,
                   'redirect-message': 137,
                   'router-renumbering': 138,
                   'icmp-node-information-query': 139,
                   'icmp-node-information-response': 140,
                   'inverse-neighbor-discovery-solicitation': 141,
                   'inverse-neighbor-discovery-advertisement': 142,
                   'version-2-multicast-listener-report': 143,
                   'home-agent-address-discovery-request': 144,
                   'home-agent-address-discovery-reply': 145,
                   'mobile-prefix-solicitation': 146,
                   'mobile-prefix-advertisement': 147,
                   'certification-path-solicitation': 148,
                   'certification-path-advertisement': 149,
                   'multicast-router-advertisement': 151,
                   'multicast-router-solicitation': 152,
                   'multicast-router-termination': 153,
                  },
              }
  ICMP_CODE = {'unreachable': [0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
                               10, 11, 12, 13, 14, 15],
               'redirect': [0, 1, 2, 3],
               'router-advertisement': [0, 16],
               'time-exceeded': [0, 1],
               'parameter-problem': [0, 1, 2],
               'destination-unreachable': [0, 1, 2, 3, 4, 5, 6, 7],
               'parameter-problem': [0, 1, 2, 3],
               'router-renumbering': [0, 1, 255],
               'icmp-node-information-query': [0, 1, 2],
               'icmp-node-information-response': [0, 1, 2],
              }
  _IPV4_BYTE_SIZE = 1
  _IPV6_BYTE_SIZE = 4
  COMMENT = 0
  COUNTER = 1
  ACTION = 2
  SADDRESS = 3
  DADDRESS = 4
  ADDRESS = 5
  SPORT = 6
  DPORT = 7
  PROTOCOL_EXCEPT = 8
  OPTION = 9
  PROTOCOL = 10
  SADDREXCLUDE = 11
  DADDREXCLUDE = 12
  LOGGING = 13
  QOS = 14
  POLICER = 15
  PACKET_LEN = 16
  FRAGMENT_OFFSET = 17
  ICMP_TYPE = 18
  SPFX = 19
  DPFX = 20
  ETHER_TYPE = 21
  TRAFFIC_TYPE = 22
  VERBATIM = 23
  LOSS_PRIORITY = 24
  ROUTING_INSTANCE = 25
  PRECEDENCE = 26
  SINTERFACE = 27
  EXPIRATION = 28
  DINTERFACE = 29
  PLATFORM = 30
  PLATFORMEXCLUDE = 31
  PORT = 32
  TIMEOUT = 33
  OWNER = 34
  ADDREXCLUDE = 36
  VPN = 37
  APPLY_GROUPS = 38
  APPLY_GROUPS_EXCEPT = 39
  DSCP_SET = 40
  DSCP_MATCH = 41
  DSCP_EXCEPT = 42
  FORWARDING_CLASS = 43
  STAG = 44
  DTAG = 45
  NEXT_IP = 46
  HOP_LIMIT = 47
  LOG_NAME = 48
  FLEXIBLE_MATCH_RANGE = 49
  ESPFX = 50
  EDPFX = 51
  FORWARDING_CLASS_EXCEPT = 52
  TRAFFIC_CLASS_COUNT = 53
  PAN_APPLICATION = 54
  ICMP_CODE = 55
  PRIORITY = 56
  TTL = 57
  LOG_LIMIT = 58
  TARGET_RESOURCES = 59
  TARGET_SERVICE_ACCOUNTS = 60
  ENCAPSULATE = 61
  FILTER_TERM = 62
  RESTRICT_ADDRESS_FAMILY = 63
class Error(Exception):
class FileNotFoundError(Error):
class FileReadError(Error):
class RecursionTooDeepError(Error):
class ParseError(Error):
class TermAddressExclusionError(Error):
class TermObjectTypeError(Error):
class TermPortProtocolError(Error):
class TermProtocolEtherTypeError(Error):
class TermNoActionError(Error):
class TermInvalidIcmpType(Error):
class InvalidTermActionError(Error):
class InvalidTermLoggingError(Error):
class UndefinedAddressError(Error):
class NoTermsError(Error):
class ShadingError(Error):
class FlexibleMatchError(Error):
class ICMPCodeError(Error):
class InvalidTermTTLValue(Error):
class MixedPortandNonPortProtos(Error):
class Policy:
class Term:
class VarType:
class Header:
class Target:
def TranslatePorts(ports, protocols, term_name):
  def __init__(self, header, terms):
  def AddFilter(self, header, terms):
  def _TranslateTerms(self, terms):
  def _NeedsAddressBook(self):
  def headers(self):
  def _DetectShading(self, terms):
  def __eq__(self, obj):
  def __str__(self):
    def tuple_str(tup):
  def __repr__(self):
  def __init__(self, obj):
  def __contains__(self, other):
  def __str__(self):
  def __repr__(self):
  def __eq__(self, other):
  def __ne__(self, other):
  def _SortAddressesByFamily(self, addr_type):
  def AddressesByteLength(self, address_family=(4, 6)):
  def FlattenAll(self):
  def GetAddressOfVersion(self, addr_type, af=None):
  def AddObject(self, obj):
  def SanityCheck(self):
  def AddressCleanup(self, optimize=True, addressbook=False):
    def cleanup(addresses, complement_addresses):
  def CollapsePortList(self, ports):
  def CheckProtocolIsContained(self, superset, subset):
  def CheckPortIsContained(self, superset, subset):
  def CheckAddressIsContained(self, superset, subset):
  def __init__(self, var_type, value):
  def __str__(self):
  def __repr__(self):
  def __eq__(self, other):
  def __hash__(self):
  def __init__(self):
  def AddObject(self, obj):
  def platforms(self):
  def FilterOptions(self, platform):
  def FilterName(self, platform):
  def __str__(self):
  def __repr__(self):
  def __eq__(self, obj):
  def __init__(self, target):
  def __str__(self):
  def __repr__(self):
  def __eq__(self, other):
  def __ne__(self, other):
def t_IGNORE_COMMENT(t):
def t_ESCAPEDSTRING(t):
def t_DQUOTEDSTRING(t):
def t_newline(t):
def t_error(t):
def t_DSCP_RANGE(t):
def t_DSCP(t):
def t_HEX(t):
def t_INTEGER(t):
def t_STRING(t):
def p_target(p):
def p_header(p):
def p_header_spec(p):
def p_target_spec(p):
def p_terms(p):
def p_term_spec(p):
def p_restrict_address_family_spec(p):
def p_routinginstance_spec(p):
def p_losspriority_spec(p):
def p_precedence_spec(p):
def p_flexible_match_range_spec(p):
def p_flex_match_key_values(p):
def p_forwarding_class_spec(p):
def p_forwarding_class_except_spec(p):
def p_next_ip_spec(p):
def p_encapsulate_spec(p):
def p_icmp_type_spec(p):
def p_icmp_code_spec(p):
def p_priority_spec(p):
def p_packet_length_spec(p):
def p_fragment_offset_spec(p):
def p_hop_limit_spec(p):
def p_one_or_more_dscps(p):
def p_dscp_set_spec(p):
def p_dscp_match_spec(p):
def p_dscp_except_spec(p):
def p_exclude_spec(p):
def p_prefix_list_spec(p):
def p_addr_spec(p):
def p_port_spec(p):
def p_protocol_spec(p):
def p_tag_list_spec(p):
def p_target_resources_spec(p):
def p_target_service_accounts_spec(p):
def p_ether_type_spec(p):
def p_traffic_type_spec(p):
def p_policer_spec(p):
def p_logging_spec(p):
def p_log_limit_spec(p):
def p_log_name_spec(p):
def p_option_spec(p):
def p_action_spec(p):
def p_counter_spec(p):
def p_traffic_class_count_spec(p):
def p_expiration_spec(p):
def p_comment_spec(p):
def p_owner_spec(p):
def p_verbatim_spec(p):
def p_vpn_spec(p):
def p_qos_spec(p):
def p_pan_application_spec(p):
def p_interface_spec(p):
def p_platform_spec(p):
def p_apply_groups_spec(p):
def p_apply_groups_except_spec(p):
def p_timeout_spec(p):
def p_ttl_spec(p):
def p_filter_term_spec(p):
def p_one_or_more_strings(p):
def p_one_or_more_tuples(p):
def p_one_tuple(p):
def p_one_or_more_ints(p):
def p_strings_or_ints(p):
def p_error(p):
def _ReadFile(filename):
def _Preprocess(data, max_depth=5, base_dir=''):
def ParseFile(filename, definitions=None, optimize=True, base_dir='',
              shade_check=False):
def ParsePolicy(data, definitions=None, optimize=True, base_dir='',
                shade_check=False, filename=''): class Error(Exception):
class Term(iptables.Term):
class Speedway(iptables.Iptables):
  _PLATFORM = 'speedway'
  _PREJUMP_FORMAT = None
  _POSTJUMP_FORMAT = Template('-A $filter -j $term')
  _PLATFORM = 'speedway'
  _DEFAULT_PROTOCOL = 'all'
  SUFFIX = '.ipt'
  _RENDER_PREFIX = '*filter'
  _RENDER_SUFFIX = 'COMMIT'
  _DEFAULTACTION_FORMAT = ':%s %s'
  _TERM = Term class Term(juniper.Term):
class SRXlo(juniper.Juniper):
  _PLATFORM = 'srxlo'
  _PLATFORM = 'srxlo'
  SUFFIX = '.jsl'
  _TERM = Term
  def __init__(self, *args, **kwargs):
  def NormalizeIcmpTypes(self, icmp_types, protocols, af):
  def _BuildTokens(self): class Term(windows.Term):
class WindowsAdvFirewall(windows.WindowsGenerator):
  _PLATFORM = 'windows_advfirewall'
  CMD_PREFIX = 'netsh advfirewall firewall '
  _DIR_ATOM = string.Template('dir=${dir}')
  _ADDR_ATOM = string.Template('${dir}ip=${addr}')
  _PORT_ATOM = string.Template('${dir}port=${port}')
  _PROTO_ATOM = string.Template('protocol=${protocol}')
  _ACTION_ATOM = string.Template('action=${action}')
  _RULE_FORMAT = string.Template('add rule name=${name} enable=yes '
                                 'interfacetype=any ${atoms}')
  _ACTION_TABLE = {
      'accept': 'allow',
      'deny': 'block',
      'reject': 'block',
      }
  _PLATFORM = 'windows_advfirewall'
  _TERM = Term
  def _HandleIcmpTypes(self, icmp_types, protocols):
  def _HandlePorts(self, src_ports, dst_ports):
  def _CartesianProduct(self, src_addr, dst_addr, protocol, unused_icmp_types,
                        src_port, dst_port, ret_str):
  def _ComposeRule(self, srcaddr, dstaddr, proto, srcport, dstport, action):
  def _ComposePortString(self, ports): def yaml_loader(filename):
def flags_to_dict(absl_flags):
def merge_files(*files):
def generate_configs(absl_flags):
import copy
import multiprocessing
import pathlib
import sys
from typing import Iterator, List, Tuple
from absl import app
from absl import flags
from absl import logging
from capirca.lib import aclgenerator
from capirca.lib import arista
from capirca.lib import arista_tp
from capirca.lib import aruba
from capirca.lib import brocade
from capirca.lib import cisco
from capirca.lib import ciscoasa
from capirca.lib import cisconx
from capirca.lib import ciscoxr
from capirca.lib import cloudarmor
from capirca.lib import gce
from capirca.lib import gcp_hf
from capirca.lib import ipset
from capirca.lib import iptables
from capirca.lib import juniper
from capirca.lib import junipermsmpc
from capirca.lib import junipersrx
from capirca.lib import k8s
from capirca.lib import naming
from capirca.lib import nftables
from capirca.lib import nsxv
from capirca.lib import openconfig
from capirca.lib import packetfilter
from capirca.lib import paloaltofw
from capirca.lib import pcap
from capirca.lib import policy
from capirca.lib import speedway
from capirca.lib import srxlo
from capirca.lib import windows_advfirewall
from capirca.utils import config
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if msmpc:
      acl_obj = junipermsmpc.JuniperMSMPC(msmpc, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if srx:
      acl_obj = junipersrx.JuniperSRX(srx, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if acl:
      acl_obj = cisco.Cisco(acl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if asacl:
      acl_obj = ciscoasa.CiscoASA(asacl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if aacl:
      acl_obj = aruba.Aruba(aacl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if bacl:
      acl_obj = brocade.Brocade(bacl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if eacl:
      acl_obj = arista.Arista(eacl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if atp:
      acl_obj = arista_tp.AristaTrafficPolicy(atp, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if ips:
      acl_obj = ipset.Ipset(ips, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if ipt:
      acl_obj = iptables.Iptables(ipt, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if nsx:
      acl_obj = nsxv.Nsxv(nsx, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if oc:
      acl_obj = openconfig.OpenConfig(oc, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if spd:
      acl_obj = speedway.Speedway(spd, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if pcap_accept:
      acl_obj = pcap.PcapFilter(pcap_accept, exp_info)
      RenderACL(
          str(acl_obj), '-accept' + acl_obj.SUFFIX, output_directory,
          input_file, write_files)
    if pcap_deny:
      acl_obj = pcap.PcapFilter(pcap_deny, exp_info, invert=True)
      RenderACL(
          str(acl_obj), '-deny' + acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if pf:
      acl_obj = packetfilter.PacketFilter(pf, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if win_afw:
      acl_obj = windows_advfirewall.WindowsAdvFirewall(win_afw, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if jsl:
      acl_obj = srxlo.SRXlo(jsl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if nxacl:
      acl_obj = cisconx.CiscoNX(nxacl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if xacl:
      acl_obj = ciscoxr.CiscoXR(xacl, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if nft:
      acl_obj = nftables.Nftables(nft, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if gcefw:
      acl_obj = gce.GCE(gcefw, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)
    if gcphf:
      acl_obj = gcp_hf.HierarchicalFirewall(gcphf, exp_info)
      RenderACL(
          str(acl_obj), acl_obj.SUFFIX, output_directory, input_file,
          write_files)

    if paloalto:

      acl_obj = paloaltofw.PaloAltoFW(paloalto, exp_info)