Question

迁移后，我需要扩展ASA访问列表以供参考。 ASA现在不见了，我想扩展对象组引用以验证我们捕获了所有预期的访问。我对具有4个对象组的ACL行有一个可行的想法。我的问题是ACL可能有0-4个对象组引用，我需要一个循环来运行并处理每种可能的组合。我可以为每种可能的组合编写一个循环，但我知道必须有一种更优雅的方法。

我已经有了用于分别扩展和存储对象组的代码，但是以行内替换它们是一个挑战。

感谢您的时间和考虑。

@line = ('access-list','vlan_in','extended','permit','object-group','ob1','object-group','ob2','object-group','ob3','object-group','ob4');
# @line = ('access-list','vlan_in','extended','permit','object-group','ob1','object-group','ob2','object-group','ob3','eq','53');
# @line = ('access-list','vlan_in','extended','permit','object-group','ob1','host','30.0.0.30','object-group','ob2','eq','23');
# @line = ('access-list','vlan_in','extended','permit','tcp','host','40.0.0.10','object-group','ob1','eq 80');

$OG{'ob1'} = ['tcp','udp'];
$OG{'ob2'} = ['10.0.0.10', '10.0.0.20'];
$OG{'ob3'} = ['20.0.0.15', '20.0.0.25'];
$OG{'ob4'} = ['eq 22', 'eq 443'];

foreach $ins4 (@{$OG{ob4}}) {
  foreach $ins1 (@{$OG{ob1}}) {
    foreach $ins2 (@{$OG{ob2}}) {
      foreach $ins3(@{$OG{ob3}}) {
        $buffer = "";
        foreach $element (@line) {
          if($element =~ /object-group/) { next; }
          $buffer = $buffer . ' ' . $element;
        }
        $buffer =~ s/ob1/$ins1/;
        $buffer =~ s/ob2/$ins2/;
        $buffer =~ s/ob3/$ins3/;
        $buffer =~ s/ob4/$ins4/;
        print "$buffer\n";
      }
    }
  }
}

(Current Output)
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.15 eq 22
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.25 eq 22
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.15 eq 22
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.25 eq 22
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.15 eq 22
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.25 eq 22
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.15 eq 22
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.25 eq 22
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.15 eq 443
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.25 eq 443
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.15 eq 443
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.25 eq 443
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.15 eq 443
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.25 eq 443
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.15 eq 443
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.25 eq 443

我可以蛮力地这样做，但我希望能有所启发，而不是过多地重复代码。我可以为每种情况编写单独的循环，但是希望以更优雅的方式获得一些启发。

(if 3 occurrences of ob#)
# @line = ('access-list','vlan_in','extended','permit','object-group','ob1','object-group','ob2','object-group','ob3','eq','53');

foreach $ins1 (@{$OG{ob1}}) {
  foreach $ins2 (@{$OG{ob2}}) {
    foreach $ins3(@{$OG{ob3}}) {
      $buffer = "";
      foreach $element (@line) {
        if($element =~ /object-group/) { next; }
        $buffer = $buffer . ' ' . $element;
      }
      $buffer =~ s/ob1/$ins1/;
      $buffer =~ s/ob2/$ins2/;
      $buffer =~ s/ob3/$ins3/;
      print "$buffer\n";
    }
  }
}

(if 2 occurrences of ob#)
# @line = ('access-list','vlan_in','extended','permit','object-group','ob1','host','30.0.0.30','object-group','ob2','eq','23');

foreach $ins1 (@{$OG{ob1}}) {
  foreach $ins2 (@{$OG{ob2}}) {
    $buffer = "";
    foreach $element (@line) {
      if($element =~ /object-group/) { next; }
      $buffer = $buffer . ' ' . $element;
    }
    $buffer =~ s/ob1/$ins1/;
    $buffer =~ s/ob2/$ins2/;
    print "$buffer\n";
  }
}

(if 1 occurrence of ob#)
# @line = ('access-list','vlan_in','extended','permit','tcp','host','40.0.0.10','object-group','ob1','eq 80');

foreach $ins1 (@{$OG{ob1}}) {
  $buffer = "";
  foreach $element (@line) {
    if($element =~ /object-group/) { next; }
    $buffer = $buffer . ' ' . $element;
  }
  $buffer =~ s/ob1/$ins1/;
  print "$buffer\n";
}

Answer 1

您要查找的是%OG中值的叉积。 CPAN进行营救。以下代码使用Set::Product创建叉积。

use Set::Product qw[ product ];

my @line = (
    'access-list',  'vlan_in', 'extended',     'permit',
    'object-group', 'ob1',     'object-group', 'ob2',
    'object-group', 'ob3',     'object-group', 'ob4'
);

# same order as things fed to product
my @placeholders = qw[ ob1 ob2 ob3 ob4 ];

product {
    # for efficiency, this should be done outside of this loop
    my $buffer = join( ' ', grep { !/object-group/ } @line );

    # product places the values in @_; shift them off in order
    $buffer =~ s/$_/shift()/ge for @placeholders;

    print $buffer . "\n";
}
  [ 'tcp',         'udp' ],
  [ '10.0.0.10', '10.0.0.20' ],
  [ '20.0.0.15', '20.0.0.25' ],
  [ 'eq 22',     'eq 443' ]
;

结果

access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.15 eq 22
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.15 eq 443
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.25 eq 22
access-list vlan_in extended permit tcp 10.0.0.10 20.0.0.25 eq 443
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.15 eq 22
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.15 eq 443
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.25 eq 22
access-list vlan_in extended permit tcp 10.0.0.20 20.0.0.25 eq 443
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.15 eq 22
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.15 eq 443
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.25 eq 22
access-list vlan_in extended permit udp 10.0.0.10 20.0.0.25 eq 443
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.15 eq 22
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.15 eq 443
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.25 eq 22
access-list vlan_in extended permit udp 10.0.0.20 20.0.0.25 eq 443

Perl中的递归变量扩展

1 个答案: