[rancid] xrrancid destroys ipv[46] ACLs

Discussion:

Erik Wenzel

2012-01-10 16:41:26 UTC

regardless of setting ACLSORT in rancid.conf xrrancid is sorting an ACL like:
---snip---
#sh ipv4 access-lists eriktest-v4
ipv4 access-list eriktest-v4
1 remark erik
10 remark tests
100 remark acls
1000 deny ipv4 any any
#sh ipv6 access-lists eriktest
ipv6 access-list eriktest
1 remark erik
10 remark tests
100 remark acls
1000 deny ipv6 any any
---snip---
to:
---snip---
[…]
deny ipv6 any any
ipv6 access-list eriktest
1 remark erik
10 remark tests
100 remark acls
[…]
!
deny ipv4 any any
ipv4 access-list eriktest-v4
1 remark erik
10 remark tests
100 remark acls
!
[…]
---snip---
… in rancid backup. This is completely useless. This can't be used in case of
recovery. I urge everyone who uses xrrancid and sequence numbers to verify their
ACLs in CVS. My workaround is to comment out line 1022-1037. Can someone who is
using IOS-XR in this setup confirm this behavior?

xrrancid version string: $Id: xrrancid.in 2264 2010-11-04 23:35:17Z heas $

--
Erik Wenzel
***@code.de

heasley

2012-01-10 17:36:44 UTC

Permalink

Post by Erik Wenzel
---snip---
#sh ipv4 access-lists eriktest-v4
ipv4 access-list eriktest-v4
1 remark erik
10 remark tests
100 remark acls
1000 deny ipv4 any any
#sh ipv6 access-lists eriktest
ipv6 access-list eriktest
1 remark erik
10 remark tests
100 remark acls
1000 deny ipv6 any any
---snip---
---snip---
[?]
deny ipv6 any any
ipv6 access-list eriktest
1 remark erik
10 remark tests
100 remark acls
[?]
!
deny ipv4 any any
ipv4 access-list eriktest-v4
1 remark erik
10 remark tests
100 remark acls
!
[?]
---snip---
? in rancid backup. This is completely useless. This can't be used in case of
recovery. I urge everyone who uses xrrancid and sequence numbers to verify their
ACLs in CVS. My workaround is to comment out line 1022-1037. Can someone who is
using IOS-XR in this setup confirm this behavior?

i'm not sure if i understand what the behavior is that you are trying to
describe. could you explain in more detail?

Post by Erik Wenzel
xrrancid version string: $Id: xrrancid.in 2264 2010-11-04 23:35:17Z heas $
--
Erik Wenzel
_______________________________________________
Rancid-discuss mailing list
http://www.shrubbery.net/mailman/listinfo.cgi/rancid-discuss

Erik Wenzel

2012-01-10 18:52:14 UTC

Permalink

Post by heasley

i'm not sure if i understand what the behavior is that you are trying to
describe. could you explain in more detail?

I want a working configuration backup. As you can see in the second snippet above the ACL is crippled. I extracted it from the checked out file from CVS. Why does xrrancid mess around with ACLs? I set ACLSORT to NO and still some code(line 1022-1037 in xrrancid) removes sequence numbers lines containing allow or deny from configuration. Is there a use case I do not see?

Post by heasley

heasley

2012-01-10 19:40:25 UTC

Permalink

Post by Erik Wenzel

Post by heasley

i'm not sure if i understand what the behavior is that you are trying to
describe. could you explain in more detail?

removing the sequence numbers is intentional - they're useless and cause diffs
that obscure what actually changed. removing sequence numbers does not render
the config for restoration.

ACLSORT does not affect the removal of the sequence numbers, which you already
know.

but, i now understand the behavior and i'll fix it.

Post by Erik Wenzel

Post by heasley

Erik Wenzel

2012-01-11 10:11:02 UTC

Permalink

Post by heasley

Post by Erik Wenzel

Post by heasley

i'm not sure if i understand what the behavior is that you are trying to
describe. could you explain in more detail?

removing the sequence numbers is intentional - they're useless and cause diffs
that obscure what actually changed. removing sequence numbers does not render
the config for restoration.

Intentional? You do not expect an unchanged backup of your configuration from a rancid user point of view? I do. In my case I need exactly the same sequence number in the backup, because there is a meaning in each.

Post by heasley
ACLSORT does not affect the removal of the sequence numbers, which you already
know.
but, i now understand the behavior and i'll fix it.

If that fix means that the removal of sequence numbers depends on a ACLSORT=YES ...
I think it is not a obvious solution, but it is one. Which is fine with me.

--
Erik Wenzel
***@code.de

Roman Sokolov

2012-08-13 14:46:13 UTC

Permalink

Hello,

It was really awful to see that the problem still exists...
So here is adopted patch from Josh for rancid 2.3.8 with rancid-2.3.8.p2 applied. It also contain quick fix for ending ip addresses being eated by sorting routine for thous who like sorting.

cat /usr/ports/net-mgmt/rancid/files/xrrrancid.acl.sort
--- bin/xrrancid.in Mon Aug 13 15:41:30 2012
+++ bin/xrrancid.in Mon Aug 13 18:11:03 2012
@@ -67,6 +67,7 @@
my($config_register); # configuration register value
my($filter_commstr); # SNMP community string filtering
my($filter_pwds); # password filtering mode
+my($aclstripseq); # Strip ACL sequence numbers

# This routine is used to print out the router configuration
sub ProcessHistory {
@@ -1094,12 +1095,22 @@
while (<INPUT>) {
tr/\015//d;
last if (/^$prompt/ || /^\S/);
- ($seq, $cmd, $misc, $ip) = ($_ =~ /^\s+(\d+) (\w+) (.*\s)(\w+)/);
+ ($seq, $cmd, $misc, $ip, $other) = ($_ =~ /^\s+(\d+) (\w+) (.*\s)(\w+)(.*)$/);
if ($cmd =~ /(permit|deny)/) {
- ProcessHistory("ACL $nlri $key $cmd","$aclsort","$ip",
- " $cmd $misc$ip\n");
+ if ($aclstripseq == 0) {
+ ProcessHistory("ACL $seq $nlri $key $cmd","$aclsort","$ip","$_");
+ }
+ if ($aclstripseq == 1) {
+ ProcessHistory("ACL $nlri $key $cmd","$aclsort","$ip",
+ " $cmd $misc$ip$other\n");
+ }
} else {
- ProcessHistory("ACL $nlri $key","",""," $cmd $misc$ip\n");
+ if ($aclstripseq == 0) {
+ ProcessHistory("ACL $seq $nlri $key","","","$_");
+ }
+ if ($aclstripseq == 1) {
+ ProcessHistory("ACL $nlri $key","",""," $cmd $misc$ip$other\n");
+ }
}
}
}
@@ -1319,6 +1330,16 @@

# determine ACL sorting mode
if ($ENV{"ACLSORT"} =~ /no/i) {
+ $aclsort = "";
+}
+# determine if we want to strip ACL sequence numbers
+if ($ENV{"ACLSTRIPSEQ"} =~ /yes/i) {
+ $aclstripseq = 1;
+}
+else {
+# If you are not stripping ACL sequence numbers
+# you cannot sort ACLs
+ $aclstripseq = 0;
$aclsort = "";
}
# determine community string filtering mode

--
wbr,
Roman Sokolov
mailto:***@cheater.ru