nxos_acl_interface fixes (#23917)

* Update nxos_acl_interface

* Add basic unit tests to nxos_acl_interface

lib/ansible/modules/network/nxos/nxos_acl_interface.py

@@ -16,9 +16,11 @@
 # along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-ANSIBLE_METADATA = {'metadata_version': '1.0',
+ANSIBLE_METADATA = {
-                    'status': ['preview'],
+    'metadata_version': '1.0',
-                    'supported_by': 'community'}
+    'status': ['preview'],
+    'supported_by': 'community'
+}
 
 
 DOCUMENTATION = '''
@@ -28,30 +30,30 @@ extends_documentation_fragment: nxos
 version_added: "2.2"
 short_description: Manages applying ACLs to interfaces.
 description:
-    - Manages applying ACLs to interfaces.
+  - Manages applying ACLs to interfaces.
 author:
-    - Jason Edelman (@jedelman8)
+  - Jason Edelman (@jedelman8)
-    - Gabriele Gerbino (@GGabriele)
+  - Gabriele Gerbino (@GGabriele)
 options:
-    name:
+  name:
-        description:
+    description:
-            - Case sensitive name of the access list (ACL).
+      - Case sensitive name of the access list (ACL).
-        required: true
+    required: true
-    interface:
+  interface:
-        description:
+    description:
-            - Full name of interface, e.g. I(Ethernet1/1).
+      - Full name of interface, e.g. I(Ethernet1/1).
-        required: true
+    required: true
-    direction:
+  direction:
-        description:
+    description:
-            - Direction ACL to be applied in on the interface.
+      - Direction ACL to be applied in on the interface.
-        required: true
+    required: true
-        choices: ['ingress', 'egress']
+    choices: ['ingress', 'egress']
-    state:
+  state:
-        description:
+    description:
-            - Specify desired state of the resource.
+      - Specify desired state of the resource.
-        required: false
+    required: false
-        default: present
+    default: present
-        choices: ['present','absent']
+    choices: ['present','absent']
 '''
 
 EXAMPLES = '''
@@ -61,45 +63,20 @@ EXAMPLES = '''
     interface: ethernet1/41
     direction: egress
     state: present
-    username: "{{ un }}"
-    password: "{{ pwd }}"
-    host: "{{ inventory_hostname }}"
 '''
 
 RETURN = '''
-proposed:
-    description: k/v pairs of parameters passed into module
-    returned: always
-    type: dict
-    sample: {"direction": "egress", "interface": "ethernet1/41",
-            "name": "ANSIBLE"}
-existing:
-    description: k/v pairs of existing ACL applied to the interface
-    returned: always
-    type: dict
-    sample: {}
-end_state:
-    description: k/v pairs of interface ACL after module execution
-    returned: always
-    type: dict
-    sample: {"direction": "egress", "interface": "ethernet1/41",
-            "name": "ANSIBLE"}
 acl_applied_to:
     description: list of interfaces the ACL is applied to
     returned: always
     type: list
     sample: [{"acl_type": "Router ACL", "direction": "egress",
             "interface": "Ethernet1/41", "name": "ANSIBLE"}]
-updates:
+commands:
     description: commands sent to the device
     returned: always
     type: list
     sample: ["interface ethernet1/41", "ip access-group ANSIBLE out"]
-changed:
-    description: check to see if a change was made on the device
-    returned: always
-    type: boolean
-    sample: true
 '''
 import re
 
@@ -108,34 +85,21 @@ from ansible.module_utils.nxos import nxos_argument_spec, check_args
 from ansible.module_utils.basic import AnsibleModule
 
 
-def execute_show_command(command, module, command_type='cli_show'):
+NAME = r'.*IP?\s+access list\s+(?P<name>\S+).*'
-    if module.params['transport'] == 'cli':
+INTERFACE = r'.*\s+(?P<interface>\w+(\d+)?\/?(\d+)?)\s-\s(?P<direction>\w+)\s+\W(?P<acl_type>\w+\s\w+)\W.*'
-        if 'summary' not in command:
-            command += ' | json'
-        cmds = [command]
-        body = run_commands(module, cmds)
-    elif module.params['transport'] == 'nxapi':
-        cmds = [command]
-        body = run_commands(module, cmds)
-
-    return body
 
 
 def get_acl_interface(module, acl):
-    command = 'show ip access-list summary'
+    command = ['show ip access-list summary']
-    name_regex = '.*IPV4\s+ACL\s+(?P<name>\S+).*'
-    interface_regex = ('.*\s+(?P<interface>\w+(\d+)?\/?(\d+)?)\s-\s'
-                      '(?P<direction>\w+)\s+\W(?P<acl_type>\w+\s\w+)\W.*')
     acl_list = []
 
-    body = execute_show_command(command, module, command_type='cli_show_ascii')
+    body = run_commands(module, command)
     body_split = body[0].split('Active on interfaces:')
 
     for each_acl in body_split:
-        intf_list = []
         temp = {}
         try:
-            match_name = re.match(name_regex, each_acl, re.DOTALL)
+            match_name = re.match(NAME, each_acl, re.DOTALL)
             name_dict = match_name.groupdict()
             name = name_dict['name']
         except AttributeError:
@@ -143,9 +107,8 @@ def get_acl_interface(module, acl):
 
         temp['interfaces'] = []
         for line in each_acl.split('\n'):
-            intf_temp = {}
             try:
-                match_interface = re.match(interface_regex, line, re.DOTALL)
+                match_interface = re.match(INTERFACE, line, re.DOTALL)
                 interface_dict = match_interface.groupdict()
                 interface = interface_dict['interface']
                 direction = interface_dict['direction']
@@ -155,6 +118,7 @@ def get_acl_interface(module, acl):
                 direction = ''
                 acl_type = ''
 
+            intf_temp = {}
             if interface:
                 intf_temp['interface'] = interface
             if acl_type:
@@ -185,21 +149,17 @@ def other_existing_acl(get_existing, interface, direction):
     # now we'll just get the interface in question
     # needs to be a list since same acl could be applied in both dirs
     acls_interface = []
+    this = {}
+
     if get_existing:
         for each in get_existing:
             if each.get('interface').lower() == interface:
                 acls_interface.append(each)
-    else:
-        acls_interface = []
 
-    if acls_interface:
+        if acls_interface:
-        this = {}
+            for each in acls_interface:
-        for each in acls_interface:
+                if each.get('direction') == direction:
-            if each.get('direction') == direction:
+                    this = each
-                this = each
-    else:
-        acls_interface = []
-        this = {}
 
     return acls_interface, this
 
@@ -247,21 +207,18 @@ def main():
         name=dict(required=False, type='str'),
         interface=dict(required=True),
         direction=dict(required=True, choices=['egress', 'ingress']),
-        state=dict(choices=['absent', 'present'],
+        state=dict(choices=['absent', 'present'], default='present'),
-                       default='present'),
-        include_defaults=dict(default=True),
-        config=dict(),
-        save=dict(type='bool', default=False)
     )
 
     argument_spec.update(nxos_argument_spec)
 
     module = AnsibleModule(argument_spec=argument_spec,
-                                supports_check_mode=True)
+                           supports_check_mode=True)
 
     warnings = list()
     check_args(module, warnings)
 
+    results = dict(changed=False, warnings=warnings)
 
     state = module.params['state']
     name = module.params['name']
@@ -275,12 +232,9 @@ def main():
 
     # interface_acls = includes entries of this ACL on the interface (list)
     # this_dir_acl_intf = dict - not null if it already exists
-    interfaces_acls, existing = other_existing_acl(
+    interfaces_acls, existing = other_existing_acl(get_existing, interface, direction)
-        get_existing, interface, direction)
 
-    end_state = existing
     end_state_acls = get_existing
-    changed = False
 
     cmds = []
     commands = []
@@ -303,23 +257,15 @@ def main():
                 module.exit_json(changed=True, commands=cmds)
             else:
                 load_config(module, cmds)
-                changed = True
+                results['changed'] = True
                 end_state_acls = get_acl_interface(module, name)
-                interfaces_acls, this_dir_acl_intf = other_existing_acl(
+                interfaces_acls, this_dir_acl_intf = other_existing_acl(end_state_acls, interface, direction)
-                    end_state_acls, interface, direction)
-                end_state = this_dir_acl_intf
                 if 'configure' in cmds:
                     cmds.pop(0)
     else:
         cmds = []
 
-    results = {}
+    results['commands'] = cmds
-    results['proposed'] = proposed
-    results['existing'] = existing
-    results['updates'] = cmds
-    results['changed'] = changed
-    results['warnings'] = warnings
-    results['end_state'] = end_state
     results['acl_applied_to'] = end_state_acls
 
     module.exit_json(**results)
@@ -327,4 +273,3 @@ def main():
 
 if __name__ == '__main__':
     main()
-

test/sanity/pep8/legacy-files.txt

@@ -541,7 +541,6 @@ lib/ansible/modules/network/nxos/_nxos_mtu.py
 lib/ansible/modules/network/nxos/_nxos_template.py
 lib/ansible/modules/network/nxos/nxos_aaa_server.py
 lib/ansible/modules/network/nxos/nxos_aaa_server_host.py
-lib/ansible/modules/network/nxos/nxos_acl_interface.py
 lib/ansible/modules/network/nxos/nxos_bgp.py
 lib/ansible/modules/network/nxos/nxos_bgp_af.py
 lib/ansible/modules/network/nxos/nxos_bgp_neighbor.py

test/units/modules/network/nxos/fixtures/nxos_acl_interface/show_ip_access-list_summary.txt

@@ -0,0 +1,34 @@
+IP access list __urpf_v4_acl__
+        Total ACEs Configured: 1
+        Configured on interfaces:
+        Active on interfaces:
+IP access list copp-system-p-acl-bgp
+        Total ACEs Configured: 2
+        Configured on interfaces:
+                ethernet1/41 - egress (Router ACL)
+        Active on interfaces:
+                ethernet1/41 - egress (Router ACL)
+IP access list copp-system-p-acl-cts
+        Total ACEs Configured: 2
+        Configured on interfaces:
+        Active on interfaces:
+IP access list copp-system-p-acl-dhcp
+        Total ACEs Configured: 2
+        Configured on interfaces:
+        Active on interfaces:
+IP access list copp-system-p-acl-dhcp-relay-response
+        Total ACEs Configured: 2
+        Configured on interfaces:
+        Active on interfaces:
+IP access list copp-system-p-acl-eigrp
+        Total ACEs Configured: 1
+        Configured on interfaces:
+        Active on interfaces:
+IP access list copp-system-p-acl-ftp
+        Total ACEs Configured: 4
+        Configured on interfaces:
+        Active on interfaces:
+IP access list copp-system-p-acl-glbp
+        Total ACEs Configured: 1
+        Configured on interfaces:
+        Active on interfaces:

test/units/modules/network/nxos/test_nxos_acl_interface.py

@@ -0,0 +1,72 @@
+# (c) 2016 Red Hat Inc.
+#
+# This file is part of Ansible
+#
+# Ansible is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Ansible is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Ansible.  If not, see <http://www.gnu.org/licenses/>.
+
+# Make coding more python3-ish
+from __future__ import (absolute_import, division, print_function)
+__metacl_interfaceass__ = type
+
+import json
+
+from ansible.compat.tests.mock import patch
+from ansible.modules.network.nxos import nxos_acl_interface
+from .nxos_module import TestNxosModule, load_fixture, set_module_args
+
+
+class TestNxosAclInterfaceModule(TestNxosModule):
+
+    module = nxos_acl_interface
+
+    def setUp(self):
+        self.mock_run_commands = patch('ansible.modules.network.nxos.nxos_acl_interface.run_commands')
+        self.run_commands = self.mock_run_commands.start()
+
+        self.mock_load_config = patch('ansible.modules.network.nxos.nxos_acl_interface.load_config')
+        self.load_config = self.mock_load_config.start()
+
+    def tearDown(self):
+        self.mock_run_commands.stop()
+        self.mock_load_config.stop()
+
+    def load_fixtures(self, commands=None):
+        def load_from_file(*args, **kwargs):
+            module, commands = args
+            output = list()
+
+            for item in commands:
+                try:
+                    obj = json.loads(item)
+                    command = obj['command']
+                except ValueError:
+                    command = item
+                filename = str(command).split(' | ')[0].replace(' ', '_')
+                filename = 'nxos_acl_interface/%s.txt' % filename
+                output.append(load_fixture(filename))
+            return output
+
+        self.run_commands.side_effect = load_from_file
+        self.load_config.return_value = None
+
+    def test_nxos_acl_interface(self):
+        set_module_args(dict(name='ANSIBLE', interface='ethernet1/41', direction='egress'))
+        result = self.execute_module(changed=True)
+        self.assertEqual(result['commands'], ['interface ethernet1/41', 'ip access-group ANSIBLE out'])
+
+    def test_nxos_acl_interface_remove(self):
+        set_module_args(dict(name='copp-system-p-acl-bgp', interface='ethernet1/41',
+                             direction='egress', state='absent'))
+        result = self.execute_module(changed=True)
+        self.assertEqual(result['commands'], ['interface ethernet1/41', 'no ip access-group copp-system-p-acl-bgp out'])