firewall policy about clc-go-cli HOT 21 CLOSED

It says that the --source argument requires an array. An array can be specified as JSON - '["10.101.50.0/24"]'. If you had more than one element, say 10.101.50.0/24 and 10.101.70.0/24, you could also specify them as --source 10.101.50.0/24 10.101.70.0/24.

This error seems to be not very user-friendly, so we should think about improving it a bit.

from clc-go-cli.

i'm still not able to make that work

clc firewall-policy create --data-center CA3 --destination-account SUB9 --source '["10.101.50.0/24"]' --destination '["10.101.111.0/24"]' --ports '["tcp/1433"]'

from clc-go-cli.

Does it show any errors?

from clc-go-cli.

`'[10.101.50.0/24]'` must be array specified either in JSON or in key=value,.. format.

from clc-go-cli.

Ah, I see - you work on Windows. I've just tried to reproduce - it does not work there indeed. Some characters need to be escaped differently in PowerShell. I'll write back here and fix the README as soon as I figure it out.

from clc-go-cli.

Hi there, we have been playing with this, Chris on Windows, me on MacOS. I struggled to make it parse as well, but Gavin Lai nailed the issue. The array must be in a very specific format. Take these two examples, the first one fails, the second (with space) parsed:

[Fails]
clc firewall-policy create --data-center VA1 --source-account-alias "CTDM" --destination-account "CTDM" --source ["10.136.211.224/28"] --destination ["10.128.140.0/24"] --ports ["tcp/1433", "tcp/433"]

[Parsed as w/ --generate-cli-skeleton]
{"DataCenter":"VA1","Destination":"[10.128.140.0/24]","DestinationAccount":"CTDM","Ports":["[tcp/1433,","tcp/433]"],"Source":["[10.136.211.224/28","]"],"SourceAccountAlias":"CTDM"}

(noticed how ports are parsed differently)

[Parsing succeeds]
clc firewall-policy create --data-center VA1 --source-account-alias "CTDM" --destination-account "CTDM" --source ["10.136.211.224/28" ] --destination ["10.128.140.0/24" ] --ports ["tcp/1433", "tcp/433"]

Notice the space after "10.136.211.224/28".

I have some thoughts however about the inclusion of specific data formatting convention, keeping in mind the audience may be system administrators and not developers, I think a CLI should be extensible in a way that can be incorporated in .bat or bash scripts. In that case, the environment and the parameters should be simple enough to be passed from parent processes.

In the case of firewall rules, (and maybe other calls), as a sysadmin I'd think it would be cool to not have to worry about array formatting, and rather be able to input values in quotes (we all hate escaping characters) much like a firewall rule or route are added in both Windows or Linux in a simpler way:

clc firewall-policy create
--data-center VA1
--destination-account "XXXX"
--sources 10.136.200.224/28 10.136.200.124/32
--destinations 10.128.1.0/24 10.128.2.0/24
--ports 80 443

This may result simpler and more readable, as parenthesis, brackets, spaces and other characters (except slash) can be discarded upon initial argument parsing. It also enables the use of argv/argc to pass and validate input arguments from parent shell scripts.

Side comment: In the macOS implementation, --source-account-alias is required, don't know if this is default).

I know this may require lots of work, just thinking how to make it easier to customers, to minimize inquiries and documentation efforts.

from clc-go-cli.

Disregard --generate-cli-skeleton. Seems to parse into the correct form, however producing the error message.

from clc-go-cli.

Hi, @lmcornejo

Thank you for fiddling around with this!

Regarding your notes:

Take these two examples, the first one fails, the second (with space) parsed

["10.136.211.224/28"] - this fails because bash does not pass the quotes to the tool. Quotes are special characters in bash that are used for escaping other special characters. Thus, the tool receives the input as [10.136.211.224/28], what is not a valid JSON. There are some words about it in the README.

["10.136.211.224/28" ] - this does not fail because multiple space-separated elements are interpreted as an array. In this case, the item is parsed into an array with 2 elements: [10.136.211.224/28 and ]. You can find some information about it in the README.

A solution (for bash): enclose the whole JSON expression in quotes (but of another type):

'["10.136.211.224/28"]'

and rather be able to input values in a simpler way

I agree with you that typing JSON in terminal is not convenient, although it might be convenient in some cases in conjunction with other tools.

But there are other ways to go with clc. For example, the following should actually work:

--sources 10.136.200.224/28 10.136.200.124/32

If it does not, please, create a separate issue.

The only problem with this approach is that it is impossible for now to specify an array with only one element and that's when we get stuck to JSON. So, I am going to fix it (it won't require lots of work).

Side comment: In the macOS implementation, --source-account-alias is required, don't know if this is default).

Are you trying the latest release? Could you, please, double check?

If you are still not clear about anything, feel free to ask!

from clc-go-cli.

@chrislittle I've figured it out - '[\"10.101.50.0/24\"]' - that is how quotes have to be escaped in PowerShell.

And again, --source 10.101.50.0/24 10.101.75.0/24 is already a working option; --source 10.101.50.0/24 will work in the upcoming release.

from clc-go-cli.

awesome thanks.

from clc-go-cli.

Thanks for the explanation Lev,

Updated to latest (thank you), I was able to use the simpler (no escapes) form with more than one source/destination/port and parses right.

I'll just wait for the next release for single arguments, since it looks like you are already working on it.

Point aside, notice I used sources rather than source. In other command line utils, commonly used it's uncommon (I may be old) to use multiple ranges in one command. These other tools would usually just take one argument, if two rules are needed, then two commands must be executed.

Comment aside to hear your thoughts, I think "sources" and "destinations" hints better the idea that multiple arguments can be entered instead of having to execute one command for each of multiple sources.

from clc-go-cli.

@lmcornejo I agree, "sources" and "destinations" are better choices in this case. I'll fix it.

As for me ranges seem to be uncommon too. I am not sure about how likely a user will need to enter multiple values. I can change it if you find it worthy - it won't require a great deal of work.

from clc-go-cli.

Thanks Lev, I was hoping that was a good idea.

As far as the multiple values, it’s just how the platform was implemented. I do like how the rules are somewhat “bundled” with multiple sources and destinations, it makes it easier at least to me why I created certain rule. (Though I wished there was a place to describe the rule :-). No need to change really, as customers could run a single command with multiple entries or a series of commands with a single entry.

From: Lev
Reply-To: CenturyLinkCloud/clc-go-cli
Date: Thursday, October 1, 2015 at 3:49 PM
To: CenturyLinkCloud/clc-go-cli
Cc: Luis Cornejo
Subject: Re: [clc-go-cli] firewall policy (#31)

@lmcornejohttps://github.com/lmcornejo I agree, "sources" and "destinations" are better choices in this case. I'll fix it.

As for me ranges seem to be uncommon too. I am not sure about how likely a user will need to enter multiple values. I can change it if you find it worthy - it won't require a great deal of work.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/31#issuecomment-144843966.

from clc-go-cli.

@chrislittle , @lmcornejo please, try the latest release

from clc-go-cli.

just tried

clc firewall-policy create --data-center CA3 --destination-account SUB9 --sources "10.101.50.0/24" --destinations "10.101.111.0/24" --ports "tcp/1433"

even though I stated SUB9 (my sub account) it states

Error occured while sending request to API. Status code: 400. Server says: {"body.source":["Network CIDR 10.101.50.0/24 is not part of the networks for account CCVA"]}.

C:\clc>clc network list --data-center CA3 --account-alias SUB9
[
    {
        "Cidr": "10.101.43.0/24",
        "Description": "OPENVPN_10.101.43.0/24",
        "Gateway": "10.101.43.1",
        "Id": "354de087ea14422a9d3b41ccf74a0464",
        "Name": "OPENVPN_10.101.43.0/24",
        "Netmask": "255.255.255.0",
        "Type": "private",
        "Vlan": 543
    },
    {
        "Cidr": "10.101.50.0/24",
        "Description": "DMZ_10.101.50.0/24",
        "Gateway": "10.101.50.1",
        "Id": "953bffa1cd2449a687d9b40482044ab3",
        "Name": "DMZ_10.101.50.0/24",
        "Netmask": "255.255.255.0",
        "Type": "private",
        "Vlan": 550
    },
    {
        "Cidr": "10.101.111.0/24",
        "Description": "TRUST_10.101.111.0/24",
        "Gateway": "10.101.111.1",
        "Id": "31f3af4591da479f9d35c58e4c438a32",
        "Name": "TRUST_10.101.111.0/24",
        "Netmask": "255.255.255.0",
        "Type": "private",
        "Vlan": 611
    }
]

from clc-go-cli.

It complains about the source account. The source account can be customized via the --account-alias option

from clc-go-cli.

ah got it. forgot that. is this the expected output though?

C:\clc>clc firewall-policy create --data-center CA3 --destination-account SUB9 --sources "10.101.50.0/24" --destinations "10.101.111.0/24" --ports "tcp/1433" --
account-alias SUB9
{}

its just a {} so that isn't very friendly.

from clc-go-cli.

Thank you,

It works for single parameters now.

clc firewall-policy create --data-center VA1 --destination-account "CTDM" --sources 10.136.211.224/28 --destinations 10.128.140.0/24 --ports tcp/1433
{}

[cid:246193FE-95B5-47EB-91BE-968C20C19F61]

That was very quick and much simpler, thanks much.

Luis Cornejo | Sr. Cloud Solutions Architect
CenturyLink Cloud

From: Lev
Reply-To: CenturyLinkCloud/clc-go-cli
Date: Friday, October 2, 2015 at 2:01 PM
To: CenturyLinkCloud/clc-go-cli
Cc: Luis Cornejo
Subject: Re: [clc-go-cli] firewall policy (#31)

@chrislittlehttps://github.com/chrislittle , @lmcornejohttps://github.com/lmcornejo please, try the latest releasehttps://github.com/CenturyLinkCloud/clc-go-cli/releases/tag/2015-10-02

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/31#issuecomment-145126875.

from clc-go-cli.

its just a {} so that isn't very friendly

Yes, this is an artifact left after we have removed links from the output (this command's response only contained links). A fix will be available soon

from clc-go-cli.

@chrislittle I've updated the latest release to include a fix. Could you check it?

from clc-go-cli.

solved.

from clc-go-cli.