Skip to content

Commit

Permalink
Merge pull request #3964 from nicolas-fort/T6643
Browse files Browse the repository at this point in the history 
T6643: firewall: fix ip address range parsing on firewall rules.
  • Loading branch information
@c-po
c-po authored Aug 10, 2024
2 parents be27b89 + ff58f3e commit 64e324d
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 7 deletions.
15 changes: 12 additions & 3 deletions python/vyos/firewall.py
100644 → 100755
View file
Original file line number Diff line number Diff line change
Expand Up @@ -167,10 +167,19 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name):
if address_mask:
operator = '!=' if exclude else '=='
operator = f'& {address_mask} {operator} '
if is_ipv4(suffix):
output.append(f'ip {prefix}addr {operator}{suffix}')

if suffix.find('-') != -1:
# Range
start, end = suffix.split('-')
if is_ipv4(start):
output.append(f'ip {prefix}addr {operator}{suffix}')
else:
output.append(f'ip6 {prefix}addr {operator}{suffix}')
else:
output.append(f'ip6 {prefix}addr {operator}{suffix}')
if is_ipv4(suffix):
output.append(f'ip {prefix}addr {operator}{suffix}')
else:
output.append(f'ip6 {prefix}addr {operator}{suffix}')

if 'fqdn' in side_conf:
fqdn = side_conf['fqdn']
Expand Down
8 changes: 4 additions & 4 deletions smoketest/scripts/cli/test_firewall.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -311,7 +311,7 @@ def test_ipv4_advanced(self):
self.cli_set(['firewall', 'ipv4', 'name', name, 'rule', '7', 'dscp-exclude', '21-25'])

self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'default-action', 'drop'])
self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '1', 'source', 'address', '198.51.100.1'])
self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '1', 'source', 'address', '198.51.100.1-198.51.100.50'])
self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '1', 'mark', '1010'])
self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '1', 'action', 'jump'])
self.cli_set(['firewall', 'ipv4', 'forward', 'filter', 'rule', '1', 'jump-target', name])
Expand All @@ -331,7 +331,7 @@ def test_ipv4_advanced(self):
nftables_search = [
['chain VYOS_FORWARD_filter'],
['type filter hook forward priority filter; policy accept;'],
['ip saddr 198.51.100.1', 'meta mark 0x000003f2', f'jump NAME_{name}'],
['ip saddr 198.51.100.1-198.51.100.50', 'meta mark 0x000003f2', f'jump NAME_{name}'],
['FWD-filter default-action drop', 'drop'],
['chain VYOS_INPUT_filter'],
['type filter hook input priority filter; policy accept;'],
Expand Down Expand Up @@ -455,7 +455,7 @@ def test_ipv6_basic_rules(self):
self.cli_set(['firewall', 'ipv6', 'name', name, 'default-log'])

self.cli_set(['firewall', 'ipv6', 'name', name, 'rule', '1', 'action', 'accept'])
self.cli_set(['firewall', 'ipv6', 'name', name, 'rule', '1', 'source', 'address', '2002::1'])
self.cli_set(['firewall', 'ipv6', 'name', name, 'rule', '1', 'source', 'address', '2002::1-2002::10'])
self.cli_set(['firewall', 'ipv6', 'name', name, 'rule', '1', 'destination', 'address', '2002::1:1'])
self.cli_set(['firewall', 'ipv6', 'name', name, 'rule', '1', 'log'])
self.cli_set(['firewall', 'ipv6', 'name', name, 'rule', '1', 'log-options', 'level', 'crit'])
Expand Down Expand Up @@ -510,7 +510,7 @@ def test_ipv6_basic_rules(self):
['tcp dport 23', 'drop'],
['PRE-raw default-action accept', 'accept'],
[f'chain NAME6_{name}'],
['saddr 2002::1', 'daddr 2002::1:1', 'log prefix "[ipv6-NAM-v6-smoketest-1-A]" log level crit', 'accept'],
['saddr 2002::1-2002::10', 'daddr 2002::1:1', 'log prefix "[ipv6-NAM-v6-smoketest-1-A]" log level crit', 'accept'],
[f'"{name} default-action drop"', f'log prefix "[ipv6-{name}-default-D]"', 'drop'],
['jump VYOS_STATE_POLICY6'],
['chain VYOS_STATE_POLICY6'],
Expand Down

0 comments on commit 64e324d

Please sign in to comment.