Merge pull request #5103 from alexandr-san4ez/T8281-current

firewall: T8281: Normalize network prefixes in rule configuration

2 files changed, 114 insertions, 0 deletions

diff --git a/smoketest/configs/assert/firewall-rules-address b/smoketest/configs/assert/firewall-rules-address
new file mode 100644
index 000000000..59627040c
--- /dev/null
+++ b/smoketest/configs/assert/firewall-rules-address
@@ -0,0 +1,26 @@
+set firewall ipv4 name TEST1 default-action 'drop'
+set firewall ipv4 name TEST1 rule 10 action 'return'
+set firewall ipv4 name TEST1 rule 10 destination address '10.10.11.2'
+set firewall ipv4 name TEST1 rule 10 source address '10.10.10.0/30'
+set firewall ipv4 name TEST1 rule 20 action 'return'
+set firewall ipv4 name TEST1 rule 20 destination address '10.10.13.1-10.10.13.16'
+set firewall ipv4 name TEST1 rule 20 source address '10.10.12.0/30'
+set firewall ipv4 name TEST1 rule 30 action 'return'
+set firewall ipv4 name TEST1 rule 30 destination address '!10.10.15.0/30'
+set firewall ipv4 name TEST1 rule 30 source address '10.10.14.1'
+set firewall ipv6 name TEST2 default-action 'drop'
+set firewall ipv6 name TEST2 rule 10 action 'return'
+set firewall ipv6 name TEST2 rule 10 destination address '2001:db8:10:11::2'
+set firewall ipv6 name TEST2 rule 10 source address '2001:db8:10:10::/126'
+set firewall ipv6 name TEST2 rule 20 action 'return'
+set firewall ipv6 name TEST2 rule 20 destination address '2001:db8:10:13::1-2001:db8:10:13::16'
+set firewall ipv6 name TEST2 rule 20 source address '2001:db8:10:12::/126'
+set firewall ipv6 name TEST2 rule 30 action 'return'
+set firewall ipv6 name TEST2 rule 30 destination address '!2001:db8:10:15::/126'
+set firewall ipv6 name TEST2 rule 30 source address '2001:db8:10:14::1'
+set interfaces ethernet eth0
+set interfaces loopback lo
+set system console device ttyS0 speed '115200'
+set system host-name 'vyos'
+set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
+set system login user vyos authentication plaintext-password ''
\ No newline at end of file
diff --git a/smoketest/configs/firewall-rules-address b/smoketest/configs/firewall-rules-address
new file mode 100644
index 000000000..44dd81342
--- /dev/null
+++ b/smoketest/configs/firewall-rules-address
@@ -0,0 +1,88 @@
+firewall {
+    name TEST1 {
+        default-action drop
+        rule 10 {
+            action accept
+            destination {
+                address 10.10.11.2
+            }
+            source {
+                address 10.10.10.1/30
+            }
+        }
+        rule 20 {
+            action accept
+            destination {
+                address 10.10.13.1-10.10.13.16
+            }
+            source {
+                address 10.10.12.0/30
+            }
+        }
+        rule 30 {
+            action accept
+            destination {
+                address !10.10.15.1/30
+            }
+            source {
+                address 10.10.14.1
+            }
+        }
+    }
+    ipv6-name TEST2 {
+        default-action drop
+        rule 10 {
+            action accept
+            destination {
+                address 2001:db8:10:11::2
+            }
+            source {
+                address 2001:db8:10:10::1/126
+            }
+        }
+        rule 20 {
+            action accept
+            destination {
+                address 2001:db8:10:13::1-2001:db8:10:13::16
+            }
+            source {
+                address 2001:db8:10:12::/126
+            }
+        }
+        rule 30 {
+            action accept
+            destination {
+                address !2001:db8:10:15::1/126
+            }
+            source {
+                address 2001:db8:10:14::1
+            }
+        }
+    }
+}
+interfaces {
+    ethernet eth0 {
+    }
+    loopback lo {
+    }
+}
+system {
+    console {
+        device ttyS0 {
+            speed 115200
+        }
+    }
+    host-name "vyos"
+    login {
+        user vyos {
+            authentication {
+                encrypted-password "$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0"
+                plaintext-password ""
+            }
+        }
+    }
+}
+
+// Warning: Do not remove the following line.
+// vyos-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@3:firewall@5:https@2:interfaces@23:ipoe-server@1:ipsec@5:isis@1:l2tp@3:lldp@1:mdns@1:nat@5:ntp@1:pppoe-server@5:pptp@2:qos@1:quagga@8:rpki@1:salt@1:snmp@2:ssh@2:sstp@3:system@21:vrrp@2:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2:zone-policy@1"
+// Release version: 1.3.8
\ No newline at end of file