diff options
| author | Ruben van Dijk <15885455+RubenNL@users.noreply.github.com> | 2025-10-26 11:29:10 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-10-26 06:29:10 -0400 |
| commit | fa3414e786d4df0c1f074207094ca776e26250b5 (patch) | |
| tree | b6175011a5d23e82ff8da33f55f7973a333dee97 | |
| parent | eb2bb1c77fc5c1bfd82049afb67400d706724660 (diff) | |
| download | vyos.vyos-fa3414e786d4df0c1f074207094ca776e26250b5.tar.gz vyos.vyos-fa3414e786d4df0c1f074207094ca776e26250b5.zip | |
[T7856] Fix confusion between firewall zone name and group name. (#436)
Co-authored-by: Gaige B Paulsen <gaige@cluetrust.com>
4 files changed, 35 insertions, 2 deletions
diff --git a/changelogs/fragments/t7856_firewall_group_zone.yml b/changelogs/fragments/t7856_firewall_group_zone.yml new file mode 100644 index 00000000..bc405976 --- /dev/null +++ b/changelogs/fragments/t7856_firewall_group_zone.yml @@ -0,0 +1,3 @@ +--- +bugfixes: + - facts/firewall_global.py - Fix confusion between firewall zone names and group names. diff --git a/plugins/module_utils/network/vyos/facts/firewall_global/firewall_global.py b/plugins/module_utils/network/vyos/facts/firewall_global/firewall_global.py index a46f8563..3a48889e 100644 --- a/plugins/module_utils/network/vyos/facts/firewall_global/firewall_global.py +++ b/plugins/module_utils/network/vyos/facts/firewall_global/firewall_global.py @@ -179,7 +179,7 @@ class Firewall_globalFacts(object): if policies: rules_lst = [] for sp in set(policies): - sp_regex = r" %s .+$" % sp + sp_regex = r"^set firewall (?:global-options )?state-policy %s .+$" % sp cfg = "\n".join(findall(sp_regex, conf, M)) obj = self.parse_policies(cfg, sp) obj["connection_type"] = sp @@ -233,7 +233,7 @@ class Firewall_globalFacts(object): if groups: rules_lst = [] for gr in set(groups): - gr_regex = r" %s .+$" % gr + gr_regex = r"^set firewall group " + type + " %s .+$" % gr cfg = "\n".join(findall(gr_regex, conf, M)) if "ipv6" in type: # fmt: off diff --git a/tests/unit/modules/network/vyos/fixtures/vyos_firewall_global_config_v14.cfg b/tests/unit/modules/network/vyos/fixtures/vyos_firewall_global_config_v14.cfg index ad60b45c..9e854fa6 100644 --- a/tests/unit/modules/network/vyos/fixtures/vyos_firewall_global_config_v14.cfg +++ b/tests/unit/modules/network/vyos/fixtures/vyos_firewall_global_config_v14.cfg @@ -18,3 +18,6 @@ set firewall global-options state-policy related action 'accept' set firewall global-options state-policy related log-level 'alert' set firewall global-options ipv6-src-route 'enable' set firewall global-options send-redirects 'enable' +set firewall zone ZONE-TEST interface 'eth0.1234' +set firewall zone ZONE-TEST description 'zone-test test description' +set firewall group address-group ZONE-TEST address '1.2.3.4'
\ No newline at end of file diff --git a/tests/unit/modules/network/vyos/test_vyos_firewall_global14.py b/tests/unit/modules/network/vyos/test_vyos_firewall_global14.py index 0b85e62d..f1fd708b 100644 --- a/tests/unit/modules/network/vyos/test_vyos_firewall_global14.py +++ b/tests/unit/modules/network/vyos/test_vyos_firewall_global14.py @@ -286,6 +286,14 @@ class TestVyosFirewallRulesModule14(TestVyosModule): dict(address="fdec:2503:89d6:59b3::2"), ], ), + dict( + afi="ipv4", + name="ZONE-TEST", + members=[ + dict(address="1.2.3.4"), + ], + description="This is a new description for a address group name that is also in a zone", + ), ], network_group=[ dict( @@ -324,6 +332,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "set firewall global-options state-policy invalid action 'reject'", "set firewall group address-group RND-HOSTS address 192.0.2.7", "set firewall group address-group RND-HOSTS address 192.0.2.9", + "set firewall group address-group ZONE-TEST description 'This is a new description for a address group name that is also in a zone'", "delete firewall group network-group RND description", "delete firewall group ipv6-address-group LOCAL-v6 address fdec:2503:89d6:59b3::1", "set firewall group ipv6-address-group LOCAL-v6 address fdec:2503:89d6:59b3::2", @@ -365,6 +374,13 @@ class TestVyosFirewallRulesModule14(TestVyosModule): ] ), dict( + afi="ipv4", + name="ZONE-TEST", + members=[ + dict(address="1.2.3.4"), + ] + ), + dict( afi="ipv6", name="LOCAL-v6", description="This group has the hosts address lists of this machine", @@ -431,6 +447,14 @@ class TestVyosFirewallRulesModule14(TestVyosModule): dict(address="fdec:2503:89d6:59b3::2"), ], ), + dict( + afi="ipv4", + name="ZONE-TEST", + members=[ + dict(address="4.3.2.1"), + ], + description="This is a new description for a address group name that is also in a zone", + ), ], network_group=[ dict( @@ -461,6 +485,7 @@ class TestVyosFirewallRulesModule14(TestVyosModule): commands = [ "delete firewall group address-group RND-HOSTS address 192.0.2.3", "delete firewall group address-group RND-HOSTS address 192.0.2.5", + "delete firewall group address-group ZONE-TEST address 1.2.3.4", "delete firewall global-options all-ping", "delete firewall global-options ipv6-src-route", "delete firewall global-options send-redirects", @@ -470,6 +495,8 @@ class TestVyosFirewallRulesModule14(TestVyosModule): "set firewall global-options state-policy invalid action 'reject'", "set firewall group address-group RND-HOSTS address 192.0.2.7", "set firewall group address-group RND-HOSTS address 192.0.2.9", + "set firewall group address-group ZONE-TEST address 4.3.2.1", + "set firewall group address-group ZONE-TEST description 'This is a new description for a address group name that is also in a zone'", "delete firewall group ipv6-address-group LOCAL-v6 address fdec:2503:89d6:59b3::1", "set firewall group ipv6-address-group LOCAL-v6 address fdec:2503:89d6:59b3::2", "delete firewall group port-group SSH port 22", |