Skip to content

Commit 2f2be32

Browse files
authored
fix(firewall): 'create --rules-file' not working with outbound rules (#752)
This PR fixes the behavior of the `--rules-file` flag when creating firewalls. Destination IPs were not parsed correctly which lead to the request failing when an outbound rule was specified. This was fixed and tests for outbound rules were added. Closes #750
1 parent 73154e0 commit 2f2be32

4 files changed

Lines changed: 53 additions & 5 deletions

File tree

internal/cmd/firewall/create.go

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,21 @@ var CreateCmd = base.CreateCmd{
6767
}
6868
sourceNets = append(sourceNets, *sourceNet)
6969
}
70+
var destNets []net.IPNet
71+
for i, destIP := range rule.DestinationIPs {
72+
_, destNet, err := net.ParseCIDR(destIP)
73+
if err != nil {
74+
return nil, nil, fmt.Errorf("invalid CIDR on index %d : %s", i, err)
75+
}
76+
destNets = append(destNets, *destNet)
77+
}
7078
opts.Rules = append(opts.Rules, hcloud.FirewallRule{
71-
Direction: hcloud.FirewallRuleDirection(rule.Direction),
72-
SourceIPs: sourceNets,
73-
Protocol: hcloud.FirewallRuleProtocol(rule.Protocol),
74-
Port: rule.Port,
75-
Description: rule.Description,
79+
Direction: hcloud.FirewallRuleDirection(rule.Direction),
80+
SourceIPs: sourceNets,
81+
DestinationIPs: destNets,
82+
Protocol: hcloud.FirewallRuleProtocol(rule.Protocol),
83+
Port: rule.Port,
84+
Description: rule.Description,
7685
})
7786
}
7887
}

internal/cmd/firewall/create_test.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,20 @@ func TestCreate(t *testing.T) {
5858
Port: hcloud.Ptr("443"),
5959
Description: hcloud.Ptr("Allow port 443"),
6060
},
61+
{
62+
Direction: hcloud.FirewallRuleDirectionOut,
63+
SourceIPs: nil,
64+
DestinationIPs: []net.IPNet{
65+
{IP: net.IP{28, 239, 13, 1}, Mask: net.IPMask{255, 255, 255, 255}},
66+
{IP: net.IP{28, 239, 14, 0}, Mask: net.IPMask{255, 255, 255, 0}},
67+
{
68+
IP: net.IP{0xff, 0x21, 0x1e, 0xac, 0x9a, 0x3b, 0xee, 0x58, 0x05, 0xca, 0x99, 0x0c, 0x8b, 0xc9, 0xc0, 0x3b},
69+
Mask: net.IPMask{255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255},
70+
},
71+
},
72+
Protocol: hcloud.FirewallRuleProtocolTCP,
73+
Port: hcloud.Ptr("80"),
74+
},
6175
},
6276
}).
6377
Return(hcloud.FirewallCreateResult{

internal/cmd/firewall/replace_rules_test.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,20 @@ func TestReplaceRules(t *testing.T) {
5959
Port: hcloud.Ptr("443"),
6060
Description: hcloud.Ptr("Allow port 443"),
6161
},
62+
{
63+
Direction: hcloud.FirewallRuleDirectionOut,
64+
SourceIPs: nil,
65+
DestinationIPs: []net.IPNet{
66+
{IP: net.IP{28, 239, 13, 1}, Mask: net.IPMask{255, 255, 255, 255}},
67+
{IP: net.IP{28, 239, 14, 0}, Mask: net.IPMask{255, 255, 255, 0}},
68+
{
69+
IP: net.IP{0xff, 0x21, 0x1e, 0xac, 0x9a, 0x3b, 0xee, 0x58, 0x05, 0xca, 0x99, 0x0c, 0x8b, 0xc9, 0xc0, 0x3b},
70+
Mask: net.IPMask{255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255},
71+
},
72+
},
73+
Protocol: hcloud.FirewallRuleProtocolTCP,
74+
Port: hcloud.Ptr("80"),
75+
},
6276
},
6377
}).
6478
Return([]*hcloud.Action{{ID: 123}, {ID: 321}}, nil, nil)

internal/cmd/firewall/testdata/rules.json

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,16 @@
1919
"0.0.0.0/0",
2020
"::/0"
2121
]
22+
},
23+
{
24+
"direction": "out",
25+
"source_ips": [],
26+
"destination_ips": [
27+
"28.239.13.1/32",
28+
"28.239.14.0/24",
29+
"ff21:1eac:9a3b:ee58:5ca:990c:8bc9:c03b/128"
30+
],
31+
"protocol": "tcp",
32+
"port": "80"
2233
}
2334
]

0 commit comments

Comments
 (0)