Skip to content

Commit 2f2be32

Browse files
authored
fix(firewall): 'create --rules-file' not working with outbound rules (#752)
This PR fixes the behavior of the `--rules-file` flag when creating firewalls. Destination IPs were not parsed correctly which lead to the request failing when an outbound rule was specified. This was fixed and tests for outbound rules were added. Closes #750
1 parent 73154e0 commit 2f2be32

File tree

4 files changed

+53
-5
lines changed

4 files changed

+53
-5
lines changed

internal/cmd/firewall/create.go

+14-5
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,21 @@ var CreateCmd = base.CreateCmd{
6767
}
6868
sourceNets = append(sourceNets, *sourceNet)
6969
}
70+
var destNets []net.IPNet
71+
for i, destIP := range rule.DestinationIPs {
72+
_, destNet, err := net.ParseCIDR(destIP)
73+
if err != nil {
74+
return nil, nil, fmt.Errorf("invalid CIDR on index %d : %s", i, err)
75+
}
76+
destNets = append(destNets, *destNet)
77+
}
7078
opts.Rules = append(opts.Rules, hcloud.FirewallRule{
71-
Direction: hcloud.FirewallRuleDirection(rule.Direction),
72-
SourceIPs: sourceNets,
73-
Protocol: hcloud.FirewallRuleProtocol(rule.Protocol),
74-
Port: rule.Port,
75-
Description: rule.Description,
79+
Direction: hcloud.FirewallRuleDirection(rule.Direction),
80+
SourceIPs: sourceNets,
81+
DestinationIPs: destNets,
82+
Protocol: hcloud.FirewallRuleProtocol(rule.Protocol),
83+
Port: rule.Port,
84+
Description: rule.Description,
7685
})
7786
}
7887
}

internal/cmd/firewall/create_test.go

+14
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,20 @@ func TestCreate(t *testing.T) {
5858
Port: hcloud.Ptr("443"),
5959
Description: hcloud.Ptr("Allow port 443"),
6060
},
61+
{
62+
Direction: hcloud.FirewallRuleDirectionOut,
63+
SourceIPs: nil,
64+
DestinationIPs: []net.IPNet{
65+
{IP: net.IP{28, 239, 13, 1}, Mask: net.IPMask{255, 255, 255, 255}},
66+
{IP: net.IP{28, 239, 14, 0}, Mask: net.IPMask{255, 255, 255, 0}},
67+
{
68+
IP: net.IP{0xff, 0x21, 0x1e, 0xac, 0x9a, 0x3b, 0xee, 0x58, 0x05, 0xca, 0x99, 0x0c, 0x8b, 0xc9, 0xc0, 0x3b},
69+
Mask: net.IPMask{255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255},
70+
},
71+
},
72+
Protocol: hcloud.FirewallRuleProtocolTCP,
73+
Port: hcloud.Ptr("80"),
74+
},
6175
},
6276
}).
6377
Return(hcloud.FirewallCreateResult{

internal/cmd/firewall/replace_rules_test.go

+14
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,20 @@ func TestReplaceRules(t *testing.T) {
5959
Port: hcloud.Ptr("443"),
6060
Description: hcloud.Ptr("Allow port 443"),
6161
},
62+
{
63+
Direction: hcloud.FirewallRuleDirectionOut,
64+
SourceIPs: nil,
65+
DestinationIPs: []net.IPNet{
66+
{IP: net.IP{28, 239, 13, 1}, Mask: net.IPMask{255, 255, 255, 255}},
67+
{IP: net.IP{28, 239, 14, 0}, Mask: net.IPMask{255, 255, 255, 0}},
68+
{
69+
IP: net.IP{0xff, 0x21, 0x1e, 0xac, 0x9a, 0x3b, 0xee, 0x58, 0x05, 0xca, 0x99, 0x0c, 0x8b, 0xc9, 0xc0, 0x3b},
70+
Mask: net.IPMask{255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255},
71+
},
72+
},
73+
Protocol: hcloud.FirewallRuleProtocolTCP,
74+
Port: hcloud.Ptr("80"),
75+
},
6276
},
6377
}).
6478
Return([]*hcloud.Action{{ID: 123}, {ID: 321}}, nil, nil)

internal/cmd/firewall/testdata/rules.json

+11
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,16 @@
1919
"0.0.0.0/0",
2020
"::/0"
2121
]
22+
},
23+
{
24+
"direction": "out",
25+
"source_ips": [],
26+
"destination_ips": [
27+
"28.239.13.1/32",
28+
"28.239.14.0/24",
29+
"ff21:1eac:9a3b:ee58:5ca:990c:8bc9:c03b/128"
30+
],
31+
"protocol": "tcp",
32+
"port": "80"
2233
}
2334
]

0 commit comments

Comments
 (0)