Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity. E.g., zone 'policy' -> 'action', and the zone matrix overview.
- Port forwarding allows forwarding a range of ports
- Operational data comes from firewalld active rules
- Firewall logging goes to /var/log/firewall.log
- Show implicit/built-in rules and zones (HOST) in firewall matrix,
includes "locked" policy for the default-drop behavior
- The zone services field in admin-exec 'show firewall' shows ANY when
the zone default action is set to 'accept'
- Zone 'forwarding' and 'masquerade' settings live in Infix in the
policys instead, meaning users need to explicitly add a policy
to allow both intra-zone and inter-zone forwarding
- Support for emergency lockdown (kill switch)
- Pre-defined services (xml+enums) are filtered and included as a
separate YANG model, extensions added for netconf and restconf
- Includes initial support for firewalld rich rules
firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'. This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.
Fixes#448
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The software list from sysrepo is no longer reversed, the reverse now
happens in cli-pretty. This commit reflects that.
Signed-off-by: Richard Alpe <richard@bit42.se>
With support for dns resolver in place, the ietf-system output needs to
be complemented with additional data collected from both the dnsmasq and
openresolv subsystems.
System date taken from 'client3' in the Infix DHCP server-subnets test.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Break up the --test parameter into either:
--capture: Write system command output to a local directory for later
consumption by...
--replay: Which can replay a previous capture
Rename --wrap-commands => --cmd-prefix
Existing tests relied on manually captured system data from various
points in Infix's history, making them hard to extend as we add new
features.
Move to a new model where we:
To update a unit test:
1. Use Infamy tests to setup a DUT in a known state
2. Use yanger's wrapper mode to capture the system state needed to
produce operational data for a set of YANG models
3. Use cli-pretty to create the expected output for a set of show
commands
When running unit tests, we can then use the captured data to verify
that yanger and cli-pretty works as expected without the need for a
running Infix system - just like before. The difference is that it is
now much easier to capture a new snapshot when the system evolves.
Joachim Wiberg