cisco_acl_intp 0.0.3 → 0.0.4

Sign up to get free protection for your applications and to get access to all the features.
Files changed (54) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +3 -0
  3. data/.rubocop.yml +2 -2
  4. data/.travis.yml +4 -2
  5. data/Gemfile +7 -6
  6. data/README.md +23 -18
  7. data/Rakefile +11 -13
  8. data/cisco_acl_intp.gemspec +7 -7
  9. data/lib/cisco_acl_intp/acc.rb +111 -0
  10. data/lib/cisco_acl_intp/{ace.rb → ace_base.rb} +9 -8
  11. data/lib/cisco_acl_intp/{extended_ace.rb → ace_extended.rb} +8 -10
  12. data/lib/cisco_acl_intp/{standard_ace.rb → ace_standard.rb} +5 -5
  13. data/lib/cisco_acl_intp/acespec_base.rb +15 -0
  14. data/lib/cisco_acl_intp/{ace_ip.rb → acespec_ip.rb} +14 -22
  15. data/lib/cisco_acl_intp/{ace_other_qualifiers.rb → acespec_other_qualifiers.rb} +7 -7
  16. data/lib/cisco_acl_intp/{ace_port.rb → acespec_port.rb} +10 -13
  17. data/lib/cisco_acl_intp/{ace_port_opr.rb → acespec_port_opr.rb} +75 -73
  18. data/lib/cisco_acl_intp/{ace_port_opr_base.rb → acespec_port_opr_base.rb} +49 -34
  19. data/lib/cisco_acl_intp/{ace_proto.rb → acespec_proto.rb} +4 -4
  20. data/lib/cisco_acl_intp/{ace_proto_base.rb → acespec_proto_base.rb} +8 -8
  21. data/lib/cisco_acl_intp/{ace_srcdst.rb → acespec_srcdst.rb} +9 -8
  22. data/lib/cisco_acl_intp/{ace_tcp_flags.rb → acespec_tcp_flags.rb} +4 -4
  23. data/lib/cisco_acl_intp/acl.rb +1 -1
  24. data/lib/cisco_acl_intp/acl_base.rb +108 -80
  25. data/lib/cisco_acl_intp/{mono_function_acl.rb → acl_category_base.rb} +5 -5
  26. data/lib/cisco_acl_intp/acl_utils.rb +1 -1
  27. data/lib/cisco_acl_intp/parser.rb +388 -406
  28. data/lib/cisco_acl_intp/parser.ry +8 -3
  29. data/lib/cisco_acl_intp/parser_api.rb +4 -4
  30. data/lib/cisco_acl_intp/scanner.rb +8 -10
  31. data/lib/cisco_acl_intp/scanner_special_token_handler.rb +3 -3
  32. data/lib/cisco_acl_intp/version.rb +1 -1
  33. data/spec/cisco_acl_intp/{extended_ace_spec.rb → ace_extended_spec.rb} +157 -128
  34. data/spec/cisco_acl_intp/ace_spec.rb +21 -19
  35. data/spec/cisco_acl_intp/{standard_ace_spec.rb → ace_standard_spec.rb} +7 -11
  36. data/spec/cisco_acl_intp/{ace_ip_spec.rb → acespec_ip_spec.rb} +34 -34
  37. data/spec/cisco_acl_intp/{ace_other_qualifier_spec.rb → acespec_other_qualifier_spec.rb} +18 -18
  38. data/spec/cisco_acl_intp/acespec_port_operator_spec.rb +331 -0
  39. data/spec/cisco_acl_intp/{ace_port_spec.rb → acespec_port_spec.rb} +33 -33
  40. data/spec/cisco_acl_intp/{ace_proto_spec.rb → acespec_proto_spec.rb} +61 -61
  41. data/spec/cisco_acl_intp/{ace_srcdst_spec.rb → acespec_srcdst_spec.rb} +113 -54
  42. data/spec/cisco_acl_intp/{ace_tcp_flags_spec.rb → acespec_tcp_flags_spec.rb} +10 -10
  43. data/spec/cisco_acl_intp/acl_base_spec.rb +14 -12
  44. data/spec/cisco_acl_intp/{extended_acl_spec.rb → acl_extended_spec.rb} +28 -28
  45. data/spec/cisco_acl_intp/{standard_acl_spec.rb → acl_standard_spec.rb} +24 -23
  46. data/spec/cisco_acl_intp/cisco_acl_intp_spec.rb +1 -1
  47. data/spec/cisco_acl_intp/parser_spec.rb +12 -12
  48. data/spec/cisco_acl_intp/scanner_spec.rb +31 -36
  49. data/spec/parser_fullfill_patterns.rb +6 -7
  50. data/spec/spec_helper.rb +6 -6
  51. data/tools/check_acl.rb +1 -1
  52. metadata +60 -59
  53. data/lib/cisco_acl_intp/single_acl_base.rb +0 -137
  54. data/spec/cisco_acl_intp/ace_port_operator_spec.rb +0 -340
data/lib/cisco_acl_intp/parser.ry CHANGED
@@ -230,9 +230,14 @@ udp_srcdst_spec: objgrp_srcdst_spec udp_port_spec
230
230
  named_acl: std_named_acl_header std_named_acl_entry_list
231
231
  | ext_named_acl_header ext_named_acl_entry_list
232
232
  # Notice:
233
- # acl header でエラーがあると、そのあとのエントリ追加用のハコ(object)が
234
- # つくれないので、エラーリカバリしようがない。
235
- # acl_entry_list の中身については可能な範囲で parse して追加。
233
+ #
234
+ # If an error exists in ACL header, parser cannot
235
+ # create 'body' object for add ACL entries that come
236
+ # next of header. Then parser cannot parse any ACL
237
+ # entries and cannot recover its error. When ACL
238
+ # header is correct, parser add ACL entires to 'body'
239
+ # if each entry can read. (parse and add all correct
240
+ # ACL entries.)
236
241
 
237
242
  std_named_acl_header: NAMED_ACL 'standard' STRING eos
238
243
  {
data/lib/cisco_acl_intp/parser_api.rb CHANGED
@@ -111,7 +111,7 @@ module CiscoAclIntp
111
111
  @silent_mode = @debug_print || opts[:silent] || false
112
112
 
113
113
  @color_mode = opts[:color] || :none
114
- AclContainerBase.color_mode = @color_mode
114
+ AccessControlContainer.color_mode = @color_mode
115
115
 
116
116
  @err_handler = ParserErrorHandler.new
117
117
  @err_handler.reset_count
@@ -134,7 +134,7 @@ module CiscoAclIntp
134
134
  filename
135
135
  else
136
136
  @err_handler.count
137
- fail AclError, "File: #{filename} not found."
137
+ raise AclError, "File: #{filename} not found."
138
138
  end
139
139
  end
140
140
  end
@@ -152,13 +152,13 @@ module CiscoAclIntp
152
152
  aclstr
153
153
  else
154
154
  @err_handler.count
155
- fail AclError, "Argment: #{aclstr} not found."
155
+ raise AclError, "Argment: #{aclstr} not found."
156
156
  end
157
157
  end
158
158
  end
159
159
 
160
160
  # Syntax error handler
161
- def on_error(tok, val, vstack)
161
+ def on_error(tok, val, _vstack)
162
162
  errstr = format(
163
163
  '%s, near value: %s, (token: %s)',
164
164
  err_pos_str, val, token_to_str(tok)
data/lib/cisco_acl_intp/scanner.rb CHANGED
@@ -18,7 +18,7 @@ module CiscoAclIntp
18
18
  # @param [File] file File IO object
19
19
  # @return [Array] Scanned tokens array (Queue)
20
20
  def scan_file(file)
21
- run_scaner(file) do |each|
21
+ run_scaner(file) do
22
22
  # no-op
23
23
  end
24
24
  end
@@ -72,9 +72,9 @@ module CiscoAclIntp
72
72
  # @param [Integer] aclnum ACL number
73
73
  # @return [Array] Token list
74
74
  def check_numd_acl_type(aclnum)
75
- if (1..99).include?(aclnum) || (1300..1999).include?(aclnum)
75
+ if (1..99).cover?(aclnum) || (1300..1999).cover?(aclnum)
76
76
  [:NUMD_STD_ACL, aclnum]
77
- elsif (100..199).include?(aclnum) || (2000..2699).include?(aclnum)
77
+ elsif (100..199).cover?(aclnum) || (2000..2699).cover?(aclnum)
78
78
  [:NUMD_EXT_ACL, aclnum]
79
79
  else
80
80
  [:UNKNOWN, "access-list #{aclnum}"]
@@ -109,7 +109,7 @@ module CiscoAclIntp
109
109
  when @ss.scan(/(\d+\.\d+\.\d+\.\d+)\s/)
110
110
  ## IP Address
111
111
  @line_queue.push [:IPV4_ADDR, @ss[1]]
112
- when @ss.scan(/(\d+\.\d+\.\d+\.\d+)(\/)(\d+)\s/)
112
+ when @ss.scan(%r{(\d+\.\d+\.\d+\.\d+)(\/)(\d+)\s})
113
113
  ## IP Address of 'ip/mask' notation
114
114
  @line_queue.push [:IPV4_ADDR, @ss[1]]
115
115
  @line_queue.push ['/', @ss[2]]
@@ -144,13 +144,11 @@ module CiscoAclIntp
144
144
  # @return [Boolean] if line matched tokens
145
145
  def scan_match_arg_tokens
146
146
  @arg_tokens.each do |(str, length)|
147
- if @ss.scan(/#{str}/)
148
- (1...length).each do |idx|
149
- @line_queue.push token_list(@ss[idx])
150
- end
151
- @line_queue.push [:STRING, @ss[length]] # last element
152
- break
147
+ next unless @ss.scan(/#{str}/)
148
+ (1...length).each do |idx|
149
+ @line_queue.push token_list(@ss[idx])
153
150
  end
151
+ @line_queue.push [:STRING, @ss[length]] # last element
154
152
  end
155
153
  @ss.matched?
156
154
  end
data/lib/cisco_acl_intp/scanner_special_token_handler.rb CHANGED
@@ -6,7 +6,7 @@ module CiscoAclIntp
6
6
  module SpecialTokenHandler
7
7
  # STRING token regexp:
8
8
  # first letter is alphabet or digit
9
- STR_REGEXP = '[a-zA-Z\d]\S*'
9
+ STR_REGEXP = '[a-zA-Z\d]\S*'.freeze
10
10
 
11
11
  # Tokens that takes string parameter
12
12
  STRING_ARG_TOKENS = [
@@ -24,13 +24,13 @@ module CiscoAclIntp
24
24
  ['object-group', 'service', :word],
25
25
  ['object-group', :word], # longest match
26
26
  ['group-object', :word]
27
- ]
27
+ ].freeze
28
28
 
29
29
  # Conversion table of string-tokens
30
30
  SYMBOL_TO_REGEXPSTR = {
31
31
  word: ['(', STR_REGEXP, ')'].join,
32
32
  leftover: '(.*)$'
33
- }
33
+ }.freeze
34
34
 
35
35
  # Convert STRING_ARG_TOKENS to Regexp string
36
36
  # @param [Array] set Special tokens set
data/lib/cisco_acl_intp/version.rb CHANGED
@@ -3,7 +3,7 @@
3
3
  # CiscoAclIntp Module, version definition
4
4
  module CiscoAclIntp
5
5
  # Version number
6
- VERSION = '0.0.3'
6
+ VERSION = '0.0.4'.freeze
7
7
  end
8
8
 
9
9
  ### Local variables:
data/spec/cisco_acl_intp/{extended_ace_spec.rb → ace_extended_spec.rb} RENAMED
@@ -1,7 +1,7 @@
1
1
  # -*- coding: utf-8 -*-
2
2
  require 'spec_helper'
3
3
 
4
- def _build_taget(opts)
4
+ def _build_target(opts)
5
5
  ExtendedAce.new(
6
6
  action: (opts[:target] || 'permit'),
7
7
  protocol: (opts[:protocol] || 'tcp'),
@@ -40,7 +40,7 @@ describe ExtendedAce do
40
40
  src: @src,
41
41
  dst: @dst
42
42
  )
43
- ea.to_s.should be_aclstr(
43
+ expect(ea.to_s).to be_aclstr(
44
44
  'permit tcp 192.168.8.9 0.0.7.6 host 192.168.30.3 range 1024 65535'
45
45
  )
46
46
  end
@@ -52,11 +52,10 @@ describe ExtendedAce do
52
52
  src: @src,
53
53
  dst: @dst
54
54
  )
55
- ea.to_s.should be_aclstr(
55
+ expect(ea.to_s).to be_aclstr(
56
56
  'deny tcp 192.168.8.9 0.0.7.6 host 192.168.30.3 range 1024 65535'
57
57
  )
58
58
  end
59
-
60
59
  end
61
60
 
62
61
  context 'Argument error case' do
@@ -75,45 +74,44 @@ describe ExtendedAce do
75
74
  end
76
75
 
77
76
  it 'should be rased exception when :action not specified' do
78
- lambda do
77
+ expect do
79
78
  ExtendedAce.new(
80
79
  protocol: 'tcp',
81
80
  src: @src,
82
81
  dst: @dst
83
82
  )
84
- end.should raise_error(AclArgumentError)
83
+ end.to raise_error(AclArgumentError)
85
84
  end
86
85
 
87
86
  it 'should be rased exception when :protocol not specified' do
88
- lambda do
87
+ expect do
89
88
  ExtendedAce.new(
90
89
  action: 'deny',
91
90
  src: @src,
92
91
  dst: @dst
93
92
  )
94
- end.should raise_error(AclArgumentError)
93
+ end.to raise_error(AclArgumentError)
95
94
  end
96
95
 
97
96
  it 'should be rased exception when :src not specified' do
98
- lambda do
97
+ expect do
99
98
  ExtendedAce.new(
100
99
  action: 'deny',
101
100
  protocol: 'tcp',
102
101
  dst: @dst
103
102
  )
104
- end.should raise_error(AclArgumentError)
103
+ end.to raise_error(AclArgumentError)
105
104
  end
106
105
 
107
106
  it 'should be rased exception when :dst not specified' do
108
- lambda do
107
+ expect do
109
108
  ExtendedAce.new(
110
109
  action: 'deny',
111
110
  protocol: 'tcp',
112
111
  src: @src
113
112
  )
114
- end.should raise_error(AclArgumentError)
113
+ end.to raise_error(AclArgumentError)
115
114
  end
116
-
117
115
  end
118
116
  end
119
117
 
@@ -193,13 +191,12 @@ describe ExtendedAce do
193
191
  # run test
194
192
  it teststr do
195
193
  if eres
196
- @ea.contains?(_build_taget(eopts)).should be_true
194
+ expect(@ea.contains?(_build_target(eopts))).to be_truthy
197
195
  else
198
- @ea.contains?(_build_taget(eopts)).should be_false
196
+ expect(@ea.contains?(_build_target(eopts))).to be_falsey
199
197
  end
200
198
  end # it
201
199
  end # tests.each
202
-
203
200
  end # context full spec test
204
201
 
205
202
  context 'ANY ip/port port exists case' do
@@ -245,160 +242,192 @@ describe ExtendedAce do
245
242
  ea = ExtendedAce.new(
246
243
  action: 'permit', protocol: 'tcp', src: @src1, dst: @dst0
247
244
  )
248
- ea.contains?(_build_taget(
249
- protocol: 'tcp',
250
- src_operator: :eq,
251
- src_ip: @src_ip_match, src_port: @src_port_match,
252
- dst_operator: :eq,
253
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
254
- )).should be_true
255
- ea.contains?(_build_taget(
256
- protocol: 'tcp',
257
- src_operator: :eq,
258
- src_ip: @src_ip_unmatch, src_port: @src_port_match,
259
- dst_operator: :eq,
260
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
261
- )).should be_true
245
+ expect(
246
+ ea.contains?(
247
+ _build_target(
248
+ protocol: 'tcp',
249
+ src_operator: :eq,
250
+ src_ip: @src_ip_match, src_port: @src_port_match,
251
+ dst_operator: :eq,
252
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
253
+ ))).to be_truthy
254
+ expect(
255
+ ea.contains?(
256
+ _build_target(
257
+ protocol: 'tcp',
258
+ src_operator: :eq,
259
+ src_ip: @src_ip_unmatch, src_port: @src_port_match,
260
+ dst_operator: :eq,
261
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
262
+ ))).to be_truthy
262
263
  end
263
264
 
264
265
  it 'should be false when any source ip and unmatch port' do
265
266
  ea = ExtendedAce.new(
266
267
  action: 'permit', protocol: 'tcp', src: @src1, dst: @dst0
267
268
  )
268
- ea.contains?(_build_taget(
269
- protocol: 'tcp',
270
- src_operator: :eq,
271
- src_ip: @src_ip_match, src_port: @src_port_unmatch,
272
- dst_operator: :eq,
273
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
274
- )).should be_false
275
- ea.contains?(_build_taget(
276
- protocol: 'tcp',
277
- src_operator: :eq,
278
- src_ip: @src_ip_unmatch, src_port: @src_port_unmatch,
279
- dst_operator: :eq,
280
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
281
- )).should be_false
269
+ expect(
270
+ ea.contains?(
271
+ _build_target(
272
+ protocol: 'tcp',
273
+ src_operator: :eq,
274
+ src_ip: @src_ip_match, src_port: @src_port_unmatch,
275
+ dst_operator: :eq,
276
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
277
+ ))).to be_falsey
278
+ expect(
279
+ ea.contains?(
280
+ _build_target(
281
+ protocol: 'tcp',
282
+ src_operator: :eq,
283
+ src_ip: @src_ip_unmatch, src_port: @src_port_unmatch,
284
+ dst_operator: :eq,
285
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
286
+ ))).to be_falsey
282
287
  end
283
288
 
284
289
  it 'should be true when any source port' do
285
290
  ea = ExtendedAce.new(
286
291
  action: 'permit', protocol: 'tcp', src: @src2, dst: @dst0
287
292
  )
288
- ea.contains?(_build_taget(
289
- protocol: 'tcp',
290
- src_operator: :eq,
291
- src_ip: @src_ip_match, src_port: @src_port_match,
292
- dst_operator: :eq,
293
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
294
- )).should be_true
295
- ea.contains?(_build_taget(
296
- protocol: 'tcp',
297
- src_operator: :eq,
298
- src_ip: @src_ip_match, src_port: @src_port_unmatch,
299
- dst_operator: :eq,
300
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
301
- )).should be_true
293
+ expect(
294
+ ea.contains?(
295
+ _build_target(
296
+ protocol: 'tcp',
297
+ src_operator: :eq,
298
+ src_ip: @src_ip_match, src_port: @src_port_match,
299
+ dst_operator: :eq,
300
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
301
+ ))).to be_truthy
302
+ expect(
303
+ ea.contains?(
304
+ _build_target(
305
+ protocol: 'tcp',
306
+ src_operator: :eq,
307
+ src_ip: @src_ip_match, src_port: @src_port_unmatch,
308
+ dst_operator: :eq,
309
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
310
+ ))).to be_truthy
302
311
  end
303
312
 
304
313
  it 'should be false when any source port and unmatch ip' do
305
314
  ea = ExtendedAce.new(
306
315
  action: 'permit', protocol: 'tcp', src: @src2, dst: @dst0
307
316
  )
308
- ea.contains?(_build_taget(
309
- protocol: 'tcp',
310
- src_operator: :eq,
311
- src_ip: @src_ip_unmatch, src_port: @src_port_match,
312
- dst_operator: :eq,
313
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
314
- )).should be_false
315
- ea.contains?(_build_taget(
316
- protocol: 'tcp',
317
- src_operator: :eq,
318
- src_ip: @src_ip_unmatch, src_port: @src_port_unmatch,
319
- dst_operator: :eq,
320
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
321
- )).should be_false
317
+ expect(
318
+ ea.contains?(
319
+ _build_target(
320
+ protocol: 'tcp',
321
+ src_operator: :eq,
322
+ src_ip: @src_ip_unmatch, src_port: @src_port_match,
323
+ dst_operator: :eq,
324
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
325
+ ))).to be_falsey
326
+ expect(
327
+ ea.contains?(
328
+ _build_target(
329
+ protocol: 'tcp',
330
+ src_operator: :eq,
331
+ src_ip: @src_ip_unmatch, src_port: @src_port_unmatch,
332
+ dst_operator: :eq,
333
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
334
+ ))).to be_falsey
322
335
  end
323
336
 
324
337
  it 'should be true when any destination ip' do
325
338
  ea = ExtendedAce.new(
326
339
  action: 'permit', protocol: 'tcp', src: @src0, dst: @dst1
327
340
  )
328
- ea.contains?(_build_taget(
329
- protocol: 'tcp',
330
- src_operator: :eq,
331
- src_ip: @src_ip_match, src_port: @src_port_match,
332
- dst_operator: :eq,
333
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
334
- )).should be_true
335
- ea.contains?(_build_taget(
336
- protocol: 'tcp',
337
- src_operator: :eq,
338
- src_ip: @src_ip_match, src_port: @src_port_match,
339
- dst_operator: :eq,
340
- dst_ip: @dst_ip_unmatch, dst_port: @dst_port_match
341
- )).should be_true
341
+ expect(
342
+ ea.contains?(
343
+ _build_target(
344
+ protocol: 'tcp',
345
+ src_operator: :eq,
346
+ src_ip: @src_ip_match, src_port: @src_port_match,
347
+ dst_operator: :eq,
348
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
349
+ ))).to be_truthy
350
+ expect(
351
+ ea.contains?(
352
+ _build_target(
353
+ protocol: 'tcp',
354
+ src_operator: :eq,
355
+ src_ip: @src_ip_match, src_port: @src_port_match,
356
+ dst_operator: :eq,
357
+ dst_ip: @dst_ip_unmatch, dst_port: @dst_port_match
358
+ ))).to be_truthy
342
359
  end
343
360
 
344
361
  it 'should be false when any destination ip and unmatch port' do
345
362
  ea = ExtendedAce.new(
346
363
  action: 'permit', protocol: 'tcp', src: @src0, dst: @dst1
347
364
  )
348
- ea.contains?(_build_taget(
349
- protocol: 'tcp',
350
- src_operator: :eq,
351
- src_ip: @src_ip_match, src_port: @src_port_match,
352
- dst_operator: :eq,
353
- dst_ip: @dst_ip_match, dst_port: @dst_port_unmatch
354
- )).should be_false
355
- ea.contains?(_build_taget(
356
- protocol: 'tcp',
357
- src_operator: :eq,
358
- src_ip: @src_ip_match, src_port: @src_port_match,
359
- dst_operator: :eq,
360
- dst_ip: @dst_ip_unmatch, dst_port: @dst_port_unmatch
361
- )).should be_false
365
+ expect(
366
+ ea.contains?(
367
+ _build_target(
368
+ protocol: 'tcp',
369
+ src_operator: :eq,
370
+ src_ip: @src_ip_match, src_port: @src_port_match,
371
+ dst_operator: :eq,
372
+ dst_ip: @dst_ip_match, dst_port: @dst_port_unmatch
373
+ ))).to be_falsey
374
+ expect(
375
+ ea.contains?(
376
+ _build_target(
377
+ protocol: 'tcp',
378
+ src_operator: :eq,
379
+ src_ip: @src_ip_match, src_port: @src_port_match,
380
+ dst_operator: :eq,
381
+ dst_ip: @dst_ip_unmatch, dst_port: @dst_port_unmatch
382
+ ))).to be_falsey
362
383
  end
363
384
 
364
385
  it 'should be true when any destination port' do
365
386
  ea = ExtendedAce.new(
366
387
  action: 'permit', protocol: 'tcp', src: @src0, dst: @dst2
367
388
  )
368
- ea.contains?(_build_taget(
369
- protocol: 'tcp',
370
- src_operator: :eq,
371
- src_ip: @src_ip_match, src_port: @src_port_match,
372
- dst_operator: :eq,
373
- dst_ip: @dst_ip_match, dst_port: @dst_port_match
374
- )).should be_true
375
- ea.contains?(_build_taget(
376
- protocol: 'tcp',
377
- src_operator: :eq,
378
- src_ip: @src_ip_match, src_port: @src_port_match,
379
- dst_operator: :eq,
380
- dst_ip: @dst_ip_match, dst_port: @dst_port_unmatch
381
- )).should be_true
389
+ expect(
390
+ ea.contains?(
391
+ _build_target(
392
+ protocol: 'tcp',
393
+ src_operator: :eq,
394
+ src_ip: @src_ip_match, src_port: @src_port_match,
395
+ dst_operator: :eq,
396
+ dst_ip: @dst_ip_match, dst_port: @dst_port_match
397
+ ))).to be_truthy
398
+ expect(
399
+ ea.contains?(
400
+ _build_target(
401
+ protocol: 'tcp',
402
+ src_operator: :eq,
403
+ src_ip: @src_ip_match, src_port: @src_port_match,
404
+ dst_operator: :eq,
405
+ dst_ip: @dst_ip_match, dst_port: @dst_port_unmatch
406
+ ))).to be_truthy
382
407
  end
383
408
 
384
409
  it 'should be false when any destination port and unmatch ip' do
385
410
  ea = ExtendedAce.new(
386
411
  action: 'permit', protocol: 'tcp', src: @src0, dst: @dst2
387
412
  )
388
- ea.contains?(_build_taget(
389
- protocol: 'tcp',
390
- src_operator: :eq,
391
- src_ip: @src_ip_match, src_port: @src_port_match,
392
- dst_operator: :eq,
393
- dst_ip: @dst_ip_unmatch, dst_port: @dst_port_match
394
- )).should be_false
395
- ea.contains?(_build_taget(
396
- protocol: 'tcp',
397
- src_operator: :eq,
398
- src_ip: @src_ip_match, src_port: @src_port_match,
399
- dst_operator: :eq,
400
- dst_ip: @dst_ip_unmatch, dst_port: @dst_port_unmatch
401
- )).should be_false
413
+ expect(
414
+ ea.contains?(
415
+ _build_target(
416
+ protocol: 'tcp',
417
+ src_operator: :eq,
418
+ src_ip: @src_ip_match, src_port: @src_port_match,
419
+ dst_operator: :eq,
420
+ dst_ip: @dst_ip_unmatch, dst_port: @dst_port_match
421
+ ))).to be_falsey
422
+ expect(
423
+ ea.contains?(
424
+ _build_target(
425
+ protocol: 'tcp',
426
+ src_operator: :eq,
427
+ src_ip: @src_ip_match, src_port: @src_port_match,
428
+ dst_operator: :eq,
429
+ dst_ip: @dst_ip_unmatch, dst_port: @dst_port_unmatch
430
+ ))).to be_falsey
402
431
  end
403
432
  end # context exists any ip/port
404
433
  end # describe contains?