cisco_acl_intp 0.0.3 → 0.0.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +3 -0
- data/.rubocop.yml +2 -2
- data/.travis.yml +4 -2
- data/Gemfile +7 -6
- data/README.md +23 -18
- data/Rakefile +11 -13
- data/cisco_acl_intp.gemspec +7 -7
- data/lib/cisco_acl_intp/acc.rb +111 -0
- data/lib/cisco_acl_intp/{ace.rb → ace_base.rb} +9 -8
- data/lib/cisco_acl_intp/{extended_ace.rb → ace_extended.rb} +8 -10
- data/lib/cisco_acl_intp/{standard_ace.rb → ace_standard.rb} +5 -5
- data/lib/cisco_acl_intp/acespec_base.rb +15 -0
- data/lib/cisco_acl_intp/{ace_ip.rb → acespec_ip.rb} +14 -22
- data/lib/cisco_acl_intp/{ace_other_qualifiers.rb → acespec_other_qualifiers.rb} +7 -7
- data/lib/cisco_acl_intp/{ace_port.rb → acespec_port.rb} +10 -13
- data/lib/cisco_acl_intp/{ace_port_opr.rb → acespec_port_opr.rb} +75 -73
- data/lib/cisco_acl_intp/{ace_port_opr_base.rb → acespec_port_opr_base.rb} +49 -34
- data/lib/cisco_acl_intp/{ace_proto.rb → acespec_proto.rb} +4 -4
- data/lib/cisco_acl_intp/{ace_proto_base.rb → acespec_proto_base.rb} +8 -8
- data/lib/cisco_acl_intp/{ace_srcdst.rb → acespec_srcdst.rb} +9 -8
- data/lib/cisco_acl_intp/{ace_tcp_flags.rb → acespec_tcp_flags.rb} +4 -4
- data/lib/cisco_acl_intp/acl.rb +1 -1
- data/lib/cisco_acl_intp/acl_base.rb +108 -80
- data/lib/cisco_acl_intp/{mono_function_acl.rb → acl_category_base.rb} +5 -5
- data/lib/cisco_acl_intp/acl_utils.rb +1 -1
- data/lib/cisco_acl_intp/parser.rb +388 -406
- data/lib/cisco_acl_intp/parser.ry +8 -3
- data/lib/cisco_acl_intp/parser_api.rb +4 -4
- data/lib/cisco_acl_intp/scanner.rb +8 -10
- data/lib/cisco_acl_intp/scanner_special_token_handler.rb +3 -3
- data/lib/cisco_acl_intp/version.rb +1 -1
- data/spec/cisco_acl_intp/{extended_ace_spec.rb → ace_extended_spec.rb} +157 -128
- data/spec/cisco_acl_intp/ace_spec.rb +21 -19
- data/spec/cisco_acl_intp/{standard_ace_spec.rb → ace_standard_spec.rb} +7 -11
- data/spec/cisco_acl_intp/{ace_ip_spec.rb → acespec_ip_spec.rb} +34 -34
- data/spec/cisco_acl_intp/{ace_other_qualifier_spec.rb → acespec_other_qualifier_spec.rb} +18 -18
- data/spec/cisco_acl_intp/acespec_port_operator_spec.rb +331 -0
- data/spec/cisco_acl_intp/{ace_port_spec.rb → acespec_port_spec.rb} +33 -33
- data/spec/cisco_acl_intp/{ace_proto_spec.rb → acespec_proto_spec.rb} +61 -61
- data/spec/cisco_acl_intp/{ace_srcdst_spec.rb → acespec_srcdst_spec.rb} +113 -54
- data/spec/cisco_acl_intp/{ace_tcp_flags_spec.rb → acespec_tcp_flags_spec.rb} +10 -10
- data/spec/cisco_acl_intp/acl_base_spec.rb +14 -12
- data/spec/cisco_acl_intp/{extended_acl_spec.rb → acl_extended_spec.rb} +28 -28
- data/spec/cisco_acl_intp/{standard_acl_spec.rb → acl_standard_spec.rb} +24 -23
- data/spec/cisco_acl_intp/cisco_acl_intp_spec.rb +1 -1
- data/spec/cisco_acl_intp/parser_spec.rb +12 -12
- data/spec/cisco_acl_intp/scanner_spec.rb +31 -36
- data/spec/parser_fullfill_patterns.rb +6 -7
- data/spec/spec_helper.rb +6 -6
- data/tools/check_acl.rb +1 -1
- metadata +60 -59
- data/lib/cisco_acl_intp/single_acl_base.rb +0 -137
- data/spec/cisco_acl_intp/ace_port_operator_spec.rb +0 -340
@@ -2,7 +2,7 @@
|
|
2
2
|
require 'spec_helper'
|
3
3
|
|
4
4
|
def get_port_table(data)
|
5
|
-
data.split(/\n/).
|
5
|
+
data.split(/\n/).each_with_object({}) do |line, tbl|
|
6
6
|
md = line.match(/^\s*([\w\d\-]+)\s+.+[\s\(](\d+)\)$/)
|
7
7
|
tbl[md[1]] = md[2] if md
|
8
8
|
tbl
|
@@ -30,24 +30,24 @@ describe AceUdpProtoSpec do
|
|
30
30
|
describe '#name_to_numer, #to_i' do
|
31
31
|
it 'should be "111" by converting proto name "sunrpc"' do
|
32
32
|
aups = AceUdpProtoSpec.new('sunrpc')
|
33
|
-
aups.number.
|
34
|
-
aups.to_i.
|
33
|
+
expect(aups.number).to eq 111
|
34
|
+
expect(aups.to_i).to eq 111
|
35
35
|
end
|
36
36
|
|
37
37
|
it 'should be error by converting unknown proto name "hoge"' do
|
38
|
-
|
38
|
+
expect do
|
39
39
|
AceUdpProtoSpec.new('hoge')
|
40
|
-
end.
|
40
|
+
end.to raise_error(AclArgumentError)
|
41
41
|
end
|
42
42
|
end
|
43
43
|
|
44
44
|
describe 'class#valid_name?' do
|
45
45
|
it 'should be true when valid udp port name' do
|
46
|
-
AceUdpProtoSpec.valid_name?('snmp').
|
46
|
+
expect(AceUdpProtoSpec.valid_name?('snmp')).to be_truthy
|
47
47
|
end
|
48
48
|
|
49
49
|
it 'should be false when invalid udp port name' do
|
50
|
-
AceUdpProtoSpec.valid_name?('daytime').
|
50
|
+
expect(AceUdpProtoSpec.valid_name?('daytime')).to be_falsey
|
51
51
|
end
|
52
52
|
end
|
53
53
|
|
@@ -86,26 +86,26 @@ EOL
|
|
86
86
|
|
87
87
|
it 'should be number string when it not match IOS acl literal' do
|
88
88
|
aups = AceUdpProtoSpec.new(3_333)
|
89
|
-
aups.to_s.
|
89
|
+
expect(aups.to_s).to be_aclstr('3333')
|
90
90
|
end
|
91
91
|
|
92
92
|
it 'should be error when out of range port number' do
|
93
|
-
|
93
|
+
expect do
|
94
94
|
AceUdpProtoSpec.new(65_536)
|
95
|
-
end.
|
95
|
+
end.to raise_error(AclArgumentError)
|
96
96
|
|
97
|
-
|
97
|
+
expect do
|
98
98
|
AceUdpProtoSpec.new(-1)
|
99
|
-
end.
|
99
|
+
end.to raise_error(AclArgumentError)
|
100
100
|
end
|
101
101
|
|
102
102
|
it 'should be error when not specified name/number' do
|
103
|
-
|
103
|
+
expect do
|
104
104
|
AceUdpProtoSpec.new
|
105
|
-
end.
|
106
|
-
|
105
|
+
end.to raise_error(AclArgumentError)
|
106
|
+
expect do
|
107
107
|
AceUdpProtoSpec.new('')
|
108
|
-
end.
|
108
|
+
end.to raise_error(AclArgumentError)
|
109
109
|
end
|
110
110
|
end
|
111
111
|
end
|
@@ -114,24 +114,24 @@ describe AceTcpProtoSpec do
|
|
114
114
|
describe '#name_to_numer, #to_i' do
|
115
115
|
it 'should be "49" by converting proto name "tacacs"' do
|
116
116
|
atps = AceTcpProtoSpec.new('tacacs')
|
117
|
-
atps.number.
|
118
|
-
atps.to_i.
|
117
|
+
expect(atps.number).to eq 49
|
118
|
+
expect(atps.to_i).to eq 49
|
119
119
|
end
|
120
120
|
|
121
121
|
it 'should be error by converting unknown proto name "fuga"' do
|
122
|
-
|
122
|
+
expect do
|
123
123
|
AceTcpProtoSpec.new('fuga')
|
124
|
-
end.
|
124
|
+
end.to raise_error(AclArgumentError)
|
125
125
|
end
|
126
126
|
end
|
127
127
|
|
128
128
|
describe 'class#valid_name?' do
|
129
129
|
it 'should be true when valid tcp port name' do
|
130
|
-
AceTcpProtoSpec.valid_name?('daytime').
|
130
|
+
expect(AceTcpProtoSpec.valid_name?('daytime')).to be_truthy
|
131
131
|
end
|
132
132
|
|
133
133
|
it 'should be false when invalid tcp port name' do
|
134
|
-
AceTcpProtoSpec.valid_name?('snmp').
|
134
|
+
expect(AceTcpProtoSpec.valid_name?('snmp')).to be_falsey
|
135
135
|
end
|
136
136
|
end
|
137
137
|
|
@@ -176,26 +176,26 @@ EOL
|
|
176
176
|
|
177
177
|
it 'should be number string when it not match IOS acl literal' do
|
178
178
|
aups = AceTcpProtoSpec.new(6_633)
|
179
|
-
aups.to_s.
|
179
|
+
expect(aups.to_s).to be_aclstr('6633')
|
180
180
|
end
|
181
181
|
|
182
182
|
it 'should be error when not specified name/number' do
|
183
|
-
|
183
|
+
expect do
|
184
184
|
AceTcpProtoSpec.new
|
185
|
-
end.
|
186
|
-
|
185
|
+
end.to raise_error(AclArgumentError)
|
186
|
+
expect do
|
187
187
|
AceTcpProtoSpec.new('')
|
188
|
-
end.
|
188
|
+
end.to raise_error(AclArgumentError)
|
189
189
|
end
|
190
190
|
|
191
191
|
it 'should be error when out of range port number' do
|
192
|
-
|
192
|
+
expect do
|
193
193
|
AceTcpProtoSpec.new(65_536)
|
194
|
-
end.
|
194
|
+
end.to raise_error(AclArgumentError)
|
195
195
|
|
196
|
-
|
196
|
+
expect do
|
197
197
|
AceTcpProtoSpec.new(-1)
|
198
|
-
end.
|
198
|
+
end.to raise_error(AclArgumentError)
|
199
199
|
end
|
200
200
|
end
|
201
201
|
end
|
@@ -204,24 +204,24 @@ describe AceIpProtoSpec do
|
|
204
204
|
describe '#name_to_numer' do
|
205
205
|
it 'should be "88" by converting proto name "eigrp"' do
|
206
206
|
aips = AceIpProtoSpec.new('eigrp')
|
207
|
-
aips.number.
|
208
|
-
aips.to_i.
|
207
|
+
expect(aips.number).to eq 88
|
208
|
+
expect(aips.to_i).to eq 88
|
209
209
|
end
|
210
210
|
|
211
211
|
it 'should be error by converting unknown proto name "foo"' do
|
212
|
-
|
212
|
+
expect do
|
213
213
|
AceIpProtoSpec.new('foo')
|
214
|
-
end.
|
214
|
+
end.to raise_error(AclArgumentError)
|
215
215
|
end
|
216
216
|
end
|
217
217
|
|
218
218
|
describe 'class#valid_name?' do
|
219
219
|
it 'should be true when valid tcp port name' do
|
220
|
-
AceIpProtoSpec.valid_name?('ospf').
|
220
|
+
expect(AceIpProtoSpec.valid_name?('ospf')).to be_truthy
|
221
221
|
end
|
222
222
|
|
223
223
|
it 'should be false when invalid tcp port name' do
|
224
|
-
AceIpProtoSpec.valid_name?('daytime').
|
224
|
+
expect(AceIpProtoSpec.valid_name?('daytime')).to be_falsey
|
225
225
|
end
|
226
226
|
end
|
227
227
|
|
@@ -237,30 +237,30 @@ describe AceIpProtoSpec do
|
|
237
237
|
end
|
238
238
|
|
239
239
|
it 'should be true, ip includes tcp/udp' do
|
240
|
-
@p_ip.contains?(@p_tcp).
|
241
|
-
@p_ip.contains?(@p_udp).
|
242
|
-
@p_ip.contains?(@p_ip2).
|
240
|
+
expect(@p_ip.contains?(@p_tcp)).to be_truthy
|
241
|
+
expect(@p_ip.contains?(@p_udp)).to be_truthy
|
242
|
+
expect(@p_ip.contains?(@p_ip2)).to be_truthy
|
243
243
|
end
|
244
244
|
|
245
245
|
it 'should be false, ip not includes esp' do
|
246
|
-
@p_ip.contains?(@p_esp).
|
247
|
-
@p_esp.contains?(@p_ip).
|
248
|
-
@p_esp.contains?(@p_tcp).
|
249
|
-
@p_esp.contains?(@p_udp).
|
246
|
+
expect(@p_ip.contains?(@p_esp)).to be_falsey
|
247
|
+
expect(@p_esp.contains?(@p_ip)).to be_falsey
|
248
|
+
expect(@p_esp.contains?(@p_tcp)).to be_falsey
|
249
|
+
expect(@p_esp.contains?(@p_udp)).to be_falsey
|
250
250
|
end
|
251
251
|
|
252
252
|
it 'should be true, tcp/udp includes tcp/udp' do
|
253
|
-
@p_tcp.contains?(@p_tcp2).
|
254
|
-
@p_udp.contains?(@p_udp2).
|
253
|
+
expect(@p_tcp.contains?(@p_tcp2)).to be_truthy
|
254
|
+
expect(@p_udp.contains?(@p_udp2)).to be_truthy
|
255
255
|
end
|
256
256
|
|
257
257
|
it 'should be false, tcp/udp not includes ip/udp/tcp' do
|
258
|
-
@p_tcp.contains?(@p_ip).
|
259
|
-
@p_tcp.contains?(@p_udp).
|
260
|
-
@p_tcp.contains?(@p_esp).
|
261
|
-
@p_udp.contains?(@p_ip).
|
262
|
-
@p_udp.contains?(@p_tcp).
|
263
|
-
@p_udp.contains?(@p_esp).
|
258
|
+
expect(@p_tcp.contains?(@p_ip)).to be_falsey
|
259
|
+
expect(@p_tcp.contains?(@p_udp)).to be_falsey
|
260
|
+
expect(@p_tcp.contains?(@p_esp)).to be_falsey
|
261
|
+
expect(@p_udp.contains?(@p_ip)).to be_falsey
|
262
|
+
expect(@p_udp.contains?(@p_tcp)).to be_falsey
|
263
|
+
expect(@p_udp.contains?(@p_esp)).to be_falsey
|
264
264
|
end
|
265
265
|
end
|
266
266
|
|
@@ -285,26 +285,26 @@ EOL
|
|
285
285
|
|
286
286
|
it 'should be number string when it not match IOS acl literal' do
|
287
287
|
aups = AceIpProtoSpec.new(255)
|
288
|
-
aups.to_s.
|
288
|
+
expect(aups.to_s).to be_aclstr('255')
|
289
289
|
end
|
290
290
|
|
291
291
|
it 'should be error when out of range port number' do
|
292
|
-
|
292
|
+
expect do
|
293
293
|
AceIpProtoSpec.new(256)
|
294
|
-
end.
|
294
|
+
end.to raise_error(AclArgumentError)
|
295
295
|
|
296
|
-
|
296
|
+
expect do
|
297
297
|
AceIpProtoSpec.new(-1)
|
298
|
-
end.
|
298
|
+
end.to raise_error(AclArgumentError)
|
299
299
|
end
|
300
300
|
|
301
301
|
it 'should be error when not specified name/number' do
|
302
|
-
|
302
|
+
expect do
|
303
303
|
AceIpProtoSpec.new
|
304
|
-
end.
|
305
|
-
|
304
|
+
end.to raise_error(AclArgumentError)
|
305
|
+
expect do
|
306
306
|
AceIpProtoSpec.new('')
|
307
|
-
end.
|
307
|
+
end.to raise_error(AclArgumentError)
|
308
308
|
end
|
309
309
|
end
|
310
310
|
end
|
@@ -23,15 +23,15 @@ describe AceSrcDstSpec do
|
|
23
23
|
end
|
24
24
|
|
25
25
|
it 'should be true when same ip/netmask/wildcard' do
|
26
|
-
(@sds1 == @sds2).
|
26
|
+
expect(@sds1 == @sds2).to be_truthy
|
27
27
|
end
|
28
28
|
|
29
29
|
it 'should be false when different operator' do
|
30
|
-
(@sds1 == @sds3).
|
30
|
+
expect(@sds1 == @sds3).to be_falsey
|
31
31
|
end
|
32
32
|
|
33
33
|
it 'should be false when different ip' do
|
34
|
-
(@sds1 == @sds4).
|
34
|
+
expect(@sds1 == @sds4).to be_falsey
|
35
35
|
end
|
36
36
|
end
|
37
37
|
|
@@ -42,7 +42,7 @@ describe AceSrcDstSpec do
|
|
42
42
|
ipaddr: '192.168.3.3',
|
43
43
|
wildcard: '0.0.0.127'
|
44
44
|
)
|
45
|
-
sds.to_s.
|
45
|
+
expect(sds.to_s).to be_aclstr('192.168.3.0 0.0.0.127')
|
46
46
|
end
|
47
47
|
|
48
48
|
it 'should be "192.168.3.0 eq www" with L4 port' do
|
@@ -52,17 +52,17 @@ describe AceSrcDstSpec do
|
|
52
52
|
operator: 'eq',
|
53
53
|
port: AceTcpProtoSpec.new(80)
|
54
54
|
)
|
55
|
-
sds.to_s.
|
55
|
+
expect(sds.to_s).to be_aclstr('192.168.3.0 0.0.0.127 eq www')
|
56
56
|
end
|
57
57
|
end
|
58
58
|
|
59
59
|
context 'Argument error case' do
|
60
60
|
it 'should be raise exception when :ipaddr not specified' do
|
61
|
-
|
61
|
+
expect do
|
62
62
|
AceSrcDstSpec.new(
|
63
63
|
wildcard: '0.0.0.127'
|
64
64
|
)
|
65
|
-
end.
|
65
|
+
end.to raise_error(AclArgumentError)
|
66
66
|
end
|
67
67
|
## TBD, error handling must be written in detail
|
68
68
|
end
|
@@ -91,28 +91,48 @@ describe AceSrcDstSpec do
|
|
91
91
|
end
|
92
92
|
|
93
93
|
it 'should be true when match ip and ANY port' do
|
94
|
-
|
95
|
-
|
94
|
+
expect(
|
95
|
+
@sds0.contains?(_srcdst(@ip_match, :eq, @p1_match))
|
96
|
+
).to be_truthy
|
97
|
+
expect(
|
98
|
+
@sds0.contains?(_srcdst(@ip_match, :eq, @p1_unmatch))
|
99
|
+
).to be_truthy
|
96
100
|
end
|
97
101
|
|
98
102
|
it 'should be false when unmatch ip and ANY port' do
|
99
|
-
|
100
|
-
|
103
|
+
expect(
|
104
|
+
@sds0.contains?(_srcdst(@ip_unmatch, :eq, @p1_match))
|
105
|
+
).to be_falsey
|
106
|
+
expect(
|
107
|
+
@sds0.contains?(_srcdst(@ip_unmatch, :eq, @p1_unmatch))
|
108
|
+
).to be_falsey
|
101
109
|
end
|
102
110
|
|
103
111
|
it 'should be true when match ip and contained port set' do
|
104
|
-
|
105
|
-
|
112
|
+
expect(
|
113
|
+
@sds1.contains?(_srcdst(@ip_match, :eq, @p1_lower))
|
114
|
+
).to be_truthy
|
115
|
+
expect(
|
116
|
+
@sds1.contains?(_srcdst(@ip_match, :lt, @p1_match))
|
117
|
+
).to be_truthy
|
106
118
|
end
|
107
119
|
|
108
120
|
it 'should be false when unmatch ip and contained port set' do
|
109
|
-
|
110
|
-
|
121
|
+
expect(
|
122
|
+
@sds1.contains?(_srcdst(@ip_unmatch, :eq, @p1_lower))
|
123
|
+
).to be_falsey
|
124
|
+
expect(
|
125
|
+
@sds1.contains?(_srcdst(@ip_unmatch, :lt, @p1_match))
|
126
|
+
).to be_falsey
|
111
127
|
end
|
112
128
|
|
113
129
|
it 'should be false when match ip and not-contained port set' do
|
114
|
-
|
115
|
-
|
130
|
+
expect(
|
131
|
+
@sds1.contains?(_srcdst(@ip_match, :eq, @p1_match))
|
132
|
+
).to be_falsey
|
133
|
+
expect(
|
134
|
+
@sds1.contains?(_srcdst(@ip_match, :lt, @p1_higher))
|
135
|
+
).to be_falsey
|
116
136
|
end
|
117
137
|
end
|
118
138
|
|
@@ -133,41 +153,49 @@ describe AceSrcDstSpec do
|
|
133
153
|
end
|
134
154
|
|
135
155
|
it 'should be true when contained (length)' do
|
136
|
-
|
137
|
-
|
156
|
+
expect(
|
157
|
+
@sds0.contains?(_srcdst(@ip_contained1, :eq, @p1_match))
|
158
|
+
).to be_truthy
|
159
|
+
expect(
|
160
|
+
@sds1.contains?(_srcdst(@ip_contained1, :eq, @p1_match))
|
161
|
+
).to be_truthy
|
138
162
|
end
|
139
163
|
|
140
164
|
it 'should be true when contained (bitmask)' do
|
141
|
-
|
142
|
-
|
165
|
+
expect(
|
166
|
+
@sds0.contains?(_srcdst(@ip_contained2, :eq, @p1_match))
|
167
|
+
).to be_truthy
|
168
|
+
expect(
|
169
|
+
@sds1.contains?(_srcdst(@ip_contained2, :eq, @p1_match))
|
170
|
+
).to be_truthy
|
143
171
|
end
|
144
172
|
|
145
173
|
it 'should be false when not contained (length)' do
|
146
|
-
|
147
|
-
_srcdst(@ip_not_contained1, :eq, @p1_match)
|
148
|
-
).
|
149
|
-
|
150
|
-
_srcdst(@ip_not_contained1, :eq, @p1_match)
|
151
|
-
).
|
174
|
+
expect(
|
175
|
+
@sds0.contains?(_srcdst(@ip_not_contained1, :eq, @p1_match))
|
176
|
+
).to be_falsey
|
177
|
+
expect(
|
178
|
+
@sds1.contains?(_srcdst(@ip_not_contained1, :eq, @p1_match))
|
179
|
+
).to be_falsey
|
152
180
|
end
|
153
181
|
|
154
182
|
it 'should be false when not contained (bitmask)' do
|
155
|
-
|
156
|
-
_srcdst(@ip_not_contained2, :eq, @p1_match)
|
157
|
-
).
|
158
|
-
|
159
|
-
_srcdst(@ip_not_contained2, :eq, @p1_match)
|
160
|
-
).
|
183
|
+
expect(
|
184
|
+
@sds0.contains?(_srcdst(@ip_not_contained2, :eq, @p1_match))
|
185
|
+
).to be_falsey
|
186
|
+
expect(
|
187
|
+
@sds1.contains?(_srcdst(@ip_not_contained2, :eq, @p1_match))
|
188
|
+
).to be_falsey
|
161
189
|
end
|
162
190
|
|
163
191
|
it 'should be raised error when invalid subnet notation' do
|
164
|
-
|
192
|
+
expect do
|
165
193
|
@sds0.contains?(_srcdst(@ip_error1, :eq, @p1_match))
|
166
|
-
end.
|
194
|
+
end.to raise_error(NetAddr::ValidationError)
|
167
195
|
|
168
|
-
|
196
|
+
expect do
|
169
197
|
@sds1.contains?(_srcdst(@ip_error1, :eq, @p1_match))
|
170
|
-
end.
|
198
|
+
end.to raise_error(NetAddr::ValidationError)
|
171
199
|
|
172
200
|
# lambda do
|
173
201
|
# @sds0.contains?(_srcdst(@ip_error2, :eq, @p1_match)).should be_false
|
@@ -198,16 +226,24 @@ describe AceSrcDstSpec do
|
|
198
226
|
end
|
199
227
|
|
200
228
|
it 'should be true, with match ip in range port' do
|
201
|
-
|
229
|
+
expect(
|
230
|
+
@sds.contains?(_srcdst(@ip_match, :eq, @p_in))
|
231
|
+
).to be_truthy
|
202
232
|
end
|
203
233
|
|
204
234
|
it 'should be false, with match ip and out of range port' do
|
205
|
-
|
206
|
-
|
235
|
+
expect(
|
236
|
+
@sds.contains?(_srcdst(@ip_match, :eq, @p_out_lower))
|
237
|
+
).to be_falsey
|
238
|
+
expect(
|
239
|
+
@sds.contains?(_srcdst(@ip_match, :eq, @p_out_higher))
|
240
|
+
).to be_falsey
|
207
241
|
end
|
208
242
|
|
209
243
|
it 'should be false, with unmatch ip match in range port' do
|
210
|
-
|
244
|
+
expect(
|
245
|
+
@sds.contains?(_srcdst(@ip_unmatch, :eq, @p_in))
|
246
|
+
).to be_falsey
|
211
247
|
end
|
212
248
|
end
|
213
249
|
|
@@ -248,32 +284,55 @@ describe AceSrcDstSpec do
|
|
248
284
|
end
|
249
285
|
|
250
286
|
it 'should be true, for any ip' do
|
251
|
-
|
252
|
-
|
287
|
+
expect(
|
288
|
+
@sds1.contains?(_srcdst(@ip_match, :eq, @p_match))
|
289
|
+
).to be_truthy
|
290
|
+
expect(
|
291
|
+
@sds1.contains?(_srcdst(@ip_unmatch, :eq, @p_match))
|
292
|
+
).to be_truthy
|
253
293
|
end
|
254
294
|
|
255
295
|
it 'should be false, for any ip with unmatch port' do
|
256
|
-
|
257
|
-
|
296
|
+
expect(
|
297
|
+
@sds1.contains?(_srcdst(@ip_match, :eq, @p_unmatch))
|
298
|
+
).to be_falsey
|
299
|
+
expect(
|
300
|
+
@sds1.contains?(_srcdst(@ip_unmatch, :eq, @p_unmatch))
|
301
|
+
).to be_falsey
|
258
302
|
end
|
259
303
|
|
260
304
|
it 'should be true, for any port' do
|
261
|
-
|
262
|
-
|
305
|
+
expect(
|
306
|
+
@sds2.contains?(_srcdst(@ip_match, :eq, @p_match))
|
307
|
+
).to be_truthy
|
308
|
+
expect(
|
309
|
+
@sds2.contains?(_srcdst(@ip_match, :eq, @p_unmatch))
|
310
|
+
).to be_truthy
|
263
311
|
end
|
264
312
|
|
265
313
|
it 'should be false, for any port with unmatch ip' do
|
266
|
-
|
267
|
-
|
314
|
+
expect(
|
315
|
+
@sds2.contains?(_srcdst(@ip_unmatch, :eq, @p_match))
|
316
|
+
).to be_falsey
|
317
|
+
expect(
|
318
|
+
@sds2.contains?(_srcdst(@ip_unmatch, :eq, @p_unmatch))
|
319
|
+
).to be_falsey
|
268
320
|
end
|
269
321
|
|
270
322
|
it 'should be true, for any ip and any port' do
|
271
|
-
|
272
|
-
|
273
|
-
|
274
|
-
|
323
|
+
expect(
|
324
|
+
@sds3.contains?(_srcdst(@ip_match, :eq, @p_match))
|
325
|
+
).to be_truthy
|
326
|
+
expect(
|
327
|
+
@sds3.contains?(_srcdst(@ip_match, :eq, @p_unmatch))
|
328
|
+
).to be_truthy
|
329
|
+
expect(
|
330
|
+
@sds3.contains?(_srcdst(@ip_unmatch, :eq, @p_match))
|
331
|
+
).to be_truthy
|
332
|
+
expect(
|
333
|
+
@sds3.contains?(_srcdst(@ip_unmatch, :eq, @p_unmatch))
|
334
|
+
).to be_truthy
|
275
335
|
end
|
276
336
|
end
|
277
|
-
|
278
337
|
end # describe contains?
|
279
338
|
end # describe AceSrcDstSpec
|