From b5b705e22fa5e0b24d5b58bd4f333167ed83cfe7 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Fri, 24 Apr 2009 15:14:37 +0000
Subject: [PATCH] added test case for ip range

---
 test/ipt/objects-for-regression-tests.fwb | 130 ++++++++++++++++------
 1 file changed, 96 insertions(+), 34 deletions(-)

diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb
index 792e90b8a..6e1e8933e 100644
--- a/test/ipt/objects-for-regression-tests.fwb
+++ b/test/ipt/objects-for-regression-tests.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="10" lastModified="1239403597" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="10" lastModified="1240585297" id="root">
   <Library id="sysid99" name="Deleted Objects" comment="" ro="False">
     <ICMP6Service id="idE0C27650" code="0" type="1" name="ipv6 dest unreachable" comment="No route to destination" ro="False"/>
     <IPv4 id="id41D295E2" name="firewall30:ppp.200*:ip" comment="" ro="False" address="192.168.1.1" netmask="255.255.255.0"/>
@@ -804,10 +804,8 @@
     <Interface id="id42484X60089" bridgeport="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="ppp*" comment="" ro="False">
       <IPv4 id="id42486X60089" name="firewall71:ppp*:ip" comment="" ro="False" address="192.168.1.1" netmask="255.255.255.0"/>
     </Interface>
-    <ObjectRef ref="sysid0"/>
-    <ObjectRef ref="sysid0"/>
-    <ObjectRef ref="sysid0"/>
     <ObjectRef ref="id3B0221F1-ipv4"/>
+    <ObjectRef ref="id3CEBFF26"/>
   </Library>
   <Library id="syslib001" color="#d2ffd0" name="User" comment="User defined objects" ro="False">
     <ObjectGroup id="stdid01_1" name="Objects" comment="" ro="False">
@@ -1666,6 +1664,7 @@
         <AddressRange id="id3F6D17F4" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
         <AddressRange id="id40D153ED" name="old broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
         <AddressRange id="id4368AD8615884" name="ext_range" comment="" ro="False" start_address="22.22.22.100" end_address="22.22.22.110"/>
+        <AddressRange id="id42386X35957" name="r-192.168.1.0-include-fw" comment="this range includes address of the interface of firewall2" ro="False" start_address="192.168.1.1" end_address="192.168.1.100"/>
       </ObjectGroup>
     </ObjectGroup>
     <ServiceGroup id="stdid05_1" name="Services" comment="" ro="False">
@@ -5083,7 +5082,7 @@
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id3AFB66C6" host_OS="linux24" inactive="False" lastCompiled="1240458844" lastInstalled="1142003872" lastModified="1240458834" platform="iptables" version="" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " ro="False">
+      <Firewall id="id3AFB66C6" host_OS="linux24" inactive="False" lastCompiled="1240458844" lastInstalled="1142003872" lastModified="1240585346" platform="iptables" version="" name="firewall2" comment="this object has several interfaces and shows different rules for NAT. Also testing policy rule options " ro="False">
         <NAT id="id3AFB66C7" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <NATRule id="id3AFB66C8" disabled="False" position="0" comment="">
             <OSrc neg="False">
@@ -6617,7 +6616,28 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DD1E1E0" disabled="False" log="True" position="20" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id42387X35957" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="using module iprange if&#10;iptables version is &gt;= 1.2.11">
+            <Src neg="False">
+              <ObjectRef ref="id42386X35957"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="udp-SNMP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="color">#C0BA44</Option>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id3DD1E1E0" disabled="False" log="True" position="21" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -6635,7 +6655,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3D8FC846" disabled="False" log="False" position="21" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D8FC846" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FC56A"/>
@@ -6654,7 +6674,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3D8FC984" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3D8FC984" disabled="False" log="False" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
             </Src>
@@ -6673,7 +6693,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3DCBFEA0" disabled="False" log="False" position="23" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id3DCBFEA0" disabled="False" log="False" position="24" action="Reject" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -6694,7 +6714,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3DCBFEAD" disabled="False" log="False" position="24" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3DCBFEAD" disabled="False" log="False" position="25" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -6713,7 +6733,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3DD4C015" disabled="False" log="True" position="25" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id3DD4C015" disabled="False" log="True" position="26" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -6733,7 +6753,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447B8D" disabled="False" log="True" position="26" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
+          <PolicyRule id="id3C447B8D" disabled="False" log="True" position="27" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6758,7 +6778,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id3C447BCB" disabled="False" log="True" position="27" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id3C447BCB" disabled="False" log="True" position="28" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -6776,7 +6796,7 @@
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id3AFB66F9" disabled="False" log="True" position="28" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id3AFB66F9" disabled="False" log="True" position="29" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -30160,7 +30180,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">True</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id31158X1798" host_OS="linux24" inactive="False" lastCompiled="1215360886" lastInstalled="1142003872" lastModified="1232745617" platform="iptables" version="lt_1.2.6" name="firewall2-1" comment="copy of firewall2 but old iptables version" ro="False">
+      <Firewall id="id31158X1798" host_OS="linux24" inactive="False" lastCompiled="1215360886" lastInstalled="1142003872" lastModified="1240585393" platform="iptables" version="lt_1.2.6" name="firewall2-1" comment="copy of firewall2 but old iptables version" ro="False">
         <NAT id="id31415X1798" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <NATRule id="id31416X1798" disabled="False" position="0" comment="">
             <OSrc neg="False">
@@ -31652,7 +31672,28 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id31303X1798" disabled="False" log="True" position="20" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id80837X35957" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="using module iprange if&#10;iptables version is &gt;= 1.2.11">
+            <Src neg="False">
+              <ObjectRef ref="id42386X35957"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="udp-SNMP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="color">#C0BA44</Option>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id31303X1798" disabled="False" log="True" position="21" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -31670,7 +31711,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id31315X1798" disabled="False" log="False" position="21" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id31315X1798" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FC56A"/>
@@ -31689,7 +31730,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id31328X1798" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id31328X1798" disabled="False" log="False" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
             </Src>
@@ -31708,7 +31749,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id31341X1798" disabled="False" log="False" position="23" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id31341X1798" disabled="False" log="False" position="24" action="Reject" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -31729,7 +31770,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id31354X1798" disabled="False" log="False" position="24" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id31354X1798" disabled="False" log="False" position="25" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -31748,7 +31789,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id31367X1798" disabled="False" log="True" position="25" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id31367X1798" disabled="False" log="True" position="26" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -31768,7 +31809,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id31379X1798" disabled="False" log="True" position="26" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
+          <PolicyRule id="id31379X1798" disabled="False" log="True" position="27" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -31793,7 +31834,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id31391X1798" disabled="False" log="True" position="27" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id31391X1798" disabled="False" log="True" position="28" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -31811,7 +31852,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id31403X1798" disabled="False" log="True" position="28" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id31403X1798" disabled="False" log="True" position="29" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -31947,7 +31988,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
           <Option name="verify_interfaces">False</Option>
         </FirewallOptions>
       </Firewall>
-      <Firewall id="id32114X1798" host_OS="linux24" inactive="False" lastCompiled="1215360886" lastInstalled="1142003872" lastModified="1232745623" platform="iptables" version="1.4.0" name="firewall2-2" comment="another copy of firewall2 but new iptables version" ro="False">
+      <Firewall id="id32114X1798" host_OS="linux24" inactive="False" lastCompiled="1215360886" lastInstalled="1142003872" lastModified="1240585400" platform="iptables" version="1.4.0" name="firewall2-2" comment="another copy of firewall2 but new iptables version" ro="False">
         <NAT id="id32371X1798" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <NATRule id="id32372X1798" disabled="False" position="0" comment="">
             <OSrc neg="False">
@@ -33439,7 +33480,28 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id32259X1798" disabled="False" log="True" position="20" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id80854X35957" disabled="False" group="" log="False" position="20" action="Accept" direction="Both" comment="using module iprange if&#10;iptables version is &gt;= 1.2.11">
+            <Src neg="False">
+              <ObjectRef ref="id42386X35957"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="udp-SNMP"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="color">#C0BA44</Option>
+              <Option name="stateless">False</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id32259X1798" disabled="False" log="True" position="21" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B022266"/>
             </Src>
@@ -33457,7 +33519,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id32271X1798" disabled="False" log="False" position="21" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id32271X1798" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="id3B4572AF"/>
               <ObjectRef ref="id3D8FC56A"/>
@@ -33476,7 +33538,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id32284X1798" disabled="False" log="False" position="22" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id32284X1798" disabled="False" log="False" position="23" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="host-secondary1-com"/>
             </Src>
@@ -33495,7 +33557,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id32297X1798" disabled="False" log="False" position="23" action="Reject" direction="Both" comment="">
+          <PolicyRule id="id32297X1798" disabled="False" log="False" position="24" action="Reject" direction="Both" comment="">
             <Src neg="True">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -33516,7 +33578,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id32310X1798" disabled="False" log="False" position="24" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id32310X1798" disabled="False" log="False" position="25" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
               <ObjectRef ref="id3B022266"/>
@@ -33535,7 +33597,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id32323X1798" disabled="False" log="True" position="25" action="Deny" direction="Both" comment="">
+          <PolicyRule id="id32323X1798" disabled="False" log="True" position="26" action="Deny" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="net-Internal_net"/>
             </Src>
@@ -33555,7 +33617,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id32335X1798" disabled="False" log="True" position="26" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
+          <PolicyRule id="id32335X1798" disabled="False" log="True" position="27" action="Accept" direction="Both" comment="host-fw2 has the same address as &#10;        one of the firewall's interfaces">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -33580,7 +33642,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id32347X1798" disabled="False" log="True" position="27" action="Accept" direction="Both" comment="">
+          <PolicyRule id="id32347X1798" disabled="False" log="True" position="28" action="Accept" direction="Both" comment="">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -33598,7 +33660,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT%
             </When>
             <PolicyRuleOptions/>
           </PolicyRule>
-          <PolicyRule id="id32359X1798" disabled="False" log="True" position="28" action="Deny" direction="Both" comment="'catch all' rule">
+          <PolicyRule id="id32359X1798" disabled="False" log="True" position="29" action="Deny" direction="Both" comment="'catch all' rule">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>