Description
When firewall rules contain IP addresses, networks, or ranges entered directly in the rule, modifying a rule only generates the expected change for the parameter that has been edited.
When host sets are used, modifying any firewall rule also causes all host sets referenced by firewall rules to be expanded again in the pending changes.
This can generate a very large number of unrelated changes, making the pending changes difficult to understand and potentially slowing down the firewall during configuration and commit operations.
Steps to reproduce
- Create a host set containing multiple entries, for example 10 IP addresses or networks.
- Create a firewall rule using this host set.
- Create another firewall rule that does not use the host set.
- Modify any parameter of the second rule.
- Check the pending changes before applying the configuration.
- Notice that, in addition to the expected rule modification, all entries of the host set are included as additional changes.
The same behavior can also be reproduced by modifying a disabled rule.
Expected behavior
Modifying a firewall rule should generate only the changes related to the parameters actually modified by the user.
Unchanged host sets should not be expanded or rewritten when modifying unrelated firewall rules.
Actual behavior
If host sets are used in firewall rules, modifying any rule generates:
- the expected change related to the modified rule;
- additional changes caused by the expansion of all host sets referenced by firewall rules.
For example, if a host set contains 10 entries, modifying another unrelated rule generates 10 additional changes related to that host set.
With multiple or large host sets, a simple firewall rule modification can therefore generate a very large number of pending changes.
This introduces changes that are unrelated to the user action, makes the pending changes difficult to understand, and can noticeably slow down configuration and commit operations.
Components
Image version: NethSecurity 8.8.0
Description
When firewall rules contain IP addresses, networks, or ranges entered directly in the rule, modifying a rule only generates the expected change for the parameter that has been edited.
When host sets are used, modifying any firewall rule also causes all host sets referenced by firewall rules to be expanded again in the pending changes.
This can generate a very large number of unrelated changes, making the pending changes difficult to understand and potentially slowing down the firewall during configuration and commit operations.
Steps to reproduce
The same behavior can also be reproduced by modifying a disabled rule.
Expected behavior
Modifying a firewall rule should generate only the changes related to the parameters actually modified by the user.
Unchanged host sets should not be expanded or rewritten when modifying unrelated firewall rules.
Actual behavior
If host sets are used in firewall rules, modifying any rule generates:
For example, if a host set contains 10 entries, modifying another unrelated rule generates 10 additional changes related to that host set.
With multiple or large host sets, a simple firewall rule modification can therefore generate a very large number of pending changes.
This introduces changes that are unrelated to the user action, makes the pending changes difficult to understand, and can noticeably slow down configuration and commit operations.
Components
Image version: NethSecurity 8.8.0