T4072: Firewall op-mode command: add bridge capabilities

[nicolas-fort]

Change Summary

Add options to op-mode command show firewall in order to print bridge firewall

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):
  Change op-mode command show firewall

Related Task(s)

• https://vyos.dev/T4072

Component(s) name

firewall

Proposed changes

How to test

vyos@ssh-serv:~$ show firewall 
Rulesets Information

---------------------------------
ipv4 Firewall "forward filter"

  Rule  Action    Protocol      Packets    Bytes  Conditions
------  --------  ----------  ---------  -------  -----------------------------------------
    10  accept    all                 0        0  ct state { established, related }  accept
    20  drop      all                 0        0  ct state invalid
    30  accept    all                 0        0  iifname "eth1"  accept

---------------------------------
ipv4 Firewall "input filter"

Rule     Action    Protocol      Packets    Bytes  Conditions
-------  --------  ----------  ---------  -------  ------------------------------------------------------------------------------------------------------------------------
10       accept    all              1438  1815141  ct state { established, related }  accept
20       drop      all                 0        0  ct state invalid
30       accept    icmp                0        0  ct state new icmp type echo-request  accept
40       drop      tcp                 0        0  ct state new tcp dport 22 iifname "eth0" add @RECENT_INP_filter_40 { ip saddr limit rate over 4/minute burst 4 packets }
41       accept    tcp                 2      120  ct state new tcp dport 22  accept
default  drop      all

---------------------------------
ipv4 Firewall "name FOO"

  Rule  Action    Protocol      Packets    Bytes  Conditions
------  --------  ----------  ---------  -------  -----------------------------------------
    10  accept    tcp                 0        0  meta l4proto tcp ip saddr 1.1.1.1  accept

---------------------------------
bridge Firewall "forward filter"

Rule     Action    Protocol      Packets    Bytes  Conditions
------
10       continue  all                 0        0  iifname "eth2" vlan id 22  continue
20       drop      all                 0        0  iifname @I_TRUNK-RIGHT vlan id 60
30       jump      all                 0        0  oifname "eth1"  jump NAME_TEST
default  accept    all

---------------------------------
bridge Firewall "name TEST"

Rule     Action    Protocol      Packets    Bytes  Conditions
-------  --------  ----------  ---------  -------  -------------------------------------------------
10       continue  all                 0        0  prefix "[bri-NAM-TEST-10-C]" vlan pcp 0  continue
default  accept    all                 0        0

vyos@ssh-serv:~$ 
vyos@ssh-serv:~$ show firewall bridge 
Rulesets bridge Information

---------------------------------
bridge Firewall "forward filter"

Rule     Action    Protocol      Packets    Bytes  Conditions
-------  --------  ----------  ---------  -------  -----------------------------------
10       continue  all                 0        0  iifname "eth2" vlan id 22  continue
20       drop      all                 0        0  iifname @I_TRUNK-RIGHT vlan id 60
30       jump      all                 0        0  oifname "eth1"  jump NAME_TEST
default  accept    all

---------------------------------
bridge Firewall "name TEST"

Rule     Action    Protocol      Packets    Bytes  Conditions
-------  --------  ----------  ---------  -------  -------------------------------------------------
10       continue  all                 0        0  prefix "[bri-NAM-TEST-10-C]" vlan pcp 0  continue
default  accept    all                 0        0

vyos@ssh-serv:~$ 
vyos@ssh-serv:~$ show firewall statistics 
Rulesets Statistics

---------------------------------
ipv4 Firewall "forward filter"

Rule     Packets    Bytes    Action    Source    Destination    Inbound-Interface    Outbound-interface
-------  ---------  -------  --------  --------  -------------  -------------------  --------------------
10       0          0        accept    any       any            any                  any
20       0          0        drop      any       any            any                  any
30       0          0        accept    any       any            eth1                 any
default  N/A        N/A      accept    any       any            any                  any

---------------------------------
ipv4 Firewall "input filter"

Rule     Packets    Bytes    Action    Source    Destination    Inbound-Interface    Outbound-interface
-------  ---------  -------  --------  --------  -------------  -------------------  --------------------
10       1510       1820025  accept    any       any            any                  any
20       0          0        drop      any       any            any                  any
30       0          0        accept    any       any            any                  any
40       0          0        drop      any       any            eth0                 any
41       2          120      accept    any       any            any                  any
default  N/A        N/A      drop      any       any            any                  any

---------------------------------
ipv4 Firewall "name FOO"

  Rule    Packets    Bytes  Action    Source    Destination    Inbound-Interface    Outbound-interface
------  ---------  -------  --------  --------  -------------  -------------------  --------------------
    10          0        0  accept    1.1.1.1   any            any                  any

---------------------------------
bridge Firewall "forward filter"

Rule     Packets    Bytes    Action    Source    Destination    Inbound-Interface    Outbound-interface
-------  ---------  -------  --------  --------  -------------  -------------------  --------------------
10       0          0        continue  any       any            eth2                 any
20       0          0        drop      any       any            TRUNK-RIGHT          any
30       0          0        jump      any       any            any                  eth1
default  N/A        N/A      accept    any       any            any                  any

---------------------------------
bridge Firewall "name TEST"

Rule       Packets    Bytes  Action    Source    Destination    Inbound-Interface    Outbound-interface
-------  ---------  -------  --------  --------  -------------  -------------------  --------------------
10               0        0  continue  any       any            any                  any
default          0        0  accept    any       any            any                  any

vyos@ssh-serv:~$ 
vyos@ssh-serv:~$ show firewall summary 
Ruleset Summary

IPv4 Ruleset:

Ruleset Hook    Ruleset Priority    Description
--------------  ------------------  -------------
forward         filter
input           filter
name            FOO

Bridge Ruleset:

Ruleset Hook    Ruleset Priority    Description
--------------  ------------------  -------------
forward         filter
name            TEST

Firewall Groups

Name         Type             References    Members
-----------  ---------------  ------------  ---------
TRUNK-RIGHT  interface_group  N/D           eth4
vyos@ssh-serv:~$  

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly