|
 |
47f735 |
From bccc66877af7baa95e70c4314e3016ac78c4bbc7 Mon Sep 17 00:00:00 2001
|
|
|
e4e66d |
From: Eric Garver <eric@garver.life>
|
|
|
e4e66d |
Date: Tue, 4 Feb 2020 09:12:17 -0500
|
|
|
47f735 |
Subject: [PATCH 02/22] RHEL only: default to AllowZoneDrifting=yes
|
|
|
e4e66d |
|
|
|
e4e66d |
---
|
|
|
47f735 |
config/firewalld.conf | 4 ++--
|
|
|
47f735 |
doc/xml/firewalld.conf.xml | 2 +-
|
|
|
47f735 |
doc/xml/firewalld.dbus.xml | 2 +-
|
|
|
47f735 |
src/firewall/config/__init__.py.in | 2 +-
|
|
|
47f735 |
src/tests/functions.at | 5 +++++
|
|
|
47f735 |
5 files changed, 10 insertions(+), 5 deletions(-)
|
|
|
e4e66d |
|
|
|
e4e66d |
diff --git a/config/firewalld.conf b/config/firewalld.conf
|
|
|
e4e66d |
index 532f0452212e..f791b2358ab8 100644
|
|
|
e4e66d |
--- a/config/firewalld.conf
|
|
|
e4e66d |
+++ b/config/firewalld.conf
|
|
|
e4e66d |
@@ -71,5 +71,5 @@ RFC3964_IPv4=yes
|
|
|
e4e66d |
# Note: If "yes" packets will only drift from source based zones to interface
|
|
|
e4e66d |
# based zones (including the default zone). Packets never drift from interface
|
|
|
e4e66d |
# based zones to other interfaces based zones (including the default zone).
|
|
|
e4e66d |
-# Possible values; "yes", "no". Defaults to "no".
|
|
|
e4e66d |
-AllowZoneDrifting=no
|
|
|
e4e66d |
+# Possible values; "yes", "no". Defaults to "yes".
|
|
|
e4e66d |
+AllowZoneDrifting=yes
|
|
|
e4e66d |
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
|
|
|
e4e66d |
index fcfbfd2b68c1..c21ef87813bc 100644
|
|
|
e4e66d |
--- a/doc/xml/firewalld.conf.xml
|
|
|
e4e66d |
+++ b/doc/xml/firewalld.conf.xml
|
|
|
e4e66d |
@@ -197,7 +197,7 @@
|
|
|
e4e66d |
to interface based zones (including the default zone). Packets
|
|
|
e4e66d |
never drift from interface based zones to other interfaces
|
|
|
e4e66d |
based zones (including the default zone).
|
|
|
e4e66d |
- Valid values; "yes", "no". Defaults to "no".
|
|
|
e4e66d |
+ Valid values; "yes", "no". Defaults to "yes".
|
|
|
e4e66d |
</para>
|
|
|
e4e66d |
</listitem>
|
|
|
e4e66d |
</varlistentry>
|
|
|
e4e66d |
diff --git a/doc/xml/firewalld.dbus.xml b/doc/xml/firewalld.dbus.xml
|
|
|
47f735 |
index b75067e12c51..d68c775ee5bf 100644
|
|
|
e4e66d |
--- a/doc/xml/firewalld.dbus.xml
|
|
|
e4e66d |
+++ b/doc/xml/firewalld.dbus.xml
|
|
|
47f735 |
@@ -2787,7 +2787,7 @@
|
|
|
e4e66d |
to interface based zones (including the default zone). Packets
|
|
|
e4e66d |
never drift from interface based zones to other interfaces
|
|
|
e4e66d |
based zones (including the default zone).
|
|
|
e4e66d |
- Valid values; "yes", "no". Defaults to "no".
|
|
|
e4e66d |
+ Valid values; "yes", "no". Defaults to "yes".
|
|
|
e4e66d |
</para></listitem>
|
|
|
e4e66d |
</varlistentry>
|
|
|
e4e66d |
<varlistentry id="FirewallD1.config.Properties.AutomaticHelpers">
|
|
|
e4e66d |
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
|
|
|
47f735 |
index e875e849dec1..0dec7913f694 100644
|
|
|
e4e66d |
--- a/src/firewall/config/__init__.py.in
|
|
|
e4e66d |
+++ b/src/firewall/config/__init__.py.in
|
|
|
47f735 |
@@ -133,4 +133,4 @@ FALLBACK_AUTOMATIC_HELPERS = "no"
|
|
|
e4e66d |
FALLBACK_FIREWALL_BACKEND = "nftables"
|
|
|
e4e66d |
FALLBACK_FLUSH_ALL_ON_RELOAD = True
|
|
|
e4e66d |
FALLBACK_RFC3964_IPV4 = True
|
|
|
e4e66d |
-FALLBACK_ALLOW_ZONE_DRIFTING = False
|
|
|
e4e66d |
+FALLBACK_ALLOW_ZONE_DRIFTING = True
|
|
|
e4e66d |
diff --git a/src/tests/functions.at b/src/tests/functions.at
|
|
|
47f735 |
index 6b1263b178dc..7ac28d514233 100644
|
|
|
e4e66d |
--- a/src/tests/functions.at
|
|
|
e4e66d |
+++ b/src/tests/functions.at
|
|
|
47f735 |
@@ -123,6 +123,11 @@ m4_define([FWD_START_TEST], [
|
|
|
47f735 |
dnl set the appropriate backend
|
|
|
47f735 |
AT_CHECK([sed -i 's/^FirewallBackend.*/FirewallBackend=FIREWALL_BACKEND/' ./firewalld.conf])
|
|
|
e4e66d |
|
|
|
47f735 |
+ dnl Expected test results assume this is set to "no", but downstream
|
|
|
47f735 |
+ dnl RHEL overrides it to "yes". Override it back to "no" so we don't
|
|
|
47f735 |
+ dnl have to fix up all the tests when bringing them from upstream.
|
|
|
47f735 |
+ AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
e4e66d |
+
|
|
|
47f735 |
dnl fib matching is pretty new in nftables. Don't use rpfilter on older
|
|
|
47f735 |
dnl kernels.
|
|
|
47f735 |
m4_if(nftables, FIREWALL_BACKEND, [
|
|
|
e4e66d |
--
|
|
|
47f735 |
2.27.0
|
|
|
e4e66d |
|