|
 |
e67a06 |
From 42c3c63410d53f1f1eef8a756202231a7872aafa Mon Sep 17 00:00:00 2001
|
|
|
66253d |
From: Eric Garver <eric@garver.life>
|
|
|
66253d |
Date: Tue, 4 Feb 2020 09:12:17 -0500
|
|
|
e67a06 |
Subject: [PATCH 2/6] RHEL only: default to AllowZoneDrifting=yes
|
|
|
66253d |
|
|
|
66253d |
---
|
|
|
66253d |
config/firewalld.conf | 4 ++--
|
|
|
66253d |
doc/xml/firewalld.conf.xml | 2 +-
|
|
|
66253d |
doc/xml/firewalld.dbus.xml | 2 +-
|
|
|
66253d |
src/firewall/config/__init__.py.in | 2 +-
|
|
|
e67a06 |
src/tests/cli/firewall-cmd.at | 8 ++++++++
|
|
|
66253d |
src/tests/dbus/firewalld.conf.at | 4 ++--
|
|
|
66253d |
src/tests/features/rfc3964_ipv4.at | 4 ++++
|
|
|
66253d |
src/tests/functions.at | 1 +
|
|
|
66253d |
src/tests/regression/rhbz1514043.at | 4 ++++
|
|
|
e67a06 |
src/tests/regression/rhbz1715977.at | 9 +++++++++
|
|
|
e67a06 |
10 files changed, 33 insertions(+), 7 deletions(-)
|
|
|
66253d |
|
|
|
66253d |
diff --git a/config/firewalld.conf b/config/firewalld.conf
|
|
|
66253d |
index 532f0452212e..f791b2358ab8 100644
|
|
|
66253d |
--- a/config/firewalld.conf
|
|
|
66253d |
+++ b/config/firewalld.conf
|
|
|
66253d |
@@ -71,5 +71,5 @@ RFC3964_IPv4=yes
|
|
|
66253d |
# Note: If "yes" packets will only drift from source based zones to interface
|
|
|
66253d |
# based zones (including the default zone). Packets never drift from interface
|
|
|
66253d |
# based zones to other interfaces based zones (including the default zone).
|
|
|
66253d |
-# Possible values; "yes", "no". Defaults to "no".
|
|
|
66253d |
-AllowZoneDrifting=no
|
|
|
66253d |
+# Possible values; "yes", "no". Defaults to "yes".
|
|
|
66253d |
+AllowZoneDrifting=yes
|
|
|
66253d |
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
|
|
|
66253d |
index fcfbfd2b68c1..c21ef87813bc 100644
|
|
|
66253d |
--- a/doc/xml/firewalld.conf.xml
|
|
|
66253d |
+++ b/doc/xml/firewalld.conf.xml
|
|
|
66253d |
@@ -197,7 +197,7 @@
|
|
|
66253d |
to interface based zones (including the default zone). Packets
|
|
|
66253d |
never drift from interface based zones to other interfaces
|
|
|
66253d |
based zones (including the default zone).
|
|
|
66253d |
- Valid values; "yes", "no". Defaults to "no".
|
|
|
66253d |
+ Valid values; "yes", "no". Defaults to "yes".
|
|
|
66253d |
</para>
|
|
|
66253d |
</listitem>
|
|
|
66253d |
</varlistentry>
|
|
|
66253d |
diff --git a/doc/xml/firewalld.dbus.xml b/doc/xml/firewalld.dbus.xml
|
|
|
66253d |
index 5d77af976443..77ad77c01675 100644
|
|
|
66253d |
--- a/doc/xml/firewalld.dbus.xml
|
|
|
66253d |
+++ b/doc/xml/firewalld.dbus.xml
|
|
|
66253d |
@@ -2591,7 +2591,7 @@
|
|
|
66253d |
to interface based zones (including the default zone). Packets
|
|
|
66253d |
never drift from interface based zones to other interfaces
|
|
|
66253d |
based zones (including the default zone).
|
|
|
66253d |
- Valid values; "yes", "no". Defaults to "no".
|
|
|
66253d |
+ Valid values; "yes", "no". Defaults to "yes".
|
|
|
66253d |
</para></listitem>
|
|
|
66253d |
</varlistentry>
|
|
|
66253d |
<varlistentry id="FirewallD1.config.Properties.AutomaticHelpers">
|
|
|
66253d |
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
|
|
|
66253d |
index 481eb8de758d..645c76b66c8d 100644
|
|
|
66253d |
--- a/src/firewall/config/__init__.py.in
|
|
|
66253d |
+++ b/src/firewall/config/__init__.py.in
|
|
|
66253d |
@@ -130,4 +130,4 @@ FALLBACK_AUTOMATIC_HELPERS = "no"
|
|
|
66253d |
FALLBACK_FIREWALL_BACKEND = "nftables"
|
|
|
66253d |
FALLBACK_FLUSH_ALL_ON_RELOAD = True
|
|
|
66253d |
FALLBACK_RFC3964_IPV4 = True
|
|
|
66253d |
-FALLBACK_ALLOW_ZONE_DRIFTING = False
|
|
|
66253d |
+FALLBACK_ALLOW_ZONE_DRIFTING = True
|
|
|
66253d |
diff --git a/src/tests/cli/firewall-cmd.at b/src/tests/cli/firewall-cmd.at
|
|
|
e67a06 |
index 74f480f8730f..c47c14ea1fc2 100644
|
|
|
66253d |
--- a/src/tests/cli/firewall-cmd.at
|
|
|
66253d |
+++ b/src/tests/cli/firewall-cmd.at
|
|
|
e67a06 |
@@ -696,6 +696,10 @@ FWD_START_TEST([ipset])
|
|
|
e67a06 |
CHECK_IPSET
|
|
|
e67a06 |
CHECK_IPSET_HASH_MAC
|
|
|
e67a06 |
|
|
|
e67a06 |
+ dnl Expected test results assume this is set to "no"
|
|
|
e67a06 |
+ AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
e67a06 |
+ FWD_RELOAD
|
|
|
e67a06 |
+
|
|
|
e67a06 |
FWD_CHECK([--permanent --new-ipset=foobar --type=hash:ip], 0, ignore)
|
|
|
e67a06 |
FWD_CHECK([--reload], 0, ignore)
|
|
|
e67a06 |
FWD_CHECK([--ipset=foobar --get-entries], 0, [
|
|
|
e67a06 |
@@ -1197,6 +1201,10 @@ FWD_START_TEST([rich rules priority])
|
|
|
66253d |
|
|
|
66253d |
CHECK_LOG_AUDIT
|
|
|
66253d |
|
|
|
66253d |
+ dnl Expected test results assume this is set to "no"
|
|
|
66253d |
+ AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
66253d |
+ FWD_RELOAD
|
|
|
66253d |
+
|
|
|
66253d |
dnl Verify generic layout of zone
|
|
|
66253d |
NFT_LIST_RULES([inet], [filter_IN_public], 0, [dnl
|
|
|
66253d |
table inet firewalld {
|
|
|
66253d |
diff --git a/src/tests/dbus/firewalld.conf.at b/src/tests/dbus/firewalld.conf.at
|
|
|
66253d |
index 35aead759a9c..4eefa3286f9f 100644
|
|
|
66253d |
--- a/src/tests/dbus/firewalld.conf.at
|
|
|
66253d |
+++ b/src/tests/dbus/firewalld.conf.at
|
|
|
66253d |
@@ -4,7 +4,7 @@ AT_KEYWORDS(dbus)
|
|
|
66253d |
dnl Verify defaults over dbus. Should be inline with default firewalld.conf.
|
|
|
66253d |
IF_HOST_SUPPORTS_NFT_FIB([
|
|
|
66253d |
DBUS_GETALL([config], [config], 0, [dnl
|
|
|
66253d |
-string "AllowZoneDrifting" : variant string "no"
|
|
|
66253d |
+string "AllowZoneDrifting" : variant string "yes"
|
|
|
66253d |
string "AutomaticHelpers" : variant string "no"
|
|
|
66253d |
string "CleanupOnExit" : variant string "no"
|
|
|
66253d |
string "DefaultZone" : variant string "public"
|
|
|
66253d |
@@ -18,7 +18,7 @@ string "MinimalMark" : variant int32 100
|
|
|
66253d |
string "RFC3964_IPv4" : variant string "yes"
|
|
|
66253d |
])], [
|
|
|
66253d |
DBUS_GETALL([config], [config], 0, [dnl
|
|
|
66253d |
-string "AllowZoneDrifting" : variant string "no"
|
|
|
66253d |
+string "AllowZoneDrifting" : variant string "yes"
|
|
|
66253d |
string "AutomaticHelpers" : variant string "no"
|
|
|
66253d |
string "CleanupOnExit" : variant string "no"
|
|
|
66253d |
string "DefaultZone" : variant string "public"
|
|
|
66253d |
diff --git a/src/tests/features/rfc3964_ipv4.at b/src/tests/features/rfc3964_ipv4.at
|
|
|
66253d |
index 54f5f756270b..15fef52612cc 100644
|
|
|
66253d |
--- a/src/tests/features/rfc3964_ipv4.at
|
|
|
66253d |
+++ b/src/tests/features/rfc3964_ipv4.at
|
|
|
66253d |
@@ -1,6 +1,10 @@
|
|
|
66253d |
FWD_START_TEST([RFC3964_IPv4])
|
|
|
66253d |
AT_KEYWORDS(rfc3964_ipv4)
|
|
|
66253d |
|
|
|
66253d |
+dnl Expected test results assume this is set to "no"
|
|
|
66253d |
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
66253d |
+FWD_RELOAD
|
|
|
66253d |
+
|
|
|
66253d |
AT_CHECK([sed -i 's/^LogDenied.*/LogDenied=all/' ./firewalld.conf])
|
|
|
66253d |
AT_CHECK([sed -i 's/^RFC3964_IPv4.*/RFC3964_IPv4=yes/' ./firewalld.conf])
|
|
|
66253d |
FWD_RELOAD
|
|
|
66253d |
diff --git a/src/tests/functions.at b/src/tests/functions.at
|
|
|
e67a06 |
index 5b3ed3ee4a5a..8f5ceba4d3f2 100644
|
|
|
66253d |
--- a/src/tests/functions.at
|
|
|
66253d |
+++ b/src/tests/functions.at
|
|
|
66253d |
@@ -230,6 +230,7 @@ m4_define([FWD_END_TEST], [
|
|
|
66253d |
IF_HOST_SUPPORTS_IP6TABLES([], [
|
|
|
66253d |
sed -i "/WARNING: ip6tables not usable, disabling IPv6 firewall/d" ./firewalld.log
|
|
|
66253d |
])
|
|
|
66253d |
+ sed -i "/WARNING: AllowZoneDrifting is enabled./d" ./firewalld.log
|
|
|
66253d |
if test x"$1" != x"ignore"; then
|
|
|
66253d |
if test -n "$1"; then
|
|
|
66253d |
sed -i $1 ./firewalld.log
|
|
|
66253d |
diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at
|
|
|
66253d |
index 241cf547f7f3..8e4846a078b8 100644
|
|
|
66253d |
--- a/src/tests/regression/rhbz1514043.at
|
|
|
66253d |
+++ b/src/tests/regression/rhbz1514043.at
|
|
|
66253d |
@@ -1,6 +1,10 @@
|
|
|
66253d |
FWD_START_TEST([--set-log-denied does not zero config])
|
|
|
66253d |
AT_KEYWORDS(log_denied rhbz1514043)
|
|
|
66253d |
|
|
|
66253d |
+dnl Expected test results assume this is set to "no"
|
|
|
66253d |
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
|
|
|
66253d |
+FWD_RELOAD
|
|
|
66253d |
+
|
|
|
66253d |
FWD_CHECK([-q --set-log-denied=all])
|
|
|
66253d |
FWD_CHECK([-q --permanent --zone=public --add-service=samba])
|
|
|
66253d |
FWD_RELOAD
|
|
|
e67a06 |
diff --git a/src/tests/regression/rhbz1715977.at b/src/tests/regression/rhbz1715977.at
|
|
|
e67a06 |
index d548de72b90c..b9886e1a0a2b 100644
|
|
|
e67a06 |
--- a/src/tests/regression/rhbz1715977.at
|
|
|
e67a06 |
+++ b/src/tests/regression/rhbz1715977.at
|
|
|
e67a06 |
@@ -14,6 +14,7 @@ NFT_LIST_RULES([inet], [filter_IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
udp dport 137 ct state new,untracked accept
|
|
|
e67a06 |
udp dport 138 ct state new,untracked accept
|
|
|
e67a06 |
ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
|
|
|
e67a06 |
+ tcp dport 9090 ct state new,untracked accept
|
|
|
e67a06 |
ip daddr 192.168.122.235 tcp dport 22 ct state new,untracked accept
|
|
|
e67a06 |
}
|
|
|
e67a06 |
}
|
|
|
e67a06 |
@@ -23,6 +24,7 @@ IPTABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
+ ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT tcp -- 0.0.0.0/0 192.168.122.235 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
])
|
|
|
e67a06 |
IP6TABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
@@ -31,6 +33,7 @@ IP6TABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
ACCEPT udp ::/0 ::/0 udp dpt:137 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp ::/0 ::/0 udp dpt:138 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
+ ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
])
|
|
|
e67a06 |
|
|
|
e67a06 |
FWD_CHECK([-q --zone=internal --add-rich-rule='rule family=ipv4 destination address="192.168.111.222/32" source address="10.10.10.0/24" service name="ssh" accept'])
|
|
|
e67a06 |
@@ -44,6 +47,7 @@ NFT_LIST_RULES([inet], [filter_IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
udp dport 137 ct state new,untracked accept
|
|
|
e67a06 |
udp dport 138 ct state new,untracked accept
|
|
|
e67a06 |
ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
|
|
|
e67a06 |
+ tcp dport 9090 ct state new,untracked accept
|
|
|
e67a06 |
ip daddr 192.168.122.235 tcp dport 22 ct state new,untracked accept
|
|
|
e67a06 |
ip daddr 192.168.111.222 ip saddr 10.10.10.0/24 tcp dport 22 ct state new,untracked accept
|
|
|
e67a06 |
}
|
|
|
e67a06 |
@@ -54,6 +58,7 @@ IPTABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
+ ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT tcp -- 0.0.0.0/0 192.168.122.235 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT tcp -- 10.10.10.0/24 192.168.111.222 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
])
|
|
|
e67a06 |
@@ -63,6 +68,7 @@ IP6TABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
ACCEPT udp ::/0 ::/0 udp dpt:137 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp ::/0 ::/0 udp dpt:138 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
+ ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
])
|
|
|
e67a06 |
|
|
|
e67a06 |
FWD_CHECK([-q --zone=internal --add-rich-rule='rule family=ipv4 service name="ssdp" accept'])
|
|
|
e67a06 |
@@ -76,6 +82,7 @@ NFT_LIST_RULES([inet], [filter_IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
udp dport 137 ct state new,untracked accept
|
|
|
e67a06 |
udp dport 138 ct state new,untracked accept
|
|
|
e67a06 |
ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
|
|
|
e67a06 |
+ tcp dport 9090 ct state new,untracked accept
|
|
|
e67a06 |
ip daddr 192.168.122.235 tcp dport 22 ct state new,untracked accept
|
|
|
e67a06 |
ip daddr 192.168.111.222 ip saddr 10.10.10.0/24 tcp dport 22 ct state new,untracked accept
|
|
|
e67a06 |
ip daddr 239.255.255.250 udp dport 1900 ct state new,untracked accept
|
|
|
e67a06 |
@@ -87,6 +94,7 @@ IPTABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
+ ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT tcp -- 0.0.0.0/0 192.168.122.235 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT tcp -- 10.10.10.0/24 192.168.111.222 tcp dpt:22 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp -- 0.0.0.0/0 239.255.255.250 udp dpt:1900 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
@@ -97,6 +105,7 @@ IP6TABLES_LIST_RULES([filter], [IN_internal_allow], 0, [dnl
|
|
|
e67a06 |
ACCEPT udp ::/0 ::/0 udp dpt:137 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp ::/0 ::/0 udp dpt:138 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
+ ACCEPT tcp ::/0 ::/0 tcp dpt:9090 ctstate NEW,UNTRACKED
|
|
|
e67a06 |
])
|
|
|
e67a06 |
|
|
|
e67a06 |
FWD_CHECK([-q --zone=internal --add-rich-rule='rule family=ipv4 destination address="192.168.122.235/32" service name="mdns" accept'], 122, [ignore], [ignore])
|
|
|
66253d |
--
|
|
|
66253d |
2.23.0
|
|
|
66253d |
|