|
 |
24f428 |
From 681ca12830d89c8b2f527c7ffee7e75ce83f1abc Mon Sep 17 00:00:00 2001
|
|
|
24f428 |
From: Eric Garver <e@erig.me>
|
|
|
24f428 |
Date: Wed, 5 Dec 2018 17:16:30 -0500
|
|
|
24f428 |
Subject: [PATCH 06/23] nftables: fix rich rule masquerade
|
|
|
24f428 |
|
|
|
24f428 |
(cherry picked from commit aee4948e86fde6df8205b07f4da58e2a8c07377c)
|
|
|
24f428 |
---
|
|
|
24f428 |
src/firewall/core/nftables.py | 7 +++----
|
|
|
24f428 |
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
24f428 |
|
|
|
24f428 |
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
|
24f428 |
index 44cd4f9e1752..00a02ad149e5 100644
|
|
|
24f428 |
--- a/src/firewall/core/nftables.py
|
|
|
24f428 |
+++ b/src/firewall/core/nftables.py
|
|
|
24f428 |
@@ -900,7 +900,6 @@ class nftables(object):
|
|
|
24f428 |
|
|
|
24f428 |
rule_fragment = []
|
|
|
24f428 |
if rich_rule:
|
|
|
24f428 |
- rule_fragment += self._rich_rule_family_fragment(rich_rule.family)
|
|
|
24f428 |
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
|
|
|
24f428 |
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
|
|
|
24f428 |
|
|
|
24f428 |
@@ -912,10 +911,10 @@ class nftables(object):
|
|
|
24f428 |
# nat tables needs to use ip/ip6 family
|
|
|
24f428 |
rules = []
|
|
|
24f428 |
if rich_rule and (rich_rule.family and rich_rule.family == "ipv6"
|
|
|
24f428 |
- or rich_rule.source and check_address("ipv6", rich_rule.source)):
|
|
|
24f428 |
+ or rich_rule.source and check_address("ipv6", rich_rule.source.addr)):
|
|
|
24f428 |
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip6", rich_rule))
|
|
|
24f428 |
- if rich_rule and (rich_rule.family and rich_rule.family == "ipv4"
|
|
|
24f428 |
- or rich_rule.source and check_address("ipv4", rich_rule.source)):
|
|
|
24f428 |
+ elif rich_rule and (rich_rule.family and rich_rule.family == "ipv4"
|
|
|
24f428 |
+ or rich_rule.source and check_address("ipv4", rich_rule.source.addr)):
|
|
|
24f428 |
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip", rich_rule))
|
|
|
24f428 |
else:
|
|
|
24f428 |
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip6", rich_rule))
|
|
|
24f428 |
--
|
|
|
24f428 |
2.20.1
|
|
|
24f428 |
|