From 44dff592c200f81d74b64ba1c729ec8ec3b8612e Mon Sep 17 00:00:00 2001

From: Eric Garver <eric@garver.life>

Date: Tue, 13 Apr 2021 14:35:31 -0400

Subject: [PATCH 23/30] fix(direct): rule order with multiple address with

 -s/-d

Fixes: rhbz 1940928

Fixes: rhbz 1949552

(cherry picked from commit 2be50d366b9ba073e5f86edcd0b412ff48c3fed1)

(cherry picked from commit a545183d6916169cd16648707b9f876ea0833955)

---

 src/firewall/core/fw_direct.py | 53 +++++++++++++++++++++++++++++-----

 src/firewall/core/ipXtables.py | 32 --------------------

 2 files changed, 46 insertions(+), 39 deletions(-)

diff --git a/src/firewall/core/fw_direct.py b/src/firewall/core/fw_direct.py

index e53a72e3326a..76aeda9f19cb 100644

--- a/src/firewall/core/fw_direct.py

+++ b/src/firewall/core/fw_direct.py

@@ -298,7 +298,7 @@ class FirewallDirect(object):

                 r.append((ipv, table, chain, priority, list(args)))

         return r

-    def _register_rule(self, rule_id, chain_id, priority, enable):

+    def _register_rule(self, rule_id, chain_id, priority, enable, count):

         if enable:

             if chain_id not in self._rules:

                 self._rules[chain_id] = LastUpdatedOrderedDict()

@@ -307,14 +307,14 @@ class FirewallDirect(object):

                 self._rule_priority_positions[chain_id] = { }

             if priority in self._rule_priority_positions[chain_id]:

-                self._rule_priority_positions[chain_id][priority] += 1

+                self._rule_priority_positions[chain_id][priority] += count

             else:

-                self._rule_priority_positions[chain_id][priority] = 1

+                self._rule_priority_positions[chain_id][priority] = count

         else:

             del self._rules[chain_id][rule_id]

             if len(self._rules[chain_id]) == 0:

                 del self._rules[chain_id]

-            self._rule_priority_positions[chain_id][priority] -= 1

+            self._rule_priority_positions[chain_id][priority] -= count

     # DIRECT PASSTHROUGH (untracked)

@@ -376,6 +376,34 @@ class FirewallDirect(object):

                 r.append(list(args))

         return r

+    def split_value(self, rules, opts):

+        """Split values combined with commas for options in opts"""

+

+        out_rules = [ ]

+        for rule in rules:

+            processed = False

+            for opt in opts:

+                try:

+                    i = rule.index(opt)

+                except ValueError:

+                    pass

+                else:

+                    if len(rule) > i and "," in rule[i+1]:

+                        # For all items in the comma separated list in index

+                        # i of the rule, a new rule is created with a single

+                        # item from this list

+                        processed = True

+                        items = rule[i+1].split(",")

+                        for item in items:

+                            _rule = rule[:]

+                            _rule[i+1] = item

+                            out_rules.append(_rule)

+            if not processed:

+                out_rules.append(rule)

+

+        return out_rules

+

+

     def _rule(self, enable, ipv, table, chain, priority, args, transaction):

         self._check_ipv_table(ipv, table)

         # Do not create zone chains if we're using nftables. Only allow direct

@@ -458,6 +486,7 @@ class FirewallDirect(object):

         # has index 1.

         index = 1

+        count = 0

         if chain_id in self._rule_priority_positions:

             positions = sorted(self._rule_priority_positions[chain_id].keys())

             j = 0

@@ -465,11 +494,21 @@ class FirewallDirect(object):

                 index += self._rule_priority_positions[chain_id][positions[j]]

                 j += 1

-        transaction.add_rule(backend, backend.build_rule(enable, table, _chain, index, args))

+        # split the direct rule in some cases as iptables-restore can't handle

+        # compound args.

+        #

+        args_list = [list(args)]

+        args_list = self.split_value(args_list, [ "-s", "--source" ])

+        args_list = self.split_value(args_list, [ "-d", "--destination" ])

+

+        for _args in args_list:

+            transaction.add_rule(backend, backend.build_rule(enable, table, _chain, index, tuple(_args)))

+            index += 1

+            count += 1

-        self._register_rule(rule_id, chain_id, priority, enable)

+        self._register_rule(rule_id, chain_id, priority, enable, count)

         transaction.add_fail(self._register_rule,

-                             rule_id, chain_id, priority, not enable)

+                             rule_id, chain_id, priority, not enable, count)

     def _chain(self, add, ipv, table, chain, transaction):

         self._check_ipv_table(ipv, table)

diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py

index 968b75867849..818ce3f153d0 100644

--- a/src/firewall/core/ipXtables.py

+++ b/src/firewall/core/ipXtables.py

@@ -200,36 +200,6 @@ class ip4tables(object):

                                                      " ".join(_args), ret))

         return ret

-    def split_value(self, rules, opts=None):

-        """Split values combined with commas for options in opts"""

-

-        if opts is None:

-            return rules

-

-        out_rules = [ ]

-        for rule in rules:

-            processed = False

-            for opt in opts:

-                try:

-                    i = rule.index(opt)

-                except ValueError:

-                    pass

-                else:

-                    if len(rule) > i and "," in rule[i+1]:

-                        # For all items in the comma separated list in index

-                        # i of the rule, a new rule is created with a single

-                        # item from this list

-                        processed = True

-                        items = rule[i+1].split(",")

-                        for item in items:

-                            _rule = rule[:]

-                            _rule[i+1] = item

-                            out_rules.append(_rule)

-            if not processed:

-                out_rules.append(rule)

-

-        return out_rules

-

     def _rule_replace(self, rule, pattern, replacement):

         try:

             i = rule.index(pattern)

@@ -472,8 +442,6 @@ class ip4tables(object):

         for table in table_rules:

             rules = table_rules[table]

-            rules = self.split_value(rules, [ "-s", "--source" ])

-            rules = self.split_value(rules, [ "-d", "--destination" ])

             temp_file.write("*%s\n" % table)

             for rule in rules:

-- 

2.27.0