Blame SOURCES/0024-fix-rich-rule-forward-port-deletion-after-reload.patch

c8bceb
From 582db194cc697f79a17ac543076dd4bbe1216db6 Mon Sep 17 00:00:00 2001
c8bceb
From: Eric Garver <eric@garver.life>
c8bceb
Date: Thu, 11 Apr 2019 11:14:40 -0400
c8bceb
Subject: [PATCH 24/73] fix: rich rule forward-port deletion after reload
c8bceb
c8bceb
Simplify mark allocation for rich rules and make sure we use the mark in
c8bceb
apply_zone_settings().
c8bceb
c8bceb
Fixes: #482
c8bceb
Fixes: rhbz 1637675
c8bceb
(cherry picked from commit 362ebff8016116f831b83d3c9ee65858055b2c91)
c8bceb
(cherry picked from commit ab365b6a49a6f78b1c8394fca20b69623f9b9061)
c8bceb
---
c8bceb
 src/firewall/core/fw_zone.py | 40 +++++++++++++++++++-----------------
c8bceb
 1 file changed, 21 insertions(+), 19 deletions(-)
c8bceb
c8bceb
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
c8bceb
index d5eafb863439..d98ff2259087 100644
c8bceb
--- a/src/firewall/core/fw_zone.py
c8bceb
+++ b/src/firewall/core/fw_zone.py
c8bceb
@@ -323,8 +323,12 @@ class FirewallZone(object):
c8bceb
                     elif key == "masquerade":
c8bceb
                         self._masquerade(enable, _zone, zone_transaction)
c8bceb
                     elif key == "rules":
c8bceb
+                        if "mark" in obj.settings["rules"][args]:
c8bceb
+                            mark = obj.settings["rules"][args]["mark"]
c8bceb
+                        else:
c8bceb
+                            mark = None
c8bceb
                         self.__rule(enable, _zone,
c8bceb
-                                    Rich_Rule(rule_str=args), None,
c8bceb
+                                    Rich_Rule(rule_str=args), mark,
c8bceb
                                     zone_transaction)
c8bceb
                     elif key == "interfaces":
c8bceb
                         self._interface(enable, _zone, args, zone_transaction)
c8bceb
@@ -672,8 +676,7 @@ class FirewallZone(object):
c8bceb
         return None
c8bceb
 
c8bceb
     def __rule(self, enable, zone, rule, mark_id, zone_transaction):
c8bceb
-        return self._rule_prepare(enable, zone, rule, mark_id,
c8bceb
-                                  zone_transaction)
c8bceb
+        self._rule_prepare(enable, zone, rule, mark_id, zone_transaction)
c8bceb
 
c8bceb
     def add_rule(self, zone, rule, timeout=0, sender=None,
c8bceb
                  use_zone_transaction=None):
c8bceb
@@ -692,13 +695,16 @@ class FirewallZone(object):
c8bceb
         else:
c8bceb
             zone_transaction = use_zone_transaction
c8bceb
 
c8bceb
-        if _obj.applied:
c8bceb
-            mark = self.__rule(True, _zone, rule, None, zone_transaction)
c8bceb
+        if type(rule.element) == Rich_ForwardPort:
c8bceb
+            mark = self._fw.new_mark()
c8bceb
         else:
c8bceb
             mark = None
c8bceb
 
c8bceb
+        if _obj.applied:
c8bceb
+            self.__rule(True, _zone, rule, mark, zone_transaction)
c8bceb
+
c8bceb
         self.__register_rule(_obj, rule_id, mark, timeout, sender)
c8bceb
-        zone_transaction.add_fail(self.__unregister_rule, _obj, rule_id)
c8bceb
+        zone_transaction.add_fail(self.__unregister_rule, _obj, rule_id, mark)
c8bceb
 
c8bceb
         if use_zone_transaction is None:
c8bceb
             zone_transaction.execute(True)
c8bceb
@@ -720,28 +726,31 @@ class FirewallZone(object):
c8bceb
             raise FirewallError(errors.NOT_ENABLED,
c8bceb
                                 "'%s' not in '%s'" % (rule, _zone))
c8bceb
 
c8bceb
+        if "mark" in _obj.settings["rules"][rule_id]:
c8bceb
+            mark = _obj.settings["rules"][rule_id]["mark"]
c8bceb
+        else:
c8bceb
+            mark = None
c8bceb
+
c8bceb
         if use_zone_transaction is None:
c8bceb
             zone_transaction = self.new_zone_transaction(_zone)
c8bceb
         else:
c8bceb
             zone_transaction = use_zone_transaction
c8bceb
 
c8bceb
-        if "mark" in _obj.settings["rules"][rule_id]:
c8bceb
-            mark = _obj.settings["rules"][rule_id]["mark"]
c8bceb
-        else:
c8bceb
-            mark = None
c8bceb
         if _obj.applied:
c8bceb
             self.__rule(False, _zone, rule, mark, zone_transaction)
c8bceb
 
c8bceb
-        zone_transaction.add_post(self.__unregister_rule, _obj, rule_id)
c8bceb
+        zone_transaction.add_post(self.__unregister_rule, _obj, rule_id, mark)
c8bceb
 
c8bceb
         if use_zone_transaction is None:
c8bceb
             zone_transaction.execute(True)
c8bceb
 
c8bceb
         return _zone
c8bceb
 
c8bceb
-    def __unregister_rule(self, _obj, rule_id):
c8bceb
+    def __unregister_rule(self, _obj, rule_id, mark=None):
c8bceb
         if rule_id in _obj.settings["rules"]:
c8bceb
             del _obj.settings["rules"][rule_id]
c8bceb
+        if mark:
c8bceb
+            self._fw.del_mark(mark)
c8bceb
 
c8bceb
     def query_rule(self, zone, rule):
c8bceb
         return self.__rule_id(rule) in self.get_settings(zone)["rules"]
c8bceb
@@ -1705,9 +1714,6 @@ class FirewallZone(object):
c8bceb
                     if toaddr and enable:
c8bceb
                         zone_transaction.add_post(enable_ip_forwarding, ipv)
c8bceb
 
c8bceb
-                if enable:
c8bceb
-                    mark_id = self._fw.new_mark()
c8bceb
-
c8bceb
                 filter_chain = "INPUT" if not toaddr else "FORWARD_IN"
c8bceb
 
c8bceb
                 if enable:
c8bceb
@@ -1720,10 +1726,6 @@ class FirewallZone(object):
c8bceb
                                     toaddr, mark_id, rule)
c8bceb
                 zone_transaction.add_rules(backend, rules)
c8bceb
 
c8bceb
-                if not enable:
c8bceb
-                    zone_transaction.add_post(self._fw.del_mark, mark_id)
c8bceb
-                    mark_id = None
c8bceb
-
c8bceb
             # SOURCE PORT
c8bceb
             elif type(rule.element) == Rich_SourcePort:
c8bceb
                 port = rule.element.port
c8bceb
-- 
c8bceb
2.20.1
c8bceb