|
 |
136e2c |
From b1590ac89253781d127ad40baa1abb8de7731cc9 Mon Sep 17 00:00:00 2001
|
|
|
136e2c |
From: Eric Garver <eric@garver.life>
|
|
|
136e2c |
Date: Tue, 16 Apr 2019 10:53:48 -0400
|
|
|
136e2c |
Subject: [PATCH 27/73] fix: nftables rich rule mark not marking every packet
|
|
|
136e2c |
|
|
|
136e2c |
Similar to the fix for #478, nftables needs to mark every packet, not
|
|
|
136e2c |
just the first one that begins a new connection.
|
|
|
136e2c |
|
|
|
136e2c |
(cherry picked from commit 9d98c11732bcbee4a74bd883cd9b6e7defb3b401)
|
|
|
136e2c |
(cherry picked from commit 7538a479e100d14d248a64c8a23d81ccc9723b9e)
|
|
|
136e2c |
---
|
|
|
136e2c |
src/firewall/core/nftables.py | 9 ++++++---
|
|
|
136e2c |
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
|
136e2c |
index 50303e94ed7b..02e2ca008157 100644
|
|
|
136e2c |
--- a/src/firewall/core/nftables.py
|
|
|
136e2c |
+++ b/src/firewall/core/nftables.py
|
|
|
136e2c |
@@ -798,7 +798,8 @@ class nftables(object):
|
|
|
136e2c |
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
|
|
|
136e2c |
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
|
|
|
136e2c |
rule_fragment += [proto, "dport", "%s" % portStr(port, "-")]
|
|
|
136e2c |
- rule_fragment += ["ct", "state", "new,untracked"]
|
|
|
136e2c |
+ if not rich_rule or type(rich_rule.action) != Rich_Mark:
|
|
|
136e2c |
+ rule_fragment += ["ct", "state", "new,untracked"]
|
|
|
136e2c |
|
|
|
136e2c |
rules = []
|
|
|
136e2c |
if rich_rule:
|
|
|
136e2c |
@@ -831,7 +832,8 @@ class nftables(object):
|
|
|
136e2c |
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
|
|
|
136e2c |
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
|
|
|
136e2c |
rule_fragment = ["meta", "l4proto", protocol]
|
|
|
136e2c |
- rule_fragment += ["ct", "state", "new,untracked"]
|
|
|
136e2c |
+ if not rich_rule or type(rich_rule.action) != Rich_Mark:
|
|
|
136e2c |
+ rule_fragment += ["ct", "state", "new,untracked"]
|
|
|
136e2c |
|
|
|
136e2c |
rules = []
|
|
|
136e2c |
if rich_rule:
|
|
|
136e2c |
@@ -864,7 +866,8 @@ class nftables(object):
|
|
|
136e2c |
rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
|
|
|
136e2c |
rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
|
|
|
136e2c |
rule_fragment += [proto, "sport", "%s" % portStr(port, "-")]
|
|
|
136e2c |
- rule_fragment += ["ct", "state", "new,untracked"]
|
|
|
136e2c |
+ if not rich_rule or type(rich_rule.action) != Rich_Mark:
|
|
|
136e2c |
+ rule_fragment += ["ct", "state", "new,untracked"]
|
|
|
136e2c |
|
|
|
136e2c |
rules = []
|
|
|
136e2c |
if rich_rule:
|
|
|
136e2c |
--
|
|
|
136e2c |
2.20.1
|
|
|
136e2c |
|