|
 |
00d018 |
From 4d099f4c0866801e40e362090e6986c693386e2c Mon Sep 17 00:00:00 2001
|
|
|
00d018 |
From: Eric Garver <eric@garver.life>
|
|
|
00d018 |
Date: Thu, 27 Aug 2020 15:30:45 -0400
|
|
|
00d018 |
Subject: [PATCH 50/62] fix(icmptype): when applying rules get ict from perm
|
|
|
00d018 |
config
|
|
|
00d018 |
|
|
|
00d018 |
Otherwise we may get runtime errors because the running kernel doesn't
|
|
|
00d018 |
support the ict. Use the permanent ict definition so we allow the case
|
|
|
00d018 |
where ip6tables is missing or not available. Explicit usage of an ict
|
|
|
00d018 |
not supported by the kernel will still fail to apply at runtime
|
|
|
00d018 |
(iptables complains), but if ip6tables is missing we don't attempt to
|
|
|
00d018 |
apply the ipv6 rules thus avoiding the issue.
|
|
|
00d018 |
|
|
|
00d018 |
(cherry picked from commit fdc44800aef4ec166987d529ffaea51f13ff54c2)
|
|
|
00d018 |
(cherry picked from commit 0016ec8e4aefb6cf2a8986a91530eae25a28ead7)
|
|
|
00d018 |
---
|
|
|
00d018 |
src/firewall/core/fw_zone.py | 6 +++---
|
|
|
00d018 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
00d018 |
|
|
|
00d018 |
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
|
|
|
00d018 |
index b9fe1f6aae97..9d8bcf620251 100644
|
|
|
00d018 |
--- a/src/firewall/core/fw_zone.py
|
|
|
00d018 |
+++ b/src/firewall/core/fw_zone.py
|
|
|
00d018 |
@@ -1526,7 +1526,7 @@ class FirewallZone(object):
|
|
|
00d018 |
if rule.family:
|
|
|
00d018 |
ipvs = [ rule.family ]
|
|
|
00d018 |
elif rule.element and (isinstance(rule.element, Rich_IcmpBlock) or isinstance(rule.element, Rich_IcmpType)):
|
|
|
00d018 |
- ict = self._fw.icmptype.get_icmptype(rule.element.name)
|
|
|
00d018 |
+ ict = self._fw.config.get_icmptype(rule.element.name)
|
|
|
00d018 |
if ict.destination:
|
|
|
00d018 |
ipvs = [ipv for ipv in ["ipv4", "ipv6"] if ipv in ict.destination]
|
|
|
00d018 |
|
|
|
00d018 |
@@ -1698,7 +1698,7 @@ class FirewallZone(object):
|
|
|
00d018 |
# ICMP BLOCK and ICMP TYPE
|
|
|
00d018 |
elif type(rule.element) == Rich_IcmpBlock or \
|
|
|
00d018 |
type(rule.element) == Rich_IcmpType:
|
|
|
00d018 |
- ict = self._fw.icmptype.get_icmptype(rule.element.name)
|
|
|
00d018 |
+ ict = self._fw.config.get_icmptype(rule.element.name)
|
|
|
00d018 |
|
|
|
00d018 |
if type(rule.element) == Rich_IcmpBlock and \
|
|
|
00d018 |
rule.action and type(rule.action) == Rich_Accept:
|
|
|
00d018 |
@@ -1862,7 +1862,7 @@ class FirewallZone(object):
|
|
|
00d018 |
transaction.add_rules(backend, rules)
|
|
|
00d018 |
|
|
|
00d018 |
def _icmp_block(self, enable, zone, icmp, transaction):
|
|
|
00d018 |
- ict = self._fw.icmptype.get_icmptype(icmp)
|
|
|
00d018 |
+ ict = self._fw.config.get_icmptype(icmp)
|
|
|
00d018 |
|
|
|
00d018 |
if enable:
|
|
|
00d018 |
transaction.add_chain(zone, "filter", "INPUT")
|
|
|
00d018 |
--
|
|
|
00d018 |
2.28.0
|
|
|
00d018 |
|