|
 |
725d6a |
From 0b69b4e464f02ea6fec50522b587a93092040b4d Mon Sep 17 00:00:00 2001
|
|
|
725d6a |
From: Eric Garver <eric@garver.life>
|
|
|
725d6a |
Date: Thu, 27 Aug 2020 15:59:13 -0400
|
|
|
725d6a |
Subject: [PATCH 51/62] fix(rich): clamp the IP families to those actually
|
|
|
725d6a |
enabled
|
|
|
725d6a |
|
|
|
725d6a |
One scenario is if IPv6 is not available, but we specify an icmp-type
|
|
|
725d6a |
that is ipv6 only, then we'll still attempt to call the IPv6 backend. We
|
|
|
725d6a |
should not do that.
|
|
|
725d6a |
|
|
|
725d6a |
(cherry picked from commit 4fcb27bdcf8be30d91d490ba2c0286af1cf299de)
|
|
|
725d6a |
(cherry picked from commit b8b0aeaaf853546f6990e8f635d7ea79233bbc79)
|
|
|
725d6a |
---
|
|
|
725d6a |
src/firewall/core/fw_zone.py | 5 ++++-
|
|
|
725d6a |
src/tests/regression/rhbz1855140.at | 2 --
|
|
|
725d6a |
2 files changed, 4 insertions(+), 3 deletions(-)
|
|
|
725d6a |
|
|
|
725d6a |
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
|
|
|
725d6a |
index 9d8bcf620251..bd026222dce5 100644
|
|
|
725d6a |
--- a/src/firewall/core/fw_zone.py
|
|
|
725d6a |
+++ b/src/firewall/core/fw_zone.py
|
|
|
725d6a |
@@ -1542,7 +1542,10 @@ class FirewallZone(object):
|
|
|
725d6a |
ipvs = [ source_ipv ]
|
|
|
725d6a |
|
|
|
725d6a |
if not ipvs:
|
|
|
725d6a |
- ipvs = [ipv for ipv in ["ipv4", "ipv6"] if self._fw.is_ipv_enabled(ipv)]
|
|
|
725d6a |
+ ipvs = ["ipv4", "ipv6"]
|
|
|
725d6a |
+
|
|
|
725d6a |
+ # clamp ipvs to those that are actually enabled.
|
|
|
725d6a |
+ ipvs = [ipv for ipv in ipvs if self._fw.is_ipv_enabled(ipv)]
|
|
|
725d6a |
|
|
|
725d6a |
# add an element to object to allow backends to know what ipvs this applies to
|
|
|
725d6a |
rule.ipvs = ipvs
|
|
|
725d6a |
diff --git a/src/tests/regression/rhbz1855140.at b/src/tests/regression/rhbz1855140.at
|
|
|
725d6a |
index cea943e0bf24..8059e29fe71a 100644
|
|
|
725d6a |
--- a/src/tests/regression/rhbz1855140.at
|
|
|
725d6a |
+++ b/src/tests/regression/rhbz1855140.at
|
|
|
725d6a |
@@ -2,9 +2,7 @@ FWD_START_TEST([rich rule icmptypes with one family])
|
|
|
725d6a |
AT_KEYWORDS(rich icmp rhbz1855140)
|
|
|
725d6a |
|
|
|
725d6a |
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="echo-request" accept'], 0, ignore)
|
|
|
725d6a |
-IF_HOST_SUPPORTS_IPV6_RULES([
|
|
|
725d6a |
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="neighbour-advertisement" accept'], 0, ignore)
|
|
|
725d6a |
-])
|
|
|
725d6a |
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="timestamp-request" accept'], 0, ignore)
|
|
|
725d6a |
FWD_RELOAD
|
|
|
725d6a |
NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
|
|
|
725d6a |
--
|
|
|
725d6a |
2.28.0
|
|
|
725d6a |
|