|
 |
fa246d |
From 2871abfceceba37c6ba38aa0ef25e23a059294ec Mon Sep 17 00:00:00 2001
|
|
|
fa246d |
From: Vrinda Punj <vpunj@redhat.com>
|
|
|
fa246d |
Date: Wed, 18 Nov 2020 13:14:44 -0500
|
|
|
fa246d |
Subject: [PATCH 67/68] fix(zone): add source with mac address
|
|
|
fa246d |
|
|
|
fa246d |
nftables supports matching the destination MAC, but iptables does not.
|
|
|
fa246d |
As such, lift the restriction from nftables. For iptables, gracefully
|
|
|
fa246d |
ignore the scenarios in which we attempt to match destination MAC.
|
|
|
fa246d |
|
|
|
fa246d |
Fixes: #703
|
|
|
fa246d |
Fixes: df4aefcbe7b7 ("improvement(ipXtables): add utility function match sources")
|
|
|
fa246d |
Fixes: 1582c5dd736a ("feat: nftables: convert to libnftables JSON interface")
|
|
|
fa246d |
|
|
|
fa246d |
Co-authored-by: Eric Garver <eric@garver.life>
|
|
|
fa246d |
(cherry picked from commit 20151fbb5c5104e3d4dbc4ea938b9a68bdbcf225)
|
|
|
fa246d |
(cherry picked from commit 79bb113a2a108ce1c69dc7bc7af60297b8ec2ad0)
|
|
|
fa246d |
---
|
|
|
fa246d |
src/firewall/core/ipXtables.py | 4 ++++
|
|
|
fa246d |
src/firewall/core/nftables.py | 2 --
|
|
|
fa246d |
src/tests/regression/gh703.at | 23 +++++++++++++++++++++++
|
|
|
fa246d |
src/tests/regression/regression.at | 1 +
|
|
|
fa246d |
4 files changed, 28 insertions(+), 2 deletions(-)
|
|
|
fa246d |
create mode 100644 src/tests/regression/gh703.at
|
|
|
fa246d |
|
|
|
fa246d |
diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
|
|
|
fa246d |
index 450e427c08b5..b28146edd060 100644
|
|
|
fa246d |
--- a/src/firewall/core/ipXtables.py
|
|
|
fa246d |
+++ b/src/firewall/core/ipXtables.py
|
|
|
fa246d |
@@ -814,6 +814,10 @@ class ip4tables(object):
|
|
|
fa246d |
else:
|
|
|
fa246d |
zone_dispatch_chain = "%s_ZONES" % (chain)
|
|
|
fa246d |
|
|
|
fa246d |
+ # iptables can not match destination MAC
|
|
|
fa246d |
+ if check_mac(address) and chain in ["POSTROUTING", "FORWARD_OUT", "OUTPUT"]:
|
|
|
fa246d |
+ return []
|
|
|
fa246d |
+
|
|
|
fa246d |
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain], zone=zone)
|
|
|
fa246d |
action = "-g"
|
|
|
fa246d |
|
|
|
fa246d |
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
|
fa246d |
index 0a73c2c2669d..a0a899dd3eef 100644
|
|
|
fa246d |
--- a/src/firewall/core/nftables.py
|
|
|
fa246d |
+++ b/src/firewall/core/nftables.py
|
|
|
fa246d |
@@ -1067,8 +1067,6 @@ class nftables(object):
|
|
|
fa246d |
return self._set_match_fragment(address[len("ipset:"):], True if "daddr" == addr_field else False, invert)
|
|
|
fa246d |
else:
|
|
|
fa246d |
if check_mac(address):
|
|
|
fa246d |
- if addr_field == "daddr":
|
|
|
fa246d |
- raise FirewallError(INVALID_RULE, "%s._rule_addr_fragment()", (self.__class__))
|
|
|
fa246d |
family = "ether"
|
|
|
fa246d |
elif check_single_address("ipv4", address):
|
|
|
fa246d |
family = "ip"
|
|
|
fa246d |
diff --git a/src/tests/regression/gh703.at b/src/tests/regression/gh703.at
|
|
|
fa246d |
new file mode 100644
|
|
|
fa246d |
index 000000000000..af724a7713a7
|
|
|
fa246d |
--- /dev/null
|
|
|
fa246d |
+++ b/src/tests/regression/gh703.at
|
|
|
fa246d |
@@ -0,0 +1,23 @@
|
|
|
fa246d |
+FWD_START_TEST([add source with mac address])
|
|
|
fa246d |
+AT_KEYWORDS(gh703)
|
|
|
fa246d |
+
|
|
|
fa246d |
+FWD_CHECK([--zone=home --add-source=34:7e:5c:3a:4c:32], 0, [ignore])
|
|
|
fa246d |
+
|
|
|
fa246d |
+NFT_LIST_RULES([ip], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
fa246d |
+ table ip firewalld {
|
|
|
fa246d |
+ chain nat_POSTROUTING_ZONES_SOURCE {
|
|
|
fa246d |
+ ether daddr 34:7e:5c:3a:4c:32 goto nat_POST_home
|
|
|
fa246d |
+ }
|
|
|
fa246d |
+ }
|
|
|
fa246d |
+])
|
|
|
fa246d |
+NFT_LIST_RULES([ip6], [nat_POSTROUTING_ZONES_SOURCE], 0, [dnl
|
|
|
fa246d |
+ table ip6 firewalld {
|
|
|
fa246d |
+ chain nat_POSTROUTING_ZONES_SOURCE {
|
|
|
fa246d |
+ ether daddr 34:7e:5c:3a:4c:32 goto nat_POST_home
|
|
|
fa246d |
+ }
|
|
|
fa246d |
+ }
|
|
|
fa246d |
+])
|
|
|
fa246d |
+
|
|
|
fa246d |
+dnl NOTE: iptables does _not_ support matching mac destination.
|
|
|
fa246d |
+
|
|
|
fa246d |
+FWD_END_TEST
|
|
|
fa246d |
diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at
|
|
|
fa246d |
index c1e8620ee700..7597a458076c 100644
|
|
|
fa246d |
--- a/src/tests/regression/regression.at
|
|
|
fa246d |
+++ b/src/tests/regression/regression.at
|
|
|
fa246d |
@@ -36,3 +36,4 @@ m4_include([regression/rhbz1541077.at])
|
|
|
fa246d |
m4_include([regression/rhbz1855140.at])
|
|
|
fa246d |
m4_include([regression/rhbz1871298.at])
|
|
|
fa246d |
m4_include([regression/rhbz1596304.at])
|
|
|
fa246d |
+m4_include([regression/gh703.at])
|
|
|
fa246d |
--
|
|
|
fa246d |
2.27.0
|
|
|
fa246d |
|