|
 |
c8bceb |
From 2cb9ac1e34fd652e75147ca1d3f4495609448a04 Mon Sep 17 00:00:00 2001
|
|
|
c8bceb |
From: Eric Garver <eric@garver.life>
|
|
|
c8bceb |
Date: Fri, 23 Aug 2019 14:54:40 -0400
|
|
|
c8bceb |
Subject: [PATCH 91/99] fix: --add-masquerade should only affect ipv4
|
|
|
c8bceb |
|
|
|
c8bceb |
As per the man page. Users should use rich rules to get IPv6
|
|
|
c8bceb |
masquerading.
|
|
|
c8bceb |
|
|
|
c8bceb |
(cherry picked from commit 88e13653686e4b72b4964e41564c70ca0096e0a9)
|
|
|
c8bceb |
(cherry picked from commit 1e95c8d2f2a7d8a4b2f1ad34be268031ab5e9ba5)
|
|
|
c8bceb |
---
|
|
|
c8bceb |
src/firewall/core/fw_zone.py | 13 +++++--------
|
|
|
c8bceb |
src/firewall/core/nftables.py | 1 -
|
|
|
c8bceb |
2 files changed, 5 insertions(+), 9 deletions(-)
|
|
|
c8bceb |
|
|
|
c8bceb |
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
|
|
|
c8bceb |
index 1f33b5504d54..6b766d0dc3ba 100644
|
|
|
c8bceb |
--- a/src/firewall/core/fw_zone.py
|
|
|
c8bceb |
+++ b/src/firewall/core/fw_zone.py
|
|
|
c8bceb |
@@ -1893,15 +1893,12 @@ class FirewallZone(object):
|
|
|
c8bceb |
zone_transaction.add_chain("nat", "POSTROUTING")
|
|
|
c8bceb |
zone_transaction.add_chain("filter", "FORWARD_OUT")
|
|
|
c8bceb |
|
|
|
c8bceb |
- for ipv in ["ipv4", "ipv6"]:
|
|
|
c8bceb |
- zone_transaction.add_post(enable_ip_forwarding, ipv)
|
|
|
c8bceb |
+ ipv = "ipv4"
|
|
|
c8bceb |
+ zone_transaction.add_post(enable_ip_forwarding, ipv)
|
|
|
c8bceb |
|
|
|
c8bceb |
- for backend in self._fw.enabled_backends():
|
|
|
c8bceb |
- if not backend.zones_supported:
|
|
|
c8bceb |
- continue
|
|
|
c8bceb |
-
|
|
|
c8bceb |
- rules = backend.build_zone_masquerade_rules(enable, zone)
|
|
|
c8bceb |
- zone_transaction.add_rules(backend, rules)
|
|
|
c8bceb |
+ backend = self._fw.get_backend_by_ipv(ipv)
|
|
|
c8bceb |
+ rules = backend.build_zone_masquerade_rules(enable, zone)
|
|
|
c8bceb |
+ zone_transaction.add_rules(backend, rules)
|
|
|
c8bceb |
|
|
|
c8bceb |
def _forward_port(self, enable, zone, zone_transaction, port, protocol,
|
|
|
c8bceb |
toport=None, toaddr=None, mark_id=None):
|
|
|
c8bceb |
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
|
c8bceb |
index e6a4ec3518a8..baa6a7f58cfb 100644
|
|
|
c8bceb |
--- a/src/firewall/core/nftables.py
|
|
|
c8bceb |
+++ b/src/firewall/core/nftables.py
|
|
|
c8bceb |
@@ -973,7 +973,6 @@ class nftables(object):
|
|
|
c8bceb |
or rich_rule.source and check_address("ipv4", rich_rule.source.addr)):
|
|
|
c8bceb |
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip", rich_rule))
|
|
|
c8bceb |
else:
|
|
|
c8bceb |
- rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip6", rich_rule))
|
|
|
c8bceb |
rules.extend(self._build_zone_masquerade_nat_rules(enable, zone, "ip", rich_rule))
|
|
|
c8bceb |
|
|
|
c8bceb |
add_del = { True: "add", False: "delete" }[enable]
|
|
|
c8bceb |
--
|
|
|
c8bceb |
2.20.1
|
|
|
c8bceb |
|