|
 |
c8bceb |
From b40b19e1de852aee5b1a53a26c8fb0e3e00b6a71 Mon Sep 17 00:00:00 2001
|
|
|
c8bceb |
From: Eric Garver <eric@garver.life>
|
|
|
c8bceb |
Date: Fri, 20 Sep 2019 09:48:07 -0400
|
|
|
c8bceb |
Subject: [PATCH 105/109] fix: service: usage of helpers with '-' in name
|
|
|
c8bceb |
|
|
|
c8bceb |
Fixes: 8c65bda2a750 ("fix: allow custom helpers using standard helper modules")
|
|
|
c8bceb |
(cherry picked from commit 28f3e6a83167ca2798157fd6e2c752b296c72830)
|
|
|
c8bceb |
(cherry picked from commit 98e77f8fb8fd6e72e71eb1267ea5ccbc0563cb83)
|
|
|
c8bceb |
---
|
|
|
c8bceb |
src/firewall/core/fw_zone.py | 6 +++---
|
|
|
c8bceb |
src/firewall/functions.py | 6 ++++--
|
|
|
c8bceb |
2 files changed, 7 insertions(+), 5 deletions(-)
|
|
|
c8bceb |
|
|
|
c8bceb |
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
|
|
|
c8bceb |
index c096e3efe028..e7be779ebc8c 100644
|
|
|
c8bceb |
--- a/src/firewall/core/fw_zone.py
|
|
|
c8bceb |
+++ b/src/firewall/core/fw_zone.py
|
|
|
c8bceb |
@@ -25,7 +25,7 @@ from firewall.core.base import SHORTCUTS, DEFAULT_ZONE_TARGET, \
|
|
|
c8bceb |
from firewall.core.logger import log
|
|
|
c8bceb |
from firewall.functions import portStr, checkIPnMask, checkIP6nMask, \
|
|
|
c8bceb |
checkProtocol, enable_ip_forwarding, check_single_address, check_mac, \
|
|
|
c8bceb |
- portInPortRange
|
|
|
c8bceb |
+ portInPortRange, get_nf_conntrack_short_name
|
|
|
c8bceb |
from firewall.core.rich import Rich_Rule, Rich_Accept, \
|
|
|
c8bceb |
Rich_Mark, Rich_Service, Rich_Port, Rich_Protocol, \
|
|
|
c8bceb |
Rich_Masquerade, Rich_ForwardPort, Rich_SourcePort, Rich_IcmpBlock, \
|
|
|
c8bceb |
@@ -1609,7 +1609,7 @@ class FirewallZone(object):
|
|
|
c8bceb |
modules = [ ]
|
|
|
c8bceb |
for helper in helpers:
|
|
|
c8bceb |
module = helper.module
|
|
|
c8bceb |
- _module_short_name = module.replace("-","_").replace("nf_conntrack_", "")
|
|
|
c8bceb |
+ _module_short_name = get_nf_conntrack_short_name(module)
|
|
|
c8bceb |
if self._fw.nf_conntrack_helper_setting == 0:
|
|
|
c8bceb |
if _module_short_name not in \
|
|
|
c8bceb |
self._fw.nf_conntrack_helpers[module]:
|
|
|
c8bceb |
@@ -1820,7 +1820,7 @@ class FirewallZone(object):
|
|
|
c8bceb |
if self._fw.nf_conntrack_helper_setting == 0:
|
|
|
c8bceb |
for helper in helpers:
|
|
|
c8bceb |
module = helper.module
|
|
|
c8bceb |
- _module_short_name = module.replace("-","_").replace("nf_conntrack_", "")
|
|
|
c8bceb |
+ _module_short_name = get_nf_conntrack_short_name(module)
|
|
|
c8bceb |
if _module_short_name not in \
|
|
|
c8bceb |
self._fw.nf_conntrack_helpers[module]:
|
|
|
c8bceb |
raise FirewallError(
|
|
|
c8bceb |
diff --git a/src/firewall/functions.py b/src/firewall/functions.py
|
|
|
c8bceb |
index 5f54a59204b8..ad2166905d1d 100644
|
|
|
c8bceb |
--- a/src/firewall/functions.py
|
|
|
c8bceb |
+++ b/src/firewall/functions.py
|
|
|
c8bceb |
@@ -345,6 +345,9 @@ def enable_ip_forwarding(ipv):
|
|
|
c8bceb |
return writefile("/proc/sys/net/ipv6/conf/all/forwarding", "1\n")
|
|
|
c8bceb |
return False
|
|
|
c8bceb |
|
|
|
c8bceb |
+def get_nf_conntrack_short_name(module):
|
|
|
c8bceb |
+ return module.replace("_","-").replace("nf-conntrack-", "")
|
|
|
c8bceb |
+
|
|
|
c8bceb |
def get_nf_conntrack_helpers():
|
|
|
c8bceb |
kver = os.uname()[2]
|
|
|
c8bceb |
path = "/lib/modules/%s/kernel/net/netfilter/" % kver
|
|
|
c8bceb |
@@ -361,8 +364,7 @@ def get_nf_conntrack_helpers():
|
|
|
c8bceb |
# the we add it to helpers list and goto next module
|
|
|
c8bceb |
if filename.startswith("nf_conntrack_proto_"):
|
|
|
c8bceb |
helper = filename.split(".")[0].strip()
|
|
|
c8bceb |
- helper = helper.replace("_", "-")
|
|
|
c8bceb |
- helper = helper.replace("nf-conntrack-", "")
|
|
|
c8bceb |
+ helper = get_nf_conntrack_short_name(helper)
|
|
|
c8bceb |
helpers.setdefault(module, [ ]).append(helper)
|
|
|
c8bceb |
continue
|
|
|
c8bceb |
# Else we get module alias and if "-helper" in the "alias:" line of modinfo
|
|
|
c8bceb |
--
|
|
|
c8bceb |
2.20.1
|
|
|
c8bceb |
|