From 0b69b4e464f02ea6fec50522b587a93092040b4d Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Thu, 27 Aug 2020 15:59:13 -0400
Subject: [PATCH 51/62] fix(rich): clamp the IP families to those actually
enabled
One scenario is if IPv6 is not available, but we specify an icmp-type
that is ipv6 only, then we'll still attempt to call the IPv6 backend. We
should not do that.
(cherry picked from commit 4fcb27bdcf8be30d91d490ba2c0286af1cf299de)
(cherry picked from commit b8b0aeaaf853546f6990e8f635d7ea79233bbc79)
---
src/firewall/core/fw_zone.py | 5 ++++-
src/tests/regression/rhbz1855140.at | 2 --
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index 9d8bcf620251..bd026222dce5 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -1542,7 +1542,10 @@ class FirewallZone(object):
ipvs = [ source_ipv ]
if not ipvs:
- ipvs = [ipv for ipv in ["ipv4", "ipv6"] if self._fw.is_ipv_enabled(ipv)]
+ ipvs = ["ipv4", "ipv6"]
+
+ # clamp ipvs to those that are actually enabled.
+ ipvs = [ipv for ipv in ipvs if self._fw.is_ipv_enabled(ipv)]
# add an element to object to allow backends to know what ipvs this applies to
rule.ipvs = ipvs
diff --git a/src/tests/regression/rhbz1855140.at b/src/tests/regression/rhbz1855140.at
index cea943e0bf24..8059e29fe71a 100644
--- a/src/tests/regression/rhbz1855140.at
+++ b/src/tests/regression/rhbz1855140.at
@@ -2,9 +2,7 @@ FWD_START_TEST([rich rule icmptypes with one family])
AT_KEYWORDS(rich icmp rhbz1855140)
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="echo-request" accept'], 0, ignore)
-IF_HOST_SUPPORTS_IPV6_RULES([
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="neighbour-advertisement" accept'], 0, ignore)
-])
FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="timestamp-request" accept'], 0, ignore)
FWD_RELOAD
NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
--
2.28.0