From 08cb6f0c7abca95fa898020bb9f3ba3f4bfbf148 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Fri, 28 Aug 2020 13:15:34 -0400 Subject: [PATCH 53/62] fix(nftables): packet marks with masks (cherry picked from commit e296b926ae5dc4cbc277b6dd755d045e73ed4411) (cherry picked from commit 371efe757f2bde20b4301a78ed3c48ec1d31bf5e) --- src/firewall/core/fw_zone.py | 2 ++ src/firewall/core/nftables.py | 9 +++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py index 129306b6f969..6eaed4232405 100644 --- a/src/firewall/core/fw_zone.py +++ b/src/firewall/core/fw_zone.py @@ -1719,6 +1719,8 @@ class FirewallZone(object): if enable: transaction.add_chain(zone, table, "INPUT") transaction.add_chain(zone, table, "FORWARD_IN") + if enable and type(rule.action) == Rich_Mark: + transaction.add_chain(zone, "mangle", "PREROUTING") rules = backend.build_zone_icmp_block_rules(enable, zone, ict, rule) transaction.add_rules(backend, rules) diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py index 0198200b2372..76668a60468f 100644 --- a/src/firewall/core/nftables.py +++ b/src/firewall/core/nftables.py @@ -1043,8 +1043,13 @@ class nftables(object): zone=zone) table = "mangle" chain = "%s_%s_%s" % (table, target, chain_suffix) - rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, - "value": rich_rule.action.set}} + value = rich_rule.action.set.split("/") + if len(value) > 1: + rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, + "value": {"^": [{"&": [{"meta": {"key": "mark"}}, value[1]]}, value[0]]}}} + else: + rule_action = {"mangle": {"key": {"meta": {"key": "mark"}}, + "value": value[0]}} else: raise FirewallError(INVALID_RULE, "Unknown action %s" % type(rich_rule.action)) -- 2.28.0