From fcff9a0adbc8042544372e1af5d84b48e6d52c93 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Mon, 13 May 2019 09:40:31 -0400
Subject: [PATCH 32/37] fix: avoid calling backends that aren't available

We should operate just fine if some backend aren't available, e.g.
ip6tables. This fixes some areas that broke that.

Fixes: #491
(cherry picked from commit 3fdffa76be42ce88bff35ce2b84c2beda3c016a1)
(cherry picked from commit 86d003dcdbd2eb20ac32858f7cfa3074169d5b5e)
---
 src/firewall/core/fw.py      | 54 ++++++++++++++++++------------------
 src/firewall/core/fw_zone.py |  4 ++-
 2 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py
index abb25f0c3e72..998de99e9532 100644
--- a/src/firewall/core/fw.py
+++ b/src/firewall/core/fw.py
@@ -703,24 +703,24 @@ class Firewall(object):
     def get_backend_by_ipv(self, ipv):
         if self.nftables_enabled:
             return self.nftables_backend
-        if ipv == "ipv4":
+        if ipv == "ipv4" and self.ip4tables_enabled:
             return self.ip4tables_backend
-        elif ipv == "ipv6":
+        elif ipv == "ipv6" and self.ip6tables_enabled:
             return self.ip6tables_backend
-        elif ipv == "eb":
+        elif ipv == "eb" and self.ebtables_enabled:
             return self.ebtables_backend
         raise FirewallError(errors.INVALID_IPV,
-                            "'%s' is not a valid backend" % ipv)
+                            "'%s' is not a valid backend or is unavailable" % ipv)
 
     def get_direct_backend_by_ipv(self, ipv):
-        if ipv == "ipv4":
+        if ipv == "ipv4" and self.ip4tables_enabled:
             return self.ip4tables_backend
-        elif ipv == "ipv6":
+        elif ipv == "ipv6" and self.ip6tables_enabled:
             return self.ip6tables_backend
-        elif ipv == "eb":
+        elif ipv == "eb" and self.ebtables_enabled:
             return self.ebtables_backend
         raise FirewallError(errors.INVALID_IPV,
-                            "'%s' is not a valid backend" % ipv)
+                            "'%s' is not a valid backend or is unavailable" % ipv)
 
     def is_backend_enabled(self, name):
         if name == "ip4tables":
@@ -791,29 +791,29 @@ class Firewall(object):
             rules = backend.build_default_rules(self._log_denied)
             transaction.add_rules(backend, rules)
 
-        ipv6_backend = self.get_backend_by_ipv("ipv6")
-        if self.ipv6_rpfilter_enabled and \
-           "raw" in ipv6_backend.get_available_tables():
+        if self.is_ipv_enabled("ipv6"):
+            ipv6_backend = self.get_backend_by_ipv("ipv6")
+            if self.ipv6_rpfilter_enabled and \
+               "raw" in ipv6_backend.get_available_tables():
 
-            # Execute existing transaction
-            transaction.execute(True)
-            # Start new transaction
-            transaction.clear()
+                # Execute existing transaction
+                transaction.execute(True)
+                # Start new transaction
+                transaction.clear()
 
-            rules = ipv6_backend.build_rpfilter_rules(self._log_denied)
-            transaction.add_rules(ipv6_backend, rules)
+                rules = ipv6_backend.build_rpfilter_rules(self._log_denied)
+                transaction.add_rules(ipv6_backend, rules)
 
-            # Execute ipv6_rpfilter transaction, it might fail
-            try:
-                transaction.execute(True)
-            except FirewallError as msg:
-                log.warning("Applying rules for ipv6_rpfilter failed: %s", msg)
-            # Start new transaction
-            transaction.clear()
+                # Execute ipv6_rpfilter transaction, it might fail
+                try:
+                    transaction.execute(True)
+                except FirewallError as msg:
+                    log.warning("Applying rules for ipv6_rpfilter failed: %s", msg)
+                # Start new transaction
+                transaction.clear()
 
-        else:
-            if use_transaction is None:
-                transaction.execute(True)
+        if use_transaction is None:
+            transaction.execute(True)
 
     # flush and policy
 
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index d5eafb863439..31d7d6a168a8 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -1554,7 +1554,7 @@ class FirewallZone(object):
         if rule.family is not None:
             ipvs = [ rule.family ]
         else:
-            ipvs = [ "ipv4", "ipv6" ]
+            ipvs = [ipv for ipv in ["ipv4", "ipv6"] if self._fw.is_ipv_enabled(ipv)]
 
         source_ipv = self._rule_source_ipv(rule.source)
         if source_ipv is not None and source_ipv != "":
@@ -1804,6 +1804,8 @@ class FirewallZone(object):
         #
         backends_ipv = []
         for ipv in ["ipv4", "ipv6"]:
+            if not self._fw.is_ipv_enabled(ipv):
+                continue
             backend = self._fw.get_backend_by_ipv(ipv)
             if len(svc.destination) > 0:
                 if ipv in svc.destination:
-- 
2.20.1