From b81c4e04ad26fd73dfdd024efd9fc60561ce0ab2 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Thu, 8 Nov 2018 12:42:43 -0500 Subject: [PATCH 21/34] rich rules: allow catch-all rules Since we now support rich rule priorities it makes sense to allow catch-all rules if priority is specified. But disallow it for priority==0 as this will cause unexpected results for the user (always drop everything). (cherry picked from commit df846d7a6c20582a2db79d690526662990e8541f) --- src/firewall/core/rich.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/firewall/core/rich.py b/src/firewall/core/rich.py index c415bf39212f..f0e4af54f32c 100644 --- a/src/firewall/core/rich.py +++ b/src/firewall/core/rich.py @@ -544,7 +544,7 @@ class Rich_Rule(object): if self.element is None: if self.action is None: raise FirewallError(errors.INVALID_RULE, "no element, no action") - if self.source is None and self.destination is None: + if self.source is None and self.destination is None and self.priority == 0: raise FirewallError(errors.INVALID_RULE, "no element, no source, no destination") if type(self.element) not in [ Rich_IcmpBlock, -- 2.18.0