From 0b69b4e464f02ea6fec50522b587a93092040b4d Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Thu, 27 Aug 2020 15:59:13 -0400 Subject: [PATCH 51/62] fix(rich): clamp the IP families to those actually enabled One scenario is if IPv6 is not available, but we specify an icmp-type that is ipv6 only, then we'll still attempt to call the IPv6 backend. We should not do that. (cherry picked from commit 4fcb27bdcf8be30d91d490ba2c0286af1cf299de) (cherry picked from commit b8b0aeaaf853546f6990e8f635d7ea79233bbc79) --- src/firewall/core/fw_zone.py | 5 ++++- src/tests/regression/rhbz1855140.at | 2 -- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py index 9d8bcf620251..bd026222dce5 100644 --- a/src/firewall/core/fw_zone.py +++ b/src/firewall/core/fw_zone.py @@ -1542,7 +1542,10 @@ class FirewallZone(object): ipvs = [ source_ipv ] if not ipvs: - ipvs = [ipv for ipv in ["ipv4", "ipv6"] if self._fw.is_ipv_enabled(ipv)] + ipvs = ["ipv4", "ipv6"] + + # clamp ipvs to those that are actually enabled. + ipvs = [ipv for ipv in ipvs if self._fw.is_ipv_enabled(ipv)] # add an element to object to allow backends to know what ipvs this applies to rule.ipvs = ipvs diff --git a/src/tests/regression/rhbz1855140.at b/src/tests/regression/rhbz1855140.at index cea943e0bf24..8059e29fe71a 100644 --- a/src/tests/regression/rhbz1855140.at +++ b/src/tests/regression/rhbz1855140.at @@ -2,9 +2,7 @@ FWD_START_TEST([rich rule icmptypes with one family]) AT_KEYWORDS(rich icmp rhbz1855140) FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="echo-request" accept'], 0, ignore) -IF_HOST_SUPPORTS_IPV6_RULES([ FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="neighbour-advertisement" accept'], 0, ignore) -]) FWD_CHECK([--permanent --zone public --add-rich-rule='rule icmp-type name="timestamp-request" accept'], 0, ignore) FWD_RELOAD NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl -- 2.28.0