From 582db194cc697f79a17ac543076dd4bbe1216db6 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Thu, 11 Apr 2019 11:14:40 -0400 Subject: [PATCH 24/73] fix: rich rule forward-port deletion after reload Simplify mark allocation for rich rules and make sure we use the mark in apply_zone_settings(). Fixes: #482 Fixes: rhbz 1637675 (cherry picked from commit 362ebff8016116f831b83d3c9ee65858055b2c91) (cherry picked from commit ab365b6a49a6f78b1c8394fca20b69623f9b9061) --- src/firewall/core/fw_zone.py | 40 +++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py index d5eafb863439..d98ff2259087 100644 --- a/src/firewall/core/fw_zone.py +++ b/src/firewall/core/fw_zone.py @@ -323,8 +323,12 @@ class FirewallZone(object): elif key == "masquerade": self._masquerade(enable, _zone, zone_transaction) elif key == "rules": + if "mark" in obj.settings["rules"][args]: + mark = obj.settings["rules"][args]["mark"] + else: + mark = None self.__rule(enable, _zone, - Rich_Rule(rule_str=args), None, + Rich_Rule(rule_str=args), mark, zone_transaction) elif key == "interfaces": self._interface(enable, _zone, args, zone_transaction) @@ -672,8 +676,7 @@ class FirewallZone(object): return None def __rule(self, enable, zone, rule, mark_id, zone_transaction): - return self._rule_prepare(enable, zone, rule, mark_id, - zone_transaction) + self._rule_prepare(enable, zone, rule, mark_id, zone_transaction) def add_rule(self, zone, rule, timeout=0, sender=None, use_zone_transaction=None): @@ -692,13 +695,16 @@ class FirewallZone(object): else: zone_transaction = use_zone_transaction - if _obj.applied: - mark = self.__rule(True, _zone, rule, None, zone_transaction) + if type(rule.element) == Rich_ForwardPort: + mark = self._fw.new_mark() else: mark = None + if _obj.applied: + self.__rule(True, _zone, rule, mark, zone_transaction) + self.__register_rule(_obj, rule_id, mark, timeout, sender) - zone_transaction.add_fail(self.__unregister_rule, _obj, rule_id) + zone_transaction.add_fail(self.__unregister_rule, _obj, rule_id, mark) if use_zone_transaction is None: zone_transaction.execute(True) @@ -720,28 +726,31 @@ class FirewallZone(object): raise FirewallError(errors.NOT_ENABLED, "'%s' not in '%s'" % (rule, _zone)) + if "mark" in _obj.settings["rules"][rule_id]: + mark = _obj.settings["rules"][rule_id]["mark"] + else: + mark = None + if use_zone_transaction is None: zone_transaction = self.new_zone_transaction(_zone) else: zone_transaction = use_zone_transaction - if "mark" in _obj.settings["rules"][rule_id]: - mark = _obj.settings["rules"][rule_id]["mark"] - else: - mark = None if _obj.applied: self.__rule(False, _zone, rule, mark, zone_transaction) - zone_transaction.add_post(self.__unregister_rule, _obj, rule_id) + zone_transaction.add_post(self.__unregister_rule, _obj, rule_id, mark) if use_zone_transaction is None: zone_transaction.execute(True) return _zone - def __unregister_rule(self, _obj, rule_id): + def __unregister_rule(self, _obj, rule_id, mark=None): if rule_id in _obj.settings["rules"]: del _obj.settings["rules"][rule_id] + if mark: + self._fw.del_mark(mark) def query_rule(self, zone, rule): return self.__rule_id(rule) in self.get_settings(zone)["rules"] @@ -1705,9 +1714,6 @@ class FirewallZone(object): if toaddr and enable: zone_transaction.add_post(enable_ip_forwarding, ipv) - if enable: - mark_id = self._fw.new_mark() - filter_chain = "INPUT" if not toaddr else "FORWARD_IN" if enable: @@ -1720,10 +1726,6 @@ class FirewallZone(object): toaddr, mark_id, rule) zone_transaction.add_rules(backend, rules) - if not enable: - zone_transaction.add_post(self._fw.del_mark, mark_id) - mark_id = None - # SOURCE PORT elif type(rule.element) == Rich_SourcePort: port = rule.element.port -- 2.20.1