44 lines
1.6 KiB
Diff
44 lines
1.6 KiB
Diff
|
From a9abba630333970cc59d5fdcb1e92968b38f5eaa Mon Sep 17 00:00:00 2001
|
||
|
|
From: Eric Garver <e@erig.me>
|
||
|
|
Date: Thu, 11 Oct 2018 11:58:22 -0400
|
||
|
|
Subject: [PATCH 020/127] nftables: fix reject statement in "block" zone
|
||
|
|
|
||
|
|
Also add test coverage.
|
||
|
|
|
||
|
|
Fixes: #406
|
||
|
|
---
|
||
|
|
src/firewall/core/nftables.py | 3 ++-
|
||
|
|
src/tests/firewall-cmd.at | 2 ++
|
||
|
|
2 files changed, 4 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
||
|
|
index 8a305539..3c871069 100644
|
||
|
|
--- a/src/firewall/core/nftables.py
|
||
|
|
+++ b/src/firewall/core/nftables.py
|
||
|
|
@@ -619,7 +619,8 @@ class nftables(object):
|
||
|
|
target in ["ACCEPT", "REJECT", "%%REJECT%%", "DROP"] and \
|
||
|
|
chain in ["INPUT", "FORWARD_IN", "FORWARD_OUT", "OUTPUT"]:
|
||
|
|
rules.append(["add", "rule", family, "%s" % TABLE_NAME,
|
||
|
|
- "%s_%s" % (table, _zone), target.lower()])
|
||
|
|
+ "%s_%s" % (table, _zone),
|
||
|
|
+ target.lower() if target != "%%REJECT%%" else "%%REJECT%%"])
|
||
|
|
|
||
|
|
return rules
|
||
|
|
|
||
|
|
diff --git a/src/tests/firewall-cmd.at b/src/tests/firewall-cmd.at
|
||
|
|
index ef45110c..b7ec3816 100644
|
||
|
|
--- a/src/tests/firewall-cmd.at
|
||
|
|
+++ b/src/tests/firewall-cmd.at
|
||
|
|
@@ -69,6 +69,8 @@ FWD_START_TEST([zone interfaces])
|
||
|
|
FWD_CHECK([--zone=public --change-interface=dummy], 0, ignore)
|
||
|
|
FWD_CHECK([--get-zone-of-interface=dummy], 0, [public
|
||
|
|
])
|
||
|
|
+ FWD_CHECK([--zone=block --add-interface=dummy1], 0, ignore)
|
||
|
|
+ FWD_CHECK([--zone=block --remove-interface=dummy1], 0, ignore)
|
||
|
|
|
||
|
|
FWD_CHECK([--zone=dmz --change-zone=dummy], 0, ignore)
|
||
|
|
FWD_CHECK([--get-zone-of-interface=dummy], 0, [dmz
|
||
|
|
--
|
||
|
|
2.19.1
|
||
|
|
|