66 lines
3.0 KiB
Diff
66 lines
3.0 KiB
Diff
From 5d36e0f55887c6204e07bd8095ead1ce2d535ddb Mon Sep 17 00:00:00 2001
|
|
From: Eric Garver <e@erig.me>
|
|
Date: Fri, 2 Nov 2018 14:10:38 -0400
|
|
Subject: [PATCH 025/127] rich rules: fix mark action
|
|
|
|
They were being placed in the wrong (and nonexistent) chain. Also add
|
|
test coverage for the "mark" action.
|
|
|
|
Fixes: 7c5f5f4d12ee ("fw_zone: push rich rule generation to backend")
|
|
Tested-by: Felix Kaechele <heffer@fedoraproject.org>
|
|
---
|
|
src/firewall/core/ipXtables.py | 4 ++--
|
|
src/firewall/core/nftables.py | 4 ++--
|
|
src/tests/firewall-cmd.at | 1 +
|
|
3 files changed, 5 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
|
|
index 11aebec6..b98ba522 100644
|
|
--- a/src/firewall/core/ipXtables.py
|
|
+++ b/src/firewall/core/ipXtables.py
|
|
@@ -807,10 +807,10 @@ class ip4tables(object):
|
|
chain = "%s_deny" % target
|
|
rule_action = [ "-j", "DROP" ]
|
|
elif type(rich_rule.action) == Rich_Mark:
|
|
- chain = "%s_allow" % target
|
|
- table = "mangle"
|
|
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["PREROUTING"],
|
|
zone=zone)
|
|
+ table = "mangle"
|
|
+ chain = "%s_allow" % target
|
|
rule_action = [ "-j", "MARK", "--set-xmark", rich_rule.action.set ]
|
|
else:
|
|
raise FirewallError(INVALID_RULE,
|
|
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
index cd05b2c3..69236a96 100644
|
|
--- a/src/firewall/core/nftables.py
|
|
+++ b/src/firewall/core/nftables.py
|
|
@@ -723,10 +723,10 @@ class nftables(object):
|
|
chain = "%s_%s_deny" % (table, target)
|
|
rule_action = ["drop"]
|
|
elif type(rich_rule.action) == Rich_Mark:
|
|
- table = "mangle"
|
|
- chain = "%s_%s_allow" % (table, target)
|
|
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["PREROUTING"],
|
|
zone=zone)
|
|
+ table = "mangle"
|
|
+ chain = "%s_%s_allow" % (table, target)
|
|
rule_action = ["meta", "mark", "set", rich_rule.action.set]
|
|
else:
|
|
raise FirewallError(INVALID_RULE,
|
|
diff --git a/src/tests/firewall-cmd.at b/src/tests/firewall-cmd.at
|
|
index b7ec3816..f31c8955 100644
|
|
--- a/src/tests/firewall-cmd.at
|
|
+++ b/src/tests/firewall-cmd.at
|
|
@@ -863,6 +863,7 @@ FWD_START_TEST([rich rules good])
|
|
rich_rule_test([rule forward-port port="66" to-port="666" to-addr="192.168.100.2" protocol="sctp" family="ipv4" source address="192.168.2.100"])
|
|
rich_rule_test([rule forward-port port="99" to-port="999" to-addr="1::2:3:4:7" protocol="dccp" family="ipv6" source address="1:2:3:4:6::"])
|
|
rich_rule_test([rule forward-port port="99" to-port="10999" to-addr="1::2:3:4:7" protocol="dccp" family="ipv6" source address="1:2:3:4:6::"])
|
|
+ rich_rule_test([rule family="ipv4" port port="222" protocol="tcp" mark set="0xff"])
|
|
FWD_END_TEST
|
|
FWD_START_TEST([rich rules audit])
|
|
CHECK_LOG_AUDIT
|
|
--
|
|
2.19.1
|
|
|