111 lines
4.9 KiB
Diff
111 lines
4.9 KiB
Diff
From a628d6e3a710fb8379cf2fb319cdafc06dd2dad6 Mon Sep 17 00:00:00 2001
|
|
From: Eric Garver <e@erig.me>
|
|
Date: Thu, 30 Aug 2018 16:34:19 -0400
|
|
Subject: [PATCH] fedora patch to default to iptables backend
|
|
|
|
---
|
|
config/firewalld.conf | 7 -------
|
|
src/firewall/core/io/firewalld_conf.py | 17 +++++++++++++++++
|
|
src/tests/dbus/firewalld.conf.at | 2 +-
|
|
src/tests/functions.at | 4 ++--
|
|
4 files changed, 20 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/config/firewalld.conf b/config/firewalld.conf
|
|
index 532f045..0f64a56 100644
|
|
--- a/config/firewalld.conf
|
|
+++ b/config/firewalld.conf
|
|
@@ -40,13 +40,6 @@ IndividualCalls=no
|
|
# Default: off
|
|
LogDenied=off
|
|
|
|
-# FirewallBackend
|
|
-# Selects the firewall backend implementation.
|
|
-# Choices are:
|
|
-# - nftables (default)
|
|
-# - iptables (iptables, ip6tables, ebtables and ipset)
|
|
-FirewallBackend=nftables
|
|
-
|
|
# FlushAllOnReload
|
|
# Flush all runtime rules on a reload. In previous releases some runtime
|
|
# configuration was retained during a reload, namely; interface to zone
|
|
diff --git a/src/firewall/core/io/firewalld_conf.py b/src/firewall/core/io/firewalld_conf.py
|
|
index 7c70921..4e83d6e 100644
|
|
--- a/src/firewall/core/io/firewalld_conf.py
|
|
+++ b/src/firewall/core/io/firewalld_conf.py
|
|
@@ -268,6 +268,12 @@ class firewalld_conf(object):
|
|
if key not in done:
|
|
if (key in self._config and \
|
|
self._config[key] != value):
|
|
+ # Only write FirewallBackend if it's not the default.
|
|
+ # We will change the default in the future.
|
|
+ if key == "FirewallBackend" and \
|
|
+ self._config[key] == config.FALLBACK_FIREWALL_BACKEND:
|
|
+ done.append(key)
|
|
+ continue
|
|
empty = False
|
|
temp_file.write(u'%s=%s\n' %
|
|
(key, self._config[key]))
|
|
@@ -275,6 +281,12 @@ class firewalld_conf(object):
|
|
elif key in self._deleted:
|
|
modified = True
|
|
else:
|
|
+ # Only write FirewallBackend if it's not the default.
|
|
+ # We will change the default in the future.
|
|
+ if key == "FirewallBackend" and \
|
|
+ value == config.FALLBACK_FIREWALL_BACKEND:
|
|
+ done.append(key)
|
|
+ continue
|
|
empty = False
|
|
temp_file.write(line+u"\n")
|
|
done.append(key)
|
|
@@ -286,6 +298,11 @@ class firewalld_conf(object):
|
|
for (key,value) in self._config.items():
|
|
if key in done:
|
|
continue
|
|
+ # Only write FirewallBackend if it's not the default.
|
|
+ # We will change the default in the future.
|
|
+ if key == "FirewallBackend" and \
|
|
+ value == config.FALLBACK_FIREWALL_BACKEND:
|
|
+ continue
|
|
if key in ["MinimalMark", "AutomaticHelpers"]: # omit deprecated from new config
|
|
continue
|
|
if not empty:
|
|
diff --git a/src/tests/dbus/firewalld.conf.at b/src/tests/dbus/firewalld.conf.at
|
|
index cc15318..374312b 100644
|
|
--- a/src/tests/dbus/firewalld.conf.at
|
|
+++ b/src/tests/dbus/firewalld.conf.at
|
|
@@ -19,7 +19,7 @@ string "AllowZoneDrifting" : variant string "no"
|
|
string "AutomaticHelpers" : variant string "no"
|
|
string "CleanupOnExit" : variant string "no"
|
|
string "DefaultZone" : variant string "public"
|
|
-string "FirewallBackend" : variant string "nftables"
|
|
+string "FirewallBackend" : variant string "iptables"
|
|
string "FlushAllOnReload" : variant string "yes"
|
|
string "IPv6_rpfilter" : variant string m4_escape(["${EXPECTED_IPV6_RPFILTER_VALUE}"])
|
|
string "IndividualCalls" : variant string m4_escape(["${EXPECTED_INDIVIDUAL_CALLS_VALUE}"])
|
|
diff --git a/src/tests/functions.at b/src/tests/functions.at
|
|
index 582fdcc..5a1aad1 100644
|
|
--- a/src/tests/functions.at
|
|
+++ b/src/tests/functions.at
|
|
@@ -106,7 +106,7 @@ m4_define([FWD_START_TEST], [
|
|
m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [
|
|
AT_KEYWORDS(offline)
|
|
], [
|
|
- m4_define_default([FIREWALL_BACKEND], [nftables])
|
|
+ m4_define_default([FIREWALL_BACKEND], [iptables])
|
|
|
|
AT_KEYWORDS(FIREWALL_BACKEND)
|
|
|
|
@@ -114,7 +114,7 @@ m4_define([FWD_START_TEST], [
|
|
AT_CHECK([sed -i 's/^CleanupOnExit.*/CleanupOnExit=no/' ./firewalld.conf])
|
|
|
|
dnl set the appropriate backend
|
|
- AT_CHECK([sed -i 's/^FirewallBackend.*/FirewallBackend=FIREWALL_BACKEND/' ./firewalld.conf])
|
|
+ AT_CHECK([echo "FirewallBackend=FIREWALL_BACKEND" >> ./firewalld.conf])
|
|
|
|
dnl fib matching is pretty new in nftables. Don't use rpfilter on older
|
|
dnl kernels.
|
|
--
|
|
1.8.3.1
|
|
|