File 0001-nftables-fix-rich-rules-ports-protocols-so... of Package firewalld

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-nftables-fix-rich-rules-ports-protocols-source-ports.patch of Package firewalld (Revision 8b97e171de7d32c318bdf5abd2f904f2)

Currently displaying revision 8b97e171de7d32c318bdf5abd2f904f2 , Show latest

From 0a5827471610fdbb19a053f7f46c114d4fbdf2a0 Mon Sep 17 00:00:00 2001
From: Eric Garver <e@erig.me>
Date: Wed, 29 Aug 2018 16:10:20 -0400
Subject: [PATCH] nftables: fix rich rules ports/protocols/source ports not
 considering ct state

They were accepting the packets, but were not matching on "ct state new"
as they should have been. In most (all?) cases, this should not have had
a noticeable affect because the existing connections were accepted long
before the _allow rules are hit.

(cherry picked from commit 0dd56eba38a2e0075281fb5a7180ecb9851359e1)
---
 src/firewall/core/nftables.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
index 1ac8b3a8..20296292 100644
--- a/src/firewall/core/nftables.py
+++ b/src/firewall/core/nftables.py
@@ -812,6 +812,7 @@ class nftables(object):
             rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
             rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
         rule_fragment += [proto, "dport", "%s" % portStr(port, "-")]
+        rule_fragment += ["ct", "state", "new"]
 
         rules = []
         if rich_rule:
@@ -821,7 +822,7 @@ class nftables(object):
         else:
             rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
                           "%s_%s_allow" % (table, target)] +
-                          rule_fragment + ["ct", "state", "new", "accept"])
+                          rule_fragment + ["accept"])
 
         return rules
 
@@ -844,6 +845,7 @@ class nftables(object):
             rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
             rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
         rule_fragment = ["meta", "l4proto", protocol]
+        rule_fragment += ["ct", "state", "new"]
 
         rules = []
         if rich_rule:
@@ -853,7 +855,7 @@ class nftables(object):
         else:
             rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
                           "filter_%s_allow" % (target)] +
-                          rule_fragment + ["ct", "state", "new", "accept"])
+                          rule_fragment + ["accept"])
 
         return rules
 
@@ -876,6 +878,7 @@ class nftables(object):
             rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
             rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
         rule_fragment += [proto, "sport", "%s" % portStr(port, "-")]
+        rule_fragment += ["ct", "state", "new"]
 
         rules = []
         if rich_rule:
@@ -885,7 +888,7 @@ class nftables(object):
         else:
             rules.append([add_del, "rule", "inet", "%s" % TABLE_NAME,
                           "%s_%s_allow" % (table, target)] +
-                          rule_fragment + ["ct", "state", "new", "accept"])
+                          rule_fragment + ["accept"])
 
         return rules
 
-- 
2.18.0

Places

File 0001-nftables-fix-rich-rules-ports-protocols-source-ports.patch of Package firewalld (Revision 8b97e171de7d32c318bdf5abd2f904f2)

Places