From 582db194cc697f79a17ac543076dd4bbe1216db6 Mon Sep 17 00:00:00 2001

From: Eric Garver <eric@garver.life>

Date: Thu, 11 Apr 2019 11:14:40 -0400

Subject: [PATCH 24/73] fix: rich rule forward-port deletion after reload

Simplify mark allocation for rich rules and make sure we use the mark in

apply_zone_settings().

Fixes: #482

Fixes: rhbz 1637675

(cherry picked from commit 362ebff8016116f831b83d3c9ee65858055b2c91)

(cherry picked from commit ab365b6a49a6f78b1c8394fca20b69623f9b9061)

---

 src/firewall/core/fw_zone.py | 40 +++++++++++++++++++-----------------

 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py

index d5eafb863439..d98ff2259087 100644

--- a/src/firewall/core/fw_zone.py

+++ b/src/firewall/core/fw_zone.py

@@ -323,8 +323,12 @@ class FirewallZone(object):

                     elif key == "masquerade":

                         self._masquerade(enable, _zone, zone_transaction)

                     elif key == "rules":

+                        if "mark" in obj.settings["rules"][args]:

+                            mark = obj.settings["rules"][args]["mark"]

+                        else:

+                            mark = None

                         self.__rule(enable, _zone,

-                                    Rich_Rule(rule_str=args), None,

+                                    Rich_Rule(rule_str=args), mark,

                                     zone_transaction)

                     elif key == "interfaces":

                         self._interface(enable, _zone, args, zone_transaction)

@@ -672,8 +676,7 @@ class FirewallZone(object):

         return None

     def __rule(self, enable, zone, rule, mark_id, zone_transaction):

-        return self._rule_prepare(enable, zone, rule, mark_id,

-                                  zone_transaction)

+        self._rule_prepare(enable, zone, rule, mark_id, zone_transaction)

     def add_rule(self, zone, rule, timeout=0, sender=None,

                  use_zone_transaction=None):

@@ -692,13 +695,16 @@ class FirewallZone(object):

         else:

             zone_transaction = use_zone_transaction

-        if _obj.applied:

-            mark = self.__rule(True, _zone, rule, None, zone_transaction)

+        if type(rule.element) == Rich_ForwardPort:

+            mark = self._fw.new_mark()

         else:

             mark = None

+        if _obj.applied:

+            self.__rule(True, _zone, rule, mark, zone_transaction)

+

         self.__register_rule(_obj, rule_id, mark, timeout, sender)

-        zone_transaction.add_fail(self.__unregister_rule, _obj, rule_id)

+        zone_transaction.add_fail(self.__unregister_rule, _obj, rule_id, mark)

         if use_zone_transaction is None:

             zone_transaction.execute(True)

@@ -720,28 +726,31 @@ class FirewallZone(object):

             raise FirewallError(errors.NOT_ENABLED,

                                 "'%s' not in '%s'" % (rule, _zone))

+        if "mark" in _obj.settings["rules"][rule_id]:

+            mark = _obj.settings["rules"][rule_id]["mark"]

+        else:

+            mark = None

+

         if use_zone_transaction is None:

             zone_transaction = self.new_zone_transaction(_zone)

         else:

             zone_transaction = use_zone_transaction

-        if "mark" in _obj.settings["rules"][rule_id]:

-            mark = _obj.settings["rules"][rule_id]["mark"]

-        else:

-            mark = None

         if _obj.applied:

             self.__rule(False, _zone, rule, mark, zone_transaction)

-        zone_transaction.add_post(self.__unregister_rule, _obj, rule_id)

+        zone_transaction.add_post(self.__unregister_rule, _obj, rule_id, mark)

         if use_zone_transaction is None:

             zone_transaction.execute(True)

         return _zone

-    def __unregister_rule(self, _obj, rule_id):

+    def __unregister_rule(self, _obj, rule_id, mark=None):

         if rule_id in _obj.settings["rules"]:

             del _obj.settings["rules"][rule_id]

+        if mark:

+            self._fw.del_mark(mark)

     def query_rule(self, zone, rule):

         return self.__rule_id(rule) in self.get_settings(zone)["rules"]

@@ -1705,9 +1714,6 @@ class FirewallZone(object):

                     if toaddr and enable:

                         zone_transaction.add_post(enable_ip_forwarding, ipv)

-                if enable:

-                    mark_id = self._fw.new_mark()

-

                 filter_chain = "INPUT" if not toaddr else "FORWARD_IN"

                 if enable:

@@ -1720,10 +1726,6 @@ class FirewallZone(object):

                                     toaddr, mark_id, rule)

                 zone_transaction.add_rules(backend, rules)

-                if not enable:

-                    zone_transaction.add_post(self._fw.del_mark, mark_id)

-                    mark_id = None

-

             # SOURCE PORT

             elif type(rule.element) == Rich_SourcePort:

                 port = rule.element.port

-- 

2.20.1