From 5acbdc31a56f4b680323ba7aa92383da9e9f25fa Mon Sep 17 00:00:00 2001

From: Eric Garver <eric@garver.life>

Date: Wed, 22 Jul 2020 09:18:42 -0400

Subject: [PATCH 41/45] fix(rich): icmptypes with one family

They were mistakenly being added to both families which fails.

Fixes: rhbz 1855140

(cherry picked from commit 0112e36c4e225504b15a1feef3d453a757a00b21)

(cherry picked from commit bd61af7db6f92d48a79fb1e84405aef4f522ffbf)

---

 src/firewall/core/fw_zone.py  | 26 +++++++++++---------------

 src/firewall/core/nftables.py |  2 +-

 2 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py

index 5677effab146..b9fe1f6aae97 100644

--- a/src/firewall/core/fw_zone.py

+++ b/src/firewall/core/fw_zone.py

@@ -1522,14 +1522,17 @@ class FirewallZone(object):

                     transaction.add_rules(backend, rules)

     def _rule_prepare(self, enable, zone, rule, transaction):

-        if rule.family is not None:

+        ipvs = []

+        if rule.family:

             ipvs = [ rule.family ]

-        else:

-            ipvs = [ipv for ipv in ["ipv4", "ipv6"] if self._fw.is_ipv_enabled(ipv)]

+        elif rule.element and (isinstance(rule.element, Rich_IcmpBlock) or isinstance(rule.element, Rich_IcmpType)):

+            ict = self._fw.icmptype.get_icmptype(rule.element.name)

+            if ict.destination:

+                ipvs = [ipv for ipv in ["ipv4", "ipv6"] if ipv in ict.destination]

         source_ipv = self._rule_source_ipv(rule.source)

-        if source_ipv is not None and source_ipv != "":

-            if rule.family is not None:

+        if source_ipv:

+            if rule.family:

                 # rule family is defined by user, no way to change it

                 if rule.family != source_ipv:

                     raise FirewallError(errors.INVALID_RULE,

@@ -1538,6 +1541,9 @@ class FirewallZone(object):

                 # use the source family as rule family

                 ipvs = [ source_ipv ]

+        if not ipvs:

+            ipvs = [ipv for ipv in ["ipv4", "ipv6"] if self._fw.is_ipv_enabled(ipv)]

+

         # add an element to object to allow backends to know what ipvs this applies to

         rule.ipvs = ipvs

@@ -1699,16 +1705,6 @@ class FirewallZone(object):

                     # icmp block might have reject or drop action, but not accept

                     raise FirewallError(errors.INVALID_RULE,

                                         "IcmpBlock not usable with accept action")

-                if ict.destination:

-                    for ipv in ipvs:

-                        if ipv in ict.destination \

-                           and not backend.is_ipv_supported(ipv):

-                            raise FirewallError(

-                                errors.INVALID_RULE,

-                                "Icmp%s %s not usable with %s" % \

-                                ("Block" if type(rule.element) == \

-                                 Rich_IcmpBlock else "Type",

-                                 rule.element.name, backend.name))

                 table = "filter"

                 if enable:

diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py

index 85c790b5b51e..0198200b2372 100644

--- a/src/firewall/core/nftables.py

+++ b/src/firewall/core/nftables.py

@@ -1383,7 +1383,7 @@ class nftables(object):

             return ICMP_TYPES_FRAGMENTS[ipv][icmp_type]

         else:

             raise FirewallError(INVALID_ICMPTYPE,

-                                "ICMP type '%s' not supported by %s" % (icmp_type, self.name))

+                                "ICMP type '%s' not supported by %s for %s" % (icmp_type, self.name, ipv))

     def build_zone_icmp_block_rules(self, enable, zone, ict, rich_rule=None):

         table = "filter"

-- 

2.27.0