|
 |
87a48e |
From 8311259a6e2a6ac475c3d8c9a2df099469bf8277 Mon Sep 17 00:00:00 2001
|
|
|
87a48e |
From: Eric Garver <eric@garver.life>
|
|
|
87a48e |
Date: Wed, 27 Oct 2021 10:13:59 -0400
|
|
|
87a48e |
Subject: [PATCH 45/50] fix(zone): detect same source/interface in zones
|
|
|
87a48e |
|
|
|
87a48e |
Fixes: rhbz2014383
|
|
|
87a48e |
(cherry picked from commit 4b721abb087a529596722a045a63a65af2e0566a)
|
|
|
87a48e |
(cherry picked from commit 081fcfe7b255b2e0f91c4a3dc55539e4cfd4b7d1)
|
|
|
87a48e |
---
|
|
|
87a48e |
src/firewall/core/io/zone.py | 15 +++++++++++++++
|
|
|
87a48e |
1 file changed, 15 insertions(+)
|
|
|
87a48e |
|
|
|
87a48e |
diff --git a/src/firewall/core/io/zone.py b/src/firewall/core/io/zone.py
|
|
|
87a48e |
index 3aea94a13155..4291ec9cba00 100644
|
|
|
87a48e |
--- a/src/firewall/core/io/zone.py
|
|
|
87a48e |
+++ b/src/firewall/core/io/zone.py
|
|
|
87a48e |
@@ -193,11 +193,26 @@ class Zone(IO_Object):
|
|
|
87a48e |
for interface in config:
|
|
|
87a48e |
if not checkInterface(interface):
|
|
|
87a48e |
raise FirewallError(errors.INVALID_INTERFACE, interface)
|
|
|
87a48e |
+ if self.fw_config:
|
|
|
87a48e |
+ for zone in self.fw_config.get_zones():
|
|
|
87a48e |
+ if zone == self.name:
|
|
|
87a48e |
+ continue
|
|
|
87a48e |
+ if interface in self.fw_config.get_zone(zone).interfaces:
|
|
|
87a48e |
+ raise FirewallError(errors.INVALID_INTERFACE,
|
|
|
87a48e |
+ "interface '{}' already bound to zone '{}'".format(interface, zone))
|
|
|
87a48e |
elif item == "sources":
|
|
|
87a48e |
for source in config:
|
|
|
87a48e |
if not checkIPnMask(source) and not checkIP6nMask(source) and \
|
|
|
87a48e |
not check_mac(source) and not source.startswith("ipset:"):
|
|
|
87a48e |
raise FirewallError(errors.INVALID_ADDR, source)
|
|
|
87a48e |
+ if self.fw_config:
|
|
|
87a48e |
+ for zone in self.fw_config.get_zones():
|
|
|
87a48e |
+ if zone == self.name:
|
|
|
87a48e |
+ continue
|
|
|
87a48e |
+ if source in self.fw_config.get_zone(zone).sources:
|
|
|
87a48e |
+ raise FirewallError(errors.INVALID_ADDR,
|
|
|
87a48e |
+ "source '{}' already bound to zone '{}'".format(source, zone))
|
|
|
87a48e |
+
|
|
|
87a48e |
|
|
|
87a48e |
def check_name(self, name):
|
|
|
87a48e |
super(Zone, self).check_name(name)
|
|
|
87a48e |
--
|
|
|
87a48e |
2.27.0
|
|
|
87a48e |
|