|
 |
136e2c |
From 3bf7abe7cfdc738959c092bd30ef9ee42789fc8d Mon Sep 17 00:00:00 2001
|
|
|
136e2c |
From: Eric Garver <eric@garver.life>
|
|
|
136e2c |
Date: Tue, 17 Sep 2019 14:54:13 -0400
|
|
|
136e2c |
Subject: [PATCH 102/109] fix: allow custom helpers using standard helper
|
|
|
136e2c |
modules
|
|
|
136e2c |
|
|
|
136e2c |
e.g. a helper called "ftp-foobar" using module "nf_conntrack_ftp"
|
|
|
136e2c |
|
|
|
136e2c |
(cherry picked from commit 8c65bda2a750c1b1a15851a6030dfef8cdb74d15)
|
|
|
136e2c |
(cherry picked from commit 80260288c58b0555360822d1eb81b2a4d36a5ed1)
|
|
|
136e2c |
---
|
|
|
136e2c |
src/firewall/core/fw_zone.py | 10 ++++++----
|
|
|
136e2c |
src/firewall/core/ipXtables.py | 4 ++--
|
|
|
136e2c |
src/firewall/core/nftables.py | 4 ++--
|
|
|
136e2c |
3 files changed, 10 insertions(+), 8 deletions(-)
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
|
|
|
136e2c |
index 6b766d0dc3ba..c096e3efe028 100644
|
|
|
136e2c |
--- a/src/firewall/core/fw_zone.py
|
|
|
136e2c |
+++ b/src/firewall/core/fw_zone.py
|
|
|
136e2c |
@@ -1609,8 +1609,9 @@ class FirewallZone(object):
|
|
|
136e2c |
modules = [ ]
|
|
|
136e2c |
for helper in helpers:
|
|
|
136e2c |
module = helper.module
|
|
|
136e2c |
+ _module_short_name = module.replace("-","_").replace("nf_conntrack_", "")
|
|
|
136e2c |
if self._fw.nf_conntrack_helper_setting == 0:
|
|
|
136e2c |
- if helper.name not in \
|
|
|
136e2c |
+ if _module_short_name not in \
|
|
|
136e2c |
self._fw.nf_conntrack_helpers[module]:
|
|
|
136e2c |
raise FirewallError(
|
|
|
136e2c |
errors.INVALID_HELPER,
|
|
|
136e2c |
@@ -1627,7 +1628,7 @@ class FirewallZone(object):
|
|
|
136e2c |
for (port,proto) in helper.ports:
|
|
|
136e2c |
rules = backend.build_zone_helper_ports_rules(
|
|
|
136e2c |
enable, zone, proto, port,
|
|
|
136e2c |
- destination, helper.name)
|
|
|
136e2c |
+ destination, helper.name, _module_short_name)
|
|
|
136e2c |
zone_transaction.add_rules(backend, rules)
|
|
|
136e2c |
else:
|
|
|
136e2c |
if helper.module not in modules:
|
|
|
136e2c |
@@ -1819,7 +1820,8 @@ class FirewallZone(object):
|
|
|
136e2c |
if self._fw.nf_conntrack_helper_setting == 0:
|
|
|
136e2c |
for helper in helpers:
|
|
|
136e2c |
module = helper.module
|
|
|
136e2c |
- if helper.name not in \
|
|
|
136e2c |
+ _module_short_name = module.replace("-","_").replace("nf_conntrack_", "")
|
|
|
136e2c |
+ if _module_short_name not in \
|
|
|
136e2c |
self._fw.nf_conntrack_helpers[module]:
|
|
|
136e2c |
raise FirewallError(
|
|
|
136e2c |
errors.INVALID_HELPER,
|
|
|
136e2c |
@@ -1836,7 +1838,7 @@ class FirewallZone(object):
|
|
|
136e2c |
for (port,proto) in helper.ports:
|
|
|
136e2c |
rules = backend.build_zone_helper_ports_rules(
|
|
|
136e2c |
enable, zone, proto, port,
|
|
|
136e2c |
- destination, helper.name)
|
|
|
136e2c |
+ destination, helper.name, _module_short_name)
|
|
|
136e2c |
zone_transaction.add_rules(backend, rules)
|
|
|
136e2c |
|
|
|
136e2c |
for (port,proto) in svc.ports:
|
|
|
136e2c |
diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
|
|
|
136e2c |
index 647a7a161517..b0a4c5e1c161 100644
|
|
|
136e2c |
--- a/src/firewall/core/ipXtables.py
|
|
|
136e2c |
+++ b/src/firewall/core/ipXtables.py
|
|
|
136e2c |
@@ -983,7 +983,7 @@ class ip4tables(object):
|
|
|
136e2c |
return rules
|
|
|
136e2c |
|
|
|
136e2c |
def build_zone_helper_ports_rules(self, enable, zone, proto, port,
|
|
|
136e2c |
- destination, helper_name):
|
|
|
136e2c |
+ destination, helper_name, module_short_name):
|
|
|
136e2c |
add_del = { True: "-A", False: "-D" }[enable]
|
|
|
136e2c |
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["PREROUTING"],
|
|
|
136e2c |
zone=zone)
|
|
|
136e2c |
@@ -992,7 +992,7 @@ class ip4tables(object):
|
|
|
136e2c |
rule += [ "--dport", "%s" % portStr(port) ]
|
|
|
136e2c |
if destination:
|
|
|
136e2c |
rule += [ "-d", destination ]
|
|
|
136e2c |
- rule += [ "-j", "CT", "--helper", helper_name ]
|
|
|
136e2c |
+ rule += [ "-j", "CT", "--helper", module_short_name ]
|
|
|
136e2c |
|
|
|
136e2c |
return [rule]
|
|
|
136e2c |
|
|
|
136e2c |
diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
|
|
|
136e2c |
index 9d88e72f42bf..0317d820389f 100644
|
|
|
136e2c |
--- a/src/firewall/core/nftables.py
|
|
|
136e2c |
+++ b/src/firewall/core/nftables.py
|
|
|
136e2c |
@@ -927,7 +927,7 @@ class nftables(object):
|
|
|
136e2c |
return rules
|
|
|
136e2c |
|
|
|
136e2c |
def build_zone_helper_ports_rules(self, enable, zone, proto, port,
|
|
|
136e2c |
- destination, helper_name):
|
|
|
136e2c |
+ destination, helper_name, module_short_name):
|
|
|
136e2c |
add_del = { True: "add", False: "delete" }[enable]
|
|
|
136e2c |
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"],
|
|
|
136e2c |
zone=zone)
|
|
|
136e2c |
@@ -944,7 +944,7 @@ class nftables(object):
|
|
|
136e2c |
|
|
|
136e2c |
helper_object = ["ct", "helper", "inet", TABLE_NAME,
|
|
|
136e2c |
"helper-%s-%s" % (helper_name, proto),
|
|
|
136e2c |
- "{", "type", "\"%s\"" % (helper_name), "protocol",
|
|
|
136e2c |
+ "{", "type", "\"%s\"" % (module_short_name), "protocol",
|
|
|
136e2c |
proto, ";", "}"]
|
|
|
136e2c |
|
|
|
136e2c |
return [helper_object, rule]
|
|
|
136e2c |
--
|
|
|
136e2c |
2.20.1
|
|
|
136e2c |
|