|
 |
64e4ee |
From 3bcaadbc99a10634d5a7552d7398436ef836f428 Mon Sep 17 00:00:00 2001
|
|
|
64e4ee |
From: Thomas Woerner <twoerner@redhat.com>
|
|
|
64e4ee |
Date: Mon, 22 May 2017 17:59:10 +0200
|
|
|
64e4ee |
Subject: [PATCH 3/6] firewall.core.fw_zone: Load NAT helpers with conntrack
|
|
|
64e4ee |
helpers
|
|
|
64e4ee |
|
|
|
64e4ee |
If a conntrack helper is used, then the NAT helper will automatically be loaded
|
|
|
64e4ee |
also if there is a matching NAT helper.
|
|
|
64e4ee |
|
|
|
64e4ee |
Fixes: RHBZ#1452681
|
|
|
64e4ee |
(cherry picked from commit af59d816c92e0391d118949542eb19bcf8b74580)
|
|
|
64e4ee |
---
|
|
|
64e4ee |
src/firewall/core/fw_zone.py | 12 ++++++++++++
|
|
|
64e4ee |
1 file changed, 12 insertions(+)
|
|
|
64e4ee |
|
|
|
64e4ee |
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
|
|
|
64e4ee |
index 2c99b0cbce8a..3089d12edd1b 100644
|
|
|
64e4ee |
--- a/src/firewall/core/fw_zone.py
|
|
|
64e4ee |
+++ b/src/firewall/core/fw_zone.py
|
|
|
64e4ee |
@@ -1155,9 +1155,15 @@ class FirewallZone(object):
|
|
|
64e4ee |
_rule += [ "-j", "CT", "--helper", helper.name ]
|
|
|
64e4ee |
self.__rule_source(rule.source, _rule)
|
|
|
64e4ee |
zone_transaction.add_rule(ipv, _rule)
|
|
|
64e4ee |
+ nat_module = module.replace("conntrack", "nat")
|
|
|
64e4ee |
+ if nat_module in self._fw.nf_nat_helpers:
|
|
|
64e4ee |
+ modules.append(nat_module)
|
|
|
64e4ee |
else:
|
|
|
64e4ee |
if helper.module not in modules:
|
|
|
64e4ee |
modules.append(helper.module)
|
|
|
64e4ee |
+ nat_module = helper.module.replace("conntrack", "nat")
|
|
|
64e4ee |
+ if nat_module in self._fw.nf_nat_helpers:
|
|
|
64e4ee |
+ modules.append(nat_module)
|
|
|
64e4ee |
zone_transaction.add_modules(modules)
|
|
|
64e4ee |
|
|
|
64e4ee |
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS["INPUT"],
|
|
|
64e4ee |
@@ -1624,6 +1630,9 @@ class FirewallZone(object):
|
|
|
64e4ee |
modules = [ ]
|
|
|
64e4ee |
for helper in helpers:
|
|
|
64e4ee |
modules.append(helper.module)
|
|
|
64e4ee |
+ nat_module = helper.module.replace("conntrack", "nat")
|
|
|
64e4ee |
+ if nat_module in self._fw.nf_nat_helpers:
|
|
|
64e4ee |
+ modules.append(nat_module)
|
|
|
64e4ee |
zone_transaction.add_modules(modules)
|
|
|
64e4ee |
zone_transaction.add_chain("filter", "INPUT")
|
|
|
64e4ee |
|
|
|
64e4ee |
@@ -1641,6 +1650,9 @@ class FirewallZone(object):
|
|
|
64e4ee |
raise FirewallError(
|
|
|
64e4ee |
errors.INVALID_HELPER,
|
|
|
64e4ee |
"'%s' is not available in kernel" % module)
|
|
|
64e4ee |
+ nat_module = helper.module.replace("conntrack", "nat")
|
|
|
64e4ee |
+ if nat_module in self._fw.nf_nat_helpers:
|
|
|
64e4ee |
+ zone_transaction.add_module(nat_module)
|
|
|
64e4ee |
if helper.family != "" and helper.family != ipv:
|
|
|
64e4ee |
# no support for family ipv, continue
|
|
|
64e4ee |
continue
|
|
|
64e4ee |
--
|
|
|
64e4ee |
2.12.0
|
|
|
64e4ee |
|