Attachment 572753 Details for Bug 801182 – Allow (ipv6-)icmp before conntrack checking

[patch] Allow (ipv6-)icmp before conntrack checking

0001-ipXtables-Move-icmp-before-conntrack.patch (text/plain), 1.88 KB, created by Jiri Popelka on 2012-03-26 13:24:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jiri Popelka

Created: 2012-03-26 13:24:33 UTC

Size: 1.88 KB

patch

obsolete

>From addbd791a6ebae45255104623fb594339b3ea23b Mon Sep 17 00:00:00 2001
>From: Jiri Popelka <jpopelka@redhat.com>
>Date: Mon, 26 Mar 2012 15:13:03 +0200
>Subject: [PATCH] ipXtables: Move icmp before conntrack
>
>---
> src/firewall/core/ipXtables.py |   24 ++++++++++++------------
> 1 files changed, 12 insertions(+), 12 deletions(-)
>
>diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
>index 39697f7..d1a8f7e 100644
>--- a/src/firewall/core/ipXtables.py
>+++ b/src/firewall/core/ipXtables.py
>@@ -74,23 +74,23 @@ DEFAULT_RULES["filter"] = [
>     "-N INPUT_direct",
>     "-N INPUT_ZONES",
> 
>-    "-I INPUT 1 -m conntrack --ctstate INVALID -j %%REJECT%%",
>-    "-I INPUT 2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
>-    "-I INPUT 3 -i lo -j ACCEPT",
>-    "-I INPUT 4 -j INPUT_direct",
>-    "-I INPUT 5 -j INPUT_ZONES",
>-    "-I INPUT 6 -p %%ICMP%% -j ACCEPT",
>+    "-I INPUT 1 -p %%ICMP%% -j ACCEPT",
>+    "-I INPUT 2 -m conntrack --ctstate INVALID -j %%REJECT%%",
>+    "-I INPUT 3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
>+    "-I INPUT 4 -i lo -j ACCEPT",
>+    "-I INPUT 5 -j INPUT_direct",
>+    "-I INPUT 6 -j INPUT_ZONES",
>     "-I INPUT 7 -j %%REJECT%%",
> 
>     "-N FORWARD_direct",
>     "-N FORWARD_ZONES",
> 
>-    "-I FORWARD 1 -m conntrack --ctstate INVALID -j %%REJECT%%",
>-    "-I FORWARD 2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
>-    "-I FORWARD 3 -i lo -j ACCEPT",
>-    "-I FORWARD 4 -j FORWARD_direct",
>-    "-I FORWARD 5 -j FORWARD_ZONES",
>-    "-I FORWARD 6 -p %%ICMP%% -j ACCEPT",
>+    "-I FORWARD 1 -p %%ICMP%% -j ACCEPT",
>+    "-I FORWARD 2 -m conntrack --ctstate INVALID -j %%REJECT%%",
>+    "-I FORWARD 3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
>+    "-I FORWARD 4 -i lo -j ACCEPT",
>+    "-I FORWARD 5 -j FORWARD_direct",
>+    "-I FORWARD 6 -j FORWARD_ZONES",
>     "-I FORWARD 7 -j %%REJECT%%",
> 
>     "-N OUTPUT_direct",
>-- 
>1.7.7.6
>

Actions: View | Diff

Attachments on bug 801182: 568914 | 572753