Attachment 663004 Details for Bug 886515 – this change seems to fix the problem

[patch] this change seems to fix the problem

0001-fix-duplicated-iptables-rules-RHBZ-886515.patch (text/plain), 3.41 KB, created by Jiri Popelka on 2012-12-13 14:39:04 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jiri Popelka

Created: 2012-12-13 14:39:04 UTC

Size: 3.41 KB

patch

obsolete

>From 2a0d95794df557c7791b5c566931680db7e74494 Mon Sep 17 00:00:00 2001
>From: Jiri Popelka <jpopelka@redhat.com>
>Date: Thu, 13 Dec 2012 15:30:00 +0100
>Subject: [PATCH] fix duplicated iptables rules (RHBZ#886515)
>
>remove old settings when overloading zone/service/icmp type
>---
> src/firewall/core/fw.py      |  4 +++-
> src/firewall/core/fw_zone.py | 20 ++++++++++++++++----
> 2 files changed, 19 insertions(+), 5 deletions(-)
>
>diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py
>index 9636f8e..ee4b240 100644
>--- a/src/firewall/core/fw.py
>+++ b/src/firewall/core/fw.py
>@@ -192,7 +192,7 @@ class Firewall:
>                         log.debug1("  Overloads %s '%s' ('%s/%s')", reader_type,
>                                    orig_obj.name, orig_obj.path,
>                                    orig_obj.filename)
>-
>+                        self.icmptype.remove_icmptype(orig_obj.name)
>                     self.icmptype.add_icmptype(obj)
>                     # add a deep copy to the configuration interface
>                     self.config.add_icmptype(copy.deepcopy(obj), default)
>@@ -203,6 +203,7 @@ class Firewall:
>                         log.debug1("  Overloads %s '%s' ('%s/%s')", reader_type,
>                                    orig_obj.name, orig_obj.path,
>                                    orig_obj.filename)
>+                        self.service.remove_service(orig_obj.name)
>                     self.service.add_service(obj)
>                     # add a deep copy to the configuration interface
>                     self.config.add_service(copy.deepcopy(obj), default)
>@@ -215,6 +216,7 @@ class Firewall:
>                         log.debug1("  Overloads %s '%s' ('%s/%s')", reader_type,
>                                    orig_obj.name, orig_obj.path,
>                                    orig_obj.filename)
>+                        self.zone.remove_zone(orig_obj.name)
>                     self.zone.add_zone(obj)
>                     # add a deep copy to the configuration interface
>                     self.config.add_zone(copy.deepcopy(obj), default)
>diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
>index 5d0d253..99bb6b4 100644
>--- a/src/firewall/core/fw_zone.py
>+++ b/src/firewall/core/fw_zone.py
>@@ -55,10 +55,8 @@ class FirewallZone:
>         return self._zones[z]
> 
>     def add_zone(self, obj):
>-        obj.settings = { }
>-        for x in [ "interfaces", "services", "ports", "masquerade",
>-                   "forward_ports", "icmp_blocks" ]:
>-            obj.settings[x] = { }
>+        obj.settings = { x : {} for x in [ "interfaces", "services", "ports",
>+                               "masquerade", "forward_ports", "icmp_blocks" ] }
> 
>         self._zones[obj.name] = obj
> 
>@@ -81,6 +79,20 @@ class FirewallZone:
> 
>     def remove_zone(self, zone):
>         obj = self._zones[zone]
>+        try:
>+            for args in obj.icmp_blocks:
>+                self.remove_icmp_block(obj.name, args)
>+            for args in obj.forward_ports:
>+                self.remove_forward_port(obj.name, *args)
>+            for args in obj.services:
>+                self.remove_service(obj.name, args)
>+            for args in obj.ports:
>+                self.remove_port(obj.name, *args)
>+            if obj.masquerade:
>+                self.remove_masquerade(obj.name)
>+        except FirewallError as msg:
>+            log.warning("%s: %s" % (obj.name, msg))
>+
>         obj.settings.clear()
>         del self._zones[zone]
> 
>-- 
>1.8.0.1
>

Actions: View | Diff

Attachments on bug 886515: 662389 | 663004