Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not emit extra l4proto filter for helpers #41

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Do not emit extra l4proto filter for helpers #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion root/usr/share/firewall4/templates/mangle-rule.uc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

{%+ if (rule.family && !rule.has_addrs): -%}
meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
{%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes): -%}
{%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes && !rule.set_helper): -%}
meta l4proto {{
(rule.proto.name == 'icmp' && rule.family == 6) ? 'ipv6-icmp' : rule.proto.name
}} {%+ endif -%}
Expand Down
2 changes: 1 addition & 1 deletion root/usr/share/firewall4/templates/rule.uc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{%+ if (rule.family && !rule.has_addrs): -%}
meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
{%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes): -%}
{%+ if (!rule.proto.any && !rule.has_ports && !rule.icmp_types && !rule.icmp_codes && !rule.set_helper): -%}
meta l4proto {{ fw4.l4proto(rule.family, rule.proto) }} {%+ endif -%}
{%+ if (rule.iifnames): -%}
iifname {{ fw4.set(rule.iifnames) }} {%+ endif -%}
Expand Down
24 changes: 12 additions & 12 deletions tests/01_configuration/01_ruleset
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,18 +169,18 @@ table inet fw4 {
}

chain helper_lan {
meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
meta nfproto ipv4 tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
meta nfproto ipv4 udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
meta nfproto ipv4 tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
meta nfproto ipv4 udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
meta nfproto ipv4 tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
}

chain accept_from_lan {
Expand Down
2 changes: 1 addition & 1 deletion tests/02_zones/06_family_selections
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,7 +294,7 @@ table inet fw4 {
}

chain helper_test6 {
meta nfproto ipv4 meta l4proto tcp tcp dport 1234 ct helper set "test" comment "!fw4: An example IPv4-only conntrack helper"
meta nfproto ipv4 tcp dport 1234 ct helper set "test" comment "!fw4: An example IPv4-only conntrack helper"
}

chain drop_from_test6 {
Expand Down
30 changes: 15 additions & 15 deletions tests/02_zones/07_helpers
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,7 +223,7 @@ table inet fw4 {
}

chain helper_test1 {
meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
}

chain drop_from_test1 {
Expand All @@ -247,7 +247,7 @@ table inet fw4 {
}

chain helper_test2 {
meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
}

chain drop_from_test2 {
Expand All @@ -271,7 +271,7 @@ table inet fw4 {
}

chain helper_test3 {
meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
}

chain drop_from_test3 {
Expand All @@ -295,18 +295,18 @@ table inet fw4 {
}

chain helper_test4 {
meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
meta nfproto ipv4 tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
meta nfproto ipv4 udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
meta nfproto ipv4 tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
meta nfproto ipv4 udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
meta nfproto ipv4 tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
}

chain drop_from_test4 {
Expand Down