Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not emit helper jump without helper modules #27

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Do not emit helper jump without helper modules #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion root/usr/share/ucode/fw4.uc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2186,7 +2186,7 @@ return {
zone.dflags.snat = true;

if ((zone.auto_helper && !(zone.masq || zone.masq6)) || length(zone.helper)) {
zone.dflags.helper = true;
zone.dflags.helper = false;

for (let helper in (length(zone.helper) ? zone.helper : this.state.helpers)) {
if (!helper.available)
Expand All @@ -2203,6 +2203,7 @@ return {
target: "helper",
set_helper: helper
});
zone.dflags.helper = true;
}
}
}
Expand Down
12 changes: 0 additions & 12 deletions tests/02_zones/01_policies
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,9 +123,6 @@ table inet fw4 {

chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname "zone1" jump helper_test1 comment "!fw4: Handle test1 IPv4/IPv6 helper assignment"
iifname "zone2" jump helper_test2 comment "!fw4: Handle test2 IPv4/IPv6 helper assignment"
iifname "zone3" jump helper_test3 comment "!fw4: Handle test3 IPv4/IPv6 helper assignment"
}

chain handle_reject {
Expand All @@ -145,9 +142,6 @@ table inet fw4 {
jump accept_to_test1
}

chain helper_test1 {
}

chain accept_from_test1 {
iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
}
Expand All @@ -168,9 +162,6 @@ table inet fw4 {
jump drop_to_test2
}

chain helper_test2 {
}

chain drop_from_test2 {
iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
}
Expand All @@ -191,9 +182,6 @@ table inet fw4 {
jump reject_to_test3
}

chain helper_test3 {
}

chain reject_from_test3 {
iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
}
Expand Down
23 changes: 0 additions & 23 deletions tests/02_zones/04_wildcard_devices
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,14 +168,6 @@ table inet fw4 {

chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname "/never/" jump helper_test2 comment "!fw4: Handle test2 IPv4/IPv6 helper assignment"
iifname "test*" jump helper_test3 comment "!fw4: Handle test3 IPv4/IPv6 helper assignment"
iifname "foo*" jump helper_test4 comment "!fw4: Handle test4 IPv4/IPv6 helper assignment"
iifname "bar*" jump helper_test4 comment "!fw4: Handle test4 IPv4/IPv6 helper assignment"
iifname { "test1", "test2" } jump helper_test4 comment "!fw4: Handle test4 IPv4/IPv6 helper assignment"
iifname "foo*" iifname != { "test3", "test4" } iifname != "baz*" iifname != "qrx*" jump helper_test5 comment "!fw4: Handle test5 IPv4/IPv6 helper assignment"
iifname "bar*" iifname != { "test3", "test4" } iifname != "baz*" iifname != "qrx*" jump helper_test5 comment "!fw4: Handle test5 IPv4/IPv6 helper assignment"
iifname { "test1", "test2" } iifname != { "test3", "test4" } iifname != "baz*" iifname != "qrx*" jump helper_test5 comment "!fw4: Handle test5 IPv4/IPv6 helper assignment"
}

chain handle_reject {
Expand All @@ -195,9 +187,6 @@ table inet fw4 {
jump drop_to_test1
}

chain helper_test1 {
}

chain drop_from_test1 {
counter drop comment "!fw4: drop test1 IPv4/IPv6 traffic"
}
Expand All @@ -218,9 +207,6 @@ table inet fw4 {
jump drop_to_test2
}

chain helper_test2 {
}

chain drop_from_test2 {
iifname "/never/" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
}
Expand All @@ -241,9 +227,6 @@ table inet fw4 {
jump drop_to_test3
}

chain helper_test3 {
}

chain drop_from_test3 {
iifname "test*" counter drop comment "!fw4: drop test3 IPv4/IPv6 traffic"
}
Expand All @@ -264,9 +247,6 @@ table inet fw4 {
jump drop_to_test4
}

chain helper_test4 {
}

chain drop_from_test4 {
iifname "foo*" counter drop comment "!fw4: drop test4 IPv4/IPv6 traffic"
iifname "bar*" counter drop comment "!fw4: drop test4 IPv4/IPv6 traffic"
Expand All @@ -291,9 +271,6 @@ table inet fw4 {
jump drop_to_test5
}

chain helper_test5 {
}

chain drop_from_test5 {
iifname "foo*" iifname != { "test3", "test4" } iifname != "baz*" iifname != "qrx*" counter drop comment "!fw4: drop test5 IPv4/IPv6 traffic"
iifname "bar*" iifname != { "test3", "test4" } iifname != "baz*" iifname != "qrx*" counter drop comment "!fw4: drop test5 IPv4/IPv6 traffic"
Expand Down
9 changes: 0 additions & 9 deletions tests/02_zones/05_subnet_mask_matches
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,9 +112,6 @@ table inet fw4 {

chain prerouting {
type filter hook prerouting priority filter; policy accept;
meta nfproto ipv6 ip6 saddr != { ::7, ::8 } ip6 saddr & ::ffff == ::1 ip6 saddr & ::ffff != ::5 ip6 saddr & ::ffff != ::6 jump helper_test2 comment "!fw4: Handle test2 IPv6 helper assignment"
meta nfproto ipv6 ip6 saddr != { ::7, ::8 } ip6 saddr & ::ffff == ::2 ip6 saddr & ::ffff != ::5 ip6 saddr & ::ffff != ::6 jump helper_test2 comment "!fw4: Handle test2 IPv6 helper assignment"
meta nfproto ipv6 ip6 saddr { ::3, ::4 } ip6 saddr != { ::7, ::8 } ip6 saddr & ::ffff != ::5 ip6 saddr & ::ffff != ::6 jump helper_test2 comment "!fw4: Handle test2 IPv6 helper assignment"
}

chain handle_reject {
Expand All @@ -134,9 +131,6 @@ table inet fw4 {
jump drop_to_test1
}

chain helper_test1 {
}

chain drop_from_test1 {
meta nfproto ipv6 ip6 saddr & ::ffff == ::1 ip6 saddr & ::ffff != ::2 counter drop comment "!fw4: drop test1 IPv6 traffic"
}
Expand All @@ -157,9 +151,6 @@ table inet fw4 {
jump drop_to_test2
}

chain helper_test2 {
}

chain drop_from_test2 {
meta nfproto ipv6 ip6 saddr != { ::7, ::8 } ip6 saddr & ::ffff == ::1 ip6 saddr & ::ffff != ::5 ip6 saddr & ::ffff != ::6 counter drop comment "!fw4: drop test2 IPv6 traffic"
meta nfproto ipv6 ip6 saddr != { ::7, ::8 } ip6 saddr & ::ffff == ::2 ip6 saddr & ::ffff != ::5 ip6 saddr & ::ffff != ::6 counter drop comment "!fw4: drop test2 IPv6 traffic"
Expand Down
3 changes: 0 additions & 3 deletions tests/03_rules/03_constraints
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,9 +147,6 @@ table inet fw4 {
jump drop_to_lan
}

chain helper_lan {
}

chain drop_from_lan {
}

Expand Down
8 changes: 0 additions & 8 deletions tests/03_rules/05_mangle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,8 +203,6 @@ table inet fw4 {

chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname { "eth0", "eth1" } jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
iifname { "eth2", "eth3" } jump helper_wan comment "!fw4: Handle wan IPv4/IPv6 helper assignment"
}

chain handle_reject {
Expand All @@ -224,9 +222,6 @@ table inet fw4 {
jump drop_to_lan
}

chain helper_lan {
}

chain drop_from_lan {
iifname { "eth0", "eth1" } counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
}
Expand All @@ -247,9 +242,6 @@ table inet fw4 {
jump drop_to_wan
}

chain helper_wan {
}

chain drop_from_wan {
iifname { "eth2", "eth3" } counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
}
Expand Down
3 changes: 0 additions & 3 deletions tests/03_rules/11_log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,9 +157,6 @@ table inet fw4 {
jump drop_to_wan
}

chain helper_wan {
}

chain drop_from_wan {
}

Expand Down