nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-09-19 04:59:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

firewalld: Flush iptables rules before restarting firewall

Browse Source 
This is a workaround for the problem that when restarting firewalld with
iptables backend, flushing fails and starting with nftables also fails requiring
a restart to recover the problem.

Fixes #1440.

Reviewed-by: Joseph Nuthalapati <njoseph@thoughtworks.com>
This commit is contained in:
Sunil Mohan Adapa 2019-01-07 20:51:17 -08:00 committed by Joseph Nuthalapati
parent 03936f8c35
commit 2c51165f99
No known key found for this signature in database
GPG Key ID: 5398F00A2FA43C35
1 changed files with 37 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
actions/firewall
View File

@ -72,6 +72,36 @@ def parse_arguments():
return parser.parse_args() return parser.parse_args()
def _flush_iptables_rules():
"""Flush firewalld iptables rules before restarting it.
This is workaround for
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914694
This workaround can be removed if the bug is fixed or if firewalld starts
defaulting to nftables again.
The bug leads to firewalld failing to flush rules when there are custom
chains in the rules. This only happens on firewalld iptables backend when
nftables is running with iptables compatibility.
Flushing the tables before a restart will make the restart succeed and
after the restart nftables backend is used avoiding the problem.
"""
rule_template = '*{table}\n-F\n-X\n-Z\nCOMMIT\n'
iptables_rules = ''
ip6tables_rules = ''
for table in ['security', 'raw', 'mangle', 'nat', 'filter']:
iptables_rules += rule_template.format(table=table)
ip6tables_rules += rule_template.format(table=table)
subprocess.run(['iptables-restore'], input=iptables_rules.encode(),
check=True)
subprocess.run(['ip6tables-restore'], input=iptables_rules.encode(),
check=True)
def set_firewall_backend(backend): def set_firewall_backend(backend):
"""Set FirewallBackend attribute to the specified string.""" """Set FirewallBackend attribute to the specified string."""
conf_file = '/etc/firewalld/firewalld.conf' conf_file = '/etc/firewalld/firewalld.conf'
@ -83,16 +113,21 @@ def set_firewall_backend(backend):
aug.set('/augeas/load/Shellvars/incl[last() + 1]', conf_file) aug.set('/augeas/load/Shellvars/incl[last() + 1]', conf_file)
aug.load() aug.load()
old_backend = aug.get('/files/{}/FirewallBackend'.format(conf_file))
aug.set('/files/{}/FirewallBackend'.format(conf_file), aug.set('/files/{}/FirewallBackend'.format(conf_file),
'{}'.format(backend)) '{}'.format(backend))
aug.save() aug.save()
action_utils.service_enable('firewalld') if old_backend == 'iptables':
action_utils.service_restart('firewalld') _flush_iptables_rules()
if backend != old_backend:
action_utils.service_restart('firewalld')
def subcommand_setup(_): def subcommand_setup(_):
"""Perform basic firewalld setup.""" """Perform basic firewalld setup."""
action_utils.service_enable('firewalld')
subprocess.call(['firewall-cmd', '--set-default-zone=external']) subprocess.call(['firewall-cmd', '--set-default-zone=external'])
set_firewall_backend('nftables') set_firewall_backend('nftables')