Bug #3170
Custom firewall zones precedence
Status: | CLOSED | Start date: | ||
---|---|---|---|---|
Priority: | Normal | Due date: | ||
Assignee: | - | % Done: | 100% | |
Category: | nethserver-firewall-base | |||
Target version: | v6.6 | |||
Security class: | Resolution: | |||
Affected version: | v6.6 | NEEDINFO: | No |
Description
User defined zones should be listed above standard zones in shorewall configuration:
Where a zone is nested in one or more other zones, you may either ensure that the nested zone precedes its parents.
Associated revisions
zones: precedence to custom zones. Refs #3170
zones template: cosmetic fix. Refs #3170
History
#1 Updated by Giacomo Sanchietti about 6 years ago
- Status changed from NEW to TRIAGED
- Target version set to v6.6
- % Done changed from 0 to 20
#2 Updated by Giacomo Sanchietti about 6 years ago
- Status changed from TRIAGED to ON_DEV
- Assignee set to Giacomo Sanchietti
- % Done changed from 20 to 30
#3 Updated by Giacomo Sanchietti about 6 years ago
- Status changed from ON_DEV to MODIFIED
- % Done changed from 30 to 60
#4 Updated by Giacomo Sanchietti about 6 years ago
- Status changed from MODIFIED to ON_QA
- Assignee deleted (
Giacomo Sanchietti) - % Done changed from 60 to 70
Package in nethserver-testing:
- nethserver-firewall-base-2.6.0-1.7.g998a560.ns6.noarch.rpm
- Check the bug is not reproducible (please add the steps to reproduce)
#5 Updated by Nicola Rauso about 6 years ago
- Assignee set to Nicola Rauso
#6 Updated by Nicola Rauso about 6 years ago
- Status changed from ON_QA to VERIFIED
- Assignee deleted (
Nicola Rauso) - % Done changed from 70 to 90
Test case
- Check the bug is not reproducible (please add the steps to reproduce)
Verified: OK
A little estetic issue: the new shorewall template fragment, "/etc/e-smith/templates/etc/shorewall/zones/15objects
", contains the old name in the initial comment
# # 50objects # { use esmith::NetworksDB; my $ndb = esmith::NetworksDB->open_ro(); foreach ($ndb->zones()) { my $i = $_->prop('Interface') || ""; my $n = $_->prop('Network') || ""; next if ($i eq '' || $n eq ''); $OUT .= substr($_->key, 0, 5)." ipv4\n";; } }
to make "/etc/shorewall/zones
" file more readable, the comment should be updated with the new name:
# # 15objects # ...
#7 Updated by Nicola Rauso about 6 years ago
Steps to reproduce:
- create new "
Zone
" into "Firewall Objects" menu - check if in the Shorewall configuration file "
/etc/shorewall/zones
" all the entries relative to custom "Zones
" objects (either the already defined ones, either the new one created in the previous step) have priority (that is they come before) in comparison with standard zones.
#8 Updated by Giacomo Sanchietti about 6 years ago
- Status changed from VERIFIED to CLOSED
- % Done changed from 90 to 100
Released in nethserver-updates:
- nethserver-firewall-base-2.6.1-1.ns6.noarch.rpm