File 0002-firewall-cmd-On-getZoneOfInterface-only-as... of Package firewalld

Overview Repositories Revisions Requests Users Attributes Meta

File 0002-firewall-cmd-On-getZoneOfInterface-only-ask-NM-for-p.patch of Package firewalld (Revision ea20f93f3dea3b590902fc0d42f6d7ac)

Currently displaying revision ea20f93f3dea3b590902fc0d42f6d7ac , Show latest

From 01264f0bede1fbb5bb0a6ba902da83145bfa10e7 Mon Sep 17 00:00:00 2001
From: Eric Garver <e@erig.me>
Date: Tue, 17 Jul 2018 15:04:22 -0400
Subject: [PATCH 2/8] firewall-cmd: On getZoneOfInterface only ask NM for
 permanent conns

When the --permanent flag is set first ask NetworkManager if the
interface is in it's permanent configuration. Then we can fallback to
firewalld's config. Previously this just went straight to firewalld's
config which was usually empty in NetworkManger was in use.

Fixes: rhbz 1460295
(cherry picked from commit 02b194ee3fbf11f1dcb406565ef8cf53a2fc74b9)
---
 src/firewall-cmd | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/firewall-cmd b/src/firewall-cmd
index 12e18bb8..778a880f 100755
--- a/src/firewall-cmd
+++ b/src/firewall-cmd
@@ -469,6 +469,17 @@ def try_set_zone_of_interface(_zone, interface):
                 return True
     return False
 
+def try_get_zone_of_interface(interface):
+    if nm_is_imported():
+        try:
+            connection = nm_get_connection_of_interface(interface)
+        except Exception:
+            pass
+        else:
+            if connection is not None:
+                return nm_get_zone_of_connection(connection)
+    return False
+
 parser = argparse.ArgumentParser(usage="see firewall-cmd man page",
                                  add_help=False)
 
@@ -1777,7 +1788,10 @@ if a.permanent:
             cmd.print_and_exit(" ".join(l))
         elif a.get_zone_of_interface:
             for interface in a.get_zone_of_interface:
-                zone = fw.config().getZoneOfInterface(interface)
+                # ask NM before checking our config
+                zone = try_get_zone_of_interface(interface)
+                if not zone:
+                    zone = fw.config().getZoneOfInterface(interface)
                 if zone:
                     if len(a.get_zone_of_interface) > 1:
                         cmd.print_warning("%s: %s" % (interface, zone))
-- 
2.19.0

Places

File 0002-firewall-cmd-On-getZoneOfInterface-only-ask-NM-for-p.patch of Package firewalld (Revision ea20f93f3dea3b590902fc0d42f6d7ac)

Places