Merge branch 'jenner' of http://git.vyatta.com/vyatta-cfg-system into jenner

4 files changed, 60 insertions, 35 deletions

diff --git a/debian/changelog b/debian/changelog
index c0cfc100..82c12f32 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+vyatta-cfg-system (0.15.30) unstable; urgency=low
+
+  * * add jump to local-zone-out chain in OUTPUT chain for both [ip and
+    ip6] tables
+
+ -- Mohit Mehta <mohit.mehta@vyatta.com>  Fri, 24 Apr 2009 18:31:57 -0700
+
 vyatta-cfg-system (0.15.29) unstable; urgency=low
 
   * Add support for virtual-ethernet
diff --git a/scripts/zone-mgmt/vyatta-zone.pl b/scripts/zone-mgmt/vyatta-zone.pl
index f826244b..b4fc7ad3 100755
--- a/scripts/zone-mgmt/vyatta-zone.pl
+++ b/scripts/zone-mgmt/vyatta-zone.pl
@@ -188,23 +188,6 @@ sub add_fromlocalzone_ruleset {
                 $ruleset_type, $ruleset, '-o', $zone_chain);
     return ($error, ) if $error;
 
-     # if jump to localzoneout chain not inserted, then insert rule
-     my $rule_cnt = Vyatta::Zone::count_iptables_rules($cmd_hash{$ruleset_type},
-                $table_hash{$ruleset_type}, "OUTPUT");
-     my $insert_at_rule_num=1;
-     if ( $rule_cnt > 1 ) {
-        $insert_at_rule_num=$rule_cnt;
-     }
-     my $result = Vyatta::Zone::rule_exists ($cmd_hash{$ruleset_type},
-        $table_hash{$ruleset_type}, "OUTPUT", $zone_chain);
-     if ($result < 1) {
-      my $cmd = "sudo $cmd_hash{$ruleset_type} -t $table_hash{$ruleset_type} " . 
-	"-I OUTPUT $insert_at_rule_num -j $zone_chain";
-      $error = Vyatta::Zone::run_cmd($cmd);
-      return "Error: call to add jump rule for local zone out
-$zone_chain chain failed [$error]" if $error;
-     }
-
     return;
 }
 
@@ -260,16 +243,6 @@ sub delete_fromlocalzone_ruleset {
 		$ruleset_type, $ruleset, '-o', $zone_chain);
     return ($error, ) if $error;
 
-    # if only drop rule in $zone_chain, then delete jump from OUTPUT chain
-    my $rule_cnt = Vyatta::Zone::count_iptables_rules($cmd_hash{$ruleset_type}, 
-	$table_hash{$ruleset_type}, $zone_chain);
-    if ($rule_cnt < 2) {
-      $cmd = "sudo $cmd_hash{$ruleset_type} -t $table_hash{$ruleset_type} " . 
-	"-D OUTPUT -j $zone_chain";
-      $error = Vyatta::Zone::run_cmd($cmd);
-      return "Error: call to delete jump rule for local zone out
-$zone_chain chain failed [$error]" if $error;
-     }
     return;
 }
 
@@ -547,7 +520,7 @@ sub delete_zone_interface {
 
 sub add_fromzone_fw {
     my ($zone, $from_zone, $ruleset_type, $ruleset_name) = @_;
-    my $error;
+    my ($cmd, $error);
 
     # for all interfaces in from zone apply ruleset to filter traffic
     # from this zone to specified zone (i.e. $zone)
@@ -570,14 +543,37 @@ sub add_fromzone_fw {
           return "Error: $error" if $error;        
         }
       }
-    }
+
+      my $zone_chain=Vyatta::Zone::get_zone_chain("exists",
+                        $from_zone, 'localout');
+      # add jump to local-zone-out chain in OUTPUT chains for [ip and ip6]tables
+      foreach my $tree (keys %cmd_hash) {
+        # if jump to localzoneout chain not inserted, then insert rule
+        my $rule_cnt = Vyatta::Zone::count_iptables_rules($cmd_hash{$tree},
+                $table_hash{$tree}, "OUTPUT");
+        my $insert_at_rule_num=1;
+        if ( $rule_cnt > 1 ) {
+          $insert_at_rule_num=$rule_cnt;
+        }
+        my $result = Vyatta::Zone::rule_exists ($cmd_hash{$tree},
+          $table_hash{$tree}, "OUTPUT", $zone_chain);
+        if ($result < 1) {
+          my $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} " .
+             "-I OUTPUT $insert_at_rule_num -j $zone_chain";
+          $error = Vyatta::Zone::run_cmd($cmd);
+          return "Error: call to add jump rule for local zone out
+$zone_chain chain failed [$error]" if $error;
+        }
+      }
+
+    } # end of else
 
     return;
 }
 
 sub delete_fromzone_fw {
     my ($zone, $from_zone, $ruleset_type, $ruleset_name) = @_;
-    my $error;
+    my ($cmd, $error);
 
     # for all interfaces in from zone remove ruleset to filter traffic
     # from this zone to specified zone (i.e. $zone)
@@ -600,7 +596,29 @@ sub delete_fromzone_fw {
           return "Error: $error" if $error;
         }
       }
-    }
+    
+      my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig",
+                        $from_zone, 'localout');
+      # if only drop rule in $zone_chain in both [ip and ip6]tables
+      # then delete jump from OUTPUT chain in both
+      foreach my $tree (keys %cmd_hash) {
+        my $rule_cnt = Vyatta::Zone::count_iptables_rules($cmd_hash{$tree},
+        $table_hash{$tree}, $zone_chain);
+        if ($rule_cnt > 1) {
+         # atleast one of [ip or ip6]tables has local-zone as a from zone
+         return;
+        }
+      }
+
+      foreach my $tree (keys %cmd_hash) {
+           $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} " .
+           "-D OUTPUT -j $zone_chain";
+           $error = Vyatta::Zone::run_cmd($cmd);
+           return "Error: call to delete jump rule for local zone out
+$zone_chain chain failed [$error]" if $error;
+      }
+
+    } # end of else
     return;
 }
 
diff --git a/templates/zone-policy/zone/node.tag/from/node.tag/firewall/ipv6-name/node.def b/templates/zone-policy/zone/node.tag/from/node.tag/firewall/ipv6-name/node.def
index 1283f55c..e34cf8c4 100644
--- a/templates/zone-policy/zone/node.tag/from/node.tag/firewall/ipv6-name/node.def
+++ b/templates/zone-policy/zone/node.tag/from/node.tag/firewall/ipv6-name/node.def
@@ -7,7 +7,7 @@ allowed:
         echo -n ${params[@]##*/}
 
 create:
-        params=( `ls /opt/vyatta/config/active/firewall/ipv6-name` )
+        params=( `ls /opt/vyatta/config/active/firewall/ipv6-name 2>/dev/null` )
         array_len=${#params[*]}
         i=0
         found=0
@@ -31,7 +31,7 @@ create:
           --ruleset-name="$VAR(@)"
 
 update:
-        params=( `ls /opt/vyatta/config/active/firewall/ipv6-name` )
+        params=( `ls /opt/vyatta/config/active/firewall/ipv6-name 2>/dev/null` )
         array_len=${#params[*]}
         i=0
         found=0
diff --git a/templates/zone-policy/zone/node.tag/from/node.tag/firewall/name/node.def b/templates/zone-policy/zone/node.tag/from/node.tag/firewall/name/node.def
index 8fc557c5..20dd913e 100644
--- a/templates/zone-policy/zone/node.tag/from/node.tag/firewall/name/node.def
+++ b/templates/zone-policy/zone/node.tag/from/node.tag/firewall/name/node.def
@@ -7,7 +7,7 @@ allowed:
         echo -n ${params[@]##*/}
 
 create:
-        params=( `ls /opt/vyatta/config/active/firewall/name` )
+        params=( `ls /opt/vyatta/config/active/firewall/name 2>/dev/null` )
         array_len=${#params[*]}
         i=0
         found=0
@@ -31,7 +31,7 @@ create:
           --ruleset-name="$VAR(@)"
 
 update:
-        params=( `ls /opt/vyatta/config/active/firewall/name` )
+        params=( `ls /opt/vyatta/config/active/firewall/name 2>/dev/null` )
         array_len=${#params[*]}
         i=0
         found=0