summaryrefslogtreecommitdiff
path: root/data
diff options
context:
space:
mode:
authorsarthurdev <965089+sarthurdev@users.noreply.github.com>2022-10-10 16:04:09 +0200
committersarthurdev <965089+sarthurdev@users.noreply.github.com>2022-10-10 16:04:09 +0200
commit8269866a5d467c8c05e770720a268e1f3cb868c0 (patch)
tree7966588ef88bda399d57d3cc338aaac9affbc353 /data
parent8bd4c4136a248eebdd6d59f8132d394cc1033c29 (diff)
downloadvyos-1x-8269866a5d467c8c05e770720a268e1f3cb868c0.tar.gz
vyos-1x-8269866a5d467c8c05e770720a268e1f3cb868c0.zip
firewall: T4741: Verify zone `from` is defined before use
Diffstat (limited to 'data')
-rw-r--r--data/templates/firewall/nftables-zone.j222
1 files changed, 14 insertions, 8 deletions
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2
index 919881e19..17ef5101d 100644
--- a/data/templates/firewall/nftables-zone.j2
+++ b/data/templates/firewall/nftables-zone.j2
@@ -39,18 +39,22 @@
{% if zone_conf.local_zone is vyos_defined %}
chain VZONE_{{ zone_name }}_IN {
iifname lo counter return
-{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall[fw_name] is vyos_defined %}
+{% if zone_conf.from is vyos_defined %}
+{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall[fw_name] is vyos_defined %}
iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
iifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{% endfor %}
+{% endfor %}
+{% endif %}
{{ zone_conf | nft_default_rule('zone_' + zone_name) }}
}
chain VZONE_{{ zone_name }}_OUT {
oifname lo counter return
-{% for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall[fw_name] is vyos_defined %}
+{% if zone_conf.from_local is vyos_defined %}
+{% for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall[fw_name] is vyos_defined %}
oifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
oifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{% endfor %}
+{% endfor %}
+{% endif %}
{{ zone_conf | nft_default_rule('zone_' + zone_name) }}
}
{% else %}
@@ -59,12 +63,14 @@
{% if zone_conf.intra_zone_filtering is vyos_defined %}
iifname { {{ zone_conf.interface | join(",") }} } counter return
{% endif %}
-{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall[fw_name] is vyos_defined %}
-{% if zone[from_zone].local_zone is not defined %}
+{% if zone_conf.from is vyos_defined %}
+{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall[fw_name] is vyos_defined %}
+{% if zone[from_zone].local_zone is not defined %}
iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
iifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{% endif %}
-{% endfor %}
+{% endif %}
+{% endfor %}
+{% endif %}
{{ zone_conf | nft_default_rule('zone_' + zone_name) }}
}
{% endif %}