diff options
| author | Adam Rogers <arogers0311@gmail.com> | 2026-09-18 09:09:01 +1000 |
|---|---|---|
| committer | Adam Rogers <arogers0311@gmail.com> | 2026-09-18 09:09:01 +1000 |
| commit | 92c2d6ec5ebd1a721f725473c92a24a737de9cfe (patch) | |
| tree | 3afa3301449d49641d7b72b64f929871b5ea9420 /python | |
| parent | 03500232bca1e1e2eda017428171faf9b4a3dc27 (diff) | |
| download | vyos-1x-92c2d6ec5ebd1a721f725473c92a24a737de9cfe.tar.gz vyos-1x-92c2d6ec5ebd1a721f725473c92a24a737de9cfe.zip | |
firewall: T9332: fix GeoIP source/destination nftables set name collision
GeoIP (country-code/ASN) match sets were named
GEOIP_{CC|ASN}{6}_{hook}_{name}_{rule} with no source/destination
discriminator, unlike the sibling FQDN-match naming which already
appends one. A rule matching GeoIP on both source and destination
computed the same set name for both sides, so geoip_update() silently
overwrote one side's IP-range list with the other's, and the generated
rule matched both saddr and daddr against the same single set -
silently dropping one of the two configured constraints with no error
at commit or runtime.
Append the existing source/destination prefix (already in scope,
matching the FQDN convention) to the set name in firewall.py, and
thread the same discriminator through geoip.py's set-name construction
so the rule's match expression and the set it references always agree.
Also updates the non-load-bearing geoip_sets() name construction in
conf_mode/firewall.py and conf_mode/policy_route.py for consistency.
Diffstat (limited to 'python')
| -rwxr-xr-x | python/vyos/firewall.py | 2 | ||||
| -rw-r--r-- | python/vyos/geoip.py | 8 |
2 files changed, 5 insertions, 5 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index f68c317f9..08f978f39 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -259,7 +259,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): # for policy if hook == 'route' or hook == 'route6': hook_name = hook - output.append(f'{ip_name} {prefix}addr {operator} @GEOIP_{geoip_prefix}{def_suffix}_{hook_name}_{fw_name}_{rule_id}') + output.append(f'{ip_name} {prefix}addr {operator} @GEOIP_{geoip_prefix}{def_suffix}_{hook_name}_{fw_name}_{rule_id}_{prefix}') if 'mac_address' in side_conf: suffix = side_conf['mac_address'] diff --git a/python/vyos/geoip.py b/python/vyos/geoip.py index 70c74b04f..eb81f4ce8 100644 --- a/python/vyos/geoip.py +++ b/python/vyos/geoip.py @@ -266,13 +266,13 @@ def geoip_update(firewall=None, policy=None): version = 6 if path[0] == 'ipv6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_CC{vprefix}_{path[1]}_{path[2]}_{path[4]}' + set_name = f'GEOIP_CC{vprefix}_{path[1]}_{path[2]}_{path[4]}_{path[5][0]}' firewall_sets[f'v{version}'][set_name] = db_return_cc_ranges(codes, version) for asns, path in dict_search_recursive(firewall, 'asn'): version = 6 if path[0] == 'ipv6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_ASN{vprefix}_{path[1]}_{path[2]}_{path[4]}' + set_name = f'GEOIP_ASN{vprefix}_{path[1]}_{path[2]}_{path[4]}_{path[5][0]}' firewall_sets[f'v{version}'][set_name] = db_return_asn_ranges(asns, version) if policy: @@ -282,13 +282,13 @@ def geoip_update(firewall=None, policy=None): version = 6 if path[0] == 'route6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}' + set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}_{path[4][0]}' policy_sets[f'v{version}'][set_name] = db_return_cc_ranges(codes, version) for asns, path in dict_search_recursive(policy, 'asn'): version = 6 if path[0] == 'route6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_ASN{vprefix}_{path[0]}_{path[1]}_{path[3]}' + set_name = f'GEOIP_ASN{vprefix}_{path[0]}_{path[1]}_{path[3]}_{path[4][0]}' policy_sets[f'v{version}'][set_name] = db_return_asn_ranges(asns, version) render( |