Package: pyroman
Version: 0.4.6-4
Severity: important
Tags: upstream patch
There is currently no easy way to add "esp" and "ah" protocols in a rule
because the
protocols are not recognized by pyroman.
This patch allows the following "add_service" definition:
add_service("ipsec", dports="esp ah")
and if used in a rule like:
allow(client="host1", server="vpnhost", service="ipsec")
will generate the rules properly.
I'm reporting the bug against what's installed on this system, but it should
apply to the latest version in SVN.
-- System Information:
Debian Release: 6.0.1
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
Versions of packages pyroman depends on:
ii iptables 1.4.8-3 administration tools for packet fi
ii python 2.6.6-3+squeeze7 interactive high-level object-orie
ii python-support 1.0.10 automated rebuilding support for P
pyroman recommends no packages.
pyroman suggests no packages.
-- no debconf information
diff --git a/pyroman/port.py b/pyroman/port.py
index 1883f218..28d8acb0 100644
--- a/pyroman/port.py
+++ b/pyroman/port.py
@@ -45,7 +45,7 @@ class Port:
"""
# Split and verify syntax of statement
- preg = re.compile("^(?:([a-z0-9\-]+|[0-9]+(?:\:[0-9]+)?)(?:/))?(tcp|udp|icmp|icmpv6|ipv6-icmp)$")
+ preg = re.compile("^(?:([a-z0-9\-]+|[0-9]+(?:\:[0-9]+)?)(?:/))?(tcp|udp|esp|ah|icmp|icmpv6|ipv6-icmp)$")
# verify port range
prreg = re.compile("^([0-9]+:)?[0-9]+$")
@@ -66,7 +66,7 @@ class Port:
self.proto = m.group(2)
# if it's a named port, verify it's resolveable...
- if not self.prreg.match(self.port) and self.proto in ["udp", "tcp"]:
+ if self.proto in ["udp", "tcp"] and not self.prreg.match(self.port):
try:
socket.getservbyname(self.port, self.proto)
except socket.error:
@@ -105,6 +105,9 @@ class Port:
return "--icmpv6-type " + self.port
else:
return ""
+ elif self.proto in ("esp", "ah"):
+ # no port for ESP and AH
+ return ""
else:
raise PyromanException("Unknown protocol: %s" % self.proto)
diff --git a/pyroman/service.py b/pyroman/service.py
index 3f4d8d51..64aaf44f 100644
--- a/pyroman/service.py
+++ b/pyroman/service.py
@@ -93,7 +93,7 @@ class Service:
f1 = dp.get_filter_proto() + " "
f2 = sp.get_filter_port(dir1)
f3 = dp.get_filter_port(dir2)
- if f2 != "" or f3 != "":
+ if f1.strip() or f2 != "" or f3 != "":
result.append( f1 + " " + f2 + " " + f3 )
for i in self.include:
