From 0ff53ffb2790ab95b71d3df461a04bca8f02a520 Mon Sep 17 00:00:00 2001
From: Imran Iqbal <iqbalmy@hotmail.com>
Date: Sat, 24 Oct 2020 07:08:04 +0100
Subject: [PATCH] feat(firewalld.conf): support configuration of
 `AllowZoneDrifting`

Close #44.

Configuration description taken from:

* https://firewalld.org/documentation/man-pages/firewalld.conf.html
---
 firewalld/files/firewalld.conf                    | 15 +++++++++++++++
 pillar.example                                    |  1 +
 .../default/controls/yaml_dump_spec.rb            |  1 +
 3 files changed, 17 insertions(+)

diff --git a/firewalld/files/firewalld.conf b/firewalld/files/firewalld.conf
index c989717..2e209cd 100644
--- a/firewalld/files/firewalld.conf
+++ b/firewalld/files/firewalld.conf
@@ -95,3 +95,18 @@ FlushAllOnReload={{ firewalld.FlushAllOnReload|default('yes') }}
 # Defaults to "yes".
 RFC3964_IPv4={{ firewalld.RFC3964_IPv4|default('yes') }}
 {%- endif %}
+{%- if firewalld.get('AllowZoneDrifting', False) %}
+
+# AllowZoneDrifting
+# Older versions of firewalld had undocumented behavior known as "zone
+# drifting". This allowed packets to ingress multiple zones - this is a
+# violation of zone based firewalls. However, some users rely on this behavior
+# to have a "catch-all" zone, e.g. the default zone. You can enable this if you
+# desire such behavior. It's disabled by default for security reasons. Note: If
+# "yes" packets will only drift from source based zones to interface based
+# zones (including the default zone). Packets never drift from interface based
+# zones to other interfaces based zones (including the default zone). Valid
+# values; "yes", "no".
+# Defaults to "no".
+AllowZoneDrifting={{ firewalld.AllowZoneDrifting|default('no') }}
+{%- endif %}
diff --git a/pillar.example b/pillar.example
index 3f64319..e68b767 100644
--- a/pillar.example
+++ b/pillar.example
@@ -10,6 +10,7 @@ firewalld:
   FirewallBackend: 'nftables'
   FlushAllOnReload: 'yes'
   RFC3964_IPv4: 'yes'
+  AllowZoneDrifting: 'no'
 
   ipset:
     manage: true
diff --git a/test/integration/default/controls/yaml_dump_spec.rb b/test/integration/default/controls/yaml_dump_spec.rb
index b2f5d6a..5c4b391 100644
--- a/test/integration/default/controls/yaml_dump_spec.rb
+++ b/test/integration/default/controls/yaml_dump_spec.rb
@@ -5,6 +5,7 @@ control 'firewalld `map.jinja` YAML dump' do
 
   yaml_dump = "---\n"
   yaml_dump += <<~YAML_DUMP.chomp
+    AllowZoneDrifting: 'no'
     AutomaticHelpers: system
     FirewallBackend: nftables
     FlushAllOnReload: 'yes'