From d276135878615f36c9b0128bd0bb91570b1064f3 Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Mon, 11 Apr 2022 14:56:08 -0400
Subject: [PATCH] fix(fw_icmptype): don't alter ipvs in io_object

We should never modify the runtime icmptype object. This caused sanity
failures on --runtime-to-permanent because the runtime icmptype
pretended to be ipv4 only, but our configuration (policy
allow-host-ipv6) used it inside an IPv6 only rich rule.

For users that disable IPv6 then this probably triggered an accidental
copy of the stock icmptype to a user icmptype, but with the ipv6 family
dropped.

Conflict: NA
Reference: https://github.com/firewalld/firewalld/commit/d276135878615f36c9b0128bd0bb91570b1064f3
(cherry picked from commit 9a9c9041a365fc8e12a3edf342de784cc5419a72)
---
 src/firewall/core/fw_icmptype.py | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/src/firewall/core/fw_icmptype.py b/src/firewall/core/fw_icmptype.py
index a565bb6d..5b75d314 100644
--- a/src/firewall/core/fw_icmptype.py
+++ b/src/firewall/core/fw_icmptype.py
@@ -21,7 +21,6 @@
 
 __all__ = [ "FirewallIcmpType" ]
 
-import copy
 from firewall.core.logger import log
 from firewall import errors
 from firewall.errors import FirewallError
@@ -54,7 +53,6 @@ class FirewallIcmpType(object):
         orig_ipvs = obj.destination
         if len(orig_ipvs) == 0:
             orig_ipvs = [ "ipv4", "ipv6" ]
-        ipvs = orig_ipvs[:]
         for ipv in orig_ipvs:
             if ipv == "ipv4":
                 if not self._fw.ip4tables_enabled and not self._fw.nftables_enabled:
@@ -68,16 +66,7 @@ class FirewallIcmpType(object):
                 supported_icmps = [ ]
             if obj.name.lower() not in supported_icmps:
                 log.info1("ICMP type '%s' is not supported by the kernel for %s." % (obj.name, ipv))
-                ipvs.remove(ipv)
-        if len(ipvs) != len(orig_ipvs):
-            if len(ipvs) < 1:
-                raise FirewallError(errors.INVALID_ICMPTYPE,
-                                    "No supported ICMP type.")
-            new_obj = copy.deepcopy(obj)
-            new_obj.destination = ipvs
-            self._icmptypes[obj.name] = new_obj
-        else:
-            self._icmptypes[obj.name] = obj
+        self._icmptypes[obj.name] = obj
 
     def remove_icmptype(self, icmptype):
         self.check_icmptype(icmptype)
-- 
2.23.0