#305 test routing rules against kernel interface routes not to cl

[Rado Q]

FWB 5.0.1, SuSE Linux 11.2, kernel 2.6.31, iptables-1.4.4

When defined routes replace kernel routes for the interfaces, then the route setting by "ip route ..." fails, fwbuilder aborts applying the remaining routes, not just the ones conflicting.
This caused confusion when copy&paste mistakes/ leftovers from one FireWall to another or typos conflicted with existing interfaces, but no clue why.

Recovery happens by restoring the previous routing table.
While bug #3489096 wasn't fixed, this was a fatal trap, because all routes were broken, machine unreachable.

Since the bug #3489096 has been fixed in the meantime, this has less fatal ill-effects.

Yet, can you add a "routing-conflict" check when compiling routing rules to avoid clashes with preset kernel interface routes/ address definitions?

[Vadim Kurland]

how can this check be done ?

[Rado Q]

I'm not familiar with the FWB code, but I assumed since you have some logic for overlapping (shadowing) policy rules, you could easily adapt that to compare routing entries for networks (with gateway and interface specified) against the network definitions of the interfaces on the firewall.
If they are the same, raise an alarm and stop compiling.

However, the urgency is lowered, since the "restore-routing"-bug is fixed... see it as a nice-to-have "mindslip-safety-net", not a daily killer.

Thanks for considering, and all the good work, appreciate it _VERY_ much. :)