Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nftables backend tries to mix ipv6 addresses and ipv4 addresses in the same rule #1146

Closed
TheBigK02 opened this issue Jun 13, 2023 · 2 comments
Closed

nftables backend tries to mix ipv6 addresses and ipv4 addresses in the same rule #1146

TheBigK02 opened this issue Jun 13, 2023 · 2 comments
Labels
bug Confirmed as a bug.
Projects
firewalld

Comments

@TheBigK02
Copy link

What happened

I upgraded my raspberrypi to Debian bookworm a couple days ago. Since then firewalld upgraded to version 1.3.0-1. Since then the Forwarding of packets to different zones worked differently? So I decided to add polices to accept those forwarded packages.

What you expected to happen

No response

How to reproduce it (as minimally and precisely as possible)

put in ipv4 addresses and ipv6 addresses as sources into the same zone.
use nftables as backend
Create a Policy to accept forwarding packets:

firewall-cmd --permanent --new-policy inToTrusted
firewall-cmd --permanent --policy=intToTrusted --add-egress-zone=trusted
firewall-cmd --permanent --policy=intToTrusted --add-ingress-zone=internal

Anything else we need to know?

No response

Firewalld Version

1.3.0

Firewalld Backend

nftables

Linux distribution

Debian GNU/Linux 12 bookworm

Linux kernel version

6.1.0-9-arm64

Other information

Pastebin1
Pastebin2
@TheBigK02 TheBigK02 added the triage Issue needs triaged. label Jun 13, 2023
erig0 added a commit to erig0/firewalld that referenced this issue Jun 13, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
cfa86d3 
Coverage: firewalld#1146
@erig0 erig0 added bug Confirmed as a bug. and removed triage Issue needs triaged. labels Jun 13, 2023
@erig0 erig0 added this to backlog in firewalld via automation Jun 13, 2023
@erig0
Copy link
Collaborator

erig0 commented Jun 13, 2023

Note: This is fixed on current code (master branch), but affects stable release: 1.2.z, 1.3.z. We should fix it on those stable releases.

#1147 has a new test to trigger this bug.

erig0 added a commit to erig0/firewalld that referenced this issue Jun 13, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
d84e58d 
Coverage: firewalld#1146
erig0 added a commit that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
3e7f059 
Coverage: #1146
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
fix(policy): mixed IP families is ingress/egress
901fb9b 
Note: This fix is unique to the stable branches. The master branch has
significantly diverged in this area.

Fixes: firewalld#1146
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
f84d429 
Coverage: firewalld#1146
(cherry picked from commit 3e7f059)
@erig0 erig0 mentioned this issue Jun 14, 2023
Merged
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
fix(policy): mixed IP families is ingress/egress
6fe6385 
Note: This fix is unique to the stable branches. The master branch has
significantly diverged in this area.

Fixes: firewalld#1146
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
6ef29f5 
Coverage: firewalld#1146
(cherry picked from commit 3e7f059)
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
fix(policy): mixed IP families in ingress/egress
cc9dcbe 
Note: This fix is unique to the stable branches. The master branch has
significantly diverged in this area.

Fixes: firewalld#1146
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
cbc59eb 
Coverage: firewalld#1146
(cherry picked from commit 3e7f059)
erig0 added a commit that referenced this issue Jun 14, 2023
@erig0
fix(policy): mixed IP families in ingress/egress
69ed4d6 
Note: This fix is unique to the stable branches. The master branch has
significantly diverged in this area.

Fixes: #1146
erig0 added a commit that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
6c700a5 
Coverage: #1146
(cherry picked from commit 3e7f059)
@erig0
Copy link
Collaborator

erig0 commented Jun 14, 2023

v1.3.3 released with a fix for this.

@erig0 erig0 closed this as completed Jun 14, 2023
firewalld automation moved this from backlog to Done Jun 14, 2023
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
fix(policy): mixed IP families in ingress/egress
5bb9177 
Note: This fix is unique to the stable branches. The master branch has
significantly diverged in this area.

Fixes: firewalld#1146
(cherry picked from commit 69ed4d6)
erig0 added a commit to erig0/firewalld that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
7b90eb0 
Coverage: firewalld#1146
(cherry picked from commit 3e7f059)
erig0 added a commit that referenced this issue Jun 14, 2023
@erig0
fix(policy): mixed IP families in ingress/egress
d9e4b96 
Note: This fix is unique to the stable branches. The master branch has
significantly diverged in this area.

Fixes: #1146
(cherry picked from commit 69ed4d6)
erig0 added a commit that referenced this issue Jun 14, 2023
@erig0
test(policy): verify ingress and egress zone w/ mixed families
5700608 
Coverage: #1146
(cherry picked from commit 3e7f059)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Confirmed as a bug.
Projects
firewalld
  
Done
Milestone
No milestone
Development

No branches or pull requests
2 participants
@erig0 @TheBigK02