Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Simplerule: wrong IP protocol version filter statement for IPv6 traffic #69

Closed
nbarrientos opened this issue Jan 27, 2021 · 0 comments · Fixed by #70
Closed

Simplerule: wrong IP protocol version filter statement for IPv6 traffic #69

nbarrientos opened this issue Jan 27, 2021 · 0 comments · Fixed by #70
Assignees
Labels
bug Something isn't working

Comments

@nbarrientos
Copy link
Collaborator

nbarrientos commented Jan 27, 2021

nftables::simplerule{"foo":
  action => 'accept',
  proto  => 'tcp6',
  dport  => 666,
}

Generates:

inet filter default_in ip version 6 tcp dport { 666 } accept

which is wrong. It should be:

inet filter default_in ip6 version 6 tcp dport { 666 } accept

Otherwise the IPv6 traffic is not matched and hence rejected:

kernel: [nftables] INPUT Rejected: IN=eth0 OUT= MACSRC=X MACDST=X MACPROTO=86dd SRC=FOO DST=BAR LEN=80 TC=0 HOPLIMIT=58 FLOWLBL=791055 PROTO=TCP SPT=41896 DPT=666 SEQ=3478527298 ACK=0 WINDOW=64800 RES=0x00 SYN URGP=0 OPT (020405A00402080AF96995530000000001030307)

Trivial fix to apply here:

https://github.com/voxpupuli/puppet-nftables/blob/master/templates/simplerule.epp#L18

Tests to be fixed accordingly.

@nbarrientos nbarrientos added the bug Something isn't working label Jan 27, 2021
@nbarrientos nbarrientos self-assigned this Jan 27, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant