Bug 1373260
| Summary: | An error in the permanent direct rules will make all other direct rules using a table other than the filter table not applicable. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Thomas Woerner <twoerner> |
| Component: | firewalld | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | Jiri Jaburek <jjaburek> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.3 | CC: | jjaburek, mkolaja, todoleza |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-0.4.3.2-7.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2016-11-03 21:04:27 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2597.html |
Description of problem: An error in the permanent direct rules will make all other direct rules using a table other than the filter table not applicable. firewall.core.{ipXtables,ebtables}: Copy rule before extracting items in set_rules In set_rules, the rules are grouped by table to be able to create the iptables-save format without changing the table serveral times. For this the table is extracted from the rule and therefore also removed from the rule. But this is not done on a copy of the rule, but the internal rule. This results in removing the table information from the rule completely, which is an issue if the rule can not be applied in the transaction and the generous_mode is used to be able to assign the rules one by one. This is the case for rules saved in direct.xml. Version-Release number of selected component (if applicable): firewalld-0.4.3.2-6.el7 How reproducible: Always Steps to Reproduce: 1. Add two permanent direct rules to the direct interface. One with an error: firewall-cmd --permanent --direct --add-rule ipv4 nat PERROUTING 0 -m mac --mac-source xx:xx:xx:xx:xx -j MARK --set-mark 1 firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 0 -m mac --mac-source 00:11:22:33:44:55 -j MARK --set-mark 1 2. Reload firewalld 3. Test which rules are there: iptables-save | grep mac-source Actual results: No rules Expected results: # iptables-save | grep mac-source -A PREROUTING_direct -m mac --mac-source 00:11:22:33:44:55 -j MARK --set-xmark 0x1/0xffffffff Additional info: Already fixed upstream: https://github.com/t-woerner/firewalld/commit/32474c134556731553c3985bb315ec0ee5f83c99