Bug 1459921

Summary:	rich rules cannot apply ipv6-only ICMP types
Product:	Red Hat Enterprise Linux 7	Reporter:	Tomas Dolezal <todoleza>
Component:	firewalld	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	Tomas Dolezal <todoleza>
Severity:	high	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	high
Version:	7.4	CC:	bressers, lmiksik, mjahoda, todoleza, twoerner
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	No Doc Update
Doc Text:	undefined	Story Points:	---
Clone Of:	1409544	Environment:
Last Closed:	2017-08-01 16:24:48 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1409544
Bug Blocks:

Comment 2 Tomas Dolezal 2017-06-08 14:58:52 UTC

icmptypes that are unusable for ipv4 are not applied in ipv6tables. However ipv4-only icmptypes are applied in ipv4 tables and their application is skipped for ipv6 - thats expected. The issue seems to be that failure on ipv4 stops the process of adding to ipv6.

bad-header is not applied at all, see bellow. network-unreachable was applied to ip4table

/var/log/firewalld
2017-06-08 16:50:14 WARNING: INVALID_RULE: IcmpType network-prohibited not usable with ipv6
2017-06-08 16:50:51 WARNING: ALREADY_ENABLED: 'rule icmp-type name="bad-header" log' already in 'public'
2017-06-08 16:51:13 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:52:43 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:53:04 WARNING: INVALID_RULE: IcmpType network-unreachable not usable with ipv6

version: firewalld-0.4.4.4-5.el7.noarch

Comment 3 Tomas Dolezal 2017-06-08 15:05:00 UTC

note that there's workaround via using less generic rules

cannot use:
firewall-cmd --add-rich-rule 'rule icmp-type name=bad-header log'

workaround:
firewall-cmd --add-rich-rule 'rule family=ipv6 icmp-type name=bad-header log'

generic ipv4-only works no matter what:
firewall-cmd --add-rich-rule 'rule icmp-type name=network-unreachable log'

Comment 6 Thomas Woerner 2017-06-08 15:50:43 UTC

Fixed upstream: https://github.com/t-woerner/firewalld/commit/cf50bd0004418abe1294f53b58387a181dfd2b51

Comment 14 errata-xmlrpc 2017-08-01 16:24:48 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1934