Bug 801182
| Summary: | Default ip6tables ruleset does not permit ICMPv6 | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Tore Anderson <tore> | ||||||
| Component: | firewalld | Assignee: | Thomas Woerner <twoerner> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | urgent | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 17 | CC: | jpopelka, twoerner | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | firewalld-0.2.4-1.fc17 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2012-03-21 19:05:36 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Tore Anderson
2012-03-07 21:04:30 UTC
Upstream fixed:
commit 18670eaab2c24ecea40dd8804d13360b6a3585ab
Author: Thomas Woerner <twoerner>
Date: Fri Mar 9 12:56:56 2012 +0100
- fixed icmp protocol used for ipv6 (rhbz#801182)
Created attachment 568914 [details] Match and accept ICMPv6 before jumping to the INPUT_* chains (In reply to comment #1) > Upstream fixed Not quite, even though the match now is correct it is never reached. As I explained in the original report, this happens because it hits a catch-all REJET rule in IN_ZONE_public first. This is at least the case when the patch is applide on top of firewalld-0.2.2-1.fc17.src.rpm. I've attached a patch which reorders the match a bit so that it works for me, at least. Tore Here is the fix for the remaining problem:
commit 119dec410a1116631d187b8b7a7877d2ea1ae6f7
Author: Thomas Woerner <twoerner>
Date: Mon Mar 12 12:41:28 2012 +0100
- do not REJECT in each zone, use RETURN to get back to the builtin chain;
this makes icmp usable without adding it to each zone
diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py
index b688af9..3e92b6c 100644
--- a/src/firewall/core/fw_zone.py
+++ b/src/firewall/core/fw_zone.py
@@ -128,7 +128,7 @@ class FirewallZone:
"-j", "%s_allow" % (_zone) ]))
if table == "filter":
rules.append((ipv, [ _zone, 3, "-t", table,
- "-j", "%%REJECT%%" ]))
+ "-j", "RETURN" ]))
if create:
# handle chains first
Confirmed, that fixes the problem, ICMPv6 are now let through and IPv6 works again. That said, the new "-j RETURN" at the end of IN_ZONE_public is rather pointless, as there is an implicit RETURN at the end of each non-built-in iptables chain anyway. So I think you could just as well remove the rule completely, and thus slim down the ruleset a bit. Tore firewalld-0.2.3-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/firewalld-0.2.3-1.fc17 Package firewalld-0.2.3-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing firewalld-0.2.3-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-3817/firewalld-0.2.3-1.fc17 then log in and leave karma (feedback). firewalld-0.2.4-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/firewalld-0.2.4-1.fc17 (In reply to comment #6) > Package firewalld-0.2.3-1.fc17: > * should fix your issue, > * was pushed to the Fedora 17 testing repository, > * should be available at your local mirror within two days. > Update it with: > # su -c 'yum update --enablerepo=updates-testing firewalld-0.2.3-1.fc17' > as soon as you are able to. > Please go to the following url: > https://admin.fedoraproject.org/updates/FEDORA-2012-3817/firewalld-0.2.3-1.fc17 > then log in and leave karma (feedback). Fix confirmed, DHCPv6 opening also much appreciated. Could not figure out how to leave positive karma though - it says status obsolete, maybe that's why? Tore Please use https://admin.fedoraproject.org/updates/firewalld-0.2.4-1.fc17 it replaced the old version (see comment #7) (In reply to comment #9) > Please use https://admin.fedoraproject.org/updates/firewalld-0.2.4-1.fc17 it > replaced the old version (see comment #7) Ah, didn't notice there was a new version out. Tested, fix confirmed, and positive karma added. Tore firewalld-0.2.4-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. Created attachment 572753 [details] Allow (ipv6-)icmp before conntrack checking I found out, that replies to ICMPv6 Echo requests sent to IPv6 multicast address are still not let through, for example 'ping6 -I eth0 ff02::1'. Problem is that conntrack marks these replies as INVALID and they are rejected because of matching this rule: "-I INPUT -m conntrack --ctstate INVALID -j --reject-with icmp6-adm-prohibited" I asked netfilter upstream and if I understand the response [1] correctly there's no way how this can be "fixed" in conntrack module so we should probably move the rule "-I INPUT -p %%ICMP%% -j ACCEPT" before the conntrack one. [1] http://www.spinics.net/lists/netfilter/msg52580.html |