Bug 1434763

+++ This bug was initially created as a clone of Bug #1434594 +++

Description of problem:
When creating rich rules that use icmp-type, I was unable to add rules for accepting router-advertisement and neighbor-solicitation packets (while still dropping all other unsolicited traffic) permanently. They are able to be added to the runtime set, but saving them causes errors in the log, and will hose the config for that zone on reload/reboot

Version-Release number of selected component (if applicable):
firewalld-0.4.4.3-2.fc25.noarch


How reproducible:
100%

Steps to Reproduce:
From the router:

[root@Router ~ ]# firewall-cmd --list-all
drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: enp0s31f6
  sources: 
  services: dhcpv6-client
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

[root@Router ~]# ping6 google.com
PING google.com(ya-in-x64.1e100.net (2607:f8b0:4002:c03::64)) 56 data bytes
From Router.localdomain (fe80::be5f:f4ff:fe7b:6364%enp0s31f6) icmp_seq=1 Destination unreachable: Address unreachable
From Router.localdomain (fe80::be5f:f4ff:fe7b:6364%enp0s31f6) icmp_seq=2 Destination unreachable: Address unreachable
From Router.localdomain (fe80::be5f:f4ff:fe7b:6364%enp0s31f6) icmp_seq=3 Destination unreachable: Address unreachable

This is due to the firewall not accepting RA or neighbor solicitation packets, thus I add a firewall rule to work around it

[root@Router ~]# firewall-cmd --add-rich-rule='rule family="ipv6" icmp-type name="router-advertisement" accept'
success
[root@Router ~]# firewall-cmd --list-all
drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: enp0s31f6
  sources: 
  services: dhcpv6-client
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv6" icmp-type name="router-advertisement" accept

This all works great, however, if I then go to make it permanent...

[root@Router ~]# firewall-cmd --add-rich-rule='rule family="ipv6" icmp-type name="router-advertisement" accept' --permanent
success
[root@Router ~]# journalctl | tail
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: copyout_option: set identity association
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: copy_option: set rapid commit (len 0)
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: copy_option: set elapsed time (len 2)
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: copy_option: set option request (len 4)
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: copyout_option: set IA_PD
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: client6_send: send solicit to ff02::1:2%enp0s31f6
Mar 21 17:09:14 Router.localdomain dhcp6c[1112]: dhcp6_reset_timer: reset a timer on enp0s31f6, state=SOLICIT, timeo=20, retrans=121944
Mar 21 17:09:59 Router.localdomain audit: NETFILTER_CFG table=filter family=10 entries=164
Mar 21 17:10:58 Router.localdomain firewalld[834]: WARNING: Unknown element '<class 'firewall.core.rich.Rich_IcmpType'>'
Mar 21 17:11:03 Router.localdomain firewalld[834]: ERROR: Failed to load zone file 'drop.xml': INVALID_ZONE: not a valid zone file: not well-formed (invalid token): line 7, column 6

If we look at that file:
[root@Router ~]# cat /etc/firewalld/zones/drop.xml
<?xml version="1.0" encoding="utf-8"?>
<zone target="DROP">
  <short>Drop</short>
  <description>Unsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
  <masquerade/>
  <rule family="ipv6">
    </>
    <accept/>
  </rule>
  <rule family="ipv6">
    </>
    <accept/>
  </rule>
</zone>

Yeah, that doesn't look right, and if we try now to reload:
[root@Router ~]# firewall-cmd --reload
success
[root@Router ~]# firewall-cmd --list-all
drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: enp0s31f6
  sources: 
  services: 
  ports: 
  protocols: 
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

Blah, everything's gone. So, I attempt to re-add everything

[root@Router ~]# firewall-cmd --add-masquerade --permanent 
success
[root@Router ~]# firewall-cmd --add-masquerade
success
[root@Router ~]# firewall-cmd --add-service=dhcpv6-client 
success
[root@Router ~]# firewall-cmd --list-all
drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: enp0s31f6
  sources: 
  services: 
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

I can re-add the masquerade rule, and that reloads fine

[root@Router ~]# firewall-cmd --reload
success
[root@Router ~]# cat /etc/firewalld/zones/drop.xml
<?xml version="1.0" encoding="utf-8"?>
<zone target="DROP">
  <short>Drop</short>
  <description>Unsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
  <masquerade/>
</zone>
[root@Router ~]# firewall-cmd --list-all
drop (active)
  target: DROP
  icmp-block-inversion: no
  interfaces: enp0s31f6
  sources: 
  services: 
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules:

So, stuck having to drop back to direct rules

Actual results:
Rules are not saved, all customizations to the zone have been destroyed, and firewalld informs me that the file for that zone is now corrupt

Expected results:
Firewalld being able to save rich rules involving icmp-types

Additional info:

--- Additional comment from Thomas Woerner on 2017-03-22 06:34:02 EDT ---

Fixed upstream: https://github.com/t-woerner/firewalld/commit/095bf9f3691bb6f45039b7e15ab61cc52ed32ced