Bug 1459921 - rich rules cannot apply ipv6-only ICMP types
Summary: rich rules cannot apply ipv6-only ICMP types
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: firewalld
Version: 7.4
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Thomas Woerner
QA Contact: Tomas Dolezal
Mirek Jahoda
URL:
Whiteboard:
Depends On: 1409544
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-06-08 14:58 UTC by Tomas Dolezal
Modified: 2017-08-01 16:24 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of: 1409544
Environment:
Last Closed: 2017-08-01 16:24:48 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1934 normal SHIPPED_LIVE firewalld bug fix and enhancement update 2017-08-01 17:55:15 UTC

Comment 2 Tomas Dolezal 2017-06-08 14:58:52 UTC
icmptypes that are unusable for ipv4 are not applied in ipv6tables. However ipv4-only icmptypes are applied in ipv4 tables and their application is skipped for ipv6 - thats expected. The issue seems to be that failure on ipv4 stops the process of adding to ipv6.

bad-header is not applied at all, see bellow. network-unreachable was applied to ip4table

/var/log/firewalld
2017-06-08 16:50:14 WARNING: INVALID_RULE: IcmpType network-prohibited not usable with ipv6
2017-06-08 16:50:51 WARNING: ALREADY_ENABLED: 'rule icmp-type name="bad-header" log' already in 'public'
2017-06-08 16:51:13 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:52:43 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:53:04 WARNING: INVALID_RULE: IcmpType network-unreachable not usable with ipv6

version: firewalld-0.4.4.4-5.el7.noarch

Comment 3 Tomas Dolezal 2017-06-08 15:05:00 UTC
note that there's workaround via using less generic rules

cannot use:
firewall-cmd --add-rich-rule 'rule icmp-type name=bad-header log'

workaround:
firewall-cmd --add-rich-rule 'rule family=ipv6 icmp-type name=bad-header log'

generic ipv4-only works no matter what:
firewall-cmd --add-rich-rule 'rule icmp-type name=network-unreachable log'

Comment 14 errata-xmlrpc 2017-08-01 16:24:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1934


Note You need to log in before you can comment on or make changes to this bug.