Bug 1459921 - rich rules cannot apply ipv6-only ICMP types
rich rules cannot apply ipv6-only ICMP types
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: firewalld (Show other bugs)
7.4
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Thomas Woerner
Tomas Dolezal
Mirek Jahoda
:
Depends On: 1409544
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-08 10:58 EDT by Tomas Dolezal
Modified: 2017-08-01 12:24 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Story Points: ---
Clone Of: 1409544
Environment:
Last Closed: 2017-08-01 12:24:48 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 2 Tomas Dolezal 2017-06-08 10:58:52 EDT
icmptypes that are unusable for ipv4 are not applied in ipv6tables. However ipv4-only icmptypes are applied in ipv4 tables and their application is skipped for ipv6 - thats expected. The issue seems to be that failure on ipv4 stops the process of adding to ipv6.

bad-header is not applied at all, see bellow. network-unreachable was applied to ip4table

/var/log/firewalld
2017-06-08 16:50:14 WARNING: INVALID_RULE: IcmpType network-prohibited not usable with ipv6
2017-06-08 16:50:51 WARNING: ALREADY_ENABLED: 'rule icmp-type name="bad-header" log' already in 'public'
2017-06-08 16:51:13 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:52:43 WARNING: INVALID_RULE: IcmpType bad-header not usable with ipv4
2017-06-08 16:53:04 WARNING: INVALID_RULE: IcmpType network-unreachable not usable with ipv6

version: firewalld-0.4.4.4-5.el7.noarch
Comment 3 Tomas Dolezal 2017-06-08 11:05:00 EDT
note that there's workaround via using less generic rules

cannot use:
firewall-cmd --add-rich-rule 'rule icmp-type name=bad-header log'

workaround:
firewall-cmd --add-rich-rule 'rule family=ipv6 icmp-type name=bad-header log'

generic ipv4-only works no matter what:
firewall-cmd --add-rich-rule 'rule icmp-type name=network-unreachable log'
Comment 14 errata-xmlrpc 2017-08-01 12:24:48 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1934

Note You need to log in before you can comment on or make changes to this bug.