-
Bug
-
Resolution: Done-Errata
-
Major
-
rhel-8.5.0
-
firewalld-0.9.11-8.el8_10
-
None
-
Moderate
-
rhel-sst-networking-core
-
ssg_networking
-
20
-
2
-
False
-
No
-
None
-
Pass
-
Automated
-
If docs needed, set a value
-
-
All
-
None
Description of problem:
Firewalld fails to load config when zone contains rich rule with undefined service
Version-Release number of selected component (if applicable):
firewalld-0.9.3-7.el8
How reproducible:
Every time.
Steps to Reproduce:
1. RHEL8.5 VM
- systemctl start firewalld
- firewall-cmd --state
running
2.Add a rich rule using an undefined service:
- /usr/bin/firewall-cmd --add-rich-rule='rule priority="-100" family="ipv4" source address="10.0.0.10" service name="listen" accept' --permanent
- /usr/bin/firewall-cmd --add-rich-rule='rule priority="-100" family="ipv4" source address="10.0.0.11" service name="ssh" accept' --permanent
3. Reload config:
- firewall-cmd --reload
Actual results: Firewalld state becomes not-running, and "failed" when attempted to start with systemd.
Error: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
internal:0:0-0: Error: Could not process rule: No such file or directory
JSON blob:
{"nftables": [{"metainfo": {"json_schema_version": 1}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_INPUT_ZONES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "filter_IN_public"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_OUT_ZONES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "filter_FWDO_public"}}]}}}, {"insert": {"rule": {"family": "ip", "table": "firewalld", "chain": "nat_POSTROUTING_ZONES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "nat_POST_public"}}]}}}, {"insert": {"rule": {"family": "ip6", "table": "firewalld", "chain": "nat_POSTROUTING_ZONES", "expr": [{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "nat_POST_public"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter_FORWARD_IN_ZONES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "filter_FWDI_public"}}]}}}, {"insert": {"rule": {"family": "ip", "table": "firewalld", "chain": "nat_PREROUTING_ZONES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "nat_PRE_public"}}]}}}, {"insert": {"rule": {"family": "ip6", "table": "firewalld", "chain": "nat_PREROUTING_ZONES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "nat_PRE_public"}}]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "mangle_PREROUTING_ZONES", "expr": [{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "eth0"}}, {"goto": {"target": "mangle_PRE_public"}}]}}}]}
[root@rhel8u5-1 zones]# firewall-cmd --state
not running
[root@rhel8u5-1 zones]# systemctl stop firewalld
[root@rhel8u5-1 zones]# systemctl start firewalld
[root@rhel8u5-1 zones]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor p>
Active: active (running) since Thu 2021-12-09 13:59:17 EST; 9s ago
Docs: man:firewalld(1)
Main PID: 3070 (firewalld)
Tasks: 2 (limit: 4976)
Memory: 23.6M
CGroup: /system.slice/firewalld.service
└─3070 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork >
Dec 09 13:59:17 rhel8u5-1.example.com systemd[1]: Starting firewalld - dynamic >
Dec 09 13:59:17 rhel8u5-1.example.com systemd[1]: Started firewalld - dynamic f>
Dec 09 13:59:17 rhel8u5-1.example.com firewalld[3070]: WARNING: AllowZoneDrifti>
Dec 09 13:59:17 rhel8u5-1.example.com firewalld[3070]: ERROR: INVALID_SERVICE: >
Dec 09 13:59:17 rhel8u5-1.example.com firewalld[3070]: ERROR: 'python-nftables'>
internal:0:0-0: Error: C>
internal:0:0-0: Error: C>
internal:0:0-0: Error: C>
internal:0:0-0: Error: C>
- firewall-cmd --state
failed
Expected results: Firewalld state running.
- firewall-cmd --state
running
Additional info:
similar to bz 1852133, but now on RHEL8.5
In RHEL8.4, the same configuration leaves firewalld running with a working configuration.
- external trackers
- links to
-
RHBA-2024:136396 firewalld update