Page MenuHomeVyOS Platform
Create Task
Maniphest T4218

firewall: rule name is not allowed to start with a number
Closed, ResolvedPublicBUG
Actions

Description

To reproduce use:

set firewall group address-group nameservers address '10.20.0.15'
set firewall name 37-out default-action 'accept'
set firewall name 37-out rule 10 action 'accept'
set firewall name 37-out rule 10 destination group address-group 'nameservers'
set firewall name 37-out rule 10 destination port '53'
set firewall name 37-out rule 10 protocol 'udp'
set firewall name 37-out rule 10 state new 'enable'
set firewall name 37-out rule 100 action 'drop'
set firewall name 37-out rule 100 destination address '10.20.0.0/16'
set firewall name 37-out rule 100 state new 'enable'
[email protected]# commit
[ firewall ]
Failed to apply firewall

[[firewall]] failed
Commit failed
[email protected]# sudo nft -f /run/nftables.conf
/run/nftables.conf:7:11-12: Error: syntax error, unexpected number, expecting string
    chain 37-out {
          ^^
/run/nftables.conf:8:12-16: Error: syntax error, unexpected state, expecting timeout or expectation or helper
        ct state {new} meta l4proto  udp udp dport {53} ip daddr $A_nameservers counter return comment "37-out-10"
           ^^^^^
/run/nftables.conf:9:12-16: Error: syntax error, unexpected state, expecting timeout or expectation or helper
        ct state {new} ip daddr 10.20.0.0/16 counter drop comment "37-out-100"
           ^^^^^
/run/nftables.conf:10:17-22: Error: syntax error, unexpected return, expecting string
        counter return comment "37-out default-action accept"
                ^^^^^^
/run/nftables.conf:12:1-1: Error: syntax error, unexpected '}'
}
^
[edit]

Maybe simply prefix the NFS tables with VyOS_ ??

Details

Difficulty level
Easy (less than an hour)
Version
1.4-rolling-202201270317
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Unspecified (please specify)

Event Timeline

c-po assigned this task to sarthurdev.Jan 28 2022, 9:22 PM
c-po created this task.
pasik added a subscriber: pasik.Jan 29 2022, 11:27 AM
sarthurdev changed the task status from Open to In progress.Jan 29 2022, 10:34 PM
m.korobeinikov added a subscriber: m.korobeinikov.EditedJan 29 2022, 11:18 PM

The same situation if you set the number or special symbol.

set firewall name 1TEST rule 2 action accept
set firewall name !TEST rule 2 action accept
set firewall name T!EST rule 2 action accept
set firewall name TES!T rule 2 action accept
set firewall name 9_TEST rule 2 action accept
set firewall name #TEST rule 2 action accept
set firewall name @TEST rule 2 action accept
set firewall name TEST) rule 2 action accept


vyos@vyos# commit
[ firewall ]
Failed to apply firewall

[[firewall]] failed
Commit failed
[edit]

But it works so :

set firewall name T9EST rule 2 action accept

It ll be working well if add a letter (in this ticket)

set firewall name a37-out rule 10 action 'accept'

or

set firewall name VyOS_37-out rule 10 action 'accept'
sarthurdev changed the task status from In progress to Needs testing.Jan 31 2022, 5:06 PM

PR: https://github.com/vyos/vyos-1x/pull/1199

m.korobeinikov added a comment.Feb 1 2022, 9:44 PM

( VyOS 1.4-rolling-202202010836)- Rule name which starts with a number work well.

vyos@vyos# sh firewall
 name 1TEST {
   rule 2 {
       action accept
   }
 }
 name 9_TEST {
   rule 2 {
       action accept
   }
c-po added a comment.Feb 3 2022, 7:05 AM

Thanks - works again

c-po closed this task as Resolved.Feb 3 2022, 7:05 AM
c-po moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.Feb 13 2022, 7:38 PM