Page MenuHomeVyOS Platform
Create Task
Maniphest T4435

Policy route and firewall - error when using undefined group
Closed, ResolvedPublicBUG
Actions

Description

Add policy match not existing group:

set policy route PBR rule 10 destination group port-group 'NOGROUP' 
set policy route PBR rule 10 protocol 'tcp'
set interfaces ethernet eth4 policy route PBR

Commit erros:

vyos@tstrtr2# commit
[ policy route PBR ]
Invalid port-group "NOGROUP" on policy route rule

[[policy route PBR]] failed
[ interfaces ethernet eth4 policy ]
VyOS had an issue completing a command.

Report time:      2022-05-20 16:13:24
Image version:    VyOS 1.4-rolling-202205200217
Release train:    sagitta

Built by:         autobuild@vyos.net
Built on:         Fri 20 May 2022 02:17 UTC
Build UUID:       710f6def-46af-4eaf-9aaa-6e8261414b78
Build commit ID:  69f82f599dcd07

Architecture:     x86_64
Boot via:         installed image
System type:      KVM guest

Hardware vendor:  QEMU
Hardware model:   Standard PC (i440FX + PIIX, 1996)
Hardware S/N:     
Hardware UUID:    eb1c36f5-4f71-45c9-b4c7-39a74285ea0f

Traceback (most recent call last):
  File "/usr/libexec/vyos/conf_mode/policy-route-interface.py", line 117, in <module>
    apply(c)
  File "/usr/libexec/vyos/conf_mode/policy-route-interface.py", line 97, in apply
    cmd(f'nft insert rule ip mangle {route_chain} iifname {ifname} counter jump {name}')
  File "/usr/lib/python3/dist-packages/vyos/util.py", line 161, in cmd
    raise OSError(code, feedback)
PermissionError: [Errno 1] failed to run command: nft insert rule ip mangle VYOS_PBR_PREROUTING iifname eth4 counter jump VYOS_PBR_PBR
returned: 
exit code: 1

noteworthy:
cmd 'nft insert rule ip mangle VYOS_PBR_PREROUTING iifname eth4 counter jump VYOS_PBR_PBR'
returned (out):

returned (err):
Error: Could not process rule: No such file or directory
insert rule ip mangle VYOS_PBR_PREROUTING iifname eth4 counter jump VYOS_PBR_PBR
                                                                    ^^^^^^^^^^^^

[[interfaces ethernet eth4 policy]] failed
Commit failed
[edit]
vyos@tstrtr2#

Required extra checks

Details

Version
VyOS 1.4-rolling-202205200217
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

Viacheslav created this task.May 20 2022, 4:16 PM
Viacheslav renamed this task from Policy route without definded port-group erros to Policy route without defined port-group error.
pasik subscribed.May 20 2022, 4:20 PM
n.fort subscribed.Jun 11 2022, 11:15 AM

Extra checks are needed not only when attaching a policy route to an interface, but also when attaching firewall.
For example:

vyos@vyos# set firewall name FOO rule 10 action accept 
[edit]
vyos@vyos# set firewall name FOO rule 10 destination group address-group NOAG
[edit]
vyos@vyos# commit

Invalid address-group "NOAG" on firewall rule

[[firewall]] failed
Commit failed
[edit]


## So Far, it's OK
## But
vyos@vyos# set int eth eth3 firewall in name FOO 
[edit]
vyos@vyos# compare
+firewall {
+    name FOO {
+        rule 10 {
+            action accept
+            destination {
+                group {
+                    address-group NOAG
+                }
+            }
+        }
+    }
+}
[edit interfaces ethernet eth3]
+firewall {
+    in {
+        name FOO
+    }
+}
[edit]
vyos@vyos# 
[edit]
vyos@vyos# commit

Invalid address-group "NOAG" on firewall rule

[[firewall]] failed
Commit failed

## Commit fails as expected, but interfaces config was commited properly:
vyos@vyos# run show config comm | grep fire
set interfaces ethernet eth3 firewall in name 'FOO'
n.fort renamed this task from Policy route without defined port-group error to Policy route and firewall - error when using undefined group.Jun 11 2022, 11:19 AM
sarthurdev changed the task status from Open to Needs testing.Jun 15 2022, 9:15 PM
sarthurdev claimed this task.
sarthurdev moved this task from Open to In Progress on the VyOS 1.4 Sagitta board.
sarthurdev subscribed.

PR: https://github.com/vyos/vyos-1x/pull/1362

Restricted Repository Identity mentioned this in rVYOSONEX10782837ad7c: Merge pull request #1362 from sarthurdev/T4435.Jun 25 2022, 9:14 AM
sarthurdev mentioned this in rVYOSONEXfb984a3fc56d: firewall: T4435: Verify parent config applied successfully.Jun 25 2022, 9:14 AM
Viacheslav closed this task as Resolved.Sep 1 2022, 4:59 PM
Viacheslav moved this task from In Progress to Finished on the VyOS 1.4 Sagitta board.