If a single rule is deleted from a firewall rule set used in a zone policy, a superfluous error is produced --
[email protected]# delete firewall name wan-to-local-ipv4 rule 9 [edit] [email protected]# compare [edit firewall name wan-to-local-ipv4] -rule 9 { - action accept - protocol icmp -} [edit] [email protected]# commit [ firewall name wan-to-local-ipv4 ] Firewall configuration error: Cannot delete rule set "wan-to-local-ipv4" (still in use) [[firewall name wan-to-local-ipv4]] failed Commit failed
If there are other rules in the rule set then the chain will still exist and can be modified without consequence.
Please see the following patch which resolves the issue by considering it an error condition only to delete *every* rule in a rule set.
# diff vyatta-firewall.pl vyatta-firewall.pl.bak
529,530d528
< my $all_rules_deleted = 1;
<
532,560c530,560
< if ("$test_rule_hash{$test_rule}" ne 'deleted') {
< $all_rules_deleted = 0;
<
< if ("$test_rule_hash{$test_rule}" eq 'static') {
< next;
< } elsif ("$test_rule_hash{$test_rule}" eq 'added') {
< my $test_node = new Vyatta::IpTables::Rule;
< $test_node->setup("$tree $name rule $test_rule");
< $test_node->set_ip_version($ip_version_hash{$tree});
< my ($err_str, @rule_strs) = $test_node->rule();
< if (defined($err_str)) {
< Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n");
< exit 1;
< }
< my $test_chain = chain_configured(2, $name, $tree);
< if (defined($test_chain)) {
< # Chain name must be unique in both trees
< Vyatta::Config::outputError([$tree,$name], "Firewall configuration error: Rule set name \"$name\" already used in \"$test_chain\"\n");
< exit 1;
< }
< } elsif ("$test_rule_hash{$test_rule}" eq 'changed') {
< my $test_node = new Vyatta::IpTables::Rule;
< $test_node->setup("$tree $name rule $test_rule");
< $test_node->set_ip_version($ip_version_hash{$tree});
< my ($err_str, @rule_strs) = $test_node->rule();
< if (defined($err_str)) {
< Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n");
< exit 1;
< }
---
> if ("$test_rule_hash{$test_rule}" eq 'static') {
> next;
> } elsif ("$test_rule_hash{$test_rule}" eq 'added') {
> my $test_node = new Vyatta::IpTables::Rule;
> $test_node->setup("$tree $name rule $test_rule");
> $test_node->set_ip_version($ip_version_hash{$tree});
> my ($err_str, @rule_strs) = $test_node->rule();
> if (defined($err_str)) {
> Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n");
> exit 1;
> }
> my $test_chain = chain_configured(2, $name, $tree);
> if (defined($test_chain)) {
> # Chain name must be unique in both trees
> Vyatta::Config::outputError([$tree,$name], "Firewall configuration error: Rule set name \"$name\" already used in \"$test_chain\"\n");
> exit 1;
> }
> } elsif ("$test_rule_hash{$test_rule}" eq 'changed') {
> my $test_node = new Vyatta::IpTables::Rule;
> $test_node->setup("$tree $name rule $test_rule");
> $test_node->set_ip_version($ip_version_hash{$tree});
> my ($err_str, @rule_strs) = $test_node->rule();
> if (defined($err_str)) {
> Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n");
> exit 1;
> }
> } elsif ("$test_rule_hash{$test_rule}" eq 'deleted') {
> if (Vyatta::IpTables::Mgr::chain_referenced($table, $name, $iptables_cmd)) {
> # Disallow deleting a chain if it's still referenced
> Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: Cannot delete rule set \"$name\" (still in use)\n");
> exit 1;
564,571d563
<
<
< if ($all_rules_deleted and Vyatta::IpTables::Mgr::chain_referenced($table, $name, $iptables_cmd)) {
< # Disallow deleting a chain if it's still referenced
< Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: Cannot delete rule set \"$name\" (still in use)\n");
< exit 1;
< }
<