Page MenuHomeVyOS Platform
Create Task
Maniphest T5250

Firewall - show firewall group
Closed, ResolvedPublicBUG
Actions

Description

Command show firewall group [group_name] prints wrong/incomplete information for ipv6-address-group and ipv6-network-group: references are not printed

vyos@vyos# run show config comm | grep group
set firewall group address-group AG01 address '1.1.1.1'
set firewall group ipv6-address-group V6-AG01 address '2001::1'
set firewall group ipv6-network-group V6-NG01 network '2001:db8::0/64'
set firewall group mac-group MG01 mac-address '11:22:33:44:55:66'
set firewall group network-group NG01 network '2.2.2.0/30'
set firewall group port-group PG01 port '22-25'
set firewall ipv6-name FOO-6 rule 10 destination group network-group 'V6-NG01'
set firewall ipv6-name FOO-6 rule 10 source group address-group 'V6-AG01'
set firewall ipv6-name FOO-6 rule 10 source group mac-group 'MG01'
set firewall ipv6-name FOO-6 rule 10 source group port-group 'PG01'
set firewall name FOO rule 10 destination group network-group 'NG01'
set firewall name FOO rule 10 destination group port-group 'PG01'
set firewall name FOO rule 10 source group address-group 'AG01'
set firewall name FOO rule 10 source group mac-group 'MG01'
[edit]
vyos@vyos# run show firewall group 
Firewall Groups

Name     Type                References    Members
-------  ------------------  ------------  -----------------
AG01     address_group       FOO-10        1.1.1.1
V6-AG01  ipv6_address_group  N/A           2001::1
V6-NG01  ipv6_network_group  N/A           2001:db8::0/64
MG01     mac_group           FOO-10        11:22:33:44:55:66
                             FOO-6-10
NG01     network_group       FOO-10        2.2.2.0/30
PG01     port_group          FOO-10        22-25
                             FOO-6-10
[edit]
vyos@vyos# run show firewall group V6-AG01 
Firewall Groups

Name     Type                References    Members
-------  ------------------  ------------  ---------
V6-AG01  ipv6_address_group  N/A           2001::1
[edit]
vyos@vyos# 

vyos@vyos# run show firewall group AG01  
Firewall Groups

Name    Type           References    Members
------  -------------  ------------  ---------
AG01    address_group  FOO-10        1.1.1.1
[edit]
vyos@vyos#

Details

Difficulty level
Unknown (require assessment)
Version
1.4-rolling-202305310317
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

n.fort changed the task status from Open to In progress.May 31 2023, 6:38 PM
n.fort claimed this task.
n.fort created this task.
pasik added a subscriber: pasik.May 31 2023, 7:34 PM
cuongdt1994 added a subscriber: cuongdt1994.Jun 5 2023, 11:38 PM

In this case I found the ipv6-address-group and ipv6-network-group not assigned without name or group. Because it's can't show references.

Example:

The demo below clearly indicates the problem is happening, references is normal.

NG01 (*)
network_group (*)
FOO-10 (**)
2.2.2.0/30 (*)

(*) set firewall group network-group NG01 network '2.2.2.0/30'
(**) set firewall name FOO rule 10 destination group network-group 'NG01'

but in the command here.

set firewall group ipv6-address-group V6-AG01 address '2001::1'
set firewall group ipv6-network-group V6-NG01 network '2001:db8::0/64'

I didn't find a qualified reference to show.

Reference code:

def find_references(group_type, group_name):
    out = []
    for name_type in ['name', 'ipv6_name']:
        if name_type not in firewall:
            continue
        for name, name_conf in firewall[name_type].items():
            if 'rule' not in name_conf:
                continue
            for rule_id, rule_conf in name_conf['rule'].items():
                source_group = dict_search_args(rule_conf, 'source', 'group', group_type)
                dest_group = dict_search_args(rule_conf, 'destination', 'group', group_type)
                if source_group and group_name == source_group:
                    out.append(f'{name}-{rule_id}')
                elif dest_group and group_name == dest_group:
                    out.append(f'{name}-{rule_id}')
    return out

header = ['Name', 'Type', 'References', 'Members']
vfreex added a subscriber: vfreex.Jun 29 2023, 7:51 PM
This comment was removed by vfreex.
n.fort added a comment.Jul 12 2023, 10:13 AM

PR in firewall refactor: https://github.com/vyos/vyos-1x/pull/2016

n.fort changed the task status from In progress to Needs testing.Aug 30 2023, 1:53 PM
n.fort closed this task as Resolved.Oct 3 2023, 6:58 PM