Page MenuHomeVyOS Platform

generate firewall rule-resequence drops geoip country-code from output
Closed, ResolvedPublicBUG

Description

Version: VyOS 1.5-rolling-202311081451
Steps to reproduce:

set firewall ipv4 name SOMEZONE-FORWARD-IPV4 default-action 'drop'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 action 'drop'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 destination geoip country-code 'us'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 destination geoip country-code 'ca'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 destination geoip inverse-match
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 log 'enable'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 20 action 'accept'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 20 source address 192.168.0.5

$ show config commands | grep SOMEZONE
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 default-action 'drop'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 action 'drop'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 destination geoip country-code 'us'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 destination geoip country-code 'ca'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 destination geoip inverse-match
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 10 log 'enable'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 20 action 'accept'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 20 source address '192.168.0.5'

$ generate firewall rule-resequence | grep SOMEZONE
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 default-action 'drop'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 100 action 'drop'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 100 destination geoip inverse-match
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 100 log 'enable'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 110 action 'accept'
set firewall ipv4 name SOMEZONE-FORWARD-IPV4 rule 110 source address '192.168.0.5'

Details

Version
1.5-rolling-202311081451
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

The country-code item in the config_dict is type list and gets skipped by the convert_to_set_commands function.

'destination': {'geoip': {'country-code': ['us', 'ca'], 'inverse-match': {}}},

I think below is a potential fix, although I have only tested it with my own config, not sure if it breaks anything else.

diff -rupP /usr/libexec/vyos/op_mode/generate_firewall_rule-resequence.py generate_firewall_rule-resequence.py
--- /usr/libexec/vyos/op_mode/generate_firewall_rule-resequence.py      2023-09-10 13:42:53.000000000 +0000
+++ generate_firewall_rule-resequence.py        2023-11-14 18:45:53.663591434 +0000
@@ -41,6 +41,10 @@ def convert_to_set_commands(config_dict,
                 commands.extend(
                     convert_to_set_commands(value, f"{current_key} "))

+        elif isinstance(value, list):
+            for item in value:
+                commands.append(f"set {current_key} '{item}'")
+
         elif isinstance(value, str):
             commands.append(f"set {current_key} '{value}'")

My config:

$ show config commands | grep "set firewall ipv4\|set firewall ipv6" | wc -l
349

Pre-patch:

$ generate firewall rule-resequence | grep "set firewall ipv4\|set firewall ipv6" | wc -l
347

Post-patch:

$ generate firewall rule-resequence | grep "set firewall ipv4\|set firewall ipv6" | wc -l
349

@Viacheslav - you're the most familiar with this code, what are your thoughts?

@JeffWDH looks good to me. It definitely should fix this.

Viacheslav changed the task status from Open to In progress.Nov 15 2023, 1:26 PM
Viacheslav assigned this task to JeffWDH.

Fix was merged into 1.4 and 1.5.

JeffWDH triaged this task as Low priority.
JeffWDH edited a custom field.
Viacheslav moved this task from Open to Finished on the VyOS 1.5 Circinus board.
Viacheslav moved this task from Open to Finished on the VyOS 1.4 Sagitta board.