Page MenuHomeVyOS Platform

Issues while deleting all rules from a firewall
Open, NormalPublicBUG

Description

It is possible to create a firewall name with no rules other than the default-action:

[edit]
vyos@vyos# set firewall name TEST default-action accept 
[edit]
vyos@vyos# set interfaces ethernet eth0 firewall in name 'TEST'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos#

It is possible to go from an empty firewall to one with rules:

[edit]
vyos@vyos# set firewall name TEST rule 1 action accept 
[edit]
vyos@vyos# commit
[edit]
vyos@vyos#

However the operation is not reversable:

[edit]
vyos@vyos# delete firewall name TEST rule 1
[edit]
vyos@vyos# commit
[ firewall name TEST ]
Firewall configuration error: Cannot delete rule set "TEST" (still in use)



[[firewall name TEST]] failed
Commit failed
[edit]
vyos@vyos#

The also seems to be a race condition/improper order of operations when simultaneously removing both the firewall and the places it is used:

[edit]
vyos@vyos# delete interfaces ethernet eth0 firewall in name 'TEST'
[edit]
vyos@vyos# delete firewall name TEST
[edit]
vyos@vyos# commit
[ firewall name TEST ]
Firewall configuration error: Cannot delete rule set "TEST" (still in use)



delete [ firewall name TEST ] failed
Commit failed
[edit]
vyos@vyos#

This needs two commits to succeed:

[edit]
vyos@vyos# delete interfaces ethernet eth0 firewall in name 'TEST'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# delete firewall name TEST
[edit]
vyos@vyos# commit
[edit]
vyos@vyos#

Details

Difficulty level
Hard (possibly days)
Version
1.2.0-rolling+201903040337
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

varesa created this object in space S1 VyOS Public.
dmbaturin added a subscriber: dmbaturin.

Sadly, still reproducible. I fear we may want to keep it as a known wart until the firewall rewrite is complete.

dmbaturin set Is it a breaking change? to Unspecified (possibly destroys the router).
Viacheslav changed the subtype of this task from "Task" to "Bug".
Viacheslav changed Difficulty level from Unknown (require assessment) to Hard (possibly days).