Page MenuHomeVyOS Platform

Issues while deleting all rules from a firewall
Closed, ResolvedPublicBUG

Description

It is possible to create a firewall name with no rules other than the default-action:

[edit]
[email protected]# set firewall name TEST default-action accept 
[edit]
[email protected]# set interfaces ethernet eth0 firewall in name 'TEST'
[edit]
[email protected]# commit
[edit]
[email protected]#

It is possible to go from an empty firewall to one with rules:

[edit]
[email protected]# set firewall name TEST rule 1 action accept 
[edit]
[email protected]# commit
[edit]
[email protected]#

However the operation is not reversable:

[edit]
[email protected]# delete firewall name TEST rule 1
[edit]
[email protected]# commit
[ firewall name TEST ]
Firewall configuration error: Cannot delete rule set "TEST" (still in use)



[[firewall name TEST]] failed
Commit failed
[edit]
[email protected]#

The also seems to be a race condition/improper order of operations when simultaneously removing both the firewall and the places it is used:

[edit]
[email protected]# delete interfaces ethernet eth0 firewall in name 'TEST'
[edit]
[email protected]# delete firewall name TEST
[edit]
[email protected]# commit
[ firewall name TEST ]
Firewall configuration error: Cannot delete rule set "TEST" (still in use)



delete [ firewall name TEST ] failed
Commit failed
[edit]
[email protected]#

This needs two commits to succeed:

[edit]
[email protected]# delete interfaces ethernet eth0 firewall in name 'TEST'
[edit]
[email protected]# commit
[edit]
[email protected]# delete firewall name TEST
[edit]
[email protected]# commit
[edit]
[email protected]#

Details

Difficulty level
Hard (possibly days)
Version
1.2.0-rolling+201903040337
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

varesa created this object in space S1 VyOS Public.
dmbaturin added a subscriber: dmbaturin.

Sadly, still reproducible. I fear we may want to keep it as a known wart until the firewall rewrite is complete.

dmbaturin set Is it a breaking change? to Unspecified (possibly destroys the router).
Viacheslav changed the subtype of this task from "Task" to "Bug".
Viacheslav changed Difficulty level from Unknown (require assessment) to Hard (possibly days).
sdev changed the task status from Open to Needs testing.Jan 18 2022, 1:45 PM
sdev claimed this task.
sdev added a subscriber: sdev.

Tested on VyOS 1.4-rolling-202202150317 and working as expected.