Page MenuHomeVyOS Platform

Can't commit due to with the same name, but different firewall groups types
Needs testing, NormalPublicBUG

Description

Here is a simple firewall group that would not let me execute a commit despite that address-group in question has been defined.

This is the config.boot :

firewall {
    all-ping enable
    broadcast-ping disable
    config-trap disable
    group {
...
}
address-group emby {
    address 10.0.7.10
}
...
}
port-group emby {
    port 8096
    port 8920
}

This is the error I was getting when committing :

vyos@fw01# commit
[ firewall name trust_to_server rule 710 destination group address-group emby ]
Group [emby] has not been defined

[[firewall name trust_to_server]] failed
Commit failed

This is the candidate config :

vyos@fw01# compare
[edit firewall name trust_to_server]
+rule 710 {
+    action accept
+    description "emby access"
+    destination {
+        group {
+            address-group emby
+            port-group emby
+        }
+    }
+    protocol tcp
+}

I deleted the address-group then save the config to overwrite the previous config.boot. By doing this, I got a new error message as shown below.

vyos@fw01# commit
[ firewall name trust_to_server rule 710 destination group port-group emby ]
Error: group [emby] is of type [address] not [port]

[[firewall name trust_to_server]] failed
Commit failed

I was able to commit when I renamed one of the groups. In my case, I renamed the port-group to emby_app and the system let me commit.
Now, I am not sure if I encountered two different issues here.

Details

Difficulty level
Unknown (require assessment)
Version
1.2.1
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)

Event Timeline

kabaga created this task.Feb 16 2020, 11:21 PM
pasik added a subscriber: pasik.Feb 17 2020, 8:13 AM
syncer changed the task status from Open to Needs testing.Mar 28 2020, 11:55 AM
syncer triaged this task as Normal priority.
syncer edited projects, added VyOS 1.3 Equuleus; removed VyOS 1.2 Crux.
syncer added a subscriber: syncer.

can you try to reproduce in rolling, please?

Downloaded the latest rolling, the only thing I have done with the rolling was installing it on a fresh Proxmox VM. I created two firewall groups with the same name - one for address-group and the other is for port-group.

+    group {
+        address-group emby {
+            address 10.0.7.10
+        }
+        port-group emby {
+            port 8096
+            port 8920
+        }
+    }

When I tried to commit, I got the error below. However, I was able to commit and save.

vyos@vyos# commit
[ firewall group address-group emby ]
Error: type mismatch [port] [address]

When creating a firewall name, the error below is what I got. Also, I get a commit failed.

vyos@vyos# compare 
[edit firewall]
+name trust_to_server {
+    default-action drop
+    rule 100 {
+        action accept
+        destination {
+            group {
+                address-group emby
+                port-group emby
+            }
+        }
+        source {
+            address 10.0.11.0/24
+        }
+    }
+}
[edit]
vyos@vyos# commit
[ firewall name trust_to_server rule 100 destination group address-group emby ]
Group [emby] has not been defined

[[firewall name trust_to_server]] failed
Commit failed
[edit]
vyos@vyos# 
[edit]
vyos@vyos#

I discarded the candidate config; deleted the "port-group emby" and created a new "port-group emby_app". Then I recreated the same firewall rules and I got the same commit error above despite renaming the port-group. The odd part is the "address-group emby" exist.

The workaround that I find is to delete the "address-group emby" then commit and save. Recreate the "address-group emby" then commit and save. Recreate the same firewall rules with the new port-group emby_app then commit and save. The workaround let me commit the firewall rules. It seems to be related to the config.boot. I have to keep saving the changes I made; otherwise, it would fail to commit.

syncer assigned this task to Dmitry.Mar 28 2020, 1:30 PM