Page MenuHomeVyOS Platform
Create Task
Maniphest T5977

nftables: Operation not supported when using match-ipsec in outbound firewall
Closed, ResolvedPublicBUG
Actions

Description

Commit fails when trying to use match-ipsec in firewall ipv4 output filter rule

vyos@vyos# commit

Failed to apply firewall: /run/nftables.conf:45:9-38: Error: Could not
process rule: Operation not supported         meta ipsec == 1 counter
accept comment "ipv4-OUT-filter-10"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ /run/nftables.conf:46:9-22: Error: Could
not process rule: Operation not supported         counter accept comment
"OUT-filter default-action accept"         ^^^^^^^^^^^^^^
/run/nftables.conf:50:9-62: Error: Could not process rule: Operation not
supported         ip frag-off & 0x3fff != 0 meta mark set 0xffff1 return
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

[[firewall]] failed
Commit failed

Commands to reproduce:

set firewall ipv4 output filter rule 10 action accept
set firewall ipv4 output filter rule 10 ipsec match-ipsec

This also occurs when jumping to a rule set that contains a match-ipsec.

Details

Difficulty level
Unknown (require assessment)
Version
1.4.0-rc3, 1.5-rolling-202401230024
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)

Event Timeline

devon created this task.Jan 23 2024, 6:01 AM
n.fort changed the task status from Open to Confirmed.Jan 23 2024, 10:49 AM
Viacheslav added a subscriber: Viacheslav.EditedJan 23 2024, 11:33 AM

Also, issues with the input

vyos@r4# set firewall ipv4 input filter rule 10 action accept
[edit]
vyos@r4# set firewall ipv4 input filter rule 10 ipsec match-ipsec
[edit]
vyos@r4# 
[edit]
vyos@r4# commit
[ firewall ]
Failed to apply firewall: /run/nftables.conf:19:17-27: Error: No such
file or directory; did you mean table ‘vyos_filter’ in family ip? delete
table ip vyos_filter                 ^^^^^^^^^^^
/run/nftables.conf:47:18-28: Error: No such file or directory; did you
mean table ‘vyos_filter’ in family ip? delete table ip6 vyos_filter
^^^^^^^^^^^ /run/nftables.conf:75:21-31: Error: No such file or
directory; did you mean table ‘vyos_filter’ in family ip? delete table
bridge vyos_filter                     ^^^^^^^^^^^

[[firewall]] failed
Commit failed
[edit]
vyos@r4#

Update, input fixed with removing /run/nftables*

pasik added a subscriber: pasik.Jan 23 2024, 11:33 AM
n.fort changed the task status from Confirmed to In progress.Jan 23 2024, 11:47 AM
n.fort claimed this task.
n.fort added a project: VyOS 1.5 Circinus.
n.fort changed Version from 1.4.0-rc3 to 1.4.0-rc3, 1.5-rolling-202401230024.
n.fort changed Issue type from Unspecified (please specify) to Bug (incorrect behavior).
dmbaturin triaged this task as High priority.Jan 23 2024, 6:57 PM
n.fort added a comment.Jan 23 2024, 8:26 PM

Pr for 1.5: https://github.com/vyos/vyos-1x/pull/2887

n.fort changed the task status from In progress to Needs testing.Feb 1 2024, 10:21 AM
dmbaturin closed this task as Resolved.Feb 15 2024, 5:39 PM
dmbaturin edited projects, added VyOS 1.4 Sagitta (1.4.0-epa1); removed VyOS 1.4 Sagitta.