Firewalld broken after update...

The_Great_Sephiroth · Posted: Mon Jul 08, 2019 10:34 pm Post subject: Firewalld broken after update...

OK, I updated my system this past weekend since I had a four-day break. It took three days to update (554 updates) and firewalld was one of the updates. I no longer have any firewall. I saw that for whatever idiotic reason, the switch was made to default to nftables. I set it to use iptables. That got me this output while connected to my home network (WiFi).

The_Great_Sephiroth · Posted: Tue Jul 09, 2019 5:53 pm Post subject:

I have continued digging and verified that nftables was fully enabled in my kernel. Is there some tool I need so I can actually firewall my system? I am still down and working from my Android tablet, which limits me.
_________________
Ever picture systemd as what runs "The Borg"?

The_Great_Sephiroth · Posted: Wed Jul 10, 2019 10:04 pm Post subject:

OK, all of our Gentoo systems are on hold until we can figure this out. From the looks of it, somebody decided that firewalld needed to use the shiny, new nftables. They switched it by default but even when I set it to use iptables in /etc/firewalld/firewalld.conf, it generates empty rules and leaves us wide-open. We have reproduced this on a second laptop now, so we have no choice but to stop updates until this is resolved. What I have tried is below.

Setting the firewalld configuration to use iptables
Setting it back to nftables
checked for iptables rules while using iptables int he configuration and nftables rules while in nftables mode
Checked with the firewall-applet GUI interface, realizing that the "permanent" settings are there, but they never go to runtime
Tried allowing samba-client in the runtime page and got a single word error: "RAW"

In other words, this nftables stuff comes across to me as a very alpha product that somebody was dying to test, and it has us affected since we use firewalld with Plasma to configure individual settings in zones and apply said zones to various wireless and wired connections. Now all we get is wide-open at all times no matter what we do. I can manually enter rules on the command-line using sudo, but that is NOT a solution.
_________________
Ever picture systemd as what runs "The Borg"?

Anon-E-moose · Posted: Wed Jul 10, 2019 10:44 pm Post subject:

Why not just convert iptables rules to nftables rules, it's not that hard.

https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables

Or like me you can just create your rules as a script and execute it, I've never needed firewalld or any firewall tool, I tried them in the past and it was easier to just roll my own.

Edit to add: and nftables is not new, it's been around for years. It's just an easier way to do things than the old iptables way.

Edit to add 2: Not sure if you've read this https://firewalld.org/2018/07/nftables-backend

The_Great_Sephiroth · Posted: Wed Jul 10, 2019 11:43 pm Post subject:

I have ALL NFT stuff enabled in the kernel. I just double-checked. Also, I made it the default, as I said in my last post, and it still won't create firewall rules. It won't create them whether NFT or IPT is the backend. It is flat-out broken.

As for the manual rules, that is not a solution. As I said before, I need the software to work as it is intended. Sure, we can do scripts. How about telling that to the finance lady that has only ever used Windows and barely know how to turn on the desktop? This won't work for 99% of us. We are supposed to be able to define firewall zones (home, public, work, etc) and apply certain rules to each zone. We then assign those zones to the connections in NetworkManager and when a connection comes up, the correct zone rules are applied. To the normal users this all happens without them knowing anything. We cannot spend years training these people on how to enter firewall rules, execute BASH scripts, or anything else. We need this software, which worked FLAWLESSLY prior to the update, to work. Something in the new firewalld is completely broken and we need to fix it or figure out a solid work-around. Scripts won't work for us.

Not trying to come across as a butt, I am just really pissed that something so critical and also so broken got through the cracks. On top of that I am now struggling with the licenses and am about to give up and accept all because it tells me what license to read but not how to accept it in package.license! Bad day for Gentoo here, that is all.
_________________
Ever picture systemd as what runs "The Borg"?

Anon-E-moose · Posted: Thu Jul 11, 2019 12:26 am Post subject:

Have you turned on debugging to see what's going on?
_________________
PRIME x570-pro, 3700x, 6.1 zen kernel
gcc 13, profile 17.0 (custom bare multilib), openrc, wayland

The_Great_Sephiroth · Posted: Thu Jul 11, 2019 12:37 am Post subject:

No, I have never needed debugging before. How do I do this? I synced and am currently updating 11 packages, none related to the network though.
_________________
Ever picture systemd as what runs "The Borg"?

Anon-E-moose · Posted: Thu Jul 11, 2019 10:02 am Post subject:

https://firewalld.org/documentation/howto/debug-firewalld.html
_________________
PRIME x570-pro, 3700x, 6.1 zen kernel
gcc 13, profile 17.0 (custom bare multilib), openrc, wayland

The_Great_Sephiroth · Posted: Thu Jul 11, 2019 12:12 pm Post subject:

I actually checked the log last night after a kernel upgrade and found the most likely cause. The new firewalld version is not calling the commands correctly. I will post the log and link to it in this post or another response today.

*UPDATE*

I deleted the firewalld log, rebooted, and pasted the new log. This gets spammed over and over again. It did not do this prior to the update where nftables became the default. It does this regardless of whether or not the setting is iptables or nftables.

My firewalld log
_________________
Ever picture systemd as what runs "The Borg"?

Marlo · Veteran Joined: 26 Jul 2003 Posts: 1591

Anon-E-moose · Posted: Thu Jul 11, 2019 7:09 pm Post subject:

The_Great_Sephiroth · Posted: Fri Jul 12, 2019 2:10 am Post subject:

Checked all that. There was one single link on that bug report. I read the discussion. Nothing fruitful. All of the kernel modules mentioned are enabled on my kernel. I literally have EVERY option enabled as a module or built-in. Well, except the one which is obsolete, but I have NEVER enabled that one.
_________________
Ever picture systemd as what runs "The Borg"?

Anon-E-moose · Posted: Fri Jul 12, 2019 9:18 am Post subject:

There was a link to a discussion, then another link to another bug report (started because he couldn't reopen the original one)

https://github.com/firewalld/firewalld/issues/484

And on this one there is a patch (look at last one by erig0 commented on Apr 17)
with mention that commits have been added to firewalld codebase.

I would imagine that 1.6.4 will probably have those changes in it.

As far as you having every option, if you had the security option then it would have found it.

Read the thread properly and try the patch OR stick with 0.5.1 until changes have been finalized.

Good luck!
_________________
PRIME x570-pro, 3700x, 6.1 zen kernel
gcc 13, profile 17.0 (custom bare multilib), openrc, wayland

The_Great_Sephiroth · Posted: Sat Jul 13, 2019 1:41 pm Post subject:

OK, I just went through every single option under the netfilter configuration menus and literally EVERYTHING is checked as either built-in or module. So if this security table option is set to no, then it is not in the netfilter configuration area, meaning I am not seeing it. Here is the kernel configuration.

Also, I did read and understand the tickets, but it does me no good. I already upgraded because there was no warning that everything breaks with this version. I assumed it would work.

Kernel Configuration

What option is not set there that should be and since I use the menu configuration to configure my kernels, why is it not in the netfilter sections?
_________________
Ever picture systemd as what runs "The Borg"?

Hu · Moderator Joined: 06 Mar 2007 Posts: 21593

Unless you override using Z, you only see options that you can enable. If an option has an unsatisfied prerequisite, it is not shown. I happen to already know that table 'security' refers to the Netfilter table named security, and I remembered approximately where to find it. It is controlled by the option IP_NF_SECURITY, which is not even listed in your kernel configuration. That tipped me off that you are probably missing a prerequisite, since it would be shown as # CONFIG_IP_NF_SECURITY is not set if you had the option to enable it and did not. From there, I opened the Kconfig file (though menuconfig can do this for you too) and checked the prerequisites:

Anon-E-moose · Posted: Sat Jul 13, 2019 4:20 pm Post subject:

This is the patch from the second github bug link

http://dpaste.com/2YJVJ7K

With it you shouldn't require security, your choice as to whether to apply it or just enable security.
To apply it put it in /etc/portage/patches/net-firewall/firewalld-0.6.3.

NOTE: I don't run firewalld, so can't verify if the patch works, but from the looks of it, it should.
It looks to see if security is available and only asks for it, if it sees it.
_________________
PRIME x570-pro, 3700x, 6.1 zen kernel
gcc 13, profile 17.0 (custom bare multilib), openrc, wayland

Anon-E-moose · Posted: Sat Jul 13, 2019 4:22 pm Post subject:

The_Great_Sephiroth · Posted: Sat Jul 13, 2019 9:23 pm Post subject:

I searched for "security" and got loads of results. I was not sure of the entire symbol name. I also gave up fairly easily as I woke up sick this morning. Lovely little sinus issues that make life a living Hell, but I digress.

I have NEVER needed that prior to now and never enabled the multiple security types option before. That is what threw me. Thank you both for the help. I will be building a new kernel soon (updates grabbed a new one) and have already enabled the security table in both IPv4 and IPv6 iptables. Thanks for being patient with me, I haven't had an issue in ages and this one stumped me.
_________________
Ever picture systemd as what runs "The Borg"?

Anon-E-moose · Posted: Sat Jul 13, 2019 10:26 pm Post subject:

main menu -> security options -> enable different security models (sets CONFIG_SECURITY)

other options are set in netfilter area (security above needs to be set for other options to show)
_________________
PRIME x570-pro, 3700x, 6.1 zen kernel
gcc 13, profile 17.0 (custom bare multilib), openrc, wayland

The_Great_Sephiroth · Posted: Sun Jul 14, 2019 2:41 pm Post subject:

Yeah, I already enabled it. I had long since forgotten about using Z to see hidden options. I built the new kernel and will be installing it today. Will post the results.
_________________
Ever picture systemd as what runs "The Borg"?