Project

General

Profile

Bug #7105

ICMP type selection is assuming IPv6 when it should assume IPv4

Added by Jim Pingle 3 months ago. Updated 3 months ago.

Status:
Resolved
Priority:
High
Category:
Rules/NAT
Target version:
Start date:
01/09/2017
Due date:
% Done:

100%

Affected version:
2.4
Affected Architecture:
All

Description

I had an older rule which did not have an ipprotocol type set inside, which is quite common with configurations that have been upgraded over time. Upon upgrading to a recent snapshot (From Dec 29 to Jan 9), the ruleset did not load and the following error was in the notices & logs:

/rc.filter_configure_sync: New alert found: There were error(s) loading the rules: /tmp/rules.debug:335: icmp-type mismatch - The line in question reads [335]: pass in quick on $DSL reply-to ( pppoe0 x.x.x.x ) proto icmp from $AllowPing to y.y.y.y icmp6-type echoreq tracker 1418235506 keep state label "USER_RULE: Allow ping from specified host" 

Note that it was tagged "icmp6-type" when it should have been the IPv4 equivalent. Also, when editing the rule I had to reselect the ICMP type as nothing was selected in the list.

Associated revisions

Revision da2a39e2
Added by Renato Botelho 3 months ago

Fix #7105: Old rules may not have ipprotocol defined, consider it icmp6-type only when ipprotocol is inet6

Revision 3661dfdc
Added by Renato Botelho 2 months ago

Fix #7105: Old rules may not have ipprotocol defined, consider it icmp6-type only when ipprotocol is inet6

History

#1 Updated by Renato Botelho 3 months ago

  • Assignee set to Renato Botelho

#2 Updated by Renato Botelho 3 months ago

  • Status changed from Confirmed to Feedback
  • % Done changed from 0 to 100

#3 Updated by Jim Pingle 3 months ago

  • Status changed from Feedback to Resolved

Works

Also available in: Atom PDF