Regression #12937: Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server - pfSense - pfSense bugtracker

Custom queries

2.4.5-p1 - Resolved/Closed
2.5.0 - Resolved/Closed
2.5.1 - Resolved/Closed
2.5.2 - Resolved/Closed
2.6.0 - Resolved/Closed
2.7.0 - Resolved/Closed
2.7.1 - All Open Issues
2.7.1 - Resolved/Closed
2.7.2 - Resolved/Closed
2.8.0 - All Open Bugs
2.8.0 - All Open Features
2.8.0 - All Open Issues
2.8.0 - All Open Regressions
2.8.0 - Feedback
2.8.0 - Needs Attention
2.8.0 - New/Confirmed
2.8.0 - Pull Requests
2.8.0 - Regressions affecting 2.7.0
2.8.0 - Resolved/Closed
21.02.2/2.5.1 - Resolved/Closed
21.05 Plus - All Closed Issues
21.05.1 Plus Target - All Closed Issues
21.05.1 Target - All Closed Issues
22.01 Plus - All Closed Issues
22.01 Target - All Closed Issues
22.05 Plus - All Closed Issues
22.05 Target - All Closed Issues
23.01 Plus - All Closed Issues
23.01 Target - All Closed Issues
23.05 Plus - All Closed Issues
23.05 Target - All Closed Issues
23.05.1 Plus - All Closed Issues
23.05.1 Target - All Closed Issues
23.09 Plus - All Closed Issues
23.09 Target - All Closed Issues
23.09.1 Plus - All Closed Issues
23.09.1 Target - All Closed Issues
24.03 Plus - All Closed Issues
24.03 Target - All Closed Issues
24.07 Plus - All Closed Issues
24.07 Plus - All Open Issues
24.07 Plus - Feedback Issues
24.07 Plus - Needs Attention/Work
24.07 Plus - New/Confirmed/In Progress Issues
24.07 Plus - Pull Request Review
24.07 Plus - Waiting on Merge
24.07 Target - All Closed Issues
24.07 Target - All Open Issues
All Open Issues assigned to Me
All Open Pull Requests
Any Target - All Open Regressions
Any Target - Feedback Issues
CE-Next - All Closed Issues (Move to specific target)
CE-Next - All Open Issues
CE-Next - Feedback (Likely needs target changed)
New Issues by Category - Future Target
New Issues by Category - No Target
New Issues by Category - No Target+Future
No Target - All Open Issues (Base Only)
No Target - New Issues (Base Only)
No Target - New Issues (Base and Packages)
Release Notes - Plus Target Version (DO NOT EDIT)
Release Notes - Target Version (DO NOT EDIT)

Actions

Copy link

Regression #12937

closed

Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server

Added by Danilo Zrenjanin about 2 years ago. Updated almost 2 years ago.

Status:

Resolved

Priority:

Normal

Assignee:

Viktor Gurov

Category:

Traffic Shaper Wizards

Target version:

2.7.0

Start date:

Due date:

% Done:

100%

Estimated time:

Plus Target Version:

22.05

Release Notes:

Default

Affected Version:

2.6.0

Affected Architecture:

Description

After running the traffic shaper wizard and defining an Upstream SIP server IP address under the VOIP specific settings, inappropriate floating rules will be created. Which will prevent the firewall filter from reloading.

It fails with the following log:

There were error(s) loading the rules: /tmp/rules.debug:146: rule expands to no valid combination - The line in question reads [146]: match inet6 proto udp from 192.168.33.20 to any ridentifier 1646990408 queue (qVoIP) label "USER_RULE: Connections From Upstream SIP Server"

It looks like the Wizard defines rules using IPv4+IPv6 Address Family, which can be used only with aliases.

Related issues

Related to Feature #4769: IPv6 support in the Traffic Shaper Wizard

Resolved

Viktor Gurov

06/17/2015

Actions

Issue # Delay: days Cancel

History
Notes
Property changes
Associated revisions

Actions

Copy link

Updated by Jim Pingle about 2 years ago

Plus Target Version changed from 21.02 to 22.05

Actions

Copy link

Updated by Viktor Gurov about 2 years ago

Tracker changed from Bug to Regression
Assignee set to Viktor Gurov

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/692

Actions

Copy link

Updated by Viktor Gurov about 2 years ago

Related to Feature #4769: IPv6 support in the Traffic Shaper Wizard added

Actions

Copy link

Updated by Jim Pingle about 2 years ago

Status changed from New to Pull Request Review

Actions

Copy link

Updated by Viktor Gurov about 2 years ago

Status changed from Pull Request Review to Feedback

Merged:
https://github.com/pfsense/pfsense/commit/030fab3edaee1c2f10ea8695a041864810d94390

Actions

Copy link

Updated by Jim Pingle about 2 years ago

Subject changed from Traffic Shaper basic Wizard rules to Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server

Updating subject for release notes.

Actions

Copy link

Updated by Viktor Gurov about 2 years ago

% Done changed from 0 to 100

Applied in changeset 030fab3edaee1c2f10ea8695a041864810d94390.

Actions

Copy link

Updated by Marcos M about 2 years ago

Tested on 22.05.a.20220410.0600.

There are still places where it fails:

There were error(s) loading the rules: /tmp/rules.debug:230: rule expands to no valid combination - The line in question reads [230]: match inet6 proto udp from any to 10.0.5.200 ridentifier 1649625457 queue (qVoIP) label "id:1649625457" label "USER_RULE: Connections To Upstream SIP Server"

There were error(s) loading the rules: /tmp/rules.debug:227: rule expands to no valid combination - The line in question reads [227]: match on { vmx1 vmx3.521 } inet6 from 10.0.5.200 to any ridentifier 1649625679 queue (qOthersLow) label "id:1649625679" label "USER_RULE: Penalty Box"

Additionally:

Using the Penalty Box option results in a floating rule using the queue qOthersLow which does not exist.
Floating rules without a specific interface should be created with the Any interface selected instead.

Actions

Copy link

Updated by Marcos M about 2 years ago

Status changed from Feedback to New

Actions

Copy link

#10

Updated by Viktor Gurov about 2 years ago

Marcos Mendoza wrote in #note-8:

Additionally:

Using the Penalty Box option results in a floating rule using the queue qOthersLow which does not exist.

Floating rules without a specific interface should be created with the Any interface selected instead.

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/708

Actions

Copy link

#11

Updated by Jim Pingle about 2 years ago

Status changed from New to Pull Request Review

Actions

Copy link

#12

Updated by Viktor Gurov about 2 years ago

Status changed from Pull Request Review to Feedback

Merged:
https://github.com/pfsense/pfsense/commit/25df45db811c713ee0893c03b535142780c14bca

Actions

Copy link

#13

Updated by Marcos M about 2 years ago

Everything works except for:

Floating rules without a specific interface should be created with the Any interface selected instead.

For reference, the option that created the empty interface list is the VOIP rules one.

Actions

Copy link

#14

Updated by Viktor Gurov about 2 years ago

Status changed from Feedback to New

Marcos Mendoza wrote in #note-13:

Everything works except for:

Floating rules without a specific interface should be created with the Any interface selected instead.

For reference, the option that created the empty interface list is the VOIP rules one.

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/723

Actions

Copy link

#15

Updated by Jim Pingle about 2 years ago

Status changed from New to Pull Request Review

Actions

Copy link

#16

Updated by Viktor Gurov about 2 years ago

Status changed from Pull Request Review to Feedback

Merged:
https://github.com/pfsense/pfsense/commit/ac0c991083b910d82fcc52ceb52718f5bc40d4de

Actions

Copy link

#17

Updated by → luckman212 about 2 years ago

Is this at all related to https://redmine.pfsense.org/issues/13026 ? I am eager to have limiters working again on 22.05 snaps, sorry to be a PITA.

Actions

Copy link

#18

Updated by Marcos M about 2 years ago

Status changed from Feedback to New

The VOIP rules were created with the Any interface. However, this error is back now:

There were error(s) loading the rules: /tmp/rules.debug:221: rule expands to no valid combination - The line in question reads [221]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650416745 queue (qDefault) label "id:1650416745" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:05:47

and with with "Others" option enabled:

There were error(s) loading the rules: /tmp/rules.debug:229: rule expands to no valid combination - The line in question reads [229]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650417190 queue (qOthersLow) label "id:1650417190" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:13:12

Actions

Copy link

#19

Updated by Viktor Gurov about 2 years ago

Marcos Mendoza wrote in #note-18:

The VOIP rules were created with the Any interface. However, this error is back now:

There were error(s) loading the rules: /tmp/rules.debug:221: rule expands to no valid combination - The line in question reads [221]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650416745 queue (qDefault) label "id:1650416745" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:05:47

and with with "Others" option enabled:

There were error(s) loading the rules: /tmp/rules.debug:229: rule expands to no valid combination - The line in question reads [229]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650417190 queue (qOthersLow) label "id:1650417190" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:13:12

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/728

Actions

Copy link

#20