Project

General

Profile

Actions
Copy link

Regression #12937

closed
DZ VG

Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server

Regression #12937: Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server

Added by Danilo Zrenjanin over 4 years ago. Updated over 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
Traffic Shaper Wizards
Target version:
2.7.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
22.05
Release Notes:
Default
Affected Version:
2.6.0
Affected Architecture:

Description

After running the traffic shaper wizard and defining an Upstream SIP server IP address under the VOIP specific settings, inappropriate floating rules will be created. Which will prevent the firewall filter from reloading.

It fails with the following log:

There were error(s) loading the rules: /tmp/rules.debug:146: rule expands to no valid combination - The line in question reads [146]: match inet6 proto udp from 192.168.33.20 to any ridentifier 1646990408 queue (qVoIP) label "USER_RULE: Connections From Upstream SIP Server"

It looks like the Wizard defines rules using IPv4+IPv6 Address Family, which can be used only with aliases.

Related issues 1 (0 open — 1 closed)

Related to Feature #4769: IPv6 support in the Traffic Shaper WizardResolvedViktor Gurov06/17/2015

Actions

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #1

  • Plus Target Version changed from 21.02 to 22.05

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #2

  • Tracker changed from Bug to Regression
  • Assignee set to Viktor Gurov

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #3

  • Related to Feature #4769: IPv6 support in the Traffic Shaper Wizard added

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #4

  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #5

  • Status changed from Pull Request Review to Feedback

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #6

  • Subject changed from Traffic Shaper basic Wizard rules to Traffic Shaper wizard can produce an invalid ruleset when configured with an IPv4 upstream SIP server

Updating subject for release notes.

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #7

  • % Done changed from 0 to 100

Applied in changeset commit:030fab3edaee1c2f10ea8695a041864810d94390.

MM Updated by Marcos M over 4 years ago Actions
Copy link
 #8

Tested on 22.05.a.20220410.0600.

There are still places where it fails:

There were error(s) loading the rules: /tmp/rules.debug:230: rule expands to no valid combination - The line in question reads [230]: match inet6 proto udp from any to 10.0.5.200 ridentifier 1649625457 queue (qVoIP) label "id:1649625457" label "USER_RULE: Connections To Upstream SIP Server"

There were error(s) loading the rules: /tmp/rules.debug:227: rule expands to no valid combination - The line in question reads [227]: match on { vmx1 vmx3.521 } inet6 from 10.0.5.200 to any ridentifier 1649625679 queue (qOthersLow) label "id:1649625679" label "USER_RULE: Penalty Box"

Additionally:
  • Using the Penalty Box option results in a floating rule using the queue qOthersLow which does not exist.
  • Floating rules without a specific interface should be created with the Any interface selected instead.

MM Updated by Marcos M over 4 years ago Actions
Copy link
 #9

  • Status changed from Feedback to New

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #10

Marcos Mendoza wrote in #note-8:

Additionally:
  • Using the Penalty Box option results in a floating rule using the queue qOthersLow which does not exist.
  • Floating rules without a specific interface should be created with the Any interface selected instead.

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/708

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #11

  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #12

  • Status changed from Pull Request Review to Feedback

MM Updated by Marcos M over 4 years ago Actions
Copy link
 #13

Everything works except for:

Floating rules without a specific interface should be created with the Any interface selected instead.

For reference, the option that created the empty interface list is the VOIP rules one.

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #14

  • Status changed from Feedback to New

Marcos Mendoza wrote in #note-13:

Everything works except for:

Floating rules without a specific interface should be created with the Any interface selected instead.

For reference, the option that created the empty interface list is the VOIP rules one.

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/723

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #15

  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #16

  • Status changed from Pull Request Review to Feedback

→L Updated by → luckman212 over 4 years ago Actions
Copy link
 #17

Is this at all related to https://redmine.pfsense.org/issues/13026 ? I am eager to have limiters working again on 22.05 snaps, sorry to be a PITA.

MM Updated by Marcos M over 4 years ago Actions
Copy link
 #18

  • Status changed from Feedback to New

The VOIP rules were created with the Any interface. However, this error is back now:

There were error(s) loading the rules: /tmp/rules.debug:221: rule expands to no valid combination - The line in question reads [221]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650416745 queue (qDefault) label "id:1650416745" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:05:47

and with with "Others" option enabled:

There were error(s) loading the rules: /tmp/rules.debug:229: rule expands to no valid combination - The line in question reads [229]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650417190 queue (qOthersLow) label "id:1650417190" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:13:12

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #19

Marcos Mendoza wrote in #note-18:

The VOIP rules were created with the Any interface. However, this error is back now:

There were error(s) loading the rules: /tmp/rules.debug:221: rule expands to no valid combination - The line in question reads [221]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650416745 queue (qDefault) label "id:1650416745" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:05:47

and with with "Others" option enabled:

There were error(s) loading the rules: /tmp/rules.debug:229: rule expands to no valid combination - The line in question reads [229]: match on { vmx1 vmx3.521 } inet6 from 172.19.1.10 to any ridentifier 1650417190 queue (qOthersLow) label "id:1650417190" label "USER_RULE: Penalty Box"

@ 2022-04-19 20:13:12

fix:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/728

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #20

  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #21

  • Status changed from Pull Request Review to Feedback

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #22

  • Status changed from Feedback to Resolved

Works now

Actions
Copy link

Also available in: Atom