Package: firewalld
Version: 0.6.2-1
Severity: normal
From <https://firewalld.org/2018/07/nftables-backend>:
"The main consequence for users is that firewall rules created outside of
firewalld (e.g. libvirt, docker, user, etc) will take precedence over
firewalld’s rules."
but unfortunately also:
"For firewalld this means packets may be accepted early by custom iptables
or nftables rules, but will still be subject to firewalld’s rules."
libvirt starts dnsmasq:
# ss -lpn '( sport = 53 or sport = 67 )' | grep dnsmasq
udp UNCONN 0 0 192.168.122.1:53 0.0.0.0:*
users:(("dnsmasq",pid=3990102,fd=5))
udp UNCONN 0 0 0.0.0.0%virbr0:67 0.0.0.0:*
users:(("dnsmasq",pid=3990102,fd=3))
tcp LISTEN 0 32 192.168.122.1:53 0.0.0.0:*
users:(("dnsmasq",pid=3990102,fd=6))
and adds some iptables rules:
# iptables-save | grep 'INPUT.*virbr.*ACCEPT'
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
As mentioned above, these rules aren't enough for the packet to be accepted,
nftables would need to be configured to accept 53/67 from virbr0 as well.
https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains explains:
"if a packet gets accepted/dropped and there is a later chain in the same
hook which is ordered with a later priority, the packet will be evaluated
*again*"
According to https://bbs.archlinux.org/viewtopic.php?id=239362, this breaks
docker as well. :-(
-- System Information:
Debian Release: buster/sid
APT prefers testing-debug
APT policy: (980, 'testing-debug'), (980, 'testing'), (980, 'stable'), (500,
'unstable-debug'), (500, 'stable-debug'), (500, 'unstable'), (500, 'stable'),
(200, 'experimental-debug'), (200, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64
Kernel: Linux 4.18.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=cs_CZ.UTF-8, LC_CTYPE=cs_CZ.UTF-8 (charmap=UTF-8),
LANGUAGE=cs_CZ.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages firewalld depends on:
ii dbus 1.12.10-1
ii gir1.2-glib-2.0 1.58.0-1
ii iptables 1.6.2-1.1
ii nftables 0.9.0-1
ii policykit-1 0.105-21
ii python3 3.6.6-1
ii python3-dbus 1.2.8-2+b1
ii python3-gi 3.30.1-1
ii python3-slip-dbus 0.6.5-2
Versions of packages firewalld recommends:
ii ebtables 2.0.10.4-5
ii ipset 6.34-1
firewalld suggests no packages.
-- Configuration Files:
/etc/firewalld/firewalld.conf [Errno 13] Operace zamítnuta:
'/etc/firewalld/firewalld.conf'
/etc/firewalld/lockdown-whitelist.xml [Errno 13] Operace zamítnuta:
'/etc/firewalld/lockdown-whitelist.xml'
-- no debconf information
--
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/
_______________________________________________
Pkg-utopia-maintainers mailing list
Pkg-utopia-maintainers@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-utopia-maintainers
