From 92c2d6ec5ebd1a721f725473c92a24a737de9cfe Mon Sep 17 00:00:00 2001 From: Adam Rogers Date: Fri, 18 Sep 2026 09:09:01 +1000 Subject: firewall: T9332: fix GeoIP source/destination nftables set name collision GeoIP (country-code/ASN) match sets were named GEOIP_{CC|ASN}{6}_{hook}_{name}_{rule} with no source/destination discriminator, unlike the sibling FQDN-match naming which already appends one. A rule matching GeoIP on both source and destination computed the same set name for both sides, so geoip_update() silently overwrote one side's IP-range list with the other's, and the generated rule matched both saddr and daddr against the same single set - silently dropping one of the two configured constraints with no error at commit or runtime. Append the existing source/destination prefix (already in scope, matching the FQDN convention) to the set name in firewall.py, and thread the same discriminator through geoip.py's set-name construction so the rule's match expression and the set it references always agree. Also updates the non-load-bearing geoip_sets() name construction in conf_mode/firewall.py and conf_mode/policy_route.py for consistency. --- python/vyos/firewall.py | 2 +- python/vyos/geoip.py | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) (limited to 'python') diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index f68c317f9..08f978f39 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -259,7 +259,7 @@ def parse_rule(rule_conf, hook, fw_name, rule_id, ip_name): # for policy if hook == 'route' or hook == 'route6': hook_name = hook - output.append(f'{ip_name} {prefix}addr {operator} @GEOIP_{geoip_prefix}{def_suffix}_{hook_name}_{fw_name}_{rule_id}') + output.append(f'{ip_name} {prefix}addr {operator} @GEOIP_{geoip_prefix}{def_suffix}_{hook_name}_{fw_name}_{rule_id}_{prefix}') if 'mac_address' in side_conf: suffix = side_conf['mac_address'] diff --git a/python/vyos/geoip.py b/python/vyos/geoip.py index 70c74b04f..eb81f4ce8 100644 --- a/python/vyos/geoip.py +++ b/python/vyos/geoip.py @@ -266,13 +266,13 @@ def geoip_update(firewall=None, policy=None): version = 6 if path[0] == 'ipv6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_CC{vprefix}_{path[1]}_{path[2]}_{path[4]}' + set_name = f'GEOIP_CC{vprefix}_{path[1]}_{path[2]}_{path[4]}_{path[5][0]}' firewall_sets[f'v{version}'][set_name] = db_return_cc_ranges(codes, version) for asns, path in dict_search_recursive(firewall, 'asn'): version = 6 if path[0] == 'ipv6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_ASN{vprefix}_{path[1]}_{path[2]}_{path[4]}' + set_name = f'GEOIP_ASN{vprefix}_{path[1]}_{path[2]}_{path[4]}_{path[5][0]}' firewall_sets[f'v{version}'][set_name] = db_return_asn_ranges(asns, version) if policy: @@ -282,13 +282,13 @@ def geoip_update(firewall=None, policy=None): version = 6 if path[0] == 'route6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}' + set_name = f'GEOIP_CC{vprefix}_{path[0]}_{path[1]}_{path[3]}_{path[4][0]}' policy_sets[f'v{version}'][set_name] = db_return_cc_ranges(codes, version) for asns, path in dict_search_recursive(policy, 'asn'): version = 6 if path[0] == 'route6' else 4 vprefix = '6' if version == 6 else '' - set_name = f'GEOIP_ASN{vprefix}_{path[0]}_{path[1]}_{path[3]}' + set_name = f'GEOIP_ASN{vprefix}_{path[0]}_{path[1]}_{path[3]}_{path[4][0]}' policy_sets[f'v{version}'][set_name] = db_return_asn_ranges(asns, version) render( -- cgit v1.2.3