Short description:

In case `firewalld` does not (longer) understand its configuration files, `systemd` does start it during boot an reports it running. In contrast `firewall-cmd --state` reports `failed` and the machine accepts incoming IP connections from IP addresses it should not.

I would expect: If such a security function like the firewall is not correctly working, the administrator is informed "somehow" and "loudly enough" about this problem. The least minimum I would expect is a red-colored "ERROR"-line in the journal.

To be fair, I should note, there is a Python trace dumped in the journal and in the file `/var/log/firewalld`. Yet, at least I did overlook these for two years.

Bug 1212974 is the technical bug behind this security hole. I open two bugs because I believe these are two independent issues.

Long description:

OpenSUSE Leap 15.0 (2018) replaced `SuSEfirewall2` by `firewalld`. Hence, I configured `firewalld` using among others, this command:

  # firewall-cmd --permanent --zone=home --add-source=192.168.193.0/255.255.255.0

The firewall worked fine afterwards. I upgraded OpenSUSE over the years to 15.5, so that the old configuration files are still in use today. At some point in time, `firewalld` stopped being able to parse the `255.255.255.0` and consequently did not protect my machine anymore.

I even checked the configuration at each upgraded with `firewall-cmd --info-zone home` but stupidly I never typed `firewall-cmd --state`. By chance, I recently looked into the file `/var/log/firewalld` and discovered the following message:

2023-06-30 16:07:59 Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/firewall/server/decorators.py", line 53, in handle_exceptions
    return func(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/firewall/server/firewalld.py", line 93, in start
    return self.fw.start()
  File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 541, in start
    self._start()
  File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 502, in _start
    self.zone.apply_zones(use_transaction=transaction)
  File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 178, in apply_zones
    self.apply_zone_settings(zone, use_transaction=use_transaction)
  File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 297, in apply_zone_settings
    self._zone_settings(True, _zone, transaction)
  File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 267, in _zone_settings
    self._source(enable, zone, args[0], args[1], transaction)
  File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 752, in _source
    policy, source, table, chain)
  File "/usr/lib/python3.6/site-packages/firewall/core/nftables.py", line 935, in build_zone_source_address_rules
    "expr": [self._rule_addr_fragment(opt, address),
  File "/usr/lib/python3.6/site-packages/firewall/core/nftables.py", line 1217, in _rule_addr_fragment
    address = {"prefix": {"addr": addr_len[0], "len": int(addr_len[1])}}
ValueError: invalid literal for int() with base 10: '255.255.255.0'

According to the log files, this issues was introduced when I upgraded to OpenSUSE Leap 15.3 in July 2021. Consequently, since two years my firewall is not working properly.

How to reproduce:

Note: I assume the error can only be provoked on an "active zone". I use the `public` zone in the example below. You can list your active zones with `firewall-cmd --get-active-zones`.

Warning: The instructions below tamper with your firewall settings. You machine may end up having no internet access or being reachable from "dangerous" IP addresses. Make sure to restore your firewall settings after your test.

Make a backup first ...

# cp /etc/firewalld/zones/public.xml /etc/firewalld/zones/public.xml.ori

Add a rule and change its netmask in the configuration file into a form `firewalld` does currently not understand (due to Bug 1212974).

# firewall-cmd --permanent --zone=public --add-source=1.2.3.4/24
success
# sed -i 's%1.2.3.4/24%1.2.3.4/255.255.255.0%' /etc/firewalld/zones/public.xml

Provoke the error by having `firewalld` read the configuration file:

# systemctl restart firewalld

Check whether `firewalld` is OK:

# firewall-cmd --state
failed

Notice that `systemctl` reports "active (running)" and thus has not detected the failing of the firewall:

# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: disabled)
     Active: active (running) since Mon 2023-07-03 20:19:21 CEST; 1min 30s ago
       Docs: man:firewalld(1)
   Main PID: 8569 (firewalld)
      Tasks: 2 (limit: 4915)
     CGroup: /system.slice/firewalld.service
             └─ 8569 /usr/bin/python3 /usr/sbin/firewalld --nofork --nopid

Jul 03 20:19:21 goofy systemd[1]: Starting firewalld - dynamic firewall daemon...
Jul 03 20:19:21 goofy systemd[1]: Started firewalld - dynamic firewall daemon.
Jul 03 20:19:21 goofy firewalld[8569]: Traceback (most recent call last):
                                         File "/usr/lib/python3.6/site-packages/firewall/server/decorators.py", line 53, in handle_exceptions
                                           return func(*args, **kwargs)
                                         File "/usr/lib/python3.6/site-packages/firewall/server/firewalld.py", line 93, in start
                                           return self.fw.start()
                                         File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 541, in start
                                           self._start()
                                         File "/usr/lib/python3.6/site-packages/firewall/core/fw.py", line 502, in _start
                                           self.zone.apply_zones(use_transaction=transaction)
                                         File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 178, in apply_zones
                                           self.apply_zone_settings(zone, use_transaction=use_transaction)
                                         File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 297, in apply_zone_settings
                                           self._zone_settings(True, _zone, transaction)
                                         File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 267, in _zone_settings
                                           self._source(enable, zone, args[0], args[1], transaction)
                                         File "/usr/lib/python3.6/site-packages/firewall/core/fw_zone.py", line 752, in _source
                                           policy, source, table, chain)
                                         File "/usr/lib/python3.6/site-packages/firewall/core/nftables.py", line 935, in build_zone_source_address_rules
                                           "expr": [self._rule_addr_fragment(opt, address),
                                         File "/usr/lib/python3.6/site-packages/firewall/core/nftables.py", line 1217, in _rule_addr_fragment
                                           address = {"prefix": {"addr": addr_len[0], "len": int(addr_len[1])}}
                                       ValueError: invalid literal for int() with base 10: '255.255.255.0'


`firewall-cmd` does list the configuration it does not understand without any indication of an error:

# firewall-cmd --info-zone public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 1.2.3.4/255.255.255.0
  services: 
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

If you want, you can reboot your machine and check afterwards that `firewalld` is in "failed" state and that there is no red error shown in `journalctl -r` about this security hole.

Finally make sure your firewall is configured correctly by restoring the original configuration file:

# mv /etc/firewalld/zones/public.xml.ori /etc/firewalld/zones/public.xml
# systemctl restart firewalld
# firewall-cmd --state
running