firewalld breaks networking on Fedora34 if port ranges overlap

[c1728p9]

SUMMARY

Using ansible.posix.firewalld to open ports bypasses some of the checks that are done by firewall-cmd and can lead to configurations which bring break networking (rather than aborting early).

ISSUE TYPE

• Bug Report

COMPONENT NAME

ansible.posix.firewalld

ANSIBLE VERSION

ansible 2.9.25
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/russ/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.9/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.9.2 (default, Feb 20 2021, 00:00:00) [GCC 11.0.0 20210210 (Red Hat 11.0.0-0)]

COLLECTION VERSION

v1.3.0

CONFIGURATION

None

OS / ENVIRONMENT

Fedora 34 (Workstation Edition)

STEPS TO REPRODUCE

ping google.com -c 1 # Verify network works
ansible-playbook test-playbook.yml --ask-become-pass
ping google.com -c 1 # Networking no longer works

test-playbook.yml

---
- name: Test Playbook
  hosts: localhost
  become: true
  tasks:
    - name: Permit traffic
      ansible.posix.firewalld:
        port: "1000-1010/tcp"
        permanent: true
        state: enabled
    - name: Permit overlapping traffic
      ansible.posix.firewalld:
        port: "1002-1003/tcp"
        permanent: true
        state: enabled
    - name: Reload FirewallD
      systemd:
        name: firewalld
        state: reloaded

EXPECTED RESULTS

Expected output is to abort before adding the overlapping ports. Network expected to be working.

$ ping google.com -c 1
PING google.com (142.251.32.174) 56(84) bytes of data.
64 bytes from dfw28s30-in-f14.1e100.net (142.251.32.174): icmp_seq=1 ttl=115 time=24.1 ms

--- google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 24.114/24.114/24.114/0.000 ms

$ ansible-playbook test-playbook.yml --ask-become-pass
BECOME password:
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [Test Playbook] **********************************************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] ********************************************************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [Permit traffic] *********************************************************************************************************************************************************************************************************************************************************
changed: [localhost]

TASK [Permit overlapping traffic] *********************************************************************************************************************************************************************************************************************************************
failed: [localhost]

PLAY RECAP ********************************************************************************************************************************************************************************************************************************************************************
localhost                  : ok=4    changed=1    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

$ ping google.com -c 1
64 bytes from dfw28s30-in-f14.1e100.net (142.251.32.174): icmp_seq=1 ttl=115 time=24.1 ms

--- google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 24.114/24.114/24.114/0.000 ms

Example trying to add conflicting ports with firewall-cmd:

$ sudo firewall-cmd --permanent --add-port=1000-1010/tcp
success
$ sudo firewall-cmd --permanent --add-port=1002-1003/tcp
Warning: ALREADY_ENABLED: 1002-1003:tcp
success

Expected contents of /etc/firewalld/zones/FedoraWorkstation.xml (output from running above firewall-cmd commands). Note that port range 1000-1010/tcp is added, but 1002-1003/tcp is not.

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Fedora Workstation</short>
  <description>Unsolicited incoming network packets are rejected from port 1 to 1024, except for select network services. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <service name="samba-client"/>
  <service name="mdns"/>
  <port port="1025-65535" protocol="udp"/>
  <port port="1025-65535" protocol="tcp"/>
  <port port="1000-1010" protocol="tcp"/>
</zone>

ACTUAL RESULTS

Overlapping ports are added to the firewall zone. This causes networking to stop working:

$ ping google.com -c 1
PING google.com (142.251.32.174) 56(84) bytes of data.
64 bytes from dfw28s30-in-f14.1e100.net (142.251.32.174): icmp_seq=1 ttl=115 time=24.1 ms

--- google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 24.114/24.114/24.114/0.000 ms

$ ansible-playbook test-playbook.yml --ask-become-pass
BECOME password:
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

PLAY [Test Playbook] **********************************************************************************************************************************************************************************************************************************************************

TASK [Gathering Facts] ********************************************************************************************************************************************************************************************************************************************************
ok: [localhost]

TASK [Permit traffic] *********************************************************************************************************************************************************************************************************************************************************
changed: [localhost]

TASK [Permit overlapping traffic] *********************************************************************************************************************************************************************************************************************************************
changed: [localhost]

TASK [Reload FirewallD] *******************************************************************************************************************************************************************************************************************************************************
changed: [localhost]

PLAY RECAP ********************************************************************************************************************************************************************************************************************************************************************
localhost                  : ok=4    changed=3    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0

$ ping google.com -c 1
PING google.com (142.251.32.174) 56(84) bytes of data.

--- google.com ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Actual contents of /etc/firewalld/zones/FedoraWorkstation.xml. Note that both port range 1000-1010/tcp and 1002-1003/tcp are added.

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Fedora Workstation</short>
  <description>Unsolicited incoming network packets are rejected from port 1 to 1024, except for select network services. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <service name="samba-client"/>
  <service name="mdns"/>
  <port port="1025-65535" protocol="udp"/>
  <port port="1025-65535" protocol="tcp"/>
  <port port="1000-1010" protocol="tcp"/>
  <port port="1002-1003" protocol="tcp"/>
</zone>

[saito-hideki]

Hi, thank you for reporting this issue.
The behavior of the firewalld module is the same for both RHEL8 and Fedora34 (overlapping ports will be set), but it seems that the behavior of firewalld-cmd has changed in Fedora34.
I think we need to implement better parameter handling, like firewall-cmd in Fedora34.