firewall: T8247: Allow both protocol names and numbers consistently by Nyandorew · Pull Request #4978 · vyos/vyos-1x

Nyandorew · 2026-02-10T01:43:38Z

Related Task(s)

Change summary

Fixes inconsistent handling of protocol specification in firewall configuration. When users specify protocol by IANA number (e.g., 6 for TCP), certain options like port specifications, TCP flags, and GRE settings would fail validation because the checks compare against string names.

This PR normalizes protocol numbers to their string names early in verify_rule() so all subsequent validations work consistently.

Example of the bug:

# This works
set firewall ipv4 name RULE rule 1 protocol 6

# This fails with "Protocol must be tcp, udp, or tcp_udp when specifying a port"
set firewall ipv4 name RULE rule 2 protocol 6
set firewall ipv4 name RULE rule 2 destination port 443

Types of changes

Bug fix (non-breaking change which fixes an issue)

Related PR(s)

Component(s) name

src/conf_mode/firewall.py

How to test

#!/bin/vbash
source /opt/vyatta/etc/functions/script-template

# Safeguard: ensure script runs with vyattacfg group
if [ "$(id -g -n)" != 'vyattacfg' ] ; then
    exec sg vyattacfg -c "/bin/vbash $(readlink -f $0) $@"
fi

echo "=========================================="
echo "Firewall Protocol Number Test Script"
echo "Task: T8247"
echo "=========================================="

configure

# Initial setup - create base rule
echo ""
echo "[Setup] Creating base firewall rules..."
set firewall ipv4 name RULE default-action drop
set firewall ipv4 name RULE rule 1 action accept
set firewall ipv6 name RULE6 default-action drop
set firewall ipv6 name RULE6 rule 1 action accept
commit
echo "[Setup] Base rules created."

# ==========================================
# Test 1: Port specification (TCP) - Numeric protocol
# ==========================================
echo ""
echo "[Test 1a] Port specification with numeric protocol (6 = TCP)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol 6
set firewall ipv4 name RULE rule 1 destination port 443
if commit; then
    echo "[Test 1a] PASSED: Numeric protocol 6 with port 443 accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 1a] FAILED: Numeric protocol 6 with port 443 rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 destination
commit

# ==========================================
# Test 1b: Port specification (TCP) - String protocol
# ==========================================
echo ""
echo "[Test 1b] Port specification with string protocol (tcp)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol tcp
set firewall ipv4 name RULE rule 1 destination port 443
if commit; then
    echo "[Test 1b] PASSED: String protocol tcp with port 443 accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 1b] FAILED: String protocol tcp with port 443 rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 destination
commit

# ==========================================
# Test 2a: Port specification (UDP) - Numeric protocol
# ==========================================
echo ""
echo "[Test 2a] Port specification with numeric protocol (17 = UDP)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol 17
set firewall ipv4 name RULE rule 1 destination port 53
if commit; then
    echo "[Test 2a] PASSED: Numeric protocol 17 with port 53 accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 2a] FAILED: Numeric protocol 17 with port 53 rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 destination
commit

# ==========================================
# Test 2b: Port specification (UDP) - String protocol
# ==========================================
echo ""
echo "[Test 2b] Port specification with string protocol (udp)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol udp
set firewall ipv4 name RULE rule 1 destination port 53
if commit; then
    echo "[Test 2b] PASSED: String protocol udp with port 53 accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 2b] FAILED: String protocol udp with port 53 rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 destination
commit

# ==========================================
# Test 3a: TCP flags - Numeric protocol
# ==========================================
echo ""
echo "[Test 3a] TCP flags with numeric protocol (6 = TCP)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol 6
set firewall ipv4 name RULE rule 1 tcp flags syn
if commit; then
    echo "[Test 3a] PASSED: Numeric protocol 6 with tcp flags syn accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 3a] FAILED: Numeric protocol 6 with tcp flags syn rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 tcp
commit

# ==========================================
# Test 3b: TCP flags - String protocol
# ==========================================
echo ""
echo "[Test 3b] TCP flags with string protocol (tcp)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol tcp
set firewall ipv4 name RULE rule 1 tcp flags syn
if commit; then
    echo "[Test 3b] PASSED: String protocol tcp with tcp flags syn accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 3b] FAILED: String protocol tcp with tcp flags syn rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 tcp
commit

# ==========================================
# Test 4a: GRE matching - Numeric protocol
# ==========================================
echo ""
echo "[Test 4a] GRE matching with numeric protocol (47 = GRE)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol 47
set firewall ipv4 name RULE rule 1 gre flags checksum unset
set firewall ipv4 name RULE rule 1 gre key 100
if commit; then
    echo "[Test 4a] PASSED: Numeric protocol 47 with GRE options accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 4a] FAILED: Numeric protocol 47 with GRE options rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 gre
commit

# ==========================================
# Test 4b: GRE matching - String protocol
# ==========================================
echo ""
echo "[Test 4b] GRE matching with string protocol (gre)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol gre
set firewall ipv4 name RULE rule 1 gre flags checksum unset
set firewall ipv4 name RULE rule 1 gre key 100
if commit; then
    echo "[Test 4b] PASSED: String protocol gre with GRE options accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 4b] FAILED: String protocol gre with GRE options rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 gre
commit

# ==========================================
# Test 5a: synproxy action - Numeric protocol
# ==========================================
echo ""
echo "[Test 5a] synproxy action with numeric protocol (6 = TCP)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 action synproxy
set firewall ipv4 name RULE rule 1 protocol 6
set firewall ipv4 name RULE rule 1 synproxy tcp mss 1460
if commit; then
    echo "[Test 5a] PASSED: Numeric protocol 6 with synproxy accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 5a] FAILED: Numeric protocol 6 with synproxy rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 action
set firewall ipv4 name RULE rule 1 action accept
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 synproxy
commit

# ==========================================
# Test 5b: synproxy action - String protocol
# ==========================================
echo ""
echo "[Test 5b] synproxy action with string protocol (tcp)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 action synproxy
set firewall ipv4 name RULE rule 1 protocol tcp
set firewall ipv4 name RULE rule 1 synproxy tcp mss 1460
if commit; then
    echo "[Test 5b] PASSED: String protocol tcp with synproxy accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 5b] FAILED: String protocol tcp with synproxy rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 action
set firewall ipv4 name RULE rule 1 action accept
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 synproxy
commit

# ==========================================
# Test 6a: ICMP protocol (IPv4) - Numeric protocol
# ==========================================
echo ""
echo "[Test 6a] ICMP with numeric protocol (1 = ICMP)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol 1
set firewall ipv4 name RULE rule 1 icmp type-name echo-request
if commit; then
    echo "[Test 6a] PASSED: Numeric protocol 1 with ICMP type accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 6a] FAILED: Numeric protocol 1 with ICMP type rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 icmp
commit

# ==========================================
# Test 6b: ICMP protocol (IPv4) - String protocol
# ==========================================
echo ""
echo "[Test 6b] ICMP with string protocol (icmp)..."
echo "[Before]"
run show firewall ipv4 name RULE rule 1
set firewall ipv4 name RULE rule 1 protocol icmp
set firewall ipv4 name RULE rule 1 icmp type-name echo-request
if commit; then
    echo "[Test 6b] PASSED: String protocol icmp with ICMP type accepted."
    echo "[After]"
    run show firewall ipv4 name RULE rule 1
else
    echo "[Test 6b] FAILED: String protocol icmp with ICMP type rejected."
fi
# Cleanup
delete firewall ipv4 name RULE rule 1 protocol
delete firewall ipv4 name RULE rule 1 icmp
commit

# ==========================================
# Test 7a: ICMPv6 protocol (IPv6) - Numeric protocol
# ==========================================
echo ""
echo "[Test 7a] ICMPv6 with numeric protocol (58 = ICMPv6)..."
echo "[Before]"
run show firewall ipv6 name RULE6 rule 1
set firewall ipv6 name RULE6 rule 1 protocol 58
set firewall ipv6 name RULE6 rule 1 icmpv6 type-name echo-request
if commit; then
    echo "[Test 7a] PASSED: Numeric protocol 58 with ICMPv6 type accepted."
    echo "[After]"
    run show firewall ipv6 name RULE6 rule 1
else
    echo "[Test 7a] FAILED: Numeric protocol 58 with ICMPv6 type rejected."
fi
# Cleanup
delete firewall ipv6 name RULE6 rule 1 protocol
delete firewall ipv6 name RULE6 rule 1 icmpv6
commit

# ==========================================
# Test 7b: ICMPv6 protocol (IPv6) - String protocol
# ==========================================
echo ""
echo "[Test 7b] ICMPv6 with string protocol (ipv6-icmp)..."
echo "[Before]"
run show firewall ipv6 name RULE6 rule 1
set firewall ipv6 name RULE6 rule 1 protocol ipv6-icmp
set firewall ipv6 name RULE6 rule 1 icmpv6 type-name echo-request
if commit; then
    echo "[Test 7b] PASSED: String protocol ipv6-icmp with ICMPv6 type accepted."
    echo "[After]"
    run show firewall ipv6 name RULE6 rule 1
else
    echo "[Test 7b] FAILED: String protocol ipv6-icmp with ICMPv6 type rejected."
fi
# Cleanup
delete firewall ipv6 name RULE6 rule 1 protocol
delete firewall ipv6 name RULE6 rule 1 icmpv6
commit

# ==========================================
# Final cleanup - remove base rules
# ==========================================
echo ""
echo "[Cleanup] Removing base firewall rules..."
delete firewall ipv4 name RULE
delete firewall ipv6 name RULE6
commit

exit

echo ""
echo "=========================================="
echo "All tests completed!"
echo "=========================================="

Test result

test_firewall_protocol_result.txt
test_firewall_protocol.sh

admin@Y-ANDOU-VYOS15.Y-ANDOU-01:~$ grep 'Test [0-9]' test_firewall_protocol_result.txt
[Test 1a] Port specification with numeric protocol (6 = TCP)...
[Test 1a] PASSED: Numeric protocol 6 with port 443 accepted.
[Test 1b] Port specification with string protocol (tcp)...
[Test 1b] PASSED: String protocol tcp with port 443 accepted.
[Test 2a] Port specification with numeric protocol (17 = UDP)...
[Test 2a] PASSED: Numeric protocol 17 with port 53 accepted.
[Test 2b] Port specification with string protocol (udp)...
[Test 2b] PASSED: String protocol udp with port 53 accepted.
[Test 3a] TCP flags with numeric protocol (6 = TCP)...
[Test 3a] PASSED: Numeric protocol 6 with tcp flags syn accepted.
[Test 3b] TCP flags with string protocol (tcp)...
[Test 3b] PASSED: String protocol tcp with tcp flags syn accepted.
[Test 4a] GRE matching with numeric protocol (47 = GRE)...
[Test 4a] PASSED: Numeric protocol 47 with GRE options accepted.
[Test 4b] GRE matching with string protocol (gre)...
[Test 4b] PASSED: String protocol gre with GRE options accepted.
[Test 5a] synproxy action with numeric protocol (6 = TCP)...
[Test 5a] PASSED: Numeric protocol 6 with synproxy accepted.
[Test 5b] synproxy action with string protocol (tcp)...
[Test 5b] PASSED: String protocol tcp with synproxy accepted.
[Test 6a] ICMP with numeric protocol (1 = ICMP)...
[Test 6a] PASSED: Numeric protocol 1 with ICMP type accepted.
[Test 6b] ICMP with string protocol (icmp)...
[Test 6b] PASSED: String protocol icmp with ICMP type accepted.
[Test 7a] ICMPv6 with numeric protocol (58 = ICMPv6)...
[Test 7a] PASSED: Numeric protocol 58 with ICMPv6 type accepted.
[Test 7b] ICMPv6 with string protocol (ipv6-icmp)...
[Test 7b] PASSED: String protocol ipv6-icmp with ICMPv6 type accepted.

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
I have run the components SMOKETESTS if applicable
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

Requested by: @Nyandorew

github-actions · 2026-02-10T01:43:50Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

github-actions · 2026-02-10T01:43:53Z

👍
No issues in PR Title / Commit Title

Nyandorew · 2026-02-10T01:45:58Z

I have read the CLA Document and I hereby sign the CLA

- Add PROTOCOL_NUMBER_TO_NAME mapping for IANA protocol numbers - Normalize protocol numbers to names early in verify_rule() - Fix inconsistent behavior when protocol numbers used with various options - Ensures protocol numbers (e.g., 6 for TCP) work consistently across: * Port specifications * TCP flags * GRE settings * synproxy action * ICMP protocol validation

github-actions · 2026-02-10T04:30:29Z

CI integration ❌ failed!

Details

CI logs

CLI Smoketests ❌ failed
CLI Smoketests (interfaces only) ❌ failed
Config tests ❌ failed
RAID1 tests ❌ failed
CLI Smoketests VPP ⏭️ skipped
Config tests VPP ⏭️ skipped
TPM tests ⏭️ skipped

Nyandorew

I've tested this code and it works fine.

zdc · 2026-02-10T09:48:31Z

src/conf_mode/firewall.py

+# Protocol number to name mapping (IANA Protocol Numbers)
+# This ensures consistent handling of numeric protocol specifications
+PROTOCOL_NUMBER_TO_NAME = {
+    '1': 'icmp',
+    '2': 'igmp',
+    '6': 'tcp',
+    '17': 'udp',
+    '47': 'gre',
+    '50': 'esp',
+    '51': 'ah',
+    '58': 'ipv6-icmp',
+    '89': 'ospf',
+    '132': 'sctp',
+}
+


I do not believe this should be hardcoded. Instead, we could use nftables’ built-in interface to retrieve the list of supported protocols (nft describe inet_proto), or at minimum, reference /etc/protocols, which, if I recall correctly, is already used for validation in certain parts of the CLI.

Acknowledged—thanks for the suggestion.
I’ll update this to avoid hardcoding and switch to using nftables’ built-in interface (nft describe inet_proto) or, alternatively, referencing /etc/protocols.
This will require a bit of investigation and implementation work, so could you please allow me a few days to post an update?

zdc · 2026-02-25T14:43:29Z

@Nyandorew I see, you requested the review earlier, but there were no changes after the previous one - maybe this was done accidentally?

Could you confirm that you are still working on the PR?

github-actions bot assigned Nyandorew Feb 10, 2026

github-actions bot added the current label Feb 10, 2026

Nyandorew mentioned this pull request Feb 10, 2026

firewall: Allow both protocol names and numbers consistently in CLI configuration Amiya-Corp/vyos-1x_fork#1

Open

10 tasks

Nyandorew force-pushed the devin/1770277170-firewall-protocol-number-fix branch from 2239417 to ad9154c Compare February 10, 2026 04:20

vyosbot added a commit to vyos/vyos-cla-signatures that referenced this pull request Feb 10, 2026

@Nyandorew has signed the CLA in vyos/vyos-1x#4978

9b79d1e

Nyandorew commented Feb 10, 2026

View reviewed changes

zdc requested changes Feb 10, 2026

View reviewed changes

Nyandorew requested a review from zdc February 12, 2026 04:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

firewall: T8247: Allow both protocol names and numbers consistently#4978

firewall: T8247: Allow both protocol names and numbers consistently#4978
Nyandorew wants to merge 1 commit intovyos:currentfrom
Amiya-Corp:devin/1770277170-firewall-protocol-number-fix

Nyandorew commented Feb 10, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 10, 2026 •

edited

Loading

Uh oh!

Nyandorew commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

Nyandorew left a comment

Uh oh!

zdc Feb 10, 2026

Uh oh!

Nyandorew Feb 12, 2026

Uh oh!

zdc commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

Nyandorew commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Task(s)

Change summary

Types of changes

Related PR(s)

Component(s) name

How to test

Test result

Checklist:

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Nyandorew commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Details

Uh oh!

Nyandorew left a comment

Choose a reason for hiding this comment

Uh oh!

zdc Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Nyandorew Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

zdc commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Nyandorew commented Feb 10, 2026 •

edited

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading