firewalld does not work on siduction. The service starts, fails and exits with
status 0 - so it never shows up in "systemctl --failed". No nftables ruleset is
ever active, while the plasma-firewall KCM keeps showing a configured firewall.
Silent failure, which is why it went unnoticed.
firewalld[1308]: ERROR: 'python-nftables' failed: internal:0:0-0:
Error: Could not process rule: No such file or directory
firewalld[1308]: ERROR: Failed to load full stock configuration. This likely
indicates a system level issue, e.g. the firewall backend
(nftables, iptables) is broken. All hope is lost. Exiting.
CAUSE
firewalld builds an nftables "fib" expression for the IPv6 reverse path filter,
in build_rpfilter_rules() (https://github.com/firewalld/firewalld/blob/v2.5.1/src/firewall/core/nftables.py#L2624),
nftables.py line 2649 (https://github.com/firewalld/firewalld/blob/v2.5.1/src/firewall/core/nftables.py#L2649):
{"match": {"left": {"fib": {"flags": fib_flags, "result": "oif"}}, ...
This is the only fib usage in the nftables backend. The shipped default is
IPv6_rpfilter=strict, which the
parser in fw.py:405-414 (https://github.com/firewalld/firewalld/blob/v2.5.1/src/firewall/core/fw.py#L405-L414)
maps to the else branch of build_rpfilter_rules(). Only the value "no" skips the
call entirely
(guard in fw.py:1022 (https://github.com/firewalld/firewalld/blob/v2.5.1/src/firewall/core/fw.py#L1022))
- so the stock configuration always hits it.
The siduction kernel has no fib support at all:
$ modinfo -n nft_fib nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib_netdev
-> none found
$ ls /lib/modules/7.1.8-1-siduction-amd64/kernel/net/netfilter/ | grep fib
-> empty
$ grep NFT_FIB /boot/config-7.1.8-1-siduction-amd64
# CONFIG_NFT_FIB_IPV4 is not set
# CONFIG_NFT_FIB_IPV6 is not set
The kernel rejects the rule with ENOENT and the whole transaction is aborted.
DEBIAN COMPARISON
From debian/config/config (https://salsa.debian.org/kernel-team/linux/-/blob/debian/latest/debian/config/config)
in salsa kernel-team/linux, branch debian/latest (grep NFT_FIB in that file):
CONFIG_NFT_FIB_IPV4=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NFT_FIB_INET=m
CONFIG_NFT_FIB_NETDEV=m
CONFIG_NF_TABLES_ARP=y
VERIFIED ON A CLEAN STATE
Purged firewalld, python3-firewall and plasma-firewall, removed /etc/firewalld,
rebooted (empty kernel ruleset, "nft list tables" returned nothing), reinstalled
from sid. Same failure. Local configuration is ruled out.
Affects at least 7.1.7-1 and 7.1.8-1.
Versions: firewalld 2.5.1-2, nftables 1.1.6-1+b1, python3-nftables 1.1.6-1+b1.
NOTE ON THE 2023 THREAD
Topic 8905 (https://forum.siduction.org/index.php?topic=8905.0) reported
the same error message and it was answered with "python-nftables does not exist
in debian unstable". That was a misreading: "python-nftables" is a
string literal in nftables.py:389 (https://github.com/firewalld/firewalld/blob/v2.5.1/src/firewall/core/nftables.py#L389),
not a package name. The package python3-nftables is installed and works. The
cause was already the kernel back then. The reporter moved to Debian testing,
where firewalld ran - consistent with the config difference above.
WORKAROUND
Set IPv6_rpfilter=no in /etc/firewalld/firewalld.conf. firewalld then starts and
builds its ruleset, at the cost of losing the IPv6 reverse path filter.
REQUEST
Please enable CONFIG_NFT_FIB_IPV4=m and CONFIG_NFT_FIB_IPV6=m
(NFT_FIB_INET/NETDEV follow automatically).
Thank you!
---
Diagnosis worked out together with Claude Code (Opus 5), all findings measured
on my own machine: the module check, the config comparison and the clean-state
reproducer are verified here.
This sounds like a good idea and hopefully Towo could implement that change.