so-firewall issue

[pkgwillie]

I was trying to add some custom firewall rules with so-firewall which has somehow resulted in unexpected behaviour. All docker containers are not able to start after a reboot. When I run salt-cal state.highstate I get the following error. Anybody knows what is wrong and how to get this fixed?

[root@gwilliams]# salt-call state.highstate
[ERROR ] Rendering exception occurred
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/salt/utils/templates.py", line 497, in render_jinja_tmpl
output = template.render(**decoded_context)
File "/usr/lib/python3.6/site-packages/jinja2/environment.py", line 1090, in render
self.environment.handle_exception()
File "/usr/lib/python3.6/site-packages/jinja2/environment.py", line 832, in handle_exception
reraise(*rewrite_traceback_stack(source=source))
File "/usr/lib/python3.6/site-packages/jinja2/_compat.py", line 28, in reraise
raise value.with_traceback(tb)
File "", line 5, in top-level template code
File "/usr/lib/python3.6/site-packages/jinja2/environment.py", line 1155, in make_module
return TemplateModule(self, self.new_context(vars, shared, locals))
File "/usr/lib/python3.6/site-packages/jinja2/environment.py", line 1238, in init
body_stream = list(template.root_render_func(context))
File "/var/cache/salt/minion/files/base/firewall/map.jinja", line 7, in top-level template code
{% if local_portgroups.firewall.aliases.ports %}
File "/usr/lib/python3.6/site-packages/jinja2/sandbox.py", line 407, in getattr
value = getattr(obj, attribute)
jinja2.exceptions.UndefinedError: 'None' has no attribute 'firewall'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/salt/utils/templates.py", line 261, in render_tmpl
output = render_str(tmplstr, context, tmplpath)
File "/usr/lib/python3.6/site-packages/salt/utils/templates.py", line 504, in render_jinja_tmpl
raise SaltRenderError("Jinja variable {}{}".format(exc, out), buf=tmplstr)
salt.exceptions.SaltRenderError: Jinja variable 'None' has no attribute 'firewall'
/var/cache/salt/minion/files/base/firewall/map.jinja(7):

[...]
{% set translated_pillar_assigned_hostgroups = {} %}

{% import_yaml 'firewall/portgroups.yaml' as default_portgroups %}
{% set default_portgroups = default_portgroups.firewall.aliases.ports %}
{% import_yaml 'firewall/portgroups.local.yaml' as local_portgroups %}
{% if local_portgroups.firewall.aliases.ports %} <======================
{% set local_portgroups = local_portgroups.firewall.aliases.ports %}
{% else %}
{% set local_portgroups = {} %}
{% endif %}
{% set portgroups = salt['defaults.merge'](default_portgroups, local_portgroups, in_place=False) %}
[...]

[CRITICAL] Rendering SLS 'base:firewall' failed: Jinja variable 'None' has no attribute 'firewall'
/var/cache/salt/minion/files/base/firewall/map.jinja(7):

[...]
{% set translated_pillar_assigned_hostgroups = {} %}

{% import_yaml 'firewall/portgroups.yaml' as default_portgroups %}
{% set default_portgroups = default_portgroups.firewall.aliases.ports %}
{% import_yaml 'firewall/portgroups.local.yaml' as local_portgroups %}
{% if local_portgroups.firewall.aliases.ports %} <======================
{% set local_portgroups = local_portgroups.firewall.aliases.ports %}
{% else %}
{% set local_portgroups = {} %}
{% endif %}
{% set portgroups = salt['defaults.merge'](default_portgroups, local_portgroups, in_place=False) %}
[...]

local:
Data failed to compile:

Rendering SLS 'base:firewall' failed: Jinja variable 'None' has no attribute 'firewall'

/var/cache/salt/minion/files/base/firewall/map.jinja(7):

[...]
{% set translated_pillar_assigned_hostgroups = {} %}

{% import_yaml 'firewall/portgroups.yaml' as default_portgroups %}
{% set default_portgroups = default_portgroups.firewall.aliases.ports %}
{% import_yaml 'firewall/portgroups.local.yaml' as local_portgroups %}
{% if local_portgroups.firewall.aliases.ports %} <======================
{% set local_portgroups = local_portgroups.firewall.aliases.ports %}
{% else %}
{% set local_portgroups = {} %}
{% endif %}
{% set portgroups = salt['defaults.merge'](default_portgroups, local_portgroups, in_place=False) %}
[...]

[dougburks]

Take a look at the firewall documentation and review any files mentioned there for typos:
https://docs.securityonion.net/en/2.3/firewall.html

[pkgwillie]

Thanks @dougburks . I reverted all changes and updated SO standalone instance and was able to start all services. However trying to add custom port group according to documentation results in error below.

[dougburks]

Those commands work fine for me with no errors:

[root@securityonion ~]# so-firewall addportgroup cisco
[root@securityonion ~]# so-firewall addport cisco tcp 9002

If you're getting errors, then you most likely still have some kind of typo in your firewall files.