Hi,

Steps to reproduce. Here's the config in the master:

root@zigo-puppet-master:~# cat /etc/puppet/puppet.conf
[master]
# Tell what type of ENC
#node_terminus = exec

# Path to enc
#external_nodes = /usr/bin/oci-puppet-external-node-classifier

# Path to standard hiera config
hiera_config = /etc/puppet/hiera.yaml

top_level_facts_soft_limit = 8192

[main]
#puppet master address
server = zigo-puppet-master

root@zigo-puppet-master:~# cat /etc/puppet/code/environments/production/manifests/site.pp
node /.*/ {
  firewall {'102 allow all for 10.0.0.0/24':
    proto => tcp,
    jump => accept,
    source => '10.0.0.0/24',
  }
}

In the slave node:

root@zigo-puppet-slave:~# cat /etc/puppet/puppet.conf
# This file can be used to override the default puppet settings.
# See the following links for more details on what settings are available:
# - https://puppet.com/docs/puppet/latest/config_important_settings.html
# - https://puppet.com/docs/puppet/latest/config_about_settings.html
# - https://puppet.com/docs/puppet/latest/config_file_main.html
# - https://puppet.com/docs/puppet/latest/configuration.html

[main]
server = zigo-puppet-master

ssldir = /var/lib/puppet/ssl/ca

[master]
vardir = /var/lib/puppet
cadir  = /var/lib/puppet/ssl/ca
dns_alt_names = puppet

Then after a "puppetserver reload", the server crashes the slave doing
(rewrapped so it is easier to read):

Error: Could not retrieve catalog from remote server:
Error 500 on SERVER: Server Error: Evaluation Error:
Error while evaluating a Resource Statement,
Could not autoload puppet/type/firewall:
Could not autoload puppet/provider/firewall/firewall:
no such file to load -- puppet_x/puppetlabs/firewall/ipcidr
(file: /etc/puppet/code/environments/production/manifests/site.pp,
     line: 2, column: 3) on node zigo-puppet-slave

Lavamind, I can add your ssh key to both the master and salve,
so you can try by yourself.

Cheers,

Thomas Goirand (zigo)

severity -1 serious
reassign -1 puppet-module-puppetlabs-firewall
thanks

Thanks for the report.

This bug is caused by a defect in the firewall module, which was fixed
by upstream in a later version, so I'm reassigning the report to that
package.

Also marking this as RC since installing and using the module is
breaking puppetserver in a serious way.

We believe that the bug you reported is fixed in the latest version of
puppet-module-puppetlabs-firewall, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1109161@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jérôme Charaoui <jerome@riseup.net> (supplier of updated puppet-module-puppetlabs-firewall package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 13 Jul 2025 18:53:06 +0200
Source: puppet-module-puppetlabs-firewall
Binary: puppet-module-puppetlabs-firewall
Architecture: source all
Version: 8.0.0-4
Distribution: unstable
Urgency: medium
Maintainer: Puppet Package Maintainers <pkg-puppet-devel@lists.alioth.debian.org>
Changed-By: Jérôme Charaoui <jerome@riseup.net>
Description:
 puppet-module-puppetlabs-firewall - Puppet module for Firewall management
Closes: 1109161
Changes:
 puppet-module-puppetlabs-firewall (8.0.0-4) unstable; urgency=medium
 .
   * Team upload.
   * Add patch fixing issue with autoload (Closes: #1109161)
Checksums-Sha1:
 ae836f973a7827c553326940733be43ffb87b57b 1694 puppet-module-puppetlabs-firewall_8.0.0-4.dsc
 862cd78676f75a6c3ca0952c6459b24c00ae9d4d 6192 puppet-module-puppetlabs-firewall_8.0.0-4.debian.tar.xz
 d43bf99a97c467b201f5a260b6faf440303ea12e 69256 puppet-module-puppetlabs-firewall_8.0.0-4_all.deb
 040d7c0c52902a0cd1ca1988b4772141f38831ae 5215 puppet-module-puppetlabs-firewall_8.0.0-4_amd64.buildinfo
Checksums-Sha256:
 7d2f096ef05bf3a51ea0ffe57ccef086f7c201ff7b97cb58cf3d5679cbe8c4f7 1694 puppet-module-puppetlabs-firewall_8.0.0-4.dsc
 81ceef3928d114d107fa2b26e74b612832efcbb9f41ae76c3a558b0487928481 6192 puppet-module-puppetlabs-firewall_8.0.0-4.debian.tar.xz
 a9ec8d9ac29dc531153bfe0067a4e6d80a03ccf1f2e02c8e144c574772a6fdc8 69256 puppet-module-puppetlabs-firewall_8.0.0-4_all.deb
 2c15571d222a40c2ffd24c8609b059838d0c663002ed5cd95a2b2cb885034dc8 5215 puppet-module-puppetlabs-firewall_8.0.0-4_amd64.buildinfo
Files:
 448a66af1460734bcbc2704cd7e46e97 1694 admin optional puppet-module-puppetlabs-firewall_8.0.0-4.dsc
 33d6b36ae2988ce5ffde97a731c48601 6192 admin optional puppet-module-puppetlabs-firewall_8.0.0-4.debian.tar.xz
 0d85f454b2ca4773d4cf65793beb260d 69256 admin optional puppet-module-puppetlabs-firewall_8.0.0-4_all.deb
 24ab4d175866147cd506ade93f4c2d48 5215 admin optional puppet-module-puppetlabs-firewall_8.0.0-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQTAq04Rv2xblqv/eu5pxS9ljpiFQgUCaHP0FwAKCRBpxS9ljpiF
QpoxAQCjxGVw3cJ24789uTWq47r+JpecSuMSERa8G/v9a3pRQwD/dtErWtN4HVyf
QQm7qTg7vV87thrsCd1uRipa0m8sIg4=
=ESpP
-----END PGP SIGNATURE-----

Making sure that one is closed.

Cheers,

Thomas Goirand (zigo)

Hi Thomas,

This bug was fixed in puppet-module-puppetlabs-firewall/8.0.0-4, but the newer
upload (8.1.7-1) doesn't seem to have the changes from that version (according
to the changelog). Because of this, the BTS version tracking still thinks the
bug applies to 8.1.7-1

If 8.1.7-1 also fixes this bug, 8.1.7-1 should be added as a 'fixed' version.

Thanks,

Ivo