Bug 1066037

Summary:	firewall-config should allow unspecifying zone binding for interface
Product:	Red Hat Enterprise Linux 7	Reporter:	Tomas Dolezal <todoleza>
Component:	firewalld	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	Tomas Dolezal <todoleza>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.0	CC:	jscotka, mjahoda, pvrabec, swadeley, todoleza, twoerner
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	firewalld-0.4.2-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1133545 (view as bug list)		Environment:
Last Closed:	2016-11-03 20:59:39 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1113520, 1133545, 1295396, 1296594, 1313485

Description Tomas Dolezal 2014-02-17 14:42:00 UTC

Description of problem:
When user wants to use default zone for several connections to be able to change them at once, he is unable to do that after specifying a zone for any connection.
Proposed solution is to add some "<Default>" zone into zones list under "Select zone for connection".
This functionality should be available from both firewall-config and firewall-cmd (e.g. --unset-zone or whatever suitable)

Version-Release number of selected component (if applicable):
firewall-config-0.3.9-4.el7.noarch

How reproducible:
always

Steps to Reproduce:
This is available via Options/Change zone of connections (firewall-config-0.3.9-4.test0.el7.noarch) or under Interfaces tab where you select interface entry and click on Edit.

Actual results:
Unable to unspecify zone to which is interface bound

Expected results:
Have an entry for no zone to unspecify it

Additional info:
the test version has copied menu from firewall-applet in Options menu, link http://koji.fedoraproject.org/koji/buildinfo?buildID=498589

Comment 1 Tomas Dolezal 2014-02-17 14:46:47 UTC

please forget the link in additional, it is wrong

Comment 14 Tomas Dolezal 2016-04-26 13:40:20 UTC

the same action - zone unsetting on ifaces - should be also available from firewall-cmd CLI utility

Comment 15 Thomas Woerner 2016-04-28 15:19:59 UTC

Fixed in upstream git commits:

firewall-applet:
https://github.com/t-woerner/firewalld/commit/fc486a6c3cdb375460e348f28d80657ebcb9d6fe

firewall-config:
https://github.com/t-woerner/firewalld/commit/3353c6f59c022ba5ebcf88130f32973bf982746e

fw_nm module:
https://github.com/t-woerner/firewalld/commit/554408ca361c2d2006927b382ce3d136ab21c600

Comment 16 Thomas Woerner 2016-05-02 07:59:29 UTC

Here is the fix for firewall-cmd:
https://github.com/t-woerner/firewalld/commit/e83ae424b271dec86cbb91b3ed33ec5bce88db05

Comment 18 Thomas Woerner 2016-05-30 14:39:24 UTC

There are additional commits for ifcfg file handling:

firewall/core/io/ifcfg: New ifcfg file parser
https://github.com/t-woerner/firewalld/commit/dc955c5253109bf3cae4f879c3ec69c565784fa8

New global SYSCONFIGDIR and IFCFGDIR setting, use SYSCONFIGDIR in off…
https://github.com/t-woerner/firewalld/commit/d5d428e44824d6183e6cac8c523be51e0cf82497

firewall.core.fw_ifcfg: New module to search for and change ifcfg files
https://github.com/t-woerner/firewalld/commit/2390d3fbbb784ac2a6216b62bb564015b7f1ea25

firewall.core.fw_zone: Use requested zone in add_interface call in ch…
https://github.com/t-woerner/firewalld/commit/03d767ce2ac7efe99fffc3a702c95542d8a7984b

firewall.core.fw_zone: Use ifcfg_set_zone_of_interface in add_interfa…
https://github.com/t-woerner/firewalld/commit/3496f26b49afbe9e62f6dbab43daff31dde10b75

firewall.core.fw_ifcfg: iFix ifcfg_set_zone_of_interface for missing … https://github.com/t-woerner/firewalld/commit/46ff47cee8f3ca08f6b90b8e75e6a37976cd54c4

Comment 24 errata-xmlrpc 2016-11-03 20:59:39 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-2597.html