Bug 1182641

Summary:	Can`t delete direct rule using firewall-cmd
Product:	[Fedora] Fedora	Reporter:	Solomonov Sergei <sergei.solomonov>
Component:	firewalld	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	21	CC:	jpopelka, twoerner
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	firewalld-0.3.14.1-1.fc22	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	1182671 (view as bug list)		Environment:
Last Closed:	2015-06-18 13:28:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1182671

Description Solomonov Sergei 2015-01-15 15:55:02 UTC

Description of problem:
Can`t delete direct rule using firewall-cmd tool

Version-Release number of selected component (if applicable):
version 0.3.13

How reproducible:


Steps to Reproduce:
# firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 81
# firewall-cmd --reload
# firewall-cmd --permanent --direct --remove-rule ipv4 nat OUTPUT 0 -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 81
# firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 82
# firewall-cmd --reload
# firewall-cmd --direct --get-all-rules
Actual results:
ipv4 nat OUTPUT 0 -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 81
ipv4 nat OUTPUT 0 -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 82

Expected results:
ipv4 nat OUTPUT 0 -s 127.0.0.1 -d 127.0.0.1 -p tcp --dport 80 -j REDIRECT --to-ports 82

Additional info:
Also tested on Oracle Enterprise Linux 7, version 0.3.9

Comment 1 Thomas Woerner 2015-01-15 16:48:38 UTC

Fixed upstream: https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=133e8e7cc77dfe10269ac146f3c03810f50062dd

Comment 2 Thomas Woerner 2015-01-15 16:52:36 UTC

Permanent direct settings are not recognized as such while reloading firewalld after adding the settings to the permanent environment if firewalld has been reloaded after adding the settings in the first place and after they have been removed again from the permanent environment.

A new test has been added to firewall-cmd_test.sh for verification.

Comment 3 Fedora Update System 2015-06-12 22:26:05 UTC

firewalld-0.3.14.1-1.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/firewalld-0.3.14.1-1.fc22

Comment 4 Fedora Update System 2015-06-14 17:34:10 UTC

Package firewalld-0.3.14.1-1.fc22:
* should fix your issue,
* was pushed to the Fedora 22 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing firewalld-0.3.14.1-1.fc22'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-10008/firewalld-0.3.14.1-1.fc22
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2015-06-18 13:28:18 UTC

firewalld-0.3.14.1-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.