Bug 179187

alex, whats the status of gnome-user-share vs firewalls ?
didn't you do kernel work to fix this ?

Unfortunately not. That was for smb browsing.
This is an actual service, so we can't really permanently punch through the
firewall for this...

Alex, what is the plan for fixing this ? Or is there no plan ?

I can't really think of a possible solution. The port we get is a dynamic high
port. We can't open all such ports, and there is no way to dynamically open a
port in the firewall from the app.

Then there is no point in keeping this on FC5Target

Davidz has some ideas about using selinux to let some specific apps punch open
ports in the firewall. That could work.

Moving to FC7Target

Nothing is going to happen for FC7 here, unfortunately.

Changing version to '9' as part of upcoming Fedora 9 GA.
More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

*** Bug 447248 has been marked as a duplicate of this bug. ***

This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Is solution to make gnome-user-share bind to fixed port (or next free one) and open in firewall a bunch of ports starting from it considered to be too insecure?

I am really wondering about this one... F12 will make the "Personal file sharing" even more prominent in the UI by showing those bars in nautilus (in Downloads and Public) and there is not even a hint telling the user that this does not work at all atm if the firewall is active (which is the case in a default configuration).

I wonder if anyone has even a semi-cool workaround for this, or is anyone just turning off the firewall anyway? Really makes me wonder...

Even disabling the firewall isn't getting it to work in my case. 

(In reply to comment #13)
> I am really wondering about this one... F12 will make the "Personal file
> sharing" even more prominent in the UI by showing those bars in nautilus (in
> Downloads and Public) and there is not even a hint telling the user that this
> does not work at all atm if the firewall is active (which is the case in a
> default configuration).
> 
> I wonder if anyone has even a semi-cool workaround for this, or is anyone just
> turning off the firewall anyway? Really makes me wonder...

I can second that, Akshay.

I have Fedora 12 (i686, firewall disabled, and yum fully updated, running as VM under VMware Server 2.0.2 on Windows XP Professional SP3 32-bit, Ethernet connected to VMware NAT, hostname "apollo.localdomain").

On the Windows host, I've installed Apple's Bonjour 1.0.106 (Bonjour's port 5353/UDP is open, Internet Explorer version is 8.0.6001.18702).

Bonjour's Internet Explorer add-on can see "apollo" and "HP LaserJet 3055 (30E85D)". When I double-click the LaserJet, I can see its management webpage in IE. When I double-click apollo, I get an IE message "the webpage cannot be found", which seems to be an HTTP 404.

The URL that ends up in the IE Address Bar is "http://apollo.local:37830/" -- when I try opening this address in Firefox 3.6, I get a "404 Not Found".

What can I do to help you diagnose this, Bastien? Please let me know.

I forgot to mention my Fedora Personal File Sharing settings: I have selected "Share public files on network". I get the same behaviour regardless of whether I have "Require password" as "Never" or the preferred "Always".

Billy, did you try to connect to the share from your desktop machine itself? That should work at least... Not sure if it is supposed to work over a NAT, but if bonjour is working, the rest probably should, too...

Michael,

I think my NAT comment was misleading: I am indeed connecting directly.

To clarify:

192.168.76.1 windows host
192.168.76.128 apollo fedora guest

There is no NAT between the Windows host and the Fedora guest; they are simply on VMware's NAT interface, meaning that the Fedora guest has NAT access to the Internet through the host.

Another point of clarification: I mentioned a LaserJet in Comment 15; this LaserJet is on the Windows host's Ethernet LAN, which is a different IP subnet to 192.168.76.0/24. I only mention it to illustrate that IE/Bonjour seem to be working fine, and the Personal File Sharing problem is with Fedora.

Thanks,
Billy.

Wow - F14 and this is still an open bug?  Why can't the webdav connecting port either be a fixed port, or can iptables be uPnP enabled so local services can temporarily open ports for sessions?

*** Bug 673692 has been marked as a duplicate of this bug. ***

Fedora 16 is out. What's the current status?

Fedora 16 did not fix this.  The problem remains as originally described five years ago.

Created attachment 549218 [details]
/sbin/ip6tables-save showing high ports open

Solution: modify ip6tables, iptables to allow gnome-user-share to work on a network with firewalls "up"

Here's my workaround ip6tables and iptables.

Reasoning:
- since the high ports bounce around
- since the high ports are communicated over mdns you can't guess them or constraint them
- since no other reasonable service uses the very high ports above 32K
it is fair to open them up widely.

Add the following to ip6tables (and iptables)
-A INPUT -p tcp -m tcp --dport 32768:65535 -j ACCEPT 
-A INPUT -p udp -m udp --dport 32768:65535 -j ACCEPT 

I don't believe that kernel hacking is necessary or appropriate here.
Fundamentally, it's a user experience and user-level debuggability problem

A more complete and intuitive solution up into the experience level to this might involve any or all of the following
(a) a user being able to specify the port somehow in their gnome-file-share-properties
(b) the file sharing is a hash of the user's login added to a base port; e.g. sub port($user) { return 35987 + (md5($user) % 256); }
(c) system-config-firewall having prominent support for enabling user sharing in the firewall by whatever scheme, high port, specific port, port range
(d) nautilus webdav gvfs (?) probing to guess whether the surrounding targets have their "shields up" by examining the mdns records and doing a speculative probe once per [reasonable period]

Any solution that reminds the user what is going on will be helpful. The file sharing feature is kindof neato, but it's got to be far more debuggable when it ceases to work.  Today when it ceases to work the world is silent about its very existence.  As such, the Network panel largely is a "windows thing" because that is what shows up there: the windows machines.

Created attachment 549219 [details]
/sbin/iptables-save showing high ports open (for completeness; pair with ip6tables)

Relevant upstream feature request to have gnome-user-share ask firewalld to punch temporary holes in the firewall: <https://bugzilla.gnome.org/show_bug.cgi?id=336201>.

Will be fixed in the next version of Fedora, see:
http://www.hadess.net/2014/06/firewalls-and-per-network-sharing.html