Bug 909466

Summary:	firewall-cmd (firewalld) allows adding non-existing services
Product:	[Fedora] Fedora	Reporter:	Jan Middelkoop <jan>
Component:	firewalld	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	18	CC:	jpopelka, rvastenhoud, stephen.hindmarch, twoerner
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-12 22:25:21 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Middelkoop 2013-02-08 20:49:07 UTC

Description of problem:
firewall-cmd allows adding non-existing --permanent services.  This in itself is not such a big issue, but this distrubs the firewall-cmd --reload or startup process.

Version-Release number of selected component (if applicable):
firewalld-0.2.12-2.fc18.noarch

How reproducible:
Always.

Steps to Reproduce:
(note that the 'smtps' service does not exist)
1. firewall-cmd --permanent --zone=public --add-service=smtps
2. firewall-cmd --permanent --zone=public --list-services
mdns ident http dhcpv6-client smtp smtps imaps ssh dns imap
3. firewall-cmd --reload
4. firewall-cmd --zone=public --list-services
mdns ident http dhcpv6-client smtp
  
Actual results:
The services get enabled up to the non-existent "smtps" service.  Because of that, the firewall seems to stop and doesn't enable the "imaps", "ssh" (eek!), "dns" and "imap" services.

Expected results:
An error during
1. firewall-cmd --permanent --zone=public --add-service=smtps
about adding a non-existent service.

Perhaps it would also be a good idea if firewalld continued loading the rest of the services if a service file doesn't exist.  I imagine the same situation could appear if, for example, one of the enabled services were removed from the system.

Additional info:
-

Comment 1 Jiri Popelka 2013-02-13 14:32:08 UTC

(In reply to comment #0)
> Expected results:
> An error during
> 1. firewall-cmd --permanent --zone=public --add-service=smtps
> about adding a non-existent service.

Fixed upstream
http://git.fedorahosted.org/cgit/firewalld.git/commit/?id=c5bff8daecfc5f386a6169a200f208ed6a96d72e

> Perhaps it would also be a good idea if firewalld continued loading the rest
> of the services if a service file doesn't exist.

Fixed upstream
http://git.fedorahosted.org/cgit/firewalld.git/commit/?id=8871709124a3899d9bfb24c4b42bdf464258a6ab

Thanks for the report !

Comment 2 Jan Middelkoop 2013-02-14 08:16:51 UTC

Thanks for the fix. :-)

Comment 3 Jiri Popelka 2013-04-03 09:51:10 UTC

*** Bug 929385 has been marked as a duplicate of this bug. ***

Comment 4 Fedora Update System 2013-04-03 10:45:32 UTC

firewalld-0.2.12-5.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/firewalld-0.2.12-5.fc18

Comment 5 Fedora Update System 2013-04-04 23:58:58 UTC

Package firewalld-0.2.12-5.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing firewalld-0.2.12-5.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-4826/firewalld-0.2.12-5.fc18
then log in and leave karma (feedback).

Comment 6 Fedora Update System 2013-04-12 22:25:23 UTC

firewalld-0.2.12-5.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Jiri Popelka 2013-04-16 13:28:42 UTC

*** Bug 952677 has been marked as a duplicate of this bug. ***