Bug 949730

Summary:	system-config-printer deletes POSTROUTING firewall rules of NAT virtual machines(libvirtd)
Product:	Red Hat Enterprise Linux 6	Reporter:	Wilmer Jaramillo M. <wilmer>
Component:	system-config-firewall	Assignee:	Eric Garver <egarver>
Status:	CLOSED WONTFIX	QA Contact:	qe-baseos-daemons
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.4	CC:	jpopelka
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-10-09 17:30:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Wilmer Jaramillo M. 2013-04-08 20:31:28 UTC

Description of problem:
When launch system-config-printer first time, this check the firewall and request permission for add ipp port in iptables rules deleting POSTROUTING rules of virtualization libvirt daemon disabling the operation of virtual machines.


How reproducible:

Have a virtual Machine(Windows) doing NAT.


Steps to Reproduce:
1. Install (Windows) virtual machine doing NAT.
2. Launch system-config-printer
2. Accept request about add iptables rules.
3. try use nat through virtual machines.
  
Actual results:
Delete iptables POSTROUTING rules:
MASQUERADE  tcp  --  192.168.122.0/24    !192.168.122.0/24    masq ports: 1024-

and add INPUT rules: 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 631 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 631 -j ACCEPT


Expected results:

Only add INPUT rules:
-A INPUT -p tcp -m state --state NEW -m tcp --dport 631 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 631 -j ACCEPT


Additional info:

Comment 2 Jiri Popelka 2013-04-09 09:02:19 UTC

system-config-printer uses (via D-Bus interface) system-config-firewall (s-c-f) for modification of firewall. Problem is that s-c-f needs to do complete firewall restart for each change which is a problem for libvirtd which creates its own rules. With the restart libvirt's rules are lost.

I'm moving this ticket to s-c-f for now, but I'm almost sure this can't be fixed because its one of the limitation of s-c-f and one of the reasons for FirewallD development
(see. https://fedoraproject.org/wiki/FirewallD#Dynamic_firewall_with_FirewallD)

Comment 3 RHEL Program Management 2013-10-13 23:43:42 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

Comment 4 Eric Garver 2017-10-09 17:30:07 UTC

Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the
Production 3 Phase, Critical impact Security Advisories (RHSAs) and
selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as
they become available.

The official life cycle policy can be reviewed here:

http://redhat.com/rhel/lifecycle

This issue does not meet the inclusion criteria for the Production 3
Phase and will be marked as CLOSED/WONTFIX. If this remains a critical
requirement, please contact Red Hat Customer Support to request a
re-evaluation of the issue, citing a clear business justification. Note
that a strong business justification will be required for re-evaluation.