Bug 961345

Summary:	lokkit command deletes existing iptables entries
Product:	Red Hat Enterprise Linux 6	Reporter:	Nicola Asuni <nicola>
Component:	system-config-firewall	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED NOTABUG	QA Contact:	qe-baseos-daemons
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	smooge
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-10 09:11:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Nicola Asuni 2013-05-09 12:55:25 UTC

Description of problem:

When executing the "lokkit" command some existing entries on iptables are deleted.

Version-Release number of selected component (if applicable):

lokkit --version
system-config-firewall 1.2.27

uname -a
Linux testguest 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux



How reproducible:

Steps to Reproduce:

1. add the following entry to iptables:

iptables -t filter -I INPUT -m state --state NEW -m tcp -p tcp -s 10.199.3.16 --dport 443 -j ACCEPT

2. save iptables:

service iptables save

3. check if the entry is correctly added:

iptables -L

4. execute a lokkit command:

lokkit -p 9940:tcp

5. now the previous iptable entry has been deleted. You can check with:

iptables -L


This is for me a severe bug since during automatic deployment the firewall configuration of numerous guests were corrupted.

Comment 1 Nicola Asuni 2013-05-09 12:56:45 UTC

Please note that I am currently using a fully updated CentOS version (as today).

Comment 3 Stephen John Smoogen 2013-05-09 17:29:46 UTC

Hi I am not the maintainer of this software but helped (in a very very small part) in its initial development.

The application is working as "intended". lokkit and by extension system-firewall-config is meant to be an initial firewall setup tool and was never meant to deal with existing or edited firewall tables. Any editing of existing rules requires complicated logic to guess the intention of the system administrator (like does the administrator really want to put the ALLOW rule after a DROP rule so it never gets there.. or vice versa.) 

Currently development for such a system is going on in the program firewalld which is meant to be more versatile in handling firewalls.

Comment 4 Nicola Asuni 2013-05-10 07:56:18 UTC

Hi Stephen, thank you for your prompt answer.

After further investigation I also realized that the two systems, iptables and lokkit, are incompatible but this was not immediately clear for me.

Initially I thought that using lokkit was an easy way to *add* an entry to the iptables file while, I discovered later, that when the lokkit command is invoked, the iptables files (/etc/sysconfig/iptables and /etc/sysconfig/ip6tables) are destroyed and rewritten using only the information on /etc/sysconfig/system-config-firewall file generated by lokkit.

As a future reference, the solution to my case consist into using the "--custom-rule" option of lokkit and write a custom file with the custom rule to add. For example:

echo "-I INPUT -m state --state NEW -m tcp -p tcp -s 10.199.3.16 --dport 443 -j ACCEPT" > /etc/sysconfig/iptables-custom-rule

lokkit --custom-rules=ipv4:filter:/etc/sysconfig/iptables-custom-rule

Comment 5 Thomas Woerner 2013-05-10 09:11:53 UTC

I can not add more information to the comment from Stephen and also your own.

Closing as not a bug.