Bug 1002016 - Combined zones does not show up as permanent
Combined zones does not show up as permanent
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: firewalld (Show other bugs)
19
All Linux
unspecified Severity medium
: ---
: ---
Assigned To: Thomas Woerner
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-28 06:49 EDT by Anders Blomdell
Modified: 2014-03-08 23:43 EST (History)
4 users (show)

See Also:
Fixed In Version: firewalld-0.3.9.3-1.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-01-16 09:38:54 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Hackish first try at adding editing capability of combined zones (1.23 KB, patch)
2013-08-28 09:04 EDT, Anders Blomdell
no flags Details | Diff
Editable combined zones (4.29 KB, patch)
2013-08-29 11:09 EDT, Anders Blomdell
no flags Details | Diff
Allow longer names for combined zones, create combine directory (6.89 KB, patch)
2013-08-29 14:15 EDT, Anders Blomdell
no flags Details | Diff

  None (edit)
Description Anders Blomdell 2013-08-28 06:49:16 EDT
Description of problem:

When creating a combined zone, they don't show as --permanent

Version-Release number of selected component (if applicable):

firewalld-0.3.4-1.fc19.noarch


How reproducible:

Always

Steps to Reproduce:
1. mkdir /etc/firewalld/zones/test/
2. cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/test/test.xml
3. firewall-cmd --reload
4. firewall-cmd --permanent --list-all --zone test

Actual results:

Error: INVALID_ZONE: test

Expected results:

test
  interfaces: 
  sources: 
  services: ipp-client mdns dhcpv6-client ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 

Additional info:

Combined zones are also hidden in the firewall-config GUI

I would suggest combined zones to show up as a number 'zone/subname' in both firewalld-config and firewalld-cmd, which would make it possible to edit the individual combined zones from the GUI.
Comment 1 Anders Blomdell 2013-08-28 07:23:24 EDT
Just adding "self.config.add_zone(copy.deepcopy(combined_zone))" makes it show up permanent, but editing will be totally bogus (only /etc/firewalld/zones/test/test.xml in my example will be affected).
Comment 2 Anders Blomdell 2013-08-28 09:04:17 EDT
Created attachment 791395 [details]
Hackish first try at adding editing capability of combined zones
Comment 3 Anders Blomdell 2013-08-29 11:09:55 EDT
Created attachment 791875 [details]
Editable combined zones

Adding, removing and editing of combined zones implemented.

Combined zones now includes both top level .xml files as well as file from subdirectory (i.e. /etc/firewalld/zones/zone.xml and /etc/firewalld/zones/zone/*.xml)
Comment 4 Anders Blomdell 2013-08-29 13:06:26 EDT
Minor problem: name of combined zone name files can easily exceed the 17 character limit in max_zone_name_len, but netfilter rule will only? contain the part before the '/', perhaps max_zone_name_len should be made a function that checks constraints and returns a properly truncated zone_name. E.g

  a_very_long_zone_name/some_sub_rule

would become:

  a_very_long_zone_/some_sub_rule

returning a suitable tuple, would make it possible to only enable the OK button for well-formed entries as well (firewall-config).
Comment 5 Anders Blomdell 2013-08-29 14:15:58 EDT
Created attachment 791924 [details]
Allow longer names for combined zones, create combine directory

Added:

1. Check and create /etc/firewalld/zones/<combined>/ before creating .xml (sloppy testing on my part, testing with reused name :-()

2. Allow longer names for combined zones (hopefully only the combined name will occur in netfilter rules).
Comment 6 Jiri Popelka 2013-11-14 12:31:31 EST
I've just applied your patch.
https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=a438a70de9bf0d4ce6252e56eda0c0439b3210ed

Sorry it took so long and thank you very much for it !
Comment 7 Fedora Update System 2014-01-13 11:47:11 EST
firewalld-0.3.9-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/firewalld-0.3.9-1.fc20
Comment 8 Fedora Update System 2014-01-13 11:49:55 EST
firewalld-0.3.9-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/firewalld-0.3.9-1.fc19
Comment 9 lnie 2014-01-14 00:42:31 EST
tested firewalld-0.3.9-1.fc20 ,the output is still :
Error: INVALID_ZONE: test
Comment 10 Fedora Update System 2014-01-14 03:39:25 EST
Package firewalld-0.3.9-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing firewalld-0.3.9-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-0738/firewalld-0.3.9-1.fc20
then log in and leave karma (feedback).
Comment 11 Jiri Popelka 2014-01-16 08:55:00 EST
Actually it works, but you have to specify the zone name as "zone/subname".

For example if I have test/1.xml and test/2.xml
# firewall-cmd --permanent --list-all-zones
test/1
 ...
test/2
 ...

#firewall-cmd --permanent --list-all --zone test/1
test/1
 ...

#firewall-cmd --permanent --list-all --zone test/2
test/2
 ...

I'll take a look if it can be changed to be able to use the zone name without the subname.
Comment 12 Jiri Popelka 2014-01-16 09:38:54 EST
It actually makes perfect sense as it is now.
Permanent changes mean changes in configuration files.
When I take the above example, i.e. test/1 and test/2, from the following command
#firewall-cmd --permanent --add-service=dns --zone=test
it's not clear whether the service should be added to 1.xml or 2.xml, therefore it's necessary to use the name as "zone/subname".
Comment 13 Fedora Update System 2014-01-16 10:35:26 EST
firewalld-0.3.9.1-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/FEDORA-2014-0752/firewalld-0.3.9.1-1.fc19
Comment 14 Anders Blomdell 2014-01-16 10:42:08 EST
(In reply to Jiri Popelka from comment #12)
> It actually makes perfect sense as it is now.
> Permanent changes mean changes in configuration files.
> When I take the above example, i.e. test/1 and test/2, from the following
> command
> #firewall-cmd --permanent --add-service=dns --zone=test
> it's not clear whether the service should be added to 1.xml or 2.xml,
> therefore it's necessary to use the name as "zone/subname".

My intention in this case was to add it to test.xml (hance the changed logic for combined zones).
Comment 15 Fedora Update System 2014-03-08 23:43:17 EST
firewalld-0.3.9.3-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.