Description of problem: You can call add* methods from *.zone interface through D-Bus with negative timeout. This results in success and timeout is (probably) set to 0 (no timeout). Example: # firewall-cmd --add-rich-rule='rule family='ipv4' source address='192.168.2.2' accept' --timeout=-10 # dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.zone.addRichRule string:"" string:"rule family='ipv4' source address='192.168.2.2' accept" int32:-10 # iptables-save | grep 192.168.2.2 Version-Release number of selected component (if applicable): upstream git How reproducible: deterministic Actual results: success Expected results: command/method should fail and not insert rules into ip*tables
Should be fixed upstream with https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=780b2c9362e6fa344aec6487a04b29ac48fbe89a
Can't mark as resolved. Commands return errors, but iptables contain added rules: :: [ PASS ] :: iptables should not contain this rule (sanity) (Expected 1, got 1) :: [ BEGIN ] :: addRichRule (D-Bus) :: actually running 'dbus-send --system --dest=org.fedoraproject.FirewallD1 --print-reply --type=method_call /org/fedoraproject/FirewallD1 org.fedoraproject.FirewallD1.zone.addRichRule string:"" string:"rule family='ipv4' source address='192.168.2.8' accept" int32:-10' Error org.freedesktop.DBus.Python.dbus.exceptions.DBusException: INVALID_VALUE: timeout '-10' is not positive number :: [ PASS ] :: addRichRule (D-Bus) (Expected 1, got 1) :: [ BEGIN ] :: iptables should not contain this rule :: actually running 'iptables-save | grep 192.168.2.8' -A IN_public_allow -s 192.168.2.8/32 -j ACCEPT :: [ FAIL ] :: iptables should not contain this rule (Expected 1, got 0) :: [ BEGIN ] :: iptables should not contain this rule (sanity) :: actually running 'iptables-save | grep 192.168.2.9' :: [ PASS ] :: iptables should not contain this rule (sanity) (Expected 1, got 1) :: [ BEGIN ] :: firewall-cmd :: actually running 'firewall-cmd --add-rich-rule='rule family='ipv4' source address='192.168.2.9' accept' --timeout=-10' Error: INVALID_VALUE: timeout '-10' is not positive number :: [ PASS ] :: firewall-cmd (Expected 114, got 114) :: [ BEGIN ] :: iptables should not contain this rule :: actually running 'iptables-save | grep 192.168.2.9' -A IN_public_allow -s 192.168.2.9/32 -j ACCEPT :: [ FAIL ] :: iptables should not contain this rule (Expected 1, got 0)
aha, thanks, try again please https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=b4e3248a0a1e05433512fd3f1e5b1740391d7da5
Thanks. This looks better :) Verified and works correctly for every command
firewalld-0.3.11-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/firewalld-0.3.11-1.fc20
firewalld-0.3.11-1.fc20 works
Package firewalld-0.3.11-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing firewalld-0.3.11-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-9609/firewalld-0.3.11-1.fc20 then log in and leave karma (feedback).
Package firewalld-0.3.11-2.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing firewalld-0.3.11-2.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-9609/firewalld-0.3.11-2.fc20 then log in and leave karma (feedback).
Package firewalld-0.3.11-3.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing firewalld-0.3.11-3.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-9609/firewalld-0.3.11-3.fc20 then log in and leave karma (feedback).
firewalld-0.3.11-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.