Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: In cockpit firewall-zone differs from command line Version-Release number of selected component (if applicable): cockpit-212-1.fc31 and lower. How reproducible: Fresh install of Fedora 31 Server installation, not minimal system. Default firewall zone is FedoraServer but in cockpit it is Public. Steps to Reproduce: 1. Login in Cockpit -> Network -> Firewall shows zone "public" 2. Login in cli and write firewalld-cmd --get-default-zone shows FedoraServer 3. Settings made in zone FedoraServer mismatches settings in Cockpit zone public Actual results: Mismatched Expected results: Matched Additional info:
The cockpit firewalld page shows the zone's "short" name. The short name of the FedoraServer zone is actually "Public", so what cockpit is showing is the FedoraServer zone. Of course firewalld has a "Public" zone builtin as well, which makes this confusing. Maybe it's worth it to start including the zone id in the name shown on the firewall page as well. But I cannot reproduce the mismatch. Now any service added to the FedoraServer zone should of course show up on the cockpit page under the "Public" zone. When I add a zone to the FedoraServer zone using firewall-cmd, it does show up under Public on the cockpit page.
Okay I get it with the zones. This is indeed kind of confusing. Cockpit shouldn't show the short name of firewalld zones. I guess I wrote wrong about the firewall mismatch. I mean the services shows up correctly but no ports are showing, activated by firewalld-cmd command. firewall-cmd --list-all --zone=FedoraServer shows up both services and ports. Services shows up equal in Cockpit too, but the ports are missing. I have some custom ports and 80, 443 activated by firewalld-cmd which aren't shown up in Cockpit. However, I can activate the services http and https in addition because I do not see which (custom)ports are activated by firewalld-cmd. Cockpit should figure out which port belongs to which service and should show up with name and port number. For instance: both ports 80, 443 should be shown up as http, https services with theirs ports in Cockpit like the same way as when I would activate http, https service in Cockpit. But they do not show up. Both services showing up by name and port number when activated in Cockpit. Custom port should shows up labeled like the same way firewalld-cmd does, when custom port activates in Cockpit.
We'll for sure do something about the naming. And indeed the ports is also a bug. When cockpit adds a custom port it defines a service, I didn't realize a zone could also have a port attached to it directly.
https://github.com/cockpit-project/cockpit/pull/13669
The second PR for showing "direct ports" now landed in master as well. Will be part of release 215 on Wednesday.
FEDORA-2020-a63046430d has been submitted as an update to Fedora 32. https://bodhi.fedoraproject.org/updates/FEDORA-2020-a63046430d
FEDORA-2020-6f3212b6fa has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2020-6f3212b6fa
cockpit-215-1.fc32 has been pushed to the Fedora 32 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-a63046430d
cockpit-215-1.fc31 has been pushed to the Fedora 31 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-6f3212b6fa
Aaah you guys are amazing :D I just testing cockpit-215-1.fc31 and now FedoraServer zone shows up as well as my custom ports / additional ports. Thanks again for changing that Best regards, Woti
@Woti, great to hear, thanks for testing! Do you mind +1'ing https://bodhi.fedoraproject.org/updates/FEDORA-2020-6f3212b6fa then?
It was not easy to sign up to give +1 but I got it :)
cockpit-215-1.fc31 has been pushed to the Fedora 31 stable repository. If problems still persist, please make note of it in this bug report.
FEDORA-2020-a63046430d has been pushed to the Fedora 32 stable repository. If problem still persists, please make note of it in this bug report.
I came across a small design fault. Using Cockpit in english language, the zones are displayed by their names. But changing to another language, Cockpit is just displaying "Add zones" in the giving language. How to test: Login into Cockpit. Select "Networking" and click on "Firewall". Cockpit is displaying FedoraServer zone and in my case libvirt zone. Now, click on your username in the top right corner and select "Display language". Choose a language for instance German or Swedish and click on "Select". Cockpit is reloading but the zone names has disappered. Instead, "Zonen hinzufügen" for German or "Läg till zon" for Swedish is displayed. I have not tried the other languages but I think it applies to all languages except English. Best regards, Woti
Thanks for the report. It is not broken in the code, other languages are fine. It is `fuzzy` translation: #: pkg/networkmanager/firewall.jsx:169 #, fuzzy #| msgid "Add zone" msgid "$0 zone" msgstr "Zone hinzufügen" But we should not be using fuzzy translations, so there must be some other problem somewhere. I'll take this upstream to track this properly. https://github.com/cockpit-project/cockpit/issues/13815
@Woti: The fix landed upstream now, so this Wednesday's release 216 will have this fixed. Thanks for the report!
Hei, just updated to 216 today and yes your fix works :)