10:44 a.m.
Hi,
# firewall-cmd --version
0.3.3
<Runtime Configuration>
# firewall-cmd --list-rich-rules
# firewall-cmd --add-rich-rule='rule forward-port port="2222"
to-port="22" to-addr="192.168.100.2" protocol="tcp"
family="ipv4" source
address="192.168.2.100"'
# firewall-cmd --list-rich-rules
rule family="ipv4" source address="192.168.2.100" forward-port
port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
# firewall-cmd --remove-rich-rule='rule forward-port port="2222"
to-port="22" to-addr="192.168.100.2" protocol="tcp"
family="ipv4" source
address="192.168.2.100"'
# firewall-cmd --list-rich-rules
# firewall-cmd --add-rich-rule='rule forward-port port="2222"
to-port="22" to-addr="192.168.100.2" protocol="tcp"
family="ipv4" source
address="192.168.2.100"'
# firewall-cmd --list-rich-rules
rule family="ipv4" source address="192.168.2.100" forward-port
port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
# firewall-cmd --reload
# firewall-cmd --list-rich-rules
<\Runtime Configuration>
Runtime Configuration - OK.
<Permanent Configuration>
# firewall-cmd --list-rich-rules
# firewall-cmd --permanent --add-rich-rule='rule forward-port
port="2222" to-port="22" to-addr="192.168.100.2"
protocol="tcp"
family="ipv4" source address="192.168.2.100"'
# firewall-cmd --list-rich-rules
# firewall-cmd --reload
# firewall-cmd --list-rich-rules
rule family="ipv4" source address="192.168.2.100" forward-port
port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
# firewall-cmd --permanent --remove-rich-rule='rule forward-port
port="2222" to-port="22" to-addr="192.168.100.2"
protocol="tcp"
family="ipv4" source address="192.168.2.100"'
# firewall-cmd --list-rich-rules
rule family="ipv4" source address="192.168.2.100" forward-port
port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
# firewall-cmd --reload
# firewall-cmd --list-rich-rules
rule family="ipv4" source address="192.168.2.100" forward-port
port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
# /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
…
<rule family="ipv4">
<source address="192.168.2.100"/>
<forward-port to-addr="192.168.100.2" to-port="22"
protocol="tcp"
port="2222"/>
</rule>
</zone>
# Oops! It's still here. :)
<\Permanent Configuration>
Permanent Configuration - Is it a bug or a feature?
poma
12:27 p.m.
On 07/26/2013 05:44 PM, poma wrote:
# firewall-cmd --permanent --add-rich-rule='rule forward-port
port="2222" to-port="22" to-addr="192.168.100.2"
protocol="tcp" family="ipv4" source
address="192.168.2.100"'
# firewall-cmd --permanent --list-rich-rules
rule family="ipv4" source address="192.168.2.100" forward-port
port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
The thing is that when firewalld adds a rich rule, this string rule is
parsed and its representation is created in firewalld.
Then when we want to list rich rules, the internal representation of
rule is exported into string - but this string can be different from the
one that was previously passed to --add-rich-rule. That's all right,
because their meaning is the same, they just may have different order of
elements.
# firewall-cmd --permanent --remove-rich-rule='rule forward-port
port="2222" to-port="22" to-addr="192.168.100.2"
protocol="tcp" family="ipv4" source
address="192.168.2.100"'
Problem is that when we remove or query rich-rule, in
FirewallClientConfigZoneSettings() we compare this not yet
parsed&exported string with already parsed&exported string and I said
above the string may be different even their meaning is the same. And in
this case the rule is not removed (or query fails).
I think in FirewallClientConfigZoneSettings() in
{add|remove|query}RichRule() we need to first pass the input string
through the parser&"exporter" before we can compare the string-only
rich-rules.
--
Jiri
2:44 p.m.
On 26.07.2013 19:27, Jiri Popelka wrote:
On 07/26/2013 05:44 PM, poma wrote:
> # firewall-cmd --permanent --add-rich-rule='rule forward-port
> port="2222" to-port="22" to-addr="192.168.100.2"
protocol="tcp"
> family="ipv4" source address="192.168.2.100"'
> # firewall-cmd --permanent --list-rich-rules
> rule family="ipv4" source address="192.168.2.100" forward-port
> port="2222" protocol="tcp" to-port="22"
to-addr="192.168.100.2"
The thing is that when firewalld adds a rich rule, this string rule is
parsed and its representation is created in firewalld.
Then when we want to list rich rules, the internal representation of
rule is exported into string - but this string can be different from the
one that was previously passed to --add-rich-rule. That's all right,
because their meaning is the same, they just may have different order of
elements.
> # firewall-cmd --permanent --remove-rich-rule='rule forward-port
> port="2222" to-port="22" to-addr="192.168.100.2"
protocol="tcp"
> family="ipv4" source address="192.168.2.100"'
Problem is that when we remove or query rich-rule, in
FirewallClientConfigZoneSettings() we compare this not yet
parsed&exported string with already parsed&exported string and I said
above the string may be different even their meaning is the same. And in
this case the rule is not removed (or query fails).
I think in FirewallClientConfigZoneSettings() in
{add|remove|query}RichRule() we need to first pass the input string
through the parser&"exporter" before we can compare the string-only
rich-rules.
--
Jiri
OK, thanks for the further clarification.
poma
11:44 a.m.
On 07/26/2013 07:27 PM, Jiri Popelka wrote:
I think in FirewallClientConfigZoneSettings() in
{add|remove|query}RichRule() we need to first pass the input string
through the parser&"exporter" before we can compare the string-only
rich-rules.
I've just fixed it upstream
https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=2c82c4a8df7852...
--
Jiri
1:16 p.m.
On 09.10.2013 18:44, Jiri Popelka wrote:
On 07/26/2013 07:27 PM, Jiri Popelka wrote:
> I think in FirewallClientConfigZoneSettings() in
> {add|remove|query}RichRule() we need to first pass the input string
> through the parser&"exporter" before we can compare the string-only
> rich-rules.
I've just fixed it upstream
https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=2c82c4a8df7852...
I haven't tested this yet, but I have confidence in you.
Thank you very much.
Bee awesome.:!
poma
3796
days inactive
3921
days old
firewalld-devel@lists.fedorahosted.org
5 comments
2 participants
participants (2)
-
Jiri Popelka -
poma