- firewalld-devel - Fedora mailing-lists

Fedora repository with testing firewalld builds
by Jiri Popelka 01 Apr '14

01 Apr '14

It's been 2 months since 0.3.9.3 release, so I think it's time for another one. Given that 0.3.9 wasn't quite a success - it introduced some regressions which have been fixed with follow-up 0.3.9.x releases - I've been thinking about how can we improve this and the first idea is doing a release-candidates (or whatever you call it). If you're interested in testing and you use Fedora, then it's piece of cake, just grab one of .repo files from https://copr.fedoraproject.org/coprs/jpopelka/FirewallD/ copy it into /etc/yum.repos.d/ and run 'yum update'. Yum will offer you to update to build of snapshot of upstream git repository. I'll be glad for any response, thanks ! -- Jiri

1 0

Patches for minor documentation fixes
by Jon Jensen 26 Mar '14

26 Mar '14

I was just taking a first look at firewalld in RHEL 7 beta and found a few minor typos etc. that I figured I could send fixes for in the attached patches, for what it's worth. Thanks, Jon -- Jon Jensen End Point Corporation http://www.endpoint.com/

2 3

firewalld 0.3.9.3
by Jiri Popelka 05 Feb '14

05 Feb '14

Hi, here's 0.3.9.3 https://fedorahosted.org/released/firewalld/firewalld-0.3.9.3.tar.bz2 sha1sum: d9ad8d9fc335e691a7deeb4be7346b5956ef7650 It fixes two more regressions introduced with 0.3.9: - broken persistent port forwarding (RHBZ#1056154) - not allowing Router Advertisements with IPv6_rpfilter (RHBZ#1058505) one regression introduced with 0.3.4: - default zone rules being applied to all zones (RHBZ#1057875) and some more bug-fixes, like RHBZ#1055190 Hopefully we'll be more lucky with future releases than we were with 0.3.9 (which introduced some regressions). -- Jiri

1 0

firewalld 0.3.9.2
by Jiri Popelka 17 Jan '14

17 Jan '14

And here follows 0.3.9.2, which fixes one regression (RHBZ#1053932) introduced in 0.3.9. https://fedorahosted.org/released/firewalld/firewalld-0.3.9.2.tar.bz2 sha1sum: 3ec457ca224a768e5cee3def20817026f254256c -- Jiri

1 0

firewalld 0.3.9.1
by Jiri Popelka 16 Jan '14

16 Jan '14

Hi all, we've just released firewalld-0.3.9.1 https://fedorahosted.org/released/firewalld/firewalld-0.3.9.1.tar.bz2 sha1sum: ca94c91b1c3a90e4f7cbf2732c36aa41257af53a changes since 0.3.8: - translation updates - New IPv6_rpfilter setting to enable source address validation (RHBZ#847707) - Do not mix original and customized zones in case of target changes, apply only used zones - firewall-cmd: fix --*_lockdown_whitelist_uid to work with uid 0 - Don't show main window maximized. (RHBZ#1046811) - Use rmmod instead of 'modprobe -r' (RHBZ#1031102) - Deprecate 'enabled' attribute of 'masquerade' element - firewall-config: new zone was added twice to the list - firewalld.dbus(5) - Enable python shebang fix again - firewall/client: handle_exceptions: Use loop in decorator - firewall-offline-cmd: Do not mask firewalld service with disabled option - firewall-config: richRuleDialogActionRejectType Entry -> ComboBox - Rich_Rule: fix parsing of reject element (RHBZ#1027373) - Show combined zones in permanent configuration (RHBZ#1002016) - firewall-cmd(1): document exit code 2 and colored output (RHBZ#1028507) - firewall-config: fix RHBZ#1028853 -- Jiri

1 0

firewall-cmd hang if remove or query a 'non-exist' service
by Eli Qiao 09 Jan '14

09 Jan '14

hi all I hit a issue when I use firewall-cmd to query or remove a non-exist service it should be report no service immediately or give a timeout window by default. qiao@ubuntu:~/kimchi$ dpkg -l | grep firewalld ii firewalld 0.3.0-1 all dynamically managed firewall with support for network zones qiao@ubuntu:~/kimchi$ sudo service firewalld start * Starting dynamic firewall daemon firewalld [ OK ] qiao@ubuntu:~/kimchi$ dpkg -l | grep firewalld^C qiao@ubuntu:~/kimchi$ firewall-cmd --list-services dhcpv6-client ssh qiao@ubuntu:~/kimchi$ sudo firewall-cmd --remove-service kimchid [ hang ....] -- Thanks Eli (Li Yong) Qiao (qiaoly(a)cn.ibm.com) CSTL-KVM Frobisher/RHEV-H

2 2

firewall-cmd - rich-rule - permanent configuration
by poma 28 Nov '13

28 Nov '13

Hi, # firewall-cmd --version 0.3.3 <Runtime Configuration> # firewall-cmd --list-rich-rules # firewall-cmd --add-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"' # firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.2.100" forward-port port="2222" protocol="tcp" to-port="22" to-addr="192.168.100.2" # firewall-cmd --remove-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"' # firewall-cmd --list-rich-rules # firewall-cmd --add-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"' # firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.2.100" forward-port port="2222" protocol="tcp" to-port="22" to-addr="192.168.100.2" # firewall-cmd --reload # firewall-cmd --list-rich-rules <\Runtime Configuration> Runtime Configuration - OK. <Permanent Configuration> # firewall-cmd --list-rich-rules # firewall-cmd --permanent --add-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"' # firewall-cmd --list-rich-rules # firewall-cmd --reload # firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.2.100" forward-port port="2222" protocol="tcp" to-port="22" to-addr="192.168.100.2" # firewall-cmd --permanent --remove-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"' # firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.2.100" forward-port port="2222" protocol="tcp" to-port="22" to-addr="192.168.100.2" # firewall-cmd --reload # firewall-cmd --list-rich-rules rule family="ipv4" source address="192.168.2.100" forward-port port="2222" protocol="tcp" to-port="22" to-addr="192.168.100.2" # /etc/firewalld/zones/public.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> … <rule family="ipv4"> <source address="192.168.2.100"/> <forward-port to-addr="192.168.100.2" to-port="22" protocol="tcp" port="2222"/> </rule> </zone> # Oops! It's still here. :) <\Permanent Configuration> Permanent Configuration - Is it a bug or a feature? poma

2 5

firewalld 0.3.8
by Jiri Popelka 05 Nov '13

05 Nov '13

Hi, https://fedorahosted.org/released/firewalld/firewalld-0.3.8.tar.bz2 sha1sum: b67642886fefe0549b227d6e5f2455008c129ccc Changelog: - Fixed memory leaks - New option --debug-gc - Python3 compatibility - Better non-ascii support - Several firewall-config & firewall-applet fixes - New --remove-rules commands for firewall-cmd and removeRules methods for D-Bus - Fixed FirewallDirect.get_rules to return proper list - Fixed LastUpdatedOrderedDict.keys() - Enable rich rule usage in trusted zone (RHBZ#994144) - New error codes: INVALID_CONTEXT, INVALID_COMMAND, INVALID_USER and INVALID_UID -- Jiri

1 0

0.3.7 has just been released
by Jiri Popelka 17 Oct '13

17 Oct '13

Hi all, https://fedorahosted.org/released/firewalld/firewalld-0.3.7.tar.bz2 Changelog says: - updated translations - Don't fail on missing ip[6]tables/ebtables table. (RHBZ#967376) - bash-completion: --permanent --direct options - firewall/core/fw.py: fix checking for iptables & ip6tables (RHBZ#1017087) - firewall-cmd: use client's exception_handler instead of catching exceptions ourselves - FirewallClientZoneSettings: fix {add|remove|query}RichRule() - Extend amanda-client service with 10080/tcp (RHBZ#1016867) - Simplify Rich_Rule()_lexer() by using functions.splitArgs() - Fix encoding problems in exception handling (RHBZ#1015941) Enjoy. -- Jiri

1 0

[PATCH] Fix minor typo in message: permanet->permanent
by Yuri Chornoivan 03 Oct '13

03 Oct '13

Hi, Attached is a minor typo fix. Thanks for reviewing it. Best regards, Yuri P.S. It is sad to see that some developers give no time for translators to translate the released versions of their applications. ;)

2 1

firewalld-0.3.5
by Jiri Popelka 02 Oct '13

02 Oct '13

Hi all, exactly after 2 months after 0.3.4 we've released 0.3.5, which contains lots of bug-fixes. https://fedorahosted.org/released/firewalld/firewalld-0.3.5.tar.bz2 Enjoy ! -- Jiri

3 7

RFE: ability to specify the source port
by Sergio Villar Senin 18 Sep '13

18 Sep '13

Hi, I have recently started a discussion in firewalld-users: https://lists.fedorahosted.org/pipermail/firewalld-users/2013-September/000… and the outcome was that apparently there is no way in firewalld to specify the source port for a specific service, rule, etc... Everytime the documentation mentions <port> it always means the destination port (--dport in iptables). I was wondering if there are any plans to add some syntactic sugar to either firewalld-cmd or to the rich language to allow users to specify the source port (--sport in iptables). BR

2 1

[PATCH] Fix warning of deprecated MainLoop
by Christopher Meng 16 Sep '13

16 Sep '13

Hi, Today when I ran this program I found something noisy in the terminal: [rpmaker@fab Desktop]$ firewall-config firewall-config.py:813: PyGIDeprecationWarning: MainLoop is deprecated; use GLib.MainLoop instead self.mainloop = GObject.MainLoop() So I send this patch to you to solve this problem. Please take a look at the attachment area. Thank you. Yours sincerely, Christopher Meng Always playing in Fedora Project http://cicku.me

2 1

How to send patch?
by Christopher Meng 16 Sep '13

16 Sep '13

Hi, I have a patch for firewalld-config, very small. Can I fork the repo and send a pull request?(No howto?) Or send patch here? Thanks. Yours sincerely, Christopher Meng Always playing in Fedora Project http://cicku.me

2 1

Possibly useful NetworkManager script for dynamically determined zones
by Anders Blomdell 29 Aug '13

29 Aug '13

First: Thanks for a nice and firewall! In addition to the changes to combined zone handling in https://bugzilla.redhat.com/show_bug.cgi?id=1002016, I would like to share the attached NetworkManager script which I have found useful. Best regards Anders -- Anders Blomdell Email: anders.blomdell(a)control.lth.se Department of Automatic Control Lund University Phone: +46 46 222 4625 P.O. Box 118 Fax: +46 46 138118 SE-221 00 Lund, Sweden

1 1

Possibly useful NetworkManager script for dynamically determined zones
by Anders Blomdell 29 Aug '13

29 Aug '13

First: Thanks for a nice and firewall! In addition to the changes to combined zone handling in https://bugzilla.redhat.com/show_bug.cgi?id=1002016, I would like to share the attached NetworkManager script which I have found useful. Best regards Anders -- Anders Blomdell Email: anders.blomdell(a)control.lth.se Department of Automatic Control Lund University Phone: +46 46 222 4625 P.O. Box 118 Fax: +46 46 138118 SE-221 00 Lund, Sweden

1 0

D-BUS documentation, where it is?
by Víctor R. Escobar 16 Aug '13

16 Aug '13

Hello everybody, I am getting started with firewalld and I've read most of the documententation which was user oriented. Right now I am looking for the D-BUS interface and somewhere some kind of API documentation or other online resource about how to deal with the firewall via D-BUS. Could someone tell me how to find it? I've really googled for it and had no results. Additionally "man 5 firewalld.dbus" isn't avialable on my local fedora, either on several internet pages which have broken links :( Example of broken link: http://linuxmanpages.net/manpages/fedora19/man5/firewalld.dbus.5.html Thank you in advance! Víctor R. Escobar

1 1

[PATCH] Fix minor typos in docs and messages
by Yuri Chornoivan 02 Aug '13

02 Aug '13

Hi, Attached is a patch with fixes of minor typos in firewalld docs and messages. Many thanks for reviewing it. Best regards, Yuri

2 1

New firewalld version 0.3.4
by Thomas Woerner 30 Jul '13

30 Jul '13

The new firewalld version 0.3.4 is available at https://fedorahosted.org/released/firewalld/ Major changes: - Provides enhanced firewall-config with lockdown and rich rule support - New man pages (created from docbook sources) - A first version of permanent direct rules (/etc/firewalld/direct.xml, but without command line and firewall-config support) - firewall-applet is now better working with gnome3 - Better python3 support - Bug fixes and enhancements - New services Changelog for version 0.3.4: - firewall-cmd: print result (yes/no) of all --query-* commands - move permanent-getZoneOf{Interface|Source} from firewall-cmd to server - Check Interfaces/sources when updating permanent zone settings. - FirewallDConfig: getZoneOfInterface/Source can actually return more zones - Fixed toaddr check in forward port to only allow single address, no range - firewall-cmd: various output improvements - fw_zone: use check_single_address from firewall.functions - getZoneOfInterface/Source does not need to throw exception - firewall.functions: Use socket.inet_pton in checkIP, fixed checkIP*nMask - firewall.core.io.service: Properly check port/proto and destination address - Install applet desktop file into /etc/xdg/autostart - Fixed option problem with rich rule destinations (RHBZ#979804) - Better exception creation in dbus_handle_exceptions() decorator (RHBZ#979790) - Updated firewall-offline-cmd - Use priority in add, remove, query and list of direct rules (RHBZ#979509) - New documentation (man pages are created from docbook sources) - firewall/core/io/direct.py: use prirority for rule methods, new get_all_ methods - direct: pass priority also to client.py and firewall-cmd - applet: New blink and blink-count settings - firewall.functions: New function ppid_of_pid - applet: Check for gnome3 and fix it, use new settings, new size-changed cb - firewall-offline-cmd: Fix use of systemctl in chroot - firewall-config: use string.ascii_letters instead of string.letters - dbus_to_python(): handle non-ascii chars in dbus.String. - Modernize old syntax constructions. - dict.keys() in Python 3 returns a "view" instead of list - Use gettext.install() to install _() in builtins namespace. - Allow non-ascii chars in 'short' and 'description' - README: More information for "Working With The Source Repository" - Build environment fixes - firewalld.spec: Added missing checks for rhel > 6 for pygobject3-base - firewall-applet: New setting show-inactive - Don't stop on reload when lockdown already enabled (RHBZ#987403) - firewall-cmd: --lockdown-on/off did not touch firewalld.conf - FirewallApplet.gschema.xml: Dropped unused sender-info setting - doc/firewall-applet.xml: Added information about gsettings - several debug and log message fixes - Add chain for sources so they can be checked before interfaces (RHBZ#903222) - Add dhcp and proxy-dhcp services (RHBZ#986947) - io/Zone(): don't error on deprecated family attr of source elem - Limit length of zone file name (to 12 chars) due to Netfilter internals. - It was not possible to overload a zone with defined source(s). - DEFAULT_ZONE_TARGET: {chain}_ZONE_{zone} -> {chain}_{zone} - New runtime get<X>Settings for services and icmptypes, fixed policies callbacks - functions: New functions checkUser, checkUid and checkCommand - src/firewall/client: Fixed lockdown-whitelist-updated signal handling - firewall-cmd(1): move firewalld.richlanguage(5) reference in --*-rich-rule - Rich rule service: Only add modules for accept action - firewall/core/rich: Several fixes and enhanced checks - Fixed reload of direct rules - firewall/client: New functions to set and get the exception handler - firewall-config: New and enhanced UI to handle lockdown and rich rules - zone's immutable attribute is redundant - Do not allow to set settings in config for immutable zones. - Ignore deprecated 'immutable' attribute in zone files. - Eviscerate 'immutable' completely. - FirewallDirect.query_rule(): fix it - permanent direct: activate firewall.core.io.direct:Direct reader - core/io/*: simplify getting of character data - FirewallDirect.set_config(): allow reloading

1 0

fedoraproject.org wiki - FirewalldRichLanguage
by poma 29 Jul '13

29 Jul '13

Hi, On https://fedoraproject.org/wiki/Features/FirewalldRichLanguage there are two[1] instances of 'to-address="<address>"' under the "Forward-Port" sections, should probably be in abbreviated form - 'to-addr="<address>"'. poma [1] https://fedoraproject.org/wiki/Features/FirewalldRichLanguage#Forward-Port https://fedoraproject.org/wiki/Features/FirewalldRichLanguage#Forward-Port_2

2 1

firewall-cmd - list-rich-rules - bash-completion & man
by poma 26 Jul '13

26 Jul '13

Hi, # rpm -q firewalld firewalld-0.3.3-2.fc19.noarch # grep -- --list-rich-rules /usr/share/bash-completion/completions/firewall-cmd # zgrep -- --list-rich-rules /usr/share/man/man1/firewall-cmd.1.gz Is this option belongs there? poma

2 2

[PATCH] ms-wbt-service
by Adam 22 Apr '13

22 Apr '13

https://bugzilla.redhat.com/show_bug.cgi?id=914859

1 0

[PATCH] Postgresql Service
by Adam 22 Apr '13

22 Apr '13

https://bugzilla.redhat.com/show_bug.cgi?id=914859

1 0

[PATCH] Mysql Service
by Adam 22 Apr '13

22 Apr '13

https://bugzilla.redhat.com/show_bug.cgi?id=914859

1 0

[PATCH] Services for FreeIPA
by Adam Young 22 Apr '13

22 Apr '13

https://bugzilla.redhat.com/show_bug.cgi?id=914859 Text is from Wikipedia.

1 0

a few issues with firewalld 0.3.0
by Michael Biebl 26 Mar '13

26 Mar '13

Hi, while looking at 0.3.0 [0], I noticed a few issues. If you prefer this to be reported via a bug tracker, just let me know: 1/ config/systemd.service: - uses hard-coded paths, should use @bindir@ which are substituted dynamically. - uses a fedora specific sysconfig config file. systemd upstream clearly recommends *not* to use it. - uses deprecated dbus.target and syslog.target. Those no longer exist or are useful, so should be dropped. 2/ shell-completion/firewall-cmd-bash-completion.sh - please install that file in /usr/share/bash-completion/completions - name the file after the binary, this way bash-completion will load it on demand - see [2] as a reference for how to implement that. Cheers, Michael [0] https://fedorahosted.org/released/firewalld/firewalld-0.3.0.tar.bz2 [1] http://0pointer.de/blog/projects/on-etc-sysinit.html [2] http://cgit.freedesktop.org/systemd/systemd/commit/?id=d611dadcc74db10ba533… -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?

2 2

firewalld keeps file descriptors open when forking
by Michael Biebl 07 Mar '13

07 Mar '13

Hi, I noticed that firewalld keeps the stdin/stdout/stderror file descriptors open when forking. The recommended way for daemons is to redirect those to /dev/null and close all others. See [1] Section "SysV Daemons, 1. + 9. This is important when running firewalld in non-systemd environments. [2] has some example code for python. Unfortunately I'm not much of a python hacker myself. Michael [1] http://0pointer.de/public/systemd-man/daemon.html [2] http://code.activestate.com/recipes/278731-creating-a-daemon-the-python-way/ -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?

3 5

Distinguishing between Internal and external wired networks
by Colin Simpson 06 Mar '13

06 Mar '13

I'm reposting this to firewalld-devel as I'm not getting much traction on firewalld-users, and maybe to be honest this is more in the line of a possible enhancement for say AD connected or FreeIPA connected systems. Thoughts? Thanks Colin ==== Hi We are looking at firewalld just now for deployment in our environment. One situation we have is that the Ethernet wired interface is set to simply DHCP. This is used by users on our network and on public network. Obviously we'd like to allow more ports open on our network than on a public network. Our network would be zone "internal" and if not our network would be zone "public", I'd guess. The option of setting up two different wired setups won't work as users cannot be relied on to switch to a public setting when off internal network. Is there any way we can get firewalld to detect which type of network it's on. This is probably analogous, I guess, to the way the windows firewall has a "Domain networks" zone (which they auto detect). Or a way we can give firewalld a helper script that can tell it which network it's on. Or something else we haven't thought of... At the moment we tackle this with using a custom NM dispatcher script that detects our internal network (by doing an operations against internal KDC's) and loading the correct firewall into iptables based on this testing. So maybe this is the way, if firewalld is happy to allow us, can we or should we force a zone from a dispatcher.d NM script to switch to the correct zone. A similar issue is we have a commercial VPN solution that doesn't work through Network Manager, can we force a change to the zone (it can be made to execute a script on connection) when the VPN comes up (the VPN changes routing so all traffic goes via the VPN interface). How do others tackle this? Thanks Colin ________________________________ This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If you are not the original recipient or the person responsible for delivering the email to the intended recipient, be advised that you have received this email in error, and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please immediately notify the sender and delete the original.

2 1

[PATCH] Increase the maximum length of the port forwarding fields from 5 to 11.
by Luke Macken 11 Feb '13

11 Feb '13

This allows forwarding high port ranges, like 10000-12345. diff --git a/src/firewall-config.glade b/src/firewall-config.glade index c1bc7d2..ec8681e 100755 --- a/src/firewall-config.glade +++ b/src/firewall-config.glade @@ -518,7 +518,7 @@ <object class="GtkEntry" id="forwardDialogPortEntry"> <property name="visible">True</property> <property name="can_focus">True</property> - <property name="max_length">5</property> + <property name="max_length">11</property> <property name="invisible_char">●</property> <property name="width_chars">5</property> <signal name="changed" handler="onForwardChanged" swapped="no"/> @@ -579,7 +579,7 @@ <object class="GtkEntry" id="forwardDialogToPortEntry"> <property name="visible">True</property> <property name="can_focus">True</property> - <property name="max_length">5</property> + <property name="max_length">11</property> <property name="invisible_char">●</property> <property name="width_chars">5</property> <signal name="changed" handler="onForwardChanged" swapped="no"/> -- 1.8.1.2

2 1

[PATCH v2 0/4] Build system cleanups
by Doug Goldstein 14 Jan '13

14 Jan '13

The following patch series allows you to build a working tarball with 'make dist' and not have to rerun the autogen.sh script to build it. It also updates .gitignore when you're working that it ignores the files built up in the process of running make. Change from v2: - Fix debug echo left for the systemd service - Fix icon installation Doug Goldstein (4): Reorganize .gitignore while adding entries build: enable builds to work from the tarball Fix make distcheck Fix categories for .desktop entries to be valid .gitignore | 31 +++++++++---- Makefile.am | 3 +- autogen.sh | 4 -- config/Makefile.am | 58 +++++++++++++----------- config/firewall-applet.desktop.in | 2 +- config/firewall-config.desktop.in | 2 +- po/POTFILES.in | 89 +++++++++++++++++++++++++++++++++++++ po/POTFILES.in.in | 16 ------- src/Makefile.am | 31 +++++-------- 9 files changed, 158 insertions(+), 78 deletions(-) create mode 100644 po/POTFILES.in delete mode 100644 po/POTFILES.in.in -- 1.7.8.6

4 13

[PATCH 0/4] Build system cleanups
by Doug Goldstein 05 Nov '12

05 Nov '12

The following patch series allows you to build a working tarball with 'make dist' and not have to rerun the autogen.sh script to build it. It also updates .gitignore when you're working that it ignores the files built up in the process of running make. Doug Goldstein (4): Reorganize .gitignore while adding entries build: enable builds to work from the tarball Fix make distcheck Fix categories for .desktop entries to be valid .gitignore | 31 +++++++++---- Makefile.am | 3 +- autogen.sh | 4 -- config/Makefile.am | 58 +++++++++++++----------- config/firewall-applet.desktop.in | 2 +- config/firewall-config.desktop.in | 2 +- po/POTFILES.in | 89 +++++++++++++++++++++++++++++++++++++ po/POTFILES.in.in | 16 ------- src/Makefile.am | 31 +++++-------- 9 files changed, 158 insertions(+), 78 deletions(-) create mode 100644 po/POTFILES.in delete mode 100644 po/POTFILES.in.in -- 1.7.8.6

3 7

Can FirewallD do these things I used to do in IPtables?
by David Andrew Michael Noelle 21 Sep '12

21 Sep '12

We have a customized hack of an old firewall-2.4-stronger script we've been using and hacking more features into for years, and I'd still be using it if Fedora hadn't moved to systemd. I can't seem to get it to run /after/ the interfaces are all up so it can determine their IPs as assigned by dhclient. And dhclient won't run the script with its up-hooks, either. Maybe there's a way to get that to work, but if I'm going to be reworking this anyway, I thought I may as well move to The New Firewall System. And now I can't figure out how to do all our little tricks in FirewallD. Maybe I'm missing something, maybe it's just not documented, or maybe it just doesn't work that way. Hopefully you can tell me if there's a way to do all these things or I should go back to the systemd/dhclient/iptables puzzle. There are four interfaces. They used to be eth0-eth3, but NetworkManager has new names for them now. I'll just call them by their meanings/zones: External, Internal, DMZ, and Printers. - No traffic of any sort is allowed between Internal and DMZ or between Printers and External. - Internal and DMZ can both print to and receive status replies from Printers and access the internet through External. - There is a long list of Internal-> External exceptions, blocked IPs that cannot be accessed by some or all Internal IPs, mostly social media sites that are not work-related. This is predominantly http, but the destination and source addresses are the more relevant part. - DMZ->External doesn't discriminate against IPs, but cannot make any outgoing connections on port 25 or any of a list of known file sharing service ports, and other ports may need to be shut down from time to time. - It would be nice if things like outgoing passive-mode FTP could be toggled for DMZ, but that's an enhancement, not a requirement. - Many specific External incoming ports are forwarded to various Internal addresses. Often on different ports than they came in on. Sometimes PPTP and incoming FTP. both passive and active, are required. - ICMP, portscan, and syn-flood limiting on all interfaces with different limits. So... can FirewallD do all that, or something functionally equivalent? If so, how? If not, will it be able to in the near future? -- -Dave Noelle, dave(a)Straylight.org

1 0

First version of libvirt firewalld patch
by Thomas Woerner 15 Mar '12

15 Mar '12

Hello, here is the first version of the firewalld patch for nwfilter. "firewall-cmd --direct --passthrough {ipv4|ipv6|eb} args" is used as a replacement for iptables, ip6tables and ebtables. The rules are passed through to netfilter without processing and saving them. This means that the rules are gone if firewalld will be reloaded or restarted. Therefore I'd like to add automatic firewalld activation, deactivation and reactivation detection (using a dbus watch) in case of firewalld start, stop and restart/reload. Thomas

1 0

[PATCH] removeInterface() shouldn't require zone to be specified
by Jiri Popelka 11 Mar '12

11 Mar '12

see attached patch -- Jiri

1 1

[PATCH] firewall-cmd: --list=all
by Jiri Popelka 07 Mar '12

07 Mar '12

examples: (list all info about zone "home") firewall-cmd --zone=home --list=all (list all info about default zone) firewall-cmd --list=all --- TODO | 1 - src/firewall-cmd | 23 +++++++++++++++++++++-- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/TODO b/TODO index ad00efd..4280f15 100644 --- a/TODO +++ b/TODO @@ -1,3 +1,2 @@ -- firewall-cmd --list --zone=home - add documentation about all config files - add man pages diff --git a/src/firewall-cmd b/src/firewall-cmd index d7b1951..0aff6ed 100755 --- a/src/firewall-cmd +++ b/src/firewall-cmd @@ -51,7 +51,7 @@ def usage(): --enable [--timeout=<seconds>] <masquerade> --disable <masquerade> --query <action> | <masquerade> - --list=<action> + --list=<action> | all Action: --service=<service> --port=<port>[-<port>]/<protocol> @@ -330,7 +330,7 @@ try: elif mode == "query": sys.exit(not fw.queryForwardPort(zone, port, protocol, toport, toaddr)) - + # block icmp elif action == "icmp-block": if mode == "list": @@ -345,6 +345,25 @@ try: elif mode == "query": sys.exit(not fw.queryIcmpBlock(zone, value)) + elif (action == "all"): + if mode == "list": + print("zone: " + (zone if zone != "" else fw.getDefaultZone())) + l = fw.getInterfaces(zone) + if len(l) > 0: + print("interfaces: " + ", ".join(l)) + l = fw.getServices(zone) + if len(l) > 0: + print("services: " + ", ".join(l)) + l = fw.getPorts(zone) + if len(l) > 0: + print("ports: " + ", ".join(["%s/%s" % (port[0], port[1]) for port in l])) + l = fw.getForwardPorts(zone) + if len(l) > 0: + print("forward-ports: " + "\n".join(["port=%s:proto=%s:toport=%s:toaddr=%s" % (interface, port, protocol, toport, toaddr) for (port, protocol, toport, toaddr) in l])) + l = fw.getIcmpBlocks(zone) + if len(l) > 0: + print("icmp-blocks: " + ", ".join(l)) + except dbus.DBusException, e: if e._dbus_error_name == 'org.freedesktop.DBus.Error.ServiceUnknown': print("FirewallD is probably not running.") -- 1.7.7.6

2 1

[PATCH 1/2] add_interface() called with wrong number of parameters
by Jiri Popelka 05 Mar '12

05 Mar '12

In firewall/core/fw_zone.py we define add_interface as add_interface(zone, interface, timeout=0, sender=None) but we call it in server/firewalld.py:addInterface() as zone.add_interface(zone, interface, sender) which means that we pass the sender value into the timeout parameter. I'm not sure how this is supposed to work so this patch is just a suggestion. --- src/firewall/core/fw_zone.py | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py index 89593dc..71d62d4 100644 --- a/src/firewall/core/fw_zone.py +++ b/src/firewall/core/fw_zone.py @@ -294,7 +294,7 @@ class FirewallZone: if not enable: self.remove_chain(zone, table, chain) - def add_interface(self, zone, interface, timeout=0, sender=None): + def add_interface(self, zone, interface, sender=None): self._fw.check_panic() _zone = self._fw.check_zone(zone) _obj = self._zones[_zone] @@ -310,7 +310,7 @@ class FirewallZone: _obj.interfaces.append(interface) _obj.settings["interfaces"][interface_id] = \ - self.__gen_settings(timeout, sender) + self.__gen_settings(0, sender) return _zone -- 1.7.7.6

2 3

[PATCH] firewall-cmd: query mode returns reversed values
by Jiri Popelka 05 Mar '12

05 Mar '12

The query mode exits the program with exit status 1 when the query is true and with exit status 0 when the query is false. This should be reversed For example firewall-cmd --zone=work --query --service=ssh; echo $? returns 1 while it should return 0 because ssh service is enabled (by default) in 'work' zone. --- src/firewall-cmd | 16 ++++++++-------- 1 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/firewall-cmd b/src/firewall-cmd index 9163680..fb8ba80 100755 --- a/src/firewall-cmd +++ b/src/firewall-cmd @@ -225,7 +225,7 @@ try: elif mode == "disable": fw.disablePanicMode() elif mode == "query": - sy.exit(fw.queryPanicMode()) + sys.exit(not fw.queryPanicMode()) # zone elif action == "zone": @@ -247,7 +247,7 @@ try: elif mode == "remove": fw.removeInterface(zone, value) elif mode == "query": - sys.exit(fw.queryInterface(zone, value)) + sys.exit(not fw.queryInterface(zone, value)) # service elif action == "service": @@ -260,7 +260,7 @@ try: elif mode == "remove": fw.removeService(zone, value) elif mode == "query": - sys.exit(fw.queryService(zone, value)) + sys.exit(not fw.queryService(zone, value)) # port elif action == "port": @@ -279,7 +279,7 @@ try: elif mode == "remove": fw.removePort(zone, port, proto) elif mode == "query": - sys.exit(fw.queryPort(zone, port, proto)) + sys.exit(not fw.queryPort(zone, port, proto)) # masquerade elif action == "masquerade": @@ -288,7 +288,7 @@ try: elif mode == "disable": fw.disableMasquerade(zone) elif mode == "query": - sys.exit(fw.queryMasquerade(zone)) + sys.exit(not fw.queryMasquerade(zone)) # forward port elif action == "forward-port": @@ -328,8 +328,8 @@ try: elif mode == "remove": fw.removeForwardPort(zone, port, protocol, toport, toaddr) elif mode == "query": - sys.exit(fw.queryForwardPort(zone, port, protocol, toport, - toaddr)) + sys.exit(not fw.queryForwardPort(zone, port, protocol, + toport, toaddr)) # block icmp elif action == "icmp-block": @@ -343,7 +343,7 @@ try: elif mode == "remove": fw.removeIcmpBlock(zone, value) elif mode == "query": - sys.exit(fw.queryIcmpBlock(zone, value)) + sys.exit(not fw.queryIcmpBlock(zone, value)) except dbus.DBusException, e: if e._dbus_error_name == 'org.freedesktop.DBus.Error.ServiceUnknown': -- 1.7.7.6

2 1

[PATCH] firewall-cmd: fix usage()
by Jiri Popelka 28 Feb '12

28 Feb '12

I've been confused with the following: --add|--enable - this looks like they are synonyms which isn't true --remove|--disable - the same as previous --masquerade action can be used only with --enable|--disable|--query --- src/firewall-cmd | 15 +++++++++------ 1 files changed, 9 insertions(+), 6 deletions(-) diff --git a/src/firewall-cmd b/src/firewall-cmd index 174ff55..5759508 100755 --- a/src/firewall-cmd +++ b/src/firewall-cmd @@ -45,18 +45,21 @@ def usage(): --get-zone-of-interface=<interface> --zone=<zone> - Modes: - --add|--enable [--timeout=<seconds>] <action> - --remove|--disable <action> - --query <action> + Mode: + --add [--timeout=<seconds>] <action> + --remove <action> + --enable [--timeout=<seconds>] <masquerade> + --disable <masquerade> + --query <action> | <masquerade> --list=<action> - Actions: + Action: --service=<service> --port=<port>[-<port>]/<protocol> --interface=<interface> - --masquerade --forward-port=port=<port>:proto=<protocol>[:toport=<destinaton port>][:toaddr=<destination address>] --icmp-block=<icmp type> + Masquerade: + --masquerade """) try: -- 1.7.7.6

1 0

[PATCH 1/3] client.py: fix typo in getInterfaces()
by Jiri Popelka 28 Feb '12

28 Feb '12

--- src/firewall/client.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/firewall/client.py b/src/firewall/client.py index 4034e44..657e7b4 100644 --- a/src/firewall/client.py +++ b/src/firewall/client.py @@ -113,7 +113,7 @@ class FirewallClient(object): @slip.dbus.polkit.enable_proxy def getInterfaces(self, zone): - return dbu_to_python(self.fw_zone.getInterfaces(zone)) + return dbus_to_python(self.fw_zone.getInterfaces(zone)) @slip.dbus.polkit.enable_proxy def queryInterface(self, interface): -- 1.7.7.6

1 2

[PATCH] firewalld.service: do not fork
by Jiri Popelka 28 Feb '12

28 Feb '12

I've been thinking that systemd prefers services to not fork. --- config/firewalld.service | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/config/firewalld.service b/config/firewalld.service index 53b5bc3..e0a538e 100644 --- a/config/firewalld.service +++ b/config/firewalld.service @@ -5,9 +5,8 @@ Before=network.target Conflicts=iptables.service ip6tables.service ebtables.service [Service] -Type=forking EnvironmentFile=-/etc/sysconfig/firewalld -ExecStart=/usr/sbin/firewalld +ExecStart=/usr/sbin/firewalld --nofork ExecReload=/usr/bin/firewall-cmd --reload [Install] -- 1.7.7.6

1 0

[PATCH] firewall-cmd: fix bug in --list=port and --port action help message
by Jiri Popelka 28 Feb '12

28 Feb '12

--- src/firewall-cmd | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/firewall-cmd b/src/firewall-cmd index e60d6c3..1063060 100755 --- a/src/firewall-cmd +++ b/src/firewall-cmd @@ -53,7 +53,7 @@ def usage(): --list=interface lists interfaces of a zone Actions: --service=<service> - --port=<port>[-<port>]:<protocol> + --port=<port>[-<port>]/<protocol> --masquerade --forward-port=port=<port>:proto=<protocol>[:toport=<destinaton port>][:toaddr=<destination address>] --icmp-block=<icmp type> @@ -262,7 +262,7 @@ try: if mode == "list": l = fw.getPorts(zone) if len(l) > 0: - print(", ".join(["%s/%s" % port for port in l])) + print(", ".join(["%s/%s" % (port[0], port[1]) for port in l])) else: try: (port, proto) = value.split("/") -- 1.7.7.6

1 0

[PATCH] firewall-cmd: fix bug in --list=service
by Jiri Popelka 28 Feb '12

28 Feb '12

--- src/firewall-cmd | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/firewall-cmd b/src/firewall-cmd index 7e8bf21..e60d6c3 100755 --- a/src/firewall-cmd +++ b/src/firewall-cmd @@ -247,7 +247,7 @@ try: # service elif action == "service": if mode == "list": - l = z.getServices(zone) + l = fw.getServices(zone) if len(l) > 0: print(", ".join(l)) elif mode == "add": -- 1.7.7.6

1 0

dhcpv6-client service
by Jiri Popelka 28 Feb '12

28 Feb '12

Hi, according to https://bugzilla.redhat.com/show_bug.cgi?id=591630#c4 I think we need a dhcpv6-client service (see attachment). Could it be possibly enabled in home/work/internal zones ? -- Jiri

1 0

welcome
by Thomas Woerner 31 Jan '12

31 Jan '12

Hello, welcome to the firewalld-devel mailing list. This list should be used for discussions about the development of firewalld only. If you have general questions about the use of firewalld, please sent a email to the firewalld-users mailing list. Thanks, Thomas

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

firewalld-devel