firewall-cmd - rich-rule - permanent configuration
Jiri Popelka
jpopelka at redhat.com
Fri Jul 26 17:27:05 UTC 2013
On 07/26/2013 05:44 PM, poma wrote:
> # firewall-cmd --permanent --add-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"'
> # firewall-cmd --permanent --list-rich-rules
> rule family="ipv4" source address="192.168.2.100" forward-port port="2222" protocol="tcp" to-port="22" to-addr="192.168.100.2"
The thing is that when firewalld adds a rich rule, this string rule is
parsed and its representation is created in firewalld.
Then when we want to list rich rules, the internal representation of
rule is exported into string - but this string can be different from the
one that was previously passed to --add-rich-rule. That's all right,
because their meaning is the same, they just may have different order of
elements.
> # firewall-cmd --permanent --remove-rich-rule='rule forward-port port="2222" to-port="22" to-addr="192.168.100.2" protocol="tcp" family="ipv4" source address="192.168.2.100"'
Problem is that when we remove or query rich-rule, in
FirewallClientConfigZoneSettings() we compare this not yet
parsed&exported string with already parsed&exported string and I said
above the string may be different even their meaning is the same. And in
this case the rule is not removed (or query fails).
I think in FirewallClientConfigZoneSettings() in
{add|remove|query}RichRule() we need to first pass the input string
through the parser&"exporter" before we can compare the string-only
rich-rules.
--
Jiri
More information about the firewalld-devel
mailing list