Unable to edit firewall zones in YAST

8876523450 · June 30, 2023, 1:17pm

Tumbleweed.

New problem - was working previously.

Unable to edit the firewall zones in YAST. Unable to properly assign network interface to a zone.

Previous working edits have disappeared.

YAST seems to create a double entry of the edited zone into /etc/firewalld/zones when editing a zone.

Seeing this behaviour on two separate machines.

arvidjaar · June 30, 2023, 1:36pm

It is absolutely unclear what you mean. I tried to change interface zone and it worked. You need to provide more detailed description of steps you used.

I presume you have previous snapshots so you can restore old content. If you can provided step by step description how to reproduce it starting from known good content you should open bug report.

Again, it is absolutely unclear what it means. I edited zone (by adding service) and I do not see any “double entries” anywhere.

8876523450 · June 30, 2023, 1:59pm

Start YAST

Click Firewall

Choose any zone

Edit it by adding a service

Click Accept

Return to Firewall and observe that edits were not saved

Observe that double entry .xml file of edited zone appears in /etc/firewalld/zones

Observe that every zone in YAST > Firewall is exactly the same despite the .xml files in /lib/firewalld/zones having different entries

arvidjaar · June 30, 2023, 2:38pm

github.com/firewalld/firewalld

firewall-cmd --permanent --list-all-zones returns identical bogus content for all zones

opened 02:37PM - 30 Jun 23 UTC

arvidjaar

triage

### What happened Identical information is returned for all zones. It is probab…le the default `public` zone. ``` uefi:~ # firewall-cmd --list-all-zones --permanent block target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: dmz target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: docker target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: drop target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: external target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: home target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: internal target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: nm-shared target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: public target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: test target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: trusted target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: work target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: sources: services: dhcpv6-client ports: protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: uefi:~ # ``` It does not match on-disk content. As example: ``` uefi:~ # cat /etc/firewalld/zones/dmz.xml <?xml version="1.0" encoding="utf-8"?> <zone> <short>DMZ</short> <description>For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.</description> <service name="ssh"/> <service name="amqp"/> <interface name="docker0"/> <forward/> </zone> uefi:~ # ``` ### What you expected to happen Command returns the correct on-disk configuration. ### How to reproduce it (as minimally and precisely as possible) Just run the command ``` firewall-cmd --list-all-zones --permanent ``` ### Anything else we need to know? This is a regression which broke openSUSE YaST firewall module that gets information from firewalld. ### Firewalld Version 2.0.0 ### Firewalld Backend nftables ### Linux distribution openSUSE Tumbleweed ### Linux kernel version 6.3.9-1-default ### Other information _No response_

msiyer · July 2, 2023, 6:31pm

Can confirm the problem exists in the latest Raspberry Pi image (openSUSE-Tumbleweed-ARM-X11-raspberrypi.aarch64.raw.xz). I was setting up PostgreSQL on Raspberry Pi 4 Model B 4 GB. No firewall setting is persisted in the Yast2 UI.