Bug 230042

Summary:	SUSE firewall should show more detailed summary (on request)
Product:	[openSUSE] openSUSE 10.3	Reporter:	Felix Rommel <felix.rommel>
Component:	YaST2	Assignee:	Lukas Ocilka <locilka>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Enhancement
Priority:	P5 - None	CC:	security-team
Version:	Alpha 1
Target Milestone:	---
Hardware:	Other
OS:	Linux
Whiteboard:
Found By:	Other	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	step 1: enter settings step 2: click next, settings are not shown step 3: start the YaST firewall config tool again and settings are not shown complete YaST2 log directory /etc/sysconfig/SuSEfirewall2

Description Felix Rommel 2006-12-20 20:10:32 UTC

If you configure the SUSE firewall in YaST and enter some ports which you want to open or set IP protocols which are allowed, YaST doesn't save these values.

How to reproduce:

1. Open in YaST the SUSE firewall configuration tool.
2. Enter some ports in "Allowed services" which you want to open in "external zone", for example UDP 10000 and UDP 500 and enter an IP protocol like "esp".
3. Now click on the continue button.
4. The following overview page won't show the entered ports and protocol.

Comment 1 Marcus Meissner 2007-01-08 13:52:35 UTC

-> yast maintainer

Comment 2 Lukas Ocilka 2007-01-08 14:09:15 UTC

Trying to reproduce:

1.) Opening YaST Firewall
2.) Clicking [Next] to see the current configuration

External Zone
-------------
  Open Services, Ports, and Protocols
    * DNS Server 
    * NFS Client 
    * NFS Server 
    * Remote Administration 
    * SSH

3.) Clicking [Back]
4.) Clicking on Allowed Services, [Advanced] button
5.) Adding UDP Ports: "10000 500", IP Protocols: "esp"
6.) Clicking [OK]

/var/log/YaST2/y2log says:
2007-01-08 15:02:57 <1> miracle(27850) [YCP] SuSEFirewall.ycp:2351 Adding additional services ["10000", "500"]/UDP into zone EXT
2007-01-08 15:02:57 <1> miracle(27850) [YCP] PortRanges.ycp:377 Joining list of ranges []
2007-01-08 15:02:57 <1> miracle(27850) [YCP] PortRanges.ycp:487 Result of joining: []
2007-01-08 15:02:57 <1> miracle(27850) [YCP] SuSEFirewall.ycp:2351 Adding additional services ["esp"]/IP into zone EXT
2007-01-08 15:02:57 <1> miracle(27850) [YCP] PortRanges.ycp:312 Protocol IP doesn't support port ranges, skipping...
(no error)

7.) Clicking [Next] to see the changed configuration overview:
External Zone
-------------
  Open Services, Ports, and Protocols
    * DNS Server 
    * NFS Client 
    * NFS Server 
    * Remote Administration 
    * SSH 
    * UDP Ports: 10000, 500 
    * IP Protocols: esp

8.) Conclusion:
Cannot duplicate, requested ports are added.
(Checked also in the configuration file /etc/sysconfig/SuSEfirewall2)

So, please, if you can duplicate the problem by yourself, finish the firewall configuration by clicking on the Accept button and attach files /var/log/YaST/y2log and /etc/sysconfig/SuSEfirewall2 after it is done.

Thanks

Comment 3 Felix Rommel 2007-01-09 16:53:33 UTC

Ok, I checked /etc/sysconfig/SuSEfirewall2 and the settings ARE saved.

Nevertheless the settings are not shown in YaST Firewall config tool - see attached screenshots.

Comment 4 Felix Rommel 2007-01-09 16:54:39 UTC

Created attachment 112039 [details]
step 1: enter settings

Comment 5 Felix Rommel 2007-01-09 16:55:13 UTC

Created attachment 112040 [details]
step 2: click next, settings are not shown

Comment 6 Felix Rommel 2007-01-09 16:56:06 UTC

Created attachment 112041 [details]
step 3: start the YaST firewall config tool again and settings are not shown

Comment 7 Lukas Ocilka 2007-01-10 09:05:54 UTC

I see, this is strange, but ...

Could you, please, attach your /var/log/YaST/ firectory directory (a tar/gzip whatever) and your /etc/sysconfig/SuSEfirewall2 as mentioned in comment #2? I can't do anything without them because, as you can see, I was unable to duplicate the error.

Thanks

Comment 8 Felix Rommel 2007-01-10 13:34:30 UTC

Created attachment 112207 [details]
complete YaST2 log directory

Comment 9 Felix Rommel 2007-01-10 13:36:08 UTC

Created attachment 112208 [details]
/etc/sysconfig/SuSEfirewall2

Comment 10 Lukas Ocilka 2007-01-17 07:46:01 UTC

I see. Actually, firewall saves the configuration as is has been entered but port 500 and protocol esp are already allowed by service IPsec.

    /* IPsec definition */
        "ipsec" : $[
            "name"      : _("IPsec"),
            "udp_ports" : [ "isakmp", "ipsec-nat-t" ],
            "ip_protocols" : [ "esp" ],
        ],

According to /etc/services
    isakmp is port 500

It would be nice when firewall could show a detailed summary which ports are actually open (by services) and which service open which ports (and protocols...)

Comment 11 Lukas Ocilka 2007-04-02 11:39:15 UTC

This comes from the firewall .changes file:

- Show firewall summary details on request (#230042).
- yast2-firewall-2.15.4