[Bug 340926] New: Upgrade of system breaks SuSEfirewall2 if it contains lines with "\" continue line symbol.
https://bugzilla.novell.com/show_bug.cgi?id=340926 Summary: Upgrade of system breaks SuSEfirewall2 if it contains lines with "\" continue line symbol. Product: openSUSE 10.3 Version: Final Platform: Other OS/Version: openSUSE 10.3 Status: NEW Severity: Normal Priority: P5 - None Component: Update Problems AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: robin.listas@telefonica.net QAContact: jsrain@novell.com Found By: --- Symptom: nimrodel:~ # SuSEfirewall2 SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 ... SuSEfirewall2: Warning: no default firewall zone defined, assuming 'ext' SuSEfirewall2: batch committing... iptables-batch v1.3.8: host/network `##' not found Try `iptables-batch -h' or 'iptables-batch --help' for more information. SuSEfirewall2: Error: iptables-batch failed, re-running using iptables iptables v1.3.8: host/network `##' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.8: host/network `Type:' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.8: host/network `string' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.8: host/network `##' not found Try `iptables -h' or 'iptables --help' for more information. iptables v1.3.8: host/network `Default:' not found Try `iptables -h' or 'iptables --help' for more information. SuSEfirewall2: Firewall rules successfully set Notice it doesn't say the faulty line. The problem is this section: FW_TRUSTED_NETS="192.168.1.11,tcp,ftp 192.168.1.11,tcp,ftp-data \ ## Type: string ## Default: 192.168.1.11,tcp,ssh \ 192.168.1.1,udp,tftp \ 192.168.1.2,tcp,microsoft-ds 192.168.1.2,tcp,netbios-ssn \ 192.168.1.2,udp,netbios-dgm 192.168.1.2,udp,netbios-ns \ 192.168.1.33,tcp,http \ 192.168.1.33,tcp,ssh \ 192.168.1.33,tcp,ftp \ 192.168.1.33,tcp,ftp-data" # 192.168.1.1,udp,tftp --> backups del router. # 192.168.1.2 --> samba para Moria. Notice the three lines inserted in the middle of the definition? I have compared the file with the original in my 10.2 system, preserved in the backup, and I can conclude that it was the upgrade to 10.3 made by YAST who inserted those three lines in there. Removing them solves the problem: nimrodel:~ # SuSEfirewall2 SuSEfirewall2: Setting up rules from /etc/sysconfig/SuSEfirewall2 ... SuSEfirewall2: Warning: no default firewall zone defined, assuming 'ext' SuSEfirewall2: batch committing... SuSEfirewall2: Firewall rules successfully set nimrodel:~ # This same problem was reported in the security list the 23 Jul 2006 - only that time I did not have proof. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 Martin Mrazik <mmrazik@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |lnussel@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926#c1 Ludwig Nussel <lnussel@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lnussel@novell.com AssignedTo|lnussel@novell.com |locilka@novell.com --- Comment #1 from Ludwig Nussel <lnussel@novell.com> 2007-11-13 06:48:06 MST --- Well, either a YaST or fillup problem. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926#c2 Lukas Ocilka <locilka@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO Info Provider| |robin.listas@telefonica.net --- Comment #2 from Lukas Ocilka <locilka@novell.com> 2007-11-13 06:58:53 MST --- Carlos, please, attach YaST logs: See http://en.opensuse.org/Bugs/YaST Ludwig, Upgrade doesn't change the firewall configuration. Moreover `miracle:/usr/share/YaST2 # grep -r FW_TRUSTED_NETS *` didn't return anything. YaST Firewall doesn't do anything with that variable. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926#c3 Ludwig Nussel <lnussel@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|locilka@novell.com |ro@novell.com Status|NEEDINFO |NEW Info Provider|robin.listas@telefonica.net | --- Comment #3 from Ludwig Nussel <lnussel@novell.com> 2007-11-13 07:28:39 MST --- Then it must be a fillup problem. I don't know whether such multi line settings are actually permitted by the sysconfig spec though. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926#c4 Lukas Ocilka <locilka@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |locilka@novell.com --- Comment #4 from Lukas Ocilka <locilka@novell.com> 2007-11-13 07:34:12 MST --- In my opinion those "\" character are unnecessary. It should be enough to use: VAR="A B C" -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926#c5 --- Comment #5 from Carlos Robinson <robin.listas@telefonica.net> 2007-11-13 16:10:52 MST --- (In reply to comment #2 from Lukas Ocilka)
Carlos, please, attach YaST logs: See http://en.opensuse.org/Bugs/YaST
Huh? But the logs of the upgrade are not saved to harddisk, AFAIK: it's a live system on RAM. Are they :-? Ok, the upgrade started on Nov 2 23:22:48 and finished (first boot) at 14:22:59 Nov 2 23:22:48 nimrodel syslog-ng[4304]: syslog-ng version 1.6.11 going down Nov 3 14:22:59 nimrodel syslog-ng[3952]: syslog-ng version 1.6.12 starting I attach y2logs-20071113.tgz [...] No, I can't; this is what I get: The file you are trying to attach is 5282 kilobytes (KB) in size. Non-patch attachments cannot be more than 5120 KB. It's only 5 Megabytes! Good grief, that's a TINY log file, as yast logs go! Can't you please increase that absurd limit? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926#c6 --- Comment #6 from Carlos Robinson <robin.listas@telefonica.net> 2007-11-13 16:25:02 MST --- Created an attachment (id=183271) --> (https://bugzilla.novell.com/attachment.cgi?id=183271) yast logs I re-compressed as bz2. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 Ruediger Oertel <ro@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Normal |Minor Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 Sven Lachmund <opensuse@go4more.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |416108 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 User opensuse@go4more.de added comment https://bugzilla.novell.com/show_bug.cgi?id=340926#c7 Sven Lachmund <opensuse@go4more.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |opensuse@go4more.de Blocks|416108 | --- Comment #7 from Sven Lachmund <opensuse@go4more.de> 2008-08-10 07:38:36 MDT --- I still have this issue with openSUSE 11.0 and was about to report it as a bug, but it also happens if the variables are spread over multiple lines without having a backslash in the end. My SuSEfirewall2 config file contains lines like: FW_FORWARD="10.2.36.0/24,10.2.26.0/24 10.2.36.0/24,10.2.39.28/30 10.2.26.0/24,10.2.39.28/30 10.2.36.0/24,10.2.39.32/30 10.2.26.0/24,10.2.39.32/30 " And it happened to me that within this variable definition, two lines of comment, as reported in this bug report were added during a update process - from openSUSE 10.3 to openSUSE 11.0 (using the i386 DVD) and - by updating SuSEfirewall2 using you on the freshly installed openSUSE 11.0 In both cases I had to remove this comment. There is a process that changes the SuSEfirewall config file during update! Furthermore, during the update of the SuSEfirwall2 package, other changes are made on the config file. See bug report #416108 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 User pgajdos@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=340926#c9 Petr Gajdos <pgajdos@novell.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |INVALID --- Comment #9 from Petr Gajdos <pgajdos@novell.com> 2009-02-10 10:44:19 MST --- Multiline variable assignment is not supported: http://en.opensuse.org/SUSE_Package_Conventions/Sysconfig#5.1._Base_File_For... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 User robin.listas@telefonica.net added comment https://bugzilla.novell.com/show_bug.cgi?id=340926#c10 Carlos Robinson <robin.listas@telefonica.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|INVALID | --- Comment #10 from Carlos Robinson <robin.listas@telefonica.net> 2009-02-10 13:34:56 MST --- (In reply to comment #9)
Multiline variable assignment is not supported: http://en.opensuse.org/SUSE_Package_Conventions/Sysconfig#5.1._Base_File_For...
Sorry, that's not true. Ask around. The '/etc/sysconfig/SuSEfirewall2' file follows bash syntax and allows multiline statements. I'm using them, many people use them, and we have been using them for years. So, please, change your definition. It is YaST which is broken. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 User lnussel@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=340926#c11 --- Comment #11 from Ludwig Nussel <lnussel@novell.com> 2009-02-11 02:05:23 MST --- It's true that SuSEfirewall2 is written in bash and therefore accepts arbitrary scripts as config. It's however also true that the sysconfig file format is only a defined subset of shell syntax. So a file with multiline values is probably indeed invalid. Nevertheless for SuSEfirwall2 it really makes a lot of sense to support multi line values as one often has to enter many settings in one variable. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=340926 User locilka@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=340926#c12 --- Comment #12 from Lukas Ocilka <locilka@novell.com> 2009-02-11 02:13:07 MST --- BTW: YaST Firewall supports this type: VARIABLE=" several entries one or more per line" -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com