Sync from SUSE:SLFO:Main firewalld revision 0d9b52fda2c2b30c46a44ed15813e2f0

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

0002-Disable-FlushAllOnReload-option.patch

@@ -0,0 +1,57 @@
+From b1145d3efc58220f58a4e67189c4ff4a8bd789ce Mon Sep 17 00:00:00 2001
+From: Michal Rostecki <mrostecki@opensuse.org>
+Date: Mon, 25 Jan 2021 12:58:00 +0100
+Subject: [PATCH] Disable FlushAllOnReload option
+
+Disabling the FlushAllOnReload option restores the old behavior where
+--reload does not retain interface to zone assignmnets and direct rules.
+We want to keep that behavior in openSUSE and SLE
+
+Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
+---
+ config/firewalld.conf              | 4 ++--
+ doc/xml/firewalld.conf.xml         | 2 +-
+ src/firewall/config/__init__.py.in | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/config/firewalld.conf b/config/firewalld.conf
+index 7c9305e..43663b3 100644
+--- a/config/firewalld.conf
++++ b/config/firewalld.conf
+@@ -63,8 +63,8 @@ FirewallBackend=nftables
+ # configuration was retained during a reload, namely; interface to zone
+ # assignment, and direct rules. This was confusing to users. To get the old
+ # behavior set this to "no".
+-# Default: yes
+-FlushAllOnReload=yes
++# Default: no
++FlushAllOnReload=no
+ 
+ # RFC3964_IPv4
+ # As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
+diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
+index 1b74f70..a45c8df 100644
+--- a/doc/xml/firewalld.conf.xml
++++ b/doc/xml/firewalld.conf.xml
+@@ -190,7 +190,7 @@
+                 runtime configuration was retained during a reload, namely;
+                 interface to zone assignment, and direct rules. This was
+                 confusing to users. To get the old behavior set this to "no".
+-                Defaults to "yes".
++                Defaults to "no".
+                 </para>
+             </listitem>
+         </varlistentry>
+diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
+index 468daf5..5ec116c 100644
+--- a/src/firewall/config/__init__.py.in
++++ b/src/firewall/config/__init__.py.in
+@@ -132,7 +132,7 @@ FALLBACK_INDIVIDUAL_CALLS = False
+ FALLBACK_LOG_DENIED = "off"
+ FALLBACK_AUTOMATIC_HELPERS = "no"
+ FALLBACK_FIREWALL_BACKEND = "nftables"
+-FALLBACK_FLUSH_ALL_ON_RELOAD = True
++FALLBACK_FLUSH_ALL_ON_RELOAD = False
+ FALLBACK_RFC3964_IPV4 = True
+ FALLBACK_ALLOW_ZONE_DRIFTING = False
+ FALLBACK_NFTABLES_FLOWTABLE = "off"

docker-zone.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<zone target="ACCEPT">
+  <short>docker</short>
+  <description>All network connections are accepted.</description>
+  <interface name="docker0"/>
+</zone>

firewalld-runstatedir.patch

@@ -0,0 +1,13 @@
+diff --git a/__init__.py.in b/__init__.py.in.new
+index d982384..6452e6d 100644
+--- a/src/firewall/config/__init__.py.in
++++ b/src/firewall/config/__init__.py.in
+@@ -95,7 +95,7 @@ FIREWALLD_LOGFILE = '/var/log/firewalld'
+ 
+ FIREWALLD_LOGTARGET = '@DEFAULT_LOG_TARGET@'
+ 
+-FIREWALLD_PIDFILE = "/var/run/firewalld.pid"
++FIREWALLD_PIDFILE = "/run/firewalld.pid"
+ 
+ FIREWALLD_TEMPDIR = '/run/firewalld'
+ 

firewalld.spec

@@ -0,0 +1,385 @@
+#
+# spec file for package firewalld
+#
+# Copyright (c) 2023 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+#Compat macro for new _fillupdir macro introduced in Nov 2017
+%if ! %{defined _fillupdir}
+  %define _fillupdir %{_localstatedir}/adm/fillup-templates
+%endif
+%if 0%{?suse_version} < 1550 && 0%{?sle_version} < 150400
+# systemd-rpm-macros(or kmod) is wrong in 15.2 and 15.3
+%define _modprobedir /lib/modprobe.d
+%endif
+%global modprobe_d_files firewalld-sysctls.conf
+
+Name:           firewalld
+Version:        2.0.0
+Release:        0
+Summary:        A firewall daemon with D-Bus interface providing a dynamic firewall
+License:        GPL-2.0-or-later
+Group:          Productivity/Networking/Security
+URL:            https://www.firewalld.org
+Source0:        https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2
+Source1:        docker-zone.xml
+Patch0:         0002-Disable-FlushAllOnReload-option.patch
+Patch1:         firewalld-runstatedir.patch
+Patch2:         fix_list_all_zones_output.patch
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  desktop-file-utils
+BuildRequires:  docbook-xsl-stylesheets
+# Adding tools to BuildRequires as well so they can be autodetected
+# Else the configure tool will set them to /bin/false
+BuildRequires:  fdupes
+BuildRequires:  ebtables
+BuildRequires:  gettext
+BuildRequires:  glib2-devel
+BuildRequires:  gobject-introspection
+BuildRequires:  hicolor-icon-theme
+BuildRequires:  intltool
+BuildRequires:  ipset
+BuildRequires:  iptables
+BuildRequires:  libxslt-tools
+BuildRequires:  python3-devel
+BuildRequires:  systemd-rpm-macros
+Recommends:     logrotate
+Obsoletes:      firewalld-prometheus-config < 0.2
+Provides:       firewalld-prometheus-config = 0.2
+# Workaround: nftables seems to be a python3-nftables requirement,
+# not of firewalld.
+Requires:       nftables
+Requires:       python3-firewall = %{version}
+Requires:       python3-gobject
+Requires:       python3-nftables
+Requires(post): %fillup_prereq
+Suggests:       susefirewall2-to-firewalld
+BuildArch:      noarch
+%{?systemd_ordering}
+
+%description
+firewalld is a firewall service daemon that provides a dynamic customizable
+firewall with a D-Bus interface.
+
+%package -n python3-firewall
+Summary:        Python3 bindings for FirewallD
+Group:          Productivity/Networking/Security
+Requires:       dbus-1-python3
+Requires:       python3-dbus-python
+Requires:       python3-decorator
+Requires:       python3-gobject
+
+%description -n python3-firewall
+The python3 bindings for firewalld.
+
+%package -n firewall-macros
+Summary:        FirewallD RPM macros
+Group:          Productivity/Networking/Security
+
+%description -n firewall-macros
+This package provides the firewalld RPM macros file needed by packages
+which provide their own firewalld service files.
+
+%package -n firewall-applet
+Summary:        Firewall panel applet
+Group:          Productivity/Networking/Security
+Requires:       firewall-config = %{version}-%{release}
+Requires:       hicolor-icon-theme
+Requires:       python3-gobject
+Requires:       python3-qt5
+
+%description -n firewall-applet
+The firewall panel applet provides a status information of firewalld and also
+the firewall settings.
+
+%package -n firewall-config
+Summary:        Firewall configuration application
+Group:          Productivity/Networking/Security
+Requires:       %{name} = %{version}-%{release}
+Requires:       hicolor-icon-theme
+Requires:       python3-gobject-Gdk
+
+%description -n firewall-config
+The firewall configuration application provides an configuration interface for
+firewalld.
+
+%package test
+Summary:        Firewalld testsuite
+Group:          Productivity/Networking/Security
+
+%description test
+This package provides the firewalld testsuite.
+
+%package bash-completion
+Summary:        Bash Completion for firewalld
+Group:          Productivity/Networking/Security
+Requires:       %{name} = %{version}-%{release}
+Requires:       bash-completion
+Supplements:    (%{name} and bash-completion)
+
+%description bash-completion
+Bash command line completion support for firewalld.
+
+%package zsh-completion
+Summary:        Zsh Completion for firewalld
+Group:          Productivity/Networking/Security
+Requires:       %{name} = %{version}-%{release}
+Requires:       zsh
+Supplements:    (%{name} and zsh)
+
+%description zsh-completion
+Zsh command line completion support for firewalld.
+
+%lang_package
+
+%prep
+%autosetup -p1
+
+# bsc#1078223
+rm config/services/high-availability.xml
+
+%build
+export PYTHON="%{_bindir}/python3"
+autoreconf -fiv
+%configure \
+  --enable-sysconfig \
+  --enable-rpmmacros \
+  --with-ifcfgdir="%{_sysconfdir}/sysconfig/network"
+
+# Normally documentation is shipped but this will ensure that missing
+# files will be generated.
+%make_build
+
+%install
+%make_install
+
+%py3_compile %{buildroot}
+
+# remove files that shouldn't exist in the final rpms
+rm -r %{buildroot}%{_datadir}/%{name}/__pycache__
+
+desktop-file-install --delete-original \
+  --dir %{buildroot}%{_sysconfdir}/xdg/autostart \
+  %{buildroot}%{_sysconfdir}/xdg/autostart/firewall-applet.desktop
+
+desktop-file-install --delete-original \
+  --dir %{buildroot}%{_datadir}/applications \
+  %{buildroot}%{_datadir}/applications/firewall-config.desktop
+
+# fillup_only will take care of that
+%{_bindir}/install -c -D -m 600 %{buildroot}%{_sysconfdir}/sysconfig/firewalld %{buildroot}%{_fillupdir}/sysconfig.%{name}
+rm %{buildroot}%{_sysconfdir}/sysconfig/firewalld
+
+ln -sf %{_sbindir}/service %{buildroot}/%{_sbindir}/rcfirewalld
+
+# add firewalld zone (rhbz#1817022)
+install -dp %{buildroot}%{_prefix}/lib/firewalld/zones
+install -p -m 644 %{SOURCE1} %{buildroot}%{_prefix}/lib/firewalld/zones/docker.xml
+
+# No more /etc
+mkdir -p %{buildroot}%{_modprobedir}
+mv %{buildroot}%{_sysconfdir}/modprobe.d/* %{buildroot}%{_modprobedir}
+%if 0%{?suse_version} >= 1550
+mkdir -p %{buildroot}%{_distconfdir}/xdg/autostart
+mkdir -p %{buildroot}%{_distconfdir}/logrotate.d
+mv %{buildroot}%{_sysconfdir}/xdg/autostart/* %{buildroot}%{_distconfdir}/xdg/autostart
+mv %{buildroot}%{_sysconfdir}/logrotate.d/firewalld %{buildroot}%{_distconfdir}/logrotate.d/firewalld
+%endif
+
+%fdupes %{buildroot}%{python3_sitelib}
+
+%find_lang %{name} --all-name
+
+%pre
+%service_add_pre firewalld.service
+# Avoid restoring outdated stuff in posttrans
+for _f in %{?modprobe_d_files}; do
+    [ ! -f "/etc/modprobe.d/${_f}.rpmsave" ] || \
+        mv -f "/etc/modprobe.d/${_f}.rpmsave" "/etc/modprobe.d/${_f}.rpmsave.old" || :
+done
+%if 0%{?suse_version} > 1500
+# Prepare for migration to /usr/etc; save any old .rpmsave
+for i in logrotate.d/firewalld ; do
+   test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i}.rpmsave.old ||:
+done
+%endif
+
+%post
+%service_add_post firewalld.service
+%fillup_only firewalld
+
+%preun
+%service_del_preun firewalld.service
+
+%postun
+# We might a have runtime configuration which we haven't
+# made it permanent yet so restarting the service could be
+# dangerous. It's safer to not touch the firewall ourselves but
+# Let the user restart it whenever he feels like it.
+%service_del_postun_without_restart firewalld.service
+
+%posttrans
+# Migration of modprobe.conf files to _modprobedir
+for _f in %{?modprobe_d_files}; do
+    [ ! -f "/etc/modprobe.d/${_f}.rpmsave" ] || \
+        mv -fv "/etc/modprobe.d/${_f}.rpmsave" "/etc/modprobe.d/${_f}" || :
+done
+%if 0%{?suse_version} > 1500
+# Migration to /usr/etc, restore just created .rpmsave
+for i in logrotate.d/firewalld ; do
+   test -f %{_sysconfdir}/${i}.rpmsave && mv -v %{_sysconfdir}/${i}.rpmsave %{_sysconfdir}/${i} ||:
+done
+%endif
+
+%post -n firewall-applet
+/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
+
+%postun -n firewall-applet
+if [ $1 -eq 0 ] ; then
+    /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null
+    %{_bindir}/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
+    %{_bindir}/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
+fi
+
+%posttrans -n firewall-applet
+%{_bindir}/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
+%{_bindir}/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
+
+%post -n firewall-config
+/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
+
+%postun -n firewall-config
+if [ $1 -eq 0 ] ; then
+    /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null
+    %{_bindir}/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
+    %{_bindir}/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
+fi
+
+%posttrans -n firewall-config
+%{_bindir}/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
+%{_bindir}/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
+
+%files
+%doc README.md
+%license COPYING
+%{_sbindir}/firewalld
+%{_sbindir}/rcfirewalld
+%{_bindir}/firewall-cmd
+%{_bindir}/firewall-offline-cmd
+%dir %{_prefix}/lib/firewalld
+%dir %{_prefix}/lib/firewalld/icmptypes
+%dir %{_prefix}/lib/firewalld/ipsets
+%dir %{_prefix}/lib/firewalld/services
+%dir %{_prefix}/lib/firewalld/zones
+%dir %{_prefix}/lib/firewalld/helpers
+%dir %{_prefix}/lib/firewalld/policies
+%{_prefix}/lib/firewalld/icmptypes/*.xml
+%{_prefix}/lib/firewalld/ipsets/README.md
+%{_prefix}/lib/firewalld/services/*.xml
+%{_prefix}/lib/firewalld/zones/*.xml
+%{_prefix}/lib/firewalld/helpers/*.xml
+%{_prefix}/lib/firewalld/policies/*.xml
+%{_datadir}/polkit-1
+%dir %{_datadir}/dbus-1
+%dir %{_datadir}/dbus-1/system.d
+%dir %{_modprobedir}
+%{_modprobedir}/firewalld-sysctls.conf
+%config(noreplace) %{_sysconfdir}/firewalld/firewalld.conf
+%config(noreplace) %{_sysconfdir}/firewalld/lockdown-whitelist.xml
+%if 0%{?suse_version} > 1550
+%{_distconfdir}/logrotate.d/firewalld
+%else
+%config(noreplace) %{_sysconfdir}/logrotate.d/firewalld
+%endif
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/icmptypes
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/services
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/zones
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/ipsets
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/helpers
+%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/policies
+%{_unitdir}/firewalld.service
+%{_fillupdir}/sysconfig.%{name}
+%{_datadir}/dbus-1/system.d/FirewallD.conf
+%{_mandir}/man1/firewall*cmd*.1%{?ext_man}
+%{_mandir}/man1/firewalld*.1%{?ext_man}
+%{_mandir}/man5/firewall*.5%{?ext_man}
+
+%files -n python3-firewall
+%attr(0755,root,root) %dir %{python3_sitelib}/firewall
+%attr(0755,root,root) %dir %{python3_sitelib}/firewall/config
+%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core
+%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/io
+%attr(0755,root,root) %dir %{python3_sitelib}/firewall/server
+%attr(0755,root,root) %{python3_sitelib}/firewall/__pycache__
+%attr(0755,root,root) %{python3_sitelib}/firewall/config/__pycache__
+%attr(0755,root,root) %{python3_sitelib}/firewall/core/__pycache__
+%attr(0755,root,root) %{python3_sitelib}/firewall/core/io/__pycache__
+%attr(0755,root,root) %{python3_sitelib}/firewall/server/__pycache__
+%{python3_sitelib}/firewall/*.py*
+%{python3_sitelib}/firewall/config/*.py*
+%{python3_sitelib}/firewall/server/*.py*
+%{python3_sitelib}/firewall/core/io/*.py*
+%{python3_sitelib}/firewall/core/*.py*
+
+%files -n firewall-macros
+%{_rpmmacrodir}/macros.firewalld
+
+%files -n firewall-applet
+%attr(0755,root,root) %{_bindir}/firewall-applet
+%dir %{_sysconfdir}/firewall
+%config(noreplace) %{_sysconfdir}/firewall/applet.conf
+%if %{undefined _distconfdir}
+%{_sysconfdir}/xdg/autostart/firewall-applet.desktop
+%else
+%{_distconfdir}/xdg/autostart/firewall-applet.desktop
+%endif
+%{_datadir}/icons/hicolor/*/apps/firewall-applet*.*
+%{_mandir}/man1/firewall-applet*.1%{?ext_man}
+
+%files -n firewall-config
+%dir %{_datadir}/firewalld
+%attr(0755,root,root) %{_bindir}/firewall-config
+%{_datadir}/firewalld/firewall-config.glade
+%attr(0755,root,root) %{_datadir}/firewalld/gtk3_chooserbutton.py*
+%attr(0755,root,root) %{_datadir}/firewalld/gtk3_niceexpander.py*
+%{_datadir}/applications/firewall-config.desktop
+%{_datadir}/metainfo/firewall-config.appdata.xml
+%{_datadir}/icons/hicolor/*/apps/firewall-config*.*
+%{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
+%{_mandir}/man1/firewall-config*.1%{?ext_man}
+
+%files test
+%dir %{_datadir}/firewalld/testsuite
+%{_datadir}/firewalld/testsuite/README.md
+%{_datadir}/firewalld/testsuite/testsuite
+%dir %{_datadir}/firewalld/testsuite/integration
+%{_datadir}/firewalld/testsuite/integration/testsuite
+%dir %{_datadir}/firewalld/testsuite/python
+%attr(0755,root,root) %{_datadir}/firewalld/testsuite/python/*.py
+%attr(0755,root,root) %{_datadir}/firewalld/testsuite/python/__pycache__
+
+%files bash-completion
+%dir %{_datadir}/bash-completion/completions
+%{_datadir}/bash-completion/completions/firewall-cmd
+
+%files zsh-completion
+%dir %{_datadir}/zsh/site-functions
+%{_datadir}/zsh/site-functions/_firewalld
+
+%files lang -f %{name}.lang
+
+%changelog

fix_list_all_zones_output.patch

@@ -0,0 +1,22 @@
+commit f3cea0e8e2a290d4ce00de936d9b679fbd0e0484	f3cea0e
+Author: Eric Garver <eric@garver.life>
+Date:   Mon Jul 10 15:59:42 2023 -0400
+
+    fix(cli): all --list-all-zones output identical
+    
+    Fixes: #1152
+
+diff --git a/src/firewall-cmd.in b/src/firewall-cmd.in
+index 062909e9..c327763f 100755
+--- a/src/firewall-cmd.in
++++ b/src/firewall-cmd.in
+@@ -2448,7 +2448,8 @@ if a.permanent:
+             names = fw.config().getZoneNames()
+             for zone in sorted(names):
+                 interfaces = try_nm_get_interfaces_in_zone(zone)
+-                cmd.print_zone_info(zone, settings, extra_interfaces=interfaces)
++                cmd.print_zone_info(zone, fw.config().getZoneByName(zone).getSettings(),
++                                    extra_interfaces=interfaces)
+                 cmd.print_msg("")
+             sys.exit(0)
+