Sync from SUSE:SLFO:Main firewalld revision afd9a76e33869a5d728b8a81f5577674
This commit is contained in:
@@ -1,57 +1,68 @@
|
||||
From b1145d3efc58220f58a4e67189c4ff4a8bd789ce Mon Sep 17 00:00:00 2001
|
||||
From: Michal Rostecki <mrostecki@opensuse.org>
|
||||
Date: Mon, 25 Jan 2021 12:58:00 +0100
|
||||
Subject: [PATCH] Disable FlushAllOnReload option
|
||||
From 98c87acce02c1963644455933ce7c2d40015d295 Mon Sep 17 00:00:00 2001
|
||||
From: Mohd Saquib <mohd.saquib@suse.com>
|
||||
Date: Mon, 8 Jan 2024 12:34:35 +0530
|
||||
Subject: [PATCH] Disable FlushAllOnReload option by default
|
||||
|
||||
Disabling the FlushAllOnReload option restores the old behavior where
|
||||
--reload does not retain interface to zone assignmnets and direct rules.
|
||||
We want to keep that behavior in openSUSE and SLE
|
||||
|
||||
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
|
||||
Signed-off-by: Mohd Saquib <mohd.saquib@suse.com>
|
||||
|
||||
---
|
||||
config/firewalld.conf | 4 ++--
|
||||
doc/xml/firewalld.conf.xml | 2 +-
|
||||
config/firewalld.conf | 8 ++++----
|
||||
doc/xml/firewalld.conf.xml | 4 ++--
|
||||
src/firewall/config/__init__.py.in | 2 +-
|
||||
3 files changed, 4 insertions(+), 4 deletions(-)
|
||||
3 files changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/config/firewalld.conf b/config/firewalld.conf
|
||||
index 7c9305e..43663b3 100644
|
||||
index 2d1a0cb..af42478 100644
|
||||
--- a/config/firewalld.conf
|
||||
+++ b/config/firewalld.conf
|
||||
@@ -63,8 +63,8 @@ FirewallBackend=nftables
|
||||
@@ -61,10 +61,10 @@ FirewallBackend=nftables
|
||||
# FlushAllOnReload
|
||||
# Flush all runtime rules on a reload. In previous releases some runtime
|
||||
# configuration was retained during a reload, namely; interface to zone
|
||||
# assignment, and direct rules. This was confusing to users. To get the old
|
||||
# behavior set this to "no".
|
||||
-# assignment, and direct rules. This was confusing to users. To get the old
|
||||
-# behavior set this to "no".
|
||||
-# Default: yes
|
||||
-FlushAllOnReload=yes
|
||||
+# assignment, and direct rules. This was confusing to users. To override this
|
||||
+# behavior set this to "yes".
|
||||
+# Default: no
|
||||
+FlushAllOnReload=no
|
||||
|
||||
# RFC3964_IPv4
|
||||
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
|
||||
# ReloadPolicy
|
||||
# Policy during reload. By default all traffic except for established
|
||||
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
|
||||
index 1b74f70..a45c8df 100644
|
||||
index 6bb8069..e226113 100644
|
||||
--- a/doc/xml/firewalld.conf.xml
|
||||
+++ b/doc/xml/firewalld.conf.xml
|
||||
@@ -190,7 +190,7 @@
|
||||
@@ -179,8 +179,8 @@
|
||||
Flush all runtime rules on a reload. In previous releases some
|
||||
runtime configuration was retained during a reload, namely;
|
||||
interface to zone assignment, and direct rules. This was
|
||||
confusing to users. To get the old behavior set this to "no".
|
||||
- confusing to users. To get the old behavior set this to "no".
|
||||
- Defaults to "yes".
|
||||
+ confusing to users. To override this behavior set this to "yes".
|
||||
+ Defaults to "no".
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
|
||||
index 468daf5..5ec116c 100644
|
||||
index 12b694e..2c7be57 100644
|
||||
--- a/src/firewall/config/__init__.py.in
|
||||
+++ b/src/firewall/config/__init__.py.in
|
||||
@@ -132,7 +132,7 @@ FALLBACK_INDIVIDUAL_CALLS = False
|
||||
@@ -124,7 +124,7 @@ FALLBACK_INDIVIDUAL_CALLS = False
|
||||
FALLBACK_LOG_DENIED = "off"
|
||||
FALLBACK_AUTOMATIC_HELPERS = "no"
|
||||
FALLBACK_FIREWALL_BACKEND = "nftables"
|
||||
-FALLBACK_FLUSH_ALL_ON_RELOAD = True
|
||||
+FALLBACK_FLUSH_ALL_ON_RELOAD = False
|
||||
FALLBACK_RELOAD_POLICY = "INPUT:DROP,FORWARD:DROP,OUTPUT:DROP"
|
||||
FALLBACK_RFC3964_IPV4 = True
|
||||
FALLBACK_ALLOW_ZONE_DRIFTING = False
|
||||
FALLBACK_NFTABLES_FLOWTABLE = "off"
|
||||
--
|
||||
2.35.3
|
||||
|
25
0002-firewalld-runstatedir.patch
Normal file
25
0002-firewalld-runstatedir.patch
Normal file
@@ -0,0 +1,25 @@
|
||||
From 0b9644ab645d69877f3bef50ede50cb30972e2e1 Mon Sep 17 00:00:00 2001
|
||||
From: Mohd Saquib <mohd.saquib@suse.com>
|
||||
Date: Mon, 8 Jan 2024 12:57:34 +0530
|
||||
Subject: [PATCH] Change firewalld pid from /var/run to /run
|
||||
|
||||
---
|
||||
src/firewall/config/__init__.py.in | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
|
||||
index 12b694e..3914c90 100644
|
||||
--- a/src/firewall/config/__init__.py.in
|
||||
+++ b/src/firewall/config/__init__.py.in
|
||||
@@ -87,7 +87,7 @@ FIREWALLD_LOGFILE = "/var/log/firewalld"
|
||||
|
||||
FIREWALLD_LOGTARGET = "@DEFAULT_LOG_TARGET@"
|
||||
|
||||
-FIREWALLD_PIDFILE = "/var/run/firewalld.pid"
|
||||
+FIREWALLD_PIDFILE = "/run/firewalld.pid"
|
||||
|
||||
FIREWALLD_TEMPDIR = "/run/firewalld"
|
||||
|
||||
--
|
||||
2.35.3
|
||||
|
BIN
firewalld-2.0.0.tar.bz2
(Stored with Git LFS)
BIN
firewalld-2.0.0.tar.bz2
(Stored with Git LFS)
Binary file not shown.
BIN
firewalld-2.1.2.tar.bz2
(Stored with Git LFS)
Normal file
BIN
firewalld-2.1.2.tar.bz2
(Stored with Git LFS)
Normal file
Binary file not shown.
@@ -1,13 +0,0 @@
|
||||
diff --git a/__init__.py.in b/__init__.py.in.new
|
||||
index d982384..6452e6d 100644
|
||||
--- a/src/firewall/config/__init__.py.in
|
||||
+++ b/src/firewall/config/__init__.py.in
|
||||
@@ -95,7 +95,7 @@ FIREWALLD_LOGFILE = '/var/log/firewalld'
|
||||
|
||||
FIREWALLD_LOGTARGET = '@DEFAULT_LOG_TARGET@'
|
||||
|
||||
-FIREWALLD_PIDFILE = "/var/run/firewalld.pid"
|
||||
+FIREWALLD_PIDFILE = "/run/firewalld.pid"
|
||||
|
||||
FIREWALLD_TEMPDIR = '/run/firewalld'
|
||||
|
@@ -1,17 +1,97 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 22 15:57:29 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||
|
||||
- Drop rcFOO symlinks for CODE16 (PED-266).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 14 13:40:42 UTC 2024 - pgajdos@suse.com
|
||||
|
||||
- remove dependency on /usr/bin/python3 using
|
||||
%python3_fix_shebang macro, [bsc#1212476]
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri May 24 14:41:25 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org>
|
||||
|
||||
- Keep English 'translations' (en_US, en_GB) in the main package:
|
||||
do not force the lang package on plain English systems.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu May 9 18:58:54 UTC 2024 - Dirk Müller <dmueller@suse.com>
|
||||
|
||||
- update to 2.1.2:
|
||||
* fix(policy): allow forward ports w/ to-addr for egress-
|
||||
zone=HOST
|
||||
* fix(rich): fix range check for large rule limit
|
||||
* fix(tests): fix skip detection in fw-in-container environment
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jan 29 17:05:05 UTC 2024 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
|
||||
- update to 2.1.1:
|
||||
* fix(offline-cmd): use family when creating ipset (64f78a9)
|
||||
* fix(firewall-config): allow rich rule forwarded ports to be logged (d46ea62)
|
||||
* fix(ipXtables): log forwarded ports only (07dc202)
|
||||
* fix(nftables): log forwarded ports (5c26b73)
|
||||
* fix(io.ipset): raise exception if entries exceed limit (a2da5fb)
|
||||
* fix(policy): ipXtables: multiple policies using same zone (b6f2f09)
|
||||
* fix(policy): dispatch update for active policies (7f6f0e2)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jan 8 07:30:21 UTC 2024 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
|
||||
- update to 2.1.0:
|
||||
* eat(service): add DNS over QUIC (DoQ) Service (5130430)
|
||||
* feat(icmp): add ICMPv6 Multicast Listener Discovery (MLD) types (dd88bbf)
|
||||
* feat(fw): add ReloadPolicy option in firewalld.conf (0019371)
|
||||
* feat(service): add submission service (tcp 587) (d6a9561)
|
||||
* feat(service): Add alvr (3a92358)
|
||||
* feat(service): add vrrp (d62fc8d)
|
||||
[* Renamed patch 0002-Disable-FlushAllOnReload-option.patch to
|
||||
0001-Disable-FlushAllOnReload-option.patch
|
||||
[* Renamed patch firewalld-runstatedir.patch to 0002-firewalld-runstatedir.patch]
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 29 07:10:44 UTC 2023 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
|
||||
- update to 2.0.2:
|
||||
* fix(policy): runtime dispatch update if *-zone=ANY (e8b9637)
|
||||
* fix(nm): release NM client after a timeout (d534f07)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 3 06:42:21 UTC 2023 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
|
||||
- update to 2.0.1:
|
||||
* fix(cli): all --list-all-zones output identical (d30bc61)
|
||||
* fix(cli): properly show default zone attribute (ea8d9a8)
|
||||
* fix(cli): properly show active attribute for zones and policies (b202403)
|
||||
* fix(cli): --get-active-zones should include the default zone (dae9112)
|
||||
* fix(nftables): always flush main table on start (cd20981)
|
||||
* fix(runtimeToPermanent): deepcopy settings before mangling (9c53639)
|
||||
* docs: fix reference to lockdown-whitelist.xml in SYNOPSIS section (1c77205)
|
||||
* fix(firewall-config): escape markup stored in bindings store (c876fd0)
|
||||
* fix(tests): avoid deprecated assertRaisesRegexp for assertRaisesRegex (2935119)
|
||||
* fix(icmp): fix check_icmpv6_name() to use correct IPv6 names (af3c35b)
|
||||
* fix(ipset): fix configuring IP range for ipsets with nftables (6a050ec)
|
||||
* fix(ipset): fix configuring "timeout","maxelem" values for ipsets with nftables (7d3340c)
|
||||
* fix(core): fix exception while parsing invalid "tcp-mss-clamp" in policy (ff61209)
|
||||
* docs(policy): fix wrong documentation of in man firewalld.policy (21026d9)
|
||||
|
||||
- removed following patch:
|
||||
[- fix_list_all_zones_output.patch]
|
||||
-------------------------------------------------------------------
|
||||
Mon Sep 25 01:29:47 UTC 2023 - Steve Kowalik <steven.kowalik@suse.com>
|
||||
|
||||
- python3-dbus isn't correct either, it's python3-dbus-python.
|
||||
- python3-dbus isn't correct either, it's python3-dbus-python.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Sep 21 06:26:34 UTC 2023 - Steve Kowalik <steven.kowalik@suse.com>
|
||||
|
||||
- Correct Requires, python3-slip-dbus -> python3-dbus.
|
||||
- Correct Requires, python3-slip-dbus -> python3-dbus.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Aug 22 10:47:06 UTC 2023 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
|
||||
- fix(cli): all --list-all-zones output identical (boo#1213609)
|
||||
- fix(cli): all --list-all-zones output identical (boo#1213609)
|
||||
[+ fix_list_all_zones_output.patch]
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -21,9 +101,9 @@ Sat Jun 24 14:20:24 UTC 2023 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
* This is a major release. The major version is being bumped symbolically
|
||||
to reflect significant changes done in commit f4d2b80 ("fix(policy):
|
||||
disallow zone drifting"). It does not contain any deliberate breaking
|
||||
changes.
|
||||
changes.
|
||||
* Complete changelog:
|
||||
https://github.com/firewalld/firewalld/releases/tag/v2.0.0
|
||||
https://github.com/firewalld/firewalld/releases/tag/v2.0.0
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jun 15 07:48:48 UTC 2023 - Mohd Saquib <mohd.saquib@suse.com>
|
||||
@@ -176,14 +256,14 @@ Mon Mar 7 16:45:58 UTC 2022 - Martin Wilck <mwilck@suse.com>
|
||||
-------------------------------------------------------------------
|
||||
Fri Mar 4 20:30:02 UTC 2022 - Martin Wilck <mwilck@suse.com>
|
||||
|
||||
- Always own %_modprobedir (bsc#1196275, jsc#SLE-20639)
|
||||
- Always own %_modprobedir (bsc#1196275, jsc#SLE-20639)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Mar 3 14:26:57 UTC 2022 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Fix modprobe.d directory for SLE15 SP3
|
||||
- Cleanup dependencies:
|
||||
- ipset, ebtables and iptables are purely optional and deprecated,
|
||||
- ipset, ebtables and iptables are purely optional and deprecated,
|
||||
so don't require them
|
||||
- sysconfig is not needed at all
|
||||
- Don't hard require systemd, we don't have and need that in containers
|
||||
@@ -836,7 +916,7 @@ Tue Nov 28 12:30:59 UTC 2017 - mchandras@suse.de
|
||||
-------------------------------------------------------------------
|
||||
Thu Nov 23 13:37:50 UTC 2017 - rbrown@suse.com
|
||||
|
||||
- Replace references to /var/adm/fillup-templates with new
|
||||
- Replace references to /var/adm/fillup-templates with new
|
||||
%_fillupdir macro (boo#1069468)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
@@ -887,7 +967,7 @@ Wed Nov 15 12:36:09 UTC 2017 - mchandras@suse.de
|
||||
* firewall.core.fw_zone: Fix IPv6 address in rich rule forward ports
|
||||
* add Murmur (Mumble server) service
|
||||
- spec file fixes to avoid rpmlint warnings about duplicate files.
|
||||
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 8 17:25:40 UTC 2017 - mpluskal@suse.com
|
||||
|
||||
@@ -936,7 +1016,7 @@ Mon Mar 27 22:27:20 UTC 2017 - mchandras@suse.de
|
||||
* firewall.core.fw_ipset: get_ipset may not ckeck if set is applied by default
|
||||
* firewall.core.fw_transaction: Use LastUpdatedOrderedDict for zone transactions
|
||||
- Remove upstream patch:
|
||||
* 0001-firewall.core.fw_ipset-get_ipset-may-not-ckeck-if-se.patch
|
||||
* 0001-firewall.core.fw_ipset-get_ipset-may-not-ckeck-if-se.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Feb 13 16:20:27 UTC 2017 - mchandras@suse.de
|
||||
@@ -983,7 +1063,7 @@ Mon Feb 13 16:20:27 UTC 2017 - mchandras@suse.de
|
||||
* New services mssql, kibana, elasticsearch, quassel, bitcoin-rpc, bitcoin-testnet-rpc, bitcoin-testnet, bitcoin and spideroak-lansync
|
||||
* Translation updates
|
||||
- Add upstream patch to fix ipset overloading from /etc/firewalld/ipsets (gh#t-woerner/firewalld#206)
|
||||
* 0001-firewall.core.fw_ipset-get_ipset-may-not-ckeck-if-se.patch
|
||||
* 0001-firewall.core.fw_ipset-get_ipset-may-not-ckeck-if-se.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Dec 5 09:41:03 UTC 2016 - mchandras@suse.de
|
||||
|
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package firewalld
|
||||
#
|
||||
# Copyright (c) 2023 SUSE LLC
|
||||
# Copyright (c) 2025 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@@ -27,7 +27,7 @@
|
||||
%global modprobe_d_files firewalld-sysctls.conf
|
||||
|
||||
Name: firewalld
|
||||
Version: 2.0.0
|
||||
Version: 2.1.2
|
||||
Release: 0
|
||||
Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
|
||||
License: GPL-2.0-or-later
|
||||
@@ -35,9 +35,8 @@ Group: Productivity/Networking/Security
|
||||
URL: https://www.firewalld.org
|
||||
Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2
|
||||
Source1: docker-zone.xml
|
||||
Patch0: 0002-Disable-FlushAllOnReload-option.patch
|
||||
Patch1: firewalld-runstatedir.patch
|
||||
Patch2: fix_list_all_zones_output.patch
|
||||
Patch0: 0001-Disable-FlushAllOnReload-option.patch
|
||||
Patch1: 0002-firewalld-runstatedir.patch
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: automake
|
||||
BuildRequires: desktop-file-utils
|
||||
@@ -183,7 +182,9 @@ desktop-file-install --delete-original \
|
||||
%{_bindir}/install -c -D -m 600 %{buildroot}%{_sysconfdir}/sysconfig/firewalld %{buildroot}%{_fillupdir}/sysconfig.%{name}
|
||||
rm %{buildroot}%{_sysconfdir}/sysconfig/firewalld
|
||||
|
||||
%if 0%{?suse_version} < 1600
|
||||
ln -sf %{_sbindir}/service %{buildroot}/%{_sbindir}/rcfirewalld
|
||||
%endif
|
||||
|
||||
# add firewalld zone (rhbz#1817022)
|
||||
install -dp %{buildroot}%{_prefix}/lib/firewalld/zones
|
||||
@@ -203,6 +204,8 @@ mv %{buildroot}%{_sysconfdir}/logrotate.d/firewalld %{buildroot}%{_distconfdir}/
|
||||
|
||||
%find_lang %{name} --all-name
|
||||
|
||||
%python3_fix_shebang
|
||||
|
||||
%pre
|
||||
%service_add_pre firewalld.service
|
||||
# Avoid restoring outdated stuff in posttrans
|
||||
@@ -276,7 +279,9 @@ fi
|
||||
%doc README.md
|
||||
%license COPYING
|
||||
%{_sbindir}/firewalld
|
||||
%if 0%{?suse_version} < 1600
|
||||
%{_sbindir}/rcfirewalld
|
||||
%endif
|
||||
%{_bindir}/firewall-cmd
|
||||
%{_bindir}/firewall-offline-cmd
|
||||
%dir %{_prefix}/lib/firewalld
|
||||
@@ -286,12 +291,16 @@ fi
|
||||
%dir %{_prefix}/lib/firewalld/zones
|
||||
%dir %{_prefix}/lib/firewalld/helpers
|
||||
%dir %{_prefix}/lib/firewalld/policies
|
||||
%dir %{_prefix}/lib/firewalld/xmlschema
|
||||
%{_prefix}/lib/firewalld/icmptypes/*.xml
|
||||
%{_prefix}/lib/firewalld/ipsets/README.md
|
||||
%{_prefix}/lib/firewalld/services/*.xml
|
||||
%{_prefix}/lib/firewalld/zones/*.xml
|
||||
%{_prefix}/lib/firewalld/helpers/*.xml
|
||||
%{_prefix}/lib/firewalld/policies/*.xml
|
||||
%{_prefix}/lib/firewalld/xmlschema/check.sh
|
||||
%{_prefix}/lib/firewalld/xmlschema/*.xsd
|
||||
%{_datadir}/locale/en_*/LC_MESSAGES/firewalld.mo
|
||||
%{_datadir}/polkit-1
|
||||
%dir %{_datadir}/dbus-1
|
||||
%dir %{_datadir}/dbus-1/system.d
|
||||
@@ -381,5 +390,6 @@ fi
|
||||
%{_datadir}/zsh/site-functions/_firewalld
|
||||
|
||||
%files lang -f %{name}.lang
|
||||
%exclude %{_datadir}/locale/en_*/LC_MESSAGES/firewalld.mo
|
||||
|
||||
%changelog
|
||||
|
@@ -1,22 +0,0 @@
|
||||
commit f3cea0e8e2a290d4ce00de936d9b679fbd0e0484 f3cea0e
|
||||
Author: Eric Garver <eric@garver.life>
|
||||
Date: Mon Jul 10 15:59:42 2023 -0400
|
||||
|
||||
fix(cli): all --list-all-zones output identical
|
||||
|
||||
Fixes: #1152
|
||||
|
||||
diff --git a/src/firewall-cmd.in b/src/firewall-cmd.in
|
||||
index 062909e9..c327763f 100755
|
||||
--- a/src/firewall-cmd.in
|
||||
+++ b/src/firewall-cmd.in
|
||||
@@ -2448,7 +2448,8 @@ if a.permanent:
|
||||
names = fw.config().getZoneNames()
|
||||
for zone in sorted(names):
|
||||
interfaces = try_nm_get_interfaces_in_zone(zone)
|
||||
- cmd.print_zone_info(zone, settings, extra_interfaces=interfaces)
|
||||
+ cmd.print_zone_info(zone, fw.config().getZoneByName(zone).getSettings(),
|
||||
+ extra_interfaces=interfaces)
|
||||
cmd.print_msg("")
|
||||
sys.exit(0)
|
||||
|
Reference in New Issue
Block a user