Accepting request 791192 from security:netfilter

OBS-URL: https://build.opensuse.org/request/show/791192
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/firewalld?expand=0&rev=47

0001-firewall-backend-Switch-default-backend-to-iptables.patch

@@ -1,6 +1,6 @@
-diff -burNE firewalld-0.7.2_orig/config/firewalld.conf firewalld-0.7.2/config/firewalld.conf
+diff -burNE firewalld-0.7.4_orig/config/firewalld.conf firewalld-0.7.4/config/firewalld.conf
---- firewalld-0.7.2_orig/config/firewalld.conf	2019-10-10 14:29:04.022394133 +0200
+--- firewalld-0.7.4_orig/config/firewalld.conf	2020-04-03 09:45:04.363964087 +0200
-+++ firewalld-0.7.2/config/firewalld.conf	2019-10-10 14:30:12.102256167 +0200
++++ firewalld-0.7.4/config/firewalld.conf	2020-04-03 09:45:21.495215479 +0200
 @@ -53,9 +53,9 @@
  # FirewallBackend
  # Selects the firewall backend implementation.
@@ -14,9 +14,9 @@ diff -burNE firewalld-0.7.2_orig/config/firewalld.conf firewalld-0.7.2/config/fi
  
  # FlushAllOnReload
  # Flush all runtime rules on a reload. In previous releases some runtime
-diff -burNE firewalld-0.7.2_orig/doc/xml/firewalld.conf.xml firewalld-0.7.2/doc/xml/firewalld.conf.xml
+diff -burNE firewalld-0.7.4_orig/doc/xml/firewalld.conf.xml firewalld-0.7.4/doc/xml/firewalld.conf.xml
---- firewalld-0.7.2_orig/doc/xml/firewalld.conf.xml	2019-10-10 14:29:04.026394125 +0200
+--- firewalld-0.7.4_orig/doc/xml/firewalld.conf.xml	2020-04-03 09:45:05.071933150 +0200
-+++ firewalld-0.7.2/doc/xml/firewalld.conf.xml	2019-10-10 14:29:19.766362228 +0200
++++ firewalld-0.7.4/doc/xml/firewalld.conf.xml	2020-04-03 09:45:21.499215305 +0200
 @@ -149,8 +149,8 @@
              <listitem>
                  <para>
@@ -28,10 +28,10 @@ diff -burNE firewalld-0.7.2_orig/doc/xml/firewalld.conf.xml firewalld-0.7.2/doc/
                  firewalld primitives. The only exception is direct and
                  passthrough rules which always use the traditional iptables,
                  ip6tables, and ebtables backends.
-diff -burNE firewalld-0.7.2_orig/src/firewall/config/__init__.py.in firewalld-0.7.2/src/firewall/config/__init__.py.in
+diff -burNE firewalld-0.7.4_orig/src/firewall/config/__init__.py.in firewalld-0.7.4/src/firewall/config/__init__.py.in
---- firewalld-0.7.2_orig/src/firewall/config/__init__.py.in	2019-10-10 14:29:04.030394117 +0200
+--- firewalld-0.7.4_orig/src/firewall/config/__init__.py.in	2020-04-03 09:45:05.367920215 +0200
-+++ firewalld-0.7.2/src/firewall/config/__init__.py.in	2019-10-10 14:31:06.522145883 +0200
++++ firewalld-0.7.4/src/firewall/config/__init__.py.in	2020-04-03 09:45:21.503215130 +0200
-@@ -129,6 +129,6 @@
+@@ -128,7 +128,7 @@
  FALLBACK_INDIVIDUAL_CALLS = False
  FALLBACK_LOG_DENIED = "off"
  FALLBACK_AUTOMATIC_HELPERS = "system"
@@ -39,3 +39,4 @@ diff -burNE firewalld-0.7.2_orig/src/firewall/config/__init__.py.in firewalld-0.
 +FALLBACK_FIREWALL_BACKEND = "iptables"
  FALLBACK_FLUSH_ALL_ON_RELOAD = True
  FALLBACK_RFC3964_IPV4 = True
+ FALLBACK_ALLOW_ZONE_DRIFTING = False

_service

@@ -5,7 +5,7 @@
     <param name="filename">firewalld</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(.*)</param>
-    <param name="revision">v0.7.3</param>
+    <param name="revision">v0.7.4</param>
     <param name="changesgenerate">enable</param>
   </service>
   <service mode="buildtime" name="tar" />

_servicedata

@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/firewalld/firewalld</param>
-              <param name="changesrevision">f694f8ebd99f9e16bf84075d177ced4a11469587</param></service></servicedata>
+              <param name="changesrevision">3b60ab81bcb911551fa1d3b29a597be1a0202f08</param></service></servicedata>

firewalld-0.7.3.obscpio

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:0e85338636f58dd4eb50cb10c79ee29df22c440553e2acf1e37b0b7931a5aaa9
-size 7198221

firewalld-0.7.4.obscpio

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2d7f994d3d46c8f1249d4bd3748a1efc9b5ee3df48723ffeedf9986b86e04314
+size 7280141

firewalld.changes

@@ -1,3 +1,36 @@
+-------------------------------------------------------------------
+Fri Apr  3 07:39:02 UTC 2020 - Mathias Homann <Mathias.Homann@opensuse.org>
+
+- Update to 0.7.4
+
+This is a bug fix only release.
+However, it does reintroduce the zone drifting bug as a feature. See #258 and #441. This behavior is disabled by default.
+
+  * improvement: build: add an option to disable building documentation
+  * Typo in firewall-config(1)
+  * Fix typo in TFTP service description
+  * doc: README: add note about language translations
+  * fix: rich: source/dest only matching with mark action
+  * feat: AllowZoneDrifting config option
+  * feat: nftables: support AllowZoneDrifting=yes
+  * feat: ipXtables: support AllowZoneDrifting=yes
+  * fix: firewall-offline-cmd: Don't print warning about AllowZoneDrifting
+  * fix: add logrotate policy
+  * fix: tests: regenerate testsuite if .../{cli,python}/*.at changes
+  * doc: direct: add CAVEATS section
+  * fix: checkIP6: strip leading/trailing square brackets
+  * fix: nftables: remove square brackets from IPv6 addresses
+  * fix: ipXtables: remove square brackets from IPv6 addresses
+  * fix: nftables: zone dispatch with multidimensional ipsets
+  * fix: ipset: destroy runtime sets on reload/stop
+  * fix: port: support querying sub ranges
+  * fix: source_port: support querying sub ranges
+  * doc: specify accepted characters for object names
+  * fix: doc: address copy/paste mistakes in short/description
+  * fix: configure: atlocal: quote variable values
+  * fix: nftables: allow set intervals with concatenations
+  * doc: clarify --set-target values "default" vs "reject"
+
 -------------------------------------------------------------------
 Sun Mar 08 17:20:42 UTC 2020 - hpj@urpla.net
 

firewalld.obsinfo

@@ -1,5 +1,5 @@
 name: firewalld
-version: 0.7.3
+version: 0.7.4
-mtime: 1578424716
+mtime: 1585773847
-commit: f694f8ebd99f9e16bf84075d177ced4a11469587
+commit: 3b60ab81bcb911551fa1d3b29a597be1a0202f08
 

firewalld.spec

@@ -21,7 +21,7 @@
   %define _fillupdir %{_localstatedir}/adm/fillup-templates
 %endif
 Name:           firewalld
-Version:        0.7.3
+Version:        0.7.4
 Release:        0
 Summary:        A firewall daemon with D-Bus interface providing a dynamic firewall
 License:        GPL-2.0-or-later
@@ -228,6 +228,7 @@ fi
 %config(noreplace) %{_sysconfdir}/modprobe.d/firewalld-sysctls.conf
 %config(noreplace) %{_sysconfdir}/firewalld/firewalld.conf
 %config(noreplace) %{_sysconfdir}/firewalld/lockdown-whitelist.xml
+%config(noreplace) %{_sysconfdir}/logrotate.d/firewalld
 %attr(0750,root,root) %dir %{_sysconfdir}/firewalld
 %attr(0750,root,root) %dir %{_sysconfdir}/firewalld/icmptypes
 %attr(0750,root,root) %dir %{_sysconfdir}/firewalld/services