rpm/firewalld
SHA256
1
0
Fork 0
forked from pool/firewalld
Code Pull Requests Activity
2f305546a6
firewalld/0002-Disable-FlushAllOnReload-option.patch

58 lines
2.2 KiB
Diff
Raw Normal View History

Accepting request 866966 from home:mrostecki:branches:security:netfilter - Disable FlushAllOnReload option to not retain interface to zone assignments and direct rules when using --reload option. * 0002-Disable-FlushAllOnReload-option.patch OBS-URL: https://build.opensuse.org/request/show/866966 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=110
2021-01-26 17:36:13 +01:00
From b1145d3efc58220f58a4e67189c4ff4a8bd789ce Mon Sep 17 00:00:00 2001
From: Michal Rostecki <mrostecki@opensuse.org>
Date: Mon, 25 Jan 2021 12:58:00 +0100
Subject: [PATCH] Disable FlushAllOnReload option
Disabling the FlushAllOnReload option restores the old behavior where
--reload does not retain interface to zone assignmnets and direct rules.
We want to keep that behavior in openSUSE and SLE
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
---
config/firewalld.conf | 4 ++--
doc/xml/firewalld.conf.xml | 2 +-
src/firewall/config/__init__.py.in | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
Accepting request 1095078 from home:msaquib:branches:security:netfilter - update to version 2.0.0: * This is a major release. The major version is being bumped symbolically to reflect significant changes done in commit f4d2b80 ("fix(policy): disallow zone drifting"). It does not contain any deliberate breaking changes. * Complete changelog: https://github.com/firewalld/firewalld/releases/tag/v2.0.0 OBS-URL: https://build.opensuse.org/request/show/1095078 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=147
2023-06-24 17:10:37 +02:00
diff --git a/config/firewalld.conf b/config/firewalld.conf
index 7c9305e..43663b3 100644
--- a/config/firewalld.conf
+++ b/config/firewalld.conf
Accepting request 1033086 from home:polslinux:branches:security:netfilter - Update to 1.2.1: * fix(modules): don't error if /proc/modules is missing (a1f091d) * fix(readme): format optional <ver> (03e61f2) * docs: add protocols to rich and zones (191cea4) * docs(policy): add priority attribute to rule (616ed7c) * fix(runtimeToPermanent): errors for interfaces not in zone (6b5a70b) * fix(failsafe): log exception on fatal failure (af1b8f0) * fix(ipset): defer native ipset creation if nftables (ae0ded4) * fix(nftables): drop invalid packets before zone dispatch (dc972ae) * fix(iptables): drop invalid packets before zone dispatch (83a4608) * fix(policies): Splitting interfaces with wildcards (3806e79) * fix(ipset): exception on overlap checking empty set (bfe827f) * fix(bash): fix ipset commands autocompletion (742669b) * docs(README): fix typo (e40b100) * fix(treewide): misc typos (d121f0c) * fix: firewalld.conf: trim trailing whitespace (21809ed) OBS-URL: https://build.opensuse.org/request/show/1033086 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=133
2022-11-04 20:21:10 +01:00
@@ -63,8 +63,8 @@ FirewallBackend=nftables
Accepting request 866966 from home:mrostecki:branches:security:netfilter - Disable FlushAllOnReload option to not retain interface to zone assignments and direct rules when using --reload option. * 0002-Disable-FlushAllOnReload-option.patch OBS-URL: https://build.opensuse.org/request/show/866966 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=110
2021-01-26 17:36:13 +01:00
# configuration was retained during a reload, namely; interface to zone
# assignment, and direct rules. This was confusing to users. To get the old
# behavior set this to "no".
-# Default: yes
-FlushAllOnReload=yes
+# Default: no
+FlushAllOnReload=no
# RFC3964_IPv4
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
Accepting request 1095078 from home:msaquib:branches:security:netfilter - update to version 2.0.0: * This is a major release. The major version is being bumped symbolically to reflect significant changes done in commit f4d2b80 ("fix(policy): disallow zone drifting"). It does not contain any deliberate breaking changes. * Complete changelog: https://github.com/firewalld/firewalld/releases/tag/v2.0.0 OBS-URL: https://build.opensuse.org/request/show/1095078 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=147
2023-06-24 17:10:37 +02:00
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
index 1b74f70..a45c8df 100644
--- a/doc/xml/firewalld.conf.xml
+++ b/doc/xml/firewalld.conf.xml
Accepting request 1033086 from home:polslinux:branches:security:netfilter - Update to 1.2.1: * fix(modules): don't error if /proc/modules is missing (a1f091d) * fix(readme): format optional <ver> (03e61f2) * docs: add protocols to rich and zones (191cea4) * docs(policy): add priority attribute to rule (616ed7c) * fix(runtimeToPermanent): errors for interfaces not in zone (6b5a70b) * fix(failsafe): log exception on fatal failure (af1b8f0) * fix(ipset): defer native ipset creation if nftables (ae0ded4) * fix(nftables): drop invalid packets before zone dispatch (dc972ae) * fix(iptables): drop invalid packets before zone dispatch (83a4608) * fix(policies): Splitting interfaces with wildcards (3806e79) * fix(ipset): exception on overlap checking empty set (bfe827f) * fix(bash): fix ipset commands autocompletion (742669b) * docs(README): fix typo (e40b100) * fix(treewide): misc typos (d121f0c) * fix: firewalld.conf: trim trailing whitespace (21809ed) OBS-URL: https://build.opensuse.org/request/show/1033086 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=133
2022-11-04 20:21:10 +01:00
@@ -190,7 +190,7 @@
Accepting request 866966 from home:mrostecki:branches:security:netfilter - Disable FlushAllOnReload option to not retain interface to zone assignments and direct rules when using --reload option. * 0002-Disable-FlushAllOnReload-option.patch OBS-URL: https://build.opensuse.org/request/show/866966 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=110
2021-01-26 17:36:13 +01:00
runtime configuration was retained during a reload, namely;
interface to zone assignment, and direct rules. This was
confusing to users. To get the old behavior set this to "no".
- Defaults to "yes".
+ Defaults to "no".
</para>
</listitem>
</varlistentry>
Accepting request 1095078 from home:msaquib:branches:security:netfilter - update to version 2.0.0: * This is a major release. The major version is being bumped symbolically to reflect significant changes done in commit f4d2b80 ("fix(policy): disallow zone drifting"). It does not contain any deliberate breaking changes. * Complete changelog: https://github.com/firewalld/firewalld/releases/tag/v2.0.0 OBS-URL: https://build.opensuse.org/request/show/1095078 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=147
2023-06-24 17:10:37 +02:00
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
index 468daf5..5ec116c 100644
--- a/src/firewall/config/__init__.py.in
+++ b/src/firewall/config/__init__.py.in
@@ -132,7 +132,7 @@ FALLBACK_INDIVIDUAL_CALLS = False
Accepting request 866966 from home:mrostecki:branches:security:netfilter - Disable FlushAllOnReload option to not retain interface to zone assignments and direct rules when using --reload option. * 0002-Disable-FlushAllOnReload-option.patch OBS-URL: https://build.opensuse.org/request/show/866966 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=110
2021-01-26 17:36:13 +01:00
FALLBACK_LOG_DENIED = "off"
FALLBACK_AUTOMATIC_HELPERS = "no"
FALLBACK_FIREWALL_BACKEND = "nftables"
-FALLBACK_FLUSH_ALL_ON_RELOAD = True
+FALLBACK_FLUSH_ALL_ON_RELOAD = False
FALLBACK_RFC3964_IPV4 = True
FALLBACK_ALLOW_ZONE_DRIFTING = False
Accepting request 1095078 from home:msaquib:branches:security:netfilter - update to version 2.0.0: * This is a major release. The major version is being bumped symbolically to reflect significant changes done in commit f4d2b80 ("fix(policy): disallow zone drifting"). It does not contain any deliberate breaking changes. * Complete changelog: https://github.com/firewalld/firewalld/releases/tag/v2.0.0 OBS-URL: https://build.opensuse.org/request/show/1095078 OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=147
2023-06-24 17:10:37 +02:00
FALLBACK_NFTABLES_FLOWTABLE = "off"
Copy Permalink