SHA256
1
0
forked from pool/firewalld
firewalld/0001-Disable-FlushAllOnReload-option.patch
Mohd Saquib d2da4cedb0 Accepting request 1137493 from home:msaquib:branches:security:netfilter
- update to 2.1.0:
  * eat(service): add DNS over QUIC (DoQ) Service (5130430)
  * feat(icmp): add ICMPv6 Multicast Listener Discovery (MLD) types (dd88bbf)
  * feat(fw): add ReloadPolicy option in firewalld.conf (0019371)
  * feat(service): add submission service (tcp 587) (d6a9561)
  * feat(service): Add alvr (3a92358)
  * feat(service): add vrrp (d62fc8d)
  [* Renamed patch 0002-Disable-FlushAllOnReload-option.patch to
     0001-Disable-FlushAllOnReload-option.patch
  [* Renamed patch firewalld-runstatedir.patch to 0002-firewalld-runstatedir.patch]

OBS-URL: https://build.opensuse.org/request/show/1137493
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/firewalld?expand=0&rev=158
2024-01-08 08:29:12 +00:00

69 lines
2.7 KiB
Diff

From 98c87acce02c1963644455933ce7c2d40015d295 Mon Sep 17 00:00:00 2001
From: Mohd Saquib <mohd.saquib@suse.com>
Date: Mon, 8 Jan 2024 12:34:35 +0530
Subject: [PATCH] Disable FlushAllOnReload option by default
Disabling the FlushAllOnReload option restores the old behavior where
--reload does not retain interface to zone assignmnets and direct rules.
We want to keep that behavior in openSUSE and SLE
Signed-off-by: Michal Rostecki <mrostecki@opensuse.org>
Signed-off-by: Mohd Saquib <mohd.saquib@suse.com>
---
config/firewalld.conf | 8 ++++----
doc/xml/firewalld.conf.xml | 4 ++--
src/firewall/config/__init__.py.in | 2 +-
3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/config/firewalld.conf b/config/firewalld.conf
index 2d1a0cb..af42478 100644
--- a/config/firewalld.conf
+++ b/config/firewalld.conf
@@ -61,10 +61,10 @@ FirewallBackend=nftables
# FlushAllOnReload
# Flush all runtime rules on a reload. In previous releases some runtime
# configuration was retained during a reload, namely; interface to zone
-# assignment, and direct rules. This was confusing to users. To get the old
-# behavior set this to "no".
-# Default: yes
-FlushAllOnReload=yes
+# assignment, and direct rules. This was confusing to users. To override this
+# behavior set this to "yes".
+# Default: no
+FlushAllOnReload=no
# ReloadPolicy
# Policy during reload. By default all traffic except for established
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
index 6bb8069..e226113 100644
--- a/doc/xml/firewalld.conf.xml
+++ b/doc/xml/firewalld.conf.xml
@@ -179,8 +179,8 @@
Flush all runtime rules on a reload. In previous releases some
runtime configuration was retained during a reload, namely;
interface to zone assignment, and direct rules. This was
- confusing to users. To get the old behavior set this to "no".
- Defaults to "yes".
+ confusing to users. To override this behavior set this to "yes".
+ Defaults to "no".
</para>
</listitem>
</varlistentry>
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
index 12b694e..2c7be57 100644
--- a/src/firewall/config/__init__.py.in
+++ b/src/firewall/config/__init__.py.in
@@ -124,7 +124,7 @@ FALLBACK_INDIVIDUAL_CALLS = False
FALLBACK_LOG_DENIED = "off"
FALLBACK_AUTOMATIC_HELPERS = "no"
FALLBACK_FIREWALL_BACKEND = "nftables"
-FALLBACK_FLUSH_ALL_ON_RELOAD = True
+FALLBACK_FLUSH_ALL_ON_RELOAD = False
FALLBACK_RELOAD_POLICY = "INPUT:DROP,FORWARD:DROP,OUTPUT:DROP"
FALLBACK_RFC3964_IPV4 = True
FALLBACK_ALLOW_ZONE_DRIFTING = False
--
2.35.3