firewalld/SOURCES/0035-RHEL-only-default-to-AllowZoneDrifting-yes.patch

From e9a5699dcb4e50dacbf1350b39a95dc9aef6cefa Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Tue, 4 Feb 2020 09:12:17 -0500
Subject: [PATCH 35/35] RHEL only: default to AllowZoneDrifting=yes

---
 config/firewalld.conf               | 4 ++--
 doc/xml/firewalld.conf.xml          | 2 +-
 doc/xml/firewalld.dbus.xml          | 2 +-
 src/firewall/config/__init__.py.in  | 2 +-
 src/tests/dbus/firewalld.conf.at    | 2 +-
 src/tests/features/rfc3964_ipv4.at  | 4 ++++
 src/tests/firewall-cmd.at           | 4 ++++
 src/tests/functions.at              | 1 +
 src/tests/regression/rhbz1514043.at | 4 ++++
 9 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/config/firewalld.conf b/config/firewalld.conf
index ebf8021226b7..6d0feb88f7c3 100644
--- a/config/firewalld.conf
+++ b/config/firewalld.conf
@@ -81,5 +81,5 @@ RFC3964_IPv4=yes
 # Note: If "yes" packets will only drift from source based zones to interface
 # based zones (including the default zone). Packets never drift from interface
 # based zones to other interfaces based zones (including the default zone).
-# Possible values; "yes", "no". Defaults to "no".
-AllowZoneDrifting=no
+# Possible values; "yes", "no". Defaults to "yes".
+AllowZoneDrifting=yes
diff --git a/doc/xml/firewalld.conf.xml b/doc/xml/firewalld.conf.xml
index 8108066e88bf..9574c567867f 100644
--- a/doc/xml/firewalld.conf.xml
+++ b/doc/xml/firewalld.conf.xml
@@ -197,7 +197,7 @@
                 to interface based zones (including the default zone). Packets
                 never drift from interface based zones to other interfaces
                 based zones (including the default zone).
-                Valid values; "yes", "no". Defaults to "no".
+                Valid values; "yes", "no". Defaults to "yes".
                 </para>
             </listitem>
         </varlistentry>
diff --git a/doc/xml/firewalld.dbus.xml b/doc/xml/firewalld.dbus.xml
index f72bad526d65..408787594035 100644
--- a/doc/xml/firewalld.dbus.xml
+++ b/doc/xml/firewalld.dbus.xml
@@ -2590,7 +2590,7 @@
                 to interface based zones (including the default zone). Packets
                 never drift from interface based zones to other interfaces
                 based zones (including the default zone).
-                Valid values; "yes", "no". Defaults to "no".
+                Valid values; "yes", "no". Defaults to "yes".
             </para></listitem>
           </varlistentry>
           <varlistentry id="FirewallD1.config.Properties.AutomaticHelpers">
diff --git a/src/firewall/config/__init__.py.in b/src/firewall/config/__init__.py.in
index c009d93e4164..fbef1828c8aa 100644
--- a/src/firewall/config/__init__.py.in
+++ b/src/firewall/config/__init__.py.in
@@ -132,4 +132,4 @@ FALLBACK_AUTOMATIC_HELPERS = "system"
 FALLBACK_FIREWALL_BACKEND = "nftables"
 FALLBACK_FLUSH_ALL_ON_RELOAD = True
 FALLBACK_RFC3964_IPV4 = True
-FALLBACK_ALLOW_ZONE_DRIFTING = False
+FALLBACK_ALLOW_ZONE_DRIFTING = True
diff --git a/src/tests/dbus/firewalld.conf.at b/src/tests/dbus/firewalld.conf.at
index 65ac702f4713..de3780e5b5e4 100644
--- a/src/tests/dbus/firewalld.conf.at
+++ b/src/tests/dbus/firewalld.conf.at
@@ -3,7 +3,7 @@ AT_KEYWORDS(dbus)
 
 dnl Verify defaults over dbus. Should be inline with default firewalld.conf.
 DBUS_GETALL([config], [config], 0, [dnl
-string "AllowZoneDrifting" : variant string "no"
+string "AllowZoneDrifting" : variant string "yes"
 string "AutomaticHelpers" : variant string "system"
 string "CleanupOnExit" : variant string "no"
 string "DefaultZone" : variant string "public"
diff --git a/src/tests/features/rfc3964_ipv4.at b/src/tests/features/rfc3964_ipv4.at
index 54f5f756270b..15fef52612cc 100644
--- a/src/tests/features/rfc3964_ipv4.at
+++ b/src/tests/features/rfc3964_ipv4.at
@@ -1,6 +1,10 @@
 FWD_START_TEST([RFC3964_IPv4])
 AT_KEYWORDS(rfc3964_ipv4)
 
+dnl Expected test results assume this is set to "no"
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+FWD_RELOAD
+
 AT_CHECK([sed -i 's/^LogDenied.*/LogDenied=all/' ./firewalld.conf])
 AT_CHECK([sed -i 's/^RFC3964_IPv4.*/RFC3964_IPv4=yes/' ./firewalld.conf])
 FWD_RELOAD
diff --git a/src/tests/firewall-cmd.at b/src/tests/firewall-cmd.at
index 53f2eb2c7c88..ad6ed9540c7f 100644
--- a/src/tests/firewall-cmd.at
+++ b/src/tests/firewall-cmd.at
@@ -970,6 +970,10 @@ FWD_START_TEST([rich rules priority])
 
     CHECK_LOG_AUDIT
 
+    dnl Expected test results assume this is set to "no"
+    AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+    FWD_RELOAD
+
     dnl Verify generic layout of zone
     NFT_LIST_RULES([inet], [filter_IN_public], 0, [dnl
         table inet firewalld {
diff --git a/src/tests/functions.at b/src/tests/functions.at
index 3771bb8bd5a7..ef7c696ddf73 100644
--- a/src/tests/functions.at
+++ b/src/tests/functions.at
@@ -149,6 +149,7 @@ m4_define([FWD_END_TEST], [
         IF_IPV6_SUPPORTED([], [
             sed -i "/WARNING: ip6tables not usable, disabling IPv6 firewall/d" ./firewalld.log
         ])
+        sed -i "/WARNING: AllowZoneDrifting is enabled./d" ./firewalld.log
         if test x"$1" != x"ignore"; then
             if test -n "$1"; then
                 sed -i $1 ./firewalld.log
diff --git a/src/tests/regression/rhbz1514043.at b/src/tests/regression/rhbz1514043.at
index 241cf547f7f3..8e4846a078b8 100644
--- a/src/tests/regression/rhbz1514043.at
+++ b/src/tests/regression/rhbz1514043.at
@@ -1,6 +1,10 @@
 FWD_START_TEST([--set-log-denied does not zero config])
 AT_KEYWORDS(log_denied rhbz1514043)
 
+dnl Expected test results assume this is set to "no"
+AT_CHECK([sed -i 's/^AllowZoneDrifting.*/AllowZoneDrifting=no/' ./firewalld.conf])
+FWD_RELOAD
+
 FWD_CHECK([-q --set-log-denied=all])
 FWD_CHECK([-q --permanent --zone=public --add-service=samba])
 FWD_RELOAD
-- 
2.23.0