rebase to v1.2.1
Resolves: rhbz2077512 Resolves: rhbz2122678 Resolves: rhbz2125371 Resolves: rhbz2139476
This commit is contained in:
Eric Garver
parent
66a037bb45
commit
23d3ec8f9c
1
.gitignore
vendored
1
.gitignore
vendored
@ -67,3 +67,4 @@
|
||||
/firewalld-1.0.0-alpha.tar.gz
|
||||
/firewalld-1.0.0.tar.gz
|
||||
/firewalld-1.1.1.tar.gz
|
||||
/firewalld-1.2.1.tar.gz
|
||||
|
||||
@ -1,46 +0,0 @@
|
||||
From ba20c6cb0a516545404e5e02cddf3b1d01fac79b Mon Sep 17 00:00:00 2001
|
||||
From: Eric Garver <eric@garver.life>
|
||||
Date: Tue, 5 Jul 2022 15:43:19 -0400
|
||||
Subject: [PATCH 2/3] test(functions): commonize iptables output normalization
|
||||
|
||||
Share rule normalization between iptables and ip6tables.
|
||||
|
||||
(cherry picked from commit 54e761a0fe2d19dfc4c0c898540f718c837778a9)
|
||||
---
|
||||
src/tests/functions.at | 9 ++++++---
|
||||
1 file changed, 6 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/tests/functions.at b/src/tests/functions.at
|
||||
index 557acf0257e4..481c94017f15 100644
|
||||
--- a/src/tests/functions.at
|
||||
+++ b/src/tests/functions.at
|
||||
@@ -393,11 +393,15 @@ m4_define([EBTABLES_LIST_RULES], [
|
||||
])
|
||||
])
|
||||
|
||||
-m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl
|
||||
+m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl
|
||||
TRIM_WHITESPACE | dnl
|
||||
tail -n +3 dnl
|
||||
])
|
||||
|
||||
+m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl
|
||||
+ IPXTABLES_LIST_RULES_NORMALIZE() dnl
|
||||
+])
|
||||
+
|
||||
m4_define([IPTABLES_LIST_RULES_ALWAYS], [
|
||||
m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [
|
||||
NS_CHECK([PIPESTATUS0([$IPTABLES -w -n -t $1 -L $2], [IPTABLES_LIST_RULES_NORMALIZE])],
|
||||
@@ -412,8 +416,7 @@ m4_define([IPTABLES_LIST_RULES], [
|
||||
])
|
||||
|
||||
m4_define([IP6TABLES_LIST_RULES_NORMALIZE], [dnl
|
||||
- TRIM_WHITESPACE | dnl
|
||||
- tail -n +3 dnl
|
||||
+ IPXTABLES_LIST_RULES_NORMALIZE() dnl
|
||||
])
|
||||
|
||||
m4_define([IP6TABLES_LIST_RULES_ALWAYS], [
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,34 +0,0 @@
|
||||
From 68276da6dda3f73dfed5e6758675a5148ac77271 Mon Sep 17 00:00:00 2001
|
||||
From: Eric Garver <eric@garver.life>
|
||||
Date: Tue, 5 Jul 2022 14:38:34 -0400
|
||||
Subject: [PATCH 3/3] test(functions): normalize iptables ipv6-icmp/icmpv6
|
||||
|
||||
The output changed in iptables 1.8.8. Specifically commit b6196c7504d4
|
||||
("xshared: Prefer xtables_chain_protos lookup over getprotoent").
|
||||
|
||||
Fixes: #982
|
||||
Fixes: rhbz2100881
|
||||
(cherry picked from commit c54ea7b5e492b3aae631dc71579afc24d713401f)
|
||||
---
|
||||
src/tests/functions.at | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/tests/functions.at b/src/tests/functions.at
|
||||
index 481c94017f15..a38ae9005ea2 100644
|
||||
--- a/src/tests/functions.at
|
||||
+++ b/src/tests/functions.at
|
||||
@@ -395,7 +395,10 @@ m4_define([EBTABLES_LIST_RULES], [
|
||||
|
||||
m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl
|
||||
TRIM_WHITESPACE | dnl
|
||||
- tail -n +3 dnl
|
||||
+ tail -n +3 | dnl
|
||||
+ dnl iptables-1.8.8 changed output of some protocols
|
||||
+ dnl commit b6196c7504d4 ("xshared: Prefer xtables_chain_protos lookup over getprotoent")
|
||||
+ sed -e ['s/[ ]ipv6-icmp\([ -]\)/ icmpv6\1/g'] dnl
|
||||
])
|
||||
|
||||
m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,42 +0,0 @@
|
||||
From f9e0fdd188e7730468bebdf35f573f2a1ef6bd9b Mon Sep 17 00:00:00 2001
|
||||
From: Eric Garver <eric@garver.life>
|
||||
Date: Tue, 2 Aug 2022 13:11:31 -0400
|
||||
Subject: [PATCH 4/5] fix(runtimeToPermanent): errors for interfaces not in
|
||||
zone
|
||||
|
||||
We should only consider the interfaces for the currently iterated over
|
||||
zone. Otherwise we will attempt to remove an interface from a zone for
|
||||
which it is does not belong.
|
||||
|
||||
Note this only occurs when NetworkManager is running.
|
||||
|
||||
Fixes: #976
|
||||
Fixes: rhbz2112982
|
||||
(cherry picked from commit 15f47354c4a078dc694df1541550b3e5156548fc)
|
||||
---
|
||||
src/firewall/server/firewalld.py | 9 +++++----
|
||||
1 file changed, 5 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
|
||||
index 5cf963dfbbd4..f5f902d6e712 100644
|
||||
--- a/src/firewall/server/firewalld.py
|
||||
+++ b/src/firewall/server/firewalld.py
|
||||
@@ -447,10 +447,11 @@ class FirewallD(DbusServiceObject):
|
||||
conf = self.getZoneSettings2(name)
|
||||
settings = FirewallClientZoneSettings(conf)
|
||||
changed = False
|
||||
- for interface in self.fw._nm_assigned_interfaces:
|
||||
- log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface))
|
||||
- settings.removeInterface(interface)
|
||||
- changed = True
|
||||
+ for interface in settings.getInterfaces():
|
||||
+ if interface in self.fw._nm_assigned_interfaces:
|
||||
+ log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface))
|
||||
+ settings.removeInterface(interface)
|
||||
+ changed = True
|
||||
# For the remaining interfaces, attempt to let NM manage them
|
||||
for interface in settings.getInterfaces():
|
||||
try:
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,47 +0,0 @@
|
||||
From 5300da5cbb6c696baad71fb85ca36e65ab5ba292 Mon Sep 17 00:00:00 2001
|
||||
From: Eric Garver <eric@garver.life>
|
||||
Date: Mon, 1 Aug 2022 14:43:23 -0400
|
||||
Subject: [PATCH 5/5] test(runtimeToPermanent): verify when NM interfaces
|
||||
present
|
||||
|
||||
Coverage: #976
|
||||
Coverage: rhbz2112982
|
||||
(cherry picked from commit f4f67413e4db7c789bf9d7ba8e983505a6e6e6df)
|
||||
---
|
||||
src/tests/integration/gh976.at | 14 ++++++++++++++
|
||||
src/tests/integration/networkmanager.at | 1 +
|
||||
2 files changed, 15 insertions(+)
|
||||
create mode 100644 src/tests/integration/gh976.at
|
||||
|
||||
diff --git a/src/tests/integration/gh976.at b/src/tests/integration/gh976.at
|
||||
new file mode 100644
|
||||
index 000000000000..977eca997a3a
|
||||
--- /dev/null
|
||||
+++ b/src/tests/integration/gh976.at
|
||||
@@ -0,0 +1,14 @@
|
||||
+FWD_START_TEST([interfaces during runtime to permanent])
|
||||
+AT_KEYWORDS(gh976 rhbz2112982)
|
||||
+
|
||||
+START_NETWORKMANAGER()
|
||||
+
|
||||
+NMCLI_CHECK([connection add type dummy con-name dummy0 ifname dummy0 ip4 10.0.0.2 gw4 10.0.0.1], 0, [ignore])
|
||||
+echo NS_CMD([nmcli connection delete dummy0]) >> ./cleanup
|
||||
+NMCLI_CHECK([connection show dummy0], 0, [ignore])
|
||||
+NMCLI_CHECK([connection up dummy0], 0, [ignore])
|
||||
+
|
||||
+FWD_CHECK([--add-service smtp], 0, [ignore])
|
||||
+FWD_CHECK([--runtime-to-permanent], 0, [ignore])
|
||||
+
|
||||
+FWD_END_TEST()
|
||||
diff --git a/src/tests/integration/networkmanager.at b/src/tests/integration/networkmanager.at
|
||||
index 0b20adce0462..c93e92d70754 100644
|
||||
--- a/src/tests/integration/networkmanager.at
|
||||
+++ b/src/tests/integration/networkmanager.at
|
||||
@@ -1,3 +1,4 @@
|
||||
AT_BANNER([NetworkManager (FIREWALL_BACKEND)])
|
||||
m4_include([integration/rhbz1773809.at])
|
||||
m4_include([integration/rhbz1928860.at])
|
||||
+m4_include([integration/gh976.at])
|
||||
--
|
||||
2.31.1
|
||||
|
||||
@ -1,15 +1,11 @@
|
||||
Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
|
||||
Name: firewalld
|
||||
Version: 1.1.1
|
||||
Release: 3%{?dist}
|
||||
Version: 1.2.1
|
||||
Release: 1%{?dist}
|
||||
URL: http://www.firewalld.org
|
||||
License: GPLv2+
|
||||
Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz
|
||||
Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
|
||||
Patch2: 0002-test-functions-commonize-iptables-output-normalizati.patch
|
||||
Patch3: 0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch
|
||||
Patch4: 0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch
|
||||
Patch5: 0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch
|
||||
BuildArch: noarch
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: automake
|
||||
@ -141,7 +137,7 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
|
||||
%systemd_postun_with_restart firewalld.service
|
||||
|
||||
%files -f %{name}.lang
|
||||
%doc COPYING README
|
||||
%doc COPYING README.md
|
||||
%{_sbindir}/firewalld
|
||||
%{_bindir}/firewall-cmd
|
||||
%{_bindir}/firewall-offline-cmd
|
||||
@ -150,7 +146,7 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
|
||||
%dir %{_datadir}/zsh/site-functions
|
||||
%{_datadir}/zsh/site-functions/_firewalld
|
||||
%{_prefix}/lib/firewalld/icmptypes/*.xml
|
||||
%{_prefix}/lib/firewalld/ipsets/README
|
||||
%{_prefix}/lib/firewalld/ipsets/README.md
|
||||
%{_prefix}/lib/firewalld/policies/*.xml
|
||||
%{_prefix}/lib/firewalld/services/*.xml
|
||||
%{_prefix}/lib/firewalld/zones/*.xml
|
||||
@ -231,6 +227,9 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
|
||||
%{_mandir}/man1/firewall-config*.1*
|
||||
|
||||
%changelog
|
||||
* Mon Nov 07 2022 Eric Garver <egarver@redhat.com> - 1.2.1-1
|
||||
- package rebase to v1.2.1
|
||||
|
||||
* Wed Aug 03 2022 Eric Garver <egarver@redhat.com> - 1.1.1-3
|
||||
- fix(runtimeToPermanent): errors for interfaces not in zone
|
||||
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (firewalld-1.1.1.tar.gz) = d869e40ffba2687e8aa56d6c6b4440d183ad5a61f5288824794737cb617b91bf83a8198256834c93baa432efc70ebfc36fd068dccd4f46f391fcfac909f6ef1f
|
||||
SHA512 (firewalld-1.2.1.tar.gz) = a9b2d7346291d0c54e850913f2d40a08d121d64df75ee87655fa2ee022ade908c762e5b6d372d4e8879eec1138f73635ee9398cdb3703efe67039769c5e2a42a
|
||||
|
||||
Loading…
Reference in New Issue
Block a user