rebase to v1.2.5

With addition:

- feat(direct): avoid iptables flush if using nftables backend

Resolves: rhbz2221175

.gitignore

@@ -68,3 +68,4 @@
 /firewalld-1.0.0.tar.gz
 /firewalld-1.1.1.tar.gz
 /firewalld-1.2.1.tar.gz
+/firewalld-1.2.5.tar.gz

0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch

@@ -1,16 +1,17 @@
-From 174b42b2943200a7b2ec2dab6c3445158aa04aba Mon Sep 17 00:00:00 2001
+From f3fa74bb2710b0089db4026443ae67c4cabae1e1 Mon Sep 17 00:00:00 2001
 From: Eric Garver <egarver@redhat.com>
 Date: Tue, 25 May 2021 13:31:41 -0400
-Subject: [PATCH] RHEL only: Add cockpit by default to some zones
+Subject: [PATCH 1/4] RHEL only: Add cockpit by default to some zones
 
 Fixes: #1581578
 ---
- config/zones/home.xml     |  1 +
+ config/zones/home.xml                  |  1 +
- config/zones/internal.xml |  1 +
+ config/zones/internal.xml              |  1 +
- config/zones/public.xml   |  1 +
+ config/zones/public.xml                |  1 +
- config/zones/work.xml     |  1 +
+ config/zones/work.xml                  |  1 +
- src/tests/functions.at    | 20 ++++++++++++++++++++
+ src/tests/features/startup_failsafe.at |  1 +
- 5 files changed, 24 insertions(+)
+ src/tests/functions.at                 | 20 ++++++++++++++++++++
+ 6 files changed, 25 insertions(+)
 
 diff --git a/config/zones/home.xml b/config/zones/home.xml
 index d73c9bdb16b6..33064688367e 100644
@@ -56,11 +57,23 @@ index f1a14a9b4682..27b54a7783c4 100644
 +  <service name="cockpit"/>
    <forward/>
  </zone>
+diff --git a/src/tests/features/startup_failsafe.at b/src/tests/features/startup_failsafe.at
+index d251d354abfb..5178f40cec46 100644
+--- a/src/tests/features/startup_failsafe.at
++++ b/src/tests/features/startup_failsafe.at
+@@ -20,6 +20,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
+         chain filter_IN_public_allow {
+             tcp dport 22 ct state new,untracked accept
+             ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
++            tcp dport 9090 ct state new,untracked accept
+             tcp dport 443 ct state new,untracked accept
+         }
+     }
 diff --git a/src/tests/functions.at b/src/tests/functions.at
-index 3f343ef49de1..c950a3c7a1a6 100644
+index aea87c1cb4fc..4ef61a3147a4 100644
 --- a/src/tests/functions.at
 +++ b/src/tests/functions.at
-@@ -106,6 +106,14 @@ m4_define([FWD_START_TEST], [
+@@ -128,6 +128,14 @@ m4_define([FWD_START_TEST], [
      fi
  
      m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [
@@ -75,7 +88,7 @@ index 3f343ef49de1..c950a3c7a1a6 100644
      ], [
          dnl set the appropriate backend
          AT_CHECK([sed -i 's/^FirewallBackend.*/FirewallBackend=FIREWALL_BACKEND/' ./firewalld.conf])
-@@ -237,6 +245,18 @@ m4_define([FWD_START_TEST], [
+@@ -259,6 +267,18 @@ m4_define([FWD_START_TEST], [
          ])
  
          FWD_START_FIREWALLD
@@ -95,5 +108,5 @@ index 3f343ef49de1..c950a3c7a1a6 100644
  ])
  
 -- 
-2.27.0
+2.39.1
 

0002-v1.4.0-test-atlocal-pass-EBTABLES-to-testsuite.patch

@@ -0,0 +1,46 @@
+From c1aadce88b0adc4e116254a80f3a7f4634958e01 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Tue, 31 Jan 2023 09:24:56 -0500
+Subject: [PATCH 2/4] v1.4.0: test(atlocal): pass EBTABLES to testsuite
+
+(cherry picked from commit a5adb26a5eebdaa6e978c580d4fb73f7aa06802f)
+---
+ src/tests/atlocal.in   | 1 +
+ src/tests/functions.at | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/tests/atlocal.in b/src/tests/atlocal.in
+index 8c5493ac38df..595a96f0f5c9 100644
+--- a/src/tests/atlocal.in
++++ b/src/tests/atlocal.in
+@@ -1,5 +1,6 @@
+ export PYTHON="@PYTHON@"
+ 
++export EBTABLES="@EBTABLES@"
+ export IPTABLES="@IPTABLES@"
+ export IPTABLES_RESTORE="@IPTABLES_RESTORE@"
+ export IP6TABLES="@IP6TABLES@"
+diff --git a/src/tests/functions.at b/src/tests/functions.at
+index 4ef61a3147a4..50fb6bfb4541 100644
+--- a/src/tests/functions.at
++++ b/src/tests/functions.at
+@@ -104,6 +104,7 @@ m4_define([FWD_START_TEST], [
+     dnl in atlocal.
+     dnl
+     test -z "$PYTHON" && export PYTHON="python3"
++    test -z "$EBTABLES" && export EBTABLES="ebtables"
+     test -z "$IPTABLES" && export IPTABLES="iptables"
+     test -z "$IPTABLES_RESTORE" && export IPTABLES_RESTORE="iptables-restore"
+     test -z "$IP6TABLES" && export IP6TABLES="ip6tables"
+@@ -395,7 +396,7 @@ m4_define([EBTABLES_LIST_RULES_NORMALIZE], [dnl
+ m4_define([EBTABLES_LIST_RULES], [
+     dnl ebtables commit 5f508b76a0ce change list output for inversion.
+     m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [
+-        NS_CHECK([PIPESTATUS0([ebtables --concurrent -t $1 -L $2], [EBTABLES_LIST_RULES_NORMALIZE])],
++        NS_CHECK([PIPESTATUS0([$EBTABLES --concurrent -t $1 -L $2], [EBTABLES_LIST_RULES_NORMALIZE])],
+                  [$3], [m4_strip([$4])], [m4_strip([$5])], [$6], [$7])
+     ])
+ ])
+-- 
+2.39.1
+

0003-v1.4.0-feat-direct-avoid-iptables-flush-if-using-nft.patch

@@ -0,0 +1,117 @@
+From fbe4244b3663c3b96c174f6ed8d3d222cc1adcf8 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Mon, 30 Jan 2023 16:42:50 -0500
+Subject: [PATCH 3/4] v1.4.0: feat(direct): avoid iptables flush if using
+ nftables backend
+
+If FirewallBackend=nftables and there are no direct rules; then we can
+avoid flushing iptables at startup and shutdown. This means other
+applications can control iptables while firewalld only touches nftables.
+
+Fixes: #863
+(cherry picked from commit b7faa74db15e2d1ebd9fdfcdc7579874d3a2fa87)
+---
+ src/firewall/core/fw.py        | 31 +++++++++++++++++++++++++++----
+ src/firewall/core/fw_direct.py |  9 +++++++++
+ 2 files changed, 36 insertions(+), 4 deletions(-)
+
+diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py
+index 3e1bab575769..6710900839f8 100644
+--- a/src/firewall/core/fw.py
++++ b/src/firewall/core/fw.py
+@@ -469,7 +469,8 @@ class Firewall(object):
+     def _start_apply_objects(self, reload=False, complete_reload=False):
+         transaction = FirewallTransaction(self)
+ 
+-        self.flush(use_transaction=transaction)
++        if not reload:
++            self.flush(use_transaction=transaction)
+ 
+         # If modules need to be unloaded in complete reload or if there are
+         # ipsets to get applied, limit the transaction to flush.
+@@ -939,7 +940,26 @@ class Firewall(object):
+         if use_transaction is None:
+             transaction.execute(True)
+ 
+-    # flush and policy
++    def may_skip_flush_direct_backends(self):
++        if self.nftables_enabled and not self.direct.has_runtime_configuration():
++            return True
++
++        return False
++
++    def flush_direct_backends(self, use_transaction=None):
++        if use_transaction is None:
++            transaction = FirewallTransaction(self)
++        else:
++            transaction = use_transaction
++
++        for backend in self.all_backends():
++            if backend in self.enabled_backends():
++                continue
++            rules = backend.build_flush_rules()
++            transaction.add_rules(backend, rules)
++
++        if use_transaction is None:
++            transaction.execute(True)
+ 
+     def flush(self, use_transaction=None):
+         if use_transaction is None:
+@@ -949,7 +969,10 @@ class Firewall(object):
+ 
+         log.debug1("Flushing rule set")
+ 
+-        for backend in self.all_backends():
++        if not self.may_skip_flush_direct_backends():
++            self.flush_direct_backends(use_transaction=transaction)
++
++        for backend in self.enabled_backends():
+             rules = backend.build_flush_rules()
+             transaction.add_rules(backend, rules)
+ 
+@@ -1109,7 +1132,7 @@ class Firewall(object):
+         if not _panic:
+             self.set_policy("DROP")
+ 
+-        # stop
++        self.flush()
+         self.cleanup()
+ 
+         start_exception = None
+diff --git a/src/firewall/core/fw_direct.py b/src/firewall/core/fw_direct.py
+index 508cfa54f7fa..a4cd8a77e773 100644
+--- a/src/firewall/core/fw_direct.py
++++ b/src/firewall/core/fw_direct.py
+@@ -219,6 +219,9 @@ class FirewallDirect(object):
+         else:
+             transaction = use_transaction
+ 
++        if self._fw.may_skip_flush_direct_backends():
++            transaction.add_pre(self._fw.flush_direct_backends)
++
+         if self._fw.ipset_enabled and self._fw.ipset.omit_native_ipset():
+             transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend])
+ 
+@@ -268,6 +271,9 @@ class FirewallDirect(object):
+         else:
+             transaction = use_transaction
+ 
++        if self._fw.may_skip_flush_direct_backends():
++            transaction.add_pre(self._fw.flush_direct_backends)
++
+         if self._fw.ipset_enabled and self._fw.ipset.omit_native_ipset():
+             transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend])
+ 
+@@ -353,6 +359,9 @@ class FirewallDirect(object):
+         else:
+             transaction = use_transaction
+ 
++        if self._fw.may_skip_flush_direct_backends():
++            transaction.add_pre(self._fw.flush_direct_backends)
++
+         if self._fw.ipset_enabled and self._fw.ipset.omit_native_ipset():
+             transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend])
+ 
+-- 
+2.39.1
+

0004-v1.4.0-test-direct-avoid-iptables-flush-if-using-nft.patch

@@ -0,0 +1,176 @@
+From 5f092d3665463b764b957ef219010e0640babde7 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Mon, 30 Jan 2023 14:43:18 -0500
+Subject: [PATCH 4/4] v1.4.0: test(direct): avoid iptables flush if using
+ nftables backend
+
+Coverage: #863
+(cherry picked from commit dcd0dd3674ea8ef757a1b41f6b53717a45e821aa)
+---
+ src/tests/features/features.at                |   1 +
+ .../features/iptables_no_flush_on_shutdown.at | 144 ++++++++++++++++++
+ 2 files changed, 145 insertions(+)
+ create mode 100644 src/tests/features/iptables_no_flush_on_shutdown.at
+
+diff --git a/src/tests/features/features.at b/src/tests/features/features.at
+index 96b098de6e82..59725eb9fdf4 100644
+--- a/src/tests/features/features.at
++++ b/src/tests/features/features.at
+@@ -18,3 +18,4 @@ m4_include([features/rpfilter.at])
+ m4_include([features/zone_combine.at])
+ m4_include([features/startup_failsafe.at])
+ m4_include([features/ipset.at])
++m4_include([features/iptables_no_flush_on_shutdown.at])
+diff --git a/src/tests/features/iptables_no_flush_on_shutdown.at b/src/tests/features/iptables_no_flush_on_shutdown.at
+new file mode 100644
+index 000000000000..753a8251f732
+--- /dev/null
++++ b/src/tests/features/iptables_no_flush_on_shutdown.at
+@@ -0,0 +1,144 @@
++m4_if(nftables, FIREWALL_BACKEND, [
++
++dnl If FirewallBackend=nftables, and there are no --direct rules, then we can
++dnl avoid flushing iptables on shutdown. We can also avoid a flush on startup
++dnl if there are no permanent direct rules. But we will have to flush on the
++dnl first direct rule added.
++FWD_START_TEST([avoid iptables flush if using nftables])
++AT_KEYWORDS(direct gh863)
++CHECK_IPTABLES()
++
++dnl no flush on reload if no direct rules
++NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IF_HOST_SUPPORTS_IP6TABLES([
++NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT])
++])
++NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
++])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all ::/0 ::/0
++])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
++    -j ACCEPT
++])
++FWD_RELOAD()
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
++])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all ::/0 ::/0
++])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
++    -j ACCEPT
++])
++
++dnl no flush on restart (or stop) if no direct rules
++FWD_RESTART()
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
++])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all ::/0 ::/0
++])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
++    -j ACCEPT
++])
++
++dnl the first runtime direct rule should trigger an iptables flush
++FWD_CHECK([--direct --add-rule ipv4 filter INPUT 1 -j ACCEPT], 0, [ignore])
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
++    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
++])
++NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IF_HOST_SUPPORTS_IP6TABLES([
++NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT])
++])
++NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
++])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
++    ACCEPT all ::/0 ::/0
++])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
++    -j ACCEPT
++])
++FWD_RELOAD()
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
++])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
++])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++EBTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
++])
++
++dnl permanent direct rules should trigger a flush at start
++FWD_CHECK([--permanent --direct --add-rule ipv4 filter INPUT 1 -j ACCEPT], 0, [ignore])
++NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IF_HOST_SUPPORTS_IP6TABLES([
++NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT])
++])
++NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++FWD_RELOAD()
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
++    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
++])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
++])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++EBTABLES_LIST_RULES([filter], [INPUT], 0, [dnl
++])
++
++FWD_CHECK([--permanent --direct --remove-rule ipv4 filter INPUT 1 -j ACCEPT], 0, [ignore])
++FWD_RELOAD()
++
++dnl adding a chain should trigger a flush
++NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IF_HOST_SUPPORTS_IP6TABLES([
++NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT])
++])
++NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++FWD_CHECK([--direct --add-chain ipv4 filter firewalld_foobar], 0, [ignore])
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++FWD_RELOAD()
++
++dnl adding a chain should trigger a flush
++NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++IF_HOST_SUPPORTS_IP6TABLES([
++NS_CHECK([$IP6TABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$IP6TABLES -t filter -I firewalld_testsuite -j ACCEPT])
++])
++NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
++NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
++FWD_CHECK([--direct --add-passthrough ipv4 -t filter -I INPUT -j ACCEPT], 0, [ignore])
++IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore])
++
++FWD_END_TEST()
++
++])
+-- 
+2.39.1
+

firewalld.spec

@@ -1,11 +1,14 @@
 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
 Name: firewalld
-Version: 1.2.1
+Version: 1.2.5
 Release: 1%{?dist}
 URL:     http://www.firewalld.org
 License: GPLv2+
 Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz
 Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
+Patch2: 0002-v1.4.0-test-atlocal-pass-EBTABLES-to-testsuite.patch
+Patch3: 0003-v1.4.0-feat-direct-avoid-iptables-flush-if-using-nft.patch
+Patch4: 0004-v1.4.0-test-direct-avoid-iptables-flush-if-using-nft.patch
 BuildArch: noarch
 BuildRequires: autoconf
 BuildRequires: automake
@@ -227,6 +230,10 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
 %{_mandir}/man1/firewall-config*.1*
 
 %changelog
+* Mon Apr 24 2023 Eric Garver <egarver@redhat.com> - 1.2.5-1
+- package rebase to v1.2.5
+- feat(direct): avoid iptables flush if using nftables backend
+
 * Mon Nov 07 2022 Eric Garver <egarver@redhat.com> - 1.2.1-1
 - package rebase to v1.2.1
 

sources

@@ -1 +1 @@
-SHA512 (firewalld-1.2.1.tar.gz) = a9b2d7346291d0c54e850913f2d40a08d121d64df75ee87655fa2ee022ade908c762e5b6d372d4e8879eec1138f73635ee9398cdb3703efe67039769c5e2a42a
+SHA512 (firewalld-1.2.5.tar.gz) = 77ab650f63b00facd41c9d2c0e25cb84cac4b35c23695f4a8c6c803a30d6c884a1d5fb8def4ef99926ca1213c39c04cfa4e5a8a76767f49ee49bd7824a709962