import firewalld-1.1.1-3.el9

.firewalld.metadata

@@ -1 +1 @@
-8ae534ae5675079eb893406ec88b52ee7f88cb6b SOURCES/firewalld-1.0.0.tar.gz
+407ba61d94d4c3b25c5d6094a06c305ba72557de SOURCES/firewalld-1.1.1.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/firewalld-1.0.0.tar.gz
+SOURCES/firewalld-1.1.1.tar.gz

SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch

@@ -1,54 +0,0 @@
-From 09cdc166ddfe53b6e8ce3a2920f798320c170b7f Mon Sep 17 00:00:00 2001
-From: Eric Garver <eric@garver.life>
-Date: Wed, 11 Aug 2021 14:47:59 -0400
-Subject: [PATCH 2/3] fix(firewalld): keep linux capability CAP_SYS_MODULE
-
-When firewalld calls ip6tables it may implicitly load the ip6_tables, et
-al kernel modules. As such we need to retain CAP_SYS_MODULE so that
-implicit module is allowed. Otherwise we get EPERM from the kernel.
-
-This only affects the -legacy variants and the top level table/chain
-modules. The userspace binaries will modprobe the kernel modules.
-Extensions, e.g. xt_conntrack, are implicitly loaded by the kernel based
-on the rules being added and thus not subject to linux capabilities
-checks.
-
-The -nft variants are unaffected because they use the nftables
-infrastructure which has implicit module loading in the kernel similar
-to the iptables extensions (xt_* modules).
-
-Fixes: rhbz 1990271
-Fixes: fb0532e8a200 ("feat(firewalld): drop linux capabilities")
-(cherry picked from commit 13801962073f478c68d818b314091badcf8b5614)
-(cherry picked from commit d3cd7e088f946c75593b0569bd658266b2e9329d)
----
- src/firewalld.in | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/src/firewalld.in b/src/firewalld.in
-index abcbe3508f86..b1c886c6f02f 100755
---- a/src/firewalld.in
-+++ b/src/firewalld.in
-@@ -136,6 +136,7 @@ def startup(args):
-         # attempt to drop Linux capabilities to a minimal set:
-         #   - CAP_NET_ADMIN
-         #   - CAP_NET_RAW
-+        #   - CAP_SYS_MODULE
-         try:
-             import capng
-             capng.capng_clear(capng.CAPNG_SELECT_BOTH)
-@@ -143,8 +144,10 @@ def startup(args):
-                                capng.CAP_NET_ADMIN)
-             capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
-                                capng.CAP_NET_RAW)
-+            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
-+                               capng.CAP_SYS_MODULE)
-             capng.capng_apply(capng.CAPNG_SELECT_BOTH)
--            log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW.")
-+            log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
-         except ImportError:
-             pass
- 
--- 
-2.31.1
-

SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch

@@ -0,0 +1,46 @@
+From ba20c6cb0a516545404e5e02cddf3b1d01fac79b Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Tue, 5 Jul 2022 15:43:19 -0400
+Subject: [PATCH 2/3] test(functions): commonize iptables output normalization
+
+Share rule normalization between iptables and ip6tables.
+
+(cherry picked from commit 54e761a0fe2d19dfc4c0c898540f718c837778a9)
+---
+ src/tests/functions.at | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/tests/functions.at b/src/tests/functions.at
+index 557acf0257e4..481c94017f15 100644
+--- a/src/tests/functions.at
++++ b/src/tests/functions.at
+@@ -393,11 +393,15 @@ m4_define([EBTABLES_LIST_RULES], [
+     ])
+ ])
+ 
+-m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl
++m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl
+     TRIM_WHITESPACE | dnl
+     tail -n +3 dnl
+ ])
+ 
++m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl
++    IPXTABLES_LIST_RULES_NORMALIZE() dnl
++])
++
+ m4_define([IPTABLES_LIST_RULES_ALWAYS], [
+     m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [
+         NS_CHECK([PIPESTATUS0([$IPTABLES -w -n -t $1 -L $2], [IPTABLES_LIST_RULES_NORMALIZE])],
+@@ -412,8 +416,7 @@ m4_define([IPTABLES_LIST_RULES], [
+ ])
+ 
+ m4_define([IP6TABLES_LIST_RULES_NORMALIZE], [dnl
+-    TRIM_WHITESPACE | dnl
+-    tail -n +3 dnl
++    IPXTABLES_LIST_RULES_NORMALIZE() dnl
+ ])
+ 
+ m4_define([IP6TABLES_LIST_RULES_ALWAYS], [
+-- 
+2.31.1
+

SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch

@@ -1,48 +0,0 @@
-From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001
-From: Eric Garver <eric@garver.life>
-Date: Mon, 30 Aug 2021 13:24:47 -0400
-Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code
-
-If dropping capabilities is blocked by SELinux, e.g. old selinux-policy,
-then capng_apply() will return non-zero. Also check other things that
-may fail, i.e. capng_update().
-
-Fixes: rhbz 1999090
-(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363)
-(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57)
----
- src/firewalld.in | 18 ++++++++++--------
- 1 file changed, 10 insertions(+), 8 deletions(-)
-
-diff --git a/src/firewalld.in b/src/firewalld.in
-index b1c886c6f02f..38331a0b49a9 100755
---- a/src/firewalld.in
-+++ b/src/firewalld.in
-@@ -140,14 +140,16 @@ def startup(args):
-         try:
-             import capng
-             capng.capng_clear(capng.CAPNG_SELECT_BOTH)
--            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
--                               capng.CAP_NET_ADMIN)
--            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
--                               capng.CAP_NET_RAW)
--            capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
--                               capng.CAP_SYS_MODULE)
--            capng.capng_apply(capng.CAPNG_SELECT_BOTH)
--            log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
-+            if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
-+                                  capng.CAP_NET_ADMIN) or \
-+               capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
-+                                  capng.CAP_NET_RAW) or \
-+               capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
-+                                  capng.CAP_SYS_MODULE) or \
-+               capng.capng_apply(capng.CAPNG_SELECT_BOTH):
-+                log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.")
-+            else:
-+                log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
-         except ImportError:
-             pass
- 
--- 
-2.31.1
-

SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch

@@ -0,0 +1,34 @@
+From 68276da6dda3f73dfed5e6758675a5148ac77271 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Tue, 5 Jul 2022 14:38:34 -0400
+Subject: [PATCH 3/3] test(functions): normalize iptables ipv6-icmp/icmpv6
+
+The output changed in iptables 1.8.8. Specifically commit b6196c7504d4
+("xshared: Prefer xtables_chain_protos lookup over getprotoent").
+
+Fixes: #982
+Fixes: rhbz2100881
+(cherry picked from commit c54ea7b5e492b3aae631dc71579afc24d713401f)
+---
+ src/tests/functions.at | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/tests/functions.at b/src/tests/functions.at
+index 481c94017f15..a38ae9005ea2 100644
+--- a/src/tests/functions.at
++++ b/src/tests/functions.at
+@@ -395,7 +395,10 @@ m4_define([EBTABLES_LIST_RULES], [
+ 
+ m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl
+     TRIM_WHITESPACE | dnl
+-    tail -n +3 dnl
++    tail -n +3 | dnl
++    dnl iptables-1.8.8 changed output of some protocols
++    dnl commit b6196c7504d4 ("xshared: Prefer xtables_chain_protos lookup over getprotoent")
++    sed -e ['s/[ ]ipv6-icmp\([ -]\)/ icmpv6\1/g'] dnl
+ ])
+ 
+ m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl
+-- 
+2.31.1
+

SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch

@@ -0,0 +1,42 @@
+From f9e0fdd188e7730468bebdf35f573f2a1ef6bd9b Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Tue, 2 Aug 2022 13:11:31 -0400
+Subject: [PATCH 4/5] fix(runtimeToPermanent): errors for interfaces not in
+ zone
+
+We should only consider the interfaces for the currently iterated over
+zone. Otherwise we will attempt to remove an interface from a zone for
+which it is does not belong.
+
+Note this only occurs when NetworkManager is running.
+
+Fixes: #976
+Fixes: rhbz2112982
+(cherry picked from commit 15f47354c4a078dc694df1541550b3e5156548fc)
+---
+ src/firewall/server/firewalld.py | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py
+index 5cf963dfbbd4..f5f902d6e712 100644
+--- a/src/firewall/server/firewalld.py
++++ b/src/firewall/server/firewalld.py
+@@ -447,10 +447,11 @@ class FirewallD(DbusServiceObject):
+             conf = self.getZoneSettings2(name)
+             settings = FirewallClientZoneSettings(conf)
+             changed = False
+-            for interface in self.fw._nm_assigned_interfaces:
+-                log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface))
+-                settings.removeInterface(interface)
+-                changed = True
++            for interface in settings.getInterfaces():
++                if interface in self.fw._nm_assigned_interfaces:
++                    log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface))
++                    settings.removeInterface(interface)
++                    changed = True
+             # For the remaining interfaces, attempt to let NM manage them
+             for interface in settings.getInterfaces():
+                 try:
+-- 
+2.31.1
+

SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch

@@ -0,0 +1,47 @@
+From 5300da5cbb6c696baad71fb85ca36e65ab5ba292 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Mon, 1 Aug 2022 14:43:23 -0400
+Subject: [PATCH 5/5] test(runtimeToPermanent): verify when NM interfaces
+ present
+
+Coverage: #976
+Coverage: rhbz2112982
+(cherry picked from commit f4f67413e4db7c789bf9d7ba8e983505a6e6e6df)
+---
+ src/tests/integration/gh976.at          | 14 ++++++++++++++
+ src/tests/integration/networkmanager.at |  1 +
+ 2 files changed, 15 insertions(+)
+ create mode 100644 src/tests/integration/gh976.at
+
+diff --git a/src/tests/integration/gh976.at b/src/tests/integration/gh976.at
+new file mode 100644
+index 000000000000..977eca997a3a
+--- /dev/null
++++ b/src/tests/integration/gh976.at
+@@ -0,0 +1,14 @@
++FWD_START_TEST([interfaces during runtime to permanent])
++AT_KEYWORDS(gh976 rhbz2112982)
++
++START_NETWORKMANAGER()
++
++NMCLI_CHECK([connection add type dummy con-name dummy0 ifname dummy0 ip4 10.0.0.2 gw4 10.0.0.1], 0, [ignore])
++echo NS_CMD([nmcli connection delete dummy0]) >> ./cleanup
++NMCLI_CHECK([connection show dummy0], 0, [ignore])
++NMCLI_CHECK([connection up dummy0], 0, [ignore])
++
++FWD_CHECK([--add-service smtp], 0, [ignore])
++FWD_CHECK([--runtime-to-permanent], 0, [ignore])
++
++FWD_END_TEST()
+diff --git a/src/tests/integration/networkmanager.at b/src/tests/integration/networkmanager.at
+index 0b20adce0462..c93e92d70754 100644
+--- a/src/tests/integration/networkmanager.at
++++ b/src/tests/integration/networkmanager.at
+@@ -1,3 +1,4 @@
+ AT_BANNER([NetworkManager (FIREWALL_BACKEND)])
+ m4_include([integration/rhbz1773809.at])
+ m4_include([integration/rhbz1928860.at])
++m4_include([integration/gh976.at])
+-- 
+2.31.1
+

SPECS/firewalld.spec

@@ -1,13 +1,15 @@
 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
 Name: firewalld
-Version: 1.0.0
+Version: 1.1.1
-Release: 4%{?dist}
+Release: 3%{?dist}
 URL:     http://www.firewalld.org
 License: GPLv2+
 Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz
 Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
-Patch2: 0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch
+Patch2: 0002-test-functions-commonize-iptables-output-normalizati.patch
-Patch3: 0003-fix-firewalld-check-capng_apply-return-code.patch
+Patch3: 0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch
+Patch4: 0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch
+Patch5: 0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch
 BuildArch: noarch
 BuildRequires: autoconf
 BuildRequires: automake
@@ -229,6 +231,15 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
 %{_mandir}/man1/firewall-config*.1*
 
 %changelog
+* Wed Aug 03 2022 Eric Garver <egarver@redhat.com> - 1.1.1-3
+- fix(runtimeToPermanent): errors for interfaces not in zone
+
+* Fri Jul 15 2022 Eric Garver <egarver@redhat.com> - 1.1.1-2
+- test(functions): normalize iptables ipv6-icmp/icmpv6
+
+* Mon May 16 2022 Eric Garver <egarver@redhat.com> - 1.1.1-1
+- package rebase to v1.1.1
+
 * Mon Nov 22 2021 Eric Garver <egarver@redhat.com> - 1.0.0-4
 - fix(firewalld): check capng_apply() return code