rpms/firewalld
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI firewalld-1.3.4-1.el9

Browse Source
This commit is contained in:
eabdullin 2024-04-30 15:58:36 +00:00
parent c9f97fdb57
commit c56d981db8
7 changed files with 45 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.firewalld.metadata
View File

@ -1 +1 @@
8d18bc8ce17384b47b979b86b971ea0ad606f8be SOURCES/firewalld-1.2.5.tar.gz c72d4a04e7726d3352c911f20ddc44cff5515c4c SOURCES/firewalld-1.3.4.tar.bz2

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/firewalld-1.2.5.tar.gz SOURCES/firewalld-1.3.4.tar.bz2

16
SOURCES/0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
View File

@ -1,4 +1,4 @@
From f3fa74bb2710b0089db4026443ae67c4cabae1e1 Mon Sep 17 00:00:00 2001 From f113f17734cfb964bd2b72f233c48e650e205cb9 Mon Sep 17 00:00:00 2001
From: Eric Garver <egarver@redhat.com> From: Eric Garver <egarver@redhat.com>
Date: Tue, 25 May 2021 13:31:41 -0400 Date: Tue, 25 May 2021 13:31:41 -0400
Subject: [PATCH 1/4] RHEL only: Add cockpit by default to some zones Subject: [PATCH 1/4] RHEL only: Add cockpit by default to some zones
@ -58,19 +58,19 @@ index f1a14a9b4682..27b54a7783c4 100644
<forward/> <forward/>
</zone> </zone>
diff --git a/src/tests/features/startup_failsafe.at b/src/tests/features/startup_failsafe.at diff --git a/src/tests/features/startup_failsafe.at b/src/tests/features/startup_failsafe.at
index d251d354abfb..5178f40cec46 100644 index 3cdf7c3c307a..b9401d460114 100644
--- a/src/tests/features/startup_failsafe.at --- a/src/tests/features/startup_failsafe.at
+++ b/src/tests/features/startup_failsafe.at +++ b/src/tests/features/startup_failsafe.at
@@ -20,6 +20,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl @@ -20,6 +20,7 @@ NFT_LIST_RULES([inet], [filter_IN_public_allow], 0, [dnl
chain filter_IN_public_allow { chain filter_IN_public_allow {
tcp dport 22 ct state new,untracked accept tcp dport 22 accept
ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept ip6 daddr fe80::/64 udp dport 546 accept
+ tcp dport 9090 ct state new,untracked accept + tcp dport 9090 accept
tcp dport 443 ct state new,untracked accept tcp dport 443 accept
} }
} }
diff --git a/src/tests/functions.at b/src/tests/functions.at diff --git a/src/tests/functions.at b/src/tests/functions.at
index aea87c1cb4fc..4ef61a3147a4 100644 index 244d24686c86..ad3462c6715f 100644
--- a/src/tests/functions.at --- a/src/tests/functions.at
+++ b/src/tests/functions.at +++ b/src/tests/functions.at
@@ -128,6 +128,14 @@ m4_define([FWD_START_TEST], [ @@ -128,6 +128,14 @@ m4_define([FWD_START_TEST], [
@ -108,5 +108,5 @@ index aea87c1cb4fc..4ef61a3147a4 100644
]) ])
-- --
2.39.1 2.39.3

8
SOURCES/0002-v1.4.0-test-atlocal-pass-EBTABLES-to-testsuite.patch
View File

@ -1,4 +1,4 @@
From c1aadce88b0adc4e116254a80f3a7f4634958e01 Mon Sep 17 00:00:00 2001 From 0598abdbc3dd1816e9cc19186de9e95c6485519d Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life> From: Eric Garver <eric@garver.life>
Date: Tue, 31 Jan 2023 09:24:56 -0500 Date: Tue, 31 Jan 2023 09:24:56 -0500
Subject: [PATCH 2/4] v1.4.0: test(atlocal): pass EBTABLES to testsuite Subject: [PATCH 2/4] v1.4.0: test(atlocal): pass EBTABLES to testsuite
@ -21,7 +21,7 @@ index 8c5493ac38df..595a96f0f5c9 100644
export IPTABLES_RESTORE="@IPTABLES_RESTORE@" export IPTABLES_RESTORE="@IPTABLES_RESTORE@"
export IP6TABLES="@IP6TABLES@" export IP6TABLES="@IP6TABLES@"
diff --git a/src/tests/functions.at b/src/tests/functions.at diff --git a/src/tests/functions.at b/src/tests/functions.at
index 4ef61a3147a4..50fb6bfb4541 100644 index ad3462c6715f..f454ca980046 100644
--- a/src/tests/functions.at --- a/src/tests/functions.at
+++ b/src/tests/functions.at +++ b/src/tests/functions.at
@@ -104,6 +104,7 @@ m4_define([FWD_START_TEST], [ @@ -104,6 +104,7 @@ m4_define([FWD_START_TEST], [
@ -32,7 +32,7 @@ index 4ef61a3147a4..50fb6bfb4541 100644
test -z "$IPTABLES" && export IPTABLES="iptables" test -z "$IPTABLES" && export IPTABLES="iptables"
test -z "$IPTABLES_RESTORE" && export IPTABLES_RESTORE="iptables-restore" test -z "$IPTABLES_RESTORE" && export IPTABLES_RESTORE="iptables-restore"
test -z "$IP6TABLES" && export IP6TABLES="ip6tables" test -z "$IP6TABLES" && export IP6TABLES="ip6tables"
@@ -395,7 +396,7 @@ m4_define([EBTABLES_LIST_RULES_NORMALIZE], [dnl @@ -398,7 +399,7 @@ m4_define([EBTABLES_LIST_RULES_NORMALIZE], [dnl
m4_define([EBTABLES_LIST_RULES], [ m4_define([EBTABLES_LIST_RULES], [
dnl ebtables commit 5f508b76a0ce change list output for inversion. dnl ebtables commit 5f508b76a0ce change list output for inversion.
m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [ m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [
@ -42,5 +42,5 @@ index 4ef61a3147a4..50fb6bfb4541 100644
]) ])
]) ])
-- --
2.39.1 2.39.3

21
SOURCES/0003-v1.4.0-feat-direct-avoid-iptables-flush-if-using-nft.patch
View File

@ -1,4 +1,4 @@
From fbe4244b3663c3b96c174f6ed8d3d222cc1adcf8 Mon Sep 17 00:00:00 2001 From 35a4e98cfee37b2883a58ac586f0bdb34810293b Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life> From: Eric Garver <eric@garver.life>
Date: Mon, 30 Jan 2023 16:42:50 -0500 Date: Mon, 30 Jan 2023 16:42:50 -0500
Subject: [PATCH 3/4] v1.4.0: feat(direct): avoid iptables flush if using Subject: [PATCH 3/4] v1.4.0: feat(direct): avoid iptables flush if using
@ -11,15 +11,15 @@ applications can control iptables while firewalld only touches nftables.
Fixes: #863 Fixes: #863
(cherry picked from commit b7faa74db15e2d1ebd9fdfcdc7579874d3a2fa87) (cherry picked from commit b7faa74db15e2d1ebd9fdfcdc7579874d3a2fa87)
--- ---
src/firewall/core/fw.py | 31 +++++++++++++++++++++++++++---- src/firewall/core/fw.py | 30 ++++++++++++++++++++++++++----
src/firewall/core/fw_direct.py | 9 +++++++++ src/firewall/core/fw_direct.py | 9 +++++++++
2 files changed, 36 insertions(+), 4 deletions(-) 2 files changed, 35 insertions(+), 4 deletions(-)
diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py
index 3e1bab575769..6710900839f8 100644 index e9db1c6fede0..f1bc124b9443 100644
--- a/src/firewall/core/fw.py --- a/src/firewall/core/fw.py
+++ b/src/firewall/core/fw.py +++ b/src/firewall/core/fw.py
@@ -469,7 +469,8 @@ class Firewall(object): @@ -473,7 +473,8 @@ class Firewall(object):
def _start_apply_objects(self, reload=False, complete_reload=False): def _start_apply_objects(self, reload=False, complete_reload=False):
transaction = FirewallTransaction(self) transaction = FirewallTransaction(self)
@ -29,7 +29,7 @@ index 3e1bab575769..6710900839f8 100644
# If modules need to be unloaded in complete reload or if there are # If modules need to be unloaded in complete reload or if there are
# ipsets to get applied, limit the transaction to flush. # ipsets to get applied, limit the transaction to flush.
@@ -939,7 +940,26 @@ class Firewall(object): @@ -943,7 +944,26 @@ class Firewall(object):
if use_transaction is None: if use_transaction is None:
transaction.execute(True) transaction.execute(True)
@ -57,7 +57,7 @@ index 3e1bab575769..6710900839f8 100644
def flush(self, use_transaction=None): def flush(self, use_transaction=None):
if use_transaction is None: if use_transaction is None:
@@ -949,7 +969,10 @@ class Firewall(object): @@ -953,7 +973,10 @@ class Firewall(object):
log.debug1("Flushing rule set") log.debug1("Flushing rule set")
@ -69,15 +69,14 @@ index 3e1bab575769..6710900839f8 100644
rules = backend.build_flush_rules() rules = backend.build_flush_rules()
transaction.add_rules(backend, rules) transaction.add_rules(backend, rules)
@@ -1109,7 +1132,7 @@ class Firewall(object): @@ -1114,7 +1137,6 @@ class Firewall(object):
if not _panic: if not _panic:
self.set_policy("DROP") self.set_policy("DROP")
- # stop - # stop
+ self.flush() self.flush()
self.cleanup() self.cleanup()
start_exception = None
diff --git a/src/firewall/core/fw_direct.py b/src/firewall/core/fw_direct.py diff --git a/src/firewall/core/fw_direct.py b/src/firewall/core/fw_direct.py
index 508cfa54f7fa..a4cd8a77e773 100644 index 508cfa54f7fa..a4cd8a77e773 100644
--- a/src/firewall/core/fw_direct.py --- a/src/firewall/core/fw_direct.py
@ -113,5 +112,5 @@ index 508cfa54f7fa..a4cd8a77e773 100644
transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend]) transaction.add_pre(self._fw.ipset.apply_ipsets, [self._fw.ipset_backend])
-- --
2.39.1 2.39.3

32
SOURCES/0004-v1.4.0-test-direct-avoid-iptables-flush-if-using-nft.patch
View File

@ -1,4 +1,4 @@
From 5f092d3665463b764b957ef219010e0640babde7 Mon Sep 17 00:00:00 2001 From 6069c94b5033fc82d8f35f2068a61374559d22de Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life> From: Eric Garver <eric@garver.life>
Date: Mon, 30 Jan 2023 14:43:18 -0500 Date: Mon, 30 Jan 2023 14:43:18 -0500
Subject: [PATCH 4/4] v1.4.0: test(direct): avoid iptables flush if using Subject: [PATCH 4/4] v1.4.0: test(direct): avoid iptables flush if using
@ -13,17 +13,17 @@ Coverage: #863
create mode 100644 src/tests/features/iptables_no_flush_on_shutdown.at create mode 100644 src/tests/features/iptables_no_flush_on_shutdown.at
diff --git a/src/tests/features/features.at b/src/tests/features/features.at diff --git a/src/tests/features/features.at b/src/tests/features/features.at
index 96b098de6e82..59725eb9fdf4 100644 index 78fe78c483ad..f59baea1cd70 100644
--- a/src/tests/features/features.at --- a/src/tests/features/features.at
+++ b/src/tests/features/features.at +++ b/src/tests/features/features.at
@@ -18,3 +18,4 @@ m4_include([features/rpfilter.at]) @@ -19,3 +19,4 @@ m4_include([features/zone_combine.at])
m4_include([features/zone_combine.at])
m4_include([features/startup_failsafe.at]) m4_include([features/startup_failsafe.at])
m4_include([features/ipset.at]) m4_include([features/ipset.at])
m4_include([features/reset_defaults.at])
+m4_include([features/iptables_no_flush_on_shutdown.at]) +m4_include([features/iptables_no_flush_on_shutdown.at])
diff --git a/src/tests/features/iptables_no_flush_on_shutdown.at b/src/tests/features/iptables_no_flush_on_shutdown.at diff --git a/src/tests/features/iptables_no_flush_on_shutdown.at b/src/tests/features/iptables_no_flush_on_shutdown.at
new file mode 100644 new file mode 100644
index 000000000000..753a8251f732 index 000000000000..fbd7c793375c
--- /dev/null --- /dev/null
+++ b/src/tests/features/iptables_no_flush_on_shutdown.at +++ b/src/tests/features/iptables_no_flush_on_shutdown.at
@@ -0,0 +1,144 @@ @@ -0,0 +1,144 @@
@ -47,20 +47,20 @@ index 000000000000..753a8251f732
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) +NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) +NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
+]) +])
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all ::/0 ::/0 + ACCEPT 0 -- ::/0 ::/0
+]) +])
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl +EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
+ -j ACCEPT + -j ACCEPT
+]) +])
+FWD_RELOAD() +FWD_RELOAD()
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
+]) +])
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all ::/0 ::/0 + ACCEPT 0 -- ::/0 ::/0
+]) +])
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl +EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
+ -j ACCEPT + -j ACCEPT
@ -69,10 +69,10 @@ index 000000000000..753a8251f732
+dnl no flush on restart (or stop) if no direct rules +dnl no flush on restart (or stop) if no direct rules
+FWD_RESTART() +FWD_RESTART()
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
+]) +])
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all ::/0 ::/0 + ACCEPT 0 -- ::/0 ::/0
+]) +])
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl +EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
+ -j ACCEPT + -j ACCEPT
@ -84,7 +84,7 @@ index 000000000000..753a8251f732
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) +IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore]) +EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 1, [ignore], [ignore])
+IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl +IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
+]) +])
+NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite]) +NS_CHECK([$IPTABLES -t filter -N firewalld_testsuite])
+NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT]) +NS_CHECK([$IPTABLES -t filter -I firewalld_testsuite -j ACCEPT])
@ -95,10 +95,10 @@ index 000000000000..753a8251f732
+NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite]) +NS_CHECK([$EBTABLES -t filter -N firewalld_testsuite])
+NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT]) +NS_CHECK([$EBTABLES -t filter -I firewalld_testsuite -j ACCEPT])
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
+]) +])
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl +IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 0, [dnl
+ ACCEPT all ::/0 ::/0 + ACCEPT 0 -- ::/0 ::/0
+]) +])
+EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl +EBTABLES_LIST_RULES([filter], [firewalld_testsuite], 0, [dnl
+ -j ACCEPT + -j ACCEPT
@ -127,7 +127,7 @@ index 000000000000..753a8251f732
+FWD_RELOAD() +FWD_RELOAD()
+IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) +IPTABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
+IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl +IPTABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
+ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 + ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
+]) +])
+IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore]) +IP6TABLES_LIST_RULES_ALWAYS([filter], [firewalld_testsuite], 1, [ignore], [ignore])
+IP6TABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl +IP6TABLES_LIST_RULES_ALWAYS([filter], [INPUT], 0, [dnl
@ -172,5 +172,5 @@ index 000000000000..753a8251f732
+ +
+]) +])
-- --
2.39.1 2.39.3

10
SPECS/firewalld.spec
View File

@ -1,10 +1,10 @@
Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
Name: firewalld Name: firewalld
Version: 1.2.5 Version: 1.3.4
Release: 2%{?dist} Release: 1%{?dist}
URL: http://www.firewalld.org URL: http://www.firewalld.org
License: GPLv2+ License: GPLv2+
Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2
Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
Patch2: 0002-v1.4.0-test-atlocal-pass-EBTABLES-to-testsuite.patch Patch2: 0002-v1.4.0-test-atlocal-pass-EBTABLES-to-testsuite.patch
Patch3: 0003-v1.4.0-feat-direct-avoid-iptables-flush-if-using-nft.patch Patch3: 0003-v1.4.0-feat-direct-avoid-iptables-flush-if-using-nft.patch
@ -230,8 +230,8 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
%{_mandir}/man1/firewall-config*.1* %{_mandir}/man1/firewall-config*.1*
%changelog %changelog
* Wed Oct 25 2023 Eric Garver <egarver@redhat.com> - 1.2.5-2 * Thu Oct 26 2023 Eric Garver <egarver@redhat.com> - 1.3.4-1
- bump NVR for release retarget - package rebase to v1.3.4
* Mon Apr 24 2023 Eric Garver <egarver@redhat.com> - 1.2.5-1 * Mon Apr 24 2023 Eric Garver <egarver@redhat.com> - 1.2.5-1
- package rebase to v1.2.5 - package rebase to v1.2.5