diff --git a/SOURCES/firewalld-0.4.3.2-no_blanked_zone_rhbz#1381314.patch b/SOURCES/firewalld-0.4.3.2-no_blanked_zone_rhbz#1381314.patch new file mode 100644 index 0000000..34ccdee --- /dev/null +++ b/SOURCES/firewalld-0.4.3.2-no_blanked_zone_rhbz#1381314.patch @@ -0,0 +1,111 @@ +commit 636e01137515f3830c655619096e9642651a674c +Author: Thomas Woerner +Date: Thu Dec 1 12:02:55 2016 +0100 + + firewall.core.fw_zone: Do not reset ZONE with ifdown + + On reboot or shutdown the zone has been reset to default if the network + service is enabled and controlling the interface. + + The call of firewall-cmd --remove-interface in ifdown.post is now only removing + the zone binding in the firewall, but not modifying the ifcfg file anymore. + + This fixes RHBZ#1381314 + +diff --git a/doc/xml/firewall-cmd.xml b/doc/xml/firewall-cmd.xml +index 3503df4..c9d8ef5 100644 +--- a/doc/xml/firewall-cmd.xml ++++ b/doc/xml/firewall-cmd.xml +@@ -896,7 +896,12 @@ For interfaces that are not under control of NetworkManager, firewalld tries to + + + If the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. If this fails, the zone binding is created in firewalld and the limitations below apply. +-For interfaces that are not under control of NetworkManager, firewalld tries to change the ZONE setting in the ifcfg file, if the file exists. ++ ++ ++ For the addion or change of interfaces that are not under control of NetworkManager: firewalld tries to change the ZONE setting in the ifcfg file, if an ifcfg file exists that is using the interface. ++ ++ ++ Only for the removal of interfaces that are not under control of NetworkManager: firewalld is not trying to change the ZONE setting in the ifcfg file. This is needed to make sure that an ifdown of the interface will not result in a reset of the zone setting to the default zone. Only the zone binding is then removed in firewalld then. + + + Remove binding of interface interface from zone it was previously added to. +diff --git a/doc/xml/firewallctl.xml b/doc/xml/firewallctl.xml +index 11b5e60..30be89f 100644 +--- a/doc/xml/firewallctl.xml ++++ b/doc/xml/firewallctl.xml +@@ -550,7 +550,6 @@ + + + If the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface for new or changed interface bindings. If the setting in NetworkManager fails, the zone binding is created or changed in firewalld and the limitations below apply. +-For interfaces that are not under control of NetworkManager, firewalld tries to change the ZONE setting in the ifcfg file, if the file exists. + + + As a end user you don't need to create or change zone bindings of interfaces in most cases, because NetworkManager (or legacy network service) adds interfaces into zones automatically (according to option from ifcfg-interface file) if NM_CONTROLLED=no is not set. +@@ -559,6 +558,12 @@ For interfaces that are not under control of NetworkManager, firewalld tries to + Please also have a look at the firewalld1 man page in the Concepts section. + For permanent association of interface with a zone, see also 'How to set or change a zone for a connection?' in firewalld.zones5. + ++ ++ For the addion or change of interfaces that are not under control of NetworkManager: firewalld tries to change the ZONE setting in the ifcfg file, if an ifcfg file exists that is using the interface. ++ ++ ++ Only for the removal of interfaces that are not under control of NetworkManager: firewalld is not trying to change the ZONE setting in the ifcfg file. This is needed to make sure that an ifdown of the interface will not result in a reset of the zone setting to the default zone. Only the zone binding is then removed in firewalld then. ++ + + + +diff --git a/doc/xml/firewalld.zones.xml b/doc/xml/firewalld.zones.xml +index 2f81a8a..387cf6b 100644 +--- a/doc/xml/firewalld.zones.xml ++++ b/doc/xml/firewalld.zones.xml +@@ -223,6 +223,12 @@ + + If the connection is controlled by NetworkManager, you can also use nm-connection-editor to change the zone. + ++ ++ For the addion or change of interfaces that are not under control of NetworkManager: firewalld tries to change the ZONE setting in the ifcfg file, if an ifcfg file exists that is using the interface. ++ ++ ++ Only for the removal of interfaces that are not under control of NetworkManager: firewalld is not trying to change the ZONE setting in the ifcfg file. This is needed to make sure that an ifdown of the interface will not result in a reset of the zone setting to the default zone. Only the zone binding is then removed in firewalld then. ++ + + + +diff --git a/src/firewall/core/fw_zone.py b/src/firewall/core/fw_zone.py +index e4fdecf..098eed9 100644 +--- a/src/firewall/core/fw_zone.py ++++ b/src/firewall/core/fw_zone.py +@@ -671,7 +671,11 @@ class FirewallZone(object): + zone_transaction.add_post(self.__unregister_interface, _obj, + interface_id) + +- zone_transaction.add_post(ifcfg_set_zone_of_interface, "", interface) ++ # Do not reset ZONE with ifdown ++ # On reboot or shutdown the zone has been reset to default ++ # if the network service is enabled and controlling the ++ # interface (RHBZ#1381314) ++ #zone_transaction.add_post(ifcfg_set_zone_of_interface, "", interface) + + if use_zone_transaction is None: + zone_transaction.execute(True) + +commit fe6cf16e5a5ef3e49cdb554af8cf18024371554a +Author: Thomas Woerner +Date: Thu Oct 6 15:07:37 2016 +0200 + + firewall.core.io.ifcfg: Use .bak for save files + +diff --git a/src/firewall/core/io/ifcfg.py b/src/firewall/core/io/ifcfg.py +index e145f49..6ae0302 100644 +--- a/src/firewall/core/io/ifcfg.py ++++ b/src/firewall/core/io/ifcfg.py +@@ -179,7 +179,7 @@ class ifcfg(object): + # make backup + if os.path.exists(self.filename): + try: +- shutil.copy2(self.filename, "%s.old" % self.filename) ++ shutil.copy2(self.filename, "%s.bak" % self.filename) + except Exception as msg: + os.remove(temp_file.name) + raise IOError("Backup of '%s' failed: %s" % (self.filename, msg)) diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec index e5ea76f..1d68593 100644 --- a/SPECS/firewalld.spec +++ b/SPECS/firewalld.spec @@ -8,7 +8,7 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld Version: 0.4.3.2 -Release: 8%{?dist} +Release: 8.1%{?dist} URL: http://www.firewalld.org License: GPLv2+ Source0: https://fedorahosted.org/released/firewalld/%{name}-%{version}.tar.bz2 @@ -33,6 +33,7 @@ Patch18: firewalld-0.4.3.2-tolerate_ipv6_rpfilter_fail_rhbz#1285769.patch Patch19: firewalld-0.4.3.2-set_rules_copy_fix_rhbz#1373260.patch Patch20: firewalld-0.4.3.2-translation_update_rhbz#1273296.patch Patch21: firewalld-0.4.3.2-exclude_firewallctl_rhbz#1374799.patch +Patch22: firewalld-0.4.3.2-no_blanked_zone_rhbz#1381314.patch BuildArch: noarch BuildRequires: desktop-file-utils @@ -164,6 +165,7 @@ firewalld. %patch19 -p1 -b .set_rules_copy_fix_rhbz#1373260 %patch20 -p1 -b .translation_update_rhbz#1273296 %patch21 -p1 -b .exclude_firewallctl_rhbz#1374799 +%patch22 -p1 -b .no_blanked_zone_rhbz#1381314 %if 0%{?with_python3} rm -rf %{py3dir} @@ -352,6 +354,9 @@ fi %{_mandir}/man1/firewall-config*.1* %changelog +* Mon Jan 9 2017 Thomas Woerner - 0.4.3.2-8.1 +- Fix ZONE being blanked in ifcfg on reboot (RHBZ#1410860, RHBZ#1381314) + * Mon Sep 12 2016 Thomas Woerner - 0.4.3.2-8 - Exclude firewallctl (RHBZ#1374799)