diff --git a/.firewalld.metadata b/.firewalld.metadata index 6be46b7..931166f 100644 --- a/.firewalld.metadata +++ b/.firewalld.metadata @@ -1 +1 @@ -407ba61d94d4c3b25c5d6094a06c305ba72557de SOURCES/firewalld-1.1.1.tar.gz +521991a6f1e7d38e79cd2e5dc42290151fe131ce SOURCES/firewalld-1.2.1.tar.gz diff --git a/.gitignore b/.gitignore index 566fdeb..34488a1 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/firewalld-1.1.1.tar.gz +SOURCES/firewalld-1.2.1.tar.gz diff --git a/SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch b/SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch deleted file mode 100644 index 6b7a5c5..0000000 --- a/SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch +++ /dev/null @@ -1,46 +0,0 @@ -From ba20c6cb0a516545404e5e02cddf3b1d01fac79b Mon Sep 17 00:00:00 2001 -From: Eric Garver -Date: Tue, 5 Jul 2022 15:43:19 -0400 -Subject: [PATCH 2/3] test(functions): commonize iptables output normalization - -Share rule normalization between iptables and ip6tables. - -(cherry picked from commit 54e761a0fe2d19dfc4c0c898540f718c837778a9) ---- - src/tests/functions.at | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/src/tests/functions.at b/src/tests/functions.at -index 557acf0257e4..481c94017f15 100644 ---- a/src/tests/functions.at -+++ b/src/tests/functions.at -@@ -393,11 +393,15 @@ m4_define([EBTABLES_LIST_RULES], [ - ]) - ]) - --m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl -+m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl - TRIM_WHITESPACE | dnl - tail -n +3 dnl - ]) - -+m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl -+ IPXTABLES_LIST_RULES_NORMALIZE() dnl -+]) -+ - m4_define([IPTABLES_LIST_RULES_ALWAYS], [ - m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [ - NS_CHECK([PIPESTATUS0([$IPTABLES -w -n -t $1 -L $2], [IPTABLES_LIST_RULES_NORMALIZE])], -@@ -412,8 +416,7 @@ m4_define([IPTABLES_LIST_RULES], [ - ]) - - m4_define([IP6TABLES_LIST_RULES_NORMALIZE], [dnl -- TRIM_WHITESPACE | dnl -- tail -n +3 dnl -+ IPXTABLES_LIST_RULES_NORMALIZE() dnl - ]) - - m4_define([IP6TABLES_LIST_RULES_ALWAYS], [ --- -2.31.1 - diff --git a/SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch b/SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch deleted file mode 100644 index db3b039..0000000 --- a/SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 68276da6dda3f73dfed5e6758675a5148ac77271 Mon Sep 17 00:00:00 2001 -From: Eric Garver -Date: Tue, 5 Jul 2022 14:38:34 -0400 -Subject: [PATCH 3/3] test(functions): normalize iptables ipv6-icmp/icmpv6 - -The output changed in iptables 1.8.8. Specifically commit b6196c7504d4 -("xshared: Prefer xtables_chain_protos lookup over getprotoent"). - -Fixes: #982 -Fixes: rhbz2100881 -(cherry picked from commit c54ea7b5e492b3aae631dc71579afc24d713401f) ---- - src/tests/functions.at | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/src/tests/functions.at b/src/tests/functions.at -index 481c94017f15..a38ae9005ea2 100644 ---- a/src/tests/functions.at -+++ b/src/tests/functions.at -@@ -395,7 +395,10 @@ m4_define([EBTABLES_LIST_RULES], [ - - m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl - TRIM_WHITESPACE | dnl -- tail -n +3 dnl -+ tail -n +3 | dnl -+ dnl iptables-1.8.8 changed output of some protocols -+ dnl commit b6196c7504d4 ("xshared: Prefer xtables_chain_protos lookup over getprotoent") -+ sed -e ['s/[ ]ipv6-icmp\([ -]\)/ icmpv6\1/g'] dnl - ]) - - m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl --- -2.31.1 - diff --git a/SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch b/SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch deleted file mode 100644 index d439b4e..0000000 --- a/SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch +++ /dev/null @@ -1,42 +0,0 @@ -From f9e0fdd188e7730468bebdf35f573f2a1ef6bd9b Mon Sep 17 00:00:00 2001 -From: Eric Garver -Date: Tue, 2 Aug 2022 13:11:31 -0400 -Subject: [PATCH 4/5] fix(runtimeToPermanent): errors for interfaces not in - zone - -We should only consider the interfaces for the currently iterated over -zone. Otherwise we will attempt to remove an interface from a zone for -which it is does not belong. - -Note this only occurs when NetworkManager is running. - -Fixes: #976 -Fixes: rhbz2112982 -(cherry picked from commit 15f47354c4a078dc694df1541550b3e5156548fc) ---- - src/firewall/server/firewalld.py | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - -diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py -index 5cf963dfbbd4..f5f902d6e712 100644 ---- a/src/firewall/server/firewalld.py -+++ b/src/firewall/server/firewalld.py -@@ -447,10 +447,11 @@ class FirewallD(DbusServiceObject): - conf = self.getZoneSettings2(name) - settings = FirewallClientZoneSettings(conf) - changed = False -- for interface in self.fw._nm_assigned_interfaces: -- log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface)) -- settings.removeInterface(interface) -- changed = True -+ for interface in settings.getInterfaces(): -+ if interface in self.fw._nm_assigned_interfaces: -+ log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface)) -+ settings.removeInterface(interface) -+ changed = True - # For the remaining interfaces, attempt to let NM manage them - for interface in settings.getInterfaces(): - try: --- -2.31.1 - diff --git a/SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch b/SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch deleted file mode 100644 index 14c1d76..0000000 --- a/SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 5300da5cbb6c696baad71fb85ca36e65ab5ba292 Mon Sep 17 00:00:00 2001 -From: Eric Garver -Date: Mon, 1 Aug 2022 14:43:23 -0400 -Subject: [PATCH 5/5] test(runtimeToPermanent): verify when NM interfaces - present - -Coverage: #976 -Coverage: rhbz2112982 -(cherry picked from commit f4f67413e4db7c789bf9d7ba8e983505a6e6e6df) ---- - src/tests/integration/gh976.at | 14 ++++++++++++++ - src/tests/integration/networkmanager.at | 1 + - 2 files changed, 15 insertions(+) - create mode 100644 src/tests/integration/gh976.at - -diff --git a/src/tests/integration/gh976.at b/src/tests/integration/gh976.at -new file mode 100644 -index 000000000000..977eca997a3a ---- /dev/null -+++ b/src/tests/integration/gh976.at -@@ -0,0 +1,14 @@ -+FWD_START_TEST([interfaces during runtime to permanent]) -+AT_KEYWORDS(gh976 rhbz2112982) -+ -+START_NETWORKMANAGER() -+ -+NMCLI_CHECK([connection add type dummy con-name dummy0 ifname dummy0 ip4 10.0.0.2 gw4 10.0.0.1], 0, [ignore]) -+echo NS_CMD([nmcli connection delete dummy0]) >> ./cleanup -+NMCLI_CHECK([connection show dummy0], 0, [ignore]) -+NMCLI_CHECK([connection up dummy0], 0, [ignore]) -+ -+FWD_CHECK([--add-service smtp], 0, [ignore]) -+FWD_CHECK([--runtime-to-permanent], 0, [ignore]) -+ -+FWD_END_TEST() -diff --git a/src/tests/integration/networkmanager.at b/src/tests/integration/networkmanager.at -index 0b20adce0462..c93e92d70754 100644 ---- a/src/tests/integration/networkmanager.at -+++ b/src/tests/integration/networkmanager.at -@@ -1,3 +1,4 @@ - AT_BANNER([NetworkManager (FIREWALL_BACKEND)]) - m4_include([integration/rhbz1773809.at]) - m4_include([integration/rhbz1928860.at]) -+m4_include([integration/gh976.at]) --- -2.31.1 - diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec index 816a65b..0b6f6f4 100644 --- a/SPECS/firewalld.spec +++ b/SPECS/firewalld.spec @@ -1,15 +1,11 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld -Version: 1.1.1 -Release: 3%{?dist} +Version: 1.2.1 +Release: 1%{?dist} URL: http://www.firewalld.org License: GPLv2+ Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch -Patch2: 0002-test-functions-commonize-iptables-output-normalizati.patch -Patch3: 0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch -Patch4: 0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch -Patch5: 0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch BuildArch: noarch BuildRequires: autoconf BuildRequires: automake @@ -141,7 +137,7 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite %systemd_postun_with_restart firewalld.service %files -f %{name}.lang -%doc COPYING README +%doc COPYING README.md %{_sbindir}/firewalld %{_bindir}/firewall-cmd %{_bindir}/firewall-offline-cmd @@ -150,7 +146,7 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite %dir %{_datadir}/zsh/site-functions %{_datadir}/zsh/site-functions/_firewalld %{_prefix}/lib/firewalld/icmptypes/*.xml -%{_prefix}/lib/firewalld/ipsets/README +%{_prefix}/lib/firewalld/ipsets/README.md %{_prefix}/lib/firewalld/policies/*.xml %{_prefix}/lib/firewalld/services/*.xml %{_prefix}/lib/firewalld/zones/*.xml @@ -231,6 +227,9 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite %{_mandir}/man1/firewall-config*.1* %changelog +* Mon Nov 07 2022 Eric Garver - 1.2.1-1 +- package rebase to v1.2.1 + * Wed Aug 03 2022 Eric Garver - 1.1.1-3 - fix(runtimeToPermanent): errors for interfaces not in zone