diff --git a/.firewalld.metadata b/.firewalld.metadata index 555e94a..6be46b7 100644 --- a/.firewalld.metadata +++ b/.firewalld.metadata @@ -1 +1 @@ -8ae534ae5675079eb893406ec88b52ee7f88cb6b SOURCES/firewalld-1.0.0.tar.gz +407ba61d94d4c3b25c5d6094a06c305ba72557de SOURCES/firewalld-1.1.1.tar.gz diff --git a/.gitignore b/.gitignore index ccb330f..566fdeb 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/firewalld-1.0.0.tar.gz +SOURCES/firewalld-1.1.1.tar.gz diff --git a/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch b/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch deleted file mode 100644 index 714e43d..0000000 --- a/SOURCES/0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 09cdc166ddfe53b6e8ce3a2920f798320c170b7f Mon Sep 17 00:00:00 2001 -From: Eric Garver -Date: Wed, 11 Aug 2021 14:47:59 -0400 -Subject: [PATCH 2/3] fix(firewalld): keep linux capability CAP_SYS_MODULE - -When firewalld calls ip6tables it may implicitly load the ip6_tables, et -al kernel modules. As such we need to retain CAP_SYS_MODULE so that -implicit module is allowed. Otherwise we get EPERM from the kernel. - -This only affects the -legacy variants and the top level table/chain -modules. The userspace binaries will modprobe the kernel modules. -Extensions, e.g. xt_conntrack, are implicitly loaded by the kernel based -on the rules being added and thus not subject to linux capabilities -checks. - -The -nft variants are unaffected because they use the nftables -infrastructure which has implicit module loading in the kernel similar -to the iptables extensions (xt_* modules). - -Fixes: rhbz 1990271 -Fixes: fb0532e8a200 ("feat(firewalld): drop linux capabilities") -(cherry picked from commit 13801962073f478c68d818b314091badcf8b5614) -(cherry picked from commit d3cd7e088f946c75593b0569bd658266b2e9329d) ---- - src/firewalld.in | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/src/firewalld.in b/src/firewalld.in -index abcbe3508f86..b1c886c6f02f 100755 ---- a/src/firewalld.in -+++ b/src/firewalld.in -@@ -136,6 +136,7 @@ def startup(args): - # attempt to drop Linux capabilities to a minimal set: - # - CAP_NET_ADMIN - # - CAP_NET_RAW -+ # - CAP_SYS_MODULE - try: - import capng - capng.capng_clear(capng.CAPNG_SELECT_BOTH) -@@ -143,8 +144,10 @@ def startup(args): - capng.CAP_NET_ADMIN) - capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, - capng.CAP_NET_RAW) -+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -+ capng.CAP_SYS_MODULE) - capng.capng_apply(capng.CAPNG_SELECT_BOTH) -- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW.") -+ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") - except ImportError: - pass - --- -2.31.1 - diff --git a/SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch b/SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch new file mode 100644 index 0000000..6b7a5c5 --- /dev/null +++ b/SOURCES/0002-test-functions-commonize-iptables-output-normalizati.patch @@ -0,0 +1,46 @@ +From ba20c6cb0a516545404e5e02cddf3b1d01fac79b Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Tue, 5 Jul 2022 15:43:19 -0400 +Subject: [PATCH 2/3] test(functions): commonize iptables output normalization + +Share rule normalization between iptables and ip6tables. + +(cherry picked from commit 54e761a0fe2d19dfc4c0c898540f718c837778a9) +--- + src/tests/functions.at | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/tests/functions.at b/src/tests/functions.at +index 557acf0257e4..481c94017f15 100644 +--- a/src/tests/functions.at ++++ b/src/tests/functions.at +@@ -393,11 +393,15 @@ m4_define([EBTABLES_LIST_RULES], [ + ]) + ]) + +-m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl ++m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl + TRIM_WHITESPACE | dnl + tail -n +3 dnl + ]) + ++m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl ++ IPXTABLES_LIST_RULES_NORMALIZE() dnl ++]) ++ + m4_define([IPTABLES_LIST_RULES_ALWAYS], [ + m4_ifdef([TESTING_FIREWALL_OFFLINE_CMD], [], [ + NS_CHECK([PIPESTATUS0([$IPTABLES -w -n -t $1 -L $2], [IPTABLES_LIST_RULES_NORMALIZE])], +@@ -412,8 +416,7 @@ m4_define([IPTABLES_LIST_RULES], [ + ]) + + m4_define([IP6TABLES_LIST_RULES_NORMALIZE], [dnl +- TRIM_WHITESPACE | dnl +- tail -n +3 dnl ++ IPXTABLES_LIST_RULES_NORMALIZE() dnl + ]) + + m4_define([IP6TABLES_LIST_RULES_ALWAYS], [ +-- +2.31.1 + diff --git a/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch b/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch deleted file mode 100644 index b93f0ea..0000000 --- a/SOURCES/0003-fix-firewalld-check-capng_apply-return-code.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001 -From: Eric Garver -Date: Mon, 30 Aug 2021 13:24:47 -0400 -Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code - -If dropping capabilities is blocked by SELinux, e.g. old selinux-policy, -then capng_apply() will return non-zero. Also check other things that -may fail, i.e. capng_update(). - -Fixes: rhbz 1999090 -(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363) -(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57) ---- - src/firewalld.in | 18 ++++++++++-------- - 1 file changed, 10 insertions(+), 8 deletions(-) - -diff --git a/src/firewalld.in b/src/firewalld.in -index b1c886c6f02f..38331a0b49a9 100755 ---- a/src/firewalld.in -+++ b/src/firewalld.in -@@ -140,14 +140,16 @@ def startup(args): - try: - import capng - capng.capng_clear(capng.CAPNG_SELECT_BOTH) -- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -- capng.CAP_NET_ADMIN) -- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -- capng.CAP_NET_RAW) -- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -- capng.CAP_SYS_MODULE) -- capng.capng_apply(capng.CAPNG_SELECT_BOTH) -- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") -+ if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -+ capng.CAP_NET_ADMIN) or \ -+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -+ capng.CAP_NET_RAW) or \ -+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, -+ capng.CAP_SYS_MODULE) or \ -+ capng.capng_apply(capng.CAPNG_SELECT_BOTH): -+ log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.") -+ else: -+ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") - except ImportError: - pass - --- -2.31.1 - diff --git a/SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch b/SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch new file mode 100644 index 0000000..db3b039 --- /dev/null +++ b/SOURCES/0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch @@ -0,0 +1,34 @@ +From 68276da6dda3f73dfed5e6758675a5148ac77271 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Tue, 5 Jul 2022 14:38:34 -0400 +Subject: [PATCH 3/3] test(functions): normalize iptables ipv6-icmp/icmpv6 + +The output changed in iptables 1.8.8. Specifically commit b6196c7504d4 +("xshared: Prefer xtables_chain_protos lookup over getprotoent"). + +Fixes: #982 +Fixes: rhbz2100881 +(cherry picked from commit c54ea7b5e492b3aae631dc71579afc24d713401f) +--- + src/tests/functions.at | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/tests/functions.at b/src/tests/functions.at +index 481c94017f15..a38ae9005ea2 100644 +--- a/src/tests/functions.at ++++ b/src/tests/functions.at +@@ -395,7 +395,10 @@ m4_define([EBTABLES_LIST_RULES], [ + + m4_define([IPXTABLES_LIST_RULES_NORMALIZE], [dnl + TRIM_WHITESPACE | dnl +- tail -n +3 dnl ++ tail -n +3 | dnl ++ dnl iptables-1.8.8 changed output of some protocols ++ dnl commit b6196c7504d4 ("xshared: Prefer xtables_chain_protos lookup over getprotoent") ++ sed -e ['s/[ ]ipv6-icmp\([ -]\)/ icmpv6\1/g'] dnl + ]) + + m4_define([IPTABLES_LIST_RULES_NORMALIZE], [dnl +-- +2.31.1 + diff --git a/SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch b/SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch new file mode 100644 index 0000000..d439b4e --- /dev/null +++ b/SOURCES/0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch @@ -0,0 +1,42 @@ +From f9e0fdd188e7730468bebdf35f573f2a1ef6bd9b Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Tue, 2 Aug 2022 13:11:31 -0400 +Subject: [PATCH 4/5] fix(runtimeToPermanent): errors for interfaces not in + zone + +We should only consider the interfaces for the currently iterated over +zone. Otherwise we will attempt to remove an interface from a zone for +which it is does not belong. + +Note this only occurs when NetworkManager is running. + +Fixes: #976 +Fixes: rhbz2112982 +(cherry picked from commit 15f47354c4a078dc694df1541550b3e5156548fc) +--- + src/firewall/server/firewalld.py | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/src/firewall/server/firewalld.py b/src/firewall/server/firewalld.py +index 5cf963dfbbd4..f5f902d6e712 100644 +--- a/src/firewall/server/firewalld.py ++++ b/src/firewall/server/firewalld.py +@@ -447,10 +447,11 @@ class FirewallD(DbusServiceObject): + conf = self.getZoneSettings2(name) + settings = FirewallClientZoneSettings(conf) + changed = False +- for interface in self.fw._nm_assigned_interfaces: +- log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface)) +- settings.removeInterface(interface) +- changed = True ++ for interface in settings.getInterfaces(): ++ if interface in self.fw._nm_assigned_interfaces: ++ log.debug1("Zone '%s': interface binding for '%s' has been added by NM, ignoring." % (name, interface)) ++ settings.removeInterface(interface) ++ changed = True + # For the remaining interfaces, attempt to let NM manage them + for interface in settings.getInterfaces(): + try: +-- +2.31.1 + diff --git a/SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch b/SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch new file mode 100644 index 0000000..14c1d76 --- /dev/null +++ b/SOURCES/0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch @@ -0,0 +1,47 @@ +From 5300da5cbb6c696baad71fb85ca36e65ab5ba292 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Mon, 1 Aug 2022 14:43:23 -0400 +Subject: [PATCH 5/5] test(runtimeToPermanent): verify when NM interfaces + present + +Coverage: #976 +Coverage: rhbz2112982 +(cherry picked from commit f4f67413e4db7c789bf9d7ba8e983505a6e6e6df) +--- + src/tests/integration/gh976.at | 14 ++++++++++++++ + src/tests/integration/networkmanager.at | 1 + + 2 files changed, 15 insertions(+) + create mode 100644 src/tests/integration/gh976.at + +diff --git a/src/tests/integration/gh976.at b/src/tests/integration/gh976.at +new file mode 100644 +index 000000000000..977eca997a3a +--- /dev/null ++++ b/src/tests/integration/gh976.at +@@ -0,0 +1,14 @@ ++FWD_START_TEST([interfaces during runtime to permanent]) ++AT_KEYWORDS(gh976 rhbz2112982) ++ ++START_NETWORKMANAGER() ++ ++NMCLI_CHECK([connection add type dummy con-name dummy0 ifname dummy0 ip4 10.0.0.2 gw4 10.0.0.1], 0, [ignore]) ++echo NS_CMD([nmcli connection delete dummy0]) >> ./cleanup ++NMCLI_CHECK([connection show dummy0], 0, [ignore]) ++NMCLI_CHECK([connection up dummy0], 0, [ignore]) ++ ++FWD_CHECK([--add-service smtp], 0, [ignore]) ++FWD_CHECK([--runtime-to-permanent], 0, [ignore]) ++ ++FWD_END_TEST() +diff --git a/src/tests/integration/networkmanager.at b/src/tests/integration/networkmanager.at +index 0b20adce0462..c93e92d70754 100644 +--- a/src/tests/integration/networkmanager.at ++++ b/src/tests/integration/networkmanager.at +@@ -1,3 +1,4 @@ + AT_BANNER([NetworkManager (FIREWALL_BACKEND)]) + m4_include([integration/rhbz1773809.at]) + m4_include([integration/rhbz1928860.at]) ++m4_include([integration/gh976.at]) +-- +2.31.1 + diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec index 1245be3..816a65b 100644 --- a/SPECS/firewalld.spec +++ b/SPECS/firewalld.spec @@ -1,13 +1,15 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld -Version: 1.0.0 -Release: 4%{?dist} +Version: 1.1.1 +Release: 3%{?dist} URL: http://www.firewalld.org License: GPLv2+ Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch -Patch2: 0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch -Patch3: 0003-fix-firewalld-check-capng_apply-return-code.patch +Patch2: 0002-test-functions-commonize-iptables-output-normalizati.patch +Patch3: 0003-test-functions-normalize-iptables-ipv6-icmp-icmpv6.patch +Patch4: 0004-fix-runtimeToPermanent-errors-for-interfaces-not-in-.patch +Patch5: 0005-test-runtimeToPermanent-verify-when-NM-interfaces-pr.patch BuildArch: noarch BuildRequires: autoconf BuildRequires: automake @@ -229,6 +231,15 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite %{_mandir}/man1/firewall-config*.1* %changelog +* Wed Aug 03 2022 Eric Garver - 1.1.1-3 +- fix(runtimeToPermanent): errors for interfaces not in zone + +* Fri Jul 15 2022 Eric Garver - 1.1.1-2 +- test(functions): normalize iptables ipv6-icmp/icmpv6 + +* Mon May 16 2022 Eric Garver - 1.1.1-1 +- package rebase to v1.1.1 + * Mon Nov 22 2021 Eric Garver - 1.0.0-4 - fix(firewalld): check capng_apply() return code