diff --git a/SOURCES/0157-fix-policy-cache-rule_str-for-rich-rules.patch b/SOURCES/0157-fix-policy-cache-rule_str-for-rich-rules.patch new file mode 100644 index 0000000..e92a69d --- /dev/null +++ b/SOURCES/0157-fix-policy-cache-rule_str-for-rich-rules.patch @@ -0,0 +1,80 @@ +From 748065d9d6a90548ecf07a62bf4cc0ab77696994 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Wed, 26 Aug 2020 11:38:36 -0400 +Subject: [PATCH 157/158] fix(policy): cache rule_str for rich rules + +There are various areas that we use list comprehensions to convert +Rich_Rule to rule_str. This isn't cheap. Let's just cache the rule_str +and avoid the cost. + +Fixes: rhbz 1871298 +(cherry picked from commit 5402724221a3dddc9c139663d28ababed4057cc6) +(cherry picked from commit cc44042543a92393334d712ba8c3f3828aac33fb) +--- + src/firewall/core/io/zone.py | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/src/firewall/core/io/zone.py b/src/firewall/core/io/zone.py +index 05368e9c73eb..57a43ce1e0ef 100644 +--- a/src/firewall/core/io/zone.py ++++ b/src/firewall/core/io/zone.py +@@ -120,6 +120,7 @@ class Zone(IO_Object): + self.sources = [ ] + self.fw_config = None # to be able to check services and a icmp_blocks + self.rules = [ ] ++ self.rules_str = [ ] + self.icmp_block_inversion = False + self.combined = False + self.applied = False +@@ -141,6 +142,7 @@ class Zone(IO_Object): + del self.sources[:] + self.fw_config = None # to be able to check services and a icmp_blocks + del self.rules[:] ++ del self.rules_str[:] + self.icmp_block_inversion = False + self.combined = False + self.applied = False +@@ -163,17 +165,13 @@ class Zone(IO_Object): + self.interfaces = [u2b_if_py2(i) for i in self.interfaces] + self.sources = [u2b_if_py2(s) for s in self.sources] + self.rules = [u2b_if_py2(s) for s in self.rules] +- +- def __getattr__(self, name): +- if name == "rules_str": +- rules_str = [str(rule) for rule in self.rules] +- return rules_str +- else: +- return getattr(super(Zone, self), name) ++ self.rules_str = [u2b_if_py2(s) for s in self.rules_str] + + def __setattr__(self, name, value): + if name == "rules_str": + self.rules = [rich.Rich_Rule(rule_str=s) for s in value] ++ # must convert back to string to get the canonical string. ++ super(Zone, self).__setattr__(name, [str(s) for s in self.rules]) + else: + super(Zone, self).__setattr__(name, value) + +@@ -292,6 +290,7 @@ class Zone(IO_Object): + self.source_ports.append(port) + for rule in zone.rules: + self.rules.append(rule) ++ self.rules_str.append(str(rule)) + if zone.icmp_block_inversion: + self.icmp_block_inversion = True + +@@ -669,9 +668,9 @@ class zone_ContentHandler(IO_Object_ContentHandler): + except Exception as e: + log.warning("%s: %s", e, str(self._rule)) + else: +- if str(self._rule) not in \ +- [ str(x) for x in self.item.rules ]: ++ if str(self._rule) not in self.item.rules_str: + self.item.rules.append(self._rule) ++ self.item.rules_str.append(str(self._rule)) + else: + log.warning("Rule '%s' already set, ignoring.", + str(self._rule)) +-- +2.27.0 + diff --git a/SOURCES/0158-test-zone-rich-rule-parsing-bottleneck.patch b/SOURCES/0158-test-zone-rich-rule-parsing-bottleneck.patch new file mode 100644 index 0000000..0913f78 --- /dev/null +++ b/SOURCES/0158-test-zone-rich-rule-parsing-bottleneck.patch @@ -0,0 +1,55 @@ +From 7d3b14e91962df42a48f40f8ca5787f914413793 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Wed, 26 Aug 2020 14:28:45 -0400 +Subject: [PATCH 158/158] test(zone): rich rule parsing bottleneck + +Coverage for rhbz 1871298. +Verify we can parse a large amount of rich rules in a reasonable time. + +This test took 3m before the fix and now takes 18s after the fix. +Considering it "failed" after 45s should give us plenty of headroom. + +(cherry picked from commit ece30971412eedb9032b0d87233ca21ef9154830) +(cherry picked from commit 10960dba93f8dfe607010655cbaeaa7f535bfa96) +--- + src/tests/regression/regression.at | 1 + + src/tests/regression/rhbz1871298.at | 18 ++++++++++++++++++ + 2 files changed, 19 insertions(+) + create mode 100644 src/tests/regression/rhbz1871298.at + +diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at +index 42f299f16f1a..6e4dc21384d3 100644 +--- a/src/tests/regression/regression.at ++++ b/src/tests/regression/regression.at +@@ -28,3 +28,4 @@ m4_include([regression/gh567.at]) + m4_include([regression/rhbz1779835.at]) + m4_include([regression/gh599.at]) + m4_include([regression/rhbz1839781.at]) ++m4_include([regression/rhbz1871298.at]) +diff --git a/src/tests/regression/rhbz1871298.at b/src/tests/regression/rhbz1871298.at +new file mode 100644 +index 000000000000..0689399d85ec +--- /dev/null ++++ b/src/tests/regression/rhbz1871298.at +@@ -0,0 +1,18 @@ ++FWD_START_TEST([rich rule parsing bottleneck]) ++AT_KEYWORDS(rich offline rhbz1871298) ++ ++AT_SKIP_IF([! NS_CMD([which timeout >/dev/null 2>&1])]) ++ ++NS_CHECK([mkdir -p ./zones]) ++NS_CHECK([echo '' > ./zones/foobar.xml]) ++NS_CHECK([echo "" >> ./zones/foobar.xml]) ++NS_CHECK([echo "foobar" >> ./zones/foobar.xml]) ++NS_CHECK([sh -c 'for I in $(seq 10000); do echo "" >> ./zones/foobar.xml; done']) ++NS_CHECK([echo "" >> ./zones/foobar.xml]) ++ ++if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then ++ FIREWALL_OFFLINE_CMD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}" ++fi ++NS_CHECK([timeout 45 firewall-offline-cmd --system-config ./ $FIREWALL_OFFLINE_CMD_ARGS --check-config], 0, [ignore]) ++ ++FWD_END_TEST +-- +2.27.0 + diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec index 453daa4..5817730 100644 --- a/SPECS/firewalld.spec +++ b/SPECS/firewalld.spec @@ -8,7 +8,7 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld Version: 0.6.3 -Release: 11%{?dist} +Release: 12%{?dist} URL: http://www.firewalld.org License: GPLv2+ Source0: https://github.com/firewalld/firewalld/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz @@ -167,6 +167,8 @@ Patch153: 0153-fix-test-regression-gh599-fix-if-not-using-debug-out.patch Patch154: 0154-fix-test-regression-gh599-use-expr-to-be-more-portab.patch Patch155: 0155-feat-service-add-RH-Satellite-6-Capsule.patch Patch156: 0156-test-service-coverage-for-RH-Satellite-6.patch +Patch157: 0157-fix-policy-cache-rule_str-for-rich-rules.patch +Patch158: 0158-test-zone-rich-rule-parsing-bottleneck.patch BuildArch: noarch BuildRequires: desktop-file-utils @@ -468,6 +470,9 @@ fi %{_mandir}/man1/firewall-config*.1* %changelog +* Tue Sep 08 2020 Eric Garver - 0.6.3-12 +- fix(zone): cache rule_str for rich rules + * Wed Jun 10 2020 Eric Garver - 0.6.3-11 - feat(service): add RH-Satellite-6-Capsule