diff --git a/SOURCES/0069-fix-nm-reload-only-consider-NM-connections-with-a-re.patch b/SOURCES/0069-fix-nm-reload-only-consider-NM-connections-with-a-re.patch new file mode 100644 index 0000000..54fc1e2 --- /dev/null +++ b/SOURCES/0069-fix-nm-reload-only-consider-NM-connections-with-a-re.patch @@ -0,0 +1,45 @@ +From 4f3a9e3b9c776cce4603f91cf1cd3e0b36e9fe4a Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Tue, 27 Apr 2021 08:56:13 -0400 +Subject: [PATCH 69/70] fix(nm): reload: only consider NM connections with a + real interface + +Where real interface means linux interface capable of having an IP +address and does not exceed IFNAMSIZ. + +Fixes: rhbz 1928860 +(cherry picked from commit f18f1cc96503fbc5d42f30ecdc6f0da4c56aac4d) +(cherry picked from commit f65679066695887b143d1443ac1735b4c602b8dd) +--- + src/firewall/core/fw_nm.py | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/firewall/core/fw_nm.py b/src/firewall/core/fw_nm.py +index 37282a1a7711..0e38dd47e927 100644 +--- a/src/firewall/core/fw_nm.py ++++ b/src/firewall/core/fw_nm.py +@@ -141,7 +141,9 @@ def nm_get_connections(connections, connections_name): + + connections_name[uuid] = name + for dev in devices: +- connections[dev.get_iface()] = uuid ++ ip_iface = dev.get_ip_iface() ++ if ip_iface: ++ connections[ip_iface] = uuid + + def nm_get_interfaces(): + """Get active interfaces from NM +@@ -169,7 +171,9 @@ def nm_get_interfaces(): + continue + + for dev in active_con.get_devices(): +- active_interfaces.append(dev.get_iface()) ++ ip_iface = dev.get_ip_iface() ++ if ip_iface: ++ active_interfaces.append(ip_iface) + + return active_interfaces + +-- +2.27.0 + diff --git a/SOURCES/0070-test-nm-reload-only-consider-NM-connections-with-a-r.patch b/SOURCES/0070-test-nm-reload-only-consider-NM-connections-with-a-r.patch new file mode 100644 index 0000000..387a0c3 --- /dev/null +++ b/SOURCES/0070-test-nm-reload-only-consider-NM-connections-with-a-r.patch @@ -0,0 +1,81 @@ +From 2ecba497ec9d57647748f74500ce5e2ea115474a Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Tue, 27 Apr 2021 09:06:22 -0400 +Subject: [PATCH 70/70] test(nm): reload: only consider NM connections with a + real interface + +Coverage: rhbz 1928860 +(cherry picked from commit 7566d3dc5664955064b14314b3d3ef20bcebd6e4) +(cherry picked from commit 2e371157382e77731d07c6519fc5692e556e2bee) +--- + src/tests/Makefile.am | 4 ++-- + src/tests/integration/networkmanager.at | 1 + + src/tests/integration/rhbz1928860.at | 26 +++++++++++++++++++++++++ + 3 files changed, 29 insertions(+), 2 deletions(-) + create mode 100644 src/tests/integration/rhbz1928860.at + +diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am +index b7556b30ecc8..e936454faf6a 100644 +--- a/src/tests/Makefile.am ++++ b/src/tests/Makefile.am +@@ -71,7 +71,7 @@ check-container-fedora-rawhide-image: check-container-%-image: + iptables iptables-nft libtool libxml2 libxslt make nftables \ + python3-nftables python3-slip-dbus python3-gobject-base \ + diffutils procps-ng iproute which dbus-daemon \ +- NetworkManager" && \ ++ NetworkManager NetworkManager-ovs" && \ + echo "RUN alternatives --set ebtables /usr/sbin/ebtables-nft" && \ + echo "COPY . /tmp/firewalld"; \ + } | $(PODMAN) build -t firewalld-testsuite-$* -f - . ) +@@ -86,7 +86,7 @@ check-container-centos8-stream-image: check-container-%-image: + iptables iptables-ebtables nftables libtool libxml2 \ + libxslt make nftables python3-nftables python3-slip-dbus \ + python3-gobject-base diffutils procps-ng iproute which dbus-daemon \ +- NetworkManager" && \ ++ NetworkManager NetworkManager-ovs" && \ + echo "COPY . /tmp/firewalld"; \ + } | $(PODMAN) build -t firewalld-testsuite-$* -f - . ) + +diff --git a/src/tests/integration/networkmanager.at b/src/tests/integration/networkmanager.at +index 08cf6d28451a..0b20adce0462 100644 +--- a/src/tests/integration/networkmanager.at ++++ b/src/tests/integration/networkmanager.at +@@ -1,2 +1,3 @@ + AT_BANNER([NetworkManager (FIREWALL_BACKEND)]) + m4_include([integration/rhbz1773809.at]) ++m4_include([integration/rhbz1928860.at]) +diff --git a/src/tests/integration/rhbz1928860.at b/src/tests/integration/rhbz1928860.at +new file mode 100644 +index 000000000000..8ef2a1dcbd01 +--- /dev/null ++++ b/src/tests/integration/rhbz1928860.at +@@ -0,0 +1,26 @@ ++FWD_START_TEST([reload don't consider non IP capable interfaces]) ++AT_KEYWORDS(reload rhbz1928860) ++ ++START_NETWORKMANAGER ++ ++dnl OVS bridge and port ++NMCLI_CHECK([connection add type ovs-bridge conn.interface ovs-br con-name ovs-br], 0, [ignore]) ++NMCLI_CHECK([connection add type ovs-port conn.interface ovs-interface-port master ovs-br con-name ovs-interface-port], 0, [ignore]) ++echo NS_CMD([nmcli connection delete ovs-br]) >> ./cleanup ++echo NS_CMD([nmcli connection delete ovs-interface-port]) >> ./cleanup ++ ++dnl Up them ++NMCLI_CHECK([connection up ovs-br], 0, [ignore]) ++NMCLI_CHECK([connection up ovs-interface-port], 0, [ignore]) ++ ++dnl Omit the actual linux interface because it requires the OVS daemon to be ++dnl running. The bug is reproducible without it. ++dnl ++dnl NMCLI_CHECK([connection add type ovs-interface slave-type ovs-port conn.interface ovs-br master ovs-interface-port con-name ovs-interface ipv4.method disabled ipv6.method disabled], 0, [ignore]) ++dnl echo NS_CMD([nmcli connection delete ovs-interface]) >> ./cleanup ++dnl NMCLI_CHECK([connection up ovs-interface], 0, [ignore]) ++ ++dnl just need to verify reload ++FWD_RELOAD ++ ++FWD_END_TEST +-- +2.27.0 + diff --git a/SPECS/firewalld.spec b/SPECS/firewalld.spec index 5dbf1cc..72a715f 100644 --- a/SPECS/firewalld.spec +++ b/SPECS/firewalld.spec @@ -1,7 +1,7 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld Version: 0.8.2 -Release: 6%{?dist} +Release: 7%{?dist} URL: http://www.firewalld.org License: GPLv2+ Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz @@ -73,6 +73,8 @@ Patch65: 0065-fix-rich-non-printable-characters-removed-from-rich-.patch Patch66: 0066-fix-rich-limit-table-to-strip-non-printables-to-C0-a.patch Patch67: 0067-fix-zone-add-source-with-mac-address.patch Patch68: v1.0.0-0068-feat-service-add-galera-service.patch +Patch69: 0069-fix-nm-reload-only-consider-NM-connections-with-a-re.patch +Patch70: 0070-test-nm-reload-only-consider-NM-connections-with-a-r.patch BuildArch: noarch BuildRequires: autoconf @@ -271,6 +273,9 @@ desktop-file-install --delete-original \ %{_mandir}/man1/firewall-config*.1* %changelog +* Tue Jun 01 2021 Eric Garver - 0.8.2-7 +- fix(nm): reload: only consider NM connections with a real interface + * Fri Jan 29 2021 Eric Garver - 0.8.2-6 - feat(service): add galera service