diff --git a/backport-chore-nftables-add-delete-table-helper.patch b/backport-chore-nftables-add-delete-table-helper.patch new file mode 100644 index 0000000000000000000000000000000000000000..074b4a6b07a32a202657db16d48b43fad6487c14 --- /dev/null +++ b/backport-chore-nftables-add-delete-table-helper.patch @@ -0,0 +1,44 @@ +From 8be561d26931832f000526cc41293700faa6c877 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Mon, 14 Aug 2023 09:13:29 -0400 +Subject: [PATCH] chore(nftables): add delete table helper + +This is to workaround an nftables issue where using the "delete" verb on +a table that does not exist will throw ENOENT. We can't use the newer +"destroy" verb because it's too new to rely upon. + +A simple hack is to always add the table before deleting it. The "add" +is ignored if the table already exists. + +Conflict: NA +Reference: https://github.com/firewalld/firewalld/commit/8be561d26931832f000526cc41293700faa6c877 + +--- + src/firewall/core/nftables.py | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py +index f269afa9..ce8cb5e7 100644 +--- a/src/firewall/core/nftables.py ++++ b/src/firewall/core/nftables.py +@@ -383,6 +383,17 @@ class nftables: + # Tables always exist in nftables + return [table] if table else IPTABLES_TO_NFT_HOOK.keys() + ++ def _build_delete_table_rules(self, table): ++ # To avoid nftables returning ENOENT we always add the table before ++ # deleting to guarantee it will exist. ++ # ++ # In the future, this add+delete should be replaced with "destroy", but ++ # that verb is too new to rely upon. ++ return [{"add": {"table": {"family": "inet", ++ "name": table}}}, ++ {"delete": {"table": {"family": "inet", ++ "name": table}}}] ++ + def build_flush_rules(self): + # Policy is stashed in a separate table that we're _not_ going to + # flush. As such, we retain the policy rule handles and ref counts. +-- +2.33.0 + diff --git a/backport-fix-nftables-always-flush-main-table-on-start.patch b/backport-fix-nftables-always-flush-main-table-on-start.patch new file mode 100644 index 0000000000000000000000000000000000000000..378d68e326cfccc7774bd9df8dbca51261d09756 --- /dev/null +++ b/backport-fix-nftables-always-flush-main-table-on-start.patch @@ -0,0 +1,39 @@ +From 6a155ea7195f2c720625e2452afa41544b4b4227 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Thu, 10 Aug 2023 08:43:03 -0400 +Subject: [PATCH] fix(nftables): always flush main table on start + +On start created_tables will not contain the main "firewalld" table so a +flush command is not issued. We should always attempt to flush. If +CleanupOnExit=no, then not flushing causes duplicate rules on restart. + +Fixes: rhbz2222044 + +Conflict: NA +Reference: https://github.com/firewalld/firewalld/commit/6a155ea7195f2c720625e2452afa41544b4b4227 + +--- + src/firewall/core/nftables.py | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py +index 975f1fa..f7f5bb0 100644 +--- a/src/firewall/core/nftables.py ++++ b/src/firewall/core/nftables.py +@@ -410,12 +410,9 @@ class nftables(object): + self.policy_priority_counts = {} + self.zone_source_index_cache = {} + +- rules = [] + if TABLE_NAME in self.created_tables["inet"]: +- rules.append({"delete": {"table": {"family": "inet", +- "name": TABLE_NAME}}}) + self.created_tables["inet"].remove(TABLE_NAME) +- return rules ++ return self._build_delete_table_rules(TABLE_NAME) + + def _build_set_policy_rules_ct_rules(self, enable): + add_del = { True: "add", False: "delete" }[enable] +-- +2.33.0 + diff --git a/firewalld.spec b/firewalld.spec index 26a1b33efeaf8dbf8f71f6387dd7bda50d62661b..4e620aca5e61d41f2a475bad3030b073a7ebfb9b 100644 --- a/firewalld.spec +++ b/firewalld.spec @@ -1,6 +1,6 @@ Name: firewalld Version: 1.2.6 -Release: 1 +Release: 2 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall License: GPLv2+ URL: http://www.firewalld.org @@ -10,6 +10,8 @@ Patch0: firewalld-0.2.6-MDNS-default.patch Patch1: repair-test-cases.patch Patch2: add-Restart-on-failure-on-firewalld.service.patch Patch3: 0001-fix-config-Specify-the-translation-encoding-format-a.patch +Patch4: backport-chore-nftables-add-delete-table-helper.patch +Patch5: backport-fix-nftables-always-flush-main-table-on-start.patch BuildArch: noarch BuildRequires: autoconf automake desktop-file-utils gettext intltool glib2 glib2-devel systemd-units docbook-style-xsl @@ -231,6 +233,13 @@ fi %{_datadir}/firewalld/testsuite/python/firewalld_test.py %changelog +* Sun Apr 28 2024 zhouyihang - 1.2.6-2 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:chore nftables add delete table helper + fix nftables always flush main table on start + * Sat Jan 06 2024 zhanghao - 1.2.6-1 - Type:requirement - ID:NA