开源软件构建与测试

_service:tar_scm:firewalld.spec Changed

_service Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/config/Makefile.am -> _service:tar_scm:firewalld-1.2.1.tar.gz/config/Makefile.am Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/config/Makefile.in -> _service:tar_scm:firewalld-1.2.1.tar.gz/config/Makefile.in Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/config/lockdown-whitelist.xml -> _service:tar_scm:firewalld-1.2.1.tar.gz/config/lockdown-whitelist.xml Changed

_service:tar_scm:firewalld-1.2.1.tar.gz/config/services/jellyfin.xml Added

_service:tar_scm:firewalld-1.2.6.tar.gz/config/services/llmnr-tcp.xml -> _service:tar_scm:firewalld-1.2.1.tar.gz/config/services/llmnr-tcp.xml Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/config/services/llmnr-udp.xml -> _service:tar_scm:firewalld-1.2.1.tar.gz/config/services/llmnr-udp.xml Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/config/services/llmnr.xml -> _service:tar_scm:firewalld-1.2.1.tar.gz/config/services/llmnr.xml Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/configure -> _service:tar_scm:firewalld-1.2.1.tar.gz/configure Changed

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for firewalld 1.2.6.
+# Generated by GNU Autoconf 2.69 for firewalld 1.2.1.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
@@ -577,8 +577,8 @@
 # Identity of this package.
 PACKAGE_NAME='firewalld'
 PACKAGE_TARNAME='firewalld'
-PACKAGE_VERSION='1.2.6'
-PACKAGE_STRING='firewalld 1.2.6'
+PACKAGE_VERSION='1.2.1'
+PACKAGE_STRING='firewalld 1.2.1'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
@@ -1327,7 +1327,7 @@
 # Omit some internal or obsolete options to make the list less imposing.
 # This message is too long to be a string in the A/UX 3.1 sh.
 cat <<_ACEOF
-\`configure' configures firewalld 1.2.6 to adapt to many kinds of systems.
+\`configure' configures firewalld 1.2.1 to adapt to many kinds of systems.
 
 Usage: $0 OPTION... VAR=VALUE...
 
@@ -1394,7 +1394,7 @@
 
 if test -n "$ac_init_help"; then
 case $ac_init_help in
- short | recursive ) echo "Configuration of firewalld 1.2.6:";;
+ short | recursive ) echo "Configuration of firewalld 1.2.1:";;
 esac
 cat <<\_ACEOF
 
@@ -1512,7 +1512,7 @@
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
 cat <<\_ACEOF
-firewalld configure 1.2.6
+firewalld configure 1.2.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1529,7 +1529,7 @@
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by firewalld $as_me 1.2.6, which was
+It was created by firewalld $as_me 1.2.1, which was
 generated by GNU Autoconf 2.69. Invocation command line was
 
 $ $0 $@
@@ -2396,7 +2396,7 @@
 
 # Define the identity of the package.
 PACKAGE='firewalld'
- VERSION='1.2.6'
+ VERSION='1.2.1'
 
 
 # Some tools Automake needs.
@@ -2603,7 +2603,7 @@
 #define PACKAGE_RELEASE "$PACKAGE_RELEASE"
 _ACEOF
 
-PACKAGE_TAG='v1.2.6'
+PACKAGE_TAG='v1.2.1'
 
 cat >>confdefs.h <<_ACEOF
 #define PACKAGE_TAG "$PACKAGE_TAG"
@@ -5603,7 +5603,7 @@
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by firewalld $as_me 1.2.6, which was
+This file was extended by firewalld $as_me 1.2.1, which was
 generated by GNU Autoconf 2.69. Invocation command line was
 
 CONFIG_FILES = $CONFIG_FILES
@@ -5660,7 +5660,7 @@
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/\\""\`\$/\\\\&/g'`"
 ac_cs_version="\\
-firewalld config.status 1.2.6
+firewalld config.status 1.2.1
 configured by $0, generated by GNU Autoconf 2.69,
 with options \\"\$ac_cs_config\\"

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man1/firewall-applet.1 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man1/firewall-applet.1 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man1/firewall-cmd.1 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man1/firewall-cmd.1 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man1/firewall-config.1 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man1/firewall-config.1 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man1/firewall-offline-cmd.1 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man1/firewall-offline-cmd.1 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man1/firewalld.1 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man1/firewalld.1 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.conf.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.conf.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.dbus.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.dbus.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.direct.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.direct.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.helper.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.helper.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.icmptype.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.icmptype.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.ipset.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.ipset.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.lockdown-whitelist.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.lockdown-whitelist.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.policies.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.policies.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.policy.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.policy.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.richlanguage.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.richlanguage.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.service.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.service.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.zone.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.zone.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/doc/man/man5/firewalld.zones.5 -> _service:tar_scm:firewalld-1.2.1.tar.gz/doc/man/man5/firewalld.zones.5 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/firewalld.spec -> _service:tar_scm:firewalld-1.2.1.tar.gz/firewalld.spec Changed

@@ -1,6 +1,6 @@
 Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
 Name: firewalld
-Version: 1.2.6
+Version: 1.2.1
 Release: 1%{?dist}
 URL: http://firewalld.org
 License: GPLv2+
@@ -61,11 +61,7 @@
 Requires: %{name} = %{version}-%{release}
 Requires: firewall-config = %{version}-%{release}
 Requires: hicolor-icon-theme
-%if (0%{?fedora} >= 39 || 0%{?rhel} >= 10)
-Requires: python3-pyqt6
-%else
 Requires: python3-qt5
-%endif
 Requires: python3-gobject
 Requires: libnotify
 Requires: NetworkManager-libnm
@@ -252,21 +248,6 @@
 %{_mandir}/man1/firewall-config*.1*
 
 %changelog
-* Wed Jun 14 2023 Eric Garver <eric@garver.life> - 1.2.6-1
-- release v1.2.6
-
-* Thu Apr 13 2023 Eric Garver <eric@garver.life> - 1.2.5-1
-- release v1.2.5
-
-* Thu Apr 13 2023 Eric Garver <eric@garver.life> - 1.2.4-1
-- release v1.2.4
-
-* Thu Jan 05 2023 Eric Garver <eric@garver.life> - 1.2.3-1
-- release v1.2.3
-
-* Tue Nov 29 2022 Eric Garver <eric@garver.life> - 1.2.2-1
-- release v1.2.2
-
 * Wed Sep 28 2022 Eric Garver <eric@garver.life> - 1.2.1-1
 - release v1.2.1

_service:tar_scm:firewalld-1.2.6.tar.gz/po/POTFILES.in -> _service:tar_scm:firewalld-1.2.1.tar.gz/po/POTFILES.in Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall-applet -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall-applet Changed

@@ -1,4 +1,4 @@
-#!/opt/hostedtoolcache/Python/3.7.16/x64/bin/python
+#!/opt/hostedtoolcache/Python/3.7.14/x64/bin/python
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2010-2015 Red Hat, Inc.
@@ -20,21 +20,15 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 
-try:
- from PyQt6 import QtGui, QtCore, QtWidgets
- from PyQt6.QtGui import QAction
- from dbus.mainloop.pyqt6 import DBusQtMainLoop
-except (ImportError, ModuleNotFoundError):
- from PyQt5 import QtGui, QtCore, QtWidgets
- from PyQt5.QtWidgets import QAction
- from dbus.mainloop.pyqt5 import DBusQtMainLoop
+import sys
+from PyQt5 import QtGui, QtCore, QtWidgets
 
 import gi
 gi.require_version('Notify', '0.7')
 from gi.repository import Notify
 
-import sys
 import os
+from dbus.mainloop.pyqt5 import DBusQtMainLoop
 import functools
 
 from firewall import config
@@ -64,9 +58,7 @@
 return None
 
 NM_CONNECTION_EDITOR = ""
-for binary in "/usr/bin/systemsettings",
- "/bin/systemsettings",
- "/usr/bin/nm-connection-editor",
+for binary in "/usr/bin/nm-connection-editor",
 "/bin/nm-connection-editor",
 "/usr/bin/kde5-nm-connection-editor",
 "/bin/kde5-nm-connection-editor",
@@ -110,9 +102,9 @@
 self.fill_zone_combo()
 vbox.addWidget(self.combo)
 
- buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.StandardButton.Ok
- | QtWidgets.QDialogButtonBox.StandardButton.Cancel)
- self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.StandardButton.Ok)
+ buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.Ok
+ | QtWidgets.QDialogButtonBox.Cancel)
+ self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.Ok)
 buttonBox.accepted.connect(self.ok)
 buttonBox.rejected.connect(self.hide)
 vbox.addWidget(buttonBox)
@@ -260,9 +252,9 @@
 
 vbox.addLayout(grid)
 
- buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.StandardButton.Ok
- | QtWidgets.QDialogButtonBox.StandardButton.Cancel)
- self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.StandardButton.Ok)
+ buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.Ok
+ | QtWidgets.QDialogButtonBox.Cancel)
+ self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.Ok)
 buttonBox.accepted.connect(self.ok)
 buttonBox.rejected.connect(self.hide)
 vbox.addWidget(buttonBox)
@@ -365,8 +357,8 @@
 vbox2.addWidget(QtWidgets.QLabel(version))
 
 label = QtWidgets.QLabel("<a href=\"%s\">%s</a>" % (url, url))
- label.setTextFormat(QtCore.Qt.TextFormat.RichText)
- label.setTextInteractionFlags(QtCore.Qt.TextInteractionFlag.TextBrowserInteraction)
+ label.setTextFormat(QtCore.Qt.RichText)
+ label.setTextInteractionFlags(QtCore.Qt.TextBrowserInteraction)
 label.setOpenExternalLinks(True)
 
 vbox2.addWidget(label)
@@ -402,7 +394,7 @@
 
 vbox.addWidget(tabs)
 
- buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.StandardButton.Close)
+ buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.Close)
 buttonBox.rejected.connect(self.hide)
 vbox.addWidget(buttonBox)
 
@@ -460,47 +452,47 @@
 
 # urgencies
 
- self.urgencies = { "noicon": QtWidgets.QSystemTrayIcon.MessageIcon.NoIcon,
- "information": QtWidgets.QSystemTrayIcon.MessageIcon.Information,
- "warning": QtWidgets.QSystemTrayIcon.MessageIcon.Warning,
- "critical": QtWidgets.QSystemTrayIcon.MessageIcon.Critical }
+ self.urgencies = { "noicon": QtWidgets.QSystemTrayIcon.NoIcon,
+ "information": QtWidgets.QSystemTrayIcon.Information,
+ "warning": QtWidgets.QSystemTrayIcon.Warning,
+ "critical": QtWidgets.QSystemTrayIcon.Critical }
 
 # actions
 
- self.shieldsupAction = QAction(escape(_("Shields Up")),
+ self.shieldsupAction = QtWidgets.QAction(escape(_("Shields Up")),
 self)
 self.shieldsupAction.setCheckable(True)
 self.shieldsupAction.setChecked(False)
 self.shieldsupAction.triggered.connect(self.shieldsup_changed_cb)
 
- self.notificationsAction = QAction(
+ self.notificationsAction = QtWidgets.QAction(
 escape(_("Enable Notifications")), self)
 self.notificationsAction.setCheckable(True)
 self.notificationsAction.setChecked(False)
 self.notificationsAction.triggered.connect(self.notification_changed_cb)
 
- self.settingsAction = QAction(
+ self.settingsAction = QtWidgets.QAction(
 escape(_("Edit Firewall Settings...")), self)
 self.settingsAction.triggered.connect(self.configure_cb)
 
- self.changeZonesAction = QAction(
+ self.changeZonesAction = QtWidgets.QAction(
 escape(_("Change Zones of Connections...")), self)
 self.changeZonesAction.triggered.connect(self.nm_connection_editor)
 
- self.shieldsAction = QAction(
+ self.shieldsAction = QtWidgets.QAction(
 escape(_("Configure Shields UP/Down Zones...")), self)
 self.shieldsAction.triggered.connect(self.configure_shields)
 
- self.panicAction = QAction(
+ self.panicAction = QtWidgets.QAction(
 escape(_("Block all network traffic")), self)
 self.panicAction.setCheckable(True)
 self.panicAction.setChecked(False)
 self.panicAction.triggered.connect(self.panic_mode_cb)
 
- self.aboutAction = QAction(escape(_("About")), self)
- self.aboutAction.triggered.connect(self.about_dialog.exec)
+ self.aboutAction = QtWidgets.QAction(escape(_("About")), self)
+ self.aboutAction.triggered.connect(self.about_dialog.exec_)
 
- #self.quitAction = QAction(escape(_("Quit")), self,
+ #self.quitAction = QtWidgets.QAction(escape(_("Quit")), self,
 # triggered=self.quit)
 
 self.connectionsAction = QtWidgets.QWidgetAction(self)
@@ -690,12 +682,12 @@
 connection_name = connectionsconnection1
 if zone == "":
 _binding = _("{entry} (Default Zone: {default_zone})")
- action = QAction(
+ action = QtWidgets.QAction(
 escape(
 _binding.format(default_zone=self.default_zone,
 entry=connection_name)), self)
 else:
- action = QAction(
+ action = QtWidgets.QAction(
 escape(binding.format(zone=zone, entry=connection_name)), self)
 action.triggered.connect(functools.partial(
 self.zone_connection_editor, connection, connection_name, zone))
@@ -707,7 +699,7 @@
 # add other interfaces
 for interface in sorted(interfaces):
 zone = interfacesinterface
- action = QAction(
+ action = QtWidgets.QAction(
 escape(binding.format(zone=zone, entry=interface)), self)
 action.triggered.connect(functools.partial(
 self.zone_interface_editor, interface, zone))
@@ -718,7 +710,7 @@
 
 for source in sorted(sources):
 zone = sourcessource
- action = QAction(
+ action = QtWidgets.QAction(
 escape(binding.format(zone=zone, entry=source)), self)
 action.triggered.connect(functools.partial(
 self.zone_source_editor, source, zone))
@@ -928,17 +920,12 @@
 return
 
 if uuid:
- if "systemsettings" in NM_CONNECTION_EDITOR:
- os.system("%s kcm_networkmanagement --args Uuid=%s &" % (NM_CONNECTION_EDITOR, uuid))
- elif "kde-" in NM_CONNECTION_EDITOR:
+ if "kde-" in NM_CONNECTION_EDITOR:
 os.system("%s %s &" % (NM_CONNECTION_EDITOR, uuid))
 else:
 os.system("%s --edit=%s &" % (NM_CONNECTION_EDITOR, uuid))
 else:
- if "systemsettings" in NM_CONNECTION_EDITOR:
- os.system("%s kcm_networkmanagement &" % NM_CONNECTION_EDITOR)
- else:
- os.system("%s &" % NM_CONNECTION_EDITOR)
+ os.system("%s &" % NM_CONNECTION_EDITOR)

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall-applet.in -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall-applet.in Changed

@@ -20,21 +20,15 @@
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 #
 
-try:
- from PyQt6 import QtGui, QtCore, QtWidgets
- from PyQt6.QtGui import QAction
- from dbus.mainloop.pyqt6 import DBusQtMainLoop
-except (ImportError, ModuleNotFoundError):
- from PyQt5 import QtGui, QtCore, QtWidgets
- from PyQt5.QtWidgets import QAction
- from dbus.mainloop.pyqt5 import DBusQtMainLoop
+import sys
+from PyQt5 import QtGui, QtCore, QtWidgets
 
 import gi
 gi.require_version('Notify', '0.7')
 from gi.repository import Notify
 
-import sys
 import os
+from dbus.mainloop.pyqt5 import DBusQtMainLoop
 import functools
 
 from firewall import config
@@ -64,9 +58,7 @@
 return None
 
 NM_CONNECTION_EDITOR = ""
-for binary in "/usr/bin/systemsettings",
- "/bin/systemsettings",
- "/usr/bin/nm-connection-editor",
+for binary in "/usr/bin/nm-connection-editor",
 "/bin/nm-connection-editor",
 "/usr/bin/kde5-nm-connection-editor",
 "/bin/kde5-nm-connection-editor",
@@ -110,9 +102,9 @@
 self.fill_zone_combo()
 vbox.addWidget(self.combo)
 
- buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.StandardButton.Ok
- | QtWidgets.QDialogButtonBox.StandardButton.Cancel)
- self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.StandardButton.Ok)
+ buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.Ok
+ | QtWidgets.QDialogButtonBox.Cancel)
+ self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.Ok)
 buttonBox.accepted.connect(self.ok)
 buttonBox.rejected.connect(self.hide)
 vbox.addWidget(buttonBox)
@@ -260,9 +252,9 @@
 
 vbox.addLayout(grid)
 
- buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.StandardButton.Ok
- | QtWidgets.QDialogButtonBox.StandardButton.Cancel)
- self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.StandardButton.Ok)
+ buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.Ok
+ | QtWidgets.QDialogButtonBox.Cancel)
+ self.ok_button = buttonBox.button(QtWidgets.QDialogButtonBox.Ok)
 buttonBox.accepted.connect(self.ok)
 buttonBox.rejected.connect(self.hide)
 vbox.addWidget(buttonBox)
@@ -365,8 +357,8 @@
 vbox2.addWidget(QtWidgets.QLabel(version))
 
 label = QtWidgets.QLabel("<a href=\"%s\">%s</a>" % (url, url))
- label.setTextFormat(QtCore.Qt.TextFormat.RichText)
- label.setTextInteractionFlags(QtCore.Qt.TextInteractionFlag.TextBrowserInteraction)
+ label.setTextFormat(QtCore.Qt.RichText)
+ label.setTextInteractionFlags(QtCore.Qt.TextBrowserInteraction)
 label.setOpenExternalLinks(True)
 
 vbox2.addWidget(label)
@@ -402,7 +394,7 @@
 
 vbox.addWidget(tabs)
 
- buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.StandardButton.Close)
+ buttonBox = QtWidgets.QDialogButtonBox(QtWidgets.QDialogButtonBox.Close)
 buttonBox.rejected.connect(self.hide)
 vbox.addWidget(buttonBox)
 
@@ -460,47 +452,47 @@
 
 # urgencies
 
- self.urgencies = { "noicon": QtWidgets.QSystemTrayIcon.MessageIcon.NoIcon,
- "information": QtWidgets.QSystemTrayIcon.MessageIcon.Information,
- "warning": QtWidgets.QSystemTrayIcon.MessageIcon.Warning,
- "critical": QtWidgets.QSystemTrayIcon.MessageIcon.Critical }
+ self.urgencies = { "noicon": QtWidgets.QSystemTrayIcon.NoIcon,
+ "information": QtWidgets.QSystemTrayIcon.Information,
+ "warning": QtWidgets.QSystemTrayIcon.Warning,
+ "critical": QtWidgets.QSystemTrayIcon.Critical }
 
 # actions
 
- self.shieldsupAction = QAction(escape(_("Shields Up")),
+ self.shieldsupAction = QtWidgets.QAction(escape(_("Shields Up")),
 self)
 self.shieldsupAction.setCheckable(True)
 self.shieldsupAction.setChecked(False)
 self.shieldsupAction.triggered.connect(self.shieldsup_changed_cb)
 
- self.notificationsAction = QAction(
+ self.notificationsAction = QtWidgets.QAction(
 escape(_("Enable Notifications")), self)
 self.notificationsAction.setCheckable(True)
 self.notificationsAction.setChecked(False)
 self.notificationsAction.triggered.connect(self.notification_changed_cb)
 
- self.settingsAction = QAction(
+ self.settingsAction = QtWidgets.QAction(
 escape(_("Edit Firewall Settings...")), self)
 self.settingsAction.triggered.connect(self.configure_cb)
 
- self.changeZonesAction = QAction(
+ self.changeZonesAction = QtWidgets.QAction(
 escape(_("Change Zones of Connections...")), self)
 self.changeZonesAction.triggered.connect(self.nm_connection_editor)
 
- self.shieldsAction = QAction(
+ self.shieldsAction = QtWidgets.QAction(
 escape(_("Configure Shields UP/Down Zones...")), self)
 self.shieldsAction.triggered.connect(self.configure_shields)
 
- self.panicAction = QAction(
+ self.panicAction = QtWidgets.QAction(
 escape(_("Block all network traffic")), self)
 self.panicAction.setCheckable(True)
 self.panicAction.setChecked(False)
 self.panicAction.triggered.connect(self.panic_mode_cb)
 
- self.aboutAction = QAction(escape(_("About")), self)
- self.aboutAction.triggered.connect(self.about_dialog.exec)
+ self.aboutAction = QtWidgets.QAction(escape(_("About")), self)
+ self.aboutAction.triggered.connect(self.about_dialog.exec_)
 
- #self.quitAction = QAction(escape(_("Quit")), self,
+ #self.quitAction = QtWidgets.QAction(escape(_("Quit")), self,
 # triggered=self.quit)
 
 self.connectionsAction = QtWidgets.QWidgetAction(self)
@@ -690,12 +682,12 @@
 connection_name = connectionsconnection1
 if zone == "":
 _binding = _("{entry} (Default Zone: {default_zone})")
- action = QAction(
+ action = QtWidgets.QAction(
 escape(
 _binding.format(default_zone=self.default_zone,
 entry=connection_name)), self)
 else:
- action = QAction(
+ action = QtWidgets.QAction(
 escape(binding.format(zone=zone, entry=connection_name)), self)
 action.triggered.connect(functools.partial(
 self.zone_connection_editor, connection, connection_name, zone))
@@ -707,7 +699,7 @@
 # add other interfaces
 for interface in sorted(interfaces):
 zone = interfacesinterface
- action = QAction(
+ action = QtWidgets.QAction(
 escape(binding.format(zone=zone, entry=interface)), self)
 action.triggered.connect(functools.partial(
 self.zone_interface_editor, interface, zone))
@@ -718,7 +710,7 @@
 
 for source in sorted(sources):
 zone = sourcessource
- action = QAction(
+ action = QtWidgets.QAction(
 escape(binding.format(zone=zone, entry=source)), self)
 action.triggered.connect(functools.partial(
 self.zone_source_editor, source, zone))
@@ -928,17 +920,12 @@
 return
 
 if uuid:
- if "systemsettings" in NM_CONNECTION_EDITOR:
- os.system("%s kcm_networkmanagement --args Uuid=%s &" % (NM_CONNECTION_EDITOR, uuid))
- elif "kde-" in NM_CONNECTION_EDITOR:
+ if "kde-" in NM_CONNECTION_EDITOR:
 os.system("%s %s &" % (NM_CONNECTION_EDITOR, uuid))
 else:
 os.system("%s --edit=%s &" % (NM_CONNECTION_EDITOR, uuid))
 else:
- if "systemsettings" in NM_CONNECTION_EDITOR:
- os.system("%s kcm_networkmanagement &" % NM_CONNECTION_EDITOR)
- else:
- os.system("%s &" % NM_CONNECTION_EDITOR)
+ os.system("%s &" % NM_CONNECTION_EDITOR)
 
 def warning(self, text):
 QtWidgets.QMessageBox.warning(None, escape(self.name), text)
@@ -1132,4 +1119,4 @@
 
 applet = TrayApplet()
 applet.show()

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall-cmd -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall-cmd Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall-config -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall-config Changed

@@ -1,4 +1,4 @@
-#!/opt/hostedtoolcache/Python/3.7.16/x64/bin/python
+#!/opt/hostedtoolcache/Python/3.7.14/x64/bin/python
 # -*- coding: utf-8 -*-
 #
 # Copyright (C) 2011-2015 Red Hat, Inc.
@@ -2176,7 +2176,6 @@
 if self.interfaceStore.get_value(iter, 0) == interface:
 # it is here, remove it
 self.interfaceStore.remove(iter)
- break
 iter = self.interfaceStore.iter_next(iter)
 # add if zone is active_zone
 if zone == self.get_selected_zone():
@@ -2215,7 +2214,6 @@
 if self.sourceStore.get_value(iter, 0) == source:
 # it is here, remove it
 self.sourceStore.remove(iter)
- break
 iter = self.sourceStore.iter_next(iter)
 # add if zone is active_zone
 if zone == self.get_selected_zone():
@@ -2387,8 +2385,7 @@
 item = Gtk.MenuItem.new()
 label = Gtk.Label()
 label.set_markup(escape(_("Connections")))
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 item.add(label)
 item.connect("select", self.no_select)
 self.left_menu.append(item)
@@ -2451,10 +2448,8 @@
 label.set_markup("%s (%s)\n%s: %s" % \
 (connection_name, ",".join(_interfaces),
 escape(_("Zone")), zone))
- label.set_xalign(0)
- label.set_yalign(0.5)
- label.set_margin_start(12)
- label.set_margin_end(12)
+ label.set_alignment(0, 0.5)
+ label.set_padding(12, 0)
 hbox.pack_start(label, True, True, 0)
 item.add(hbox)
 item.connect("activate", self.change_zone_connection_editor, connection, connection_name, zone)
@@ -2478,8 +2473,7 @@
 item = Gtk.MenuItem.new()
 label = Gtk.Label()
 label.set_markup(escape(_("Interfaces")))
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 item.add(label)
 item.connect("select", self.no_select)
 self.left_menu.append(item)
@@ -2494,10 +2488,8 @@
 label = Gtk.Label()
 label.set_markup("%s\n%s: %s" % \
 (interface, escape(_("Zone")), zone))
- label.set_xalign(0)
- label.set_yalign(0.5)
- label.set_margin_start(12)
- label.set_margin_end(12)
+ label.set_alignment(0, 0.5)
+ label.set_padding(12, 0)
 hbox.pack_start(label, True, True, 0)
 item.add(hbox)
 item.connect("activate", self.change_zone_interface_editor, interface, zone)
@@ -2512,8 +2504,7 @@
 item = Gtk.MenuItem.new()
 label = Gtk.Label()
 label.set_markup(escape(_("Sources")))
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 item.add(label)
 item.connect("select", self.no_select)
 self.left_menu.append(item)
@@ -2528,10 +2519,8 @@
 label.set_markup("%s\n%s: %s" % \
 (source, escape(_("Zone")),
 zone))
- label.set_xalign(0)
- label.set_yalign(0.5)
- label.set_margin_start(12)
- label.set_margin_end(12)
+ label.set_alignment(0, 0.5)
+ label.set_padding(12, 0)
 hbox.pack_start(label, True, True, 0)
 item.add(hbox)
 item.connect("activate", self.change_zone_source_editor, source, zone)
@@ -3750,8 +3739,7 @@
 or self.richRuleDialogDestinationInvertCheck.get_active()):
 rule.destination = rich.Rich_Destination(
 self.richRuleDialogDestinationChooser.get_text(),
- None,
- invert=self.richRuleDialogDestinationInvertCheck.get_active())
+ self.richRuleDialogDestinationInvertCheck.get_active())
 
 # log
 if self.richRuleDialogLogCheck.is_sensitive() and \
@@ -8002,7 +7990,7 @@
 
 def create_ui(self, zone):
 self.set_property("width-request", 100)
- self.resize(100, 50)
+ self.resize_to_geometry(100, 50)
 self.set_resizable(True)
 
 self.add_button("gtk-close", 1)
@@ -8017,8 +8005,7 @@
 label.set_text(self.title)
 label.set_line_wrap(True)
 label.set_justify(Gtk.Justification.LEFT)
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 vbox.pack_start(label, True, True, 0)
 
 self.combo = Gtk.ComboBoxText()

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall-config.in -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall-config.in Changed

@@ -2176,7 +2176,6 @@
 if self.interfaceStore.get_value(iter, 0) == interface:
 # it is here, remove it
 self.interfaceStore.remove(iter)
- break
 iter = self.interfaceStore.iter_next(iter)
 # add if zone is active_zone
 if zone == self.get_selected_zone():
@@ -2215,7 +2214,6 @@
 if self.sourceStore.get_value(iter, 0) == source:
 # it is here, remove it
 self.sourceStore.remove(iter)
- break
 iter = self.sourceStore.iter_next(iter)
 # add if zone is active_zone
 if zone == self.get_selected_zone():
@@ -2387,8 +2385,7 @@
 item = Gtk.MenuItem.new()
 label = Gtk.Label()
 label.set_markup(escape(_("Connections")))
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 item.add(label)
 item.connect("select", self.no_select)
 self.left_menu.append(item)
@@ -2451,10 +2448,8 @@
 label.set_markup("%s (%s)\n%s: %s" % \
 (connection_name, ",".join(_interfaces),
 escape(_("Zone")), zone))
- label.set_xalign(0)
- label.set_yalign(0.5)
- label.set_margin_start(12)
- label.set_margin_end(12)
+ label.set_alignment(0, 0.5)
+ label.set_padding(12, 0)
 hbox.pack_start(label, True, True, 0)
 item.add(hbox)
 item.connect("activate", self.change_zone_connection_editor, connection, connection_name, zone)
@@ -2478,8 +2473,7 @@
 item = Gtk.MenuItem.new()
 label = Gtk.Label()
 label.set_markup(escape(_("Interfaces")))
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 item.add(label)
 item.connect("select", self.no_select)
 self.left_menu.append(item)
@@ -2494,10 +2488,8 @@
 label = Gtk.Label()
 label.set_markup("%s\n%s: %s" % \
 (interface, escape(_("Zone")), zone))
- label.set_xalign(0)
- label.set_yalign(0.5)
- label.set_margin_start(12)
- label.set_margin_end(12)
+ label.set_alignment(0, 0.5)
+ label.set_padding(12, 0)
 hbox.pack_start(label, True, True, 0)
 item.add(hbox)
 item.connect("activate", self.change_zone_interface_editor, interface, zone)
@@ -2512,8 +2504,7 @@
 item = Gtk.MenuItem.new()
 label = Gtk.Label()
 label.set_markup(escape(_("Sources")))
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 item.add(label)
 item.connect("select", self.no_select)
 self.left_menu.append(item)
@@ -2528,10 +2519,8 @@
 label.set_markup("%s\n%s: %s" % \
 (source, escape(_("Zone")),
 zone))
- label.set_xalign(0)
- label.set_yalign(0.5)
- label.set_margin_start(12)
- label.set_margin_end(12)
+ label.set_alignment(0, 0.5)
+ label.set_padding(12, 0)
 hbox.pack_start(label, True, True, 0)
 item.add(hbox)
 item.connect("activate", self.change_zone_source_editor, source, zone)
@@ -3750,8 +3739,7 @@
 or self.richRuleDialogDestinationInvertCheck.get_active()):
 rule.destination = rich.Rich_Destination(
 self.richRuleDialogDestinationChooser.get_text(),
- None,
- invert=self.richRuleDialogDestinationInvertCheck.get_active())
+ self.richRuleDialogDestinationInvertCheck.get_active())
 
 # log
 if self.richRuleDialogLogCheck.is_sensitive() and \
@@ -8002,7 +7990,7 @@
 
 def create_ui(self, zone):
 self.set_property("width-request", 100)
- self.resize(100, 50)
+ self.resize_to_geometry(100, 50)
 self.set_resizable(True)
 
 self.add_button("gtk-close", 1)
@@ -8017,8 +8005,7 @@
 label.set_text(self.title)
 label.set_line_wrap(True)
 label.set_justify(Gtk.Justification.LEFT)
- label.set_xalign(0)
- label.set_yalign(0.5)
+ label.set_alignment(0, 0.5)
 vbox.pack_start(label, True, True, 0)
 
 self.combo = Gtk.ComboBoxText()

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall-offline-cmd -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall-offline-cmd Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/client.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/client.py Changed

@@ -308,13 +308,13 @@
         if not self.settings15:
             self.settings15 = True
         else:
-            raise FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion")
+            FirewallError(errors.ALREADY_ENABLED, "icmp-block-inversion")
     @handle_exceptions
     def removeIcmpBlockInversion(self):
         if self.settings15:
             self.settings15 = False
         else:
-            raise FirewallError(errors.NOT_ENABLED, "icmp-block-inversion")
+            FirewallError(errors.NOT_ENABLED, "icmp-block-inversion")
     @handle_exceptions
     def queryIcmpBlockInversion(self):
         return self.settings15
@@ -330,13 +330,13 @@
         if not self.settings16:
             self.settings16 = True
         else:
-            raise FirewallError(errors.ALREADY_ENABLED, "forward")
+            FirewallError(errors.ALREADY_ENABLED, "forward")
     @handle_exceptions
     def removeForward(self):
         if self.settings16:
             self.settings16 = False
         else:
-            raise FirewallError(errors.NOT_ENABLED, "forward")
+            FirewallError(errors.NOT_ENABLED, "forward")
     @handle_exceptions
     def queryForward(self):
         return self.settings16
@@ -352,13 +352,13 @@
         if not self.settings8:
             self.settings8 = True
         else:
-            raise FirewallError(errors.ALREADY_ENABLED, "masquerade")
+            FirewallError(errors.ALREADY_ENABLED, "masquerade")
     @handle_exceptions
     def removeMasquerade(self):
         if self.settings8:
             self.settings8 = False
         else:
-            raise FirewallError(errors.NOT_ENABLED, "masquerade")
+            FirewallError(errors.NOT_ENABLED, "masquerade")
     @handle_exceptions
     def queryMasquerade(self):
         return self.settings8
@@ -1045,13 +1045,13 @@
         if not self.settings"masquerade":
             self.settings"masquerade" = True
         else:
-            raise FirewallError(errors.ALREADY_ENABLED, "masquerade")
+            FirewallError(errors.ALREADY_ENABLED, "masquerade")
     @handle_exceptions
     def removeMasquerade(self):
         if self.settings"masquerade":
             self.settings"masquerade" = False
         else:
-            raise FirewallError(errors.NOT_ENABLED, "masquerade")
+            FirewallError(errors.NOT_ENABLED, "masquerade")
     @handle_exceptions
     def queryMasquerade(self):
         return self.settings"masquerade"

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/config/__init__.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/config/__init__.py Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/fw.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/fw.py Changed

@@ -1091,7 +1091,6 @@
         _omit_native_ipset = self.ipset.omit_native_ipset()
 
         # must stash this. The value may change after _start()
-        old_firewall_backend = self._firewall_backend
         flush_all = self._flush_all_on_reload
 
         if not flush_all:
@@ -1111,7 +1110,6 @@
             self.set_policy("DROP")
 
         # stop
-        self.flush()
         self.cleanup()
 
         start_exception = None
@@ -1194,19 +1192,6 @@
         if not self._panic:
             self.set_policy("ACCEPT")
 
-        # If the FirewallBackend changed, then we must also cleanup the policy
-        # for the old backend that was set to DROP above.
-        if not self._panic and old_firewall_backend != self._firewall_backend:
-            if old_firewall_backend == "nftables":
-                for rule in self.nftables_backend.build_set_policy_rules("ACCEPT"):
-                    self.nftables_backend.set_rule(rule, self._log_denied)
-            else:
-                for rule in self.ip4tables_backend.build_set_policy_rules("ACCEPT"):
-                    self.ip4tables_backend.set_rule(rule, self._log_denied)
-                if self.ip6tables_enabled:
-                    for rule in self.ip6tables_backend.build_set_policy_rules("ACCEPT"):
-                        self.ip6tables_backend.set_rule(rule, self._log_denied)
-
         if start_exception:
             self._state = "FAILED"
             raise start_exception

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/fw_nm.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/fw_nm.py Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/fw_policy.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/fw_policy.py Changed

@@ -1327,21 +1327,7 @@
                 "ipset '%s' with type '%s' not usable as source" % \
                 (name, _type))
 
-    def _rule_prepare(self, enable, policy, rule, transaction, included_services=None):
-        # First apply any services this service may include
-        if type(rule.element) == Rich_Service:
-            svc = self._fw.service.get_service(rule.element.name)
-            if included_services is None:
-                included_services = rule.element.name
-            for include in svc.includes:
-                if include in included_services:
-                    continue
-                self.check_service(include)
-                included_services.append(include)
-                _rule = copy.deepcopy(rule)
-                _rule.element.name = include
-                self._rule_prepare(enable, policy, _rule, transaction, included_services=included_services)
-
+    def _rule_prepare(self, enable, policy, rule, transaction):
         ipvs = 
         if rule.family:
             ipvs =  rule.family 
@@ -1877,7 +1863,8 @@
         elif "ANY" in obj.ingress_zones:
             # any --> zone
             return ("nat", "POSTROUTING")
-        raise FirewallError(errors.INVALID_POLICY, "Invalid policy: %s" % (policy))
+        else:
+            return FirewallError("Invalid policy: %s" % (policy))
 
     def policy_base_chain_name(self, policy, table, policy_prefix, isSNAT=False):
         obj = self._fw.policy.get_policy(policy)
@@ -1935,4 +1922,4 @@
                     return "PRE_" + suffix
             elif table in "mangle", "raw":
                 return "PRE_" + suffix
-        raise FirewallError(errors.INVALID_POLICY, "Can't convert policy to chain name: %s, %s, %s" % (policy, table, isSNAT))
+        return FirewallError("Can't convert policy to chain name: %s, %s, %s" % (policy, table, isSNAT))

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/fw_zone.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/fw_zone.py Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/io/functions.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/io/functions.py Changed

@@ -37,19 +37,6 @@
 
 def check_on_disk_config(fw):
     fw_config = FirewallConfig(fw)
-
-    try:
-        _firewalld_conf = firewalld_conf(config.FIREWALLD_CONF)
-        _firewalld_conf.read()
-    except FirewallError as error:
-        raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg))
-    except IOError:
-        # defaults will be filled
-        pass
-    except Exception as msg:
-        raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg))
-    fw_config.set_firewalld_conf(_firewalld_conf)
-
     readers = {
         "ipset": {
             "reader": ipset_reader,
@@ -110,3 +97,11 @@
             raise FirewallError(error.code, "'%s': %s" % (config.LOCKDOWN_WHITELIST, error.msg))
         except Exception as msg:
             raise Exception("'%s': %s" % (config.LOCKDOWN_WHITELIST, msg))
+    if os.path.isfile(config.FIREWALLD_CONF):
+        try:
+            obj = firewalld_conf(config.FIREWALLD_CONF)
+            obj.read()
+        except FirewallError as error:
+            raise FirewallError(error.code, "'%s': %s" % (config.FIREWALLD_CONF, error.msg))
+        except Exception as msg:
+            raise Exception("'%s': %s" % (config.FIREWALLD_CONF, msg))

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/io/policy.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/io/policy.py Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/ipXtables.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/ipXtables.py Changed

@@ -692,10 +692,10 @@
         default_rules"filter" = 
         self.our_chains"filter" = set()
         default_rules"filter".append("-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT")
-        default_rules"filter".append("-A INPUT -i lo -j ACCEPT")
         if log_denied != "off":
             default_rules"filter".append("-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '")
         default_rules"filter".append("-A INPUT -m conntrack --ctstate INVALID -j DROP")
+        default_rules"filter".append("-A INPUT -i lo -j ACCEPT")
         default_rules"filter".append("-N INPUT_direct")
         default_rules"filter".append("-A INPUT -j INPUT_direct")
         self.our_chains"filter".update(set("INPUT_direct"))
@@ -709,10 +709,10 @@
         default_rules"filter".append("-A INPUT -j %%REJECT%%")
 
         default_rules"filter".append("-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT")
-        default_rules"filter".append("-A FORWARD -i lo -j ACCEPT")
         if log_denied != "off":
             default_rules"filter".append("-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '")
         default_rules"filter".append("-A FORWARD -m conntrack --ctstate INVALID -j DROP")
+        default_rules"filter".append("-A FORWARD -i lo -j ACCEPT")
         default_rules"filter".append("-N FORWARD_direct")
         default_rules"filter".append("-A FORWARD -j FORWARD_direct")
         self.our_chains"filter".update(set("FORWARD_direct"))
@@ -1213,7 +1213,6 @@
         return rules
 
     def build_policy_tcp_mss_clamp_rules(self, enable, policy, tcp_mss_clamp_value, destination=None, rich_rule=None):
-        chain_suffix = "allow"
         table = "filter"
         _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
         add_del = { True: "-A", False: "-D" }enable
@@ -1225,13 +1224,21 @@
             rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
             rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
 
-        rule_fragment += "-p", "tcp"
+        rules = 
+        rule_fragment = "-p", "tcp"
         if tcp_mss_clamp_value == "pmtu" or tcp_mss_clamp_value is None:
             rule_fragment += "--tcp-flags", "SYN,RST", "SYN","-j", "TCPMSS", "--clamp-mss-to-pmtu"
         else:
             rule_fragment += "--tcp-flags", "SYN,RST", "SYN", "-j", "TCPMSS", "--set-mss", tcp_mss_clamp_value
 
-        return "-t", "filter", add_del, "%s_%s" % (_policy, chain_suffix) + rule_fragment
+        if rich_rule:
+            chain_suffix = self._rich_rule_chain_suffix(rich_rule)
+            rule_fragment += self._rich_rule_priority_fragment(rich_rule)
+            rule_fragment += self._rich_rule_destination_fragment(rich_rule.destination)
+            rule_fragment += self._rich_rule_source_fragment(rich_rule.source)
+        rules.append("-t", "filter", add_del, "%s_%s" % (_policy, chain_suffix)
+                     + rule_fragment)
+        return rules
 
     def build_policy_source_ports_rules(self, enable, policy, proto, port,
                                      destination=None, rich_rule=None):

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/nftables.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/nftables.py Changed

@@ -450,7 +450,7 @@
                                                 "hook": hook,
                                                 "prio": -300 + NFT_HOOK_OFFSET - 1,
                                                 "policy": "drop"}}})
-        elif policy == "DROP":
+        if policy == "DROP":
             rules.append({"add": {"table": {"family": "inet",
                                             "name": TABLE_NAME_POLICY}}})
             self.created_tables"inet".append(TABLE_NAME_POLICY)
@@ -478,7 +478,7 @@
                                                    "name": TABLE_NAME_POLICY}}})
                 self.created_tables"inet".remove(TABLE_NAME_POLICY)
         else:
-            raise FirewallError(UNKNOWN_ERROR, "not implemented")
+            FirewallError(UNKNOWN_ERROR, "not implemented")
 
         return rules
 
@@ -570,13 +570,6 @@
                                                                     "op": "in",
                                                                     "right": "dnat"}},
                                                          {"accept": None}}}})
-        default_rules.append({"add": {"rule":  {"family": "inet",
-                                                "table": TABLE_NAME,
-                                                "chain": "filter_%s" % "INPUT",
-                                                "expr": {"match": {"left": {"meta": {"key": "iifname"}},
-                                                                    "op": "==",
-                                                                    "right": "lo"}},
-                                                         {"accept": None}}}})
         if log_denied != "off":
             default_rules.append({"add": {"rule":  {"family": "inet",
                                                     "table": TABLE_NAME,
@@ -593,6 +586,13 @@
                                                                     "op": "in",
                                                                     "right": {"set": "invalid"}}},
                                                          {"drop": None}}}})
+        default_rules.append({"add": {"rule":  {"family": "inet",
+                                                "table": TABLE_NAME,
+                                                "chain": "filter_%s" % "INPUT",
+                                                "expr": {"match": {"left": {"meta": {"key": "iifname"}},
+                                                                    "op": "==",
+                                                                    "right": "lo"}},
+                                                         {"accept": None}}}})
         for dispatch_suffix in "POLICIES_pre", "ZONES", "POLICIES_post":
             default_rules.append({"add": {"chain": {"family": "inet",
                                                     "table": TABLE_NAME,
@@ -628,13 +628,6 @@
                                                                     "op": "in",
                                                                     "right": "dnat"}},
                                                          {"accept": None}}}})
-        default_rules.append({"add": {"rule":  {"family": "inet",
-                                                "table": TABLE_NAME,
-                                                "chain": "filter_%s" % "FORWARD",
-                                                "expr": {"match": {"left": {"meta": {"key": "iifname"}},
-                                                                    "op": "==",
-                                                                    "right": "lo"}},
-                                                         {"accept": None}}}})
         if log_denied != "off":
             default_rules.append({"add": {"rule":  {"family": "inet",
                                                     "table": TABLE_NAME,
@@ -651,6 +644,13 @@
                                                                     "op": "in",
                                                                     "right": {"set": "invalid"}}},
                                                          {"drop": None}}}})
+        default_rules.append({"add": {"rule":  {"family": "inet",
+                                                "table": TABLE_NAME,
+                                                "chain": "filter_%s" % "FORWARD",
+                                                "expr": {"match": {"left": {"meta": {"key": "iifname"}},
+                                                                    "op": "==",
+                                                                    "right": "lo"}},
+                                                         {"accept": None}}}})
         for dispatch_suffix in "POLICIES_pre":
             default_rules.append({"add": {"chain": {"family": "inet",
                                                     "table": TABLE_NAME,
@@ -772,15 +772,6 @@
                 egress_fragments.append(self._rule_addr_fragment("daddr", dst))
 
         def _generate_policy_dispatch_rule(ingress_fragment, egress_fragment):
-            if ingress_fragment and egress_fragment:
-                # The IP families must be the same
-                #
-                if "payload" in ingress_fragment"match""left" and \
-                   "payload" in egress_fragment"match""left" and \
-                   ingress_fragment"match""left""payload""protocol" != \
-                   egress_fragment"match""left""payload""protocol":
-                    return None
-
             expr_fragments = 
             if ingress_fragment:
                 expr_fragments.append(ingress_fragment)
@@ -1109,8 +1100,8 @@
                 "table": TABLE_NAME,
                 "chain": "%s_%s_%s" % (table, _policy, chain_suffix),
                 "expr": expr_fragments +
-                        self._rich_rule_limit_fragment(rich_rule.log.limit),
-                         {"log": log_options}}
+                        {"log": log_options},
+                         self._rich_rule_limit_fragment(rich_rule.log.limit)}
         rule.update(self._rich_rule_priority_fragment(rich_rule))
         return {add_del: {"rule": rule}}
 
@@ -1127,8 +1118,8 @@
                 "table": TABLE_NAME,
                 "chain": "%s_%s_%s" % (table, _policy, chain_suffix),
                 "expr": expr_fragments +
-                        self._rich_rule_limit_fragment(rich_rule.audit.limit),
-                         {"log": {"level": "audit"}}}
+                        {"log": {"level": "audit"}},
+                         self._rich_rule_limit_fragment(rich_rule.audit.limit)}
         rule.update(self._rich_rule_priority_fragment(rich_rule))
         return {add_del: {"rule": rule}}
 
@@ -1316,7 +1307,6 @@
 
     def build_policy_tcp_mss_clamp_rules(self, enable, policy, tcp_mss_clamp_value,
                                       destination=None, rich_rule=None):
-        chain_suffix = "allow"
         table = "filter"
         _policy = self._fw.policy.policy_base_chain_name(policy, table, POLICY_CHAIN_PREFIX)
         add_del = { True: "add", False: "delete" }enable
@@ -1337,11 +1327,13 @@
         else:
             expr_fragments.append({"mangle": {"key": {"tcp option": {"name": "maxseg","field": "size"}},
                                               "value": tcp_mss_clamp_value}})
+        rules = 
+        rules.append({add_del: {"rule": {"family": "inet",
+                                "table": TABLE_NAME,
+                                "chain": "filter_%s_%s" % (_policy, chain_suffix),
+                                "expr": expr_fragments}}})
 
-        return {add_del: {"rule": {"family": "inet",
-                           "table": TABLE_NAME,
-                           "chain": "filter_%s_%s" % (_policy, chain_suffix),
-                           "expr": expr_fragments}}}
+        return rules
 
     def build_policy_source_ports_rules(self, enable, policy, proto, port,
                                       destination=None, rich_rule=None):
@@ -1769,7 +1761,7 @@
             elif type_formati == "mark":
                 fragments.append({"meta": {"key": "mark"}})
             else:
-                raise FirewallError(INVALID_TYPE, "Unsupported ipset type for match fragment: %s" % (type_formati))
+                raise FirewallError("Unsupported ipset type for match fragment: %s" % (type_formati))
 
         return {"match": {"left": {"concat": fragments} if len(type_format) > 1 else fragments0,
                           "op": "!=" if invert else "==",
@@ -1872,15 +1864,6 @@
         rules = 
         rules.extend(self.build_set_create_rules(set_name, type_name, create_options))
         rules.extend(self.build_set_flush_rules(set_name))
-
-        # avoid large memory usage by chunking the entries
-        chunk = 0
         for entry in entries:
             rules.extend(self.build_set_add_rules(set_name, entry))
-            chunk += 1
-            if chunk >= 1000:
-                self.set_rules(rules, self._fw.get_log_denied())
-                rules.clear()
-                chunk = 0
-        else:
-            self.set_rules(rules, self._fw.get_log_denied())
+        self.set_rules(rules, self._fw.get_log_denied())

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewall/core/rich.py -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewall/core/rich.py Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/firewalld -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/firewalld Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/Makefile.am -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/Makefile.am Changed

@@ -68,7 +68,7 @@
 	                             xsltproc docbook-xsl docbook-xml iproute2 iptables ipset ebtables \
 	                             nftables libxml2-utils libdbus-1-dev libgirepository1.0-dev \
 	                             python3-dbus python3-gi python3-nftables \
-	                             procps network-manager gir1.2-nm-1.0 time" && \
+	                             procps network-manager gir1.2-nm-1.0" && \
 	echo "COPY . /tmp/firewalld"; \
 	} | $(PODMAN) build -t firewalld-testsuite-$* -f - . )
 
@@ -79,23 +79,24 @@
 	echo "RUN dnf -y install autoconf automake conntrack-tools desktop-file-utils \
 	                 docbook-style-xsl file gettext glib2-devel intltool ipset \
 	                 iptables iptables-nft libtool libxml2 libxslt make nftables \
-	                 python3-nftables python3-gobject-base python3-dbus \
+	                 python3-nftables python3-gobject-base \
 	                 diffutils procps-ng iproute which dbus-daemon \
-	                 NetworkManager NetworkManager-ovs time" && \
+	                 NetworkManager NetworkManager-ovs" && \
 	echo "RUN alternatives --set ebtables /usr/sbin/ebtables-nft" && \
 	echo "COPY . /tmp/firewalld"; \
 	} | $(PODMAN) build -t firewalld-testsuite-$* -f - . )
 
 check-container-centos8-stream-image: check-container-%-image:
 	(cd $(abs_top_srcdir) && { \
-	echo "FROM centos:stream8" && \
+	echo "FROM centos:8" && \
 	echo "RUN dnf -y makecache" && \
+	echo "RUN dnf -y install centos-release-stream" && \
 	echo "RUN dnf -y install autoconf automake conntrack-tools desktop-file-utils \
 	                 docbook-style-xsl file gettext glib2-devel intltool ipset \
 	                 iptables iptables-ebtables nftables libtool libxml2 \
-	                 libxslt make nftables python3-nftables python3-dbus \
+	                 libxslt make nftables python3-nftables \
 	                 python3-gobject-base diffutils procps-ng iproute which dbus-daemon \
-	                 NetworkManager NetworkManager-ovs time" && \
+	                 NetworkManager NetworkManager-ovs" && \
 	echo "COPY . /tmp/firewalld"; \
 	} | $(PODMAN) build -t firewalld-testsuite-$* -f - . )

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/Makefile.in -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/Makefile.in Changed

@@ -677,7 +677,7 @@
 	                             xsltproc docbook-xsl docbook-xml iproute2 iptables ipset ebtables \
 	                             nftables libxml2-utils libdbus-1-dev libgirepository1.0-dev \
 	                             python3-dbus python3-gi python3-nftables \
-	                             procps network-manager gir1.2-nm-1.0 time" && \
+	                             procps network-manager gir1.2-nm-1.0" && \
 	echo "COPY . /tmp/firewalld"; \
 	} | $(PODMAN) build -t firewalld-testsuite-$* -f - . )
 
@@ -688,23 +688,24 @@
 	echo "RUN dnf -y install autoconf automake conntrack-tools desktop-file-utils \
 	                 docbook-style-xsl file gettext glib2-devel intltool ipset \
 	                 iptables iptables-nft libtool libxml2 libxslt make nftables \
-	                 python3-nftables python3-gobject-base python3-dbus \
+	                 python3-nftables python3-gobject-base \
 	                 diffutils procps-ng iproute which dbus-daemon \
-	                 NetworkManager NetworkManager-ovs time" && \
+	                 NetworkManager NetworkManager-ovs" && \
 	echo "RUN alternatives --set ebtables /usr/sbin/ebtables-nft" && \
 	echo "COPY . /tmp/firewalld"; \
 	} | $(PODMAN) build -t firewalld-testsuite-$* -f - . )
 
 check-container-centos8-stream-image: check-container-%-image:
 	(cd $(abs_top_srcdir) && { \
-	echo "FROM centos:stream8" && \
+	echo "FROM centos:8" && \
 	echo "RUN dnf -y makecache" && \
+	echo "RUN dnf -y install centos-release-stream" && \
 	echo "RUN dnf -y install autoconf automake conntrack-tools desktop-file-utils \
 	                 docbook-style-xsl file gettext glib2-devel intltool ipset \
 	                 iptables iptables-ebtables nftables libtool libxml2 \
-	                 libxslt make nftables python3-nftables python3-dbus \
+	                 libxslt make nftables python3-nftables \
 	                 python3-gobject-base diffutils procps-ng iproute which dbus-daemon \
-	                 NetworkManager NetworkManager-ovs time" && \
+	                 NetworkManager NetworkManager-ovs" && \
 	echo "COPY . /tmp/firewalld"; \
 	} | $(PODMAN) build -t firewalld-testsuite-$* -f - . )

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/cli/firewall-cmd.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/cli/firewall-cmd.at Changed

@@ -1216,8 +1216,8 @@
     FWD_CHECK(--permanent --direct --add-passthrough ipv4, 2, ignore, ignore)
     FWD_CHECK(--permanent --direct --add-passthrough ipv5 -nvL, 111, ignore, ignore)
     FWD_CHECK(--permanent --direct --add-passthrough ipv4 -nvL, 0, ignore)
-    FWD_CHECK(--permanent --direct --get-passthroughs ipv4 | grep "-nvL", 0, ignore)
-    FWD_CHECK(--permanent --direct --get-all-passthroughs | grep "ipv4 -nvL", 0, ignore)
+    FWD_CHECK(--permanent --direct --get-passthroughs ipv4 | grep "\-nvL", 0, ignore)
+    FWD_CHECK(--permanent --direct --get-all-passthroughs | grep "ipv4 \-nvL", 0, ignore)
     FWD_CHECK(--permanent --direct --query-passthrough ipv4 -nvL, 0, ignore)
     FWD_CHECK(--permanent --direct --remove-passthrough ipv4 -nvL, 0, ignore)
     FWD_CHECK(--permanent --direct --query-passthrough ipv4 -nvL, 1, ignore, ignore)
@@ -1577,8 +1577,8 @@
         chain filter_INPUT {
         ct state established,related accept
         ct status dnat accept
-        iifname "lo" accept
         ct state invalid drop
+        iifname "lo" accept
         jump filter_INPUT_ZONES
         reject with icmpx admin-prohibited
         }

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/features/policy.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/features/policy.at Changed

@@ -711,8 +711,8 @@
         chain filter_INPUT {
             ct state established,related accept
             ct status dnat accept
-            iifname "lo" accept
             ct state invalid drop
+            iifname "lo" accept
             jump filter_INPUT_ZONES
             reject with icmpx admin-prohibited
         }
@@ -720,16 +720,16 @@
 )
 IPTABLES_LIST_RULES(filter, INPUT, 0, dnl
 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
-ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
 DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
 INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
 INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
 )
 IP6TABLES_LIST_RULES(filter, INPUT, 0, dnl
 ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-ACCEPT all ::/0 ::/0
 DROP all ::/0 ::/0 ctstate INVALID
+ACCEPT all ::/0 ::/0
 INPUT_direct all ::/0 ::/0
 INPUT_ZONES all ::/0 ::/0
 REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
@@ -740,8 +740,8 @@
         chain filter_FORWARD {
             ct state established,related accept
             ct status dnat accept
-            iifname "lo" accept
             ct state invalid drop
+            iifname "lo" accept
             ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
             jump filter_FORWARD_ZONES
             reject with icmpx admin-prohibited
@@ -750,16 +750,16 @@
 )
 IPTABLES_LIST_RULES(filter, FORWARD, 0, dnl
 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
-ACCEPT all -- 0.0.0.0/0 0.0.0.0/0                                 
 DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0                                 
 FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
 FORWARD_ZONES all -- 0.0.0.0/0 0.0.0.0/0
 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
 )
 IP6TABLES_LIST_RULES(filter, FORWARD, 0, dnl
 ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-ACCEPT all ::/0 ::/0
 DROP all ::/0 ::/0 ctstate INVALID
+ACCEPT all ::/0 ::/0
 FORWARD_direct all ::/0 ::/0
 RFC3964_IPv4 all ::/0 ::/0
 FORWARD_ZONES all ::/0 ::/0

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/features/rfc3964_ipv4.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/features/rfc3964_ipv4.at Changed

@@ -10,9 +10,9 @@
     chain filter_FORWARD {
     ct state established,related accept
     ct status dnat accept
-    iifname "lo" accept
     ct state invalid log prefix "STATE_INVALID_DROP: "
     ct state invalid drop
+    iifname "lo" accept
     ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } log prefix "RFC3964_IPv4_REJECT: " reject with icmpv6 addr-unreachable
     jump filter_FORWARD_ZONES
     log prefix "FINAL_REJECT: "
@@ -53,9 +53,9 @@
 )
 IP6TABLES_LIST_RULES(filter, FORWARD, 0, dnl
     ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all ::/0 ::/0
     LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
     DROP all ::/0 ::/0 ctstate INVALID
+    ACCEPT all ::/0 ::/0
     FORWARD_direct all ::/0 ::/0
     RFC3964_IPv4 all ::/0 ::/0
     FORWARD_ZONES all ::/0 ::/0
@@ -79,9 +79,9 @@
     chain filter_FORWARD {
     ct state established,related accept
     ct status dnat accept
-    iifname "lo" accept
     ct state invalid log prefix "STATE_INVALID_DROP: "
     ct state invalid drop
+    iifname "lo" accept
     jump filter_FORWARD_ZONES
     log prefix "FINAL_REJECT: "
     reject with icmpx admin-prohibited
@@ -102,9 +102,9 @@
 IP6TABLES_LIST_RULES(filter, RFC3964_IPv4, 1, ignore, ignore)
 IP6TABLES_LIST_RULES(filter, FORWARD, 0, dnl
     ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all ::/0 ::/0
     LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
     DROP all ::/0 ::/0 ctstate INVALID
+    ACCEPT all ::/0 ::/0
     FORWARD_direct all ::/0 ::/0
     FORWARD_ZONES all ::/0 ::/0
     LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/features/rich_tcp_mss_clamp.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/features/rich_tcp_mss_clamp.at Changed

@@ -3,7 +3,7 @@
 dnl ###############
 
 FWD_START_TEST(tcp-mss-clamp)
-AT_KEYWORDS(tcp-mss-clamp gh1121)
+AT_KEYWORDS(tcp-mss-clamp)
 
 AT_CHECK(mkdir -p ./zones)
 
@@ -61,49 +61,10 @@
 )
 FWD_CHECK(--check-config, 0, ignore,ignore)
 
-dnl github #1121
-dnl
-AT_DATA(./zones/tcp.xml, dnl
-<?xml version="1.0" encoding="utf-8"?>
-<zone>
- <service name="ssh"/>
- <rule>
- <tcp-mss-clamp value="None"/>
- </rule>
-</zone>
-)
-FWD_CHECK(--check-config, 0, ignore, ignore)
-FWD_OFFLINE_CHECK(--zone tcp --add-service http, 0, ignore)
-AT_CHECK(cat ./zones/tcp.xml, 0, dnl
-<?xml version="1.0" encoding="utf-8"?>
-<zone>
- <service name="ssh"/>
- <service name="http"/>
- <rule>
- <tcp-mss-clamp/>
- </rule>
-</zone>
-)
-
 dnl start cli tests (permanent configuration)
 AT_CHECK(rm ./zones/tcp.xml)
 FWD_CHECK(--permanent --add-rich-rule='rule tcp-mss-clamp value=thisdoesnotexist',122,ignore,ignore)
 FWD_CHECK(--permanent --add-rich-rule='rule tcp-mss-clamp',0,ignore, ignore)
-dnl github #1121
-dnl
-AT_CHECK(cat ./zones/public.xml, 0, dnl
-<?xml version="1.0" encoding="utf-8"?>
-<zone>
- <short>Public</short>
- <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
- <service name="ssh"/>
- <service name="dhcpv6-client"/>
- <rule>
- <tcp-mss-clamp/>
- </rule>
- <forward/>
-</zone>
-)
 FWD_CHECK(--permanent --remove-rich-rule='rule tcp-mss-clamp',0,ignore, ignore)
 FWD_CHECK(--permanent --add-rich-rule='rule tcp-mss-clamp value=0',122,ignore, ignore)
 FWD_CHECK(--permanent --add-rich-rule='rule tcp-mss-clamp value=536',0,ignore, ignore)

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/features/service_include.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/features/service_include.at Changed

@@ -1,5 +1,5 @@
 FWD_START_TEST(service include)
-AT_KEYWORDS(service xml gh273 rhbz1720300 gh707 gh1075)
+AT_KEYWORDS(service xml gh273 rhbz1720300)
 
 AT_CHECK(mkdir -p ./services)
 AT_CHECK(cat <<HERE > ./services/my-service-with-include.xml
@@ -34,10 +34,6 @@
 dnl check recursive includes
 FWD_CHECK(-q --zone=drop --add-service=recursive-service)
 FWD_CHECK(-q --zone=drop --remove-service=recursive-service)
-FWD_CHECK( --zone=drop --add-rich-rule='rule service name=recursive-service log', 0, ignore)
-FWD_CHECK(--zone=drop --list-rich-rules, 0, dnl
-rule service name="recursive-service" log
-)
 
 NFT_LIST_RULES(inet, filter_IN_drop_allow, 0, dnl
 table inet firewalld {
@@ -50,17 +46,6 @@
 }
 }
 )
-NFT_LIST_RULES(inet, filter_IN_drop_log, 0, dnl
- table inet firewalld {
- chain filter_IN_drop_log {
- ip daddr 239.255.255.250 udp dport 1900 ct state new,untracked log
- ip6 daddr ff02::c udp dport 1900 ct state new,untracked log
- ip daddr 224.0.0.251 udp dport 5353 ct state new,untracked log
- ip6 daddr ff02::fb udp dport 5353 ct state new,untracked log
- tcp dport 12345 ct state new,untracked log
- }
- }
-)
 IPTABLES_LIST_RULES(filter, IN_drop_allow, 0, dnl
 ACCEPT udp -- 0.0.0.0/0 239.255.255.250 udp dpt:1900 ctstate NEW,UNTRACKED
 ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353 ctstate NEW,UNTRACKED
@@ -71,16 +56,6 @@
 ACCEPT udp ::/0 ff02::fb udp dpt:5353 ctstate NEW,UNTRACKED
 ACCEPT tcp ::/0 ::/0 tcp dpt:12345 ctstate NEW,UNTRACKED
 )
-IPTABLES_LIST_RULES(filter, IN_drop_log, 0, dnl
- LOG udp -- 0.0.0.0/0 239.255.255.250 udp dpt:1900 ctstate NEW,UNTRACKED LOG flags 0 level 4
- LOG udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353 ctstate NEW,UNTRACKED LOG flags 0 level 4
- LOG tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:12345 ctstate NEW,UNTRACKED LOG flags 0 level 4
-)
-IP6TABLES_LIST_RULES(filter, IN_drop_log, 0, dnl
- LOG udp ::/0 ff02::c udp dpt:1900 ctstate NEW,UNTRACKED LOG flags 0 level 4
- LOG udp ::/0 ff02::fb udp dpt:5353 ctstate NEW,UNTRACKED LOG flags 0 level 4
- LOG tcp ::/0 ::/0 tcp dpt:12345 ctstate NEW,UNTRACKED LOG flags 0 level 4
-)
 
 dnl firewall-cmd
 FWD_CHECK(--permanent --service=my-service-with-include --query-include=recursive-service, 0, ignore, ignore)

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/functions.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/functions.at Changed

@@ -1,5 +1,5 @@
 m4_define(FWD_STOP_FIREWALLD, 
- pid=$(cat firewalld.pid)
+ pid=$(< firewalld.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -13,9 +13,12 @@
 dnl if testsuite ran with debug flag, add debug output
 ${at_debug_p} && FIREWALLD_ARGS="--debug=9 ${FIREWALLD_ARGS}"
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
- FIREWALLD_ARGS="${FIREWALLD_ARGS} --default-config ${FIREWALLD_DEFAULT_CONFIG}"
+ FIREWALLD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}"
 fi
 
+ dnl limit data (and heap) to catch unexpected increases in memory usage
+ ulimit -d $(expr 1024 \* 100)
+
 NS_CMD(firewalld $FIREWALLD_ARGS &)
 if test $? -ne 0; then
 AT_FAIL_IF(:)
@@ -25,7 +28,7 @@
 dnl Give it some time for the dbus interface to come up
 WANTED_CODE="$1"
 up=0
- for I in $(seq 60); do
+ for I in 1 2 3 4 5 6 7 8 9 0; do
 NS_CMD(firewall-cmd --state)
 RC=$?
 echo "exit code = ${RC}"
@@ -75,7 +78,7 @@
 )
 
 m4_define(STOP_NETWORKMANAGER, 
- pid=$(cat networkmanager.pid)
+ pid=$(< networkmanager.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -117,9 +120,6 @@
 export LC_ALL
 fi
 
- dnl limit data (and heap) to catch unexpected increases in memory usage
- ulimit -d $(expr 1024 \* 100)
-
 dnl start every test with the default config
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
 AT_CHECK(if ! cp "${FIREWALLD_DEFAULT_CONFIG}/firewalld.conf" ./firewalld.conf; then exit 77; fi)
@@ -279,7 +279,7 @@
 m4_define(FWD_OFFLINE_CHECK, 
 FIREWALL_OFFLINE_CMD_ARGS="--system-config ./"
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
- FIREWALL_OFFLINE_CMD_ARGS="${FIREWALL_OFFLINE_CMD_ARGS} --default-config ${FIREWALLD_DEFAULT_CONFIG}"
+ FIREWALL_OFFLINE_CMD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}"
 fi
 
 AT_CHECK(firewall-offline-cmd $FIREWALL_OFFLINE_CMD_ARGS $1, $2, $3, $4, $5, $6)

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/integration/testsuite -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/integration/testsuite Changed

@@ -910,7 +910,7 @@
 # List of tests.
 if $at_list_p; then
 cat <<_ATEOF || at_write_fail=1
-firewalld 1.2.6 test suite test groups:
+firewalld 1.2.1 test suite test groups:
 
 NUM: FILE-NAME:LINE TEST-GROUP-NAME
 KEYWORDS
@@ -951,7 +951,7 @@
 exit $at_write_fail
 fi
 if $at_version_p; then
- $as_echo "$as_me (firewalld 1.2.6)" &&
+ $as_echo "$as_me (firewalld 1.2.1)" &&
 cat <<\_ATEOF || at_write_fail=1
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1140,11 +1140,11 @@
 
 # Banners and logs.
 $as_echo "## --------------------------- ##
-## firewalld 1.2.6 test suite. ##
+## firewalld 1.2.1 test suite. ##
 ## --------------------------- ##"
 {
 $as_echo "## --------------------------- ##
-## firewalld 1.2.6 test suite. ##
+## firewalld 1.2.1 test suite. ##
 ## --------------------------- ##"
 echo
 
@@ -1988,7 +1988,7 @@
 $as_echo "Please send $at_msg and all information you think might help:
 
 To: <https://github.com/firewalld/firewalld>
- Subject: firewalld 1.2.6 $as_me: $at_fail_list${at_fail_list:+ failed${at_xpass_list:+, }}$at_xpass_list${at_xpass_list:+ passed unexpectedly}
+ Subject: firewalld 1.2.1 $as_me: $at_fail_list${at_fail_list:+ failed${at_xpass_list:+, }}$at_xpass_list${at_xpass_list:+ passed unexpectedly}
 
 You may investigate any problem if you feel able to do so, in which
 case the test suite provides a good starting point. Its output may
@@ -2024,8 +2024,6 @@
 export LC_ALL
 fi
 
- ulimit -d $(expr 1024 \* 100)
-
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
 { set +x
 $as_echo "$at_srcdir/rhbz1773809.at:1: if ! cp \"\${FIREWALLD_DEFAULT_CONFIG}/firewalld.conf\" ./firewalld.conf; then exit 77; fi"
@@ -2089,7 +2087,7 @@
 
 kill_firewalld() {
 
- pid=$(cat firewalld.pid)
+ pid=$(< firewalld.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -2101,7 +2099,7 @@
 kill_networkmanager() {
 if test -f networkmanager.pid; then
 
- pid=$(cat networkmanager.pid)
+ pid=$(< networkmanager.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -2309,9 +2307,11 @@
 FIREWALLD_ARGS="--nofork --nopid --log-file ./firewalld.log --system-config ./"
 ${at_debug_p} && FIREWALLD_ARGS="--debug=9 ${FIREWALLD_ARGS}"
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
- FIREWALLD_ARGS="${FIREWALLD_ARGS} --default-config ${FIREWALLD_DEFAULT_CONFIG}"
+ FIREWALLD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}"
 fi
 
+ ulimit -d $(expr 1024 \* 100)
+
 ip netns exec fwd-test-${at_group_normalized} firewalld $FIREWALLD_ARGS &
 if test $? -ne 0; then
 $as_echo "rhbz1773809.at:1" >"$at_check_line_file"
@@ -2321,7 +2321,7 @@
 
 WANTED_CODE=""
 up=0
- for I in $(seq 60); do
+ for I in 1 2 3 4 5 6 7 8 9 0; do
 ip netns exec fwd-test-${at_group_normalized} firewall-cmd --state
 RC=$?
 echo "exit code = ${RC}"
@@ -2495,7 +2495,7 @@
 
 FIREWALL_OFFLINE_CMD_ARGS="--system-config ./"
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
- FIREWALL_OFFLINE_CMD_ARGS="${FIREWALL_OFFLINE_CMD_ARGS} --default-config ${FIREWALLD_DEFAULT_CONFIG}"
+ FIREWALL_OFFLINE_CMD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}"
 fi
 
 { set +x
@@ -2728,8 +2728,6 @@
 export LC_ALL
 fi
 
- ulimit -d $(expr 1024 \* 100)
-
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
 { set +x
 $as_echo "$at_srcdir/rhbz1928860.at:1: if ! cp \"\${FIREWALLD_DEFAULT_CONFIG}/firewalld.conf\" ./firewalld.conf; then exit 77; fi"
@@ -2793,7 +2791,7 @@
 
 kill_firewalld() {
 
- pid=$(cat firewalld.pid)
+ pid=$(< firewalld.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -2805,7 +2803,7 @@
 kill_networkmanager() {
 if test -f networkmanager.pid; then
 
- pid=$(cat networkmanager.pid)
+ pid=$(< networkmanager.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -3013,9 +3011,11 @@
 FIREWALLD_ARGS="--nofork --nopid --log-file ./firewalld.log --system-config ./"
 ${at_debug_p} && FIREWALLD_ARGS="--debug=9 ${FIREWALLD_ARGS}"
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
- FIREWALLD_ARGS="${FIREWALLD_ARGS} --default-config ${FIREWALLD_DEFAULT_CONFIG}"
+ FIREWALLD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}"
 fi
 
+ ulimit -d $(expr 1024 \* 100)
+
 ip netns exec fwd-test-${at_group_normalized} firewalld $FIREWALLD_ARGS &
 if test $? -ne 0; then
 $as_echo "rhbz1928860.at:1" >"$at_check_line_file"
@@ -3025,7 +3025,7 @@
 
 WANTED_CODE=""
 up=0
- for I in $(seq 60); do
+ for I in 1 2 3 4 5 6 7 8 9 0; do
 ip netns exec fwd-test-${at_group_normalized} firewall-cmd --state
 RC=$?
 echo "exit code = ${RC}"
@@ -3309,8 +3309,6 @@
 export LC_ALL
 fi
 
- ulimit -d $(expr 1024 \* 100)
-
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
 { set +x
 $as_echo "$at_srcdir/gh976.at:1: if ! cp \"\${FIREWALLD_DEFAULT_CONFIG}/firewalld.conf\" ./firewalld.conf; then exit 77; fi"
@@ -3374,7 +3372,7 @@
 
 kill_firewalld() {
 
- pid=$(cat firewalld.pid)
+ pid=$(< firewalld.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -3386,7 +3384,7 @@
 kill_networkmanager() {
 if test -f networkmanager.pid; then
 
- pid=$(cat networkmanager.pid)
+ pid=$(< networkmanager.pid)
 kill $pid
 for I in 1 2 3 4 5 6 7 8 9 0; do
 ps --pid $pid >/dev/null || { pid=0; break; }
@@ -3594,9 +3592,11 @@
 FIREWALLD_ARGS="--nofork --nopid --log-file ./firewalld.log --system-config ./"
 ${at_debug_p} && FIREWALLD_ARGS="--debug=9 ${FIREWALLD_ARGS}"
 if test "x${FIREWALLD_DEFAULT_CONFIG}" != x ; then
- FIREWALLD_ARGS="${FIREWALLD_ARGS} --default-config ${FIREWALLD_DEFAULT_CONFIG}"
+ FIREWALLD_ARGS+=" --default-config ${FIREWALLD_DEFAULT_CONFIG}"
 fi
 
+ ulimit -d $(expr 1024 \* 100)
+
 ip netns exec fwd-test-${at_group_normalized} firewalld $FIREWALLD_ARGS &
 if test $? -ne 0; then
 $as_echo "gh976.at:1" >"$at_check_line_file"
@@ -3606,7 +3606,7 @@
 
 WANTED_CODE=""
 up=0
- for I in $(seq 60); do
+ for I in 1 2 3 4 5 6 7 8 9 0; do
 ip netns exec fwd-test-${at_group_normalized} firewall-cmd --state
 RC=$?
 echo "exit code = ${RC}"
@@ -3825,8 +3825,6 @@
 export LC_ALL
 fi

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/package.m4 -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/package.m4 Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/gh258.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/regression/gh258.at Changed

@@ -16,8 +16,8 @@
         chain filter_INPUT {
             ct state established,related accept
             ct status dnat accept
-            iifname "lo" accept
             ct state invalid drop
+            iifname "lo" accept
             jump filter_INPUT_ZONES
             reject with icmpx admin-prohibited
         }
@@ -39,8 +39,8 @@
         chain filter_FORWARD {
             ct state established,related accept
             ct status dnat accept
-            iifname "lo" accept
             ct state invalid drop
+            iifname "lo" accept
             ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
             jump filter_FORWARD_ZONES
             reject with icmpx admin-prohibited
@@ -132,8 +132,8 @@
 
 IPTABLES_LIST_RULES(filter, INPUT, 0, dnl
     ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
     INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
     REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
@@ -146,8 +146,8 @@
 )
 IPTABLES_LIST_RULES(filter, FORWARD, 0, dnl
     ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
     FORWARD_ZONES all -- 0.0.0.0/0 0.0.0.0/0
     REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
@@ -201,8 +201,8 @@
 
 IP6TABLES_LIST_RULES(filter, INPUT, 0, dnl
     ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all ::/0 ::/0
     DROP all ::/0 ::/0 ctstate INVALID
+    ACCEPT all ::/0 ::/0
     INPUT_direct all ::/0 ::/0
     INPUT_ZONES all ::/0 ::/0
     REJECT all ::/0 ::/0 reject-with icmp6-adm-prohibited
@@ -215,8 +215,8 @@
 )
 IP6TABLES_LIST_RULES(filter, FORWARD, 0, dnl
     ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all ::/0 ::/0
     DROP all ::/0 ::/0 ctstate INVALID
+    ACCEPT all ::/0 ::/0
     FORWARD_direct all ::/0 ::/0
     RFC3964_IPv4 all ::/0 ::/0
     FORWARD_ZONES all ::/0 ::/0

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/regression.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/regression/regression.at Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/rhbz1514043.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/regression/rhbz1514043.at Changed

@@ -14,9 +14,9 @@
         chain filter_INPUT {
             ct state established,related accept
             ct status dnat accept
-            iifname "lo" accept
             ct state invalid log prefix "STATE_INVALID_DROP: "
             ct state invalid drop
+            iifname "lo" accept
             jump filter_INPUT_ZONES
             log prefix "FINAL_REJECT: "
             reject with icmpx admin-prohibited
@@ -28,9 +28,9 @@
         chain filter_FORWARD {
             ct state established,related accept
             ct status dnat accept
-            iifname "lo" accept
             ct state invalid log prefix "STATE_INVALID_DROP: "
             ct state invalid drop
+            iifname "lo" accept
             ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } log prefix "RFC3964_IPv4_REJECT: " reject with icmpv6 addr-unreachable
             jump filter_FORWARD_ZONES
             log prefix "FINAL_REJECT: "
@@ -41,9 +41,9 @@
 
 IPTABLES_LIST_RULES(filter, INPUT, 0, dnl
     ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
     DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     INPUT_direct all -- 0.0.0.0/0 0.0.0.0/0
     INPUT_ZONES all -- 0.0.0.0/0 0.0.0.0/0
     LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
@@ -51,9 +51,9 @@
 )
 IPTABLES_LIST_RULES(filter, FORWARD, 0, dnl
     ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     LOG all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
     DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
+    ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
     FORWARD_direct all -- 0.0.0.0/0 0.0.0.0/0
     FORWARD_ZONES all -- 0.0.0.0/0 0.0.0.0/0
     LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
@@ -61,9 +61,9 @@
 )
 IP6TABLES_LIST_RULES(filter, INPUT, 0, dnl
     ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all ::/0 ::/0
     LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
     DROP all ::/0 ::/0 ctstate INVALID
+    ACCEPT all ::/0 ::/0
     INPUT_direct all ::/0 ::/0
     INPUT_ZONES all ::/0 ::/0
     LOG all ::/0 ::/0 LOG flags 0 level 4 prefix "FINAL_REJECT: "
@@ -71,9 +71,9 @@
 )
 IP6TABLES_LIST_RULES(filter, FORWARD, 0, dnl
     ACCEPT all ::/0 ::/0 ctstate RELATED,ESTABLISHED,DNAT
-    ACCEPT all ::/0 ::/0
     LOG all ::/0 ::/0 ctstate INVALID LOG flags 0 level 4 prefix "STATE_INVALID_DROP: "
     DROP all ::/0 ::/0 ctstate INVALID
+    ACCEPT all ::/0 ::/0
     FORWARD_direct all ::/0 ::/0
     RFC3964_IPv4 all ::/0 ::/0
     FORWARD_ZONES all ::/0 ::/0

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/rhbz1871298.at -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/regression/rhbz1871298.at Changed

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/testsuite -> _service:tar_scm:firewalld-1.2.1.tar.gz/src/tests/testsuite Changed

@@ -619,7 +619,7 @@
 27;firewall-cmd.at:1952;rich rules bad;offline rich;
 28;firewall-cmd.at:1995;config validation;offline check_config;
 29;rfc3964_ipv4.at:1;RFC3964_IPv4;offline rfc3964_ipv4;
-30;service_include.at:1;service include;offline service xml gh273 rhbz1720300 gh707 gh1075;
+30;service_include.at:1;service include;offline service xml gh273 rhbz1720300;
 31;helpers_custom.at:1;customer helpers;offline helpers rhbz1733066 gh514 rhbz1769520;
 32;policy.at:5;policy - xml;offline policy xml;
 33;policy.at:79;policy - create;offline policy;
@@ -641,7 +641,7 @@
 49;protocols.at:1;protocols;offline policy protocol;
 50;rich_rules.at:1;rich rules;offline policy rich;
 51;icmp_blocks.at:1;ICMP blocks;offline policy icmp_block;
-52;rich_tcp_mss_clamp.at:5;tcp-mss-clamp;offline tcp-mss-clamp gh1121;
+52;rich_tcp_mss_clamp.at:5;tcp-mss-clamp;offline tcp-mss-clamp;
 53;rich_destination_ipset.at:1;rich destination ipset;offline rich ipset;
 54;zone.at:1;zone - target;offline zone;
 55;rpfilter.at:1;rpfilter;offline rpfilter;
@@ -741,167 +741,159 @@
 149;gh940.at:1;log prefix;nftables policy gh940;
 150;build_policy_split_wildcard.at:1;build policy split wildcards;nftables gh892 policy;
 151;gh1011.at:1;remove entries results in empty;nftables ipset gh1011 rhbz2121985;
-152;rhbz2181406.at:1;rich rule limit;nftables rich rhbz2181406;
-153;ipset_scale.at:1;ipset scale;nftables ipset gh738;
-154;gh1129.at:1;switch backend to iptables and reload;nftables gh1129;
-155;gh1146.at:1;policy with mixed family zone source;nftables policy gh1146;
-156;python.at:3;firewalld_test.py;nftables python;
-157;python.at:8;firewalld_config.py;nftables python;
-158;python.at:13;firewalld_rich.py;nftables python;
-159;python.at:18;firewalld_direct.py;nftables python;
-160;rfc3964_ipv4.at:1;RFC3964_IPv4;nftables rfc3964_ipv4;
-161;service_include.at:1;service include;nftables service xml gh273 rhbz1720300 gh707 gh1075;
-162;helpers_custom.at:1;customer helpers;nftables helpers rhbz1733066 gh514 rhbz1769520;
-163;policy.at:5;policy - xml;nftables policy xml;
-164;policy.at:79;policy - create;nftables policy;
-165;policy.at:96;policy - name;nftables policy;
-166;policy.at:109;policy - list;nftables policy;
-167;policy.at:231;policy - options;nftables policy;
-168;policy.at:290;policy - priority;nftables policy;
-169;policy.at:420;policy - zones;nftables policy;
-170;policy.at:607;policy - dispatch;nftables policy;
-171;policy.at:2239;policy - interfaces/sources;nftables policy;
-172;policy.at:2406;policy - target;nftables policy;
-173;policy.at:2455;policy - from file;nftables policy;
-174;services.at:1;services;nftables policy service;
-175;ports.at:1;ports;nftables policy port;
-176;source_ports.at:1;source ports;nftables policy source_port;
-177;forward_ports.at:1;forward ports;nftables policy forward_port;
-178;forward_ports.at:199;forward ports (OUTPUT);nftables policy forward_port rhbz2039542;
-179;masquerade.at:1;masquerade;nftables policy masquerade;
-180;protocols.at:1;protocols;nftables policy protocol;
-181;rich_rules.at:1;rich rules;nftables policy rich;
-182;icmp_blocks.at:1;ICMP blocks;nftables policy icmp_block;
-183;rich_tcp_mss_clamp.at:5;tcp-mss-clamp;nftables tcp-mss-clamp gh1121;
-184;rich_destination_ipset.at:1;rich destination ipset;nftables rich ipset;
-185;zone.at:1;zone - target;nftables zone;
-186;rpfilter.at:1;rpfilter;nftables rpfilter;
-187;zone_combine.at:1;zone - combine;nftables zone;
-188;startup_failsafe.at:1;startup failsafe - invalid xml;nftables failsafe;
-189;startup_failsafe.at:1;startup failsafe - bad zone;nftables failsafe;
-190;startup_failsafe.at:1;startup failsafe - bad policy;nftables failsafe;
-191;startup_failsafe.at:1;startup failsafe - non-existent service;nftables failsafe;
-192;startup_failsafe.at:1;startup failsafe - non-existent icmptype;nftables failsafe;
-193;startup_failsafe.at:1;startup failsafe - bad direct;nftables failsafe;
-194;startup_failsafe.at:1;startup failsafe - broken stock config;nftables;
-195;ipset_defer_native_ipset_creation.at:1;ipset defer native creation;nftables ipset direct rhbz2122678;
-196;firewall-cmd.at:5;basic options;iptables panic reload gh808;
-197;firewall-cmd.at:34;get/list options;iptables zone service icmp;
-198;firewall-cmd.at:50;default zone;iptables zone;
-199;firewall-cmd.at:62;user zone;iptables zone;
-200;firewall-cmd.at:82;zone interfaces;iptables zone;
-201;firewall-cmd.at:180;zone sources;iptables zone;
-202;firewall-cmd.at:233;services;iptables service;
-203;firewall-cmd.at:277;user services;iptables service;
-204;firewall-cmd.at:359;ports;iptables port;
-205;firewall-cmd.at:416;source ports;iptables port;
-206;firewall-cmd.at:453;protocols;iptables protocol;
-207;firewall-cmd.at:481;masquerade;iptables masquerade nat;
-208;firewall-cmd.at:508;forward;iptables forward gh586 gh613;
-209;firewall-cmd.at:696;forward ports;iptables port forward_port;
-210;firewall-cmd.at:795;ICMP block;iptables icmp;
-211;firewall-cmd.at:841;user ICMP types;iptables icmp;
-212;firewall-cmd.at:864;ipset;iptables ipset rhbz1685256;
-213;firewall-cmd.at:1061;user helpers;iptables helper;
-214;firewall-cmd.at:1089;direct;iptables direct;
-215;firewall-cmd.at:1163;direct nat;iptables direct nat;
-216;firewall-cmd.at:1188;direct passthrough;iptables direct passthrough;
-217;firewall-cmd.at:1226;direct ebtables;iptables direct ebtables;
-218;firewall-cmd.at:1272;lockdown;iptables lockdown;
-219;firewall-cmd.at:1339;rich rules good;iptables rich;
-220;firewall-cmd.at:1373;rich rules audit;iptables rich;
-221;firewall-cmd.at:1381;rich rules priority;iptables rich;
-222;firewall-cmd.at:1952;rich rules bad;iptables rich;
-223;firewall-cmd.at:1995;config validation;iptables check_config;
-224;rhbz1514043.at:1;--set-log-denied does not zero config;iptables log_denied rhbz1514043;
-225;rhbz1498923.at:1;invalid direct rule causes reload error;iptables direct reload rhbz1498923;
-226;pr181.at:1;combined zones name length check;iptables zone gh181;
-227;gh287.at:1;ICMP block inversion;iptables icmp gh287;
-228;individual_calls.at:1;individual calls;iptables individual_calls;
-229;rhbz1534571.at:3;rule deduplication;iptables rhbz1534571;
-230;gh290.at:1;invalid syntax in xml files;iptables xml direct gh290;
-231;gh290.at:19;invalid syntax in xml files;iptables xml zone gh290;
-232;icmp_block_in_forward_chain.at:1;ICMP block not present FORWARD chain;iptables icmp;
-233;pr323.at:1;GRE proto helper;iptables helper gh323;
-234;rhbz1506742.at:1;ipset with timeout;iptables ipset rhbz1506742;
-235;rhbz1594657.at:1;no log untracked passthrough queries;iptables direct passthrough rhbz1594657;
-236;rhbz1571957.at:1;set-log-denied w/ ICMP block inversion;iptables log_denied rhbz1571957 icmp;
-237;rhbz1404076.at:1;query single port added with range;iptables port rhbz1404076;
-238;gh366.at:1;service destination multiple IP versions;iptables service gh366;
-239;rhbz1601610.at:1;ipset duplicate entries;iptables ipset rhbz1601610;
-240;gh303.at:1;unicode in XML;iptables xml unicode service gh303;
-241;gh335.at:1;forward-port toaddr enables IP forwarding;iptables port forward_port gh335;
-242;gh482.at:1;remove forward-port after reload;iptables gh482 rhbz1637675 rich forward_port;
-243;gh478.at:1;rich rule marks every packet;iptables rich mark gh478;
-244;gh258.at:1;zone dispatch layout;iptables zone gh258 gh441 rhbz1713823;
-245;rhbz1715977.at:1;rich rule src/dst with service destination;iptables rich service rhbz1715977 rhbz1729097 rhbz1791783;
-246;rhbz1723610.at:1;direct remove-rules per family;iptables direct rhbz1723610 gh385;
-247;rhbz1734765.at:1;zone sources ordered by name;iptables zone rhbz1734765 rhbz1421222 gh166 rhbz1738545;
-248;gh567.at:1;rich rule source w/ mark action;iptables gh567 rich ipset;
-249;rhbz1779835.at:1;ipv6 address with brackets;iptables rhbz1779835 ipset;
-250;rhbz1779835.at:16;ipv6 address with brackets;iptables rhbz1779835 zone forward_port rich;
-251;gh330.at:1;ipset cleanup on reload/stop;iptables ipset reload gh330 rhbz1682913 rhbz1790948 rhbz1809225;
-252;gh599.at:1;writing to log after copytruncate;iptables gh599;
-253;rhbz1829104.at:1;direct rule in zone chain;iptables direct rhbz1829104;
-254;rhbz1843398.at:1;rich rule source mac;iptables rich rhbz1843398 gh643;
-255;rhbz1839781.at:1;service RH-Satellite-6;iptables service rhbz1839781;
-256;rhbz1689429.at:1;rich rule invalid priority;iptables rich rhbz1689429;
-257;rhbz1483921.at:1;direct and zone mutually exclusive;iptables direct rhbz1483921;
-258;rhbz1541077.at:1;hash:mac and family mutually exclusive;iptables ipset rhbz1541077;
-259;rhbz1855140.at:1;rich rule icmptypes with one family;iptables rich icmp rhbz1855140;
-260;rhbz1871298.at:1;rich rule parsing bottleneck;iptables rich offline rhbz1871298;
-261;rhbz1596304.at:1;rich rules strip non-printable characters;iptables rich rhbz1596304;
-262;gh703.at:1;add source with mac address;iptables gh703;
-263;ipset_netmask_allowed.at:1;ipset netmask allowed type hash:ip;iptables ipset reload;
-264;rhbz1940928.at:1;direct -s/-d multiple addresses;iptables direct rhbz1940928 rhbz1949552;
-265;rhbz1936896.at:1;ipset type hash:net,net;iptables rhbz1936896;
-266;gh795.at:1;ipset entry delete w/ timeout=0;iptables ipset gh794 gh795;
-267;rhbz1914935.at:1;zone overlapping ports;iptables zone port rhbz1914935;
-268;gh696.at:1;icmp-block-inversion no log blocked;iptables icmp gh696 rhbz1945833;
-269;rhbz1917766.at:1;rich rule source with netmask;iptables rich rhbz1917766;
-270;rhbz2014383.at:1;same source in two zone xml;iptables zone rhbz2014383;
-271;gh874.at:1;policy masquerade w/ ingress interface;iptables policy zone masquerade gh874;
-272;gh881.at:1;ipset entry overlap detect perf;iptables ipset gh881;
-273;service_includes_for_builtin.at:1;service include for built-in;iptables dbus service service_includes_for_builtin service_includes_for_built-in;
-274;gh940.at:1;log prefix;iptables policy gh940;
-275;build_policy_split_wildcard.at:1;build policy split wildcards;iptables gh892 policy;
-276;gh1011.at:1;remove entries results in empty;iptables ipset gh1011 rhbz2121985;
-277;rhbz2181406.at:1;rich rule limit;iptables rich rhbz2181406;
-278;ipset_scale.at:1;ipset scale;iptables ipset gh738;
-279;gh1129.at:16;switch backend to nftables and reload;iptables gh1129;
-280;gh1146.at:1;policy with mixed family zone source;iptables policy gh1146;
-281;python.at:3;firewalld_test.py;iptables python;
-282;python.at:8;firewalld_config.py;iptables python;
-283;python.at:13;firewalld_rich.py;iptables python;
-284;python.at:18;firewalld_direct.py;iptables python;
-285;rfc3964_ipv4.at:1;RFC3964_IPv4;iptables rfc3964_ipv4;
-286;service_include.at:1;service include;iptables service xml gh273 rhbz1720300 gh707 gh1075;
-287;helpers_custom.at:1;customer helpers;iptables helpers rhbz1733066 gh514 rhbz1769520;
-288;policy.at:5;policy - xml;iptables policy xml;
-289;policy.at:79;policy - create;iptables policy;
-290;policy.at:96;policy - name;iptables policy;
-291;policy.at:109;policy - list;iptables policy;
-292;policy.at:231;policy - options;iptables policy;
-293;policy.at:290;policy - priority;iptables policy;
-294;policy.at:420;policy - zones;iptables policy;
-295;policy.at:607;policy - dispatch;iptables policy;
-296;policy.at:2239;policy - interfaces/sources;iptables policy;
-297;policy.at:2406;policy - target;iptables policy;
-298;policy.at:2455;policy - from file;iptables policy;
-299;services.at:1;services;iptables policy service;
-300;ports.at:1;ports;iptables policy port;
-301;source_ports.at:1;source ports;iptables policy source_port;
-302;forward_ports.at:1;forward ports;iptables policy forward_port;
-303;forward_ports.at:199;forward ports (OUTPUT);iptables policy forward_port rhbz2039542;
-304;masquerade.at:1;masquerade;iptables policy masquerade;
-305;protocols.at:1;protocols;iptables policy protocol;
-306;rich_rules.at:1;rich rules;iptables policy rich;
-307;icmp_blocks.at:1;ICMP blocks;iptables policy icmp_block;
-308;rich_tcp_mss_clamp.at:5;tcp-mss-clamp;iptables tcp-mss-clamp gh1121;
-309;rich_destination_ipset.at:1;rich destination ipset;iptables rich ipset;
-310;zone.at:1;zone - target;iptables zone;
-311;rpfilter.at:1;rpfilter;iptables rpfilter;
-312;zone_combine.at:1;zone - combine;iptables zone;
+152;python.at:3;firewalld_test.py;nftables python;
+153;python.at:8;firewalld_config.py;nftables python;
+154;python.at:13;firewalld_rich.py;nftables python;
+155;python.at:18;firewalld_direct.py;nftables python;
+156;rfc3964_ipv4.at:1;RFC3964_IPv4;nftables rfc3964_ipv4;
+157;service_include.at:1;service include;nftables service xml gh273 rhbz1720300;
+158;helpers_custom.at:1;customer helpers;nftables helpers rhbz1733066 gh514 rhbz1769520;
+159;policy.at:5;policy - xml;nftables policy xml;
+160;policy.at:79;policy - create;nftables policy;
+161;policy.at:96;policy - name;nftables policy;
+162;policy.at:109;policy - list;nftables policy;
+163;policy.at:231;policy - options;nftables policy;
+164;policy.at:290;policy - priority;nftables policy;
+165;policy.at:420;policy - zones;nftables policy;
+166;policy.at:607;policy - dispatch;nftables policy;
+167;policy.at:2239;policy - interfaces/sources;nftables policy;
+168;policy.at:2406;policy - target;nftables policy;

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/gh1129.at Deleted

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/gh1146.at Deleted

@@ -1,49 +0,0 @@
-FWD_START_TEST(policy with mixed family zone source)
-AT_KEYWORDS(policy gh1146)
-
-dnl full matrix of (ipv4, ipv6, interface)
-FWD_CHECK(--permanent --zone internal --add-interface dummy1, 0, ignore)
-FWD_CHECK(--permanent --zone internal --add-source 10.11.11.0/24, 0, ignore)
-IF_HOST_SUPPORTS_IPV6_RULES(
-FWD_CHECK(--permanent --zone internal --add-source fc00:1111:1111:1111::/64, 0, ignore)
-)
-dnl
-FWD_CHECK(--permanent --zone public --add-interface dummy2, 0, ignore)
-FWD_CHECK(--permanent --zone public --add-source 10.22.22.0/24, 0, ignore)
-IF_HOST_SUPPORTS_IPV6_RULES(
-FWD_CHECK(--permanent --zone public --add-source fc00:2222:2222:2222::/64, 0, ignore)
-)
-
-FWD_CHECK(--permanent --new-policy foobar, 0, ignore)
-FWD_CHECK(--permanent --policy foobar --add-ingress-zone internal, 0, ignore)
-FWD_CHECK(--permanent --policy foobar --add-egress-zone public, 0, ignore)
-
-FWD_RELOAD()
-
-dnl Since the families are mixed there should NOT be a rule to dispatch this
-dnl policy. It's invalid to match IPv6 and IPv4 in the same rule.
-dnl
-NFT_LIST_RULES(inet, filter_FORWARD_POLICIES_pre | grep foobar | sort, 0, dnl
-    iifname "dummy1" ip daddr 10.22.22.0/24 jump filter_FWD_policy_foobar
-    iifname "dummy1" ip6 daddr fc00:2222:2222:2222::/64 jump filter_FWD_policy_foobar
-    iifname "dummy1" oifname "dummy2" jump filter_FWD_policy_foobar
-    ip saddr 10.11.11.0/24 ip daddr 10.22.22.0/24 jump filter_FWD_policy_foobar
-    ip saddr 10.11.11.0/24 oifname "dummy2" jump filter_FWD_policy_foobar
-    ip6 saddr fc00:1111:1111:1111::/64 ip6 daddr fc00:2222:2222:2222::/64 jump filter_FWD_policy_foobar
-    ip6 saddr fc00:1111:1111:1111::/64 oifname "dummy2" jump filter_FWD_policy_foobar
-)
-
-IPTABLES_LIST_RULES(filter, FORWARD_POLICIES_pre, 0, dnl
-    FWD_foobar all -- 0.0.0.0/0 0.0.0.0/0
-    FWD_foobar all -- 0.0.0.0/0 10.22.22.0/24
-    FWD_foobar all -- 10.11.11.0/24 0.0.0.0/0
-    FWD_foobar all -- 10.11.11.0/24 10.22.22.0/24
-)
-IP6TABLES_LIST_RULES(filter, FORWARD_POLICIES_pre, 0, dnl
-    FWD_foobar all ::/0 ::/0
-    FWD_foobar all ::/0 fc00:2222:2222:2222::/64
-    FWD_foobar all fc00:1111:1111:1111::/64 ::/0
-    FWD_foobar all fc00:1111:1111:1111::/64 fc00:2222:2222:2222::/64
-)
-
-FWD_END_TEST()

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/ipset_scale.at Deleted

_service:tar_scm:firewalld-1.2.6.tar.gz/src/tests/regression/rhbz2181406.at Deleted

@@ -1,49 +0,0 @@
-FWD_START_TEST(rich rule limit)
-AT_KEYWORDS(rich rhbz2181406)
-
-FWD_CHECK(--add-rich-rule='rule family=ipv4 source address=10.10.10.10 service name=ssh log limit value="2/d"', 0, ignore)
-FWD_CHECK(--add-rich-rule='rule family=ipv6 destination address=fc00::10:10:10:10 service name=ssh audit limit value="5/m" accept', 0, ignore)
-
-FWD_CHECK(--add-rich-rule='rule family=ipv4 source address=10.10.10.10 service name=http accept limit value="2/d"', 0, ignore)
-FWD_CHECK(--add-rich-rule='rule family=ipv6 destination address=fc00::10:10:10:10 service name=http accept limit value="5/m"', 0, ignore)
-
-dnl The generated rule order matters for nftables as it evaluates left to right
-NFT_LIST_RULES(inet, filter_IN_public_log, 0, dnl
-table inet firewalld {
-    chain filter_IN_public_log {
-        ip saddr 10.10.10.10 tcp dport 22 ct state new,untracked limit rate 2/day log
-        ip6 daddr fc00::10:10:10:10 tcp dport 22 ct state new,untracked limit rate 5/minute log level audit
-    }
-}
-)
-NFT_LIST_RULES(inet, filter_IN_public_allow, 0, dnl
-table inet firewalld {
-    chain filter_IN_public_allow {
-        tcp dport 22 ct state new,untracked accept
-        ip6 daddr fe80::/64 udp dport 546 ct state new,untracked accept
-        ip6 daddr fc00::10:10:10:10 tcp dport 22 ct state new,untracked accept
-        ip saddr 10.10.10.10 tcp dport 80 ct state new,untracked limit rate 2/day accept
-        ip6 daddr fc00::10:10:10:10 tcp dport 80 ct state new,untracked limit rate 5/minute accept
-    }
-}
-)
-
-IPTABLES_LIST_RULES(filter, IN_public_log, 0, dnl
-LOG tcp -- 10.10.10.10 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED limit: avg 2/day burst 5 LOG flags 0 level 4
-)
-IPTABLES_LIST_RULES(filter, IN_public_allow, 0, dnl
-ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED
-ACCEPT tcp -- 10.10.10.10 0.0.0.0/0 tcp dpt:80 ctstate NEW,UNTRACKED limit: avg 2/day burst 5
-)
-
-IP6TABLES_LIST_RULES(filter, IN_public_log, 0, dnl
-AUDIT tcp ::/0 fc00::10:10:10:10 tcp dpt:22 ctstate NEW,UNTRACKED limit: avg 5/min burst 5 AUDIT accept
-)
-IP6TABLES_LIST_RULES(filter, IN_public_allow, 0, dnl
-ACCEPT tcp ::/0 ::/0 tcp dpt:22 ctstate NEW,UNTRACKED
-ACCEPT udp ::/0 fe80::/64 udp dpt:546 ctstate NEW,UNTRACKED
-ACCEPT tcp ::/0 fc00::10:10:10:10 tcp dpt:22 ctstate NEW,UNTRACKED
-ACCEPT tcp ::/0 fc00::10:10:10:10 tcp dpt:80 ctstate NEW,UNTRACKED limit: avg 5/min burst 5
-)
-
-FWD_END_TEST()

Changes of Revision 3