• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

without shift to nft

• Files Changed
• Browse Source

- Replace incorrect usage of %_libexecdir with %_prefix/lib

- rebased the original patch from revision 19
- apply patch only on openSUSE < TW, and SLES.

- Added a patch to make iptables the default again on openSUSE

- Update to version 0.7.2:
This is a bug fix only release.
  * fix: direct: removeRules() was mistakenly removing all rules
  * fix: guarantee zone source dispatch is sorted by zone name
  * fix: nftables: fix zone dispatch using ipset sources in nat chains
  * doc: add --default-config and --system-config
  * fix: --add-masquerade should only affect ipv4
  * fix: nftables: --forward-ports should only affect IPv4
  * fix: direct: removeRules() not removing all rules in chain
  * dbus: service: fix service includes individual APIs
  * fix: allow custom helpers using standard helper modules
  * fix: service: usage of helpers with '-' in name
  * fix: Revert "ebtables: drop support for broute table"
  * fix: ebtables: don't use tables that aren't available
  * fix: fw: initialize _rfc3964_ipv4

- Update to version 0.7.1:
  * Rich Rule Priorities
  * Service Definition Includes - Service definitions can now
    include lines like: <include service="https"/> which will
    include all the ports, etc from the https service.
  * RFC3964 IPv4 filtering - A new option RFC3964_IPv4 in
    firewalld.conf is available. It does filtering based on RFC3964

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Add upstream patch to mark more strings as translatable which is
  required by firewall UI when creating rich rules (bsc#1096542)
  * 0001-Fix-translating-labels-392.patch

- Add upstream patch to fix rich rules that uses ipset (bsc#1104990)
  * 00002-firewalld-0.6.x-rich-rule-with-ipset-regression.patch

- Update to 0.6.2. Some of the changes are:
  * update translations
  * nftables: fix log-denied with values other than "all" or "off"
  * fw_ipset: raise FirewallError if backend command fails
  * ipset: only use "-exist" on restore
  * fw_ipset: fix duplicate add of ipset entries
  * *tables: For opened ports/protocols/etc match ct state new,untracked (bsc#1105821)
  * ipXtables: increase wait lock to 10s
  * nftables: fix rich rules ports/protocols/source ports not considering ct state
  * ports: allow querying a single added by range
  * fw_zone: do not change rich rule errors into warnings
  * fw_zone: fix services with multiple destination IP versions (bsc#1105899)
  * fw_zone: consider destination for protocols
  * firewall/core/fw_nm: nm_get_zone_of_connection should return None or empty string instead of False (boo#1106319)
  * fw: If direct rules fail to apply add a "Direct" label to error msg
  * fw: if startup fails on reload, reapply non-perm config that survives reload
  * nftables: fix rich rule audit log
  * ebtables: replace RETURN policy with explicit RETURN at end of chain
  * direct backends: allow build_chain() to build multiple rules
  * fw: if failure occurs during startup set state to FAILED
  * fw: on restart set policy from same function
  * ebtables: drop support for broute table
- Remove upstream patches

• Files Changed
• Browse Source

- Add upstream patch to fix Neighbor Discovery filtering for IPv6 (bsc#1105821)
  * 0001-nftables-fix-rich-rules-ports-protocols-source-ports.patch
- Add upstream patch to fix building rules for multiple IP families (bsc#1105899)
  * 0001-fw_zone-consider-destination-for-protocols.patch
  * 0002-fw_zone-fix-services-with-multiple-destination-IP-ve.patch

• Files Changed
• Browse Source

- Add firewalld-fix-firewalld-config-crash.patch: set
  nm_get_zone_of_connection to return 'None' instead of 'False' for
  automatically generated connections to avoid firewall-config
  crashes. Patch provided by upstream (boo#1106319,
  gh#firewalld/firewalld#370).

• Files Changed
• Browse Source

- Restore nftables as default backend (bsc#1102761). nftables and
  iptables can co-exist but the 'nat' table had a bug which was fixed
  in kernel-4.18.
- Update to 0.6.1. Some of the changes are:
  * Correct source/destination in rich rule masquerade
  * Only modify ifcfg files for permanent configuration changes
  * Fix a backtrace when calling common_reverse_rule()
  * man firewalld.conf: Show nftables is the default FirewallBackend
  * firewall-config: fix some untranslated strings that caused a UI
    bug causing rich rules to not be modify-able (bsc#1096542)
  * fw_direct: avoid log for untracked passthrough queries
  * fixed many issues if iptables is actually iptables-nft
  * Use preferred location for AppData files
  * ipXtables: fix ICMP block inversion with set-log-denied
  * fixes ICMP block inversion with set-log-denied with
    IndividualCalls=yes
  * nftables: fix set-log-denied if target is not ACCEPT
  * fw_direct: strip _direct chain suffix if using nftables
  * NetworkManager integration bugfixes.
- Switch back to 'iptables' backend as default (bsc#1102761)
- Update to 0.6.0. Some of the changes are:
  * update translations
  * firewall-config: Add ipv6-icmp to the protocol dropdown box (#348, bsc#1099698)
  * core: logger: Remove world-readable bit from logfile (#349, bsc#1098986)
  * IPv6 rpfilter: explicitly allow neighbor solicitation
  * nftables backend (default)
  * Added loads of new services
  * firewall-cmd: add --check-config option
  * firewall-offline-cmd: add --check-config option
  * firewallctl: completely remove all code and references
  * dbus: expose FirewallBackend
  * dbus: fix erroneous fallback for AutomaticHelpers
- Remove patches which have made it upstream
  * firewalld-add-additional-services.patch
- spec-cleaner fixes
- Update to 0.5.3 (bsc#1093120)
  * tests/regression: add test for ipset with timeout
  * ipset: allow adding entries to ipsets with timeout
  * translations: update
  * helpers: load helper module explicitly if no port given
  * helpers: nf_conntrack_proto-* helpers needs name cropped
  * config/Makefile: correct name of proto-gre helper
  * tests/regression: test helper nf_conntrack_proto_gre (#263)
  * functions: get_nf_nat_helpers() should look in other directories too
  * functions: Allow nf_conntrack_proto_* helpers
  * services: Add GRE
  * helpers: Add proto-gre
  * tests/regression: add test to verify ICMP block in forward chain
  * ipXtables: fix ICMP block not being present in FORWARD chain
- Translations update (bsc#1081623).
- Backport upstream patches to add additional services (bsc#1082033)
  * firewalld-add-additional-services.patch
- Update to 0.5.2
  * fix rule deduplication causing accidental removal of rules
  * log failure to parse direct rules xml as an error
  * firewall-config: Break infinite loop when firewalld is not running
  * fix set-log-denied not taking effect
  * po: update translations
- Remove high-availability service. SUSE HA uses the cluster service
  provided by the yast2-cluster package (bsc#1078223)
- Update to 0.5.1
  * ipXtables: fix iptables-restore wait option detection
  * python3: use "foo in dict" not dict.has_key(foo)
  * Fix potential python3 keys() incompatibility in watcher
  * Fixed python3 compatibility
  * ebtables: fix missing default value to set_rule()
  * fw_zone: fix invalid reference to __icmp_block_inversion
  * zones: Correct and defer check_name for combined zones
- Update to 0.5.0
  * firewallctl: mark deprecated (gh#firewalld/firewalld##261)
  * Add nmea-0183 service
  * Add sycthing-gui service
  * Add syncthing service
  * Adding FirewallD jenkins service (gh#firewalld/firewalld#256)
  * services/high-availability: Add port 9929
  * Fix and improve firewalld-sysctls.conf
  * firewalld: also reload dbus config interface for global options
  * Add MongoDB service definition
  * src: firewall: Add support for SUSE ifcfg scripts
  * Add UPnP client service
  * firewalld: Allow specifying log file location
  * firewalld/firewall-offline-cmd: Allow setting system config directories
- Drop obsolete patch
  * 0001-suse-ifcfg-files.patch
- Drop tests installation
- Introduce new python3-firewall and firewall-macros subpackages.
  The first one contains the firewalld python3 bindings and the second
  one contains the RPM macros for firewalld.
- Replace dbus-1-python requires with dbus-1-python3: since
  firewalld was migrated to python3, we also have to require the
  python3 dependencies (boo#1070310).
- Add missing python3-gobject-Gdk dependency (boo#1069952)
- Replace references to /var/adm/fillup-templates with new 
  %_fillupdir macro (boo#1069468)
- Make sure to use python3 everywhere (boo#1068778)
- Add combined upstream patch to support SUSE ifcfg network files.
  * 0001-suse-ifcfg-files.patch (gh#firewalld/firewalld#262, fate#323460)
- Update to version 0.4.4.6
  * firewall.core.fw_config: Fix check for icmp builtin name
  * config.services: docker-swarm: fix incorrect attribute
  * xmlschema/service.xsd: Fix protocol looking for name instead of value
  * Add docker swarm service (gh#firewalld/firewalld#230)
  * Adding FirewallD redis service (gh#firewalld/firewalld#248)
  * Adding firewalld zabbix server and agent services (gh#firewalld/firewalld#221)
  * firewall-offline-cmd: Don't require root for help output
  * doc: firewall-cmd: Document --query-* options return codes
  * firewall-cmd: Use colors only if output is a TTY
  * core: Log unsupported ICMP types as informational only
  * add bgp service to predefined services edit to config/Makefile.am
  * Add git service
  * Add kprop service
  * minidlna definitions (gh#firewalld/firewalld#236)
  * SpiderOak ONE listens on port 21327 and 21328
  * autogen.sh: Allow skipping configure via NOCONFIGURE env var
  * Add missing ports to RH-Satellite-6 service
  * Reload nf_conntrack sysctls after the module is loaded
  * Add NFSv3 service.
  * config/Makefile.am: Add murmur service (a95eed1)
  * add new service IRC
  * firewall.core.prog: Simplify runProg output: Combine stderr and stdout
  * firewall.core.fw: Fix possible dict size change in for loop
  * firewall.core.fw: Use new firewalld git repo in firewalld organization
  * config/firewall-config.appdata.xml.in: Use new firewalld git repo in firewalld organization
  * firewall.core.fw_zone: Rich-rule ICMP type: Error only for conflicting family
  * firewall.core.rich: Add checks for Rich_Source validation
  * Handle also IPv6 with the zone masquerade flag
  * Add IPv6 support for forward-ports in zones
  * firewall.command: Enable parse_forward_port to work with IPv6 adresses
  * firewall.core.fw_zone: Fix IPv6 address in rich rule forward ports
  * add Murmur (Mumble server) service
- spec file fixes to avoid rpmlint warnings about duplicate files.
 
- Switch to python3
- Run spec cleaner
- Move autogen to build section
- Add systemd requirements
- Update to version 0.4.4.5
  * firewall-offline-cmd: Fix --remove-service-from-zone option (rh#1438127)
  * Support sctp and dccp in ports, source-ports, forward-ports, helpers and rich rules
  * firewall-cmd: Fix --{set,get}-{short,description} for zone
  * firewall.core.ipXtables: Use new wait option for restore commands if available
  * Adding ovirt-vmconsole service file
  * Adding oVirt storage-console service.
  * Adding ctdb service file.
  * Adding service file for nrpe.
  * Rename extension for policy choices (server and desktop) to .policy.choice (rh#1449754)
  * D-Bus interfaces: Fix GetAll for interfaces without properties (rh#1452017)
  * firewall.core.fw_config: Fix wrong variable use in repr output
  * firewall.core.fw_icmptype: Add missing import for copy
  * firewall.core.fw_test: Fix wrong format string in repr
  * firewall.core.io.zone: Fix getattr use on super(Zone)
  * firewall.functions: New function get_nf_nat_helpers
  * firewall.core.fw: Get NAT helpers and store them internally.
  * firewall.core.fw_zone: Load NAT helpers with conntrack helpers
  * firewalld.dbus: Add missing properties nf_conntrach_helper_setting and nf_conntrack_helpers
  * firewall.server.firewalld: New property for NAT helpers supported by the kernel
- Update to version 0.4.4.4
  * Drop references to fedorahosted.org from spec file and Makefile.am
  * firewall-config: Show invalid ipset type in the ipset dialog in the bad label
  * firewall.core.fw: Show icmptypes and ipsets with type errors in permanent env
  * firewall.server.firewalld: Provide information about the supported icmp types
  * firewall.core.fw_icmptype: Add ICMP type only if the type is supported
  * firewall.core.fw: New attributes ip{4,6}tables_supported_icmp_types
  * firewall.core.ipXtables: New method supported_icmp_types
  * firewall-config: Deactivate edit buttons if there are no items
  * firewall.core.io.zone: Fix permanent rich rules using icmp-type (rh#1434594)
  * firewall.core.fw_ipset: get_ipset may not ckeck if set is applied by default
  * firewall.core.fw_transaction: Use LastUpdatedOrderedDict for zone transactions
- Remove upstream patch:
  * 0001-firewall.core.fw_ipset-get_ipset-may-not-ckeck-if-se.patch 
- Update to version 0.4.4.3
  * New service freeipa-trust (rh#1411650)
  * Complete icmp types for IPv4 and IPv6
  * New h323 helper container
  * Support helper container: h323
  * firewall.server.decorators: ALREADY_ errors should be logged as warnings
  * firewall.command: ALREADY_SET should also result in zero exit code
  * tests/firewall-offline-cmd_test.sh: Only use firewall-offline-cmd
  * Support more ipset types: hash:ip,port, hash:ip,port,ip, hash:ip,port,net, hash:ip,mark, hash:net,net, hash:net,port, hash:net,port,net, hash:net,iface
  * New checks for ipset entry validation
  * Use ipset dimension for match
  * firewall.core.base: New ZONE_SOURCE_IPSET_TYPES list
  * New firewall.core.icmp providing names and types for icmp and icmpv6 values
  * firewall.core.fw_ipset: New methods to get ipset dimension and applied state
  * firewall.errors: New error NOT_APPLIED
  * firewall-cmd man page: Add missing --get-ipset-types
  * firewall.core.fw_nm: No trace back on failed get_connection call (rh#1413345)
  * firewall.core.prog: Fix addition of the error output in runProg
  * Speed up ipset handling, (re)loading and import from file
  * Support --family option for --new-ipset
  * Handle FirewallError for query sequences in command line tools
  * Fail to alter entries of ipsets with timeout
  * Extended tests for ipset options
  * Return empty list for ipsets using timeouts
  * firewall.functions: Fix checks in checkIPnMask and checkIP6nMask (gh#t-woerner/firewalld#186)
  * firewalld.conf man page: New section about AutomaticHelpers
  * firewall-offline-cmd man page: Added -v and -q options, fixed section ids
  * firewall{-cmd, ctl}: Fix scope of final return in try_set_zone_of_interface
  * firewall.core.fw_zone: Limit masquerading forward rule to new connections
  * firewall-config: Update active zones on reloaded signal
  * firewall-applet: Update active zones and tooltip on reloaded signal
  * firewall.core.fw_zone: Fix missing chain for helper in rich rules using service (rh#1416578)
  * Support icmp-type usage in rich rules (rh#1409544)
  * firewall[-offline]-cmd: Fix --{set,get}-{short,description} for ipset and helper (rh#1416325)
  * firewall.core.ipset: Solve ipset creation issues with -exist and more flag tests
  * Speed up start and restart for ipsets with lots of entries (rh#1416817)
  * Speed up of ipset alteration by adding and removing entries using a file (rh#1416817)
  * Code cleanup and minor bug fixes
  * firewall.core.prog: Fix addition of the error output in runProg
  * New services mssql, kibana, elasticsearch, quassel, bitcoin-rpc, bitcoin-testnet-rpc, bitcoin-testnet, bitcoin and spideroak-lansync
  * Translation updates
- Add upstream patch to fix ipset overloading from /etc/firewalld/ipsets (gh#t-woerner/firewalld#206)
  * 0001-firewall.core.fw_ipset-get_ipset-may-not-ckeck-if-se.patch 
- Update to version 0.4.4.2
  * firewalld.spec: Added helpers and ipsets paths to firewalld-filesystem
  * firewall.core.fw_nm: create NMClient lazily
  * Do not use hard-coded path for modinfo, use autofoo to detect it
  * firewall.core.io.ifcfg: Dropped invalid option warning with bad format string
  * firewall.core.io.ifcfg: Properly handle quoted ifcfg values
  * firewall.core.fw_zone: Do not reset ZONE with ifdown
  * Updated translations from zanata
  * firewall-config: Extra grid at bottom to visualize firewalld settings
- Update to version 0.4.4.1
 * Translation updates form zanata
 * firewallctl: New support for helpers
 * firewallctl: Use sys.excepthook to force exception_handler usage always
 * firewall-config: Use proper source check in sourceDialog
- Update to version 0.4.4
  * firewall-applet: Use PyQt5
  * firewall-config: New nf_conntrack_select dialog, use nf_conntrack_helpers
    D-Bus property
  * New helpers Q.931 and RAS from nf_conntrack_h323
  * firewall.core.fw_zone: Add zone bingings for PREROUTING in the raw table
  * firewall.core.ipXtables: Add PREROUTING default rules for zones in raw
    table
  * New helper configuration files for amanda, ftp, irc, netbios-ns, pptp,
    sane, sip, snmp and tftp
  * firewall-cmd: Fixed --{get,set}-{description,short} for permanent zones
  * firewall.command: Do not use error code 254 for {ALREADY,NOT}_ENABLED
    sequences
  * Misc bug fixes.
  * For the complete list of changes please see:
    https://github.com/t-woerner/firewalld/releases/tag/v0.4.4
- Relax permissions for default installation files. The files in
  /usr/lib/firewalld are the default ones as shipped by the package and
  there is nothing secret in them.
- Update to version 0.4.3.3
  * Fixes CVE-2016-5410 (bsc#992772)
  * Standard error is now used for errors and warnings
  * Several fixes for use in change roots
  * Systemd service file changes
  * Fixed translations in firewall-config
  * Command line clients
  * Fixes infinite event handling loop in firewall-{config,applet} (bsc#992082)
- Update to version 0.4.3.2
  * Fix regression with unavailable optional commands
  * All missing backend messages should be warnings
  * Individual calls for missing restore commands
  * Only one authenticate call for add and remove options and also
    sequences
  * New service RH-Satellite-6
- Update to version 0.4.3.1
  * firewall.command: Fix python3 DBusException message not interable error
  * src/Makefile.am: Fix path in firewall-[offline-]cmd_test.sh while installing
  * firewallctl: Do not trace back on list command without further arguments
  * firewallctl (man1): Added remaining sections zone, service, ..
  * firewallctl: Added runtime-to-permanent, interface and source parser, IndividualCalls setting
  * firewall.server.config: Allow to set IndividualCalls property in config interface
  * Fix missing icmp rules for some zones
  * runProg: Fix issue with running programs
  * firewall-offline-cmd: Fix issues with missing system-config-firewall
  * firewall.core.ipXtables: Split up source and dest addresses for transaction
  * firewall.server.config: Log error in case of loading malformed files in watcher
  * Install and package the firewallctl man page
  * Translation updates
- Update to version 0.4.3
  * New firewallctl utility (rh#1147959)
  * doc.xml.seealso: Show firewalld.dbus in See Also sections
  * firewall.core.fw_config: Create backup on zone, service, ipset and icmptype removal (rh#1339251)
  * {zone,service,ipset,icmptype}_writer: Do not fail on failed backup
  * firewall-[offline-]cmd: Fix --new-X-from-file options for files in cwd
  * firewall-cmd: Dropped duplicate setType call in --new-ipset
  * radius service: Support also tcp ports (RBZ#1219717)
  * xmlschemas: Support source-port, protocol, icmp-block-inversion and ipset sources
  * config.xmlschema.service.xsd: Fix service destination conflicts (rh#1296573)
  * firewall-cmd, firewalld man: Information about new NetworkManager and ifcfg
  * firewall.command: Only print summary and description in print_X_info with verbose
  * firewall.command: print_msg should be able to print empty lines
  * firewall-config: No processing of runtime passthroughs signals in permanent
  * Landspace.io fixes and pylint calm downs
  * firewall.core.io.zone: Add zone_reader and zone_writer to all, pylint fixes
  * firewall-config: Fixed titles of command and context dialogs, also entry lenths
  * firewall-config: pylint calm downs
  * firewall.core.fw_zone: Fix use of MAC source in rich rules without ipv limit
  * firewall-config: Use self.active_zoens in conf_zone_added_cb
  * firewall.command: New parse_port, extended parse methods with more checks
  * firewall.command: Fixed parse_port to use the separator in the split call
  * firewall.command: New [de]activate_exception_handler, raise error in parse_X
  * services ha: Allow corosync-qnetd port
  * firewall-applet: Support for kde5-nm-connection-editor
  * tests/firewall-offline-cmd_test.sh: New tests for service and icmptype modifications
  * firewall-offline-cmd: Use FirewallCommand for simplification and sequence options
  * tests/firewall-cmd_test.sh: New tests for service and icmptype modifications
  * firewall-cmd: Fixed set, remove and query destination options for services
  * firewall.core.io.service: Source ports have not been checked in _check_config
  * firewall.core.fw_zone: Method check_source_port is not used, removed
  * firewall.core.base: Added default to ZONE_TARGETS
  * firewall.client: Allow to remove ipv:address pair for service destinations
  * tests/firewall-offline-cmd_test.sh: There is no timeout option in permanent
  * firewall-cmd: Landscape.io fixes, pylint calm downs
  * firewall-cmd: Use FirewallCommand for simplification and sequence options
  * firewall.command: New FirewallCommand for command line client simplification
  * New services: kshell, rsh, ganglia-master, ganglia-client
  * firewalld: Cleanup of unused imports, do not translate some deamon messages
  * firewalld: With fd close interation in runProg, it is not needed here anymore
  * firewall.core.prog: Add fd close iteration to runProg
  * firewall.core.fw_nm: Hide NM typelib import, new nm_get_dbus_interface function
  * firewalld.spec: Require NetworkManager-libnm instead of NetworkManager-glib
  * firewall-config: New add/remove ipset entries from file, remove all entries
  * firewall-applet: Fix tooltip after applet start with connection to firewalld
  * firewall-config: Select new zone, service or icmptype if the view was empty
  * firewalld.spec: Added build requires for iptables, ebtables and ipset
  * Adding nf_conntrack_sip module to the service SIP
  * firewall: core: fw_ifcfg: Quickly return if ifcfg directory does not exist
  * Drop unneeded python shebangs
  * Translation updates
- Remove obsolete patches:
  * 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch
  * 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch
  * 0003-firewall.core.fw_nm-Hide-NM-typelib-import-new-nm_ge.patch
- Add missing %{?_smp_mflags} during install. This will speed up
  the installation phase as well as expose build system's problems
  due to higher level of parallelism.
- Run make during %build to ensure missing documentation is generated.
- spec file cleanups.
- Add upstream patch to prevent unconditional dependencies to the
  NetworkManager typelib (gh#t-woerner/firewalld#119)
  * 0003-firewall.core.fw_nm-Hide-NM-typelib-import-new-nm_ge.patch
- Update to version 0.4.2
  * New module to search for and change ifcfg files for interfaces
    not under control of NM
  * firewall_config: Enhanced messages in status bar
  * firewall-config: New message window as overlay if not connected
  * firewall-config: Fix sentivity of option, view menus and main
    paned if not connected
  * firewall-applet: Quit on SIGINT (Ctrl-C), reduced D-Bus calls,
    some cleanup
  * firewall-[offline]cmd: Show target in zone information
  * D-Bus: Completed masquerade methods in FirewallClientZoneSettings
  * Fixed log-denied rules for icmp-blocks
  * Keep sorting of interfaces, services, icmp-blocks and other
    settings in zones
  * Fixed runtime-to-permanent not to save interfaces under control
    of NM
  * New icmp-block-inversion flag in the zones
  * ICMP type filtering in the zones
  * New services: sip, sips, managesieve
  * rich rules: Allow destination action (rh#1163428)
  * firewall-offline-cmd: New option -q/--quiet
  * firewall-[offline-]cmd: New --add-[zone,service,ipset,icmptype]-from-file
  * firewall-[offline-]cmd: Fix option for setting the destination
    address
  * firewall-config: Fixed resizing behaviour
  * New transaction model for speed ups in start, restart, stop and
    other actions
  * firewall-cmd: New options --load{zone,service,ipset,icmptype}-defaults
  * Fixed memory leak in dbus_introspection_add_properties
  * Landscape.io fixes, pylint calm downs
  * New D-Bus getXnames methods to speed up firewall-config and firewall-cmd
  * ebtables-restore: No support for COMMIT command
  * Source port support in services, zones and rich rules
  * firewall-offline-cmd: Added --{add,remove}-entries-from-file for ipsets
  * firewall-config: New active bindings side bar for simple binding changes
  * Reworked NetworkManager module
  * Proper default zone handling for NM connections
  * Try to set zone binding with NM if interface is under control of NM
  * Code cleanup and bug fixes
  * Include test suite in the release and install in /usr/share/firewalld/tests
  * New Travis-CI configuration file
  * Fixed more broken frensh translations
  * Translation updates
- Add upstream patches
  * 0001-src-firewall-core-Drop-unneeded-python-shebangs.patch: Removes
    unneeded python shebangs
  * 0002-firewall-core-fw_ifcfg-Quickly-return-if-ifcfg-direc.patch: Do
    not try to access the network-scripts ifcfg directory.
- Drop rejected patch
  * drop-standard-output-error-systemd.patch
- Minor spec file clean-up
- Avoid runtime dependency on systemd, the macros can all deal with
  its absence.
- Suggest the susefirewall2-to-firewalld package which could assist
  in migrating the SuSEFirewall2 iptables rules to FirewallD.
- Update to version 0.4.1.2
  * Install fw_nm module
  * firewalld: Do not fail if log file could not be opened
  * Make ipsets visible per default in firewall-config
  * Fixed translations with python3
  [changes in 0.4.1.1]
  * Fix for broken frensh translation
  [changes in 0.4.1]
  * Enhancements of ipset handling
  * No cleanup of ipsets using timeouts while reloading
  * Only destroy conflicting ipsets
  * Only use ipset types supported by the system
  * Add and remove several ipset entries in one call using a file
  * Reduce time frame where builtin chains are on policy DROP while reloading
  * Include descriptions in --info-X calls
  * Command line interface support to get and alter descriptions of zones,
  * services, ipsets and icmptypes with permanent option
  * Properly watch changes in combined zones
  * Fix logging in rich rule forward rules
  * Transformed direct.passthrough errors into warnings
  * Rework of import structures
  * Reduced calls to get ids for port and protocol names (rh#1305434)
  * Build and installation fixes by Markos Chandras
  * Provide D-Bus properties in introspection data
  * Fix for flaws found by landscape.io
  * Fix for repeated SUGHUP
  * New NetworkManager module to get and set zones of connections, used in
    firewall-applet and firewall-config
  * configure: Autodetect backend tools ({ip,ip6,eb}tables{,-restore}, ipset)
  * Code cleanups
  * Bug fixes
- Fix drop-standard-output-error-systemd.patch tagging
- Add libxslt-tools build dependency
- Do not recommend a specific version for the lang subpackage
- Move translations to a new subpackage
- Set DISABLE_RESTART_ON_UPDATE to 'yes' instead of '1'. The macros in
  /etc/rpm/macros.systemd only check for the 'yes' value so fix it to
  properly prevent the firewalld service from being restarted during
  updates.
- Drop typelib(NetworkManager), NetworkManager-glib, gtk3
  and libnotify dependencies (see OBS SR#360792)
- firewall-config needs typelib(NetworkManager) to run
- Initial commit. Version 0.4.0
  * drop-standard-output-error-systemd.patch (gh#t-woerner/firewalld/pull/67)

• Files Changed
• Browse Source

- Restore nftables as default backend (bsc#1102761). nftables and
  iptables can co-exist but the 'nat' table had a bug which was fixed
  in kernel-4.18.

- Update to 0.6.1. Some of the changes are:
  * Correct source/destination in rich rule masquerade
  * Only modify ifcfg files for permanent configuration changes
  * Fix a backtrace when calling common_reverse_rule()
  * man firewalld.conf: Show nftables is the default FirewallBackend
  * firewall-config: fix some untranslated strings that caused a UI
    bug causing rich rules to not be modify-able (bsc#1096542)
  * fw_direct: avoid log for untracked passthrough queries
  * fixed many issues if iptables is actually iptables-nft
  * Use preferred location for AppData files
  * ipXtables: fix ICMP block inversion with set-log-denied
  * fixes ICMP block inversion with set-log-denied with
    IndividualCalls=yes
  * nftables: fix set-log-denied if target is not ACCEPT
  * fw_direct: strip _direct chain suffix if using nftables
  * NetworkManager integration bugfixes.

• Files Changed
• Browse Source

• Files Changed
• Browse Source

Revert to previous version - boo#1102761

• Files Changed
• Browse Source

• Files Changed
• Browse Source

• Files Changed
• Browse Source

- Update to 0.5.3 (bsc#1093120)
  * tests/regression: add test for ipset with timeout
  * ipset: allow adding entries to ipsets with timeout
  * translations: update
  * helpers: load helper module explicitly if no port given
  * helpers: nf_conntrack_proto-* helpers needs name cropped
  * config/Makefile: correct name of proto-gre helper
  * tests/regression: test helper nf_conntrack_proto_gre (#263)
  * functions: get_nf_nat_helpers() should look in other directories too
  * functions: Allow nf_conntrack_proto_* helpers
  * services: Add GRE
  * helpers: Add proto-gre
  * tests/regression: add test to verify ICMP block in forward chain
  * ipXtables: fix ICMP block not being present in FORWARD chain

• Files Changed
• Browse Source