!87 fix broken symbolic link after package remove

From: @sherlock2010 
Reviewed-by: @sunsuwan 
Signed-off-by: @sunsuwan

backport-chore-nftables-add-delete-table-helper.patch

@@ -0,0 +1,44 @@
+From 8be561d26931832f000526cc41293700faa6c877 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Mon, 14 Aug 2023 09:13:29 -0400
+Subject: [PATCH] chore(nftables): add delete table helper
+
+This is to workaround an nftables issue where using the "delete" verb on
+a table that does not exist will throw ENOENT. We can't use the newer
+"destroy" verb because it's too new to rely upon.
+
+A simple hack is to always add the table before deleting it. The "add"
+is ignored if the table already exists.
+
+Conflict: NA
+Reference: https://github.com/firewalld/firewalld/commit/8be561d26931832f000526cc41293700faa6c877
+
+---
+ src/firewall/core/nftables.py | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
+index f269afa9..ce8cb5e7 100644
+--- a/src/firewall/core/nftables.py
++++ b/src/firewall/core/nftables.py
+@@ -383,6 +383,17 @@ class nftables:
+         # Tables always exist in nftables
+         return [table] if table else IPTABLES_TO_NFT_HOOK.keys()
+ 
++    def _build_delete_table_rules(self, table):
++        # To avoid nftables returning ENOENT we always add the table before
++        # deleting to guarantee it will exist.
++        #
++        # In the future, this add+delete should be replaced with "destroy", but
++        # that verb is too new to rely upon.
++        return [{"add": {"table": {"family": "inet",
++                                   "name": table}}},
++                {"delete": {"table": {"family": "inet",
++                                      "name": table}}}]
++
+     def build_flush_rules(self):
+         # Policy is stashed in a separate table that we're _not_ going to
+         # flush. As such, we retain the policy rule handles and ref counts.
+-- 
+2.33.0
+

backport-fix-nftables-always-flush-main-table-on-start.patch

@@ -0,0 +1,39 @@
+From 6a155ea7195f2c720625e2452afa41544b4b4227 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Thu, 10 Aug 2023 08:43:03 -0400
+Subject: [PATCH] fix(nftables): always flush main table on start
+
+On start created_tables will not contain the main "firewalld" table so a
+flush command is not issued. We should always attempt to flush. If
+CleanupOnExit=no, then not flushing causes duplicate rules on restart.
+
+Fixes: rhbz2222044
+
+Conflict: NA
+Reference: https://github.com/firewalld/firewalld/commit/6a155ea7195f2c720625e2452afa41544b4b4227
+
+---
+ src/firewall/core/nftables.py | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
+index 975f1fa..f7f5bb0 100644
+--- a/src/firewall/core/nftables.py
++++ b/src/firewall/core/nftables.py
+@@ -410,12 +410,9 @@ class nftables(object):
+         self.policy_priority_counts = {}
+         self.zone_source_index_cache = {}
+ 
+-        rules = []
+         if TABLE_NAME in self.created_tables["inet"]:
+-            rules.append({"delete": {"table": {"family": "inet",
+-                                               "name": TABLE_NAME}}})
+             self.created_tables["inet"].remove(TABLE_NAME)
+-        return rules
++        return self._build_delete_table_rules(TABLE_NAME)
+ 
+     def _build_set_policy_rules_ct_rules(self, enable):
+         add_del = { True: "add", False: "delete" }[enable]
+-- 
+2.33.0
+

backport-fix-nm-release-NM-client-after-a-timeout.patch

@@ -0,0 +1,61 @@
+From eb76e2a80a43481da7a54ff784edf1c76651db96 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Wed, 22 Nov 2023 12:10:09 -0500
+Subject: [PATCH] fix(nm): release NM client after a timeout
+
+Conflict: NA
+Reference: https://github.com/firewalld/firewalld/commit/eb76e2a80a43481da7a54ff784edf1c76651db96
+
+libnm will accumulate a bunch of data, e.g. routes, that is irrelevant
+to firewalld. To avoid unbound growth in memory we can destroy the
+client and reinitialize it when we query NM.
+
+Fixes: #1232
+---
+ src/firewall/core/fw_nm.py | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/src/firewall/core/fw_nm.py b/src/firewall/core/fw_nm.py
+index 0e38dd4..c1f8e1d 100644
+--- a/src/firewall/core/fw_nm.py
++++ b/src/firewall/core/fw_nm.py
+@@ -39,6 +39,7 @@ else:
+     except (ImportError, ValueError, GLib.Error):
+         _nm_imported = False
+ _nm_client = None
++_nm_client_timeout = None
+ 
+ from firewall import errors
+ from firewall.errors import FirewallError
+@@ -61,9 +62,28 @@ def nm_get_client():
+     """Returns the NM client object or None if the import of NM failed
+     @return NM.Client instance if import was successful, None otherwise
+     """
++
++    def _release():
++        """
++        Release the client to avoid excess memory usage when libnm pushes
++        irrelevant (to firewalld) updates.
++        """
++        global _nm_client
++        global _nm_client_timeout
++        _nm_client = None
++        _nm_client_timeout = None
++
+     global _nm_client
++    global _nm_client_timeout
++
+     if not _nm_client:
+         _nm_client = NM.Client.new(None)
++    else:
++        # refresh timer
++        GLib.source_remove(_nm_client_timeout)
++
++    _nm_client_timeout = GLib.timeout_add_seconds(5, _release)
++
+     return _nm_client
+ 
+ def nm_get_zone_of_connection(connection):
+-- 
+2.33.0
+

backport-fix-service-update-highest-port-number-for-ceph.patch

@@ -0,0 +1,23 @@
+From fea78fc8f4ff373bcc9eb85c7f99d1a9b45f44af Mon Sep 17 00:00:00 2001
+From: Pierre pierre@stackhpc.com
+Date: Mon, 29 Apr 2024 20:11:55 +0800
+Subject: [PATCH] fix(service): update highest port number for ceph
+
+---
+ config/services/ceph.xml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/config/services/ceph.xml b/config/services/ceph.xml
+index efed536..eb6a3f2 100644
+--- a/config/services/ceph.xml
++++ b/config/services/ceph.xml
+@@ -2,5 +2,5 @@
+ <service>
+   <short>ceph</short>
+   <description>Ceph is a distributed object store and file system. Enable this option to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS), or Manager Daemons (MGR).</description>
+-  <port protocol="tcp" port="6800-7300"/>
++  <port protocol="tcp" port="6800-7568"/>
+ </service>
+-- 
+2.27.0
+

firewalld.spec

@@ -1,6 +1,6 @@
 Name:      firewalld
 Version:   1.2.6
-Release:   1
+Release:   6
 Summary:   A firewall daemon with D-Bus interface providing a dynamic firewall
 License:   GPLv2+
 URL:       http://www.firewalld.org
@@ -10,13 +10,17 @@ Patch0:    firewalld-0.2.6-MDNS-default.patch
 Patch1:    repair-test-cases.patch
 Patch2:    add-Restart-on-failure-on-firewalld.service.patch
 Patch3:    0001-fix-config-Specify-the-translation-encoding-format-a.patch
+Patch4:    backport-chore-nftables-add-delete-table-helper.patch
+Patch5:    backport-fix-nftables-always-flush-main-table-on-start.patch
+Patch6:    backport-fix-service-update-highest-port-number-for-ceph.patch
+Patch7:    backport-fix-nm-release-NM-client-after-a-timeout.patch
 
 BuildArch:     noarch
 BuildRequires: autoconf automake desktop-file-utils gettext intltool glib2 glib2-devel systemd-units docbook-style-xsl
 BuildRequires: libxslt iptables ebtables ipset python3-devel
 
 
-Requires:  iptables ebtables ipset systemd
+Requires:  iptables iptables-nft ipset systemd
 %if %{?openEuler:1}0
 Requires:  hicolor-icon-theme python3-gobject NetworkManager-libnm dbus-x11 gtk3
 %endif
@@ -112,6 +116,11 @@ dd if=/dev/zero of=$RPM_BUILD_ROOT/%{_datadir}/firewalld/firewalld-tmp-mmap bs=4
 
 %postun
 %systemd_postun_with_restart firewalld.service
+if [ $1 -eq 0 ]; then
+    if [ -L %{_sysconfdir}/firewalld/firewalld.conf ] && [ ! -e %{_sysconfdir}/firewalld/firewalld.conf ]; then
+        rm -f %{_sysconfdir}/firewalld/firewalld.conf
+    fi
+fi
 
 %posttrans
 # If we don't yet have a symlink or existing file for firewalld.conf,
@@ -146,6 +155,7 @@ if [ ! -e %{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.policy ]; th
     esac
 fi
 
+sed -i "s/CleanupModulesOnExit=no/CleanupModulesOnExit=yes/g" %{_sysconfdir}/firewalld/firewalld.conf
 
 %files -f %{name}.lang
 %doc COPYING README.md
@@ -199,13 +209,6 @@ fi
 %{_datadir}/metainfo/firewall-config.appdata.xml
 %{_datadir}/icons/hicolor/*/apps/firewall-config*.*
 %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
-%else
-%exclude %{_bindir}/firewall-config
-%exclude %{_datadir}/firewalld/*
-%exclude %{_datadir}/applications/firewall-config.desktop
-%exclude %{_datadir}/metainfo/firewall-config.appdata.xml
-%exclude %{_datadir}/icons/hicolor/*/apps/firewall-config*.*
-%exclude %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
 %endif
 %exclude %{_datadir}/firewalld/testsuite/*
 
@@ -218,6 +221,15 @@ fi
 %defattr(-,root,root)
 %{python3_sitelib}/firewall/*
 
+%if %{!?openEuler:1}0
+%exclude %{_bindir}/firewall-config
+%exclude %{_datadir}/firewalld/*
+%exclude %{_datadir}/applications/firewall-config.desktop
+%exclude %{_datadir}/metainfo/firewall-config.appdata.xml
+%exclude %{_datadir}/icons/hicolor/*/apps/firewall-config*.*
+%exclude %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
+%endif
+
 %files -n firewalld-test
 %dir %{_datadir}/firewalld/testsuite
 %{_datadir}/firewalld/testsuite/README.md
@@ -231,6 +243,39 @@ fi
 %{_datadir}/firewalld/testsuite/python/firewalld_test.py
 
 %changelog
+* Tue Aug 27 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-6
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:fix broken symbolic link after package remove
+
+* Fri Jul 05 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-5
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:fix unintentinally exclude file
+
+* Fri Jul 05 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-4
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload related ko when stopping firewalld service
+       To reduce unnecessary loading of ebtables-related kernel modules
+       fix(nm): release NM client after a timeout
+
+* Mon Apr 29 2024 baiguo <baiguo@kylinos.cn> - 1.2.6-3
+- Type:requirement
+- ID:NA
+- SUG:NA
+- DESC:update highest port number for ceph
+
+* Sun Apr 28 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.2.6-2
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:chore nftables add delete table helper
+       fix nftables always flush main table on start
+
 * Sat Jan 06 2024 zhanghao <zhanghao383@huawei.com> - 1.2.6-1
 - Type:requirement
 - ID:NA