%if (0%{?fedora} >= 13 || 0%{?rhel} > 7)

%global with_python3 1

%if (0%{?fedora} >= 23 || 0%{?rhel} >= 8)

%global use_python3 1

%endif

%endif

Summary: A firewall daemon with D-Bus interface providing a dynamic firewall

Name: firewalld

Version: 0.8.2

Release: 1%{?dist}

URL:     http://firewalld.org

License: GPLv2+

Source0: https://github.com/firewalld/firewalld/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz

BuildArch: noarch

BuildRequires: autoconf

BuildRequires: automake

BuildRequires: desktop-file-utils

BuildRequires: gettext

BuildRequires: intltool

# glib2-devel is needed for gsettings.m4

BuildRequires: glib2, glib2-devel

BuildRequires: systemd-units

BuildRequires: docbook-style-xsl

BuildRequires: libxslt

BuildRequires: python2-devel

BuildRequires: iptables, ebtables, ipset

%if 0%{?with_python3}

BuildRequires:  python3-devel

%endif #0%{?with_python3}

Requires: iptables, ebtables, ipset

Requires(post): systemd

Requires(preun): systemd

Requires(postun): systemd

Requires: firewalld-filesystem = %{version}-%{release}

%if 0%{?use_python3}

Requires: python3-firewall  = %{version}-%{release}

%else #0%{?use_python3}

Requires: python-firewall  = %{version}-%{release}

%endif #0%{?use_python3}

%description

firewalld is a firewall service daemon that provides a dynamic customizable 

firewall with a D-Bus interface.

%package -n python-firewall

Summary: Python2 bindings for firewalld

Provides: python2-firewall

Obsoletes: python2-firewall

Requires: dbus-python

Requires: python-slip-dbus

Requires: python-decorator

Requires: pygobject3-base

Requires: python-nftables

%description -n python-firewall

Python2 bindings for firewalld.

%if 0%{?with_python3}

%package -n python3-firewall

Summary: Python3 bindings for firewalld

Requires: python3-dbus

Requires: python3-slip-dbus

Requires: python3-decorator

Requires: python3-nftables

%if (0%{?fedora} >= 23 || 0%{?rhel} >= 8)

Requires: python3-gobject-base

%else

Requires: python3-gobject

%endif

%description -n python3-firewall

Python3 bindings for firewalld.

%endif #0%{?with_python3}

%package -n firewalld-filesystem

Summary: Firewalld directory layout and rpm macros

%description -n firewalld-filesystem

This package provides directories and rpm macros which

are required by other packages that add firewalld configuration files.

%package -n firewall-applet

Summary: Firewall panel applet

Requires: %{name} = %{version}-%{release}

Requires: firewall-config = %{version}-%{release}

Requires: hicolor-icon-theme

%if 0%{?use_python3}

Requires: python3-qt5

Requires: python3-gobject

%else

Requires: python-qt5

Requires: pygobject3-base

%endif

Requires: libnotify

Requires: NetworkManager-libnm

Requires: dbus-x11

%description -n firewall-applet

The firewall panel applet provides a status information of firewalld and also 

the firewall settings.

%package -n firewall-config

Summary: Firewall configuration application

Requires: %{name} = %{version}-%{release}

Requires: hicolor-icon-theme

Requires: gtk3

%if 0%{?use_python3}

Requires: python3-gobject

%else

Requires: pygobject3-base

%endif

Requires: NetworkManager-libnm

Requires: dbus-x11

%description -n firewall-config

The firewall configuration application provides an configuration interface for 

firewalld.

%prep

%autosetup

./autogen.sh

%if 0%{?with_python3}

rm -rf %{py3dir}

cp -a . %{py3dir}

%endif #0%{?with_python3}

%build

%configure --enable-sysconfig --enable-rpmmacros

%if 0%{?use_python3}

make -C src %{?_smp_mflags}

%else

make %{?_smp_mflags}

%endif

%if 0%{?with_python3}

pushd %{py3dir}

%configure --enable-sysconfig --enable-rpmmacros PYTHON=%{__python3}

%if 0%{?use_python3}

make %{?_smp_mflags}

%else

make -C src %{?_smp_mflags}

%endif

popd

%endif #0%{?with_python3}

%install

%if 0%{?use_python3}

make -C src install-nobase_dist_pythonDATA PYTHON=%{__python2} DESTDIR=%{buildroot}

%else

make install PYTHON=%{__python2} DESTDIR=%{buildroot}

%endif #0%{?use_python3}

%if 0%{?with_python3}

pushd %{py3dir}

%if 0%{?use_python3}

make install PYTHON=%{__python3} DESTDIR=%{buildroot}

%else

make -C src install-nobase_dist_pythonDATA PYTHON=%{__python3} DESTDIR=%{buildroot}

%endif #0%{?use_python3}

popd

%endif #0%{?with_python3}

desktop-file-install --delete-original \

  --dir %{buildroot}%{_sysconfdir}/xdg/autostart \

  %{buildroot}%{_sysconfdir}/xdg/autostart/firewall-applet.desktop

desktop-file-install --delete-original \

  --dir %{buildroot}%{_datadir}/applications \

  %{buildroot}%{_datadir}/applications/firewall-config.desktop

%find_lang %{name} --all-name

%post

%systemd_post firewalld.service

%preun

%systemd_preun firewalld.service

%postun

%systemd_postun_with_restart firewalld.service 

%post -n firewall-applet

/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :

%postun -n firewall-applet

if [ $1 -eq 0 ] ; then

    /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null

    /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :

    /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :

fi

%posttrans -n firewall-applet

/usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :

/usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :

%post -n firewall-config

/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :

%postun -n firewall-config

if [ $1 -eq 0 ] ; then

    /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null

    /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :

    /usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :

fi

%posttrans -n firewall-config

/usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :

/usr/bin/glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :

%files -f %{name}.lang

%doc COPYING README

%{_sbindir}/firewalld

%{_bindir}/firewall-cmd

%{_bindir}/firewall-offline-cmd

%dir %{_datadir}/bash-completion/completions

%{_datadir}/bash-completion/completions/firewall-cmd

%dir %{_datadir}/zsh/site-functions

%{_datadir}/zsh/site-functions/_firewalld

%{_prefix}/lib/firewalld/icmptypes/*.xml

%{_prefix}/lib/firewalld/ipsets/README

%{_prefix}/lib/firewalld/services/*.xml

%{_prefix}/lib/firewalld/zones/*.xml

%{_prefix}/lib/firewalld/helpers/*.xml

%attr(0750,root,root) %dir %{_sysconfdir}/firewalld

%config(noreplace) %{_sysconfdir}/firewalld/firewalld.conf

%config(noreplace) %{_sysconfdir}/firewalld/lockdown-whitelist.xml

%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/helpers

%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/icmptypes

%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/ipsets

%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/services

%attr(0750,root,root) %dir %{_sysconfdir}/firewalld/zones

%defattr(0644,root,root)

%config(noreplace) %{_sysconfdir}/sysconfig/firewalld

#%attr(0755,root,root) %{_initrddir}/firewalld

%{_unitdir}/firewalld.service

%config(noreplace) %{_datadir}/dbus-1/system.d/FirewallD.conf

%{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.desktop.policy.choice

%{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.server.policy.choice

%{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.policy

%{_mandir}/man1/firewall*cmd*.1*

%{_mandir}/man1/firewalld*.1*

%{_mandir}/man5/firewall*.5*

%{_sysconfdir}/modprobe.d/firewalld-sysctls.conf

%{_sysconfdir}/logrotate.d/firewalld

%files -n python-firewall

%attr(0755,root,root) %dir %{python2_sitelib}/firewall

%attr(0755,root,root) %dir %{python2_sitelib}/firewall/config

%attr(0755,root,root) %dir %{python2_sitelib}/firewall/core

%attr(0755,root,root) %dir %{python2_sitelib}/firewall/core/io

%attr(0755,root,root) %dir %{python2_sitelib}/firewall/server

%{python2_sitelib}/firewall/*.py*

%{python2_sitelib}/firewall/config/*.py*

%{python2_sitelib}/firewall/core/*.py*

%{python2_sitelib}/firewall/core/io/*.py*

%{python2_sitelib}/firewall/server/*.py*

%if 0%{?with_python3}

%files -n python3-firewall

%attr(0755,root,root) %dir %{python3_sitelib}/firewall

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/__pycache__

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/config

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/config/__pycache__

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/__pycache__

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/io

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/core/io/__pycache__

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/server

%attr(0755,root,root) %dir %{python3_sitelib}/firewall/server/__pycache__

%{python3_sitelib}/firewall/__pycache__/*.py*

%{python3_sitelib}/firewall/*.py*

%{python3_sitelib}/firewall/config/*.py*

%{python3_sitelib}/firewall/config/__pycache__/*.py*

%{python3_sitelib}/firewall/core/*.py*

%{python3_sitelib}/firewall/core/__pycache__/*.py*

%{python3_sitelib}/firewall/core/io/*.py*

%{python3_sitelib}/firewall/core/io/__pycache__/*.py*

%{python3_sitelib}/firewall/server/*.py*

%{python3_sitelib}/firewall/server/__pycache__/*.py*

%endif #0%{?with_python3}

%files -n firewalld-filesystem

%dir %{_prefix}/lib/firewalld

%dir %{_prefix}/lib/firewalld/helpers

%dir %{_prefix}/lib/firewalld/icmptypes

%dir %{_prefix}/lib/firewalld/ipsets

%dir %{_prefix}/lib/firewalld/services

%dir %{_prefix}/lib/firewalld/zones

%{_rpmconfigdir}/macros.d/macros.firewalld

%files -n firewall-applet

%attr(0755,root,root) %dir %{_sysconfdir}/firewall

%{_bindir}/firewall-applet

%defattr(0644,root,root)

%{_sysconfdir}/xdg/autostart/firewall-applet.desktop

%{_sysconfdir}/firewall/applet.conf

%{_datadir}/icons/hicolor/*/apps/firewall-applet*.*

%{_mandir}/man1/firewall-applet*.1*

%files -n firewall-config

%{_bindir}/firewall-config

%defattr(0644,root,root)

%{_datadir}/firewalld/firewall-config.glade

%{_datadir}/firewalld/gtk3_chooserbutton.py*

%{_datadir}/firewalld/gtk3_niceexpander.py*

%{_datadir}/applications/firewall-config.desktop

%{_datadir}/metainfo/firewall-config.appdata.xml

%{_datadir}/icons/hicolor/*/apps/firewall-config*.*

%{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml

%{_mandir}/man1/firewall-config*.1*

%changelog

* Wed Apr 01 2020 Eric Garver <eric@garver.life> - 0.8.2-1

- bump package to v0.8.2

* Tue Jan 07 2020 Eric Garver <eric@garver.life> - 0.8.1-1

- bump package to v0.8.1

* Tue Nov 05 2019 Eric Garver <eric@garver.life> - 0.8.0-1

- bump package to v0.8.0

* Fri Apr 20 2018 Eric Garver <e@erig.me> - 0.6.0-1

- bump package to v0.6.0

* Thu Jan 25 2018 Eric Garver <e@erig.me> - 0.5.0-1

- rebase package to v0.5.0

* Tue Jun  6 2017 Thomas Woerner <twoerner@redhat.com> - 0.4.4.5-1

- Fix build from spec without fedorahosted.org archives

- firewalld.spec: Add missing autotools dependencies

- firewall-offline-cmd: Fix --remove-service-from-zone option RHBZ#1438127

- Merge pull request 213 from hwoarang/add-missing-autotools

- Support sctp and dccp in ports, source-ports, forward-ports, helpers and

  rich rules

- firewall-cmd: Fix --{set,get}-{short,description} for zone

- firewall.core.ipXtables: Use new wait option for restore commands if

  available

- Merge pull request 212 from leongold/ovirt-imageio-service

- config/Makefile.am: Install new ovirt-imageio service

- README: Use firewalld.org/documentation as documentation link

- Fix misspelled word in documentation

- Merge pull request 216 from tobiasvl/fix-protocol-spelling

- Man pages: Mention sctp and dccp protocols for remaining ports, ..

- Adding ovirt-vmconsole service file

- Adding oVirt storage-console service.

- Adding ctdb service file.

- Merge pull request 219 from leongold/ctdb-service

- Fixing incorrect port number

- Merge pull request 217 from leongold/ovirt-vmconsole

- Merge pull request 218 from leongold/ovirt-storageconsole

- config/Makefile.am: New services ctdb, ovirt-storageconsole and

  ovirt-vmconsole

- Adding service file for nrpe.

- Merge pull request 220 from leongold/nrpe-service

- config/Makefile.am: New services nrpe

- Rename extension for policy choices (server and desktop) to .policy.choice

  (RHBZ#1449754)

- D-Bus interfaces: Fix GetAll for interfaces without properties

  (RHBZ#1452017)

- firewall.core.fw_config: Fix wrong variable use in repr output

- firewall.core.fw_icmptype: Add missing import for copy

- firewall.core.fw_test: Fix wrong format string in repr

- firewall.core.io.zone: Fix __getattr__ use on super(Zone)

- firewall.functions: New function get_nf_nat_helpers

- firewall.core.fw: Get NAT helpers and store them internally.

- firewall.core.fw_zone: Load NAT helpers with conntrack helpers

- firewalld.dbus: Add missing properties nf_conntrach_helper_setting and

  nf_conntrack_helpers

- firewall.server.firewalld: New property for NAT helpers supported by the

  kernel

- Translation updates

* Mon Mar 27 2017 Thomas Woerner <twoerner@redhat.com> - 0.4.4.4-1

- Drop references to fedorahosted.org from spec file and Makefile.am

- Fix inconsistent ordering of rules in INPUT_ZONE_SOURCE (issue#166)

- Fix ipset overloading from /etc/firewalld/ipsets

- Fix permanent rich rules using icmp-type elements (RHBZ#1434594)

- firewall-config: Deactivate edit, remove, .. buttons if there are no items

- Check if ICMP types are supported by kernel before trying to use them

- firewall-config: Show invalid ipset type in the ipset configuration dialog

  in a special label

* Thu Feb  9 2017 Thomas Woerner <twoerner@redhat.com> - 0.4.4.3-1

- New service freeipa-trust (RHBZ#1411650)

- Complete icmp types for IPv4 and IPv6

- New h323 helper container

- Support helper container: h323

- firewall.server.decorators: ALREADY_ errors should be logged as warnings

- firewall.command: ALREADY_SET should also result in zero exit code

- tests/firewall-offline-cmd_test.sh: Only use firewall-offline-cmd

- Support more ipset types: hash:ip,port, hash:ip,port,ip, hash:ip,port,net,

  hash:ip,mark, hash:net,net, hash:net,port, hash:net,port,net, hash:net,iface

- New checks for ipset entry validation

- Use ipset dimension for match

- firewall.core.base: New ZONE_SOURCE_IPSET_TYPES list

- New firewall.core.icmp providing names and types for icmp and icmpv6 values

- firewall.core.fw_ipset: New methods to get ipset dimension and applied state

- firewall.errors: New error NOT_APPLIED

- firewall-cmd man page: Add missing --get-ipset-types

- firewall.core.fw_nm: No trace back on failed get_connection call

  (RHBZ#1413345)

- firewall.core.prog: Fix addition of the error output in runProg

- Speed up ipset handling, (re)loading and import from file

- Support --family option for --new-ipset

- Handle FirewallError for query sequences in command line tools

- Fail to alter entries of ipsets with timeout

- Extended tests for ipset options

- Return empty list for ipsets using timeouts

- firewall.functions: Fix checks in checkIPnMask and checkIP6nMask (issue#186)

- firewalld.conf man page: New section about AutomaticHelpers

- firewall-offline-cmd man page: Added -v and -q options, fixed section ids

- firewall{-cmd, ctl}: Fix scope of final return in try_set_zone_of_interface

- firewall.core.fw_zone: Limit masquerading forward rule to new connections

- firewall-config: Update active zones on reloaded signal

- firewall-applet: Update active zones and tooltip on reloaded signal

- firewall.core.fw_zone: Fix missing chain for helper in rich rules using

  service (RHBZ#1416578)

- Support icmp-type usage in rich rules (RHBZ#1409544)

- firewall[-offline]-cmd: Fix --{set,get}-{short,description} for ipset and

  helper (RHBZ#1416325)

- firewall.core.ipset: Solve ipset creation issues with -exist and more flag

  tests

- Speed up start and restart for ipsets with lots of entries (RHBZ#1416817)

- Speed up of ipset alteration by adding and removing entries using a file

  (RHBZ#1416817)

- Code cleanup and minor bug fixes

- firewall.core.prog: Fix addition of the error output in runProg

- New services mssql, kibana, elasticsearch, quassel, bitcoin-rpc,

  bitcoin-testnet-rpc, bitcoin-testnet, bitcoin and spideroak-lansync

- Translation updates

* Thu Dec  1 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.4.2-1

- firewalld.spec: Added helpers and ipsets paths to firewalld-filesystem

- firewall.core.fw_nm: create NMClient lazily

- Do not use hard-coded path for modinfo, use autofoo to detect it

- firewall.core.io.ifcfg: Dropped invalid option warning with bad format

  string

- firewall.core.io.ifcfg: Properly handle quoted ifcfg values

- firewall.core.fw_zone: Do not reset ZONE with ifdown

- Updated translations from zanata

- firewall-config: Extra grid at bottom to visualize firewalld settings

* Wed Nov  9 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.4.1-1

- firewall-config: Use proper source check in sourceDialog (fixes issue#162)

- firewallctl: New support for helpers

- Translation updates

* Fri Oct 28 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.4-1

- Fix dist-check

- src/Makefile.am: Install new helper files

- config/Makefile.am: Install helpers

- Merged translations

- Updated translations from zanata

- firewalld.spec: Adapt requires for PyQt5

- firewall-applet: Fix fromUTF8 for python2 PyQt5 usage

- firewall-applet: Use PyQt5

- firewall-config: New nf_conntrack_select dialog, use nf_conntrack_helpers D-Bus property

- shell-completion/bash/firewall-cmd: Updates for helpers and also some fixes

- src/tests/firewall-[offline-]cmd_test.sh: New helper tests, adapted module tests for services

- doc/xml/seealso.xml: Add firewalld.helper(5) man page

- doc/xml/seealso.xml: Add firewalld.ipset(5) man page

- Fixed typo in firewalld.ipset(5) man page

- Updated firewalld.dbus(5) man page

- New firewalld.helper(5) man page

- doc/xml/firewall-offline-cmd.xml: Updated firewall-offline-cmd man page

- doc/xml/firewall-cmd.xml: Updated firewall-cmd man page

- firewall-offline-cmd: New support for helpers

- firewall-cmd: New support for helpers

- firewall.command: New check_helper_family, check_module and print_helper_info methods

- firewall.core.fw_test: Add helpers also to offline backend

- firewall.server.config: New AutomaticHelpers property (rw)

- firewall.server.config: Fix an dict size changed error for firewall.conf file changes

- firewall.server.config: Make LogDenied property readwrite to be consistent

- Some renames of nf_conntrack_helper* functions and structures, helpers is a dict

- firewall.core.fw: Properly check helper setting in set_automatic_helpers

- firewall.errors: Add missing BUILTIN_HELPER error code

- No extra interface for helpers needed in runtime, dropped DBUS_INTERFACE_HELPER

- firewall.server.firewalld: Drop unused queryHelper D-Bus method

- New helpers Q.931 and RAS from nf_conntrack_h323

- firewall.core.io.helper: Allow dots in helper names, remove underscore

- firewall.core.io.firewalld_conf: Fixed typo in FALLBACK_AUTOMATIC_HELPERS

- firewall-[offline-]cmd: Use sys.excepthook to force exception_handler usage always

- firewall.core.fw_config: new_X methods should also check builtins

- firewall.client: Set helper family to "" if None

- firewall.client: Add missing module string to FirewallClientHelperSettings.settings

- config/firewalld.conf: Add possible values description for AutomaticHelpers

- helpers/amanda.xml: Fix typo in helper module

- firewall-config: Added support for helper module setting

- firewall.client: Added support for helper module setting

- firewall.server.config_helper: Added support for helper module setting

- firewall.core.io.service, firewall.server.config_service: Only replace underscore by dash if module start with nf_conntrack_

- firewall.core.fw_zone: Use helper module instead of a generated name from helper name

- helpers: Added kernel module

- firewall.core.io.helper: Add module to helper

- firewall-cmd: Removed duplicate --get-ipset-types from help output

- firewall.core.fw_zone: Add zone bingings for PREROUTING in the raw table

- firewall.core.ipXtables: Add PREROUTING default rules for zones in raw table

- firewall-config: New support to handle helpers, new dialogs, new helper tab, ..

- config/org.fedoraproject.FirewallConfig.gschema.xml.in: New show-helpers setting

- firewall.client: New helper management for runtime and permanent configuration

- firewall.server.firewalld: New runtime helper management, new nf_conntrack_helper property

- firewall.server.config_service: Fix module name handling (no nf_conntrack_ prefix needed)

- firewall.server.config: New permanent D-Bus helper management

- New firewall.server.config_helper to provide the permanent D-Bus interface for helpers

- firewall.core.fw_zone: Use helpers fw.nf_conntrack_helper for services using helpers

- firewall.core.fw: New helper management, new _automatic_helpers and nf_conntrack_helper settings

- firewall.core.fw_config: Add support for permanent helper handling

- firewall.core.io.service: The module does not need to start with nf_conntrack_ anymore

- firewall.functions: New functions to get and set nf_conntrack_helper kernel setting

- firewall.core.io.firewalld_conf: New support for AutomaticHelpers setting

- firewall.config.dbus: New D-Bus definitions for helpers, new DBUS_INTERFACE_REVISION 12

- New firewall.core.fw_helper providing FirewallHelper backend

- New firewall.core.helper with HELPER_MAXNAMELEN definition

- config/firewalld.conf: New AutomaticHelpers setting with description

- firewall.config.__init__.py.in: New helpers variables

- firewalld.spec: Add new helpers directory

- config/Makefile.am: Install new helpers

- New helper configuration files for amanda, ftp, irc, netbios-ns, pptp, sane, sip, snmp and tftp

- firewall.core.io.helper: New IO handler for netfilter helpers

- firewall.errors: New INVALID_HELPER error code

- firewall.core.io.ifcfg: Use .bak for save files

- firewall-config: Set internal log_denied setting after changing

- firewall.server.config: Copy props before removing items

- doc/xml/firewalld.ipset: Replaced icmptype name remains with ipset

- firewall.core.fw_zone: Fix LOG rule placement for LogDenied

- firewall.command: Use "source-ports" in print_zone_info

- firewall.core.logger: Use syslog.openlog() and syslog.closelog()

- firewall-[offline-]cmd man pages: Document --path-{zone,icmptype,ipset,service}

- firewall-cmd: Enable --path-{zone,icmptype,service} options again

- firewall.core.{ipXtables,ebtables}: Copy rule before extracting items in set_rules

- firewall.core.fw: Do not abort transaction on failed ipv6_rpfilter rules

- config/Makefile.am: Added cfengine, condor-collector and smtp-submission services

- Makefile.am: New dist-check used in the archive target

- src/Makefile.am: Reordered nobase_dist_python_DATA to be sorted

- config/Makefile.am: New CONFIG_FILES variable to contain the config files

- Merge pull request #150 from hspaans/master

- Merge pull request #146 from canvon/bugfix/spelling

- Merge pull request #145 from jcpunk/condor

- Command line tools man pages: New section about sequence options and exit codes

- Creating service file for SMTP-Submission.

- Creating service file for CFEngine.

- Fix typo in documentation: iptables mangle table

- Only use sort on lists of main items, but not for item properties

- firewall.core.io.io_object: import_config should not change ordering of lists

- firewall.core.fw_transaction: Load helper modules in FirewallZoneTransaction

- firewall.command: Fail with NOT_AUTHORIZED if authorization fails (RHBZ#1368549)

- firewall.command: Fix sequence exit code with at least one succeeded item

- Add condor collector service

- firewall-cmd: Fixed --{get,set}-{description,short} for permanent zones

- firewall.command: Do not use error code 254 for {ALREADY,NOT}_ENABLED sequences

* Tue Aug 16 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.3.3-1

- Fix CVE-2016-5410: Firewall configuration can be modified by any logged in

  user

- firewall/server/firewalld: Make getXSettings and getLogDenied CONFIG_INFO

- Update AppData configuration file.

- tests/firewalld_rich.py: Use new import structure and FirewallClient classes

- tests/firewalld_direct.py: Use new import structure

- tests: firewalld_direct: Fix assert to check for True instead of False

- tests: firewalld_config: Fix expected value when querying the zone target

- tests: firewalld_config: Use real nf_conntrack modules

- firewalld.spec: Added comment about make call for %build

- firewall-config: Use also width_request and height_request with default size

- Updated firewall-config screenshot

- firewall-cmd: Fixed typo in help output (RHBZ#1367171)

- test-suite: Ignore stderr to get default zone also for missing firewalld.conf

- firewall.core.logger: Warnings should be printed to stderr per default

- firewall.core.fw_nm: Ignore NetworkManager if NM.Client connect fails

- firewall-cmd, firewallctl: Gracefully fail if SystemBus can not be aquired

- firewall.client: Generate new DBUS_ERROR if SystemBus can not be aquired

- test-suite: Do not fail on ALREADY_ENABLED --add-destination tests

- firewall.command: ALREADY_ENABLED, NOT_ENABLED, ZONE_ALREADY_SET are warnings

- doc/xml/firewalld.dbus.xml: Removed undefined reference

- doc/xml/transform-html.xsl.in: Fixed references in the document

- doc/xml/firewalld.{dbus,zone}.xml: Embed programlisting in para

- doc/xml/transform-html.xsl.in: Enhanced html formatting closer to the man page

- firewall: core: fw_nm: Instantiate the NM client only once

- firewall/core/io/*.py: Do not traceback on a general sax parsing issue

- firewall-offline-cmd: Fix --{add,remove}-entries-from-file

- firewall-cmd: Add missing action to fix --{add,remove}-entries-from-file

- firewall.core.prog: Do not output stderr, but return it in the error case

- firewall.core.io.ifcfg.py: Fix ifcfg file reader and writer (RHBZ#1362171)

- config/firewall.service.in: use KillMode=mixed

- config/firewalld.service.in: use network-pre.target

- firewall-config: Add missing gettext.textdomain call to fix translations

- Add UDP to transmission-client.xml service

- tests/firewall-[offline-]cmd_test.sh: Hide errors and warnings

- firewall.client: Fix ALREADY_ENABLED errors in icmptype destination calls

- firewall.client: Fix NOT_ENABLED errors in icmptype destination calls

- firewall.client: Use {ALREADY,NOT}_ENABLED errors in icmptype destination

  calls

- firewall.command: Add the removed FirewallError handling to the action

  (a17ce50)

- firewall.command: Do not use query methods for sequences and also single

  options

- Add missing information about MAC and ipset sources to man pages and help

  output

- firewalld.spec: Add BuildRequires for libxslt to enable rebuild of man pages

- firewall[-offline]-cmd, firewallctl, firewall.command: Use sys.{stdout,stderr}

- firewallctl: Fix traceback if not connected to firewalld

- firewall-config: Initialize value in on_richRuleDialogElementChooser_clicked

- firewall.command: Convert errors to string for Python3

- firewall.command: Get proper firewall error code from D-BusExceptions

- firewall-cmd: Fixed traceback without args

- Add missing service files to Makefile.am

- shell-completion: Add shell completion support for

  --{get,set}--{description,short}

* Mon Jul  4 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.3.2-1

- Fix regression with unavailable optional commands

- All missing backend messages should be warnings

- Individual calls for missing restore commands

- Only one authenticate call for add and remove options and also sequences

- New service RH-Satellite-6

* Tue Jun 28 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.3.1-1

- firewall.command: Fix python3 DBusException message not interable error

- src/Makefile.am: Fix path in firewall-[offline-]cmd_test.sh while installing

- firewallctl: Do not trace back on list command without further arguments

- firewallctl (man1): Added remaining sections zone, service, ..

- firewallctl: Added runtime-to-permanent, interface and source parser,

  IndividualCalls setting

- firewall.server.config: Allow to set IndividualCalls property in config

  interface

- Fix missing icmp rules for some zones

- runProg: Fix issue with running programs

- firewall-offline-cmd: Fix issues with missing system-config-firewall

- firewall.core.ipXtables: Split up source and dest addresses for transaction

- firewall.server.config: Log error in case of loading malformed files in

  watcher

- Install and package the firewallctl man page

* Wed Jun 22 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.3-1

- New firewallctl utility (RHBZ#1147959)

- doc.xml.seealso: Show firewalld.dbus in See Also sections

- firewall.core.fw_config: Create backup on zone, service, ipset and icmptype

  removal (RHBZ#1339251)

- {zone,service,ipset,icmptype}_writer: Do not fail on failed backup

- firewall-[offline-]cmd: Fix --new-X-from-file options for files in cwd

- firewall-cmd: Dropped duplicate setType call in --new-ipset

- radius service: Support also tcp ports (RBZ#1219717)

- xmlschemas: Support source-port, protocol, icmp-block-inversion and ipset

  sources

- config.xmlschema.service.xsd: Fix service destination conflicts

  (RHBZ#1296573)

- firewall-cmd, firewalld man: Information about new NetworkManager and ifcfg

- firewall.command: Only print summary and description in print_X_info with

  verbose

- firewall.command: print_msg should be able to print empty lines

- firewall-config: No processing of runtime passthroughs signals in permanent

- Landspace.io fixes and pylint calm downs

- firewall.core.io.zone: Add zone_reader and zone_writer to __all__, pylint

  fixes

- firewall-config: Fixed titles of command and context dialogs, also entry

  lenths

- firewall-config: pylint calm downs

- firewall.core.fw_zone: Fix use of MAC source in rich rules without ipv limit

- firewall-config: Use self.active_zoens in conf_zone_added_cb

- firewall.command: New parse_port, extended parse methods with more checks

- firewall.command: Fixed parse_port to use the separator in the split call

- firewall.command: New [de]activate_exception_handler, raise error in parse_X

- services ha: Allow corosync-qnetd port

- firewall-applet: Support for kde5-nm-connection-editor

- tests/firewall-offline-cmd_test.sh: New tests for service and icmptype

  modifications

- firewall-offline-cmd: Use FirewallCommand for simplification and sequence

  options

- tests/firewall-cmd_test.sh: New tests for service and icmptype modifications

- firewall-cmd: Fixed set, remove and query destination options for services

- firewall.core.io.service: Source ports have not been checked in _check_config

- firewall.core.fw_zone: Method check_source_port is not used, removed

- firewall.core.base: Added default to ZONE_TARGETS

- firewall.client: Allow to remove ipv:address pair for service destinations

- tests/firewall-offline-cmd_test.sh: There is no timeout option in permanent

- firewall-cmd: Landscape.io fixes, pylint calm downs

- firewall-cmd: Use FirewallCommand for simplification and sequence options

- firewall.command: New FirewallCommand for command line client simplification

- New services: kshell, rsh, ganglia-master, ganglia-client

- firewalld: Cleanup of unused imports, do not translate some deamon messages

- firewalld: With fd close interation in runProg, it is not needed here anymore

- firewall.core.prog: Add fd close iteration to runProg

- firewall.core.fw_nm: Hide NM typelib import, new nm_get_dbus_interface

  function

- firewalld.spec: Require NetworkManager-libnm instead of NetworkManager-glib

- firewall-config: New add/remove ipset entries from file, remove all entries

- firewall-applet: Fix tooltip after applet start with connection to firewalld

- firewall-config: Select new zone, service or icmptype if the view was empty

- firewalld.spec: Added build requires for iptables, ebtables and ipset

- Adding nf_conntrack_sip module to the service SIP

- firewall: core: fw_ifcfg: Quickly return if ifcfg directory does not exist

- Drop unneeded python shebangs

- Translation updates

* Mon May 30 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.2-1

- New module to search for and change ifcfg files for interfaces not under

  control of NM

- firewall_config: Enhanced messages in status bar

- firewall-config: New message window as overlay if not connected

- firewall-config: Fix sentivity of option, view menus and main paned if not

  connected

- firewall-applet: Quit on SIGINT (Ctrl-C), reduced D-Bus calls, some cleanup

- firewall-[offline]cmd: Show target in zone information

- D-Bus: Completed masquerade methods in FirewallClientZoneSettings

- Fixed log-denied rules for icmp-blocks

- Keep sorting of interfaces, services, icmp-blocks and other settings in zones

- Fixed runtime-to-permanent not to save interfaces under control of NM

- New icmp-block-inversion flag in the zones

- ICMP type filtering in the zones

- New services: sip, sips, managesieve

- rich rules: Allow destination action (RHBZ#1163428)

- firewall-offline-cmd: New option -q/--quiet

- firewall-[offline-]cmd: New --add-[zone,service,ipset,icmptype]-from-file

- firewall-[offline-]cmd: Fix option for setting the destination address

- firewall-config: Fixed resizing behaviour

- New transaction model for speed ups in start, restart, stop and other actions

- firewall-cmd: New options --load{zone,service,ipset,icmptype}-defaults

- Fixed memory leak in dbus_introspection_add_properties

- Landscape.io fixes, pylint calm downs

- New D-Bus getXnames methods to speed up firewall-config and firewall-cmd

- ebtables-restore: No support for COMMIT command

- Source port support in services, zones and rich rules

- firewall-offline-cmd: Added --{add,remove}-entries-from-file for ipsets

- firewall-config: New active bindings side bar for simple binding changes

- Reworked NetworkManager module

- Proper default zone handling for NM connections

- Try to set zone binding with NM if interface is under control of NM

- Code cleanup and bug fixes

- Include test suite in the release and install in /usr/share/firewalld/tests

- New Travis-CI configuration file

- Fixed more broken frensh translations

- Translation updates

* Wed Apr 20 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.1.2-1

- Install fw_nm module

- firewalld: Do not fail if log file could not be opened

- Make ipsets visible per default in firewall-config

- Fixed translations with python3

* Tue Apr 19 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.1.1-1

- Fixed broken frensh translation

* Tue Apr 19 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.1-1

- Enhancements of ipset handling

  - No cleanup of ipsets using timeouts while reloading

  - Only destroy conflicting ipsets

  - Only use ipset types supported by the system

  - Add and remove several ipset entries in one call using a file

- Reduce time frame where builtin chains are on policy DROP while reloading

- Include descriptions in --info-X calls

- Command line interface support to get and alter descriptions of zones,

  services, ipsets and icmptypes with permanent option

- Properly watch changes in combined zones

- Fix logging in rich rule forward rules

- Transformed direct.passthrough errors into warnings

- Rework of import structures

- Reduced calls to get ids for port and protocol names (RHBZ#1305434)

- Build and installation fixes by Markos Chandras

- Provide D-Bus properties in introspection data

- Fix for flaws found by landscape.io

- Fix for repeated SUGHUP

- New NetworkManager module to get and set zones of connections, used in

  firewall-applet and firewall-config

- configure: Autodetect backend tools ({ip,ip6,eb}tables{,-restore}, ipset)

- Code cleanups

- Bug fixes

* Fri Jan 29 2016 Thomas Woerner <twoerner@redhat.com> - 0.4.0-1

- Several new services

- Lots of bug fixes

- Speed up: Using -restore commands

- Optimizations

- ipset support

- MAC address support

- Enhancements

  - Rich language

  - documentation

  - firewall-config

  - firewall-applet

  - Command line tools

- Log of denied packets

* Tue Jun 16 2015 Thomas Woerner <twoerner@redhat.com> - 0.3.14.2-0

- fixed requirements for -applet and -config

- adapted firewall-applet man page to new version

- firewall-applet, firewall-config: Only honour active connections

- firewall-applet: Change QSettings path and file names

- Updated translations, marked translations for "Connections" as fuzzy

* Fri Jun 12 2015 Thomas Woerner <twoerner@redhat.com> - 0.3.14.1-0

- spec file adaptions from Fedora

- dropped gtk applet remain: org.fedoraproject.FirewallApplet.gschema.xml

* Fri Jun 12 2015 Thomas Woerner <twoerner@redhat.com> - 0.3.14-1

- firewalld:

  - print real zone names in error messages

  - iptables 1.4.21 does not accept limits of 1/day, minimum is 2/day now

  - rate limit fix for rich rules

  - fix readdition of removed permanent direct settings

  - adaption of the polkit domains to use PK_ACTION_DIRECT_INFO

  - fixed two minor Python3 issues in firewall.core.io.direct

  - fixed use of fallback configuration values

  - fixed use without firewalld.conf

  - firewalld main restructureization

  - IPv6_rpfilter now also available as a property on D-Bus in the config interface

  - fixed wait option use for ipXtables

  - added --concurrent support for ebtables

  - richLanguage: allow masquerading with destination

  - richLanguage: limit masquerading forward rule to new connections

  - ipXtables: No dns lookups in available_tables and _detect_wait_option

  - full ebtables support: start, stop, reload, panic mode, direct chains and rules

  - fix for reload with direct rules

  - fix or flaws found by landscape.io

  - pid file handling fixes in case of pid file removal

  - fix for client issue in case of a dbus NoReply error

- configuration

  - new services: dropbox-lansync, ptp

  - new icmptypes: timestamp-request, timestamp-reply

- man pages:

  - firewalld.zones(5): fixed typos

  - firewalld.conf(5): Fixed wrong reference to firewalld.lockdown-whitelist page

- firewall-applet:

  - new version using Qt4 fixing several issues with the Gtk version

- spec file:

  - enabled Python3 support: new backends python-firewall and python3-firewall

  - some cleanup

- git:

  - migrated to github

- translations:

  - migrated to zanata

- build environment:

  - no need for autoconf-2.69, 2.68 is sufficient

* Wed Jan 28 2015 Thomas Woerner <twoerner@redhat.com> - 0.3.14-0

- enable python2 and python3 bindings for fedora >= 20 and rhel >= 7

- use python3 bindings on fedora >= 22 and rhel >= 8 for firewalld,

  firewall-config and firewall-applet

* Thu Dec 04 2014 Jiri Popelka <jpopelka@redhat.com> - 0.3.13-1

- firewalld:

  - ipXtables: use -w or -w2 if supported (RHBZ#1161745, RHBZ#1151067)

  - DROP INVALID packets (RHBZ#1169837)

  - don't use ipv6header for protocol matching. (RHBZ#1065565)

  - removeAllPassthroughs(): remove passthroughs in reverse order (RHBZ#1167100)

  - fix config.service.removeDestination() (RHBZ#1164584)

- firewall-config:

  - portProtoDialog: other protocol excludes port number/range

  - better fix for updating zoneStore also in update_active_zones()

  - fix typo in menu

- configuration:

  - new services: tinc, vdsm, mosh, iscsi-target, rsyncd

  - ship and install XML Schema files. (#8)

- man pages:

  - firewalld.dbus, firewalld.direct, firewalld, firewall-cmd

- spec file:

  - filesystem subpackage

  - make dirs&files in /usr/lib/ world-readable (RHBZ#915988)

* Tue Oct 14 2014 Jiri Popelka <jpopelka@redhat.com> - 0.3.12-1

- firewalld:

  - new runtimeToPermanent and tracked passsthrough support

  - make permanent D-Bus interfaces more fine grained like the runtime versions (RHBZ#1127706)

  - richLanguage: allow using destination with forward-port

  - Rich_Rule.check(): action can't be used with icmp-block/forward-port/masquerade

  - fixed Python specific D-Bus exception (RHBZ#1132441)

- firewall-cmd:

  - new --runtime-to-permanent to create permanent from runtime configuration

  - use new D-Bus methods for permanent changes

  - show target REJECT instead of %%REJECT%% (RHBZ#1058794)

  - --direct: make fail messages consistent (RHBZ#1141835)

- firewall-config:

  - richRuleDialog - OK button tooltip indicates problem

  - use new D-Bus methods for permanent changes

  - show target REJECT instead of %%REJECT%% (RHBZ#1058794)

  - update "Change Zones of Connections" menu on default zone change (RHBZ#11120212)

  - fixed rename of zones, services and icmptypes to not create new entry (RBHZ#1131064)

- configuration:

  - new service for Squid HTTP proxy server