backport-fix-nm-release-NM-client-after-a-timeout.patch

@@ -1,61 +0,0 @@
-From eb76e2a80a43481da7a54ff784edf1c76651db96 Mon Sep 17 00:00:00 2001
-From: Eric Garver <eric@garver.life>
-Date: Wed, 22 Nov 2023 12:10:09 -0500
-Subject: [PATCH] fix(nm): release NM client after a timeout
-
-Conflict: NA
-Reference: https://github.com/firewalld/firewalld/commit/eb76e2a80a43481da7a54ff784edf1c76651db96
-
-libnm will accumulate a bunch of data, e.g. routes, that is irrelevant
-to firewalld. To avoid unbound growth in memory we can destroy the
-client and reinitialize it when we query NM.
-
-Fixes: #1232
----
- src/firewall/core/fw_nm.py | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/src/firewall/core/fw_nm.py b/src/firewall/core/fw_nm.py
-index 0e38dd4..c1f8e1d 100644
---- a/src/firewall/core/fw_nm.py
-+++ b/src/firewall/core/fw_nm.py
-@@ -39,6 +39,7 @@ else:
-     except (ImportError, ValueError, GLib.Error):
-         _nm_imported = False
- _nm_client = None
-+_nm_client_timeout = None
- 
- from firewall import errors
- from firewall.errors import FirewallError
-@@ -61,9 +62,28 @@ def nm_get_client():
-     """Returns the NM client object or None if the import of NM failed
-     @return NM.Client instance if import was successful, None otherwise
-     """
-+
-+    def _release():
-+        """
-+        Release the client to avoid excess memory usage when libnm pushes
-+        irrelevant (to firewalld) updates.
-+        """
-+        global _nm_client
-+        global _nm_client_timeout
-+        _nm_client = None
-+        _nm_client_timeout = None
-+
-     global _nm_client
-+    global _nm_client_timeout
-+
-     if not _nm_client:
-         _nm_client = NM.Client.new(None)
-+    else:
-+        # refresh timer
-+        GLib.source_remove(_nm_client_timeout)
-+
-+    _nm_client_timeout = GLib.timeout_add_seconds(5, _release)
-+
-     return _nm_client
- 
- def nm_get_zone_of_connection(connection):
--- 
-2.33.0
-

firewalld.spec

@@ -1,6 +1,6 @@
 Name:      firewalld
 Version:   1.0.2
-Release:   11
+Release:   6
 Summary:   A firewall daemon with D-Bus interface providing a dynamic firewall
 License:   GPLv2+
 URL:       http://www.firewalld.org
@@ -20,14 +20,12 @@ Patch8:    0001-fix-config-Specify-the-translation-encoding-format-a.patch
 Patch9:    backport-chore-nftables-add-delete-table-helper.patch
 Patch10:   backport-fix-nftables-always-flush-main-table-on-start.patch
 
-Patch11:   backport-fix-nm-release-NM-client-after-a-timeout.patch
-
 BuildArch:     noarch
 BuildRequires: autoconf automake desktop-file-utils gettext intltool glib2 glib2-devel systemd-units docbook-style-xsl
 BuildRequires: libxslt iptables ebtables ipset python3-devel
 
 
-Requires:  iptables iptables-nft ipset systemd
+Requires:  iptables ebtables ipset systemd
 %if %{?openEuler:1}0
 Requires:  hicolor-icon-theme python3-gobject NetworkManager-libnm dbus-x11 gtk3
 %endif
@@ -123,11 +121,6 @@ dd if=/dev/zero of=$RPM_BUILD_ROOT/%{_datadir}/firewalld/firewalld-tmp-mmap bs=4
 
 %postun
 %systemd_postun_with_restart firewalld.service
-if [ $1 -eq 0 ]; then
-    if [ -L %{_sysconfdir}/firewalld/firewalld.conf ] && [ ! -e %{_sysconfdir}/firewalld/firewalld.conf ]; then
-        rm -f %{_sysconfdir}/firewalld/firewalld.conf
-    fi
-fi
 
 %posttrans
 # If we don't yet have a symlink or existing file for firewalld.conf,
@@ -162,7 +155,6 @@ if [ ! -e %{_datadir}/polkit-1/actions/org.fedoraproject.FirewallD1.policy ]; th
     esac
 fi
 
-sed -i "s/CleanupModulesOnExit=no/CleanupModulesOnExit=yes/g" %{_sysconfdir}/firewalld/firewalld.conf
 
 %files -f %{name}.lang
 %doc COPYING README
@@ -216,6 +208,13 @@ sed -i "s/CleanupModulesOnExit=no/CleanupModulesOnExit=yes/g" %{_sysconfdir}/fir
 %{_datadir}/metainfo/firewall-config.appdata.xml
 %{_datadir}/icons/hicolor/*/apps/firewall-config*.*
 %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
+%else
+%exclude %{_bindir}/firewall-config
+%exclude %{_datadir}/firewalld/*
+%exclude %{_datadir}/applications/firewall-config.desktop
+%exclude %{_datadir}/metainfo/firewall-config.appdata.xml
+%exclude %{_datadir}/icons/hicolor/*/apps/firewall-config*.*
+%exclude %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
 %endif
 %exclude %{_datadir}/firewalld/testsuite/*
 
@@ -228,15 +227,6 @@ sed -i "s/CleanupModulesOnExit=no/CleanupModulesOnExit=yes/g" %{_sysconfdir}/fir
 %defattr(-,root,root)
 %{python3_sitelib}/firewall/*
 
-%if %{!?openEuler:1}0
-%exclude %{_bindir}/firewall-config
-%exclude %{_datadir}/firewalld/*
-%exclude %{_datadir}/applications/firewall-config.desktop
-%exclude %{_datadir}/metainfo/firewall-config.appdata.xml
-%exclude %{_datadir}/icons/hicolor/*/apps/firewall-config*.*
-%exclude %{_datadir}/glib-2.0/schemas/org.fedoraproject.FirewallConfig.gschema.xml
-%endif
-
 %files -n firewalld-test
 %dir %{_datadir}/firewalld/testsuite
 %{_datadir}/firewalld/testsuite/README
@@ -250,37 +240,6 @@ sed -i "s/CleanupModulesOnExit=no/CleanupModulesOnExit=yes/g" %{_sysconfdir}/fir
 %{_datadir}/firewalld/testsuite/python/firewalld_test.py
 
 %changelog
-* Tue Aug 27 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.0.2-11
-- Type:bugfix
-- CVE:NA
-- SUG:NA
-- DESC:fix broken symbolic link after package remove
-
-* Fri Jul 05 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.0.2-10
-- Type:bugfix
-- ID:NA
-- SUG:NA
-- DESC:fix unintentinally exclude file
-
-* Fri Jul 05 2024 zhouyihang <zhouyihang3@h-partners.com> - 1.0.2-9
-- Type:bugfix
-- ID:NA
-- SUG:NA
-- DESC:fix(nm): release NM client after a timeout
-
-* Wed Nov 29 2023 zhanghao <zhanghao383@huawei.com> - 1.0.2-8
-- Type:requirement
-- ID:NA
-- SUG:NA
-- DESC:To reduce unnecessary loading of ebtables-related kernel modules
-
-* Tue Nov 28 2023 zhanghao <zhanghao383@huawei.com> - 1.0.2-7
-- Type:requirement
-- ID:NA
-- SUG:NA
-- DESC:Firewall startup is to set CleanupModuleOnxit=yes to unload
-       related ko when stopping firewalld service
-
 * Tue Sep 26 2023 zhanghao <zhanghao383@huawei.com> - 1.0.2-6
 - Type:bugfix
 - ID:NA