~tgamblin/ufw/distutils-to-setuptools : changes

~tgamblin/ufw/distutils-to-setuptools » Changes from revision 1140

From Revision 1140 to 1121

Rev	Summary	Authors	Date
1140	Change setup.py to use setuptools replacements for distutils Change setup.py to use setuptools replacements for distutils	Trevor Gamblin	2 years ago
1139	doc/.8: update dates doc/.8: update dates	Jamie Strandboge	2 years ago
1138	doc/ufw.8: consistently use whitespace doc/ufw.8: consistently use whitespace	Jamie Strandboge	2 years ago
1137	doc/ufw.8: delete/insert/prepend are exclusive. Thanks Greg ... doc/ufw.8: delete/insert/prepend are exclusive. Thanks Greg Atkinson References: - https://bugs.launchpad.net/ufw/+bug/1946084	Jamie Strandboge	2 years ago
1136	systemd.example: add DefaultDependencies=no; use Wants/After... systemd.example: add DefaultDependencies=no; use Wants/After local-fs.target Add back DefaultDependencies=no and instead add Wants/After local-fs.target. This will avoid a dependency on sysinit while ensuring that filesystems (including cryptsetup) are ready (the reason for removing DefaultDependencies=no in the first place). LP: #1950039	Jamie Strandboge	2 years ago
1135	tests/check-requirements: show we are performing the other f... tests/check-requirements: show we are performing the other fw check	Jamie Strandboge	2 years ago
1134	systemd.example: remove DefaultDependencies=no systemd.example: remove DefaultDependencies=no The systemd unit has historically always used DefaultDependencies=no. When only Before=network.target was used, the dependencies (as seen with 'systemctl list-dependencies ufw.service') were: ufw.service \|_system.slice When Before=network.target was changed to Before=network-pre.target and Wants=network-pre.target, this became: ufw.service \|_system.slice \|_network-pre.target Removing DefaultDependencies=no (DefaultDependencies defaults to 'yes') pulls in the sysinit.target which changes this to (on a Debian 11 system): ufw.service \|_system.slice \|_network-pre.target \|_sysinit.target \|_apparmor.service \|_blk-availability.service \|_dev-hugepages.mount \|_dev-mqueue.mount \|_keyboard-setup.service \|_kmod-static-nodes.service \|_lvm2-lvmpolld.socket \|_lvm2-monitor.service \|_proc-sys-fs-binfmt_misc.automount \|_sys-fs-fuse-connections.mount \|_sys-kernel-config.mount \|_sys-kernel-debug.mount \|_sys-kernel-tracing.mount \|_systemd-ask-password-console.path \|_systemd-binfmt.service \|_systemd-boot-system-token.service \|_systemd-hwdb-update.service \|_systemd-journal-flush.service \|_systemd-journald.service \|_systemd-machine-id-commit.service \|_systemd-modules-load.service \|_systemd-pstore.service \|_systemd-random-seed.service \|_systemd-sysctl.service \|_systemd-sysusers.service \|_systemd-timesyncd.service \|_systemd-tmpfiles-setup-dev.service \|_systemd-tmpfiles-setup.service \|_systemd-udev-trigger.service \|_systemd-udevd.service \|_systemd-update-utmp.service \|_cryptsetup.target \|_systemd-cryptsetup@vda5_crypt.service \|_local-fs.target \|_-.mount \|_boot.mount \|_systemd-fsck-root.service \|_systemd-remount-fs.service \|_swap.target \|_dev-mapper-debian\x2d\x2dbuster\x2d\x2damd64\x2d\x2dvg\x2dswap_1.swap While ufw is meant to come up before networking, there is no reason why it shouldn't come up after 'basic system initialization is completed'[1]. This should help make ufw startup more robust on systems that need something from sysinit. [1]https://www.freedesktop.org/software/systemd/man/systemd.unit.html	Jamie Strandboge	2 years ago
1133	systemd.example: add Conflicts on various firewall software systemd.example: add Conflicts on various firewall software Problems with ufw start most often have to do with other firewall software getting in the way. Take a page from firewalld's systemd unit and add a Conflicts on iptables, ip6tables, nftables and firewalld	Jamie Strandboge	2 years ago
1132	systemd.example: add Documentation and put Before before Wan... systemd.example: add Documentation and put Before before Wants (cosmetic)	Jamie Strandboge	2 years ago
1131	src/ufw-init-functions: add another default policy comment src/ufw-init-functions: add another default policy comment	Jamie Strandboge	2 years ago
1130	update ChangeLog for last commit update ChangeLog for last commit	Jamie Strandboge	2 years ago
1129	src/ufw-init-functions: set default policy after loading rul... src/ufw-init-functions: set default policy after loading rules If default input policy of DROP (default setting in ufw) is set before loading rules to allow a network root filesystem to work, it freezes before loading them, and the boot process stalls. Just set default policy after loading rules, as the snippet for ip[6]tables-restore has -n/--noflush, which doesn't flush other rules in the builtin chains. The output of iptables -L is identical before/after. https://bugs.launchpad.net/bugs/1946804 Signed-off-by: Mauricio Faria de Oliveira <mfo@canonical.com>	Mauricio Faria de Ol...	2 years ago
1128	tests/check-requirements: revert 29c210e5 (too lenient) and ... tests/check-requirements: revert 29c210e5 (too lenient) and update for 3.9 For a distribution it is arguably ok to modify this script for arbitrary python versions but as an upstream it represents what it has been tested against.	Jamie Strandboge	2 years ago
1127	AUTHORS,setup.py: use updated email address AUTHORS,setup.py: use updated email address	Jamie Strandboge	2 years ago
1126	tests/check-requirements: ix python version check for Python... tests/check-requirements: ix python version check for Python >= 3.9 Patch thanks to Matthias Klose <doko@debian.org> References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975912	Jamie Strandboge	2 years ago
1125	src/ufw: adjust version year src/ufw: adjust version year	Jamie Strandboge	2 years ago
1124	update man pages for newer dates and remove email address update man pages for newer dates and remove email address	Jamie Strandboge	2 years ago
1123	src/backend_iptables.py: unconditionally reload with delete.... src/backend_iptables.py: unconditionally reload with delete. LP: #1933117 ufw delete can confuse protocol-specific rule with otherwise matching 'proto any' rule. Consider: # ufw allow from 1.1.1.1 port 2222 proto tcp # rule 1 # ufw allow from 2.2.2.2 port 3333 proto tcp # rule 2 # ufw allow from 1.1.1.1 port 2222 # rule 3 In this case the loaded firewall will have: # iptables -L ufw-user-input -n Chain ufw-user-input (1 references) target prot opt source destination ACCEPT tcp -- 1.1.1.1 0.0.0.0/0 tcp spt:2222 ACCEPT tcp -- 2.2.2.2 0.0.0.0/0 tcp spt:3333 ACCEPT tcp -- 1.1.1.1 0.0.0.0/0 tcp spt:2222 ACCEPT udp -- 1.1.1.1 0.0.0.0/0 udp spt:2222 If we delete the 3rd rule: # ufw delete 3 Deleting: allow from 1.1.1.1 port 2222 Proceed with operation (y\|n)? y Rule deleted then ufw updates the running firewall with 'iptables -D', such that the loaded firewall is out of order and ends up having: # iptables -L ufw-user-input -n Chain ufw-user-input (1 references) target prot opt source destination ACCEPT tcp -- 2.2.2.2 0.0.0.0/0 tcp spt:3333 ACCEPT tcp -- 1.1.1.1 0.0.0.0/0 tcp spt:2222 Instead of using 'iptables -D' to delete the rule from the running firewall, instead reload the user chains so we get the proper rule order in the running firewall: # iptables -L ufw-user-input -n Chain ufw-user-input (1 references) target prot opt source destination ACCEPT tcp -- 1.1.1.1 0.0.0.0/0 tcp spt:2222 ACCEPT tcp -- 2.2.2.2 0.0.0.0/0 tcp spt:3333 TODO: we only need to reload on delete when there are overlapping proto-specific and 'proto any' rules, so a future optimization could check for this and go back to using 'iptables -D' when there are no overlaps.	Jamie Strandboge	2 years ago
1122	doc/ufw.8: insert/prepend can't be used to update comments. ... doc/ufw.8: insert/prepend can't be used to update comments. LP: #1927737	Jamie Strandboge	2 years ago
1121	src/backend_iptables.py: remove unreachable code. LP: #19277... src/backend_iptables.py: remove unreachable code. LP: #1927734	Jamie Strandboge	2 years ago

Older »