Date   

[meta-security][PATCH 1/1] LICENSE: adopt SPDX standard names

Joe Slater <joe.slater@...>
 

From: Robert Yang <liezhi.yang@...>

Modify LICENSE for ding-libs and libmhash.

Signed-off-by: Joe Slater <joe.slater@...>
---
recipes-security/libdhash/ding-libs_0.6.1.bb | 2 +-
recipes-security/libmhash/libmhash_0.9.9.9.bb | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/recipes-security/libdhash/ding-libs_0.6.1.bb b/recipes-security/libdhash/ding-libs_0.6.1.bb
index 6046fa0..843850f 100644
--- a/recipes-security/libdhash/ding-libs_0.6.1.bb
+++ b/recipes-security/libdhash/ding-libs_0.6.1.bb
@@ -2,7 +2,7 @@ SUMMARY = "Dynamic hash table implementation"
DESCRIPTION = "Dynamic hash table implementation"
HOMEPAGE = "https://fedorahosted.org/released/ding-libs"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"

SRC_URI = "https://fedorahosted.org/released/${BPN}/${BP}.tar.gz"
diff --git a/recipes-security/libmhash/libmhash_0.9.9.9.bb b/recipes-security/libmhash/libmhash_0.9.9.9.bb
index 9b34cb1..35c5ff8 100644
--- a/recipes-security/libmhash/libmhash_0.9.9.9.bb
+++ b/recipes-security/libmhash/libmhash_0.9.9.9.bb
@@ -7,7 +7,7 @@ DESCRIPTION = "\
"
HOMEPAGE = "http://mhash.sourceforge.net/"

-LICENSE = "LGPLv2.0"
+LICENSE = "LGPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7"

S = "${WORKDIR}/mhash-${PV}"
--
2.35.1


Re: Yocto poky/meta/recipes-devtool/perl

Alexander Kanavin
 

Can you please attach log.do_patch where the problem can be seen?

Alex

On Tue, 29 Mar 2022 at 15:11, Mike Ulan <mausvt@...> wrote:

Hi,
I have the question: is anybody aware that patches in a recipe are not fully applied?

When retrieved the archive for package unpacked.
Аttributes of multiple files are set as readonly.

For 5.30.1 https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl
or for 5.22.1 and 5.22 and 5.20 http://www.cpan.org/src/5.0/${BP}.tar.xz
lots of read only files in archives.

Form man of Patch behavior --read-only=warn by default.
So files to be patched with read only attributes remain unchanged.

For override patch default behavior on --read-only, i placed in poky/bitbake/bin file with name patch and content:
#!/bin/sh
/usr/bin/patch --read-only=fail "$@"
exvar=$?
echo "patch wraper readonly fail" "$@"
perror $exvar
exit $exvar

And as a clearly predictable result, the build of perl failed.
To fix problem and apply all patches and particularly my patch to backport issue for my host environment
I added to perl_${PV}.bb recipe this:
do_patch_prepend() {
os.system('chmod -R +rw %s' % d.getVar('S'))
}




Re: [meta-security][PATCH 1/1] LICENSE: adopt standard SPDX names

Joe Slater <joe.slater@...>
 

I'll send again for ding-libs and libmhash. Joe

-----Original Message-----
From: akuster808 <akuster808@...>
Sent: Tuesday, March 29, 2022 1:27 PM
To: Slater, Joseph <joe.slater@...>; yocto@...
Cc: MacLeod, Randy <Randy.MacLeod@...>
Subject: Re: [yocto] [meta-security][PATCH 1/1] LICENSE: adopt standard SPDX
names



On 3/29/22 09:18, Joe Slater wrote:
Correct LICENSE for samhain, ecrypt-utils, ding-libs, libmhash, and
sssd.

Signed-off-by: Joe Slater <joe.slater@...>
---
recipes-ids/samhain/samhain.inc | 2 +-
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 2 +-
recipes-security/libdhash/ding-libs_0.6.1.bb | 2 +-
recipes-security/libmhash/libmhash_0.9.9.9.bb | 2 +-
recipes-security/sssd/sssd_2.5.2.bb | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
Mater-next has these.

https://git.yoctoproject.org/meta-security/commit/?h=master-
next&id=ece41f7543bbd42c57f4208c7309f90cbd02e852

Looks like a few more need to be added based on these changes.

-armin

diff --git a/recipes-ids/samhain/samhain.inc
b/recipes-ids/samhain/samhain.inc index 077e118..fe0718d 100644
--- a/recipes-ids/samhain/samhain.inc
+++ b/recipes-ids/samhain/samhain.inc
@@ -1,6 +1,6 @@
DESCRIPTION = "Provides file integrity checking and log file
monitoring/analysis"
HOMEPAGE = "http://www.la-samhna.de/samhain/"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM =
"file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"

PV = "4.4.6"
diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
index 9aefc32..5f8cf3c 100644
--- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
+++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
@@ -6,7 +6,7 @@ DESCRIPTION = "eCryptfs is a stacked cryptographic
filesystem \
HOMEPAGE = "https://launchpad.net/ecryptfs"
SECTION = "base"

-LICENSE = "GPL-2.0"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM =
"file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"

DEPENDS = "keyutils libgcrypt intltool-native glib-2.0-native"
diff --git a/recipes-security/libdhash/ding-libs_0.6.1.bb
b/recipes-security/libdhash/ding-libs_0.6.1.bb
index 6046fa0..843850f 100644
--- a/recipes-security/libdhash/ding-libs_0.6.1.bb
+++ b/recipes-security/libdhash/ding-libs_0.6.1.bb
@@ -2,7 +2,7 @@ SUMMARY = "Dynamic hash table implementation"
DESCRIPTION = "Dynamic hash table implementation"
HOMEPAGE = "https://fedorahosted.org/released/ding-libs"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM =
"file://COPYING;md5=d32239bcb673463ab874e80d47fae504"

SRC_URI = "https://fedorahosted.org/released/${BPN}/${BP}.tar.gz"
diff --git a/recipes-security/libmhash/libmhash_0.9.9.9.bb
b/recipes-security/libmhash/libmhash_0.9.9.9.bb
index 9b34cb1..35c5ff8 100644
--- a/recipes-security/libmhash/libmhash_0.9.9.9.bb
+++ b/recipes-security/libmhash/libmhash_0.9.9.9.bb
@@ -7,7 +7,7 @@ DESCRIPTION = "\
"
HOMEPAGE = "http://mhash.sourceforge.net/"

-LICENSE = "LGPLv2.0"
+LICENSE = "LGPL-2.0-only"
LIC_FILES_CHKSUM =
"file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7"

S = "${WORKDIR}/mhash-${PV}"
diff --git a/recipes-security/sssd/sssd_2.5.2.bb
b/recipes-security/sssd/sssd_2.5.2.bb
index 8bc8787..9f1d627 100644
--- a/recipes-security/sssd/sssd_2.5.2.bb
+++ b/recipes-security/sssd/sssd_2.5.2.bb
@@ -2,7 +2,7 @@ SUMMARY = "system security services daemon"
DESCRIPTION = "SSSD is a system security services daemon"
HOMEPAGE = "https://pagure.io/SSSD/sssd/"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM =
"file://COPYING;md5=d32239bcb673463ab874e80d47fae504"

DEPENDS = "acl attr openldap cyrus-sasl libtdb ding-libs libpam c-ares krb5
autoconf-archive"



Re: [meta-security][PATCH 1/1] LICENSE: adopt standard SPDX names

Armin Kuster
 

On 3/29/22 09:18, Joe Slater wrote:
Correct LICENSE for samhain, ecrypt-utils, ding-libs,
libmhash, and sssd.

Signed-off-by: Joe Slater <joe.slater@...>
---
recipes-ids/samhain/samhain.inc | 2 +-
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 2 +-
recipes-security/libdhash/ding-libs_0.6.1.bb | 2 +-
recipes-security/libmhash/libmhash_0.9.9.9.bb | 2 +-
recipes-security/sssd/sssd_2.5.2.bb | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
Mater-next has these.

https://git.yoctoproject.org/meta-security/commit/?h=master-next&id=ece41f7543bbd42c57f4208c7309f90cbd02e852

Looks like a few more need to be added based on these changes.

-armin

diff --git a/recipes-ids/samhain/samhain.inc b/recipes-ids/samhain/samhain.inc
index 077e118..fe0718d 100644
--- a/recipes-ids/samhain/samhain.inc
+++ b/recipes-ids/samhain/samhain.inc
@@ -1,6 +1,6 @@
DESCRIPTION = "Provides file integrity checking and log file monitoring/analysis"
HOMEPAGE = "http://www.la-samhna.de/samhain/"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"
PV = "4.4.6"
diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
index 9aefc32..5f8cf3c 100644
--- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
+++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
@@ -6,7 +6,7 @@ DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
HOMEPAGE = "https://launchpad.net/ecryptfs"
SECTION = "base"
-LICENSE = "GPL-2.0"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"
DEPENDS = "keyutils libgcrypt intltool-native glib-2.0-native"
diff --git a/recipes-security/libdhash/ding-libs_0.6.1.bb b/recipes-security/libdhash/ding-libs_0.6.1.bb
index 6046fa0..843850f 100644
--- a/recipes-security/libdhash/ding-libs_0.6.1.bb
+++ b/recipes-security/libdhash/ding-libs_0.6.1.bb
@@ -2,7 +2,7 @@ SUMMARY = "Dynamic hash table implementation"
DESCRIPTION = "Dynamic hash table implementation"
HOMEPAGE = "https://fedorahosted.org/released/ding-libs"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
SRC_URI = "https://fedorahosted.org/released/${BPN}/${BP}.tar.gz"
diff --git a/recipes-security/libmhash/libmhash_0.9.9.9.bb b/recipes-security/libmhash/libmhash_0.9.9.9.bb
index 9b34cb1..35c5ff8 100644
--- a/recipes-security/libmhash/libmhash_0.9.9.9.bb
+++ b/recipes-security/libmhash/libmhash_0.9.9.9.bb
@@ -7,7 +7,7 @@ DESCRIPTION = "\
"
HOMEPAGE = "http://mhash.sourceforge.net/"
-LICENSE = "LGPLv2.0"
+LICENSE = "LGPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7"
S = "${WORKDIR}/mhash-${PV}"
diff --git a/recipes-security/sssd/sssd_2.5.2.bb b/recipes-security/sssd/sssd_2.5.2.bb
index 8bc8787..9f1d627 100644
--- a/recipes-security/sssd/sssd_2.5.2.bb
+++ b/recipes-security/sssd/sssd_2.5.2.bb
@@ -2,7 +2,7 @@ SUMMARY = "system security services daemon"
DESCRIPTION = "SSSD is a system security services daemon"
HOMEPAGE = "https://pagure.io/SSSD/sssd/"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"
DEPENDS = "acl attr openldap cyrus-sasl libtdb ding-libs libpam c-ares krb5 autoconf-archive"


Re: [meta-security][PATCH] openscap-daemon: inherit python_setuptools_build_meta

Armin Kuster
 

On 3/27/22 19:25, Chen Qi wrote:
setuptools_build_meta has been renamed to python_setuptools_build_meta.

Signed-off-by: Chen Qi <Qi.Chen@...>
---
.../recipes-openscap/openscap-daemon/openscap-daemon_0.1.10.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-security-compliance/recipes-openscap/openscap-daemon/openscap-daemon_0.1.10.bb b/meta-security-compliance/recipes-openscap/openscap-daemon/openscap-daemon_0.1.10.bb
index cf6d531..9659323 100644
--- a/meta-security-compliance/recipes-openscap/openscap-daemon/openscap-daemon_0.1.10.bb
+++ b/meta-security-compliance/recipes-openscap/openscap-daemon/openscap-daemon_0.1.10.bb
@@ -13,7 +13,7 @@ SRC_URI = "git://github.com/OpenSCAP/openscap-daemon.git;branch=master;protocol=
file://0001-Renamed-module-and-variables-to-get-rid-of-async.patch \
"
-inherit setuptools_build_meta
+inherit python_setuptools_build_meta
I believe this is sitting in master-next.
https://git.yoctoproject.org/meta-security/commit/?h=master-next&id=398047a7a6310b1ef70d22430fb6df4effd8cf92

S = "${WORKDIR}/git"


Re: Strange sporadic build issues (incremental builds in docker container)

Trevor Woerner
 

On Thu 2022-03-24 @ 09:31:25 AM, Alexander Kanavin wrote:
I don't. You need to inspect the build tree to find clues why the
patch was applied twice. Or simpy wipe tmp/ before builds, if your
sstate works properly that won't make the builds longer.

Alex

On Thu, 24 Mar 2022 at 07:43, Matthias Klein <matthias.klein@...> wrote:

Hello Alex,

it occurred again:

NOTE: recipe gawk-5.1.1-r0: task do_patch: Succeeded
NOTE: Running task 1673 of 4524 (/var/jenkins_home/workspace/yocto-raspberrypi/yocto/poky/meta/recipes-devtools/python/python3-six_1.16.0.bb:do_patch)
NOTE: recipe firstboot-1.0-r0: task do_populate_sysroot: Started
NOTE: recipe keymaps-1.0-r31: task do_patch: Started
NOTE: recipe python3-six-1.16.0-r0: task do_patch: Started
NOTE: recipe python3-six-1.16.0-r0: task do_patch: Succeeded
NOTE: Running task 1676 of 4524 (/var/jenkins_home/workspace/yocto-raspberrypi/yocto/poky/meta/recipes-devtools/perl/perl_5.34.1.bb:do_patch)
NOTE: recipe e2fsprogs-1.46.5-r0: task do_patch: Succeeded
ERROR: keymaps-1.0-r31 do_patch: Applying patch 'GPLv2.patch' on target directory '/var/jenkins_home/workspace/yocto-raspberrypi/build/tmp/work/raspberrypi3_64-poky-linux/keymaps/1.0-r31'
CmdError('quilt --quiltrc /var/jenkins_home/workspace/yocto-raspberrypi/build/tmp/work/raspberrypi3_64-poky-linux/keymaps/1.0-r31/recipe-sysroot-native/etc/quiltrc push', 0, 'stdout:
stderr: File series fully applied, ends at patch GPLv2.patch
')
ERROR: Logfile of failure stored in: /var/jenkins_home/workspace/yocto-raspberrypi/build/tmp/work/raspberrypi3_64-poky-linux/keymaps/1.0-r31/temp/log.do_patch.353982
NOTE: recipe keymaps-1.0-r31: task do_patch: Failed
NOTE: Running task 1679 of 4524 (/var/jenkins_home/workspace/yocto-raspberrypi/yocto/poky/meta/recipes-bsp/alsa-state/alsa-state.bb:do_patch)
ERROR: Task (/var/jenkins_home/workspace/yocto-raspberrypi/yocto/poky/meta/recipes-bsp/keymaps/keymaps_1.0.bb:do_patch) failed with exit code '1'

Do you have an idea?

Best regards,
Matthias

-----Ursprüngliche Nachricht-----
Von: Alexander Kanavin <alex.kanavin@...>
Gesendet: Dienstag, 22. März 2022 10:26
An: Matthias Klein <matthias.klein@...>
Cc: yocto@...
Betreff: Re: [yocto] Strange sporadic build issues (incremental builds in docker container)

It's hard to say without the full error message, and the build directory of the affected recipe. The easy way out is to simply wipe tmp/ before each build.

Alex

On Tue, 22 Mar 2022 at 09:51, Matthias Klein <matthias.klein@...> wrote:

Hello together,

I am building various kirkstone/master yoctos every night via Jenkins inside a Debian Bullseye Docker container.
These are incremental builds, reusing the build directory and sstate-cache of the previous build. The different yoctos are built in order. Each time, a new Docker container is launched.
(The same environment builds dunfell yoctos without any problems).

Now it happens sporadically that one of the builds aborts with the following message:

stderr: The series file no longer matches the applied patches. Please run 'quilt pop -a'.

They are usually alternating packages where the patch step fails with the above message. Also different yoctos are affected. But it is always the above message.
If I then restart the failed build it usually builds cleanly.

Does anyone have an idea in which direction the problem goes?
Yes I've been seeing exactly these issues as well.

I'm not using any sort of virtualization, I'm using Jenkins to do nightly
builds directly on my host. My host machine is openSUSE 15.3. These problems
started on Feb 21 for me.

Each of my builds starts by doing a "git pull" on each of the repositories,
then kicks off a build if any of the repositories changed. A fresh build will
always succeed. Doing a "clean" and rebuilding will (I believe) always
succeed. My gut feeling is that it somehow has something to do with having an
existing build, refreshing the repositories, then rebuilding.

I spent weeks trying to find a reproducer. I wrote a script to checkout one
version of the repositories (before), build, checkout a newer version of the
repositories (after) and rebuilding. Even in cases where I used the exact same
hashes that had failed on my Jenkins build and repeating 20 times, in some
cases I wasn't able to reproduce the error. I was able to find 1 reproducer
involving a build for an imx28evk MACHINE, but even then after 20 iterations
13 were bad and 7 were good. I repeated that set of 20 builds many times and
it was never 100% bad.

My investigations led me to believe that it might be related to rm_work and/or
BB_NUMBER_THREADS/PARALLEL_MAKE. In my Jenkins builds I enable 'INHERIT +=
"rm_work"' and I also limit the BB_NUMBER_THREADS and set PARALLEL_MAKE. On
the cmdline I was able to reduce the number of failures (sometimes to none) by
removing the rm_work and THREADS/PARALLEL, but never completely eliminate it.
In Jenkins the build failures still felt as random as they were without the
change, so I can't say that it's having much effect in Jenkins, but seems to
have some effect on the cmdline.

I can say this with certainty: Matthias says it seems that the specific
recipe that fails is random, but it's not. In every case the recipe that fails
is a recipe whose source files are contained in the meta layer itself. For me
the failing recipes were always:
modutils-initscripts
initscripts

If you look at the recipes for those packages they do not have a SRC_URI that
fetches code from some remote location then uses quilt to apply some patches.
In both cases all of the "source" code exists in the layer itself, and somehow
quilt is involved in placing them in the build area.

I have dozens and dozens of these failures recorded and it is always with a
recipe that follows that pattern. But 99%-ish percent of the failures are with
the two packages I listed above.

The failures aren't related to days when those packages change. The failures
are just... sporadic.

So the issue is related to:
- recipes with in-layer sources
- quilt (being run twice (?))
- updating layers, and rebuilding in a build area with an existing build
- Feb 21 2022 (or thereabouts)

The issue might be related to:
- jenkins?
- my build host?
- rm_work?
- BB_NUMBER_THREADS?
- PARALLEL_MAKE?


[meta-security][PATCH 1/1] LICENSE: adopt standard SPDX names

Joe Slater <joe.slater@...>
 

Correct LICENSE for samhain, ecrypt-utils, ding-libs,
libmhash, and sssd.

Signed-off-by: Joe Slater <joe.slater@...>
---
recipes-ids/samhain/samhain.inc | 2 +-
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb | 2 +-
recipes-security/libdhash/ding-libs_0.6.1.bb | 2 +-
recipes-security/libmhash/libmhash_0.9.9.9.bb | 2 +-
recipes-security/sssd/sssd_2.5.2.bb | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/recipes-ids/samhain/samhain.inc b/recipes-ids/samhain/samhain.inc
index 077e118..fe0718d 100644
--- a/recipes-ids/samhain/samhain.inc
+++ b/recipes-ids/samhain/samhain.inc
@@ -1,6 +1,6 @@
DESCRIPTION = "Provides file integrity checking and log file monitoring/analysis"
HOMEPAGE = "http://www.la-samhna.de/samhain/"
-LICENSE = "GPLv2"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"

PV = "4.4.6"
diff --git a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
index 9aefc32..5f8cf3c 100644
--- a/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
+++ b/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
@@ -6,7 +6,7 @@ DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
HOMEPAGE = "https://launchpad.net/ecryptfs"
SECTION = "base"

-LICENSE = "GPL-2.0"
+LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"

DEPENDS = "keyutils libgcrypt intltool-native glib-2.0-native"
diff --git a/recipes-security/libdhash/ding-libs_0.6.1.bb b/recipes-security/libdhash/ding-libs_0.6.1.bb
index 6046fa0..843850f 100644
--- a/recipes-security/libdhash/ding-libs_0.6.1.bb
+++ b/recipes-security/libdhash/ding-libs_0.6.1.bb
@@ -2,7 +2,7 @@ SUMMARY = "Dynamic hash table implementation"
DESCRIPTION = "Dynamic hash table implementation"
HOMEPAGE = "https://fedorahosted.org/released/ding-libs"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"

SRC_URI = "https://fedorahosted.org/released/${BPN}/${BP}.tar.gz"
diff --git a/recipes-security/libmhash/libmhash_0.9.9.9.bb b/recipes-security/libmhash/libmhash_0.9.9.9.bb
index 9b34cb1..35c5ff8 100644
--- a/recipes-security/libmhash/libmhash_0.9.9.9.bb
+++ b/recipes-security/libmhash/libmhash_0.9.9.9.bb
@@ -7,7 +7,7 @@ DESCRIPTION = "\
"
HOMEPAGE = "http://mhash.sourceforge.net/"

-LICENSE = "LGPLv2.0"
+LICENSE = "LGPL-2.0-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7"

S = "${WORKDIR}/mhash-${PV}"
diff --git a/recipes-security/sssd/sssd_2.5.2.bb b/recipes-security/sssd/sssd_2.5.2.bb
index 8bc8787..9f1d627 100644
--- a/recipes-security/sssd/sssd_2.5.2.bb
+++ b/recipes-security/sssd/sssd_2.5.2.bb
@@ -2,7 +2,7 @@ SUMMARY = "system security services daemon"
DESCRIPTION = "SSSD is a system security services daemon"
HOMEPAGE = "https://pagure.io/SSSD/sssd/"
SECTION = "base"
-LICENSE = "GPLv3+"
+LICENSE = "GPL-3.0-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504"

DEPENDS = "acl attr openldap cyrus-sasl libtdb ding-libs libpam c-ares krb5 autoconf-archive"
--
2.35.1


[PATCH yocto-autobuilder-helper] config.json: no need to explicitly exclude the NPM tests

Ross Burton <ross@...>
 

These tests now skip themselves automatically[1] if meta-oe isn't
present, so there is no need to explicitly skip them.

[1] oe-core d22ed015d8f38241acb783e1a468fb15d4317670

Signed-off-by: Ross Burton <ross.burton@...>
---
config.json | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/config.json b/config.json
index 6a77ca8..2ac151d 100644
--- a/config.json
+++ b/config.json
@@ -190,7 +190,7 @@
},
"step2" : {
"shortname" : "OE Selftest",
- "EXTRACMDS" : ["${SCRIPTSDIR}/checkvnc; OEQA_DEBUGGING_S=
AVED_OUTPUT=3D${BASE_SHAREDDIR}/pub/repro-fail/ DISPLAY=3D:1 oe-selftest =
--skip-tests distrodata.Distrodata.test_checkpkg buildoptions.SourceMirro=
ring.test_yocto_source_mirror devtool.DevtoolAddTests.test_devtool_add_np=
m recipetool.RecipetoolTests.test_recipetool_create_npm reproducible -T m=
achine -T toolchain-user -T toolchain-system -j 15"],
+ "EXTRACMDS" : ["${SCRIPTSDIR}/checkvnc; OEQA_DEBUGGING_S=
AVED_OUTPUT=3D${BASE_SHAREDDIR}/pub/repro-fail/ DISPLAY=3D:1 oe-selftest =
--skip-tests distrodata.Distrodata.test_checkpkg buildoptions.SourceMirro=
ring.test_yocto_source_mirror reproducible -T machine -T toolchain-user -=
T toolchain-system -j 15"],
"ADDLAYER" : ["${BUILDDIR}/../meta-selftest"]
},
"step3" : {
@@ -407,7 +407,7 @@
"extravars" : [
"RPM_GPG_SIGN_CHUNK =3D '1'"
],
- "EXTRACMDS" : ["${SCRIPTSDIR}/checkvnc; DISPLAY=3D:1 oe-=
selftest --skip-tests distrodata.Distrodata.test_checkpkg buildoptions.So=
urceMirroring.test_yocto_source_mirror devtool.DevtoolAddTests.test_devto=
ol_add_npm recipetool.RecipetoolTests.test_recipetool_create_npm -T machi=
ne -T toolchain-user -T toolchain-system -j 15"],
+ "EXTRACMDS" : ["${SCRIPTSDIR}/checkvnc; DISPLAY=3D:1 oe-=
selftest --skip-tests distrodata.Distrodata.test_checkpkg buildoptions.So=
urceMirroring.test_yocto_source_mirror -T machine -T toolchain-user -T to=
olchain-system -j 15"],
"ADDLAYER" : ["${BUILDDIR}/../meta-selftest"]
}
},
--=20
2.25.1


Yocto Project Status WW132`22

Stephen Jolley
 

Current Dev Position: YP 3.5 M4

Next Deadline: 4th April. 2022 YP 3.5 M4 build

 

Next Team Meetings:

 

Key Status/Updates:

  • The first release candidate build for YP 4.0 (3.5) is due next week (Monday, 4th April)
  • YP 3.1.15 was released
  • YP 3.4.3 has passed QA and likely to be released imminently
  • We’re calming down the number of changes going into the release at this point including upgrades. For example the recent go uprev is very unlikely to make it in at this point. If there are patches you think should be in the release, please comment on them to show support.
  • We were able to isolate one parsing process lockup which ideally we’d fix in the release but it is unclear if the fixes will be ready.
  • YP 4.1 planning document is available for review at: https://docs.google.com/document/d/1-g7DatSdmIETwD3xFSCxV7MbWVVkpQvQ788mIr1MPTI/edit?usp=sharing
  • Improvements to the documentation version number handling were made, making things easier for release engineering and general maintenance. It should also improve the items in the switcher dropdown menu, Please report any issues anyone spots with the docs.
  • If people see intermittent issues in their own builds, particularly if they’re the same as intermittent issues seen on the autobuilder, please do comment in the bugs mentioning when they happen as the frequency information does help us prioritize fixing the most common issues.
  • Intermittent issues continue to be at high levels and help is very much welcome in trying to resolve them. You can see the list of failures we’re continuing to see by searching for the “AB-INT” tag in bugzilla: https://bugzilla.yoctoproject.org/buglist.cgi?quicksearch=AB-INT

We did work out the cause of the infamous tinfoil wait_event intermittent issue.

 

Ways to contribute:

 

YP 3.5 Milestone Dates:

  • YP 3.5 M4 build date 2022/04/04
  • YP 3.5 M4 Release date 2022/04/29

 

Upcoming dot releases:

  • YP 3.1.15 is released.
  • YP 3.4.3 is near release.
  • YP 3.3.6 build date 2022/03/28
  • YP 3.3.6 Release date 2022/04/08
  • YP 3.1.16 build date 2022/04/25
  • YP 3.1.16 Release date 2022/05/06

 

Tracking Metrics:

 

The Yocto Project’s technical governance is through its Technical Steering Committee, more information is available at:

https://wiki.yoctoproject.org/wiki/TSC

 

The Status reports are now stored on the wiki at: https://wiki.yoctoproject.org/wiki/Weekly_Status

 

[If anyone has suggestions for other information you’d like to see on this weekly status update, let us know!]

 

Thanks,

 

Stephen K. Jolley

Yocto Project Program Manager

(    Cell:                (208) 244-4460

* Email:              sjolley.yp.pm@...

 


Yocto poky/meta/recipes-devtool/perl

Mike Ulan
 

Hi,
I have the question: is anybody aware that patches in a recipe are not fully applied?

When retrieved the archive for package unpacked. 
Аttributes of multiple files are set as readonly.  

lots of read only files in archives.

Form  man of Patch behavior --read-only=warn by default.
So files to be patched with read only attributes remain unchanged.

For override patch default behavior on --read-only, i placed in poky/bitbake/bin file with name patch and content:
#!/bin/sh
/usr/bin/patch --read-only=fail "$@"
exvar=$?
echo "patch wraper readonly fail" "$@"
perror $exvar
exit $exvar

And as a clearly predictable result, the build of perl failed. 
To fix problem and apply all patches and particularly my patch to backport issue for my host environment 
I added to perl_${PV}.bb recipe this:
do_patch_prepend() {
    os.system('chmod -R +rw %s' % d.getVar('S'))
}


Re: [OE-core] Which vendors maintain SDIO WiFi in mainline stable kernel

Fabio Estevam <festevam@...>
 

Hi Jupiter,

On Tue, Mar 29, 2022 at 3:16 AM JH <jupiter.hce@...> wrote:

Hi,

I could not understand why so many large WiFi chip vendors retreat to
stop maintaining WiFi SDIO chips to mainline Linux kernel, and to
settle it's chip support to out of the tree, use its own SDK and
proprietary kernel tree to source.codeaurora.org or private repository
which are not compatible to mainline stable kernel, the kernel
configures are also different.

I looked at the following link, the mwifiex and mwifiex_sdio support
the Marvell (NXP) 88W88 chipset, but only kernel 4.19 was able to
build and to run, kernel 5 cannot support 88W88 chipset, any more.
Same to Qualcomm, the old Atheros WiFi modules are supported, the
QCA-9377-3 chipset is in source.codeaurora.org only supported by old
kernel 4.9.
The QCA9377 is well supported in the mainline kernel by the ath10k driver:
drivers/net/wireless/ath/ath10k/

Just use 5.10 or 5.15 stable tree and there will be no need to use an
out-of-tree driver for QCA9377.


Re: [OE-core] Which vendors maintain SDIO WiFi in mainline stable kernel

Federico Pellegrin
 


Hi Jupiter,
I cannot help you on the specific chip you ask, but responding to the second part of your question I have quite good experience with Microchip WILC1000/3000 on SDIO which, after a part separate repo and then staging, is now in mailine from quite some time: https://github.com/torvalds/linux/tree/master/drivers/net/wireless/microchip/wilc1000
I had also some mixed experience (seemed to be arch releated) otherwise also with SDIO/SPI of SiLabs which is currently in mainline staging: https://github.com/torvalds/linux/tree/master/drivers/staging/wfx
These chips are at least currently still on the market (modulo shortage problems), not sure about their projected lifespan (I guess something hard to foresee).

Cheers,
Federico


Il giorno mar 29 mar 2022 alle ore 08:16 JH <jupiter.hce@...> ha scritto:
Hi,

I could not understand why so many large WiFi chip vendors retreat to
stop maintaining WiFi SDIO chips to mainline Linux kernel, and to
settle it's chip support to out of the tree, use its own SDK and
proprietary kernel tree to source.codeaurora.org or private repository
which are not compatible to mainline stable kernel, the kernel
configures are also different.

I looked at the following link, the mwifiex and mwifiex_sdio support
the Marvell (NXP) 88W88 chipset, but only kernel 4.19 was able to
build and to run, kernel 5 cannot support 88W88 chipset, any more.
Same to Qualcomm, the old Atheros WiFi modules are supported, the
QCA-9377-3 chipset is in source.codeaurora.org only supported by old
kernel 4.9.

Given the OE/Yocto poky kernel build is based on a mainline stable
kernel repository, how can I build kernel 5 for 88W88 chipset or
QCA-9377-3 from source.codeaurora.org or private repository? Or which
WiFi vendors are still well maintaining the WiFi chips for kernel 5,
the only sensible solution is to switch WiFi SDIO chips? Appreciate
your advice and comments.

https://wireless.wiki.kernel.org/en/users/drivers

Thank you very much.

Kind regards,

jupiter




Which vendors maintain SDIO WiFi in mainline stable kernel

JH
 

Hi,

I could not understand why so many large WiFi chip vendors retreat to
stop maintaining WiFi SDIO chips to mainline Linux kernel, and to
settle it's chip support to out of the tree, use its own SDK and
proprietary kernel tree to source.codeaurora.org or private repository
which are not compatible to mainline stable kernel, the kernel
configures are also different.

I looked at the following link, the mwifiex and mwifiex_sdio support
the Marvell (NXP) 88W88 chipset, but only kernel 4.19 was able to
build and to run, kernel 5 cannot support 88W88 chipset, any more.
Same to Qualcomm, the old Atheros WiFi modules are supported, the
QCA-9377-3 chipset is in source.codeaurora.org only supported by old
kernel 4.9.

Given the OE/Yocto poky kernel build is based on a mainline stable
kernel repository, how can I build kernel 5 for 88W88 chipset or
QCA-9377-3 from source.codeaurora.org or private repository? Or which
WiFi vendors are still well maintaining the WiFi chips for kernel 5,
the only sensible solution is to switch WiFi SDIO chips? Appreciate
your advice and comments.

https://wireless.wiki.kernel.org/en/users/drivers

Thank you very much.

Kind regards,

jupiter


M+ & H bugs with Milestone Movements WW13

Stephen Jolley
 

All,

YP M+ or high bugs which moved to a new milestone in WW13 are listed below:

Priority

Bug ID

Short Description

Changer

Owner

Was

Became

Medium+

5322

Global DNS fallback mechanism not present in poky distro

kai.kang@...

kai.kang@...

3.5 M3

3.6 M1

 

7600

syslinux: port extX support patches to syslinux community

randy.macleod@...

sakib.sajal@...

3.5 M3

3.6 M1

 

10693

Add a testcase for multilib eSDK on the autobuilder

randy.macleod@...

Qi.Chen@...

3.5 M3

3.6 M1

 

11361

oe-build-perf-test: monitor system resource utilization

randy.macleod@...

sakib.sajal@...

3.5 M3

3.6 M1

 

12060

It is possible to specify a PACKAGE and a PKG_ rename that conflict

kai.kang@...

kai.kang@...

3.5 M3

3.6 M1

 

12917

Warnings from nightly-multilib builds (build-deps)

kai.kang@...

kai.kang@...

3.5 M3

3.6 M1

 

12937

Consistent naming scheme for deployed artifacts

randy.macleod@...

Martin.Jansa@...

3.5 M3

3.6 M1

 

13035

Extend autobuilder worker bringup testing to include limit changes

randy.macleod@...

mhalstead@...

3.5 M3

3.6 M2

 

13288

pseudo should not follow symlinks in /proc

randy.macleod@...

sakib.sajal@...

3.5 M3

3.6 M1

 

13311

xargs: fdleak.c:396: complain_about_leaky_fds: Assertion `no_leaks' failed.

randy.macleod@...

unassigned@...

3.5 M3

3.5 M4

 

13731

Cross canadian GCC fails to find header files when using tclibc-newlib

randy.macleod@...

alejandro@...

3.5 M3

3.6 M2

 

13766

Using TCLIB=musl results in SDKs producing incompatible binaries

randy.macleod@...

sakib.sajal@...

3.5 M3

3.5 M4

 

13904

do_prepare_recipe_sysroot: postinst-useradd-* does not run in order of dependency and sometimes fails

randy.macleod@...

sakib.sajal@...

3.5 M3

3.5 M4

 

14007

When qemu hangs, try to create a snapshot or core file.

randy.macleod@...

sakib.sajal@...

3.5 M3

3.6 M1

 

14023

oe-selftest doesn't work with BB_SERVER_TIMEOUT=60

randy.macleod@...

pavel@...

3.5 M3

3.5 M4

 

14139

systemd user/groups different on opkg vs rpm images

randy.macleod@...

hongxu.jia@...

3.5 M3

3.5 M4

 

14303

Result of build is not stored in testresult.json with resulttool

randy.macleod@...

jay.shen.teoh@...

3.5 M3

3.6 M1

 

14348

Layer dependencies not updated

randy.macleod@...

bluelightning@...

3.5 M3

3.5 M4

 

14394

Add a banner on the old documentation docs

richard.purdie@...

mhalstead@...

3.5 M3

3.5 M4

 

14403

Qemu error messages not clear when command line is corrupted.

randy.macleod@...

sakib.sajal@...

3.5 M3

3.6 M2

 

14640

Relocation error when setting up SDK with rust tools

randy.macleod@...

pgowda.cve@...

3.5 M3

3.5 M4

 

14645

qemux86-64 oops on bootup

randy.macleod@...

akuster808@...

3.5 M3

3.5 M4

 

14680

intermittent setscene tasks failures

richard.purdie@...

anuj.mittal@...

3.5 M4

3.4.3

 

14693

cmake-native do_configure fails when rebuilding without sstate on NIS hosts

randy.macleod@...

liezhi.yang@...

3.5 M3

3.6 M1

 

14691

Bitbake does not check for all required perl modules to build oe-core

randy.macleod@...

sakib.sajal@...

3.5 M3

3.6 M1

 

14717

OEToolchainConfig.cmake sets wrong and unsuitable compiler flags

randy.macleod@...

martin.beeger@...

3.5 M3

3.6 M1

Thanks,

 

Stephen K. Jolley

Yocto Project Program Manager

(    Cell:                (208) 244-4460

* Email:              sjolley.yp.pm@...

 


Enhancements/Bugs closed WW13!

Stephen Jolley
 

All,

The below were the owners of enhancements or bugs closed during the last week!

Who

Count

david.reyna@...

8

alexandre.belloni@...

4

randy.macleod@...

4

richard.purdie@...

1

saul.wold@...

1

Grand Total

18

Thanks,

 

Stephen K. Jolley

Yocto Project Program Manager

(    Cell:                (208) 244-4460

* Email:              sjolley.yp.pm@...

 


Current high bug count owners for Yocto Project 3.5

Stephen Jolley
 

All,

Below is the list as of top 39 bug owners as of the end of WW13 of who have open medium or higher bugs and enhancements against YP 3.5.   There are 23 possible work days left until the final release candidates for YP 3.5 needs to be released.

Who

Count

michael.opdenacker@...

34

ross@...

26

randy.macleod@...

15

tim.orling@...

12

richard.purdie@...

11

bruce.ashfield@...

11

david.reyna@...

11

mhalstead@...

8

trevor.gamblin@...

7

bluelightning@...

6

sakib.sajal@...

6

chee.yang.lee@...

4

JPEWhacker@...

4

hongxu.jia@...

3

Qi.Chen@...

2

kai.kang@...

2

pgowda.cve@...

2

saul.wold@...

2

mshah@...

2

akuster808@...

2

jon.mason@...

1

mostthingsweb@...

1

alexandre.belloni@...

1

yi.zhao@...

1

sundeep.kokkonda@...

1

pokylinux@...

1

pavel@...

1

raj.khem@...

1

andrei@...

1

aehs29@...

1

thomas.perrot@...

1

matthewzmd@...

1

TicoTimo@...

1

nicolas.dechesne@...

1

jaskij@...

1

mark.hatle@...

1

open.source@...

1

john.kaldas.enpj@...

1

alejandro@...

1

Grand Total

189

Thanks,

 

Stephen K. Jolley

Yocto Project Program Manager

(    Cell:                (208) 244-4460

* Email:              sjolley.yp.pm@...

 


Yocto Project Newcomer & Unassigned Bugs - Help Needed

Stephen Jolley
 

All,

 

The triage team is starting to try and collect up and classify bugs which a newcomer to the project would be able to work on in a way which means people can find them. They're being listed on the triage page under the appropriate heading:

https://wiki.yoctoproject.org/wiki/Bug_Triage#Newcomer_Bugs  Also please review: https://www.openembedded.org/wiki/How_to_submit_a_patch_to_OpenEmbedded and how to create a bugzilla account at: https://bugzilla.yoctoproject.org/createaccount.cgi

The idea is these bugs should be straight forward for a person to help work on who doesn't have deep experience with the project.  If anyone can help, please take ownership of the bug and send patches!  If anyone needs help/advice there are people on irc who can likely do so, or some of the more experienced contributors will likely be happy to help too.

 

Also, the triage team meets weekly and does its best to handle the bugs reported into the Bugzilla. The number of people attending that meeting has fallen, as have the number of people available to help fix bugs. One of the things we hear users report is they don't know how to help. We (the triage team) are therefore going to start reporting out the currently 400 unassigned or newcomer bugs.

 

We're hoping people may be able to spare some time now and again to help out with these.  Bugs are split into two types, "true bugs" where things don't work as they should and "enhancements" which are features we'd want to add to the system.  There are also roughly four different "priority" classes right now,  “3.5, “3.6”, "3.99" and "Future", the more pressing/urgent issues being in "3.5" and then “3.6”.

 

Please review this link and if a bug is something you would be able to help with either take ownership of the bug, or send me (sjolley.yp.pm@...) an e-mail with the bug number you would like and I will assign it to you (please make sure you have a Bugzilla account).  The list is at: https://wiki.yoctoproject.org/wiki/Bug_Triage_Archive#Unassigned_or_Newcomer_Bugs

 

Thanks,

 

Stephen K. Jolley

Yocto Project Program Manager

(    Cell:                (208) 244-4460

* Email:              sjolley.yp.pm@...

 


psplash: Wrong spashscreen resolution in case of two displays with different resolution

Vasyl Vavrychuk
 

Hi,

In my system I have two displays (virtual) with different resolution
first: 1080x1920 (portrait orientation)
second: 640x720

When psplash is run, it shows boot animation with resolution 640x720 on the first display too:

+-----------+-----+
| | |
| psplash | |
| | |
| | |
+-----------+ |
| |
| |
| Display 1 |
| |
| |
+-----------------+

+-----------+
| |
| psplash |
| Display 2 |
| |
+-----------+

Can we achieve 1080x1920 resolution on Display 1? I worth case I don't need boot animation on display 2. Is DRM/KMS backend needed for that?

Kind regards,
Vasyl


Re: QA notification for completed autobuilder build (yocto-3.4.3.rc1)

Teoh, Jay Shen
 

Hello everyone,

This is the full report for yocto-3.4.3.rc3:
https://git.yoctoproject.org/cgit/cgit.cgi/yocto-testresults-contrib/tree/?h=intel-yocto-testresults

======= Summary ========
No high milestone defects.

No new issue found.

Thanks,
Jay

-----Original Message-----
From: yocto@... <yocto@...> On Behalf
Of Teoh, Jay Shen
Sent: Friday, 25 March, 2022 10:20 AM
To: yocto@...; qa-build-notification@...;
OE-core <openembedded-core@...>
Subject: Re: [yocto] QA notification for completed autobuilder build (yocto-
3.4.3.rc1)

Hi all,

Intel and WR YP QA is planning for QA execution for YP build yocto-3.4.3.rc3.
We are planning to execute following tests for this cycle:
Please note that this is the rc3 build for 3.4.3, the rc number was marked to
rc1 by mistake.

OEQA-manual tests for following module:
1. OE-Core
2. BSP-hw

Runtime auto test for following platforms:
1. MinnowTurbot 32-bit
2. Coffee Lake
3. NUC 7
4. NUC 6
5. Edgerouter
6. Beaglebone

ETA for completion next Monday, March 28.

Thanks,
Jay

-----Original Message-----
From: yocto@... <yocto@...> On
Behalf Of Pokybuild User
Sent: Thursday, 24 March, 2022 11:35 PM
To: yocto@...
Cc: qa-build-notification@...
Subject: [yocto] QA notification for completed autobuilder build
(yocto-
3.4.3.rc1)


A build flagged for QA (yocto-3.4.3.rc1) was completed on the
autobuilder and is available at:


https://autobuilder.yocto.io/pub/releases/yocto-3.4.3.rc1


Build hash information:

bitbake: 43dcb2b2a2b95a5c959be57bca94fb7190ea6257
meta-agl: dd8e34ef5383d95d941a3afc9a03d3fcbba699dd
meta-arm: 33bbdc67f2ed7189398292ff58a7fee42a85a166
meta-aws: c92344938ab4d37de8bd8b799186dbbe3019a069
meta-gplv2: f04e4369bf9dd3385165281b9fa2ed1043b0e400
meta-intel: fb9e0633614dbf956da185d291333bcc1b137e5a
meta-mingw: f5d761cbd5c957e4405c5d40b0c236d263c916a8
meta-openembedded: 061b7fc74f887454251307ef119b808a90654d3f
oecore: ebca8f3ac9372b7ebb3d39e8f7f930b63b481448
poky: ee68ae307fd951b9de6b31dc6713ea29186b7749



This is an automated message from the Yocto Project Autobuilder
Git: git://git.yoctoproject.org/yocto-autobuilder2
Email: richard.purdie@...



Re: firewalld isssue #yocto

Nicolas Jeker
 

On Sun, 2022-03-27 at 23:39 -0700, sateesh m wrote:
Hi Team,

                I have built a custom image core-image-base on riscv
target machine installed nftables,firewalld,JSON packages support. I
am using firewalld_0.9.3 sources depends nftables-python is present.
But I am getting error python-nftables. Can you please guide me on
what dependent I missed here? If suppose firewalld should work means,
What packages should  I install?  

But while running firewalld status is always failed mode.  
Using $firewall-cmd --reload  I am facing a  problem

Error: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0:
Error: Could not process rule: No such file or directory
 
Judging by this stack exchange thread[1] from a quick search, you might
be missing the appropriate kernel configs[2].

[1]: https://unix.stackexchange.com/questions/632113
[2]: https://wiki.gentoo.org/wiki/Nftables#Kernel

 
JSON blob:
{"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"raw_PREROUTING", "type": "filter", "hook": "prerouting", "prio": -
290}}}, {"add": {"chain": {"family": "inet", "table": "firewalld",
"name": "mangle_PREROUTING", "type": "filter", "hook": "prerouting",
"prio": -140}}}, {"add": {"chain": {"family": "inet", "table":
"firewalld", "name": "mangle_PREROUTING_POLICIES_pre"}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"mangle_PREROUTING", "expr": [{"jump": {"target":
"mangle_PREROUTING_POLICIES_pre"}}]}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name": "mangle_PREROUTING_ZONES"}}},
{"add": {"rule": {"family": "inet", "table": "firewalld", "chain":
"mangle_PREROUTING", "expr": [{"jump": {"target":
"mangle_PREROUTING_ZONES"}}]}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "mangle_PREROUTING_POLICIES_post"}}},
{"add": {"rule": {"family": "inet", "table": "firewalld", "chain":
"mangle_PREROUTING", "expr": [{"jump": {"target":
"mangle_PREROUTING_POLICIES_post"}}]}}}, {"add": {"chain": {"family":
"ip", "table": "firewalld", "name": "nat_PREROUTING", "type": "nat",
"hook": "prerouting", "prio": -90}}}, {"add": {"chain": {"family":
"ip", "table": "firewalld", "name": "nat_PREROUTING_POLICIES_pre"}}},
{"add": {"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_PREROUTING", "expr": [{"jump": {"target":
"nat_PREROUTING_POLICIES_pre"}}]}}}, {"add": {"chain": {"family":
"ip", "table": "firewalld", "name": "nat_PREROUTING_ZONES"}}},
{"add": {"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_PREROUTING", "expr": [{"jump": {"target":
"nat_PREROUTING_ZONES"}}]}}}, {"add": {"chain": {"family": "ip",
"table": "firewalld", "name": "nat_PREROUTING_POLICIES_post"}}},
{"add": {"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_PREROUTING", "expr": [{"jump": {"target":
"nat_PREROUTING_POLICIES_post"}}]}}}, {"add": {"chain": {"family":
"ip", "table": "firewalld", "name": "nat_POSTROUTING", "type": "nat",
"hook": "postrouting", "prio": 110}}}, {"add": {"chain": {"family":
"ip", "table": "firewalld", "name":
"nat_POSTROUTING_POLICIES_pre"}}}, {"add": {"rule": {"family": "ip",
"table": "firewalld", "chain": "nat_POSTROUTING", "expr": [{"jump":
{"target": "nat_POSTROUTING_POLICIES_pre"}}]}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name":
"nat_POSTROUTING_ZONES"}}}, {"add": {"rule": {"family": "ip",
"table": "firewalld", "chain": "nat_POSTROUTING", "expr": [{"jump":
{"target": "nat_POSTROUTING_ZONES"}}]}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name":
"nat_POSTROUTING_POLICIES_post"}}}, {"add": {"rule": {"family": "ip",
"table": "firewalld", "chain": "nat_POSTROUTING", "expr": [{"jump":
{"target": "nat_POSTROUTING_POLICIES_post"}}]}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name": "nat_PREROUTING",
"type": "nat", "hook": "prerouting", "prio": -90}}}, {"add":
{"chain": {"family": "ip6", "table": "firewalld", "name":
"nat_PREROUTING_POLICIES_pre"}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_PREROUTING", "expr": [{"jump":
{"target": "nat_PREROUTING_POLICIES_pre"}}]}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_PREROUTING_ZONES"}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_PREROUTING", "expr": [{"jump":
{"target": "nat_PREROUTING_ZONES"}}]}}}, {"add": {"chain": {"family":
"ip6", "table": "firewalld", "name":
"nat_PREROUTING_POLICIES_post"}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_PREROUTING", "expr": [{"jump":
{"target": "nat_PREROUTING_POLICIES_post"}}]}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name": "nat_POSTROUTING",
"type": "nat", "hook": "postrouting", "prio": 110}}}, {"add":
{"chain": {"family": "ip6", "table": "firewalld", "name":
"nat_POSTROUTING_POLICIES_pre"}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_POSTROUTING", "expr": [{"jump":
{"target": "nat_POSTROUTING_POLICIES_pre"}}]}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_POSTROUTING_ZONES"}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_POSTROUTING", "expr": [{"jump":
{"target": "nat_POSTROUTING_ZONES"}}]}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_POSTROUTING_POLICIES_post"}}}, {"add": {"rule": {"family":
"ip6", "table": "firewalld", "chain": "nat_POSTROUTING", "expr":
[{"jump": {"target": "nat_POSTROUTING_POLICIES_post"}}]}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_INPUT", "type": "filter", "hook": "input", "prio": 10}}},
{"add": {"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FORWARD", "type": "filter", "hook": "forward", "prio": 10}}},
{"add": {"chain": {"family": "inet", "table": "firewalld", "name":
"filter_OUTPUT", "type": "filter", "hook": "output", "prio": 10}}},
{"add": {"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_INPUT", "expr": [{"match": {"left": {"ct": {"key": "state"}},
"op": "in", "right": {"set": ["established", "related"]}}},
{"accept": null}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "filter_INPUT", "expr": [{"match": {"left":
{"ct": {"key": "status"}}, "op": "in", "right": "dnat"}}, {"accept":
null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld",
"chain": "filter_INPUT", "expr": [{"match": {"left": {"meta": {"key":
"iifname"}}, "op": "==", "right": "lo"}}, {"accept": null}]}}},
{"add": {"chain": {"family": "inet", "table": "firewalld", "name":
"filter_INPUT_POLICIES_pre"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_INPUT", "expr": [{"jump":
{"target": "filter_INPUT_POLICIES_pre"}}]}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_INPUT_ZONES"}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "filter_INPUT", "expr": [{"jump": {"target":
"filter_INPUT_ZONES"}}]}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_INPUT_POLICIES_post"}}},
{"add": {"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_INPUT", "expr": [{"jump": {"target":
"filter_INPUT_POLICIES_post"}}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_INPUT", "expr":
[{"match": {"left": {"ct": {"key": "state"}}, "op": "in", "right":
{"set": ["invalid"]}}}, {"drop": null}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain": "filter_INPUT",
"expr": [{"reject": {"type": "icmpx", "expr": "admin-
prohibited"}}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "filter_FORWARD", "expr": [{"match": {"left":
{"ct": {"key": "state"}}, "op": "in", "right": {"set":
["established", "related"]}}}, {"accept": null}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain": "filter_FORWARD",
"expr": [{"match": {"left": {"ct": {"key": "status"}}, "op": "in",
"right": "dnat"}}, {"accept": null}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_FORWARD", "expr":
[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==",
"right": "lo"}}, {"accept": null}]}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name":
"filter_FORWARD_POLICIES_pre"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FORWARD", "expr": [{"jump":
{"target": "filter_FORWARD_POLICIES_pre"}}]}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_FORWARD_IN_ZONES"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FORWARD", "expr": [{"jump":
{"target": "filter_FORWARD_IN_ZONES"}}]}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_FORWARD_OUT_ZONES"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FORWARD", "expr": [{"jump":
{"target": "filter_FORWARD_OUT_ZONES"}}]}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_FORWARD_POLICIES_post"}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_FORWARD", "expr":
[{"jump": {"target": "filter_FORWARD_POLICIES_post"}}]}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_FORWARD", "expr": [{"match": {"left": {"ct": {"key":
"state"}}, "op": "in", "right": {"set": ["invalid"]}}}, {"drop":
null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld",
"chain": "filter_FORWARD", "expr": [{"reject": {"type": "icmpx",
"expr": "admin-prohibited"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_OUTPUT", "expr": [{"match":
{"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "lo"}},
{"accept": null}]}}}, {"add": {"chain": {"family": "inet", "table":
"firewalld", "name": "filter_OUTPUT_POLICIES_pre"}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_OUTPUT", "expr": [{"jump": {"target":
"filter_OUTPUT_POLICIES_pre"}}]}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name":
"filter_OUTPUT_POLICIES_post"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_OUTPUT", "expr": [{"jump":
{"target": "filter_OUTPUT_POLICIES_post"}}]}}}, {"insert": {"rule":
{"family": "inet", "table": "firewalld", "chain": "raw_PREROUTING",
"expr": [{"match": {"left": {"meta": {"key": "nfproto"}}, "op": "==",
"right": "ipv6"}}, {"match": {"left": {"fib": {"flags": ["saddr",
"iif"], "result": "oif"}}, "op": "==", "right": false}}, {"drop":
null}]}}}, {"insert": {"rule": {"family": "inet", "table":
"firewalld", "chain": "raw_PREROUTING", "expr": [{"match": {"left":
{"payload": {"protocol": "icmpv6", "field": "type"}}, "op": "==",
"right": {"set": ["nd-router-advert", "nd-neighbor-solicit"]}}},
{"accept": null}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "filter_OUTPUT", "index": 0, "expr": [{"match":
{"left": {"payload": {"protocol": "ip6", "field": "daddr"}}, "op":
"==", "right": {"set": [{"prefix": {"addr": "::0.0.0.0", "len": 96}},
{"prefix": {"addr": "::ffff:0.0.0.0", "len": 96}}, {"prefix":
{"addr": "2002:0000::", "len": 24}}, {"prefix": {"addr":
"2002:0a00::", "len": 24}}, {"prefix": {"addr": "2002:7f00::", "len":
24}}, {"prefix": {"addr": "2002:ac10::", "len": 28}}, {"prefix":
{"addr": "2002:c0a8::", "len": 32}}, {"prefix": {"addr":
"2002:a9fe::", "len": 32}}, {"prefix": {"addr": "2002:e000::", "len":
19}}]}}}, {"reject": {"type": "icmpv6", "expr": "addr-
unreachable"}}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "filter_FORWARD", "index": 2, "expr":
[{"match": {"left": {"payload": {"protocol": "ip6", "field":
"daddr"}}, "op": "==", "right": {"set": [{"prefix": {"addr":
"::0.0.0.0", "len": 96}}, {"prefix": {"addr": "::ffff:0.0.0.0",
"len": 96}}, {"prefix": {"addr": "2002:0000::", "len": 24}},
{"prefix": {"addr": "2002:0a00::", "len": 24}}, {"prefix": {"addr":
"2002:7f00::", "len": 24}}, {"prefix": {"addr": "2002:ac10::", "len":
28}}, {"prefix": {"addr": "2002:c0a8::", "len": 32}}, {"prefix":
{"addr": "2002:a9fe::", "len": 32}}, {"prefix": {"addr":
"2002:e000::", "len": 19}}]}}}, {"reject": {"type": "icmpv6", "expr":
"addr-unreachable"}}]}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_IN_public"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_IN_public_pre"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_IN_public_log"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_IN_public_deny"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_IN_public_allow"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_IN_public_post"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_IN_public", "expr": [{"jump":
{"target": "filter_IN_public_pre"}}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_IN_public", "expr":
[{"jump": {"target": "filter_IN_public_log"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain": "filter_IN_public",
"expr": [{"jump": {"target": "filter_IN_public_deny"}}]}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_IN_public", "expr": [{"jump": {"target":
"filter_IN_public_allow"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_IN_public", "expr": [{"jump":
{"target": "filter_IN_public_post"}}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_IN_public_allow",
"expr": [{"match": {"left": {"payload": {"protocol": "tcp", "field":
"dport"}}, "op": "==", "right": 22}}, {"match": {"left": {"ct":
{"key": "state"}}, "op": "in", "right": {"set": ["new",
"untracked"]}}}, {"accept": null}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_IN_public_allow",
"expr": [{"match": {"left": {"payload": {"protocol": "ip6", "field":
"daddr"}}, "op": "==", "right": {"prefix": {"addr": "fe80::", "len":
64}}}}, {"match": {"left": {"payload": {"protocol": "udp", "field":
"dport"}}, "op": "==", "right": 546}}, {"match": {"left": {"ct":
{"key": "state"}}, "op": "in", "right": {"set": ["new",
"untracked"]}}}, {"accept": null}]}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name": "filter_FWDO_public"}}},
{"add": {"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FWDO_public_pre"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_FWDO_public_log"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FWDO_public_deny"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_FWDO_public_allow"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FWDO_public_post"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FWDO_public", "expr":
[{"jump": {"target": "filter_FWDO_public_pre"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_FWDO_public", "expr": [{"jump": {"target":
"filter_FWDO_public_log"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FWDO_public", "expr":
[{"jump": {"target": "filter_FWDO_public_deny"}}]}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_FWDO_public", "expr": [{"jump": {"target":
"filter_FWDO_public_allow"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FWDO_public", "expr":
[{"jump": {"target": "filter_FWDO_public_post"}}]}}}, {"add":
{"chain": {"family": "ip", "table": "firewalld", "name":
"nat_POST_public"}}}, {"add": {"chain": {"family": "ip", "table":
"firewalld", "name": "nat_POST_public_pre"}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name":
"nat_POST_public_log"}}}, {"add": {"chain": {"family": "ip", "table":
"firewalld", "name": "nat_POST_public_deny"}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name":
"nat_POST_public_allow"}}}, {"add": {"chain": {"family": "ip",
"table": "firewalld", "name": "nat_POST_public_post"}}}, {"add":
{"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_POST_public", "expr": [{"jump": {"target":
"nat_POST_public_pre"}}]}}}, {"add": {"rule": {"family": "ip",
"table": "firewalld", "chain": "nat_POST_public", "expr": [{"jump":
{"target": "nat_POST_public_log"}}]}}}, {"add": {"rule": {"family":
"ip", "table": "firewalld", "chain": "nat_POST_public", "expr":
[{"jump": {"target": "nat_POST_public_deny"}}]}}}, {"add": {"rule":
{"family": "ip", "table": "firewalld", "chain": "nat_POST_public",
"expr": [{"jump": {"target": "nat_POST_public_allow"}}]}}}, {"add":
{"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_POST_public", "expr": [{"jump": {"target":
"nat_POST_public_post"}}]}}}, {"add": {"chain": {"family": "ip6",
"table": "firewalld", "name": "nat_POST_public"}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_POST_public_pre"}}}, {"add": {"chain": {"family": "ip6",
"table": "firewalld", "name": "nat_POST_public_log"}}}, {"add":
{"chain": {"family": "ip6", "table": "firewalld", "name":
"nat_POST_public_deny"}}}, {"add": {"chain": {"family": "ip6",
"table": "firewalld", "name": "nat_POST_public_allow"}}}, {"add":
{"chain": {"family": "ip6", "table": "firewalld", "name":
"nat_POST_public_post"}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_POST_public", "expr": [{"jump":
{"target": "nat_POST_public_pre"}}]}}}, {"add": {"rule": {"family":
"ip6", "table": "firewalld", "chain": "nat_POST_public", "expr":
[{"jump": {"target": "nat_POST_public_log"}}]}}}, {"add": {"rule":
{"family": "ip6", "table": "firewalld", "chain": "nat_POST_public",
"expr": [{"jump": {"target": "nat_POST_public_deny"}}]}}}, {"add":
{"rule": {"family": "ip6", "table": "firewalld", "chain":
"nat_POST_public", "expr": [{"jump": {"target":
"nat_POST_public_allow"}}]}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_POST_public", "expr": [{"jump":
{"target": "nat_POST_public_post"}}]}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name": "filter_FWDI_public"}}},
{"add": {"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FWDI_public_pre"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_FWDI_public_log"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FWDI_public_deny"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "filter_FWDI_public_allow"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"filter_FWDI_public_post"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FWDI_public", "expr":
[{"jump": {"target": "filter_FWDI_public_pre"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_FWDI_public", "expr": [{"jump": {"target":
"filter_FWDI_public_log"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FWDI_public", "expr":
[{"jump": {"target": "filter_FWDI_public_deny"}}]}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_FWDI_public", "expr": [{"jump": {"target":
"filter_FWDI_public_allow"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_FWDI_public", "expr":
[{"jump": {"target": "filter_FWDI_public_post"}}]}}}, {"add":
{"chain": {"family": "ip", "table": "firewalld", "name":
"nat_PRE_public"}}}, {"add": {"chain": {"family": "ip", "table":
"firewalld", "name": "nat_PRE_public_pre"}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name":
"nat_PRE_public_log"}}}, {"add": {"chain": {"family": "ip", "table":
"firewalld", "name": "nat_PRE_public_deny"}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name":
"nat_PRE_public_allow"}}}, {"add": {"chain": {"family": "ip",
"table": "firewalld", "name": "nat_PRE_public_post"}}}, {"add":
{"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_PRE_public", "expr": [{"jump": {"target":
"nat_PRE_public_pre"}}]}}}, {"add": {"rule": {"family": "ip",
"table": "firewalld", "chain": "nat_PRE_public", "expr": [{"jump":
{"target": "nat_PRE_public_log"}}]}}}, {"add": {"rule": {"family":
"ip", "table": "firewalld", "chain": "nat_PRE_public", "expr":
[{"jump": {"target": "nat_PRE_public_deny"}}]}}}, {"add": {"rule":
{"family": "ip", "table": "firewalld", "chain": "nat_PRE_public",
"expr": [{"jump": {"target": "nat_PRE_public_allow"}}]}}}, {"add":
{"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_PRE_public", "expr": [{"jump": {"target":
"nat_PRE_public_post"}}]}}}, {"add": {"chain": {"family": "ip6",
"table": "firewalld", "name": "nat_PRE_public"}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_PRE_public_pre"}}}, {"add": {"chain": {"family": "ip6", "table":
"firewalld", "name": "nat_PRE_public_log"}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_PRE_public_deny"}}}, {"add": {"chain": {"family": "ip6",
"table": "firewalld", "name": "nat_PRE_public_allow"}}}, {"add":
{"chain": {"family": "ip6", "table": "firewalld", "name":
"nat_PRE_public_post"}}}, {"add": {"rule": {"family": "ip6", "table":
"firewalld", "chain": "nat_PRE_public", "expr": [{"jump": {"target":
"nat_PRE_public_pre"}}]}}}, {"add": {"rule": {"family": "ip6",
"table": "firewalld", "chain": "nat_PRE_public", "expr": [{"jump":
{"target": "nat_PRE_public_log"}}]}}}, {"add": {"rule": {"family":
"ip6", "table": "firewalld", "chain": "nat_PRE_public", "expr":
[{"jump": {"target": "nat_PRE_public_deny"}}]}}}, {"add": {"rule":
{"family": "ip6", "table": "firewalld", "chain": "nat_PRE_public",
"expr": [{"jump": {"target": "nat_PRE_public_allow"}}]}}}, {"add":
{"rule": {"family": "ip6", "table": "firewalld", "chain":
"nat_PRE_public", "expr": [{"jump": {"target":
"nat_PRE_public_post"}}]}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "mangle_PRE_public"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"mangle_PRE_public_pre"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "mangle_PRE_public_log"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"mangle_PRE_public_deny"}}}, {"add": {"chain": {"family": "inet",
"table": "firewalld", "name": "mangle_PRE_public_allow"}}}, {"add":
{"chain": {"family": "inet", "table": "firewalld", "name":
"mangle_PRE_public_post"}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "mangle_PRE_public", "expr": [{"jump":
{"target": "mangle_PRE_public_pre"}}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "mangle_PRE_public", "expr":
[{"jump": {"target": "mangle_PRE_public_log"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_public", "expr": [{"jump": {"target":
"mangle_PRE_public_deny"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "mangle_PRE_public", "expr": [{"jump":
{"target": "mangle_PRE_public_allow"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_public", "expr": [{"jump": {"target":
"mangle_PRE_public_post"}}]}}}, {"add": {"rule": {"family": "inet",
"table": "firewalld", "chain": "filter_IN_public", "index": 4,
"expr": [{"match": {"left": {"meta": {"key": "l4proto"}}, "op": "==",
"right": {"set": ["icmp", "icmpv6"]}}}, {"accept": null}]}}}, {"add":
{"rule": {"family": "inet", "table": "firewalld", "chain":
"filter_FWDI_public", "index": 4, "expr": [{"match": {"left":
{"meta": {"key": "l4proto"}}, "op": "==", "right": {"set": ["icmp",
"icmpv6"]}}}, {"accept": null}]}}}, {"add": {"rule": {"family":
"inet", "table": "firewalld", "chain": "filter_INPUT_ZONES", "expr":
[{"goto": {"target": "filter_IN_public"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_FORWARD_OUT_ZONES", "expr": [{"goto": {"target":
"filter_FWDO_public"}}]}}}, {"add": {"rule": {"family": "ip",
"table": "firewalld", "chain": "nat_POSTROUTING_ZONES", "expr":
[{"goto": {"target": "nat_POST_public"}}]}}}, {"add": {"rule":
{"family": "ip6", "table": "firewalld", "chain":
"nat_POSTROUTING_ZONES", "expr": [{"goto": {"target":
"nat_POST_public"}}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "filter_FORWARD_IN_ZONES", "expr": [{"goto":
{"target": "filter_FWDI_public"}}]}}}, {"add": {"rule": {"family":
"ip", "table": "firewalld", "chain": "nat_PREROUTING_ZONES", "expr":
[{"goto": {"target": "nat_PRE_public"}}]}}}, {"add": {"rule":
{"family": "ip6", "table": "firewalld", "chain":
"nat_PREROUTING_ZONES", "expr": [{"goto": {"target":
"nat_PRE_public"}}]}}}, {"add": {"rule": {"family": "inet", "table":
"firewalld", "chain": "mangle_PREROUTING_ZONES", "expr": [{"goto":
{"target": "mangle_PRE_public"}}]}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name": "filter_IN_policy_allow-host-
ipv6"}}}, {"add": {"chain": {"family": "inet", "table": "firewalld",
"name": "filter_IN_policy_allow-host-ipv6_pre"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_IN_policy_allow-host-ipv6_log"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_IN_policy_allow-host-ipv6_deny"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_IN_policy_allow-host-ipv6_allow"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"filter_IN_policy_allow-host-ipv6_post"}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_IN_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"filter_IN_policy_allow-host-ipv6_pre"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_IN_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"filter_IN_policy_allow-host-ipv6_log"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_IN_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"filter_IN_policy_allow-host-ipv6_deny"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_IN_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"filter_IN_policy_allow-host-ipv6_allow"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_IN_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"filter_IN_policy_allow-host-ipv6_post"}}]}}}, {"add": {"chain":
{"family": "ip", "table": "firewalld", "name": "nat_PRE_policy_allow-
host-ipv6"}}}, {"add": {"chain": {"family": "ip", "table":
"firewalld", "name": "nat_PRE_policy_allow-host-ipv6_pre"}}}, {"add":
{"chain": {"family": "ip", "table": "firewalld", "name":
"nat_PRE_policy_allow-host-ipv6_log"}}}, {"add": {"chain": {"family":
"ip", "table": "firewalld", "name": "nat_PRE_policy_allow-host-
ipv6_deny"}}}, {"add": {"chain": {"family": "ip", "table":
"firewalld", "name": "nat_PRE_policy_allow-host-ipv6_allow"}}},
{"add": {"chain": {"family": "ip", "table": "firewalld", "name":
"nat_PRE_policy_allow-host-ipv6_post"}}}, {"add": {"rule": {"family":
"ip", "table": "firewalld", "chain": "nat_PRE_policy_allow-host-
ipv6", "expr": [{"jump": {"target": "nat_PRE_policy_allow-host-
ipv6_pre"}}]}}}, {"add": {"rule": {"family": "ip", "table":
"firewalld", "chain": "nat_PRE_policy_allow-host-ipv6", "expr":
[{"jump": {"target": "nat_PRE_policy_allow-host-ipv6_log"}}]}}},
{"add": {"rule": {"family": "ip", "table": "firewalld", "chain":
"nat_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6_deny"}}]}}}, {"add": {"rule":
{"family": "ip", "table": "firewalld", "chain":
"nat_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6_allow"}}]}}}, {"add": {"rule":
{"family": "ip", "table": "firewalld", "chain":
"nat_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6_post"}}]}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_PRE_policy_allow-host-ipv6"}}}, {"add": {"chain": {"family":
"ip6", "table": "firewalld", "name": "nat_PRE_policy_allow-host-
ipv6_pre"}}}, {"add": {"chain": {"family": "ip6", "table":
"firewalld", "name": "nat_PRE_policy_allow-host-ipv6_log"}}}, {"add":
{"chain": {"family": "ip6", "table": "firewalld", "name":
"nat_PRE_policy_allow-host-ipv6_deny"}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_PRE_policy_allow-host-ipv6_allow"}}}, {"add": {"chain":
{"family": "ip6", "table": "firewalld", "name":
"nat_PRE_policy_allow-host-ipv6_post"}}}, {"add": {"rule": {"family":
"ip6", "table": "firewalld", "chain": "nat_PRE_policy_allow-host-
ipv6", "expr": [{"jump": {"target": "nat_PRE_policy_allow-host-
ipv6_pre"}}]}}}, {"add": {"rule": {"family": "ip6", "table":
"firewalld", "chain": "nat_PRE_policy_allow-host-ipv6", "expr":
[{"jump": {"target": "nat_PRE_policy_allow-host-ipv6_log"}}]}}},
{"add": {"rule": {"family": "ip6", "table": "firewalld", "chain":
"nat_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6_deny"}}]}}}, {"add": {"rule":
{"family": "ip6", "table": "firewalld", "chain":
"nat_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6_allow"}}]}}}, {"add": {"rule":
{"family": "ip6", "table": "firewalld", "chain":
"nat_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6_post"}}]}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"mangle_PRE_policy_allow-host-ipv6"}}}, {"add": {"chain": {"family":
"inet", "table": "firewalld", "name": "mangle_PRE_policy_allow-host-
ipv6_pre"}}}, {"add": {"chain": {"family": "inet", "table":
"firewalld", "name": "mangle_PRE_policy_allow-host-ipv6_log"}}},
{"add": {"chain": {"family": "inet", "table": "firewalld", "name":
"mangle_PRE_policy_allow-host-ipv6_deny"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"mangle_PRE_policy_allow-host-ipv6_allow"}}}, {"add": {"chain":
{"family": "inet", "table": "firewalld", "name":
"mangle_PRE_policy_allow-host-ipv6_post"}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"mangle_PRE_policy_allow-host-ipv6_pre"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"mangle_PRE_policy_allow-host-ipv6_log"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"mangle_PRE_policy_allow-host-ipv6_deny"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"mangle_PRE_policy_allow-host-ipv6_allow"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PRE_policy_allow-host-ipv6", "expr": [{"jump": {"target":
"mangle_PRE_policy_allow-host-ipv6_post"}}]}}}, {"insert": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_INPUT_POLICIES_pre", "expr": [{"jump": {"target":
"filter_IN_policy_allow-host-ipv6"}}]}}}, {"insert": {"rule":
{"family": "ip", "table": "firewalld", "chain":
"nat_PREROUTING_POLICIES_pre", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6"}}]}}}, {"insert": {"rule":
{"family": "ip6", "table": "firewalld", "chain":
"nat_PREROUTING_POLICIES_pre", "expr": [{"jump": {"target":
"nat_PRE_policy_allow-host-ipv6"}}]}}}, {"insert": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"mangle_PREROUTING_POLICIES_pre", "expr": [{"jump": {"target":
"mangle_PRE_policy_allow-host-ipv6"}}]}}}, {"add": {"rule":
{"family": "inet", "table": "firewalld", "chain":
"filter_IN_policy_allow-host-ipv6_allow", "expr": [{"match": {"left":
{"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv6"}},
{"match": {"left": {"payload": {"protocol": "icmpv6", "field":
"type"}}, "op": "==", "right": "nd-neighbor-advert"}}, {"accept":
null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld",
"chain": "filter_IN_policy_allow-host-ipv6_allow", "expr": [{"match":
{"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv6"}},
{"match": {"left": {"payload": {"protocol": "icmpv6", "field":
"type"}}, "op": "==", "right": "nd-neighbor-solicit"}}, {"accept":
null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld",
"chain": "filter_IN_policy_allow-host-ipv6_allow", "expr": [{"match":
{"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv6"}},
{"match": {"left": {"payload": {"protocol": "icmpv6", "field":
"type"}}, "op": "==", "right": "nd-router-advert"}}, {"accept":
null}]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld",
"chain": "filter_IN_policy_allow-host-ipv6_allow", "expr": [{"match":
{"left": {"meta": {"key": "nfproto"}}, "op": "==", "right": "ipv6"}},
{"match": {"left": {"payload": {"protocol": "icmpv6", "field":
"type"}}, "op": "==", "right": "nd-redirect"}}, {"accept":
null}]}}}]}
 

--
Regards,
Sateesh