fix:nftables always flush main table on start

backport-chore-nftables-add-delete-table-helper.patch

@@ -0,0 +1,44 @@
+From 8be561d26931832f000526cc41293700faa6c877 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Mon, 14 Aug 2023 09:13:29 -0400
+Subject: [PATCH] chore(nftables): add delete table helper
+
+This is to workaround an nftables issue where using the "delete" verb on
+a table that does not exist will throw ENOENT. We can't use the newer
+"destroy" verb because it's too new to rely upon.
+
+A simple hack is to always add the table before deleting it. The "add"
+is ignored if the table already exists.
+
+Conflict: NA
+Reference: https://github.com/firewalld/firewalld/commit/8be561d26931832f000526cc41293700faa6c877
+
+---
+ src/firewall/core/nftables.py | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
+index f269afa9..ce8cb5e7 100644
+--- a/src/firewall/core/nftables.py
++++ b/src/firewall/core/nftables.py
+@@ -383,6 +383,17 @@ class nftables:
+         # Tables always exist in nftables
+         return [table] if table else IPTABLES_TO_NFT_HOOK.keys()
+ 
++    def _build_delete_table_rules(self, table):
++        # To avoid nftables returning ENOENT we always add the table before
++        # deleting to guarantee it will exist.
++        #
++        # In the future, this add+delete should be replaced with "destroy", but
++        # that verb is too new to rely upon.
++        return [{"add": {"table": {"family": "inet",
++                                   "name": table}}},
++                {"delete": {"table": {"family": "inet",
++                                      "name": table}}}]
++
+     def build_flush_rules(self):
+         # Policy is stashed in a separate table that we're _not_ going to
+         # flush. As such, we retain the policy rule handles and ref counts.
+-- 
+2.33.0
+

backport-fix-nftables-always-flush-main-table-on-start.patch

@@ -0,0 +1,39 @@
+From 6a155ea7195f2c720625e2452afa41544b4b4227 Mon Sep 17 00:00:00 2001
+From: Eric Garver <eric@garver.life>
+Date: Thu, 10 Aug 2023 08:43:03 -0400
+Subject: [PATCH] fix(nftables): always flush main table on start
+
+On start created_tables will not contain the main "firewalld" table so a
+flush command is not issued. We should always attempt to flush. If
+CleanupOnExit=no, then not flushing causes duplicate rules on restart.
+
+Fixes: rhbz2222044
+
+Conflict: NA
+Reference: https://github.com/firewalld/firewalld/commit/6a155ea7195f2c720625e2452afa41544b4b4227
+
+---
+ src/firewall/core/nftables.py | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/src/firewall/core/nftables.py b/src/firewall/core/nftables.py
+index 975f1fa..f7f5bb0 100644
+--- a/src/firewall/core/nftables.py
++++ b/src/firewall/core/nftables.py
+@@ -410,12 +410,9 @@ class nftables(object):
+         self.policy_priority_counts = {}
+         self.zone_source_index_cache = {}
+ 
+-        rules = []
+         if TABLE_NAME in self.created_tables["inet"]:
+-            rules.append({"delete": {"table": {"family": "inet",
+-                                               "name": TABLE_NAME}}})
+             self.created_tables["inet"].remove(TABLE_NAME)
+-        return rules
++        return self._build_delete_table_rules(TABLE_NAME)
+ 
+     def _build_set_policy_rules_ct_rules(self, enable):
+         add_del = { True: "add", False: "delete" }[enable]
+-- 
+2.33.0
+

firewalld.spec

@@ -1,6 +1,6 @@
 Name:      firewalld
 Version:   1.0.2
-Release:   5
+Release:   6
 Summary:   A firewall daemon with D-Bus interface providing a dynamic firewall
 License:   GPLv2+
 URL:       http://www.firewalld.org
@@ -17,6 +17,9 @@ Patch6:    backport-fix-functions-check-config-fails-if-direct.xml-exists.patch
 Patch7:    backport-fix-service-adding-includes-to-a-built-in-service.patch
 Patch8:    0001-fix-config-Specify-the-translation-encoding-format-a.patch
 
+Patch9:    backport-chore-nftables-add-delete-table-helper.patch
+Patch10:   backport-fix-nftables-always-flush-main-table-on-start.patch
+
 BuildArch:     noarch
 BuildRequires: autoconf automake desktop-file-utils gettext intltool glib2 glib2-devel systemd-units docbook-style-xsl
 BuildRequires: libxslt iptables ebtables ipset python3-devel
@@ -237,6 +240,13 @@ fi
 %{_datadir}/firewalld/testsuite/python/firewalld_test.py
 
 %changelog
+* Tue Sep 26 2023 zhanghao <zhanghao383@huawei.com> - 1.0.2-6
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:chore nftables add delete table helper
+       nftables always flush main table on start
+
 * Mon Nov 14 2022 luoqing <luoqing@kylinsec.com.cn> - 1.0.2-5
 - Type:bugfix
 - ID:NA