From 4360dd4b4e0bbb9f508d42868035f432955d6fec Mon Sep 17 00:00:00 2001 From: Giacomo Sanchietti Date: Thu, 6 Aug 2026 16:22:13 +0200 Subject: [PATCH] fix(firewall4): raise fw4 open-file limit Applying a large firewall configuration failed part way through and the new rules were silently discarded, leaving the previous ones active while the command still reported success. Building the rules holds one file open per rule template until the whole set is finished, so a large configuration exceeds the limit of 1024 open files. A 320-section configuration needs about 1060. PKG_RELEASE is bumped so the rebuilt package is a visible upgrade and can reach existing installations without a new image. Refs #1869 Assisted-by: Claude Code:claude-sonnet-5 --- .../firewall4/20-raise-nofile-ulimit.patch | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 patches/package/network/config/firewall4/20-raise-nofile-ulimit.patch diff --git a/patches/package/network/config/firewall4/20-raise-nofile-ulimit.patch b/patches/package/network/config/firewall4/20-raise-nofile-ulimit.patch new file mode 100644 index 000000000..402d92da5 --- /dev/null +++ b/patches/package/network/config/firewall4/20-raise-nofile-ulimit.patch @@ -0,0 +1,36 @@ +# Raise fw4's open-file limit so large rulesets can be applied. +# PKG_RELEASE is bumped so this ships as a package update, without a new image. +# https://github.com/NethServer/nethsecurity/issues/1869 +--- firewall4.ori/Makefile ++++ firewall4/Makefile +@@ -5,7 +5,7 @@ + include $(TOPDIR)/rules.mk + + PKG_NAME:=firewall4 +-PKG_RELEASE:=2 ++PKG_RELEASE:=3 + + PKG_SOURCE_PROTO:=git + PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall4.git +--- firewall4.ori/patches/20-raise-nofile-ulimit.patch 1970-01-01 00:00:00.000000000 +0000 ++++ firewall4/patches/20-raise-nofile-ulimit.patch 1970-01-01 00:00:00.000000000 +0000 +@@ -0,0 +1,19 @@ ++Raise the open-file limit before rendering the ruleset. ++ ++Each template include() holds its file descriptor until the whole render ++ends, so a large ruleset exhausts the 1024 soft limit and the render ++aborts, leaving the new ruleset unapplied. Proper fix belongs in ucode. ++ ++--- a/root/sbin/fw4 +++++ b/root/sbin/fw4 ++@@ -2,6 +2,10 @@ ++ ++ set -o pipefail ++ +++# Each template include() holds its fd until the render ends, so a large +++# ruleset exceeds the default 1024 limit. See NethSecurity issue #1869. +++ulimit -HSn 8192 2>/dev/null +++ ++ MAIN=/usr/share/firewall4/main.uc ++ LOCK=/var/run/fw4.lock ++ STATE=/var/run/fw4.state