What happened

Since 3874baf, firewalld defers ipset entry adds by using the GLib mainloop. This means firewalld reports RUNNING and the traffic policy is ACCEPT before the ipsets are actually applied.

This means that an ipset that is used to drop specific traffic may not actually drop that traffic until the ipsets are applied in the background. Unwanted traffic may be accepted.

What you expected to happen

firewalld should not do set_policy(ACCEPT) until the ipset entries are fully applied. This can be solved by deferring the call to set_policy() to the GLib mainloop after the ipset entries have been queued.

How to reproduce it (as minimally and precisely as possible)

No response

Anything else we need to know?

No response

Firewalld Version

main

Firewalld Backend

No response

Linux distribution

No response

Linux kernel version

No response

Other information

No response