From 70071baf9bc7fe8cf1601106c6a22c61fc1f577e Mon Sep 17 00:00:00 2001
From: Niels Abspoel <aboe76@gmail.com>
Date: Mon, 7 Nov 2022 19:31:11 +0100
Subject: [PATCH] fix(config): update firewalld.conf to be inline with 1.2.1
 version

Added CleanupModulesOnExit
Removed MinimalMark deprecated option
Added some Notes
---
 firewalld/files/firewalld.conf | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/firewalld/files/firewalld.conf b/firewalld/files/firewalld.conf
index 2e209cd..a6c76f4 100644
--- a/firewalld/files/firewalld.conf
+++ b/firewalld/files/firewalld.conf
@@ -11,18 +11,19 @@
 # Default: public
 DefaultZone={{ firewalld.default_zone|default('public') }}
 
-# Minimal mark
-# Marks up to this minimum are free for use for example in the direct 
-# interface. If more free marks are needed, increase the minimum
-# Default: 100
-MinimalMark={{ firewalld.minimal_mark|default('100') }}
-
 # Clean up on exit
 # If set to no or false the firewall configuration will not get cleaned up
-# on exit or stop of firewalld
+# on exit or stop of firewalld.
 # Default: yes
 CleanupOnExit={{ firewalld.cleanup_on_exit|default('yes') }}
 
+# Clean up kernel modules on exit
+# If set to yes or true the firewall related kernel modules will be
+# unloaded on exit or stop of firewalld. This might attempt to unload
+# modules not originally loaded by firewalld.
+# Default: no
+CleanupModulesOnExit={{ firewalld.cleanup_module_on_exit|default('no') }}
+
 # Lockdown
 # If set to enabled, firewall changes with the D-Bus interface will be limited
 # to applications that are listed in the lockdown whitelist.
@@ -32,9 +33,11 @@ Lockdown={{ firewalld.lockdown|default('no') }}
 
 # IPv6_rpfilter
 # Performs a reverse path filter test on a packet for IPv6. If a reply to the
-# packet would be sent via the same interface that the packet arrived on, the 
+# packet would be sent via the same interface that the packet arrived on, the
 # packet will match and be accepted, otherwise dropped.
 # The rp_filter for IPv4 is controlled using sysctl.
+# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
+# for details.
 # Default: yes
 IPv6_rpfilter={{ firewalld.IPv6_rpfilter|default('yes') }}
 {%- if firewalld.get('IndividualCalls', False) %}
@@ -74,6 +77,8 @@ AutomaticHelpers={{ firewalld.AutomaticHelpers|default('sytem') }}
 # Choices are:
 #	- nftables (default)
 #	- iptables (iptables, ip6tables, ebtables and ipset)
+# Note: The iptables backend is deprecated. It will be removed in a future
+# release.
 FirewallBackend={{ firewalld.FirewallBackend|default('nftables') }}
 {%- endif %}
 {%- if firewalld.get('FlushAllOnReload', False) %}