systemd: fix unnecessary nftables initialization by backporting upstream (#16994)

Author: nbojanic

SPECS-SIGNED/systemd-boot-signed/systemd-boot-signed.spec

@@ -20,7 +20,7 @@ Version:        255
 # determine the build information from local checkout
 Version:        %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/')
 %endif
-Release:        28%{?dist}
+Release:        29%{?dist}
 License:        LGPL-2.1-or-later AND MIT AND GPL-2.0-or-later
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -98,6 +98,9 @@ popd
 /boot/efi/EFI/BOOT/%{grubefiname}
 
 %changelog
+* Thu May 28 2026 Nikola Bojanic <nbojanic@microsoft.com> - 255-29
+- Bump release to match systemd spec
+
 * Tue Apr 21 2026 Akhila Guruju <v-guakhila@microsoft.com> - 255-28
 - Bump release to match systemd spec
 

SPECS/systemd/networkd-address-skip-firewall-init.patch

@@ -0,0 +1,30 @@
+From 0d7bbcef27b8f435640427ae1f28627e46fe514d Mon Sep 17 00:00:00 2001
+From: Topi Miettinen <toiwoton@gmail.com>
+Date: Mon, 4 Dec 2023 21:49:12 +0200
+Subject: [PATCH] network/networkd-address: don't set up firewall rules here
+
+Don't set up firewall rules when we're just initializing the firewall context
+for NFT sets.
+
+Fixes: #30257
+(cherry picked from commit 58c6e75f263a1562f5550221af1ec1a9b6046143)
+---
+ src/network/networkd-address.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/network/networkd-address.c b/src/network/networkd-address.c
+index c1a8cd884a..7071137676 100644
+--- a/src/network/networkd-address.c
++++ b/src/network/networkd-address.c
+@@ -645,7 +645,7 @@ static void address_modify_nft_set_context(Address *address, bool add, NFTSetCon
+         assert(nft_set_context);
+ 
+         if (!address->link->manager->fw_ctx) {
+-                r = fw_ctx_new(&address->link->manager->fw_ctx);
++                r = fw_ctx_new_full(&address->link->manager->fw_ctx, /* init_tables= */ false);
+                 if (r < 0)
+                         return;
+         }
+-- 
+2.45.4
+

SPECS/systemd/systemd.spec

@@ -50,7 +50,7 @@ Version:        255
 # determine the build information from local checkout
 Version:        %(tools/meson-vcs-tag.sh . error | sed -r 's/-([0-9])/.^\1/; s/-g/_g/')
 %endif
-Release:        28%{?dist}
+Release:        29%{?dist}
 
 # FIXME - hardcode to 'stable' for now as that's what we have in our blobstore
 %global stable 1
@@ -152,6 +152,7 @@ Patch0908:      ipc-call-0004-core-validate-input-cgroup-path-more-prudently.pat
 Patch0909:      fix-pcrlock-hyperv-hash-algorithm-ordering.patch
 Patch0910:      CVE-2026-40226.patch
 Patch0911:      CVE-2026-40225.patch
+Patch0912:      networkd-address-skip-firewall-init.patch
 
 %ifarch %{ix86} x86_64 aarch64
 %global want_bootloader 1
@@ -1237,6 +1238,10 @@ rm -f %{name}.lang
 # %autochangelog. So we need to continue manually maintaining the
 # changelog here.
 %changelog
+* Thu May 28 2026 Nikola Bojanic <nbojanic@microsoft.com> - 255-29
+- Fix unwanted nftables initialization in systemd-networkd by backporting
+  upstream commit 58c6e75 from systemd v256 (PR #30318).
+
 * Tue Apr 21 2026 Akhila Guruju <v-guakhila@microsoft.com> - 255-28
 - Patch CVE-2026-40226, CVE-2026-40225