From 2a0349132a0f77f8551e2bd435219ffcfdc27b2e Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 25 Aug 2026 08:06:01 -0400 Subject: [PATCH] import UBI firewalld-2.4.3-4.el10_2 --- ...all-cmd-handle-no-options-when-not-r.patch | 70 +++++++++++++++++++ ...gration-podman-strict-forward-ports-.patch | 34 +++++++++ firewalld.spec | 10 ++- 3 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 0002-v2.5.0-fix-firewall-cmd-handle-no-options-when-not-r.patch create mode 100644 0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch diff --git a/0002-v2.5.0-fix-firewall-cmd-handle-no-options-when-not-r.patch b/0002-v2.5.0-fix-firewall-cmd-handle-no-options-when-not-r.patch new file mode 100644 index 0000000..fbdd911 --- /dev/null +++ b/0002-v2.5.0-fix-firewall-cmd-handle-no-options-when-not-r.patch @@ -0,0 +1,70 @@ +From e708b004c3f3bb31900051ad30b653040de674ea Mon Sep 17 00:00:00 2001 +From: dharmik +Date: Sat, 4 Jul 2026 17:45:23 +0530 +Subject: [PATCH 2/3] v2.5.0: fix(firewall-cmd): handle no options when not + running + +Avoid reading the firewalld state property when the client is not +connected to the daemon. This lets firewall-cmd print the normal +no-options usage instead of an AttributeError traceback. + +Fixes: #1570 +Signed-off-by: dharmik +--- + src/firewall-cmd.in | 2 +- + src/tests/regression/gh1570.at | 20 ++++++++++++++++++++ + src/tests/regression/regression.at | 1 + + 3 files changed, 22 insertions(+), 1 deletion(-) + create mode 100644 src/tests/regression/gh1570.at + +diff --git a/src/firewall-cmd.in b/src/firewall-cmd.in +index 9c08de548e16..50a51874e100 100755 +--- a/src/firewall-cmd.in ++++ b/src/firewall-cmd.in +@@ -1540,7 +1540,7 @@ if not ( + or options_direct + or options_permanent_only + ): +- state = fw.get_property("state") ++ state = fw.get_property("state") if fw.connected else None + if state == "RUNNING": + state = "State: running\n\n" + elif state == "FAILED": +diff --git a/src/tests/regression/gh1570.at b/src/tests/regression/gh1570.at +new file mode 100644 +index 000000000000..fc365c515ec2 +--- /dev/null ++++ b/src/tests/regression/gh1570.at +@@ -0,0 +1,20 @@ ++FWD_START_TEST([cli - no arguments]) ++AT_KEYWORDS([cli gh1570 RHEL-60902]) ++ ++FWD_STOP_FIREWALLD() ++ ++dnl Verify CLI with no options does not crash if firewalld is not running. ++FWD_CHECK([], [2], [ignore], [dnl ++State: not running ++ ++No options specified ++usage: 'firewall-cmd --help' for usage information or see firewall-cmd(1) man page ++]) ++ ++dnl Verify offline CLI with no options ++FWD_OFFLINE_CHECK([], [2], [ignore], [dnl ++usage: see firewall-offline-cmd man page ++No option specified. ++]) ++ ++FWD_END_TEST() +diff --git a/src/tests/regression/regression.at b/src/tests/regression/regression.at +index 0fe856f4ae9f..032a998ca94c 100644 +--- a/src/tests/regression/regression.at ++++ b/src/tests/regression/regression.at +@@ -64,3 +64,4 @@ m4_include([regression/gh1406.at]) + m4_include([regression/RHEL-67103.at]) + m4_include([regression/gh1486.at]) + m4_include([regression/RHEL-186856.at]) ++m4_include([regression/gh1570.at]) +-- +2.52.0 + diff --git a/0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch b/0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch new file mode 100644 index 0000000..6266180 --- /dev/null +++ b/0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch @@ -0,0 +1,34 @@ +From ca63b915863e7c486f4f41e094f98f46a837f237 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Thu, 16 Jul 2026 15:02:12 -0400 +Subject: [PATCH 3/3] v2.5.0: test(integration): podman-strict-forward-ports: + expect fail with netavark + +Newer podman uses the netavark backend and rejects --publish if +firewalld is running with StrictForwardPorts=yes. Skip the test if this +is detected. + +Fixes: 84b139f109f8 ("test(integration): add coverage for podman and StrictForwardPorts") +(cherry picked from commit d5023f550671cb90bf8e745d470f87f3b7864db3) +--- + src/tests/integration/podman-strict-forward-ports.at | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/tests/integration/podman-strict-forward-ports.at b/src/tests/integration/podman-strict-forward-ports.at +index fa87a9b18842..c9998defdcb0 100644 +--- a/src/tests/integration/podman-strict-forward-ports.at ++++ b/src/tests/integration/podman-strict-forward-ports.at +@@ -70,6 +70,10 @@ common_init() + AT_CHECK([sed -i 's/^StrictForwardPorts.*/StrictForwardPorts=yes/' ./firewalld.conf]) + FWD_RELOAD() + ++dnl If podman is using the netavark backend, then it will refuse to start ++dnl with --publish and firewalld StrictForwardPorts=yes. ++AT_SKIP_IF([test $(basename ${PODMAN}) = "podman" && ! ${PODMAN} run --rm --publish 10.10.10.1:55080:80 quay.io/centos/centos:stream9 ls]) ++ + dnl start a container with --publish + AT_CHECK([$PODMAN run --rm --detach --publish 10.10.10.1:55080:80 quay.io/centos/centos:stream9 sh -c "dnl + echo hello world > index.html && dnl +-- +2.52.0 + diff --git a/firewalld.spec b/firewalld.spec index 7288f72..0b639d8 100644 --- a/firewalld.spec +++ b/firewalld.spec @@ -1,11 +1,13 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld Version: 2.4.3 -Release: 2%{?dist} +Release: 4%{?dist} URL: http://www.firewalld.org License: GPL-2.0-or-later Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2 Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch +Patch2: 0002-v2.5.0-fix-firewall-cmd-handle-no-options-when-not-r.patch +Patch3: 0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch BuildArch: noarch BuildRequires: autoconf BuildRequires: automake @@ -253,6 +255,12 @@ end %{_mandir}/man1/firewall-config*.1* %changelog +* Fri Jun 31 2026 Eric Garver - 2.4.3-4 +- test(integration): podman-strict-forward-ports: expect fail with netavark + +* Fri Jun 31 2026 Eric Garver - 2.4.3-3 +- fix(firewall-cmd): handle no options when not running + * Fri Jun 26 2026 Eric Garver - 2.4.3-2 - rebuild to bump NVR; no changes