From 69d2b50b16015315f39ec0cb612e02bd3671c4f3 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Fri, 31 Jul 2026 16:40:11 -0400 Subject: [PATCH] test(integration): podman-strict-forward-ports: expect fail with netavark Resolves: RHEL-86710 --- ...gration-podman-strict-forward-ports-.patch | 34 +++++++++++++++++++ firewalld.spec | 6 +++- 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch diff --git a/0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch b/0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch new file mode 100644 index 0000000..6266180 --- /dev/null +++ b/0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch @@ -0,0 +1,34 @@ +From ca63b915863e7c486f4f41e094f98f46a837f237 Mon Sep 17 00:00:00 2001 +From: Eric Garver +Date: Thu, 16 Jul 2026 15:02:12 -0400 +Subject: [PATCH 3/3] v2.5.0: test(integration): podman-strict-forward-ports: + expect fail with netavark + +Newer podman uses the netavark backend and rejects --publish if +firewalld is running with StrictForwardPorts=yes. Skip the test if this +is detected. + +Fixes: 84b139f109f8 ("test(integration): add coverage for podman and StrictForwardPorts") +(cherry picked from commit d5023f550671cb90bf8e745d470f87f3b7864db3) +--- + src/tests/integration/podman-strict-forward-ports.at | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/tests/integration/podman-strict-forward-ports.at b/src/tests/integration/podman-strict-forward-ports.at +index fa87a9b18842..c9998defdcb0 100644 +--- a/src/tests/integration/podman-strict-forward-ports.at ++++ b/src/tests/integration/podman-strict-forward-ports.at +@@ -70,6 +70,10 @@ common_init() + AT_CHECK([sed -i 's/^StrictForwardPorts.*/StrictForwardPorts=yes/' ./firewalld.conf]) + FWD_RELOAD() + ++dnl If podman is using the netavark backend, then it will refuse to start ++dnl with --publish and firewalld StrictForwardPorts=yes. ++AT_SKIP_IF([test $(basename ${PODMAN}) = "podman" && ! ${PODMAN} run --rm --publish 10.10.10.1:55080:80 quay.io/centos/centos:stream9 ls]) ++ + dnl start a container with --publish + AT_CHECK([$PODMAN run --rm --detach --publish 10.10.10.1:55080:80 quay.io/centos/centos:stream9 sh -c "dnl + echo hello world > index.html && dnl +-- +2.52.0 + diff --git a/firewalld.spec b/firewalld.spec index 6686514..0b639d8 100644 --- a/firewalld.spec +++ b/firewalld.spec @@ -1,12 +1,13 @@ Summary: A firewall daemon with D-Bus interface providing a dynamic firewall Name: firewalld Version: 2.4.3 -Release: 3%{?dist} +Release: 4%{?dist} URL: http://www.firewalld.org License: GPL-2.0-or-later Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.bz2 Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch Patch2: 0002-v2.5.0-fix-firewall-cmd-handle-no-options-when-not-r.patch +Patch3: 0003-v2.5.0-test-integration-podman-strict-forward-ports-.patch BuildArch: noarch BuildRequires: autoconf BuildRequires: automake @@ -254,6 +255,9 @@ end %{_mandir}/man1/firewall-config*.1* %changelog +* Fri Jun 31 2026 Eric Garver - 2.4.3-4 +- test(integration): podman-strict-forward-ports: expect fail with netavark + * Fri Jun 31 2026 Eric Garver - 2.4.3-3 - fix(firewall-cmd): handle no options when not running