Skip to content

Commit

Permalink
firewalld-reload: fix CI tests
Browse files Browse the repository at this point in the history
A new change in firewalld 2.0 no longer flushes all rules. This means
the test cannot check for it. Instead we must check for the trusted
sources that are added in firewalld.

This is causing CI failures on main right now because this test was
merged with CI running on f38 while the update to f39 was just merged
before that.

containers#826
containers#840

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
  • Loading branch information
Luap99 authored and jakecorrenti committed Jan 3, 2024
1 parent 01094d8 commit d28d580
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion test/100-bridge-iptables.bats
Original file line number Diff line number Diff line change
Expand Up @@ -994,18 +994,26 @@ EOF
run_in_host_netns firewall-cmd --reload

# After a firewalld reload we expect rules to be deleted
expected_rc=1 run_in_host_netns iptables -S NETAVARK_FORWARD
# expected_rc=1 run_in_host_netns iptables -S NETAVARK_FORWARD
# There was a firewalld change in 3.0 that it no longer flushes all rules, howver we can still check if
# we are added to trusted.
run_in_host_netns firewall-cmd --zone=trusted --list-sources
assert "$output" == "" "no trusted sources"

# start reload service on start it should restore the rules
run_netavark_firewalld_reload

# this run in the background so give it some time to add the rules
sleep 1
check_simple_bridge_iptables
run_in_host_netns firewall-cmd --zone=trusted --list-sources
assert "$output" == "10.88.0.0/16" "container subnet is trusted after start"

run_in_host_netns firewall-cmd --reload
sleep 1
check_simple_bridge_iptables
run_in_host_netns firewall-cmd --zone=trusted --list-sources
assert "$output" == "10.88.0.0/16" "container subnet is trusted after reload"
}

@test "$fw_driver - port forwarding ipv4 - tcp with firewalld reload" {
Expand Down

0 comments on commit d28d580

Please sign in to comment.