From nobody Sun May 19 15:20:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1654023663138174.22847276912466; Tue, 31 May 2022 12:01:03 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-515-rC5l00jFO3CQcGufg2vllA-1; Tue, 31 May 2022 15:00:32 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id DEE561C08991; Tue, 31 May 2022 19:00:19 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8C0CE40E80E1; Tue, 31 May 2022 19:00:18 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 6BF031947065; Tue, 31 May 2022 19:00:18 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 37AD9194705C for ; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 09B382026D64; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.17.176]) by smtp.corp.redhat.com (Postfix) with ESMTP id D5A752026987; Tue, 31 May 2022 19:00:16 +0000 (UTC) X-MC-Unique: rC5l00jFO3CQcGufg2vllA-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v2 1/5] util: add virFirewallDGetPolicies() Date: Tue, 31 May 2022 15:00:12 -0400 Message-Id: <20220531190016.183541-2-eric@garver.life> In-Reply-To: <20220531190016.183541-1-eric@garver.life> References: <20220531190016.183541-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: laine@redhat.com Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 2.84 on 10.11.54.2 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1654023663564100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/libvirt_private.syms | 1 + src/util/virfirewalld.c | 41 ++++++++++++++++++++++++++++++++++++++++ src/util/virfirewalld.h | 1 + 3 files changed, 43 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index bfedd853268d..64d932e929eb 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2340,6 +2340,7 @@ virFirewallStartTransaction; # util/virfirewalld.h virFirewallDApplyRule; virFirewallDGetBackend; +virFirewallDGetPolicies; virFirewallDGetVersion; virFirewallDGetZones; virFirewallDInterfaceSetZone; diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c index c909901833f7..0912508dbc45 100644 --- a/src/util/virfirewalld.c +++ b/src/util/virfirewalld.c @@ -223,6 +223,47 @@ virFirewallDGetZones(char ***zones, size_t *nzones) return 0; } =20 +/** + * virFirewallDGetPolicies: + * @policies: array of char *, each entry is a null-terminated policy name + * @npolicies: number of entries in @policies + * + * Get the number of currently active firewalld policies, and their names + * in an array of null-terminated strings. The memory pointed to by + * @policies will belong to the caller, and must be freed. + * + * Returns 0 on success, -1 (and failure logged) on error + */ +int +virFirewallDGetPolicies(char ***policies, size_t *npolicies) +{ + GDBusConnection *sysbus =3D virGDBusGetSystemBus(); + g_autoptr(GVariant) reply =3D NULL; + g_autoptr(GVariant) array =3D NULL; + + *npolicies =3D 0; + *policies =3D NULL; + + if (!sysbus) + return -1; + + if (virGDBusCallMethod(sysbus, + &reply, + G_VARIANT_TYPE("(as)"), + NULL, + VIR_FIREWALL_FIREWALLD_SERVICE, + "/org/fedoraproject/FirewallD1", + "org.fedoraproject.FirewallD1.policy", + "getPolicies", + NULL) < 0) + return -1; + + g_variant_get(reply, "(@as)", &array); + *policies =3D g_variant_dup_strv(array, npolicies); + + return 0; +} + =20 /** * virFirewallDZoneExists: diff --git a/src/util/virfirewalld.h b/src/util/virfirewalld.h index c396802a2f56..ef05896e2b8b 100644 --- a/src/util/virfirewalld.h +++ b/src/util/virfirewalld.h @@ -33,6 +33,7 @@ int virFirewallDGetVersion(unsigned long *version); int virFirewallDGetBackend(void); int virFirewallDIsRegistered(void); int virFirewallDGetZones(char ***zones, size_t *nzones); +int virFirewallDGetPolicies(char ***policies, size_t *npolicies); bool virFirewallDZoneExists(const char *match); int virFirewallDApplyRule(virFirewallLayer layer, char **args, size_t argsLen, --=20 2.35.3 From nobody Sun May 19 15:20:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 165402363965147.84307366262351; Tue, 31 May 2022 12:00:39 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-595-o0gFJEiQMEyWdPTsjIvOYg-1; Tue, 31 May 2022 15:00:32 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.rdu2.redhat.com [10.11.54.1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 8D15285704F; Tue, 31 May 2022 19:00:21 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 72D3640D0168; Tue, 31 May 2022 19:00:21 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 73C531947B93; Tue, 31 May 2022 19:00:19 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 54568194705C for ; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 44CE42026D64; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.17.176]) by smtp.corp.redhat.com (Postfix) with ESMTP id 1BB372026D2D; Tue, 31 May 2022 19:00:17 +0000 (UTC) X-MC-Unique: o0gFJEiQMEyWdPTsjIvOYg-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v2 2/5] util: add virFirewallDPolicyExists() Date: Tue, 31 May 2022 15:00:13 -0400 Message-Id: <20220531190016.183541-3-eric@garver.life> In-Reply-To: <20220531190016.183541-1-eric@garver.life> References: <20220531190016.183541-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: laine@redhat.com Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 2.84 on 10.11.54.1 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1654023641368100006 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/libvirt_private.syms | 1 + src/util/virfirewalld.c | 31 +++++++++++++++++++++++++++++++ src/util/virfirewalld.h | 1 + 3 files changed, 33 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 64d932e929eb..9ea3062f75e9 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2345,6 +2345,7 @@ virFirewallDGetVersion; virFirewallDGetZones; virFirewallDInterfaceSetZone; virFirewallDIsRegistered; +virFirewallDPolicyExists; virFirewallDSynchronize; virFirewallDZoneExists; =20 diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c index 0912508dbc45..ad879164c3a8 100644 --- a/src/util/virfirewalld.c +++ b/src/util/virfirewalld.c @@ -296,6 +296,37 @@ virFirewallDZoneExists(const char *match) } =20 =20 +/** + * virFirewallDPolicyExists: + * @match: name of policy to look for + * + * Returns true if the requested policy exists, or false if it doesn't exi= st + */ +bool +virFirewallDPolicyExists(const char *match) +{ + size_t npolicies =3D 0, i; + char **policies =3D NULL; + bool result =3D false; + + if (virFirewallDGetPolicies(&policies, &npolicies) < 0) + goto cleanup; + + for (i =3D 0; i < npolicies; i++) { + if (STREQ_NULLABLE(policies[i], match)) + result =3D true; + } + + cleanup: + VIR_DEBUG("Requested policy '%s' %s exist", + match, result ? "does" : "doesn't"); + for (i =3D 0; i < npolicies; i++) + VIR_FREE(policies[i]); + VIR_FREE(policies); + return result; +} + + /** * virFirewallDApplyRule: * @layer: which layer to apply the rule to diff --git a/src/util/virfirewalld.h b/src/util/virfirewalld.h index ef05896e2b8b..fa4c9e702ccb 100644 --- a/src/util/virfirewalld.h +++ b/src/util/virfirewalld.h @@ -35,6 +35,7 @@ int virFirewallDIsRegistered(void); int virFirewallDGetZones(char ***zones, size_t *nzones); int virFirewallDGetPolicies(char ***policies, size_t *npolicies); bool virFirewallDZoneExists(const char *match); +bool virFirewallDPolicyExists(const char *match); int virFirewallDApplyRule(virFirewallLayer layer, char **args, size_t argsLen, bool ignoreErrors, --=20 2.35.3 From nobody Sun May 19 15:20:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1654023638598260.68829110749334; Tue, 31 May 2022 12:00:38 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-270-d_EjqLdkOsekKfjW6XJphw-1; Tue, 31 May 2022 15:00:35 -0400 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id DC9FD3810D44; Tue, 31 May 2022 19:00:19 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id BBB74492CA2; Tue, 31 May 2022 19:00:19 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 929D61947074; Tue, 31 May 2022 19:00:18 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 8E696194705C for ; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 831BC2026D64; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.17.176]) by smtp.corp.redhat.com (Postfix) with ESMTP id 573542026985; Tue, 31 May 2022 19:00:17 +0000 (UTC) X-MC-Unique: d_EjqLdkOsekKfjW6XJphw-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v2 3/5] network: firewalld: add zone for routed networks Date: Tue, 31 May 2022 15:00:14 -0400 Message-Id: <20220531190016.183541-4-eric@garver.life> In-Reply-To: <20220531190016.183541-1-eric@garver.life> References: <20220531190016.183541-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: laine@redhat.com Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1654023639531100003 Content-Type: text/plain; charset="utf-8"; x-default="true" This zone will be used for the routed network by default. Note that this zone definition omits "forward" aka intra-zone forwarding, because it requires firewalld >=3D 0.9.0. Signed-off-by: Eric Garver --- src/network/libvirt-routed.zone | 10 ++++++++++ src/network/meson.build | 5 +++++ 2 files changed, 15 insertions(+) create mode 100644 src/network/libvirt-routed.zone diff --git a/src/network/libvirt-routed.zone b/src/network/libvirt-routed.z= one new file mode 100644 index 000000000000..ed7dd936a242 --- /dev/null +++ b/src/network/libvirt-routed.zone @@ -0,0 +1,10 @@ + + + libvirt-routed + + + This zone is intended to be used only by routed libvirt virtual networ= ks - + libvirt will add the bridge devices for all new virtual networks to th= is + zone by default. + + diff --git a/src/network/meson.build b/src/network/meson.build index b5eff0c3ab6b..d12e36ce1ca3 100644 --- a/src/network/meson.build +++ b/src/network/meson.build @@ -100,5 +100,10 @@ if conf.has('WITH_NETWORK') install_dir: prefix / 'lib' / 'firewalld' / 'zones', rename: [ 'libvirt.xml' ], ) + install_data( + 'libvirt-routed.zone', + install_dir: prefix / 'lib' / 'firewalld' / 'zones', + rename: [ 'libvirt-routed.xml' ], + ) endif endif --=20 2.35.3 From nobody Sun May 19 15:20:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1654023646431739.2001765252317; Tue, 31 May 2022 12:00:46 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-262-qPsOcLL1MW-d4P9tjHiLPw-1; Tue, 31 May 2022 15:00:42 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B65FB1C006B3; Tue, 31 May 2022 19:00:22 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 97F202166B26; Tue, 31 May 2022 19:00:22 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id D0DEB19451EF; Tue, 31 May 2022 19:00:20 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id DD3F2194705C for ; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id C0DB62026985; Tue, 31 May 2022 19:00:17 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.17.176]) by smtp.corp.redhat.com (Postfix) with ESMTP id 95EA62026D64; Tue, 31 May 2022 19:00:17 +0000 (UTC) X-MC-Unique: qPsOcLL1MW-d4P9tjHiLPw-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v2 4/5] network: firewalld: add policies for routed networks Date: Tue, 31 May 2022 15:00:15 -0400 Message-Id: <20220531190016.183541-5-eric@garver.life> In-Reply-To: <20220531190016.183541-1-eric@garver.life> References: <20220531190016.183541-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: laine@redhat.com Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.6 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1654023647378100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/network/libvirt-routed-in.policy | 11 +++++++++++ src/network/libvirt-routed-out.policy | 12 ++++++++++++ src/network/libvirt-to-host.policy | 20 ++++++++++++++++++++ src/network/meson.build | 15 +++++++++++++++ 4 files changed, 58 insertions(+) create mode 100644 src/network/libvirt-routed-in.policy create mode 100644 src/network/libvirt-routed-out.policy create mode 100644 src/network/libvirt-to-host.policy diff --git a/src/network/libvirt-routed-in.policy b/src/network/libvirt-rou= ted-in.policy new file mode 100644 index 000000000000..dd691efbb64c --- /dev/null +++ b/src/network/libvirt-routed-in.policy @@ -0,0 +1,11 @@ + + + libvirt-routed-in + + + This policy is used to allow routed traffic to the virtual machines. + + + + + diff --git a/src/network/libvirt-routed-out.policy b/src/network/libvirt-ro= uted-out.policy new file mode 100644 index 000000000000..efa0030569d6 --- /dev/null +++ b/src/network/libvirt-routed-out.policy @@ -0,0 +1,12 @@ + + + libvirt-routed-out + + + This policy is used to allow routed virtual machine traffic to the res= t of + the network. + + + + + diff --git a/src/network/libvirt-to-host.policy b/src/network/libvirt-to-ho= st.policy new file mode 100644 index 000000000000..b20aecaf4249 --- /dev/null +++ b/src/network/libvirt-to-host.policy @@ -0,0 +1,20 @@ + + + libvirt-to-host + + + This policy is used to filter traffic from virtual machines to the + host. + + + + + + + + + + + + + diff --git a/src/network/meson.build b/src/network/meson.build index d12e36ce1ca3..49ffad24f405 100644 --- a/src/network/meson.build +++ b/src/network/meson.build @@ -105,5 +105,20 @@ if conf.has('WITH_NETWORK') install_dir: prefix / 'lib' / 'firewalld' / 'zones', rename: [ 'libvirt-routed.xml' ], ) + install_data( + 'libvirt-to-host.policy', + install_dir: prefix / 'lib' / 'firewalld' / 'policies', + rename: [ 'libvirt-to-host.xml' ], + ) + install_data( + 'libvirt-routed-out.policy', + install_dir: prefix / 'lib' / 'firewalld' / 'policies', + rename: [ 'libvirt-routed-out.xml' ], + ) + install_data( + 'libvirt-routed-in.policy', + install_dir: prefix / 'lib' / 'firewalld' / 'policies', + rename: [ 'libvirt-routed-in.xml' ], + ) endif endif --=20 2.35.3 From nobody Sun May 19 15:20:11 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1654023637644569.9727167142196; Tue, 31 May 2022 12:00:37 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-2-msCF4UJBPzCt4F_zEaspjg-1; Tue, 31 May 2022 15:00:32 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id A0E0138149C5; Tue, 31 May 2022 19:00:20 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 8E67F1121314; Tue, 31 May 2022 19:00:20 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 0DD591947B87; Tue, 31 May 2022 19:00:19 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 19F5F194705C for ; Tue, 31 May 2022 19:00:18 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 06ECE2026D2D; Tue, 31 May 2022 19:00:18 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.17.176]) by smtp.corp.redhat.com (Postfix) with ESMTP id D26AE2026D64; Tue, 31 May 2022 19:00:17 +0000 (UTC) X-MC-Unique: msCF4UJBPzCt4F_zEaspjg-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v2 5/5] network: firewalld: add support for routed networks Date: Tue, 31 May 2022 15:00:16 -0400 Message-Id: <20220531190016.183541-6-eric@garver.life> In-Reply-To: <20220531190016.183541-1-eric@garver.life> References: <20220531190016.183541-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: laine@redhat.com Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZM-MESSAGEID: 1654023639376100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/network/bridge_driver_linux.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_= linux.c index 98d2a33a1da0..c96d8f624b4d 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -858,8 +858,17 @@ int networkAddFirewallRules(virNetworkDef *def) * nftables + default zone means that traffic cannot be * forwarded (and even DHCP and DNS from guest to host * will probably no be permitted by the default zone + * + * Routed networks use a different zone and policy which we al= so + * need to verify exist. Probing for the policy guarantees the + * running firewalld has support for policies (firewalld >=3D = 0.9.0). */ - if (virFirewallDZoneExists("libvirt")) { + if (def->forward.type =3D=3D VIR_NETWORK_FORWARD_ROUTE && + virFirewallDPolicyExists("libvirt-routed-out") && + virFirewallDZoneExists("libvirt-routed")) { + if (virFirewallDInterfaceSetZone(def->bridge, "libvirt-rou= ted") < 0) + return -1; + } else if (virFirewallDZoneExists("libvirt")) { if (virFirewallDInterfaceSetZone(def->bridge, "libvirt") <= 0) return -1; } else { --=20 2.35.3