From nobody Fri May 17 06:07:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) client-ip=170.10.129.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1663859643; cv=none; d=zohomail.com; s=zohoarc; b=FtA12/ze743GXzD4HQoSdLfnNwAXNliFCyhzVcyXo0s4t/yv1N7nJnQ0kxsXcVVLYYJGRj1QjgAOXo6gdEiIwAFskKY2rkrp5yYhwGER8TOHOpl8Xkapg5aPYFBd7Rtjj9NV4vH6TttHXgHOVfZ81O2+i8qkdfb2FQjOJubQ7MM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1663859643; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=c+l/MD8+lMKI3ph2UDm1QD73KdtByCLQVxHTVDHQkaM=; b=acMJTM70oyhTyBmbmwNRas/u98x/4axikhjOCjzDDo8A1qE46kjZr7dRj7As2zqBu1wikXWdEgp9avG9nEFnskUcLznwrnWXiJir5JuQzBzO1w9cwPsgGTcB7m4j8lGS5VIXmeUspXZ4ejzkh6K8KJhqqI/R4umewVPaEbQl7OM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.zohomail.com with SMTPS id 1663859643684545.2217668537528; Thu, 22 Sep 2022 08:14:03 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-26-p5xTC6SoNlSp8vgJ3uQcfA-1; Thu, 22 Sep 2022 11:13:33 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 9AD6319711D2; Thu, 22 Sep 2022 15:13:29 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 7E8B440C6EC6; Thu, 22 Sep 2022 15:13:29 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 6BA001946A78; Thu, 22 Sep 2022 15:13:28 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id DFA6E19465A4 for ; Thu, 22 Sep 2022 15:13:26 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id C561C1121333; Thu, 22 Sep 2022 15:13:26 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.34.107]) by smtp.corp.redhat.com (Postfix) with ESMTP id 79B2E1121331; Thu, 22 Sep 2022 15:13:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1663859642; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=c+l/MD8+lMKI3ph2UDm1QD73KdtByCLQVxHTVDHQkaM=; b=Bj2tpl8qycQRfkbl9vCqTE24ZbxEPwQF24OfAd3gb5La27UkzKwUaJzZm54yH7c61gl99i pMDGCG5cxyQKXjClLuenT8HceCF+sVdzgk2d6j0ZyFZml7kpBurOo9SjxhTEms8n+jbO+8 Zct3X9Xx0GV0JMDr3l2h9cgwZRB2VoI= X-MC-Unique: p5xTC6SoNlSp8vgJ3uQcfA-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v3 1/5] util: add virFirewallDGetPolicies() Date: Thu, 22 Sep 2022 11:13:20 -0400 Message-Id: <20220922151324.1650415-2-eric@garver.life> In-Reply-To: <20220922151324.1650415-1-eric@garver.life> References: <20220922151324.1650415-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.3 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laine Stump Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1663859644641100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/libvirt_private.syms | 1 + src/util/virfirewalld.c | 41 ++++++++++++++++++++++++++++++++++++++++ src/util/virfirewalld.h | 1 + 3 files changed, 43 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 25794bc2f417..32c8bdeb23ee 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2370,6 +2370,7 @@ virFirewallStartTransaction; # util/virfirewalld.h virFirewallDApplyRule; virFirewallDGetBackend; +virFirewallDGetPolicies; virFirewallDGetVersion; virFirewallDGetZones; virFirewallDInterfaceSetZone; diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c index c909901833f7..0912508dbc45 100644 --- a/src/util/virfirewalld.c +++ b/src/util/virfirewalld.c @@ -223,6 +223,47 @@ virFirewallDGetZones(char ***zones, size_t *nzones) return 0; } =20 +/** + * virFirewallDGetPolicies: + * @policies: array of char *, each entry is a null-terminated policy name + * @npolicies: number of entries in @policies + * + * Get the number of currently active firewalld policies, and their names + * in an array of null-terminated strings. The memory pointed to by + * @policies will belong to the caller, and must be freed. + * + * Returns 0 on success, -1 (and failure logged) on error + */ +int +virFirewallDGetPolicies(char ***policies, size_t *npolicies) +{ + GDBusConnection *sysbus =3D virGDBusGetSystemBus(); + g_autoptr(GVariant) reply =3D NULL; + g_autoptr(GVariant) array =3D NULL; + + *npolicies =3D 0; + *policies =3D NULL; + + if (!sysbus) + return -1; + + if (virGDBusCallMethod(sysbus, + &reply, + G_VARIANT_TYPE("(as)"), + NULL, + VIR_FIREWALL_FIREWALLD_SERVICE, + "/org/fedoraproject/FirewallD1", + "org.fedoraproject.FirewallD1.policy", + "getPolicies", + NULL) < 0) + return -1; + + g_variant_get(reply, "(@as)", &array); + *policies =3D g_variant_dup_strv(array, npolicies); + + return 0; +} + =20 /** * virFirewallDZoneExists: diff --git a/src/util/virfirewalld.h b/src/util/virfirewalld.h index c396802a2f56..ef05896e2b8b 100644 --- a/src/util/virfirewalld.h +++ b/src/util/virfirewalld.h @@ -33,6 +33,7 @@ int virFirewallDGetVersion(unsigned long *version); int virFirewallDGetBackend(void); int virFirewallDIsRegistered(void); int virFirewallDGetZones(char ***zones, size_t *nzones); +int virFirewallDGetPolicies(char ***policies, size_t *npolicies); bool virFirewallDZoneExists(const char *match); int virFirewallDApplyRule(virFirewallLayer layer, char **args, size_t argsLen, --=20 2.35.3 From nobody Fri May 17 06:07:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1663859648; cv=none; d=zohomail.com; s=zohoarc; b=IGBAGgFXBrWVYas3OyN6g1LxtXUPoj0W2kBd6x4RkSzOXzmDrzZ027cTgLxSqjt/2RJzAbn7CWfNvb4TuGacouEga4wBJKTJILVBpb/byarNzlgSoHoWvOaZ1enyVV6KWI6jAKeUdBzFg10JdMHJAyKMUSPsfE8XHZsrJYUnprg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1663859648; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=RPkEx2WbBL9p0Rl4NLjQQIT95LriKocujC2r90Xs+X0=; b=B81gBlsyPpFjqX0FjYMRujuSQVX834o8sah4FG9lv64I+Am9OGd6/fTHx4mLEud5ehMrtkSCP5dEjrykagS+9mgxDbAjm0dYcaQkH73S7Wd1HCCiP+C7/nh1ueltZBE2pEtarDpXyVJRq6fsLh+A4/zaDD08eh4jxT9qmW+XlPQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1663859648279787.7732576528564; Thu, 22 Sep 2022 08:14:08 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-515-VGgJhi6AMDiu9G6s1r_xkQ-1; Thu, 22 Sep 2022 11:13:32 -0400 Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 554C73C1005B; Thu, 22 Sep 2022 15:13:29 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id CD4694B3FC6; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id BD6E819465B7; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 6504719465A4 for ; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 3C33C1121333; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.34.107]) by smtp.corp.redhat.com (Postfix) with ESMTP id E49361121331; Thu, 22 Sep 2022 15:13:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1663859646; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=RPkEx2WbBL9p0Rl4NLjQQIT95LriKocujC2r90Xs+X0=; b=MhxClu60u5XS0jVeea3Hr547Q+lsWQjWZgV+EDH2oHgzRq9uv/GmLwhXMFv2/id0G8jIvx E9zqKZx2arg2SIpxMpPV5bWqYf/Qzjh5fRsNGL3OMitZAqWKnNNzM4Ywv6XBxHkywuuTiS Ou/FQtlpvC6Sw+bcJt9CgUKDMfXX8wU= X-MC-Unique: VGgJhi6AMDiu9G6s1r_xkQ-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v3 2/5] util: add virFirewallDPolicyExists() Date: Thu, 22 Sep 2022 11:13:21 -0400 Message-Id: <20220922151324.1650415-3-eric@garver.life> In-Reply-To: <20220922151324.1650415-1-eric@garver.life> References: <20220922151324.1650415-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.3 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laine Stump Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.9 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1663859648646100005 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/libvirt_private.syms | 1 + src/util/virfirewalld.c | 31 +++++++++++++++++++++++++++++++ src/util/virfirewalld.h | 1 + 3 files changed, 33 insertions(+) diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 32c8bdeb23ee..92b6062fabda 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -2375,6 +2375,7 @@ virFirewallDGetVersion; virFirewallDGetZones; virFirewallDInterfaceSetZone; virFirewallDIsRegistered; +virFirewallDPolicyExists; virFirewallDSynchronize; virFirewallDZoneExists; =20 diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c index 0912508dbc45..ad879164c3a8 100644 --- a/src/util/virfirewalld.c +++ b/src/util/virfirewalld.c @@ -296,6 +296,37 @@ virFirewallDZoneExists(const char *match) } =20 =20 +/** + * virFirewallDPolicyExists: + * @match: name of policy to look for + * + * Returns true if the requested policy exists, or false if it doesn't exi= st + */ +bool +virFirewallDPolicyExists(const char *match) +{ + size_t npolicies =3D 0, i; + char **policies =3D NULL; + bool result =3D false; + + if (virFirewallDGetPolicies(&policies, &npolicies) < 0) + goto cleanup; + + for (i =3D 0; i < npolicies; i++) { + if (STREQ_NULLABLE(policies[i], match)) + result =3D true; + } + + cleanup: + VIR_DEBUG("Requested policy '%s' %s exist", + match, result ? "does" : "doesn't"); + for (i =3D 0; i < npolicies; i++) + VIR_FREE(policies[i]); + VIR_FREE(policies); + return result; +} + + /** * virFirewallDApplyRule: * @layer: which layer to apply the rule to diff --git a/src/util/virfirewalld.h b/src/util/virfirewalld.h index ef05896e2b8b..fa4c9e702ccb 100644 --- a/src/util/virfirewalld.h +++ b/src/util/virfirewalld.h @@ -35,6 +35,7 @@ int virFirewallDIsRegistered(void); int virFirewallDGetZones(char ***zones, size_t *nzones); int virFirewallDGetPolicies(char ***policies, size_t *npolicies); bool virFirewallDZoneExists(const char *match); +bool virFirewallDPolicyExists(const char *match); int virFirewallDApplyRule(virFirewallLayer layer, char **args, size_t argsLen, bool ignoreErrors, --=20 2.35.3 From nobody Fri May 17 06:07:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1663859621; cv=none; d=zohomail.com; s=zohoarc; b=Edt6WqXdLcQSynGVdRf6ZBbRHpIyWIsswBY+j/af654zHUQV725TW4DqFJ/OPMwCqj0fqupgASjBC/weDGogiq8la0S+P16in5XU1sAPRLDyCxxv9j1O7r3oPOzs79K/ieocUalmtTyLHioNMduFl9uUmoxQiKHsYL7ARG9PHDo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1663859621; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=07iozpWg8d1VnWkUBk43X6ySq/S2c7Ta2mTQgXmEJTs=; b=RmYbsAEv7TAVLnTwCljs/HRDBV2YUIQewE1/AjlpSzQjgzyai1tRR2IZJmNTwOV2T/3Ms35yi5G3xvrsWpDpqoTGM20pzoz/oJa+1RqVg+u9C4i8RNYh+W+JemNAZQadX2QWmT7fv56AXMh3XZY4dpIT/huGWH+BrmM+QqnS7IM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1663859621223465.9093022530126; Thu, 22 Sep 2022 08:13:41 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-196-R29WvDaMOEeqiZc6lTM44Q-1; Thu, 22 Sep 2022 11:13:38 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 6E18D8ADCA2; Thu, 22 Sep 2022 15:13:35 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 5AEB118EB3; Thu, 22 Sep 2022 15:13:35 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 37F561946A69; Thu, 22 Sep 2022 15:13:31 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id B046D19465A4 for ; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id A2C701121333; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.34.107]) by smtp.corp.redhat.com (Postfix) with ESMTP id 59DCC1121331; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1663859620; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=07iozpWg8d1VnWkUBk43X6ySq/S2c7Ta2mTQgXmEJTs=; b=WwMOnMIPEvraBIZxJ8/11aXY9KKa4deZFlRUh/a0AoUR6wb8Z4r0TYmJxQsLJ8Rf8c6uEC Ymzskpg1XNQNcvJDzMRR6kL+7AZuv3e7yIx7y/EacqLO2AMHLGsrmo0AkUbV6sjjamM5WO Som4zvaDVBOKrf3tYJcr8aUwAFdClIg= X-MC-Unique: R29WvDaMOEeqiZc6lTM44Q-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v3 3/5] network: firewalld: add zone for routed networks Date: Thu, 22 Sep 2022 11:13:22 -0400 Message-Id: <20220922151324.1650415-4-eric@garver.life> In-Reply-To: <20220922151324.1650415-1-eric@garver.life> References: <20220922151324.1650415-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.3 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laine Stump Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.5 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1663859622405100005 Content-Type: text/plain; charset="utf-8"; x-default="true" This zone will be used for the routed network by default. Note that this zone definition omits "forward" aka intra-zone forwarding, because it requires firewalld >=3D 0.9.0. Signed-off-by: Eric Garver --- src/network/libvirt-routed.zone | 10 ++++++++++ src/network/meson.build | 5 +++++ 2 files changed, 15 insertions(+) create mode 100644 src/network/libvirt-routed.zone diff --git a/src/network/libvirt-routed.zone b/src/network/libvirt-routed.z= one new file mode 100644 index 000000000000..ed7dd936a242 --- /dev/null +++ b/src/network/libvirt-routed.zone @@ -0,0 +1,10 @@ + + + libvirt-routed + + + This zone is intended to be used only by routed libvirt virtual networ= ks - + libvirt will add the bridge devices for all new virtual networks to th= is + zone by default. + + diff --git a/src/network/meson.build b/src/network/meson.build index 395074a0a0a6..dcb31af6448b 100644 --- a/src/network/meson.build +++ b/src/network/meson.build @@ -101,5 +101,10 @@ if conf.has('WITH_NETWORK') install_dir: prefix / 'lib' / 'firewalld' / 'zones', rename: [ 'libvirt.xml' ], ) + install_data( + 'libvirt-routed.zone', + install_dir: prefix / 'lib' / 'firewalld' / 'zones', + rename: [ 'libvirt-routed.xml' ], + ) endif endif --=20 2.35.3 From nobody Fri May 17 06:07:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1663859619; cv=none; d=zohomail.com; s=zohoarc; b=bJkjNUFVrsKbYdLlN7efsMFKrDJamfUlFyn1gYCZ68t01jrAGXoCj/HG7iO3QzBXFjAtBKyzY4aPt+2aYMKM3l7x06xgOjyXYYA7BanXEX95mbvdsDOCg8XBzgCIYhMBZyDPSztpTXBMf4BhVeMDVltZINCFIEPjzTe4BvBZoHA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1663859619; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=kia8clN+zsRZZb0rqI9gC655YTBpR/PdZdXXOnJ2no8=; b=XqSYhwu6q9Qjz+s0zGDOnxx0fKMzzfPuWLZvb4waCvChy2gFcfECUoVFBkr0Fswhfc2FaHCdcNcEN9d0C9fdJsySiky/PwoUU1tAnd192fzNyuVqaHxsURHhGdsqwOEu0KfMnaocikoWZlNV9Oe+jtjJDujtk/J5yygAE6LL+a8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1663859619390174.52003901868147; Thu, 22 Sep 2022 08:13:39 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-228-SPKwtYg-Ox61exGLdhJUIA-1; Thu, 22 Sep 2022 11:13:34 -0400 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id AB91A1C07825; Thu, 22 Sep 2022 15:13:32 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9909E140EBF4; Thu, 22 Sep 2022 15:13:32 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 08FA11946A72; Thu, 22 Sep 2022 15:13:30 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 208931946A6E for ; Thu, 22 Sep 2022 15:13:28 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 16FBC1121333; Thu, 22 Sep 2022 15:13:28 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.34.107]) by smtp.corp.redhat.com (Postfix) with ESMTP id C2D181121331; Thu, 22 Sep 2022 15:13:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1663859617; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=kia8clN+zsRZZb0rqI9gC655YTBpR/PdZdXXOnJ2no8=; b=KHfKJkCCGmqy16L7U7mb9kcDsGUdhfFIIhn0xr353TrEBgkGn7C3nfU7ATemc0CCq4Khwq mjpDsynHwnIZfltgQgcBrROcqvAefcj4H+ar7K9ewrqYjN8E+HdP2LLxSEJevgb/5XH29E yTMsS0vtQiDU/n2UGlzv39aDMMhP28w= X-MC-Unique: SPKwtYg-Ox61exGLdhJUIA-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v3 4/5] network: firewalld: add policies for routed networks Date: Thu, 22 Sep 2022 11:13:23 -0400 Message-Id: <20220922151324.1650415-5-eric@garver.life> In-Reply-To: <20220922151324.1650415-1-eric@garver.life> References: <20220922151324.1650415-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.3 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laine Stump Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.7 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1663859620393100001 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/network/libvirt-routed-in.policy | 11 +++++++++++ src/network/libvirt-routed-out.policy | 12 ++++++++++++ src/network/libvirt-to-host.policy | 20 ++++++++++++++++++++ src/network/meson.build | 15 +++++++++++++++ 4 files changed, 58 insertions(+) create mode 100644 src/network/libvirt-routed-in.policy create mode 100644 src/network/libvirt-routed-out.policy create mode 100644 src/network/libvirt-to-host.policy diff --git a/src/network/libvirt-routed-in.policy b/src/network/libvirt-rou= ted-in.policy new file mode 100644 index 000000000000..dd691efbb64c --- /dev/null +++ b/src/network/libvirt-routed-in.policy @@ -0,0 +1,11 @@ + + + libvirt-routed-in + + + This policy is used to allow routed traffic to the virtual machines. + + + + + diff --git a/src/network/libvirt-routed-out.policy b/src/network/libvirt-ro= uted-out.policy new file mode 100644 index 000000000000..efa0030569d6 --- /dev/null +++ b/src/network/libvirt-routed-out.policy @@ -0,0 +1,12 @@ + + + libvirt-routed-out + + + This policy is used to allow routed virtual machine traffic to the res= t of + the network. + + + + + diff --git a/src/network/libvirt-to-host.policy b/src/network/libvirt-to-ho= st.policy new file mode 100644 index 000000000000..b20aecaf4249 --- /dev/null +++ b/src/network/libvirt-to-host.policy @@ -0,0 +1,20 @@ + + + libvirt-to-host + + + This policy is used to filter traffic from virtual machines to the + host. + + + + + + + + + + + + + diff --git a/src/network/meson.build b/src/network/meson.build index dcb31af6448b..26b95367748f 100644 --- a/src/network/meson.build +++ b/src/network/meson.build @@ -106,5 +106,20 @@ if conf.has('WITH_NETWORK') install_dir: prefix / 'lib' / 'firewalld' / 'zones', rename: [ 'libvirt-routed.xml' ], ) + install_data( + 'libvirt-to-host.policy', + install_dir: prefix / 'lib' / 'firewalld' / 'policies', + rename: [ 'libvirt-to-host.xml' ], + ) + install_data( + 'libvirt-routed-out.policy', + install_dir: prefix / 'lib' / 'firewalld' / 'policies', + rename: [ 'libvirt-routed-out.xml' ], + ) + install_data( + 'libvirt-routed-in.policy', + install_dir: prefix / 'lib' / 'firewalld' / 'policies', + rename: [ 'libvirt-routed-in.xml' ], + ) endif endif --=20 2.35.3 From nobody Fri May 17 06:07:42 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1663859620; cv=none; d=zohomail.com; s=zohoarc; b=i8PTYQLV6IDqpeh00S0a7BIR0BqCHjPtGN6rd3Rd3mYy74MZHAtMyl+Gd/6zQFy4qCMG0zN/zNKcZMpSjVvZdKLT/UJJBhFUFry3C2RguycZi+Vp8radR/4Dj8IF7xJa0ciPULLyIfjh9117Bt5Uu/pFQ9zTKo6EUNR1+CObPCA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1663859620; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=qz5zggcIRg63Abq2IDbyaRslMZL3xXzN+LL8A0M9VEg=; b=S1+FeuwXyCiiptapWENr4TBXf8slPDOB3hKXzcqWxS3aGwYCO1l+AyziLwwIqL3GfoeZ4ETpPxEv8O/EHjsdzBDelLESaVZW1QGT8Je/Xs70hCyLJcpzvBtP+AnjwlF96VC7xlmwLb25R15LFWj2hOdwh8Qo44bmSteYuMfrZ/I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1663859619999170.31163557978584; Thu, 22 Sep 2022 08:13:39 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-186-XJvHN55FMS2w1pVNwmrVSQ-1; Thu, 22 Sep 2022 11:13:33 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 5AC7D857F90; Thu, 22 Sep 2022 15:13:30 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 48D2640C6EC2; Thu, 22 Sep 2022 15:13:30 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id DA5021946A69; Thu, 22 Sep 2022 15:13:29 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id 95E0E1947040 for ; Thu, 22 Sep 2022 15:13:28 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id 7BDBD111F3B0; Thu, 22 Sep 2022 15:13:28 +0000 (UTC) Received: from egarver.remote.csb (unknown [10.22.34.107]) by smtp.corp.redhat.com (Postfix) with ESMTP id 356A11121331; Thu, 22 Sep 2022 15:13:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1663859618; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=qz5zggcIRg63Abq2IDbyaRslMZL3xXzN+LL8A0M9VEg=; b=OfBsE5mEqcdyfbvD6L2lJ9zrGVZpynTVy9pIEP0xH9zs/w6XocmD1HctJGiKRub1XqkzRH zA9aJjxeX+GMyijg/lv5+Ygn5t8UqPWAciK8+XzhLgLEoU/ZiTwolcbU8Fhw/UuW4m6gwB PRaepVj24TkZkfxl0r+uQnVncHqFzoA= X-MC-Unique: XJvHN55FMS2w1pVNwmrVSQ-1 X-Original-To: libvir-list@listman.corp.redhat.com From: Eric Garver To: libvir-list@redhat.com Subject: [PATCH v3 5/5] network: firewalld: add support for routed networks Date: Thu, 22 Sep 2022 11:13:24 -0400 Message-Id: <20220922151324.1650415-6-eric@garver.life> In-Reply-To: <20220922151324.1650415-1-eric@garver.life> References: <20220922151324.1650415-1-eric@garver.life> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.3 X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Laine Stump Errors-To: libvir-list-bounces@redhat.com Sender: "libvir-list" X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1663859620400100002 Content-Type: text/plain; charset="utf-8"; x-default="true" Signed-off-by: Eric Garver --- src/network/bridge_driver_linux.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_= linux.c index a0f593b06636..d9597d91beed 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -857,8 +857,17 @@ int networkAddFirewallRules(virNetworkDef *def) * nftables + default zone means that traffic cannot be * forwarded (and even DHCP and DNS from guest to host * will probably no be permitted by the default zone + * + * Routed networks use a different zone and policy which we al= so + * need to verify exist. Probing for the policy guarantees the + * running firewalld has support for policies (firewalld >=3D = 0.9.0). */ - if (virFirewallDZoneExists("libvirt")) { + if (def->forward.type =3D=3D VIR_NETWORK_FORWARD_ROUTE && + virFirewallDPolicyExists("libvirt-routed-out") && + virFirewallDZoneExists("libvirt-routed")) { + if (virFirewallDInterfaceSetZone(def->bridge, "libvirt-rou= ted") < 0) + return -1; + } else if (virFirewallDZoneExists("libvirt")) { if (virFirewallDInterfaceSetZone(def->bridge, "libvirt") <= 0) return -1; } else { --=20 2.35.3