This virFirewall object will store the list of actions required to
remove the firewall that was added for the currently active instance
of the network, so it has been named "fwRemoval".

There are no uses of the fwRemoval object in the virNetworkObj yet,
but everything is in place to add it to the XML when formatted, parse
it from the XML when reading network status, and freeing the
virFirewall object with the virNetworkObj is freed.

Signed-off-by: Laine Stump <laine@redhat.com>
---
 src/conf/virnetworkobj.c | 39 +++++++++++++++++++++++++++++++++++++++
 src/conf/virnetworkobj.h | 11 +++++++++++
 src/libvirt_private.syms |  3 +++
 3 files changed, 53 insertions(+)

diff --git a/src/conf/virnetworkobj.c b/src/conf/virnetworkobj.c
index b8b86da06f..ae26f6fab1 100644
--- a/src/conf/virnetworkobj.c
+++ b/src/conf/virnetworkobj.c
@@ -55,6 +55,11 @@ struct _virNetworkObj {
 
     unsigned int taint;
 
+    /* fwRemoval contains all commands needed to remove the firewall
+     * that was added for this network.
+     */
+    virFirewall *fwRemoval;
+
     /* Immutable pointer, self locking APIs */
     virMacMap *macmap;
 
@@ -239,6 +244,28 @@ virNetworkObjSetFloorSum(virNetworkObj *obj,
 }
 
 
+virFirewall **
+virNetworkObjGetFwRemovalPtr(virNetworkObj *obj)
+{
+    return &obj->fwRemoval;
+}
+
+
+virFirewall *
+virNetworkObjGetFwRemoval(virNetworkObj *obj)
+{
+    return obj->fwRemoval;
+}
+
+
+void
+virNetworkObjSetFwRemoval(virNetworkObj *obj,
+                          virFirewall *fwRemoval)
+{
+    obj->fwRemoval = fwRemoval;
+}
+
+
 void
 virNetworkObjSetMacMap(virNetworkObj *obj,
                        virMacMap **macmap)
@@ -444,6 +471,7 @@ virNetworkObjDispose(void *opaque)
     virNetworkDefFree(obj->newDef);
     virBitmapFree(obj->classIdMap);
     virObjectUnref(obj->macmap);
+    virFirewallFree(obj->fwRemoval);
 }
 
 
@@ -800,6 +828,9 @@ virNetworkObjFormat(virNetworkObj *obj,
     if (virNetworkDefFormatBuf(&buf, obj->def, xmlopt, flags) < 0)
         return NULL;
 
+    if (obj->fwRemoval && virFirewallFormat(&buf, obj->fwRemoval) < 0)
+        return NULL;
+
     virBufferAdjustIndent(&buf, -2);
     virBufferAddLit(&buf, "</networkstatus>");
 
@@ -834,6 +865,7 @@ virNetworkLoadState(virNetworkObjList *nets,
     g_autofree char *configFile = NULL;
     g_autoptr(virNetworkDef) def = NULL;
     virNetworkObj *obj = NULL;
+    g_autoptr(virFirewall) fwRemoval = NULL;
     g_autoptr(xmlDoc) xml = NULL;
     xmlNodePtr node = NULL;
     g_autoptr(xmlXPathContext) ctxt = NULL;
@@ -876,6 +908,7 @@ virNetworkLoadState(virNetworkObjList *nets,
         g_autofree char *classIdStr = NULL;
         g_autofree char *floor_sum = NULL;
         g_autofree xmlNodePtr *nodes = NULL;
+        xmlNodePtr fwNode;
 
         ctxt->node = node;
         if ((classIdStr = virXPathString("string(./class_id[1]/@bitmap)",
@@ -910,6 +943,10 @@ virNetworkLoadState(virNetworkObjList *nets,
                 taint |= (1 << flag);
             }
         }
+        if ((fwNode = virXPathNode("./firewall", ctxt))
+            && virFirewallParseXML(&fwRemoval, fwNode, ctxt) < 0) {
+            return NULL;
+        }
     }
 
     /* create the object */
@@ -918,6 +955,8 @@ virNetworkLoadState(virNetworkObjList *nets,
 
     def = NULL;
 
+    virNetworkObjSetFwRemoval(obj, g_steal_pointer(&fwRemoval));
+
     /* assign status data stored in the network object */
     if (classIdMap) {
         virBitmapFree(obj->classIdMap);
diff --git a/src/conf/virnetworkobj.h b/src/conf/virnetworkobj.h
index 7d34fa3204..12669b83cf 100644
--- a/src/conf/virnetworkobj.h
+++ b/src/conf/virnetworkobj.h
@@ -23,6 +23,7 @@
 
 #include "network_conf.h"
 #include "virnetworkportdef.h"
+#include "virfirewall.h"
 
 typedef struct _virNetworkObj virNetworkObj;
 
@@ -76,6 +77,16 @@ void
 virNetworkObjSetFloorSum(virNetworkObj *obj,
                          unsigned long long floor_sum);
 
+virFirewall **
+virNetworkObjGetFwRemovalPtr(virNetworkObj *obj);
+
+virFirewall *
+virNetworkObjGetFwRemoval(virNetworkObj *obj);
+
+void
+virNetworkObjSetFwRemoval(virNetworkObj *obj,
+                          virFirewall *fwRemoval);
+
 void
 virNetworkObjSetMacMap(virNetworkObj *obj,
                        virMacMap **macmap);
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 1666da633d..fe023d56c3 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1290,6 +1290,8 @@ virNetworkObjGetClassIdMap;
 virNetworkObjGetDef;
 virNetworkObjGetDnsmasqPid;
 virNetworkObjGetFloorSum;
+virNetworkObjGetFwRemoval;
+virNetworkObjGetFwRemovalPtr;
 virNetworkObjGetMacMap;
 virNetworkObjGetNewDef;
 virNetworkObjGetPersistentDef;
@@ -1320,6 +1322,7 @@ virNetworkObjSetDef;
 virNetworkObjSetDefTransient;
 virNetworkObjSetDnsmasqPid;
 virNetworkObjSetFloorSum;
+virNetworkObjSetFwRemoval;
 virNetworkObjSetMacMap;
 virNetworkObjTaint;
 virNetworkObjUnrefMacMap;
-- 
2.39.2