From nobody Sun Feb 8 12:26:30 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1725556167921726.8731330869668; Thu, 5 Sep 2024 10:09:27 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 996) id D763D17FC; Thu, 5 Sep 2024 13:09:26 -0400 (EDT) Received: from lists.libvirt.org (localhost [IPv6:::1]) by lists.libvirt.org (Postfix) with ESMTP id 6FBFB177E; Thu, 5 Sep 2024 13:08:12 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 996) id E83B11751; Thu, 5 Sep 2024 13:08:05 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 5817A1622 for ; Thu, 5 Sep 2024 13:08:05 -0400 (EDT) Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-272-XIuWLPjZORaqUfG2fpXMmA-1; Thu, 05 Sep 2024 13:08:03 -0400 Received: from mx-prod-int-02.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-02.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.15]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 1E59219560B4 for ; Thu, 5 Sep 2024 17:08:03 +0000 (UTC) Received: from vhost3.router.laine.org (unknown [10.22.16.247]) by mx-prod-int-02.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 604511956086 for ; Thu, 5 Sep 2024 17:08:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on lists.libvirt.org X-Spam-Level: *** X-Spam-Status: No, score=3.0 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,RCVD_IN_SBL_CSS,SPF_HELO_NONE, T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.4 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1725556085; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Oi+owi1lNOHpKZXAu2szi1YSHcBnxQMfo2bP3dGofnk=; b=eNuzxGIO92xO0AhcMiXd6Ek8eEJprTvBWmJz0kbXrC2fDpwpirLvQZwTFdGQmzbNXy6SMv OdRbZ8KhLPTuBTbdK4H3UUU9/Eav3vnwk940vUznIM51+jEPzegVe+1f9bnecW/7wl7C5Z PyjPwRPAMshS4nJDo1lMSnLXcB9zua4= X-MC-Unique: XIuWLPjZORaqUfG2fpXMmA-1 From: Laine Stump To: devel@lists.libvirt.org Subject: [PATCH 3/5] network: support setting firewalld zone for bridge device of open networks Date: Thu, 5 Sep 2024 13:07:57 -0400 Message-ID: <20240905170759.864299-4-laine@redhat.com> In-Reply-To: <20240905170759.864299-1-laine@redhat.com> References: <20240905170759.864299-1-laine@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.15 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: E7MGXIJF2YEBLOP5DQJJXFDJWCZRKXQM X-Message-ID-Hash: E7MGXIJF2YEBLOP5DQJJXFDJWCZRKXQM X-MailFrom: laine@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-config-1; header-match-config-2; header-match-config-3; header-match-devel.lists.libvirt.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header X-Mailman-Version: 3.2.2 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1725556169772116600 Content-Type: text/plain; charset="utf-8"; x-default="true" The bit of code that sets the firewalld zone was previously a part of the function networkAddFirewallRules(), which is not called for networks with . Setting the 'libvirt' zone for the bridge device of virtual networks that also add firewall rules is usually necessary in order to get the expected traffic through without modifying firewalld's default zone (which would be a bad idea, because that would affect all the other host interfaces set to the default zone), but in general we would *not* want the bridge device for a mode=3D'open' virtual network to be automatically placed in the "libvirt" zone, a user might want to *explicitly* set some other firewalld zone for mode=3D'open' networks. We enable this by moving the code that sets the firewalld zone into a separate function that is called for all forward modes that use a bridge device created by libvirt (nat, route, isolated, open). If no zone is specified, then the bridge device will be in whatever zone interfaces are put in by default, but if the element has a "zone" attribute, then the new bridge device will be placed in the specified zone. NB: This function is only called when the network is started, and *not* when the firewall rules of an active network are reloaded at virtnetworkd restart time, because the firewalld zone of an interface isn't something that gets inadvertantly changed as a part of some other unrelated action (e.g. all iptables rules are cleared by a firewalld restart, including those rules added by libvirt), and so we don't need to be re-setting it all the time. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/215 Signed-off-by: Laine Stump Reviewed-by: Martin Kletzander --- src/network/bridge_driver.c | 4 ++ src/network/bridge_driver_linux.c | 61 ++++++++++++++++------------ src/network/bridge_driver_nop.c | 13 ++++++ src/network/bridge_driver_platform.h | 2 + 4 files changed, 54 insertions(+), 26 deletions(-) diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 915211d1b5..3504d512a0 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -1957,6 +1957,10 @@ networkStartNetworkVirtual(virNetworkDriverState *dr= iver, if (networkSetIPv6Sysctls(obj) < 0) goto error; =20 + /* set the firewall zone for the bridge device on the host */ + if (networkSetBridgeZone(def) < 0) + goto error; + /* Add "once per network" rules */ if (def->forward.type !=3D VIR_NETWORK_FORWARD_OPEN && networkAddFirewallRules(def, cfg->firewallBackend, &fwRemoval) < 0= ) { diff --git a/src/network/bridge_driver_linux.c b/src/network/bridge_driver_= linux.c index fe7c6e193c..a6203a712e 100644 --- a/src/network/bridge_driver_linux.c +++ b/src/network/bridge_driver_linux.c @@ -333,28 +333,8 @@ int networkCheckRouteCollision(virNetworkDef *def) =20 =20 int -networkAddFirewallRules(virNetworkDef *def, - virFirewallBackend firewallBackend, - virFirewall **fwRemoval) +networkSetBridgeZone(virNetworkDef *def) { - - networkSetupPrivateChains(firewallBackend, false); - - if (errInitV4 && - (virNetworkDefGetIPByIndex(def, AF_INET, 0) || - virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { - virSetError(errInitV4); - return -1; - } - - if (errInitV6 && - (virNetworkDefGetIPByIndex(def, AF_INET6, 0) || - virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || - def->ipv6nogw)) { - virSetError(errInitV6); - return -1; - } - if (def->bridgeZone) { =20 /* if a firewalld zone has been specified, fail/log an error @@ -370,12 +350,14 @@ networkAddFirewallRules(virNetworkDef *def, if (virFirewallDInterfaceSetZone(def->bridge, def->bridgeZone) < 0) return -1; =20 - } else { + } else if (def->forward.type !=3D VIR_NETWORK_FORWARD_OPEN) { =20 - /* if firewalld is active, try to set the "libvirt" zone. This is - * desirable (for consistency) if firewalld is using the iptables - * backend, but is necessary (for basic network connectivity) if - * firewalld is using the nftables backend + /* if firewalld is active, try to set the "libvirt" zone by + * default (forward mode=3D'open' networks have no zone set by + * default, but we honor it if one is specified). This is + * desirable (for consistency) if firewalld is using the + * iptables backend, but is necessary (for basic network + * connectivity) if firewalld is using the nftables backend */ if (virFirewallDIsRegistered() =3D=3D 0) { =20 @@ -421,6 +403,33 @@ networkAddFirewallRules(virNetworkDef *def, } } =20 + return 0; +} + + +int +networkAddFirewallRules(virNetworkDef *def, + virFirewallBackend firewallBackend, + virFirewall **fwRemoval) +{ + + networkSetupPrivateChains(firewallBackend, false); + + if (errInitV4 && + (virNetworkDefGetIPByIndex(def, AF_INET, 0) || + virNetworkDefGetRouteByIndex(def, AF_INET, 0))) { + virSetError(errInitV4); + return -1; + } + + if (errInitV6 && + (virNetworkDefGetIPByIndex(def, AF_INET6, 0) || + virNetworkDefGetRouteByIndex(def, AF_INET6, 0) || + def->ipv6nogw)) { + virSetError(errInitV6); + return -1; + } + switch (firewallBackend) { case VIR_FIREWALL_BACKEND_NONE: virReportError(VIR_ERR_NO_SUPPORT, "%s", diff --git a/src/network/bridge_driver_nop.c b/src/network/bridge_driver_no= p.c index 8bf3367bff..20c7a2a595 100644 --- a/src/network/bridge_driver_nop.c +++ b/src/network/bridge_driver_nop.c @@ -38,6 +38,19 @@ int networkCheckRouteCollision(virNetworkDef *def G_GNUC= _UNUSED) return 0; } =20 + +int +networkSetBridgeZone(virNetworkDef *def) +{ + if (def->bridgeZone) { + virReportError(VIR_ERR_NO_SUPPORT, "%s", + _("This platform does not support setting the bridg= e device zone")); + return -1; + } + return 0; +} + + int networkAddFirewallRules(virNetworkDef *def G_GNUC_UNUSED, virFirewallBackend firewallBackend, virFirewall **fwRemoval G_GNUC_UNUSED) diff --git a/src/network/bridge_driver_platform.h b/src/network/bridge_driv= er_platform.h index cd2e3fa7b5..02abdc197f 100644 --- a/src/network/bridge_driver_platform.h +++ b/src/network/bridge_driver_platform.h @@ -32,6 +32,8 @@ void networkPostReloadFirewallRules(bool startup); =20 int networkCheckRouteCollision(virNetworkDef *def); =20 +int networkSetBridgeZone(virNetworkDef *def); + int networkAddFirewallRules(virNetworkDef *def, virFirewallBackend firewallBackend, virFirewall **fwRemoval); --=20 2.46.0