On Thu, Sep 05, 2024 at 01:07:57PM -0400, Laine Stump wrote:
The bit of code that sets the firewalld zone was previously a part of the function networkAddFirewallRules(), which is not called for networks with <forward mode='open'/>. Setting the 'libvirt' zone for the bridge device of virtual networks that also add firewall rules is usually necessary in order to get the expected traffic through without modifying firewalld's default zone (which would be a bad idea, because that would affect all the other host interfaces set to the default zone), but in general we would *not* want the bridge device for a mode='open' virtual network to be automatically placed in the "libvirt" zone, a user might want to *explicitly* set some other firewalld zone for mode='open' networks. We enable this by moving the code that sets the firewalld zone into a separate function that is called for all forward modes that use a bridge device created by libvirt (nat, route, isolated, open). If no zone is specified, then the bridge device will be in whatever zone interfaces are put in by default, but if the <bridge> element has a "zone" attribute, then the new bridge device will be placed in the specified zone. NB: This function is only called when the network is started, and *not* when the firewall rules of an active network are reloaded at virtnetworkd restart time, because the firewalld zone of an interface isn't something that gets inadvertantly changed as a part of some other unrelated action (e.g. all iptables rules are cleared by a firewalld restart, including those rules added by libvirt), and so we don't need to be re-setting it all the time. Resolves: https://gitlab.com/libvirt/libvirt/-/issues/215 Signed-off-by: Laine Stump <laine@xxxxxxxxxx>
Reviewed-by: Martin Kletzander <mkletzan@xxxxxxxxxx>
Attachment:
signature.asc
Description: PGP signature
