Re: [PATCH 0/8] network: firewalld: native support for NAT/routed
On 11/15/22 5:21 AM, Michal Prívozník wrote:
On 11/10/22 17:31, Eric Garver wrote:
> This series further improves the firewalld backend by converting to a
> fully native implementation for NAT and routed networks. That is, there
> are no iptables rules added by libvirt when the running firewalld is
> 0.9.0 or later.
>
> The major advantage is that firewalld users can use firewall-cmd to
> filter the VM traffic and apply their own policies.
>
> When firewalld < 0.9.0 is present only the "libvirt" zone will be used.
> The new "libvirt-nat" and "libvirt-routed" zones are not used.
This
> maintains compatibility for older distributions (e.g. Ubuntu 20.04).
>
> Patch 1 is a bug fix for my previous series to avoid a bogus error log.
>
> Patches 2-3 converts the routed network to native firewalld.
>
> Patches 4-8 converts the NAT network to native firewalld. It also
> introduces the "libvirt-nat" zone.
>
> Eric Garver (8):
> util: virFirewallDGetPolicies: gracefully handle older firewalld
> network: firewalld: add networkAddHybridFirewallDRules()
> network: firewalld: use native routed networks
> util: add virFirewallDSourceSetZone()
> util: add virFirewallDApplyPolicyRichRules()
> network: firewalld: add zone for NAT networks
> network: firewalld: add policies for NAT networks
> network: firewalld: use native NAT networks
>
> libvirt.spec.in | 2 +
> src/libvirt_private.syms | 2 +
> src/network/bridge_driver_linux.c | 193 ++++++++++++++++++++---------
> src/network/libvirt-nat-out.policy | 13 ++
> src/network/libvirt-nat.zone | 10 ++
> src/network/libvirt-to-host.policy | 1 +
> src/network/meson.build | 10 ++
> src/util/virfirewalld.c | 79 +++++++++++-
> src/util/virfirewalld.h | 6 +
> 9 files changed, 258 insertions(+), 58 deletions(-)
> create mode 100644 src/network/libvirt-nat-out.policy
> create mode 100644 src/network/libvirt-nat.zone
>
Patches look good to me. You have my:
Reviewed-by: Michal Privoznik <mprivozn(a)redhat.com>
but I'll wait a bit for Laine, if he wants to express his opinion.
This series has been on my list of things I need to get to since it
arrived, but I've been purposefully not responding in order to avoid
distracting my brain from something else I'm working on that is more
urgent (supporting passt as a guest interface connection mode).
I have pending stuff (in-process on and off for many months now) that
adds a separate (configurable) backend for raw nftables that this
firewalld-backend mode needs to mesh with. In particular, I don't think
it's safe to automatically switch to using a pure firewalld backend any
time firewalld is running, because behavior isn't exactly the same as
the standard iptables backend (the first example that comes to mind is
those horrible dhcp checksum munging rules that are added by libvirt's
iptables backend).
Probably most of the patches in this series will be untouched by mine,
or should be prerequisites to mine, but some will need to be re-jiggered
to use my conf-file option and to deal with my other reorganizations.
I'll look at it in more detail as soon as I have a first version of
passt patches posted, which I'm hoping will happen sometime this week.
So please don't push these patches (yet).