From 680fc277f90e5a8286016c644b40f8178bf50b12 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Fri, 7 Dec 2018 14:09:28 -0500 Subject: [PATCH 16/34] fw: on reload() retain interfaces from NetworkManager With FlushOnAllReload=yes the interface to zone assignment controlled by NM was being lost during a reload. This is because these assignments are "runtime" from firewalld's point of view. Lets query NM for its assignments during a reload and reapply them. Also add test coverage for FlushAllOnReload=yes. Fixes: rhbz 1656962 Fixes: 242bc4e2e20c ("Add "FlushAllOnReload" config option") (cherry picked from commit cd97204a06f3243b789d4213f5bd888b0b156f88) --- src/firewall/core/fw.py | 8 ++++++++ src/tests/regression/rhbz1498923.at | 12 ++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/firewall/core/fw.py b/src/firewall/core/fw.py index 7e6255f77398..4ec2087ec48d 100644 --- a/src/firewall/core/fw.py +++ b/src/firewall/core/fw.py @@ -42,6 +42,7 @@ from firewall.core.fw_policies import FirewallPolicies from firewall.core.fw_ipset import FirewallIPSet from firewall.core.fw_transaction import FirewallTransaction from firewall.core.fw_helper import FirewallHelper +from firewall.core.fw_nm import nm_get_bus_name, nm_get_interfaces_in_zone from firewall.core.logger import log from firewall.core.io.firewalld_conf import firewalld_conf from firewall.core.io.direct import Direct @@ -1035,6 +1036,13 @@ class Firewall(object): # restore direct config self.direct.set_config(_direct_config) + # Restore permanent interfaces from NetworkManager + nm_bus_name = nm_get_bus_name() + if nm_bus_name: + for zone in self.zone.get_zones(): + for interface in nm_get_interfaces_in_zone(zone): + self.zone.add_interface(zone, interface, sender=nm_bus_name) + # enable panic mode again if it has been enabled before or set policy # to ACCEPT if _panic: diff --git a/src/tests/regression/rhbz1498923.at b/src/tests/regression/rhbz1498923.at index ed1022fb0ca4..70f7a6036b8f 100644 --- a/src/tests/regression/rhbz1498923.at +++ b/src/tests/regression/rhbz1498923.at @@ -1,4 +1,16 @@ FWD_START_TEST([invalid direct rule causes reload error]) +dnl Verify runtime interface to zone assignment is gone after reload +AT_CHECK([sed -i 's/^FlushAllOnReload.*/FlushAllOnReload=yes/' ./firewalld.conf]) +FWD_RELOAD +FWD_CHECK([-q --zone=public --add-interface=foobar0]) +FWD_CHECK([--get-zone-of-interface=foobar0], 0, [dnl +public +]) +FWD_RELOAD +FWD_CHECK([--get-zone-of-interface=foobar0], 2, [], [dnl +no zone +]) + dnl Below we test retention of some items applicable to FlushAllOnReload=no AT_CHECK([sed -i 's/^FlushAllOnReload.*/FlushAllOnReload=no/' ./firewalld.conf]) FWD_RELOAD -- 2.18.0