mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-10-30 18:03:32 +00:00
41adfe8ca9
The libvirt zonefile for firewalld (added in commit 3b71f2e4) does the
following:
1) lists specific services it wants to allow, then
2) uses a lower priority <reject/> rule to block all other services to
the host, and then finally,
3) relies on the zone's default "accept" policy to, accept all
forwarded traffic (since forwarded traffic is ignored by the
slightly higher priority <reject/> rule in (2)).
I had assumed that icmp traffic was either being allowed at the top of
the rules, or that it would be ignored by the <reject/> rule and
passed by the default accept policy (similar to forwarded traffic),
but this assumption was incorrect; the <reject/> rule does block icmp
traffic. This became apparent when DHCPv6 which requires ICMPv6 in
addition to udp/dhcpv6) failed to work.
This all means that in order to achieve our original goal of "similar
behavior to a default reject policy, but also allowing forwarded
traffic", we need to add rules to allow all icmp and icmpv6 traffic to
the libvirt zone, and that's what this patch does.
This is a further refinement of the resolution to
https://bugzilla.redhat.com/1650320
Signed-off-by: Laine Stump <laine@laine.org>
Acked-by: Eric Garver <eric@garver.life>
26 lines
809 B
Dns
26 lines
809 B
Dns
<?xml version="1.0" encoding="utf-8"?>
|
|
<zone target="ACCEPT">
|
|
<short>libvirt</short>
|
|
|
|
<description>
|
|
The default policy of "ACCEPT" allows all packets to/from
|
|
interfaces in the zone to be forwarded, while the (*low priority*)
|
|
reject rule blocks any traffic destined for the host, except those
|
|
services explicitly listed (that list can be modified as required
|
|
by the local admin). This zone is intended to be used only by
|
|
libvirt virtual networks - libvirt will add the bridge devices for
|
|
all new virtual networks to this zone by default.
|
|
</description>
|
|
|
|
<rule priority='32767'>
|
|
<reject/>
|
|
</rule>
|
|
<protocol value='icmp'/>
|
|
<protocol value='ipv6-icmp'/>
|
|
<service name='dhcp'/>
|
|
<service name='dhcpv6'/>
|
|
<service name='dns'/>
|
|
<service name='ssh'/>
|
|
<service name='tftp'/>
|
|
</zone>
|