Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for ACLs for bridge NIC device when using nftables driver #1587

Merged
merged 7 commits into from
Jan 18, 2025
Merged

Support for ACLs for bridge NIC device when using nftables driver #1587

merged 7 commits into from
Jan 18, 2025

Conversation

stgraber
Copy link
Member

Closes #1225

@github-actions github-actions bot added Documentation Documentation needs updating API Changes to the REST API labels Jan 17, 2025
stgraber and others added 7 commits January 17, 2025 18:49
@stgraber
incusd/instance/drivers: Introduce ReloadDevice
55ed0ad 
Signed-off-by: Stéphane Graber <[email protected]>
@stgraber
api: network_bridge_acl_devices
b95e5e2 
Signed-off-by: Stéphane Graber <[email protected]>
@mikerobski @stgraber
incusd/device/nic: ACL support for bridge NIC device
e861951 
Support for security.acls* fields for bridge NIC device when using nftables driver.

Signed-off-by: Mike Robski <[email protected]>
@mikerobski @stgraber
incusd/server/firewall: ACL for bridge NIC device
a298a82 
Support for ACLs for bridge NIC device when using nftables driver.
Modified nftable template to allow combining fitering and ACL rules.
Updated ACL processing to detect bridge NIC devices with ACL applied and re-generate nftable if the instance is running.

Signed-off-by: Mike Robski <[email protected]>
@mikerobski @stgraber
doc/device/nic: Add ACL support to bridge NICs
7efe318 
Support for ACLs for bridge NIC device when using nftables driver.

Signed-off-by: Mike Robski <[email protected]>
@mikerobski @stgraber
doc/network_acl: Document usage with bridged NICs
b9e1d65 
Signed-off-by: Mike Robski <[email protected]>
@mikerobski @stgraber
tests: nftable test with ACL rules
bc1b18d 
Support for ACLs for bridge NIC device when using nftables driver.

Signed-off-by: Mike Robski <[email protected]>
@stgraber
Copy link
Member Author

@mikerobski so that's my tweaked version of your PR.
I would normally directly push into the PR to avoid having a PR close a PR but because of the configuration of your clone, I can't do that directly.

Anyway, as mentioned in the other one, this one mostly adds:

  • API extension
  • Check that the instance is on the same system prior to trigerring a device update
  • Adds ReloadDevice so we can call that instead of a full Update call
  • Some minor re-titling and rebasing for consistency

@mikerobski
Copy link
Contributor

Thanks for cleaning it up, @stgraber !
The PR looks good to me.

@stgraber stgraber merged commit be2cba0 into lxc:main Jan 18, 2025
36 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
API Changes to the REST API Documentation Documentation needs updating
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@stgraber @mikerobski