From 125ea47d6e9bca41578a1368d0f6898f6c6c6d42 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Tue, 13 Jan 2026 07:25:52 +0100 Subject: [PATCH] Fix missing firewalld.conf when modifying zone services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When users modified firewall zone services (e.g., enabling SSH on WAN), firewalld.conf would disappear from /etc/firewalld/, causing firewalld to fail with "Failed to load '/etc/firewalld/firewalld.conf': [Errno 2] No such file or directory". Root cause: After switching to the "roll in" staging directory approach late in development, firewalld.conf generation was still conditional on changes to "default" or "logging" settings. When other changes (zones, services, policies) were made: 1. Code created /etc/firewalld+/ staging directory 2. Skipped generating firewalld.conf (no default/logging in diff) 3. On commit: rm -rf /etc/firewalld (deleted firewalld.conf!) 4. Renamed /etc/firewalld+ → /etc/firewalld (incomplete config) Fix: Always generate firewalld.conf whenever firewall configuration is being staged, not just for default/logging changes. Fixes #1346 Signed-off-by: Joachim Wiberg --- src/confd/src/firewall.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/confd/src/firewall.c b/src/confd/src/firewall.c index a11416f3..8d5b6364 100644 --- a/src/confd/src/firewall.c +++ b/src/confd/src/firewall.c @@ -549,9 +549,8 @@ int firewall_change(sr_session_ctx_t *session, struct lyd_node *config, struct l goto done; } - if (lydx_get_descendant(diff, "firewall", "default", NULL) || - lydx_get_descendant(diff, "firewall", "logging", NULL)) - generate_firewalld_conf(global); + /* Always generate firewalld.conf when firewall is enabled */ + generate_firewalld_conf(global); /* * Regenerate everything if anything in firewall changed, firewalld