From 125ea47d6e9bca41578a1368d0f6898f6c6c6d42 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Tue, 13 Jan 2026 07:25:52 +0100 Subject: [PATCH 1/2] Fix missing firewalld.conf when modifying zone services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When users modified firewall zone services (e.g., enabling SSH on WAN), firewalld.conf would disappear from /etc/firewalld/, causing firewalld to fail with "Failed to load '/etc/firewalld/firewalld.conf': [Errno 2] No such file or directory". Root cause: After switching to the "roll in" staging directory approach late in development, firewalld.conf generation was still conditional on changes to "default" or "logging" settings. When other changes (zones, services, policies) were made: 1. Code created /etc/firewalld+/ staging directory 2. Skipped generating firewalld.conf (no default/logging in diff) 3. On commit: rm -rf /etc/firewalld (deleted firewalld.conf!) 4. Renamed /etc/firewalld+ → /etc/firewalld (incomplete config) Fix: Always generate firewalld.conf whenever firewall configuration is being staged, not just for default/logging changes. Fixes #1346 Signed-off-by: Joachim Wiberg --- src/confd/src/firewall.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/confd/src/firewall.c b/src/confd/src/firewall.c index a11416f3..8d5b6364 100644 --- a/src/confd/src/firewall.c +++ b/src/confd/src/firewall.c @@ -549,9 +549,8 @@ int firewall_change(sr_session_ctx_t *session, struct lyd_node *config, struct l goto done; } - if (lydx_get_descendant(diff, "firewall", "default", NULL) || - lydx_get_descendant(diff, "firewall", "logging", NULL)) - generate_firewalld_conf(global); + /* Always generate firewalld.conf when firewall is enabled */ + generate_firewalld_conf(global); /* * Regenerate everything if anything in firewall changed, firewalld From 5e180abae4771b3098ff44ef2273f1ce25cf9494 Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Tue, 13 Jan 2026 07:34:04 +0100 Subject: [PATCH 2/2] Fix firewall not updating when interfaces become bridge/LAG ports When interfaces were moved from firewall zones to become bridge or LAG ports (e.g., sfp1/sfp2 moved from WAN zone to lan-br), the firewall configuration was not regenerated. This caused stale entries in /etc/firewalld/zones/*.xml where interfaces remained listed in their old zones despite no longer being L3 interfaces. Root cause: firewall_change() only triggered on firewall model changes, but interface membership changes (bridge-port/lag-port) occur in the ietf-interfaces model. When interfaces become member ports, they transition from L3 to L2, which affects the result of interfaces_get_all_l3() used for default zone assignment. Fix: Expand the diff check to also trigger firewall regeneration when bridge-port or lag-port configuration changes, ensuring firewall zones stay synchronized with actual L3 interface topology. Fixes #1345 Signed-off-by: Joachim Wiberg --- src/confd/src/firewall.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/confd/src/firewall.c b/src/confd/src/firewall.c index 8d5b6364..cad59551 100644 --- a/src/confd/src/firewall.c +++ b/src/confd/src/firewall.c @@ -487,7 +487,15 @@ int firewall_change(sr_session_ctx_t *session, struct lyd_node *config, struct l sr_error_t err = SR_ERR_OK; char **ifaces = NULL; - if (diff && !lydx_get_xpathf(diff, XPATH)) + /* + * Trigger firewall regeneration if: + * 1. Firewall configuration changed, OR + * 2. Interface membership changed (bridge-port/lag-port) + * which affects L3 interface enumeration + */ + if (diff && !lydx_get_xpathf(diff, XPATH) && + !lydx_get_xpathf(diff, "/ietf-interfaces:interfaces/interface/bridge-port") && + !lydx_get_xpathf(diff, "/ietf-interfaces:interfaces/interface/lag-port")) return SR_ERR_OK; switch (event) {