Add directional port groups with allow/reject priority based on default policy #2372
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
f4e0506 to
d2316b7
Compare
fd3a6dc to
03ca464
Compare
Signed-off-by: Piotr Resztak <piotr.resztak@futurfusion.io>
Signed-off-by: Piotr Resztak <piotr.resztak@futurfusion.io>
03ca464 to
806c1df
Compare
806c1df to
1ecc4b9
Compare
stgraber
reviewed
Aug 27, 2025
cmd/incusd/patches.go
Outdated
Comment on lines
1386
to
1389
| ovnnb, _, err := s.OVN() | ||
| if err != nil { | ||
| return err | ||
| } |
There was a problem hiding this comment.
What happens when this runs on a system without configured OVS/OVN?
There was a problem hiding this comment.
yeah, it will fail with an error saying that it’s unable to connect to OVN. So as solution I'm instantiating ovnnb only if we find ovn network.
Signed-off-by: Piotr Resztak <piotr.resztak@futurfusion.io>
1ecc4b9 to
89c80b2
Compare
stgraber
approved these changes
Aug 28, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This change adds support for prioritizing allow rules when the default policy for a network or interface is set to allow. By default, the policy is reject, so reject rules have higher priority.
To implement this, the original single port group was replaced with four separate port groups:
These groups store rules in the required order, allowing correct rule evaluation based on the default policy.
Fixes: #1833