Add docker interfaces to firewalld docker zone

If firewalld is running, create a new docker zone and
add the docker interfaces to the docker zone to allow
container networking for distros with Firewalld enabled

Fixes: #2496

Signed-off-by: Arko Dasgupta <arko.dasgupta@docker.com>

iptables/firewalld.go

@@ -19,9 +19,12 @@ const (
  // Ebtables point to bridge table
  Ebtables IPV = "eb"
 )
+
+// Reference - https://firewalld.org/documentation/man-pages/firewalld.dbus.html
 const (
  dbusInterface = "org.fedoraproject.FirewallD1"
  dbusPath = "/org/fedoraproject/FirewallD1"
+ dockerZone = "docker"
 )
 
 // Conn is a connection to firewalld dbus endpoint.
@@ -51,6 +54,9 @@ func FirewalldInit() error {
  }
  if connection != nil {
  go signalHandler()
+ if err := setupDockerZone(); err != nil {
+ return err
+ }
  }
 
  return nil
@@ -165,3 +171,78 @@ func Passthrough(ipv IPV, args ...string) ([]byte, error) {
  }
  return []byte(output), nil
 }
+
+// setupDockerZone creates a zone called docker in firewalld which includes docker interfaces to allow
+// container networking
+func setupDockerZone() error {
+ var zones []string
+ // Check if zone exists
+ if err := connection.sysobj.Call(dbusInterface+".zone.getZones", 0).Store(&zones); err != nil {
+ return err
+ }
+ if contains(zones, dockerZone) {
+ logrus.Infof("Firewalld: %s zone already exists, returning", dockerZone)
+ return nil
+ }
+
+ logrus.Debugf("Firewalld: creating %s zone", dockerZone)
+ var output string
+ settings := "version='1.0',target='ACCEPT'"
+ // Permanent
+ if err := connection.sysobj.Call(dbusInterface+".config.addZone", 0, dockerZone, settings).Store(&output); err != nil {
+ return err
+ }
+ return nil
+}
+
+// AddInterfaceFirewalld adds the interface to the trusted zone
+func AddInterfaceFirewalld(intf string) error {
+ var intfs []string
+ // Check if interface is already added to the zone
+ if err := connection.sysobj.Call(dbusInterface+".zone.getInterfaces", 0, dockerZone).Store(&intfs); err != nil {
+ return err
+ }
+ // Return if interface is already part of the zone
+ if contains(intfs, intf) {
+ logrus.Infof("Firewalld: interface %s already part of %s zone, returning", intf, dockerZone)
+ return nil
+ }
+
+ logrus.Debugf("Firewalld: adding %s interface to %s zone", intf, dockerZone)
+ var output string
+ // Runtime
+ if err := connection.sysobj.Call(dbusInterface+".zone.addInterface", 0, dockerZone, intf).Store(&output); err != nil {
+ return err
+ }
+ return nil
+}
+
+// DelInterfaceFirewalld removes the interface from the trusted zone
+func DelInterfaceFirewalld(intf string) error {
+ var intfs []string
+ // Check if interface is part of the zone
+ if err := connection.sysobj.Call(dbusInterface+".zone.getInterfaces", 0, dockerZone).Store(&intfs); err != nil {
+ return err
+ }
+ // Remove interface if it exists
+ if !contains(intfs, intf) {
+ return fmt.Errorf("Firewalld: unable to find interface %s in %s zone", intf, dockerZone)
+ }
+
+ logrus.Debugf("Firewalld: removing %s interface from %s zone", intf, dockerZone)
+ var output string
+ // Runtime
+ if err := connection.sysobj.Call(dbusInterface+".zone.removeInterface", 0, dockerZone, intf).Store(&output); err != nil {
+ return err
+ }
+ return nil
+}
+
+func contains(list []string, val string) bool {
+ for _, v := range list {
+ if v == val {
+ return true
+ }
+ }
+ return false
+}

iptables/iptables.go

@@ -146,6 +146,19 @@ func ProgramChain(c *ChainInfo, bridgeName string, hairpinMode, enable bool) err
  return errors.New("Could not program chain, missing chain name")
  }
 
+ // Either add or remove the interface from the firewalld zone
+ if firewalldRunning {
+ if enable {
+ if err := AddInterfaceFirewalld(bridgeName); err != nil {
+ return err
+ }
+ } else {
+ if err := DelInterfaceFirewalld(bridgeName); err != nil {
+ return err
+ }
+ }
+ }
+
  switch c.Table {
  case Nat:
  preroute := []string{