Allow to configure firewalld (#30)

Allow to configure firewalld Add the tun device to a firewalld trusted zone if requested. Co-authored-by: Olivier Valentin <[email protected]>
stackrox · Nov 15, 2024 · 009726f · 009726f
1 parent 7b0a20b
commit 009726f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 4 deletions.
diff --git a/scripts/network/prepare-tap.sh b/scripts/network/prepare-tap.sh
@@ -16,14 +16,16 @@ which ip &>/dev/null || stop "Don't have the ip tool"
 which whoami &>/dev/null || stop "Don't have the whoami tool"
 which iptables &>/dev/null || stop "Don't have the iptables tool"
 which sysctl &>/dev/null || stop "Don't have the sysctl tool"
+which firewall-cmd &>/dev/null || stop "Don't have the firewal-cmd tool"
 
-ADDRESS="192.168.0.1/16"
-NAME="tun0"
+ADDRESS="10.0.0.1/16"
+NAME="berserker0"
 USER="$(whoami)"
 CONFIGURE_IPTABLE="false"
+CONFIGURE_FIREWALLD="false"
 CONFIGURE_TUNTAP_IF_EXISTS="false"
 
-while getopts ":a:t:u:io" opt; do
+while getopts ":a:t:u:i:fo" opt; do
   case $opt in
     a) ADDRESS="${OPTARG}"
     ;;
@@ -33,6 +35,8 @@ while getopts ":a:t:u:io" opt; do
     ;;
     i) CONFIGURE_IPTABLE="true"
     ;;
+    f) CONFIGURE_FIREWALD="true"
+    ;;
     o) CONFIGURE_TUNTAP_IF_EXISTS="true"
     ;;
     \?) echo "Invalid option -$OPTARG" >&2
@@ -58,6 +62,12 @@ ip link set "${NAME}" up
 echo "Assigning address ${ADDRESS} to device ${NAME}..."
 ip addr add "${ADDRESS}" dev "${NAME}"
 
+if [[ "${CONFIGURE_FIREWALLD}" == "true" ]];
+then
+    echo "Adding to the trusted zone..."
+    firewall-cmd --zone=trusted --add-interface="${NAME}"
+fi
+
 if [[ "${CONFIGURE_IPTABLE}" == "true" ]];
 then
     echo "Enabling ip forward..."

diff --git a/src/worker/network.rs b/src/worker/network.rs
@@ -217,7 +217,7 @@ impl NetworkWorker {
         &self,
         addr: Ipv4Address,
     ) -> (Interface, FaultInjector<Tracer<TunTapInterface>>, i32) {
-        let device_name = "tun0";
+        let device_name = "berserker0";
         let device = TunTapInterface::new(&device_name, Medium::Ip).unwrap();
         let fd = device.as_raw_fd();