[PATCH pve-network 08/16] sdn: zones: trigger microseg apply on tap_plug

[Hannes Laimer <h.laimer@proxmox.com>]

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/PVE/Network/SDN/Zones.pm | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/PVE/Network/SDN/Zones.pm b/src/PVE/Network/SDN/Zones.pm
index 4c1468c..1af5e5c 100644
--- a/src/PVE/Network/SDN/Zones.pm
+++ b/src/PVE/Network/SDN/Zones.pm
@@ -10,6 +10,7 @@ use PVE::Cluster qw(cfs_read_file cfs_write_file cfs_lock_file);
 use PVE::Network;
 
 use PVE::Network::SDN::Vnets;
+use PVE::Network::SDN::Microseg;
 use PVE::Network::SDN::Zones::VlanPlugin;
 use PVE::Network::SDN::Zones::QinQPlugin;
 use PVE::Network::SDN::Zones::VxlanPlugin;
@@ -332,6 +333,8 @@ sub tap_plug {
         $opts->{learning} = 0
             if $interfaces_config->{ifaces}->{$bridge}
             && $interfaces_config->{ifaces}->{$bridge}->{'bridge-disable-mac-learning'};
+        # attach enforcement before bridging, so the NIC never passes traffic unenforced
+        PVE::Network::SDN::Microseg::apply_interface($iface);
         PVE::Network::tap_plug($iface, $bridge, $tag, $firewall, $trunks, $rate, $opts);
         return;
     }
@@ -343,6 +346,9 @@ sub tap_plug {
         if $plugin_config->{nodes} && !defined($plugin_config->{nodes}->{$nodename});
 
     my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($plugin_config->{type});
+
+    # attach enforcement before bridging, so the NIC never passes traffic unenforced
+    PVE::Network::SDN::Microseg::apply_interface($iface);
     $plugin->tap_plug($plugin_config, $vnet, $tag, $iface, $bridge, $firewall, $trunks, $rate);
 }
 
-- 
2.47.3