[PATCH] libvirt: Update to version 12.8.0

[Adolf Belka <adolf.belka@ipfire.org>]

- Update from version 12.3.0 to 12.8.0
- Update of rootfile
- Addition of patch to solve build issue
- 3 CVE fixes in 12.7.0
- Changelog
12.8.0
New features**
  * resctrl: Support whole-process allocations and monitoring
    ``cachetune``, ``memorytune`` and ``energytune`` can now apply to the
    entire QEMU process. Monitors without a ``vcpus`` attribute inherit the
    enclosing scope. This enables whole-VM resctrl allocations and monitoring.
  * qemu: Add ``auto_dump_max_size`` to cap the size of auto-triggered dumps
    A guest that keeps crashing fills ``auto_dump_path`` one dump at a time.
    The new ``auto_dump_max_size`` setting in qemu.conf bounds the total size
    those dumps may occupy, pruning the oldest after each new one. It takes a
    byte count or a size such as ``"10GiB"``; 0, the default, keeps them all.
  * FreeBSD: support VLAN configuration on bridges
    libvirt on FreeBSD now supports VLAN configurations such as::
      <vlan trunk='yes'>
        <tag id='42' nativeMode='untagged'/>
        <tag id='43'/>
      </vlan>
    It also supports ``macTableManager='libvirt'`` bridge configuration
    for networks (requires FreeBSD 15.0 or newer).
  * bhyve: implement ``virDomainSetLifecycleAction()`` API
    The bhyve driver now implements the ``virDomainSetLifecycleAction()`` API
    (accessible via ``virsh set-lifecycle-action``).
Improvements**
  * qemu: Select the win-dmp format for Windows guest crash dumps
    Dumps triggered by ``<on_crash>`` and by watchdog handling used QEMU's elf
    default, which WinDbg cannot load. Where QEMU reports the format as
    available only to a guest that can use it, such dumps are now written in
    win-dmp format instead.
  * logging: ``max_size`` in virtlogd.conf accepts a unit suffix
    The setting now takes a size such as ``"2MiB"`` as well as a plain byte
    count.
Bug fixes**
  * qemu: Fix resctrl monitor statistics reporting
    Statistics now use the correct monitor group names and omit nonexistent
    cache monitor data.
  * bhyve: fixes for transient/persistent domain handling and leftover TAP devices
    A few issues related to transient and persistent domain handling were fixed.
    Additionally, error handling bugs in the network interfaces management code
    were fixed so it does not leave dangling TAP interfaces on errors.
12.7.0
Security**
  * CVE-2026-18917: Integer overflow in RPC handler for ``virNodeGetFreePages``
    The RPC handler for ``virNodeGetFreePages`` didn't properly check for
    overflows in multiplication of integers when calculating the amount of
    returned data for validation and allocation of the return buffer.
    Specific values could thus pass validation and cause an undersized buffer
    to be allocated. The hypervisor driver would then fill the undersized buffer
    based on the values prior to multiplication and thus cause a write beyond
    the end of the allocated buffer.
    This bug can be triggered via a read-only connection.
  * CVE-2026-77158: Double free of disks array in ``qemuAgentGetDisks``
    The qemu hypervisor driver would double-free the array of parsed disks, on
    error code paths leading to crash of the daemon. The error code path could
    be reached when the qemu guest agent provided malformed data as response to
    the ``guest-get-disks`` command.
  * CVE-2026-77159: ``chown()`` of swtpm log file follows symlinks
    When starting up a VM with a ``swtpm`` device configured, libvirt
    ``chown()``-s the log file of swtpm to the (unprivileged) user/group
    running the swtpm process. The problem is that the directory containing the
    log files is also owned by the same user/group, thus users with access
    to that directory could install a symlink to a privileged file that the
    libvirt daemon would follow and chown the file pointed to.
New features**
  * bhyve: implement ``virDomainGetGuestInfo()`` and ``virDomainAgentSetResponseTimeout()`` APIs
    The bhyve driver now implements ``virDomainGetGuestInfo()`` which returns
    information about the guest, and ``virDomainAgentSetResponseTimeout()``
    which sets the guest agent response timeout.
  * bhyve: allow setting disk serial numbers
    The bhyve driver now allows specifying ``<serial>`` for SATA disks and NVMe
    controllers::
      <disk type='file'>
        <serial>BHYVE-SER01-0001</serial>
        <driver name='file' type='raw'/>
        <source file='/tmp/freebsd1.img'/>
        <target dev='hda' bus='sata' rotation_rate='7200'/>
      </disk>
      <controller type='nvme' index='0'>
        <serial>BHYVE-NVME0-01234</serial>
      </controller>
    It also supports specifying ``<wwn>`` for NVMe disks::

      <disk type='file'>
        <driver name='file' type='raw'/>
        <source file='/path/to/some.img'/>
        <target dev='nvme0n1' bus='nvme'/>
        <wwn>01000000efbeadde</wwn>
      </disk>
  * qemu: Add poll-weight support for iothreads
    The qemu driver now supports the iothread poll-weight property,
    which controls the weight of the most recent event interval in the
    adaptive polling duration calculation.
  * Add guest device info to ``virDomainGetGuestInfo()``
    QEMU guest agent has 'guest-get-devices` command, which returns information
    on guest devices (driver name, version, release date, and so on). This is
    now exposed via ``virDomainGetGuestInfo()`` API (accessible via ``guestinfo
    --devices`` virsh command).
Bug fixes**
  * bhyve: fix domain API calls hanging after domain shutdown
  * remote: Fix stale virStream status
    In a few cases it might happen that daemon held incorrect state of a
    virStream leading to an infinite loop. This is now fixed.
  * esx: Don't crash when parsing unmounted datastore
    When libvirt constructs domain XML for an ESX domain it traverses through
    all datastores to find which one stores disks for the domain. But if a
    datastore wasn't mounted, then a crash would occur. This is now fixed.
  * virsh: Don't crash when certain error messages are printed
    A bug in the error printing function could cause ``virsh`` to crash when
    certain errors (e.g. disk not found in ``virsh detach-disk``) were being
    reported.
12.6.0
New features**
  * bhyve: implement ``virDomainRename()``
    The bhyve driver now implements the ``virDomainRename()`` API
    for renaming of a domain (``virsh domrename``).
  * build: Add option to control building libvirtd
    Meson option ``libvirtd`` has been added to control building the monolithic
    libvirtd, independent from the stateful, daemon-based drivers.
  * sanlock: Add option to check ownership of disk leases
    The sanlock lock driver plugin now supports the ``check_disk_lease_owner``
    setting in sanlock.conf. When enabled, the sanlock plugin will check that
    leases are owned by the domain attempting to acquire them.
Improvements**
  * qemu: Add ``preserve-running`` action for ``<on_crash>``
    Allow qemu VMs to be kept running after they notify that they've crashed.
    This is useful for guests that can take their own crash dump and reboot.
12.5.0
New features**
  * bhyve: Extend the guest agent support
    The bhyve driver now supports several APIs on top of the guest agent:
     * Getting and setting guest OS SSH keys
     * Setting guest OS user's password
     * Getting and setting guest OS time
    Additionally, domain rebooting and shutting down using the agent
    is now supported.
  * bhyve: Support ``on_reboot`` and ``on_poweroff`` actions
    The bhyve driver now respects the domain's
    ``on_reboot`` and ``on_poweroff`` actions.
  * bhyve: Support populating SMBIOS fields
    Add support for populating the SMBIOS fields as defined
    by the ``<sysinfo type='smbios'>`` section of the domain's XML.
  * qemu: Add support for standalone VNC server
    Starting with this release, libvirt might spawn a standalone
    qemu-vnc process instead of QEMU's built-in VNC server, for
    enhanced security.
Improvements**
  * Enable hyperv driver on RHEL
    The spec file now enables the Hyper-V driver when building on
    Red Hat Enterprise Linux.
  * remote: allow passing argv to the ext transport
    The ext transport not only allows spawning a process (via the
    ``command`` attribute), but as of this release also
    specifying additional arguments to it, via ``argv``
    attribute.
  * Introduce ``VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES`` flag
    Some CPU features may be enabled explicitly, but should not automatically
    become part of a host-model CPU and thus are not normally visible in domain
    capabilities. Users can now request such features to be shown in the
    host-model CPU in domain capabilities using the new flag. It is exposed as
    ``--supported-cpu-features`` option for ``virsh domcapabilities``.
Bug fixes**
  * Ensure proper shutdown ordering of ``virtlogd`` and ``virtlockd``
    The logging and locking helper daemons now shutdown after the daemon running
    the ``qemu`` hypervisor driver since their services may be needed to shutdown
    the VMs run by the qemu driver.
  * qemu: Record selected ``virtio`` video device model into the XML
    The ``qemu`` driver may depending on platform and installed QEMU modules
    pick one of two distinct virtio video device types for the primary device.
    The choice was not recorded in the XML and since the devices are incompatible
    it can cause failures on migration when the destination picks the wrong
    device. This version thus records the picked device both for running VMs
    on upgrade and for new devices to prevent this problem in the future.
  * bhyve: Guest agent related fixes
    A few bugs related to the guest agent communication are fixed, from
    not properly initializing an agent to crashing when the agent
    socket cannot be opened.
  * Fix domain capabilities on AMD CPUs
    QEMU 10.1 and newer does not automatically enable features from
    arch-capabilities MSR on AMD CPUs as they are specific for Intel CPUs and
    KVM is just emulating them on AMD. But advertising them on AMD CPUs can
    cause Windows guest OS to crash so they are hidden by default now. But the
    features are still supported and can be enabled explicitly, for example,
    when migrating existing domains. Libvirt now detects this scenario and
    properly shows the affected features as enabled in domain capabilities when
    requested by ``VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES``
    flag.
  * vmx: Properly show all 64 disks on a SCSI controller
    Due to an off-by-one error a last, 64th disk was not shown in a domain XML,
    which is now fixed.
12.4.0
Removed features**
  * qemu: Bump minimum version to QEMU-7.2
    The minimal required version of QEMU was bumped to 7.2.0.
New features**
  * resctrl: Add energy monitoring via resctrl's PERF_PKG_MON
    Add support for Linux kernel 7.0 feature - energy monitoring via resctrl.
    This allows to monitor per-VM energy consumption on supported platforms.
    Implemented via ``energytune`` element in ``cputune`` .
  * Add channel lifecycle domain event
    Add support for a new domain event which can be used to track the state of
    any virtio channel. It is similar to guest agent lifecycle event.
  * bhyve: Add memory tuning support
    The bhyve driver now allows setting a domain's memory hard limit using the
    following syntax::
     <memtune>
       <hard_limit unit='G'>1</hard_limit>
     </memtune>
    It also implements the ``virDomainGetMemoryParameters()`` and
    ``virDomainSetMemoryParameters()`` APIs for controlling
    the memory hard limit of a running domain.
  * bhyve: Add virtio-console device support
    Domain XML can now use ``virtio-console`` devices. Among other things,
    these devices can be used to configure a QEMU Guest Agent::
     <devices>
       <channel type='unix'>
         <source mode='bind' path='/var/run/libvirt/bhyve/bhyve.agent'/>
         <target type='virtio' name='org.qemu.guest_agent.0'/>
         <address type='virtio-serial' controller='0' bus='0' port='1'/>
       </channel>
     </devices>
    Additionally, the ``virDomainQemuAgentCommand()`` API which allows
    running arbitrary guest agent commands is now supported.
    The ``virDomainGetHostname()`` API, used to query the hostname of a guest,
    now supports using the guest agent as a source of information.
Improvements**
  * vircgroupv2: Implement freezer controller
    The CGroupV2 code now supports freezer controller which allows suspending
    and resuming of LXC domains.
  * virnetdevbandwidth: Only clear qdisc for defined directions
    Setting a QoS on a vNIC no longer leads to clearing (preconfigured) root
    queuing discipline ('qdisc`) in both directions (egress, ingress), only the
    affected one.
Bug fixes**
  * storage: ZFS: Fix incorrect volsize and refreservation on zvol creation
    When creating a zvol, the ZFS driver listed all volumes in the pool and
    updated the new volume's size with data from the last volume in the list
    rather than the matching one. Now it correctly returns on valid one.
  * esx/vmware: VMs are tracked under different UUIDs by default
    The VMWare-related drivers were using allegedly unique IDs for domains, but
    it turned out they were not completely unique, even for the same host.  That
    caused an issue where a different domain could have been acted upon then
    requested.  Unfortunately, to make this work, the UUIDs of all
    VMWare-related domains will change from this release.  In order to use the
    pre-v12.4.0 behaviour there is a new URI query parameter ``legacy_uuid``
    which, if set to ``1``, will revert to the older way of working.
  * virsh: Provide no auth callbacks for bash completer
    The bash completer script calls virsh to provide completions. In some cases
    the underlying virsh might get stuck waiting on input (e.g. password for
    SSH session). Not anymore.
  * virauth: Verify virConnectAuth::cb is set in virAuthGetPasswordPath()
    A check was missing in ``virAuthGetPasswordPath()`` which might lead to
    crash of the client library when NULL callback was provided. This is now
    fixed.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/packages/libvirt             |  24 +++-
 lfs/libvirt                                   |   9 +-
 ...riority-regardless-of-driver_network.patch | 103 ++++++++++++++++++
 3 files changed, 126 insertions(+), 10 deletions(-)
 create mode 100644 src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch

diff --git a/config/rootfiles/packages/libvirt b/config/rootfiles/packages/libvirt
index 18bbbb4cc..77382d468 100644
--- a/config/rootfiles/packages/libvirt
+++ b/config/rootfiles/packages/libvirt
@@ -4,6 +4,7 @@ etc/libvirt/libvirt-admin.conf
 etc/libvirt/libvirt.conf
 etc/libvirt/libvirtd.conf
 #etc/libvirt/nwfilter
+#etc/libvirt/nwfilter.conf
 #etc/libvirt/nwfilter/allow-arp.xml
 #etc/libvirt/nwfilter/allow-dhcp-server.xml
 #etc/libvirt/nwfilter/allow-dhcp.xml
@@ -89,16 +90,16 @@ usr/bin/virt-xml-validate
 #usr/lib/libvirt
 #usr/lib/libvirt-admin.so
 usr/lib/libvirt-admin.so.0
-usr/lib/libvirt-admin.so.0.12003.0
+usr/lib/libvirt-admin.so.0.12008.0
 #usr/lib/libvirt-lxc.so
 usr/lib/libvirt-lxc.so.0
-usr/lib/libvirt-lxc.so.0.12003.0
+usr/lib/libvirt-lxc.so.0.12008.0
 #usr/lib/libvirt-qemu.so
 usr/lib/libvirt-qemu.so.0
-usr/lib/libvirt-qemu.so.0.12003.0
+usr/lib/libvirt-qemu.so.0.12008.0
 #usr/lib/libvirt.so
 usr/lib/libvirt.so.0
-usr/lib/libvirt.so.0.12003.0
+usr/lib/libvirt.so.0.12008.0
 #usr/lib/libvirt/connection-driver
 usr/lib/libvirt/connection-driver/libvirt_driver_ch.so
 usr/lib/libvirt/connection-driver/libvirt_driver_interface.so
@@ -120,8 +121,6 @@ usr/lib/libvirt/storage-backend/libvirt_storage_backend_vstorage.so
 #usr/lib/pkgconfig/libvirt.pc
 #usr/lib/sysctl.d
 usr/lib/sysctl.d/60-libvirtd.conf
-#usr/lib/systemd/system/libvirtd.service.d
-#usr/lib/systemd/system/libvirtd.service.d/10-secret.conf
 #usr/lib/sysusers.d
 usr/lib/sysusers.d/libvirt-login-shell.conf
 usr/lib/sysusers.d/libvirt-qemu.conf
@@ -146,12 +145,14 @@ usr/sbin/virtstoraged
 #usr/share/augeas/lenses/libvirt_secrets.aug
 #usr/share/augeas/lenses/libvirtd.aug
 #usr/share/augeas/lenses/libvirtd_ch.aug
+#usr/share/augeas/lenses/libvirtd_nwfilter.aug
 #usr/share/augeas/lenses/libvirtd_qemu.aug
 #usr/share/augeas/lenses/tests
 #usr/share/augeas/lenses/tests/test_libvirt_lockd.aug
 #usr/share/augeas/lenses/tests/test_libvirt_secrets.aug
 #usr/share/augeas/lenses/tests/test_libvirtd.aug
 #usr/share/augeas/lenses/tests/test_libvirtd_ch.aug
+#usr/share/augeas/lenses/tests/test_libvirtd_nwfilter.aug
 #usr/share/augeas/lenses/tests/test_libvirtd_qemu.aug
 #usr/share/augeas/lenses/tests/test_virtchd.aug
 #usr/share/augeas/lenses/tests/test_virtinterfaced.aug
@@ -236,6 +237,7 @@ usr/share/libvirt/cpu_map/arm_Kunpeng-920.xml
 usr/share/libvirt/cpu_map/arm_Neoverse-N1.xml
 usr/share/libvirt/cpu_map/arm_Neoverse-N2.xml
 usr/share/libvirt/cpu_map/arm_Neoverse-V1.xml
+usr/share/libvirt/cpu_map/arm_Neoverse-V2.xml
 usr/share/libvirt/cpu_map/arm_Tengyun-S2500.xml
 usr/share/libvirt/cpu_map/arm_ThunderX299xx.xml
 usr/share/libvirt/cpu_map/arm_a64fx.xml
@@ -272,6 +274,8 @@ usr/share/libvirt/cpu_map/x86_Cascadelake-Server-v4.xml
 usr/share/libvirt/cpu_map/x86_Cascadelake-Server-v5.xml
 usr/share/libvirt/cpu_map/x86_Cascadelake-Server.xml
 usr/share/libvirt/cpu_map/x86_ClearwaterForest-v1.xml
+usr/share/libvirt/cpu_map/x86_ClearwaterForest-v2.xml
+usr/share/libvirt/cpu_map/x86_ClearwaterForest-v3.xml
 usr/share/libvirt/cpu_map/x86_ClearwaterForest.xml
 usr/share/libvirt/cpu_map/x86_Conroe-v1.xml
 usr/share/libvirt/cpu_map/x86_Conroe.xml
@@ -285,6 +289,8 @@ usr/share/libvirt/cpu_map/x86_Denverton.xml
 usr/share/libvirt/cpu_map/x86_Dhyana-v1.xml
 usr/share/libvirt/cpu_map/x86_Dhyana-v2.xml
 usr/share/libvirt/cpu_map/x86_Dhyana.xml
+usr/share/libvirt/cpu_map/x86_DiamondRapids-v1.xml
+usr/share/libvirt/cpu_map/x86_DiamondRapids.xml
 usr/share/libvirt/cpu_map/x86_EPYC-Genoa-v1.xml
 usr/share/libvirt/cpu_map/x86_EPYC-Genoa-v2.xml
 usr/share/libvirt/cpu_map/x86_EPYC-Genoa.xml
@@ -310,6 +316,8 @@ usr/share/libvirt/cpu_map/x86_EPYC.xml
 usr/share/libvirt/cpu_map/x86_GraniteRapids-v1.xml
 usr/share/libvirt/cpu_map/x86_GraniteRapids-v2.xml
 usr/share/libvirt/cpu_map/x86_GraniteRapids-v3.xml
+usr/share/libvirt/cpu_map/x86_GraniteRapids-v4.xml
+usr/share/libvirt/cpu_map/x86_GraniteRapids-v5.xml
 usr/share/libvirt/cpu_map/x86_GraniteRapids.xml
 usr/share/libvirt/cpu_map/x86_Haswell-IBRS.xml
 usr/share/libvirt/cpu_map/x86_Haswell-noTSX-IBRS.xml
@@ -360,10 +368,14 @@ usr/share/libvirt/cpu_map/x86_SapphireRapids-v1.xml
 usr/share/libvirt/cpu_map/x86_SapphireRapids-v2.xml
 usr/share/libvirt/cpu_map/x86_SapphireRapids-v3.xml
 usr/share/libvirt/cpu_map/x86_SapphireRapids-v4.xml
+usr/share/libvirt/cpu_map/x86_SapphireRapids-v5.xml
+usr/share/libvirt/cpu_map/x86_SapphireRapids-v6.xml
 usr/share/libvirt/cpu_map/x86_SapphireRapids.xml
 usr/share/libvirt/cpu_map/x86_SierraForest-v1.xml
 usr/share/libvirt/cpu_map/x86_SierraForest-v2.xml
 usr/share/libvirt/cpu_map/x86_SierraForest-v3.xml
+usr/share/libvirt/cpu_map/x86_SierraForest-v4.xml
+usr/share/libvirt/cpu_map/x86_SierraForest-v5.xml
 usr/share/libvirt/cpu_map/x86_SierraForest.xml
 usr/share/libvirt/cpu_map/x86_Skylake-Client-IBRS.xml
 usr/share/libvirt/cpu_map/x86_Skylake-Client-noTSX-IBRS.xml
diff --git a/lfs/libvirt b/lfs/libvirt
index 7a879924d..891286f94 100644
--- a/lfs/libvirt
+++ b/lfs/libvirt
@@ -26,7 +26,7 @@ include Config
 
 SUMMARY	   = Server side daemon and supporting files for libvirt
 
-VER        = 12.3.0
+VER        = 12.8.0
 
 THISAPP    = libvirt-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -35,7 +35,7 @@ DIR_APP    = $(DIR_SRC)/$(THISAPP)
 TARGET     = $(DIR_INFO)/$(THISAPP)
 SUP_ARCH   = x86_64 aarch64
 PROG       = libvirt
-PAK_VER    = 47
+PAK_VER    = 48
 
 DEPS       = ebtables libpciaccess ovmf swtpm qemu
 
@@ -49,7 +49,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = a6b2cd5de3f9cd81b8dadc8193c6bd12a018d8c4a6b175168a81988224a66f8e3ab28a2dccc441f8867b896271f6c3fa640cd456af07c64784b4adda5cea8e35
+$(DL_FILE)_BLAKE2 = 3bcef7dc68ff3bd36bd9fff8a537fe3ad0b1e8e53dc43e88541cff1296ed32ec83688cee1123d6d43ba6fdcc0c34bae24afbca50f46c9914e97662e11d7bcb23
 
 install : $(TARGET)
 check : $(patsubst %,$(DIR_CHK)/%,$(objects))
@@ -82,7 +82,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@$(PREBUILD)
 	@rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar Jxf $(DIR_DL)/$(DL_FILE)
 	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libvirt/0001-Change-default-behavior-of-libvirt-guests.sh-for-IPF.patch
-	cd $(DIR_APP) && meson \
+	cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch
+	cd $(DIR_APP) && meson setup \
 				--prefix=/usr \
 				--localstatedir=/var \
 				--sysconfdir=/etc \
diff --git a/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch b/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch
new file mode 100644
index 000000000..54500d6e3
--- /dev/null
+++ b/src/patches/libvirt/libvirt-12.8.0-set-firewall_backend_priority-regardless-of-driver_network.patch
@@ -0,0 +1,103 @@
+From 135e47348266fa6529db7d135abc9204615137ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
+ <marmarek@invisiblethingslab.com>
+Date: Fri, 16 Oct 2026 14:40:44 +0200
+Subject: [PATCH] build: set firewall_backend_priority regardless of
+ driver_network
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set firewall_backend_priority whenever WITH_NWFILTER or WITH_NETWORK is
+set. And similarly, print firewall backends on the same condition.
+
+Otherwise a build with -Ddriver_network=disabled fails with:
+
+    src/nwfilter/meson.build:51:43: ERROR: Unknown variable "firewall_backend_priority".
+
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
+---
+ meson.build | 54 +++++++++++++++++++++++++++--------------------------
+ 1 file changed, 28 insertions(+), 26 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 91547a1cc47..6d5ae23e3eb 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1650,31 +1650,6 @@ endif
+ 
+ if not get_option('driver_network').disabled() and conf.has('WITH_LIBVIRTD')
+   conf.set('WITH_NETWORK', 1)
+-
+-  firewall_backend_priority = get_option('firewall_backend_priority')
+-  if firewall_backend_priority.length() == 0
+-      if host_machine.system() == 'linux'
+-          firewall_backend_priority = ['nftables', 'iptables']
+-      elif host_machine.system() == 'freebsd'
+-          firewall_backend_priority = ['pf']
+-      else
+-          # No firewall impl on non-Linux so far, so force 'none'
+-          # as placeholder
+-          firewall_backend_priority = ['none']
+-      endif
+-  else
+-      if host_machine.system() != 'linux'
+-          error('firewall backend priority only supported on linux hosts')
+-      endif
+-  endif
+-
+-  backends = []
+-  foreach backend: firewall_backend_priority
+-      backend = 'VIR_FIREWALL_BACKEND_' + backend.to_upper()
+-      backends += backend
+-  endforeach
+-
+-  conf.set('FIREWALL_BACKENDS', ', '.join(backends))
+ elif get_option('driver_network').enabled()
+   error('libvirtd must be enabled to build the network driver')
+ endif
+@@ -2035,6 +2010,33 @@ if conf.has('WITH_LIBVIRTD') and host_machine.system() == 'linux'
+   conf.set('WITH_NWFILTER', 1)
+ endif
+ 
++if conf.has('WITH_NWFILTER') or conf.has('WITH_NETWORK')
++  firewall_backend_priority = get_option('firewall_backend_priority')
++  if firewall_backend_priority.length() == 0
++      if host_machine.system() == 'linux'
++          firewall_backend_priority = ['nftables', 'iptables']
++      elif host_machine.system() == 'freebsd'
++          firewall_backend_priority = ['pf']
++      else
++          # No firewall impl on non-Linux so far, so force 'none'
++          # as placeholder
++          firewall_backend_priority = ['none']
++      endif
++  else
++      if host_machine.system() != 'linux'
++          error('firewall backend priority only supported on linux hosts')
++      endif
++  endif
++
++  backends = []
++  foreach backend: firewall_backend_priority
++      backend = 'VIR_FIREWALL_BACKEND_' + backend.to_upper()
++      backends += backend
++  endforeach
++
++  conf.set('FIREWALL_BACKENDS', ', '.join(backends))
++endif
++
+ if not get_option('pm_utils').disabled()
+   use_pm_utils = true
+   if init_script == 'systemd'
+@@ -2373,7 +2375,7 @@ misc_summary = {
+   'virt-login-shell': conf.has('WITH_LOGIN_SHELL'),
+   'Warning Flags': supported_cc_flags,
+ }
+-if conf.has('WITH_NETWORK')
++if conf.has('WITH_NWFILTER') or conf.has('WITH_NETWORK')
+   misc_summary += {
+     'firewall backends': firewall_backend_priority,
+   }
+
-- 
2.56.0