mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-26 18:41:17 +00:00
nwfilter: changes to rules in VM->host table
In the table built for traffic coming from the VM going to the host make the following changes: - don't ACCEPT the packets but do a 'RETURN' and let the host-specific firewall rules in subsequent rules evaluate whether the traffic is allowed to enter - use the '-m state' in the rules as everywhere else
This commit is contained in:
parent
6dcd9c0d15
commit
7d79da247a
@ -1790,6 +1790,10 @@ iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter,
|
|||||||
return rc;
|
return rc;
|
||||||
|
|
||||||
maySkipICMP = directionIn;
|
maySkipICMP = directionIn;
|
||||||
|
if (needState)
|
||||||
|
matchState = directionIn ? MATCH_STATE_IN : MATCH_STATE_OUT;
|
||||||
|
else
|
||||||
|
matchState = NULL;
|
||||||
|
|
||||||
chainPrefix[0] = 'H';
|
chainPrefix[0] = 'H';
|
||||||
chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP;
|
chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP;
|
||||||
@ -1800,8 +1804,8 @@ iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter,
|
|||||||
ifname,
|
ifname,
|
||||||
vars,
|
vars,
|
||||||
res,
|
res,
|
||||||
NULL, true,
|
matchState, true,
|
||||||
"ACCEPT",
|
"RETURN",
|
||||||
isIPv6,
|
isIPv6,
|
||||||
maySkipICMP);
|
maySkipICMP);
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user