mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-26 18:41:17 +00:00
nwfilter: changes to rules in VM->host table
In the table built for traffic coming from the VM going to the host make the following changes: - don't ACCEPT the packets but do a 'RETURN' and let the host-specific firewall rules in subsequent rules evaluate whether the traffic is allowed to enter - use the '-m state' in the rules as everywhere else
This commit is contained in:
parent
6dcd9c0d15
commit
7d79da247a
@ -1790,6 +1790,10 @@ iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter,
|
||||
return rc;
|
||||
|
||||
maySkipICMP = directionIn;
|
||||
if (needState)
|
||||
matchState = directionIn ? MATCH_STATE_IN : MATCH_STATE_OUT;
|
||||
else
|
||||
matchState = NULL;
|
||||
|
||||
chainPrefix[0] = 'H';
|
||||
chainPrefix[1] = CHAINPREFIX_HOST_IN_TEMP;
|
||||
@ -1800,8 +1804,8 @@ iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter,
|
||||
ifname,
|
||||
vars,
|
||||
res,
|
||||
NULL, true,
|
||||
"ACCEPT",
|
||||
matchState, true,
|
||||
"RETURN",
|
||||
isIPv6,
|
||||
maySkipICMP);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user