External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 06:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

nwfilter: avoid dir. enforcement for certain types of rules

Browse Source 
Avoid the enforcement of direction if
- icmp rules specify the type/code information
- the 'skipMatch' variable is set to 'true'
This commit is contained in:
Stefan Berger 2010-10-19 19:25:37 -04:00
parent 956e3c5890
commit c2fbdf1088
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/nwfilter/nwfilter_ebiptables_driver.c
View File

@ -1159,6 +1159,7 @@ _iptablesCreateRuleInstance(int directionIn,
bool srcMacSkipped = false;
bool skipRule = false;
bool skipMatch = false;
bool hasICMPType = false;
if (!iptables_cmd) {
virNWFilterReportError(VIR_ERR_INTERNAL_ERROR,
@ -1399,6 +1400,8 @@ _iptablesCreateRuleInstance(int directionIn,
if (HAS_ENTRY_ITEM(&rule->p.icmpHdrFilter.dataICMPType)) {
const char *parm;
hasICMPType = true;
if (maySkipICMP)
goto exit_no_error;
@ -1507,7 +1510,7 @@ _iptablesCreateRuleInstance(int directionIn,
if (match && !skipMatch)
virBufferVSprintf(&buf, " %s", match);
if (defMatch && match != NULL)
if (defMatch && match != NULL && !skipMatch && !hasICMPType)
iptablesEnforceDirection(directionIn,
rule,
&buf);