mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-28 11:31:16 +00:00
util/viriptables: add/remove rules that short-circuit masquerading
The functions - iptablesAddForwardDontMasquerade(), - iptablesRemoveForwardDontMasquerade handle exceptions in the masquerading implemented in the POSTROUTING chain of the "nat" table. Such exceptions should be added as chronologically latest, logically top-most rules. The bridge driver will call these functions beginning with the next patch: some special destination IP addresses always refer to the local subnetwork, even though they don't match any practical subnetwork's netmask. Packets from virbrN targeting such IP addresses are never routed outwards, but the current rules treat them as non-virbrN-destined packets and masquerade them. This causes problems for some receivers on virbrN. Signed-off-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
parent
ef29de14c3
commit
ccca5dc3a2
@ -1448,6 +1448,7 @@ virInitctlSetRunLevel;
|
|||||||
|
|
||||||
|
|
||||||
# util/viriptables.h
|
# util/viriptables.h
|
||||||
|
iptablesAddDontMasquerade;
|
||||||
iptablesAddForwardAllowCross;
|
iptablesAddForwardAllowCross;
|
||||||
iptablesAddForwardAllowIn;
|
iptablesAddForwardAllowIn;
|
||||||
iptablesAddForwardAllowOut;
|
iptablesAddForwardAllowOut;
|
||||||
@ -1458,6 +1459,7 @@ iptablesAddForwardRejectOut;
|
|||||||
iptablesAddOutputFixUdpChecksum;
|
iptablesAddOutputFixUdpChecksum;
|
||||||
iptablesAddTcpInput;
|
iptablesAddTcpInput;
|
||||||
iptablesAddUdpInput;
|
iptablesAddUdpInput;
|
||||||
|
iptablesRemoveDontMasquerade;
|
||||||
iptablesRemoveForwardAllowCross;
|
iptablesRemoveForwardAllowCross;
|
||||||
iptablesRemoveForwardAllowIn;
|
iptablesRemoveForwardAllowIn;
|
||||||
iptablesRemoveForwardAllowOut;
|
iptablesRemoveForwardAllowOut;
|
||||||
|
@ -832,6 +832,94 @@ iptablesRemoveForwardMasquerade(virSocketAddr *netaddr,
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
/* Don't masquerade traffic coming from the network associated with the bridge
|
||||||
|
* if said traffic targets @destaddr.
|
||||||
|
*/
|
||||||
|
static int
|
||||||
|
iptablesForwardDontMasquerade(virSocketAddr *netaddr,
|
||||||
|
unsigned int prefix,
|
||||||
|
const char *physdev,
|
||||||
|
const char *destaddr,
|
||||||
|
int action)
|
||||||
|
{
|
||||||
|
int ret = -1;
|
||||||
|
char *networkstr = NULL;
|
||||||
|
virCommandPtr cmd = NULL;
|
||||||
|
|
||||||
|
if (!(networkstr = iptablesFormatNetwork(netaddr, prefix)))
|
||||||
|
return -1;
|
||||||
|
|
||||||
|
if (!VIR_SOCKET_ADDR_IS_FAMILY(netaddr, AF_INET)) {
|
||||||
|
/* Higher level code *should* guaranteee it's impossible to get here. */
|
||||||
|
virReportError(VIR_ERR_INTERNAL_ERROR,
|
||||||
|
_("Attempted to NAT '%s'. NAT is only supported for IPv4."),
|
||||||
|
networkstr);
|
||||||
|
goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
cmd = iptablesCommandNew("nat", "POSTROUTING", AF_INET, action);
|
||||||
|
|
||||||
|
if (physdev && physdev[0])
|
||||||
|
virCommandAddArgList(cmd, "--out-interface", physdev, NULL);
|
||||||
|
|
||||||
|
virCommandAddArgList(cmd, "--source", networkstr,
|
||||||
|
"--destination", destaddr, "--jump", "RETURN", NULL);
|
||||||
|
ret = virCommandRun(cmd, NULL);
|
||||||
|
cleanup:
|
||||||
|
virCommandFree(cmd);
|
||||||
|
VIR_FREE(networkstr);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* iptablesAddDontMasquerade:
|
||||||
|
* @netaddr: the source network name
|
||||||
|
* @prefix: prefix (# of 1 bits) of netmask to apply to @netaddr
|
||||||
|
* @physdev: the physical output device or NULL
|
||||||
|
* @destaddr: the destination network not to masquerade for
|
||||||
|
*
|
||||||
|
* Add rules to the IP table context to avoid masquerading from
|
||||||
|
* @netaddr/@prefix to @destaddr on @physdev. @destaddr must be in a format
|
||||||
|
* directly consumable by iptables, it must not depend on user input or
|
||||||
|
* configuration.
|
||||||
|
*
|
||||||
|
* Returns 0 in case of success or an error code otherwise.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
iptablesAddDontMasquerade(virSocketAddr *netaddr,
|
||||||
|
unsigned int prefix,
|
||||||
|
const char *physdev,
|
||||||
|
const char *destaddr)
|
||||||
|
{
|
||||||
|
return iptablesForwardDontMasquerade(netaddr, prefix, physdev, destaddr,
|
||||||
|
ADD);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* iptablesRemoveDontMasquerade:
|
||||||
|
* @netaddr: the source network name
|
||||||
|
* @prefix: prefix (# of 1 bits) of netmask to apply to @netaddr
|
||||||
|
* @physdev: the physical output device or NULL
|
||||||
|
* @destaddr: the destination network not to masquerade for
|
||||||
|
*
|
||||||
|
* Remove rules from the IP table context that prevent masquerading from
|
||||||
|
* @netaddr/@prefix to @destaddr on @physdev. @destaddr must be in a format
|
||||||
|
* directly consumable by iptables, it must not depend on user input or
|
||||||
|
* configuration.
|
||||||
|
*
|
||||||
|
* Returns 0 in case of success or an error code otherwise.
|
||||||
|
*/
|
||||||
|
int
|
||||||
|
iptablesRemoveDontMasquerade(virSocketAddr *netaddr,
|
||||||
|
unsigned int prefix,
|
||||||
|
const char *physdev,
|
||||||
|
const char *destaddr)
|
||||||
|
{
|
||||||
|
return iptablesForwardDontMasquerade(netaddr, prefix, physdev, destaddr,
|
||||||
|
REMOVE);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
static int
|
static int
|
||||||
iptablesOutputFixUdpChecksum(const char *iface,
|
iptablesOutputFixUdpChecksum(const char *iface,
|
||||||
int port,
|
int port,
|
||||||
|
@ -94,6 +94,14 @@ int iptablesRemoveForwardMasquerade (virSocketAddr *netaddr,
|
|||||||
virSocketAddrRangePtr addr,
|
virSocketAddrRangePtr addr,
|
||||||
virPortRangePtr port,
|
virPortRangePtr port,
|
||||||
const char *protocol);
|
const char *protocol);
|
||||||
|
int iptablesAddDontMasquerade (virSocketAddr *netaddr,
|
||||||
|
unsigned int prefix,
|
||||||
|
const char *physdev,
|
||||||
|
const char *destaddr);
|
||||||
|
int iptablesRemoveDontMasquerade (virSocketAddr *netaddr,
|
||||||
|
unsigned int prefix,
|
||||||
|
const char *physdev,
|
||||||
|
const char *destaddr);
|
||||||
int iptablesAddOutputFixUdpChecksum (const char *iface,
|
int iptablesAddOutputFixUdpChecksum (const char *iface,
|
||||||
int port);
|
int port);
|
||||||
int iptablesRemoveOutputFixUdpChecksum (const char *iface,
|
int iptablesRemoveOutputFixUdpChecksum (const char *iface,
|
||||||
|
Loading…
Reference in New Issue
Block a user