mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-07-11 12:25:52 +00:00
13ffa48d2f
As with previous commits use virCommandSetDryRun to invoke virCommandToString so that it returns pre-wrapped string. Since virCommand is better aware of where the arguments terminate we can see an improvement where comments are no longer line-wrapped. The changes to the 'commonRules' strings were done with the following regex: s/ -/ \\\\\\n-/ Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
316 lines
4.7 KiB
Plaintext
316 lines
4.7 KiB
Plaintext
ebtables \
|
|
--concurrent \
|
|
-t nat \
|
|
-A libvirt-J-vnet0 \
|
|
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
|
|
-p 0x806 \
|
|
-j ACCEPT
|
|
ebtables \
|
|
--concurrent \
|
|
-t nat \
|
|
-A libvirt-J-vnet0 \
|
|
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
|
|
-p 0x806 \
|
|
-j DROP
|
|
ebtables \
|
|
--concurrent \
|
|
-t nat \
|
|
-A libvirt-J-vnet0 \
|
|
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
|
|
-p 0x806 \
|
|
-j DROP
|
|
ebtables \
|
|
--concurrent \
|
|
-t nat \
|
|
-A libvirt-P-vnet0 \
|
|
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
|
|
-p 0x800 \
|
|
-j ACCEPT
|
|
ebtables \
|
|
--concurrent \
|
|
-t nat \
|
|
-A libvirt-P-vnet0 \
|
|
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
|
|
-p 0x800 \
|
|
-j DROP
|
|
ebtables \
|
|
--concurrent \
|
|
-t nat \
|
|
-A libvirt-P-vnet0 \
|
|
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
|
|
-p 0x800 \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--destination 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m state \
|
|
--state NEW,ESTABLISHED \
|
|
-m comment \
|
|
--comment 'accept rule -- dir out' \
|
|
-j RETURN
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
--source 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m state \
|
|
--state ESTABLISHED \
|
|
-m comment \
|
|
--comment 'accept rule -- dir out' \
|
|
-j ACCEPT
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--destination 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m state \
|
|
--state NEW,ESTABLISHED \
|
|
-m comment \
|
|
--comment 'accept rule -- dir out' \
|
|
-j RETURN
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--destination 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m comment \
|
|
--comment 'drop rule -- dir out' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
--source 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m comment \
|
|
--comment 'drop rule -- dir out' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--destination 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m comment \
|
|
--comment 'drop rule -- dir out' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--destination 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m comment \
|
|
--comment 'reject rule -- dir out' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
--source 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m comment \
|
|
--comment 'reject rule -- dir out' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--destination 10.1.2.3/32 \
|
|
-m dscp \
|
|
--dscp 2 \
|
|
-m comment \
|
|
--comment 'reject rule -- dir out' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
--destination 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m state \
|
|
--state ESTABLISHED \
|
|
-m comment \
|
|
--comment 'accept rule -- dir in' \
|
|
-j RETURN
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--source 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m state \
|
|
--state NEW,ESTABLISHED \
|
|
-m comment \
|
|
--comment 'accept rule -- dir in' \
|
|
-j ACCEPT
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
--destination 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m state \
|
|
--state ESTABLISHED \
|
|
-m comment \
|
|
--comment 'accept rule -- dir in' \
|
|
-j RETURN
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
--destination 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m comment \
|
|
--comment 'drop rule -- dir in' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--source 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m comment \
|
|
--comment 'drop rule -- dir in' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
--destination 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m comment \
|
|
--comment 'drop rule -- dir in' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
--destination 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m comment \
|
|
--comment 'reject rule -- dir in' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
-m mac \
|
|
--mac-source 01:02:03:04:05:06 \
|
|
--source 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m comment \
|
|
--comment 'reject rule -- dir in' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
--destination 10.1.2.3/22 \
|
|
-m dscp \
|
|
--dscp 33 \
|
|
-m comment \
|
|
--comment 'reject rule -- dir in' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'accept rule -- dir inout' \
|
|
-j RETURN
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'accept rule -- dir inout' \
|
|
-j ACCEPT
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'accept rule -- dir inout' \
|
|
-j RETURN
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'drop rule -- dir inout' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'drop rule -- dir inout' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'drop rule -- dir inout' \
|
|
-j DROP
|
|
iptables \
|
|
-w \
|
|
-A FJ-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'reject rule -- dir inout' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A FP-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'reject rule -- dir inout' \
|
|
-j REJECT
|
|
iptables \
|
|
-w \
|
|
-A HJ-vnet0 \
|
|
-p all \
|
|
-m comment \
|
|
--comment 'reject rule -- dir inout' \
|
|
-j REJECT
|