mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-09-24 16:35:44 +00:00
ccca5dc3a2
The functions - iptablesAddForwardDontMasquerade(), - iptablesRemoveForwardDontMasquerade handle exceptions in the masquerading implemented in the POSTROUTING chain of the "nat" table. Such exceptions should be added as chronologically latest, logically top-most rules. The bridge driver will call these functions beginning with the next patch: some special destination IP addresses always refer to the local subnetwork, even though they don't match any practical subnetwork's netmask. Packets from virbrN targeting such IP addresses are never routed outwards, but the current rules treat them as non-virbrN-destined packets and masquerade them. This causes problems for some receivers on virbrN. Signed-off-by: Laszlo Ersek <lersek@redhat.com>
111 lines
5.8 KiB
C
111 lines
5.8 KiB
C
/*
|
|
* viriptables.h: helper APIs for managing iptables
|
|
*
|
|
* Copyright (C) 2007, 2008 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*
|
|
* Authors:
|
|
* Mark McLoughlin <markmc@redhat.com>
|
|
*/
|
|
|
|
#ifndef __QEMUD_IPTABLES_H__
|
|
# define __QEMUD_IPTABLES_H__
|
|
|
|
# include "virsocketaddr.h"
|
|
|
|
int iptablesAddTcpInput (int family,
|
|
const char *iface,
|
|
int port);
|
|
int iptablesRemoveTcpInput (int family,
|
|
const char *iface,
|
|
int port);
|
|
|
|
int iptablesAddUdpInput (int family,
|
|
const char *iface,
|
|
int port);
|
|
int iptablesRemoveUdpInput (int family,
|
|
const char *iface,
|
|
int port);
|
|
|
|
int iptablesAddForwardAllowOut (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *iface,
|
|
const char *physdev);
|
|
int iptablesRemoveForwardAllowOut (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *iface,
|
|
const char *physdev);
|
|
|
|
int iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *iface,
|
|
const char *physdev);
|
|
int iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *iface,
|
|
const char *physdev);
|
|
|
|
int iptablesAddForwardAllowIn (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *iface,
|
|
const char *physdev);
|
|
int iptablesRemoveForwardAllowIn (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *iface,
|
|
const char *physdev);
|
|
|
|
int iptablesAddForwardAllowCross (int family,
|
|
const char *iface);
|
|
int iptablesRemoveForwardAllowCross (int family,
|
|
const char *iface);
|
|
|
|
int iptablesAddForwardRejectOut (int family,
|
|
const char *iface);
|
|
int iptablesRemoveForwardRejectOut (int family,
|
|
const char *iface);
|
|
|
|
int iptablesAddForwardRejectIn (int family,
|
|
const char *iface);
|
|
int iptablesRemoveForwardRejectIn (int family,
|
|
const char *iface);
|
|
|
|
int iptablesAddForwardMasquerade (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *physdev,
|
|
virSocketAddrRangePtr addr,
|
|
virPortRangePtr port,
|
|
const char *protocol);
|
|
int iptablesRemoveForwardMasquerade (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *physdev,
|
|
virSocketAddrRangePtr addr,
|
|
virPortRangePtr port,
|
|
const char *protocol);
|
|
int iptablesAddDontMasquerade (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *physdev,
|
|
const char *destaddr);
|
|
int iptablesRemoveDontMasquerade (virSocketAddr *netaddr,
|
|
unsigned int prefix,
|
|
const char *physdev,
|
|
const char *destaddr);
|
|
int iptablesAddOutputFixUdpChecksum (const char *iface,
|
|
int port);
|
|
int iptablesRemoveOutputFixUdpChecksum (const char *iface,
|
|
int port);
|
|
|
|
#endif /* __QEMUD_IPTABLES_H__ */
|