[PATCH] VirtUtils: bridge initialization adds iptables rules
Jiri Pirko
jpirko at redhat.com
Fri May 31 11:34:17 UTC 2013
Mon, May 27, 2013 at 03:53:23PM CEST, olichtne at redhat.com wrote:
>From: Ondrej Lichtner <olichtne at redhat.com>
>
>When creating virtual networks we are using bridge interfaces on the
>host machine. The default behaviour of these bridges is to filter
>packets through iptables, which resulted in IPv6 communication being
>blocked. This commit fixes that by adding iptable calls to the bridge
>initialization. Every newly created bridge now works as an isolated
>network.
>
>From what I've seen these are the same rules added by libvirt when
>creating an isolated network.
>
>Signed-off-by: Ondrej Lichtner <olichtne at redhat.com>
>---
> lnst/Common/VirtUtils.py | 28 ++++++++++++++++++++++++++++
> 1 file changed, 28 insertions(+)
>
>diff --git a/lnst/Common/VirtUtils.py b/lnst/Common/VirtUtils.py
>index 71659ef..e13bfe2 100644
>--- a/lnst/Common/VirtUtils.py
>+++ b/lnst/Common/VirtUtils.py
>@@ -36,6 +36,18 @@ def _brctl(cmd):
> except ExecCmdFail as err:
> raise VirtUtilsError("brctl error: %s" % err)
>
>+def _iptables(cmd):
>+ try:
>+ exec_cmd("iptables %s" % cmd)
>+ except ExecCmdFail as err:
>+ raise VirtUtilsError("iptables error: %s" % err)
>+
>+def _ip6tables(cmd):
>+ try:
>+ exec_cmd("ip6tables %s" % cmd)
>+ except ExecCmdFail as err:
>+ raise VirtUtilsError("ip6tables error: %s" % err)
>+
> def _virsh(cmd):
> try:
> exec_cmd("virsh %s" % cmd, log_outputs=False)
>@@ -233,6 +245,14 @@ class BridgeCtl(NetCtl):
> def init(self):
> if not self._exists():
> _brctl("addbr %s" % self._name)
>+ _iptables("-I FORWARD 1 -j REJECT -i %s -o any" % self._name)
>+ _iptables("-I FORWARD 1 -j REJECT -i any -o %s" % self._name)
>+ _iptables("-I FORWARD 1 -j ACCEPT -i %s -o %s" %
>+ (self._name, self._name))
>+ _ip6tables("-I FORWARD 1 -j REJECT -i %s -o any" % self._name)
>+ _ip6tables("-I FORWARD 1 -j REJECT -i any -o %s" % self._name)
>+ _ip6tables("-I FORWARD 1 -j ACCEPT -i %s -o %s" %
>+ (self._name, self._name))
> self._remove = True
>
> _ip("link set %s up" % self._name)
>@@ -241,3 +261,11 @@ class BridgeCtl(NetCtl):
> if self._remove:
> _ip("link set %s down" % self._name)
> _brctl("delbr %s" % self._name)
>+ _iptables("-D FORWARD -j REJECT -i %s -o any" % self._name)
>+ _iptables("-D FORWARD -j REJECT -i any -o %s" % self._name)
>+ _iptables("-D FORWARD -j ACCEPT -i %s -o %s" %
>+ (self._name, self._name))
>+ _ip6tables("-D FORWARD -j REJECT -i %s -o any" % self._name)
>+ _ip6tables("-D FORWARD -j REJECT -i any -o %s" % self._name)
>+ _ip6tables("-D FORWARD -j ACCEPT -i %s -o %s" %
>+ (self._name, self._name))
>--
>1.8.1.4
>
>_______________________________________________
>LNST-developers mailing list
>LNST-developers at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/lnst-developers
applied
More information about the LNST-developers
mailing list