(vm_name, vm_id, vm_ip, vm_mac, vif, brname, dhcpSvr, hostIp, hostMacAddr)
| 698 | |
| 699 | |
| 700 | def post_default_network_rules(vm_name, vm_id, vm_ip, vm_mac, vif, brname, dhcpSvr, hostIp, hostMacAddr): |
| 701 | vmchain_default = '-'.join(vm_name.split('-')[:-1]) + "-def" |
| 702 | iptables_vmchain=iptables_chain_name(vm_name) |
| 703 | vmchain_in = iptables_vmchain + "-in" |
| 704 | vmchain_out = iptables_vmchain + "-out" |
| 705 | domID = get_vm_id(vm_name) |
| 706 | try: |
| 707 | execute("iptables -I " + vmchain_default + " 4 -m physdev --physdev-is-bridged --physdev-in " + vif + " --source " + vm_ip + " -j ACCEPT") |
| 708 | except: |
| 709 | pass |
| 710 | try: |
| 711 | execute("iptables -t nat -A PREROUTING -p tcp -m physdev --physdev-in " + vif + " -m tcp --dport 80 -d " + dhcpSvr + " -j DNAT --to-destination " + hostIp + ":80") |
| 712 | except: |
| 713 | pass |
| 714 | |
| 715 | try: |
| 716 | execute("ebtables -t nat -I " + vmchain_in + " -p IPv4 --ip-protocol tcp --ip-destination-port 80 --ip-dst " + dhcpSvr + " -j dnat --to-destination " + hostMacAddr) |
| 717 | except: |
| 718 | pass |
| 719 | |
| 720 | try: |
| 721 | execute("ebtables -t nat -I " + vmchain_in + " 4 -p ARP --arp-ip-src ! " + vm_ip + " -j DROP") |
| 722 | except: |
| 723 | pass |
| 724 | try: |
| 725 | execute("ebtables -t nat -I " + vmchain_out + " 2 -p ARP --arp-ip-dst ! " + vm_ip + " -j DROP") |
| 726 | except: |
| 727 | pass |
| 728 | if not write_rule_log_for_vm(vm_name, vm_id, vm_ip, domID, '_initial_', '-1'): |
| 729 | logging.debug("Failed to log default network rules, ignoring") |
| 730 | |
| 731 | |
| 732 | def delete_rules_for_vm_in_bridge_firewall_chain(vmName): |
no test coverage detected