On April 11, 2019 12:03 pm, Christian Ebner wrote:
> Only if the VM firewall is enabled, the tap rules for each of the NICs should
> be
> generated, analogous to the current behaviour for CTs.
applied this in spirit, but merged the check into the return for
non-existing guest firewall configs (+ a whitespace cleanup followup +
cherry-pick to stable-5):
From bd60a824555eec55e08909ca189d49962761c93b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbich...@proxmox.com>
Date: Wed, 7 Aug 2019 09:25:36 +0200
Subject: [PATCH firewall] skip tap rule generation if vmfw is disabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
like for containers, and adapt code style to be identical.
Signed-off-by: Fabian Grünbichler <f.gruenbich...@proxmox.com>
---
src/PVE/Firewall.pm | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 0e15090..ff494d6 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -3592,7 +3592,7 @@ sub compile_iptables_filter {
eval {
my $conf = $vmdata->{qemu}->{$vmid};
my $vmfw_conf = $vmfw_configs->{$vmid};
- return if !$vmfw_conf;
+ return if !$vmfw_conf || !$vmfw_conf->{options}->{enable};
foreach my $netid (sort keys %$conf) {
next if $netid !~ m/^net(\d+)$/;
@@ -3615,9 +3615,7 @@ sub compile_iptables_filter {
eval {
my $conf = $vmdata->{lxc}->{$vmid};
my $vmfw_conf = $vmfw_configs->{$vmid};
- return if !$vmfw_conf;
-
- if ($vmfw_conf->{options}->{enable}) {
+ return if !$vmfw_conf || !$vmfw_conf->{options}->{enable};
foreach my $netid (sort keys %$conf) {
next if $netid !~ m/^net(\d+)$/;
my $net =
PVE::LXC::Config->parse_lxc_network($conf->{$netid});
@@ -3628,7 +3626,6 @@ sub compile_iptables_filter {
$vmfw_conf, $vmid, 'IN',
$ipversion);
generate_tap_rules_direction($ruleset, $cluster_conf,
$iface, $netid, $macaddr,
$vmfw_conf, $vmid, 'OUT',
$ipversion);
- }
}
};
warn $@ if $@; # just to be sure - should not happen
--
2.20.1
>
> Signed-off-by: Christian Ebner <c.eb...@proxmox.com>
> ---
> src/PVE/Firewall.pm | 24 +++++++++++++-----------
> 1 file changed, 13 insertions(+), 11 deletions(-)
>
> diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
> index 48e6300..91e21ed 100644
> --- a/src/PVE/Firewall.pm
> +++ b/src/PVE/Firewall.pm
> @@ -3572,17 +3572,19 @@ sub compile_iptables_filter {
> my $vmfw_conf = $vmfw_configs->{$vmid};
> return if !$vmfw_conf;
>
> - foreach my $netid (sort keys %$conf) {
> - next if $netid !~ m/^net(\d+)$/;
> - my $net = PVE::QemuServer::parse_net($conf->{$netid});
> - next if !$net->{firewall};
> - my $iface = "tap${vmid}i$1";
> -
> - my $macaddr = $net->{macaddr};
> - generate_tap_rules_direction($ruleset, $cluster_conf, $iface,
> $netid, $macaddr,
> - $vmfw_conf, $vmid, 'IN',
> $ipversion);
> - generate_tap_rules_direction($ruleset, $cluster_conf, $iface,
> $netid, $macaddr,
> - $vmfw_conf, $vmid, 'OUT',
> $ipversion);
> + if ($vmfw_conf->{options}->{enable}) {
> + foreach my $netid (sort keys %$conf) {
> + next if $netid !~ m/^net(\d+)$/;
> + my $net = PVE::QemuServer::parse_net($conf->{$netid});
> + next if !$net->{firewall};
> + my $iface = "tap${vmid}i$1";
> +
> + my $macaddr = $net->{macaddr};
> + generate_tap_rules_direction($ruleset, $cluster_conf,
> $iface, $netid, $macaddr,
> + $vmfw_conf, $vmid, 'IN',
> $ipversion);
> + generate_tap_rules_direction($ruleset, $cluster_conf,
> $iface, $netid, $macaddr,
> + $vmfw_conf, $vmid, 'OUT',
> $ipversion);
> + }
> }
> };
> warn $@ if $@; # just to be sure - should not happen
> --
> 2.11.0
>
> _______________________________________________
> pve-devel mailing list
> pve-devel@pve.proxmox.com
> https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
_______________________________________________
pve-devel mailing list
pve-devel@pve.proxmox.com
https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
