Re: [PATCH] VirtUtils: bridge initialization adds iptables rules

[Jiri Pirko]

Mon, May 27, 2013 at 03:53:23PM CEST, olichtne(a)redhat.com wrote:
> From: Ondrej Lichtner <olichtne(a)redhat.com&gt;
>
> When creating virtual networks we are using bridge interfaces on the
> host machine. The default behaviour of these bridges is to filter
> packets through iptables, which resulted in IPv6 communication being
> blocked. This commit fixes that by adding iptable calls to the bridge
> initialization. Every newly created bridge now works as an isolated
> network.
>
> From what I've seen these are the same rules added by libvirt when
> creating an isolated network.
>
> Signed-off-by: Ondrej Lichtner <olichtne(a)redhat.com&gt;
> ---
>  lnst/Common/VirtUtils.py | 28 ++++++++++++++++++++++++++++
>  1 file changed, 28 insertions(+)
>
> diff --git a/lnst/Common/VirtUtils.py b/lnst/Common/VirtUtils.py
> index 71659ef..e13bfe2 100644
> --- a/lnst/Common/VirtUtils.py
> +++ b/lnst/Common/VirtUtils.py
> @@ -36,6 +36,18 @@ def _brctl(cmd):
>      except ExecCmdFail as err:
>          raise VirtUtilsError("brctl error: %s" % err)
>  
> +def _iptables(cmd):
> +    try:
> +        exec_cmd("iptables %s" % cmd)
> +    except ExecCmdFail as err:
> +        raise VirtUtilsError("iptables error: %s" % err)
> +
> +def _ip6tables(cmd):
> +    try:
> +        exec_cmd("ip6tables %s" % cmd)
> +    except ExecCmdFail as err:
> +        raise VirtUtilsError("ip6tables error: %s" % err)
> +
>  def _virsh(cmd):
>      try:
>          exec_cmd("virsh %s" % cmd, log_outputs=False)
> @@ -233,6 +245,14 @@ class BridgeCtl(NetCtl):
>      def init(self):
>          if not self._exists():
>              _brctl("addbr %s" % self._name)
> +            _iptables("-I FORWARD 1 -j REJECT -i %s -o any" % self._name)
> +            _iptables("-I FORWARD 1 -j REJECT -i any -o %s" % self._name)
> +            _iptables("-I FORWARD 1 -j ACCEPT -i %s -o %s" %
> +                                                    (self._name, self._name))
> +            _ip6tables("-I FORWARD 1 -j REJECT -i %s -o any" % self._name)
> +            _ip6tables("-I FORWARD 1 -j REJECT -i any -o %s" % self._name)
> +            _ip6tables("-I FORWARD 1 -j ACCEPT -i %s -o %s" %
> +                                                    (self._name, self._name))
>              self._remove = True
>  
>          _ip("link set %s up" % self._name)
> @@ -241,3 +261,11 @@ class BridgeCtl(NetCtl):
>          if self._remove:
>              _ip("link set %s down" % self._name)
>              _brctl("delbr %s" % self._name)
> +            _iptables("-D FORWARD -j REJECT -i %s -o any" % self._name)
> +            _iptables("-D FORWARD -j REJECT -i any -o %s" % self._name)
> +            _iptables("-D FORWARD -j ACCEPT -i %s -o %s" %
> +                                                    (self._name, self._name))
> +            _ip6tables("-D FORWARD -j REJECT -i %s -o any" % self._name)
> +            _ip6tables("-D FORWARD -j REJECT -i any -o %s" % self._name)
> +            _ip6tables("-D FORWARD -j ACCEPT -i %s -o %s" %
> +                                                    (self._name, self._name))
> -- 
> 1.8.1.4
>
> _______________________________________________
> LNST-developers mailing list
> LNST-developers(a)lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/lnst-developers 

applied