From 3e4b9d5be731464762e5e60b288eee141687465b Mon Sep 17 00:00:00 2001 From: Dennis Konrad Date: Tue, 7 May 2019 16:11:22 +0200 Subject: [PATCH] ACLs in custom chains are referenced now. Even when static routes are used Also the order of FORWARD rules is fixed so custom chaines are checked. This wasn't the case before. They were created but never reached (like dead code but in iptables) --- systemvm/debian/opt/cloud/bin/cs/CsAddress.py | 4 ++-- systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py index ab0cee60039c..52cddee0306d 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py @@ -441,8 +441,8 @@ def fw_vpcrouter(self): " -i %s -m state --state RELATED,ESTABLISHED " % self.dev + "-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"]) guestNetworkCidr = self.address['network'] - self.fw.append(["filter", "", "-A FORWARD -d %s -o %s -j ACL_INBOUND_%s" % - (guestNetworkCidr, self.dev, self.dev)]) + self.fw.append(["filter", "", "-A FORWARD -o %s -j ACL_INBOUND_%s" % + (self.dev, self.dev)]) self.fw.append( ["filter", "front", "-A ACL_INBOUND_%s -d 224.0.0.18/32 -j ACCEPT" % self.dev]) self.fw.append( diff --git a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py index 01dfa7cac399..d1b5f61124ca 100755 --- a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py +++ b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py @@ -167,7 +167,7 @@ def compare(self, list): cpy = cpy.replace('-A', '-I') if isinstance(fw[1], int): # if the rule is for ACLs, we want to insert them in order, right before the DROP all - if rule_chain.startswith("ACL_INBOUND") or rule_chain.startswith("ACL_OUTBOUND"): + if rule_chain.startswith("ACL_INBOUND") or rule_chain.startswith("ACL_OUTBOUND") or rule_chain.startswith("FORWARD"): rule_count = self.chain.get_count(rule_chain) if self.chain.get_count(rule_chain) > 0 else 1 cpy = cpy.replace("-A %s" % new_rule.get_chain(), '-I %s %s' % (new_rule.get_chain(), rule_count)) else: