[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [libvirt] [PATCH] nwfilter: cut off connections after changing filters



On 10/13/2010 11:53 AM, Stefan Berger wrote:
did previously not cut off existing (ssh) connections but only prevented
newly initiated ones. The attached patch allows to cut off existing
connections as well, thus enforcing what the filter is showing.


+
+static void
+iptablesEnforceDirection(int directionIn,
+ virNWFilterRuleDefPtr rule,
+ virBufferPtr buf)
+{
+ if (rule->tt != VIR_NWFILTER_RULE_DIRECTION_INOUT)
+ virBufferVSprintf(buf, " -m conntrack --ctdir %s",
+ (directionIn) ? "Original"
+ : "Reply");
+}

ACK.

--
Eric Blake   eblake redhat com    +1-801-349-2682
Libvirt virtualization library http://libvirt.org


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]