[PATCH v3 04/27] util: #define the names used for private packet filter chains

Signed-off-by: Laine Stump <laine(a)redhat.com&gt; Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com&gt; --- src/network/network_iptables.c | 51 +++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/src/network/network_iptables.c b/src/network/network_iptables.c index 697ad5d8d6..ac3e60b79f 100644 --- a/src/network/network_iptables.c +++ b/src/network/network_iptables.c @@ -38,6 +38,13 @@ VIR_LOG_INIT("network.iptables"); #define VIR_FROM_THIS VIR_FROM_NONE +#define VIR_IPTABLES_INPUT_CHAIN "LIBVIRT_INP" +#define VIR_IPTABLES_OUTPUT_CHAIN "LIBVIRT_OUT" +#define VIR_IPTABLES_FWD_IN_CHAIN "LIBVIRT_FWI" +#define VIR_IPTABLES_FWD_OUT_CHAIN "LIBVIRT_FWO" +#define VIR_IPTABLES_FWD_X_CHAIN "LIBVIRT_FWX" +#define VIR_IPTABLES_NAT_POSTROUTE_CHAIN "LIBVIRT_PRT" + enum { VIR_NETFILTER_INSERT = 0, VIR_NETFILTER_DELETE @@ -114,14 +121,14 @@ iptablesSetupPrivateChains(virFirewallLayer layer) { g_autoptr(virFirewall) fw = virFirewallNew(); iptablesGlobalChain filter_chains[] = { - {"INPUT", "LIBVIRT_INP"}, - {"OUTPUT", "LIBVIRT_OUT"}, - {"FORWARD", "LIBVIRT_FWO"}, - {"FORWARD", "LIBVIRT_FWI"}, - {"FORWARD", "LIBVIRT_FWX"}, + {"INPUT", VIR_IPTABLES_INPUT_CHAIN}, + {"OUTPUT", VIR_IPTABLES_OUTPUT_CHAIN}, + {"FORWARD", VIR_IPTABLES_FWD_OUT_CHAIN}, + {"FORWARD", VIR_IPTABLES_FWD_IN_CHAIN}, + {"FORWARD", VIR_IPTABLES_FWD_X_CHAIN}, }; iptablesGlobalChain natmangle_chains[] = { - {"POSTROUTING", "LIBVIRT_PRT"}, + {"POSTROUTING", VIR_IPTABLES_NAT_POSTROUTE_CHAIN}, }; bool changed = false; iptablesGlobalChainData data[] = { @@ -169,7 +176,7 @@ iptablesInput(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_INP", + VIR_IPTABLES_INPUT_CHAIN, "--in-interface", iface, "--protocol", tcp ? "tcp" : "udp", "--destination-port", portstr, @@ -190,7 +197,7 @@ iptablesOutput(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_OUT", + VIR_IPTABLES_OUTPUT_CHAIN, "--out-interface", iface, "--protocol", tcp ? "tcp" : "udp", "--destination-port", portstr, @@ -365,7 +372,7 @@ iptablesForwardAllowOut(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWO", + VIR_IPTABLES_FWD_OUT_CHAIN, "--source", networkstr, "--in-interface", iface, "--out-interface", physdev, @@ -375,7 +382,7 @@ iptablesForwardAllowOut(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWO", + VIR_IPTABLES_FWD_OUT_CHAIN, "--source", networkstr, "--in-interface", iface, "--jump", "ACCEPT", @@ -455,7 +462,7 @@ iptablesForwardAllowRelatedIn(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWI", + VIR_IPTABLES_FWD_IN_CHAIN, "--destination", networkstr, "--in-interface", physdev, "--out-interface", iface, @@ -467,7 +474,7 @@ iptablesForwardAllowRelatedIn(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWI", + VIR_IPTABLES_FWD_IN_CHAIN, "--destination", networkstr, "--out-interface", iface, "--match", "conntrack", @@ -547,7 +554,7 @@ iptablesForwardAllowIn(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWI", + VIR_IPTABLES_FWD_IN_CHAIN, "--destination", networkstr, "--in-interface", physdev, "--out-interface", iface, @@ -557,7 +564,7 @@ iptablesForwardAllowIn(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWI", + VIR_IPTABLES_FWD_IN_CHAIN, "--destination", networkstr, "--out-interface", iface, "--jump", "ACCEPT", @@ -622,7 +629,7 @@ iptablesForwardAllowCross(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWX", + VIR_IPTABLES_FWD_X_CHAIN, "--in-interface", iface, "--out-interface", iface, "--jump", "ACCEPT", @@ -676,7 +683,7 @@ iptablesForwardRejectOut(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWO", + VIR_IPTABLES_FWD_OUT_CHAIN, "--in-interface", iface, "--jump", "REJECT", NULL); @@ -728,7 +735,7 @@ iptablesForwardRejectIn(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "filter", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_FWI", + VIR_IPTABLES_FWD_IN_CHAIN, "--out-interface", iface, "--jump", "REJECT", NULL); @@ -810,7 +817,7 @@ iptablesForwardMasquerade(virFirewall *fw, rule = virFirewallAddRule(fw, layer, "--table", "nat", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_PRT", + VIR_IPTABLES_NAT_POSTROUTE_CHAIN, "--source", networkstr, "-p", protocol, "!", "--destination", networkstr, @@ -819,7 +826,7 @@ iptablesForwardMasquerade(virFirewall *fw, rule = virFirewallAddRule(fw, layer, "--table", "nat", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_PRT", + VIR_IPTABLES_NAT_POSTROUTE_CHAIN, "--source", networkstr, "!", "--destination", networkstr, NULL); @@ -946,7 +953,7 @@ iptablesForwardDontMasquerade(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "nat", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_PRT", + VIR_IPTABLES_NAT_POSTROUTE_CHAIN, "--out-interface", physdev, "--source", networkstr, "--destination", destaddr, @@ -956,7 +963,7 @@ iptablesForwardDontMasquerade(virFirewall *fw, virFirewallAddRule(fw, layer, "--table", "nat", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_PRT", + VIR_IPTABLES_NAT_POSTROUTE_CHAIN, "--source", networkstr, "--destination", destaddr, "--jump", "RETURN", @@ -1028,7 +1035,7 @@ iptablesOutputFixUdpChecksum(virFirewall *fw, virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, "--table", "mangle", action == VIR_NETFILTER_INSERT ? "--insert" : "--delete", - "LIBVIRT_PRT", + VIR_IPTABLES_NAT_POSTROUTE_CHAIN, "--out-interface", iface, "--protocol", "udp", "--destination-port", portstr, -- 2.44.0