Re: [libvirt] [PATCH] nwfilter: Clear all state tracking from a drop rule

Don't use state-matching in a drop rule. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com&gt; Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -1380,13 +1380,16 @@ _iptablesCreateRuleInstance(int directio return 0; } - if (match) - virBufferVSprintf(&buf, " %s", match); - if (rule->action == VIR_NWFILTER_RULE_ACTION_ACCEPT) target = accept_target; - else + else { target = "DROP"; + match = NULL; + } + + if (match) + virBufferVSprintf(&buf, " %s", match); + virBufferVSprintf(&buf, " -j %s" CMD_DEF_POST CMD_SEPARATOR