On Sat, Jun 19, 2010 at 08:08:25PM +0200, apevec@gmail.com wrote:

From: Alan Pevec <apevec@redhat.com>

--- src/network/bridge_driver.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index d24bfd0..0cd0978 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -1,5 +1,5 @@ /* - * driver.c: core driver methods for managing qemu guests + * bridge_driver.c: core driver methods for managing network * * Copyright (C) 2006-2010 Red Hat, Inc. * Copyright (C) 2006 Daniel P. Berrange

ACK Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

On Sat, Jun 19, 2010 at 08:08:26PM +0200, apevec@gmail.com wrote:

From: Alan Pevec <apevec@redhat.com>

add iptables rules to allow TFTP from the virtual network if <tftp> element is defined in the network definition.

Fedora bz#580215

* src/network/bridge_driver.c: open UDP port 69 for TFTP traffic if tftproot is defined --- src/network/bridge_driver.c | 14 ++++++++++++++ 1 files changed, 14 insertions(+), 0 deletions(-)

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 0cd0978..72255c1 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -737,6 +737,15 @@ networkAddIptablesRules(struct network_driver *driver, goto err4; }

+ /* allow TFTP requests through to dnsmasq */ + if (network->def->tftproot && + (err = iptablesAddUdpInput(driver->iptables, network->def->bridge, 69))) { + virReportSystemError(err, + _("failed to add iptables rule to allow TFTP requests from '%s'"), + network->def->bridge); + goto err4tftp; + } +

/* Catch all rules to block forwarding to/from bridges */

@@ -784,6 +793,10 @@ networkAddIptablesRules(struct network_driver *driver, iptablesRemoveForwardRejectOut(driver->iptables, network->def->bridge); err5: + if (network->def->tftproot) { + iptablesRemoveUdpInput(driver->iptables, network->def->bridge, 69); + } + err4tftp: iptablesRemoveUdpInput(driver->iptables, network->def->bridge, 53); err4: iptablesRemoveTcpInput(driver->iptables, network->def->bridge, 53); @@ -821,6 +834,7 @@ networkRemoveIptablesRules(struct network_driver *driver, iptablesRemoveForwardAllowCross(driver->iptables, network->def->bridge); iptablesRemoveForwardRejectIn(driver->iptables, network->def->bridge); iptablesRemoveForwardRejectOut(driver->iptables, network->def->bridge); + iptablesRemoveUdpInput(driver->iptables, network->def->bridge, 69); iptablesRemoveUdpInput(driver->iptables, network->def->bridge, 53); iptablesRemoveTcpInput(driver->iptables, network->def->bridge, 53); iptablesRemoveUdpInput(driver->iptables, network->def->bridge, 67);

ACK Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|