Re: [PATCH] nwfilter: cut off connections after changing filters

[Eric Blake <eblake@xxxxxxxxxx>]

On 10/13/2010 11:53 AM, Stefan Berger wrote:
> did previously not cut off existing (ssh) connections but only prevented
> newly initiated ones. The attached patch allows to cut off existing
> connections as well, thus enforcing what the filter is showing.
>
>
> +
> +static void
> +iptablesEnforceDirection(int directionIn,
> + virNWFilterRuleDefPtr rule,
> + virBufferPtr buf)
> +{
> + if (rule->tt != VIR_NWFILTER_RULE_DIRECTION_INOUT)
> + virBufferVSprintf(buf, " -m conntrack --ctdir %s",
> + (directionIn) ? "Original"
> + : "Reply");
> +}

ACK.

--
Eric Blake   eblake@xxxxxxxxxx    +1-801-349-2682
Libvirt virtualization library http://libvirt.org

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list