-sub generate_venet_rules_direction {
- my ($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, $direction, $ipversion) = @_;
-
- my $lc_direction = lc($direction);
-
- my $rules = $vmfw_conf->{rules};
-
- my $options = $vmfw_conf->{options};
- my $loglevel = get_option_log_level($options, "log_level_${lc_direction}");
-
- my $chain = "venet0-$vmid-$direction";
-
- ruleset_create_vm_chain($ruleset, $chain, $ipversion, $options, undef, undef, $direction);
-
- ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, 'venet', $direction, undef, $ipversion);
-
- # implement policy
- my $policy;
-
- if ($direction eq 'OUT') {
- $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default
- } else {
- $policy = $options->{policy_in} || 'DROP'; # allow nothing by default
- }
-
- my $accept = generate_nfqueue($options);
- my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept;
- ruleset_add_chain_policy($ruleset, $chain, $ipversion, $vmid, $policy, $loglevel, $accept_action);
-
- if ($direction eq 'OUT') {
- ruleset_generate_rule_insert($ruleset, "PVEFW-VENET-OUT", $ipversion, {
- action => $chain,
- source => $ip,
- iface_in => 'venet0'});
- } else {
- ruleset_generate_rule($ruleset, "PVEFW-VENET-IN", $ipversion, {
- action => $chain,
- dest => $ip,
- iface_out => 'venet0'});
- }
-}
-