skip tap rule generation if vmfw is disabled

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index e46a3b1716fef8665a0c17c472b651ab0a0cca47..e8bcec4069c7e1969f07fdbfe3eaf619d7e29694 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2387,10 +2387,10 @@ sub generate_tap_rules_direction {
     # plug the tap chain to bridge chain
     if ($direction eq 'IN') {
        ruleset_addrule($ruleset, "PVEFW-FWBR-IN",
-                       "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain", $loglevel, 'FWBR-IN: ', $vmid);
+                       "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain");
     } else {
        ruleset_addrule($ruleset, "PVEFW-FWBR-OUT",
-                       "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain", $loglevel, 'FWBR-OUT: ', $vmid);
+                       "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain");
     }
 }
 
@@ -3544,7 +3544,7 @@ sub compile_iptables_filter {
        eval {
            my $conf = $vmdata->{qemu}->{$vmid};
            my $vmfw_conf = $vmfw_configs->{$vmid};
-           return if !$vmfw_conf;
+           return if !$vmfw_conf || !$vmfw_conf->{options}->{enable};
 
            foreach my $netid (sort keys %$conf) {
                next if $netid !~ m/^net(\d+)$/;
@@ -3567,9 +3567,7 @@ sub compile_iptables_filter {
         eval {
             my $conf = $vmdata->{lxc}->{$vmid};
             my $vmfw_conf = $vmfw_configs->{$vmid};
-            return if !$vmfw_conf;
-
-            if ($vmfw_conf->{options}->{enable}) {
+            return if !$vmfw_conf || !$vmfw_conf->{options}->{enable};
                foreach my $netid (sort keys %$conf) {
                     next if $netid !~ m/^net(\d+)$/;
                     my $net = PVE::LXC::Config->parse_lxc_network($conf->{$netid});
@@ -3580,7 +3578,6 @@ sub compile_iptables_filter {
                                                  $vmfw_conf, $vmid, 'IN', $ipversion);
                     generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr,
                                                  $vmfw_conf, $vmid, 'OUT', $ipversion);
-               }
             }
         };
         warn $@ if $@; # just to be sure - should not happen
@@ -3782,11 +3779,11 @@ sub compile_ebtables_filter {
                        push(@$arpfilter, $ip);
                    }
                }
-               if ($net->{ip} && $vmfw_conf->{options}->{ipfilter}) {
+               if (defined(my $ip = $net->{ip}) && $vmfw_conf->{options}->{ipfilter}) {
                    # ebtables changes this to a .0/MASK network but we just
                    # want the address here, no network - see #2193
-                   $net->{ip} =~ s|/(\d+)$||;
-                   push @$arpfilter, $net->{ip};
+                   $ip =~ s|/(\d+)$||;
+                   push @$arpfilter, $ip;
                }
                generate_tap_layer2filter($ruleset, $iface, $macaddr, $vmfw_conf, $vmid, $arpfilter);
            }