move $pve_std_chains to $pve_std_chains->{$ipversion}

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 5a6284fa3d2800f84d067c0bf578d8c5d89ccc8a..dd53004b6941ec05b94c9d993a4b6f533cc41e30 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -489,7 +489,8 @@ my $pve_fw_parsed_macros;
 my $pve_fw_macro_descr;
 my $pve_fw_preferred_macro_names = {};
 
-my $pve_std_chains = {
+my $pve_std_chains = {};
+$pve_std_chains->{4} = {
     'PVEFW-SET-ACCEPT-MARK' => [
        "-j MARK --set-mark 1",
     ],
@@ -2641,7 +2642,7 @@ sub get_option_log_level {
 }
 
 sub generate_std_chains {
-    my ($ruleset, $options) = @_;
+    my ($ruleset, $options, $pve_std_chains) = @_;
 
     my $loglevel = get_option_log_level($options, 'smurf_log_level');
 
@@ -2890,7 +2891,7 @@ sub compile_iptables_filter {
 
     ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o venet0 -m set --match-set ${venet0_ipset_chain} dst -j PVEFW-VENET-IN");
 
-    generate_std_chains($ruleset, $hostfw_options);
+    generate_std_chains($ruleset, $hostfw_options, $pve_std_chains->{$ipversion});
 
     my $hostfw_enable = !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0));