ebtables: test layer2_protocols in an external chain

We need the not matching DROP outside the main tapchain,
in a specific proto chain, and a ACCEPT in the main tap chain.

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 33f558c68fa8db5866993e914a48002e2f72b791..6ac303831a62f630d437ef0e0508decd2b72f5ac 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -3770,14 +3770,18 @@ sub generate_tap_layer2filter {
     }
 
     if (defined($options->{layer2_protocols})){
     }
 
     if (defined($options->{layer2_protocols})){

+       my $protochain = $tapchain."-PROTO";
+       ruleset_addrule($ruleset, $tapchain, '', "-j $protochain");
+       ruleset_create_chain($ruleset, $protochain);
+

        foreach my $proto (split(/,/, $options->{layer2_protocols})) {
        foreach my $proto (split(/,/, $options->{layer2_protocols})) {

-           ruleset_addrule($ruleset, $tapchain, "-p $proto", '-j ACCEPT');
+           ruleset_addrule($ruleset, $protochain, "-p $proto", '-j RETURN');

        }
        }

-       ruleset_addrule($ruleset, $tapchain, '', "-j DROP");
-    } else {
-       ruleset_addrule($ruleset, $tapchain, '', '-j ACCEPT');
+       ruleset_addrule($ruleset, $protochain, '', '-j DROP');

     }
 
     }
 

+    ruleset_addrule($ruleset, $tapchain, '', '-j ACCEPT');
+

     ruleset_addrule($ruleset, 'PVEFW-FWBR-OUT', "-i $iface", "-j $tapchain");
 }
 
     ruleset_addrule($ruleset, 'PVEFW-FWBR-OUT', "-i $iface", "-j $tapchain");
 }