GithubFollow/One-KVM
1
0
Fork 0
mirror of https://github.com/mofeng-git/One-KVM.git synced 2025-12-12 01:00:29 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

pikvm/pikvm#957: Added ESTABLISHED,RELATED rule to otgnet

Browse Source
This commit is contained in:
Maxim Devaev 2023-03-26 01:24:26 +02:00
parent 2cd2fa8722
commit f6283e1197
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
kvmd/apps/otgnet/__init__.py
View File

@ -39,6 +39,7 @@ from .. import init
from .netctl import BaseCtl from .netctl import BaseCtl
from .netctl import IfaceUpCtl from .netctl import IfaceUpCtl
from .netctl import IfaceAddIpCtl from .netctl import IfaceAddIpCtl
from .netctl import IptablesAllowEstRelCtl
from .netctl import IptablesDropAllCtl from .netctl import IptablesDropAllCtl
from .netctl import IptablesAllowIcmpCtl from .netctl import IptablesAllowIcmpCtl
from .netctl import IptablesAllowPortCtl from .netctl import IptablesAllowPortCtl
@ -101,6 +102,7 @@ class _Service: # pylint: disable=too-many-instance-attributes
ctls: list[BaseCtl] = [ ctls: list[BaseCtl] = [
CustomCtl(self.__pre_start_cmd, self.__post_stop_cmd, placeholders), CustomCtl(self.__pre_start_cmd, self.__post_stop_cmd, placeholders),
IfaceUpCtl(self.__ip_cmd, netcfg.iface), IfaceUpCtl(self.__ip_cmd, netcfg.iface),
IptablesAllowEstRelCtl(self.__iptables_cmd, netcfg.iface),
*([IptablesAllowIcmpCtl(self.__iptables_cmd, netcfg.iface)] if self.__allow_icmp else []), *([IptablesAllowIcmpCtl(self.__iptables_cmd, netcfg.iface)] if self.__allow_icmp else []),
*[ *[
IptablesAllowPortCtl(self.__iptables_cmd, netcfg.iface, port, tcp) IptablesAllowPortCtl(self.__iptables_cmd, netcfg.iface, port, tcp)

13
kvmd/apps/otgnet/netctl.py
View File

@ -45,6 +45,19 @@ class IfaceAddIpCtl(BaseCtl):
return [*self.__base_cmd, "address", ("add" if direct else "del"), self.__cidr, "dev", self.__iface] return [*self.__base_cmd, "address", ("add" if direct else "del"), self.__cidr, "dev", self.__iface]
class IptablesAllowEstRelCtl(BaseCtl):
def __init__(self, base_cmd: list[str], iface: str) -> None:
self.__base_cmd = base_cmd
self.__iface = iface
def get_command(self, direct: bool) -> list[str]:
return [
*self.__base_cmd,
("-A" if direct else "-D"), "INPUT", "-i", self.__iface,
"-m", "state", "--state", "ESTABLISHED,RELATED", "-j", "ACCEPT",
]
class IptablesDropAllCtl(BaseCtl): class IptablesDropAllCtl(BaseCtl):
def __init__(self, base_cmd: list[str], iface: str) -> None: def __init__(self, base_cmd: list[str], iface: str) -> None:
self.__base_cmd = base_cmd self.__base_cmd = base_cmd