From 886534ba4d0281afc0d169546a8d55d3a5c8ece9 Mon Sep 17 00:00:00 2001
From: Soren Hansen <soren.hansen@rackspace.com>
Date: Tue, 28 Sep 2010 09:07:48 +0200
Subject: Make the incoming blocking rules take precedence over the output
 accept rules.

---
 nova/virt/libvirt_conn.py | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

(limited to 'nova')

diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 854fa6761..40a921743 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -527,11 +527,11 @@ class NWFilterFirewall(object):
     def nova_base_ipv4_filter(self):
         retval = "<filter name='nova-base-ipv4' chain='ipv4'>"
         for protocol in ['tcp', 'udp', 'icmp']:
-            for direction,action in [('out','accept'),
-                                     ('in','drop')]:
-                retval += """<rule action='%s' direction='%s' priority='400'>
+            for direction,action,priority in [('out','accept', 400),
+                                     ('in','drop', 399)]:
+                retval += """<rule action='%s' direction='%s' priority='%d'>
                                <%s />
-                             </rule>""" % (action, direction, protocol)
+                             </rule>""" % (action, direction, protocol, priority)
         retval += '</filter>'
         return retval
 
@@ -539,11 +539,12 @@ class NWFilterFirewall(object):
     def nova_base_ipv6_filter(self):
         retval = "<filter name='nova-base-ipv6' chain='ipv6'>"
         for protocol in ['tcp', 'udp', 'icmp']:
-            for direction,action in [('out','accept'),
-                                     ('in','drop')]:
-                retval += """<rule action='%s' direction='%s' priority='400'>
+            for direction,action,priority in [('out','accept',400),
+                                     ('in','drop',399)]:
+                retval += """<rule action='%s' direction='%s' priority='%d'>
                                <%s-ipv6 />
-                             </rule>""" % (action, direction, protocol)
+                             </rule>""" % (action, direction,
+                                             protocol, priority)
         retval += '</filter>'
         return retval
 
-- 
cgit