diff options
| author | Joachim F <joachifm@users.noreply.github.com> | 2017-05-21 17:22:33 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-05-21 17:22:33 +0100 |
| commit | 8f89e43427572b019c1e647a0715a011f4711be0 (patch) | |
| tree | fb252ac31b5abab2296e46953f5a3974b21574cb /nixos/modules/virtualisation | |
| parent | bfd3227686d80701250aab9eff4301b84f630e8d (diff) | |
| parent | 1c7629ce635cf98bfd4ba83137baf36259421e3a (diff) | |
| download | nixlib-8f89e43427572b019c1e647a0715a011f4711be0.tar nixlib-8f89e43427572b019c1e647a0715a011f4711be0.tar.gz nixlib-8f89e43427572b019c1e647a0715a011f4711be0.tar.bz2 nixlib-8f89e43427572b019c1e647a0715a011f4711be0.tar.lz nixlib-8f89e43427572b019c1e647a0715a011f4711be0.tar.xz nixlib-8f89e43427572b019c1e647a0715a011f4711be0.tar.zst nixlib-8f89e43427572b019c1e647a0715a011f4711be0.zip | |
Merge pull request #25700 from michalpalka/xen-bridge-stop-fix
xen service: Fix removing netfilter rules while stopping xen-bridge
Diffstat (limited to 'nixos/modules/virtualisation')
| -rw-r--r-- | nixos/modules/virtualisation/xen-dom0.nix | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix index 7df2df6ef8a8..f6f2d5dad01c 100644 --- a/nixos/modules/virtualisation/xen-dom0.nix +++ b/nixos/modules/virtualisation/xen-dom0.nix @@ -406,6 +406,9 @@ in ''; serviceConfig.ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq --conf-file=/var/run/xen/dnsmasq.conf"; postStop = '' + IFS='-' read -a data <<< `${pkgs.sipcalc}/bin/sipcalc ${cfg.bridge.address}/${toString cfg.bridge.prefixLength} | grep Network\ address` + export XEN_BRIDGE_NETWORK_ADDRESS="${"\${data[1]//[[:blank:]]/}"}" + ${pkgs.inetutils}/bin/ifconfig ${cfg.bridge.name} down ${pkgs.bridge-utils}/bin/brctl delbr ${cfg.bridge.name} @@ -413,8 +416,8 @@ in ${pkgs.iptables}/bin/iptables -w -D INPUT -i ${cfg.bridge.name} -p udp -d ${cfg.bridge.address} --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT ${pkgs.iptables}/bin/iptables -w -D INPUT -i ${cfg.bridge.name} -p tcp -d ${cfg.bridge.address} --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT # DHCP - ${pkgs.iptables}/bin/iptables -w -D INPUT -i ${cfg.bridge.name} -p udp --sport 68 --dport 67 -j ACCEPT - ${pkgs.iptables}/bin/iptables -w -D INPUT -i ${cfg.bridge.name} -p tcp --sport 68 --dport 67 -j ACCEPT + ${pkgs.iptables}/bin/iptables -w -D INPUT -i ${cfg.bridge.name} -p udp -s $XEN_BRIDGE_NETWORK_ADDRESS/${toString cfg.bridge.prefixLength} --sport 68 --dport 67 -j ACCEPT + ${pkgs.iptables}/bin/iptables -w -D INPUT -i ${cfg.bridge.name} -p tcp -s $XEN_BRIDGE_NETWORK_ADDRESS/${toString cfg.bridge.prefixLength} --sport 68 --dport 67 -j ACCEPT ''; }; |