Commit 2c5afffb authored by Guido Trotter's avatar Guido Trotter
Browse files

KVMHypervisor: implement instance policy routing



Until now we relied on traffic from instances being policy routed via a
rule based on the instance network. With this change we can enforce it
on the instance interfaces. Since the ip rules survive interface
disappearing and reappearing, we need first to remove leftover rules,
and then to apply the new one, when creating the interface.
Signed-off-by: default avatarGuido Trotter <ultrotter@google.com>
Reviewed-by: default avatarMichael Hanselmann <hansmi@google.com>
parent b7b7cda6
......@@ -171,6 +171,8 @@ class KVMHypervisor(hv_base.BaseHypervisor):
elif nic.nicparams[constants.NIC_MODE] == constants.NIC_MODE_ROUTED:
script.write(" # Route traffic targeted at the IP to the interface\n")
if nic.nicparams[constants.NIC_LINK]:
script.write(" while /sbin/ip rule del dev $INTERFACE; do :; done\n")
script.write(" /sbin/ip rule add dev $INTERFACE table $LINK\n")
script.write(" /sbin/ip route replace $IP/32 table $LINK"
" dev $INTERFACE\n")
else:
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment