From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Date: Tue, 17 Jan 2012 17:47:41 +0000 (-0500)
Subject: nwfilter: fix typing error in filter
X-Git-Tag: v0.9.10-rc1~172
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=af5594c88b5473d51be29294952fd9a6a2591fd4;p=thirdparty%2Flibvirt.git

nwfilter: fix typing error in filter

Fix a typing error in the no-ip-spoofing filter.
Return DHCP request packets passing through this filter. Have
the user use another filter to actually allow DHCP requests to be
sent (action='accept').
---

diff --git a/examples/xml/nwfilter/no-ip-spoofing.xml b/examples/xml/nwfilter/no-ip-spoofing.xml
index cbed03083d..f8c9573332 100644
--- a/examples/xml/nwfilter/no-ip-spoofing.xml
+++ b/examples/xml/nwfilter/no-ip-spoofing.xml
@@ -1,7 +1,7 @@
 <filter name='no-ip-spoofing' chain='ipv4-ip' priority='-710'>
-  <!-- allow DHCP requests -->
-  <rule action='accept' direction='out' priority='100'>
-    <ip srcipaddr='0.0.0.0' protocol='udp' srcportstart='68' srcportend='68'/>
+  <!-- allow UDP sent from 0.0.0.0 (DHCP); filter more exact later -->
+  <rule action='return' direction='out' priority='100'>
+    <ip srcipaddr='0.0.0.0' protocol='udp'/>
   </rule>
 
   <!-- allow all known IP addresses -->