diff options
author | github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 2023-01-14 00:02:26 +0000 |
---|---|---|
committer | GitHub <noreply@github.com> | 2023-01-14 00:02:26 +0000 |
commit | 4712ed9439386730e93043de43bfc1d4b6f2f297 (patch) | |
tree | 382dc21b6250da85fcdceaf610afff45c8e8932e /nixos/modules | |
parent | 49722fd14a26ca6a751932949491a87afe592d0d (diff) | |
parent | 4e7b6a7ddbe276281cd3882dd42b701f51b48c6b (diff) | |
download | nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.tar nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.tar.gz nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.tar.bz2 nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.tar.lz nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.tar.xz nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.tar.zst nixpkgs-4712ed9439386730e93043de43bfc1d4b6f2f297.zip |
Merge master into staging-next
Diffstat (limited to 'nixos/modules')
-rw-r--r-- | nixos/modules/virtualisation/qemu-vm.nix | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 1b3c0e23f97..4520408ca33 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -528,6 +528,20 @@ in ''; }; + virtualisation.restrictNetwork = + mkOption { + type = types.bool; + default = false; + example = true; + description = + lib.mdDoc '' + If this option is enabled, the guest will be isolated, i.e. it will + not be able to contact the host and no guest IP packets will be + routed over the host to the outside. This option does not affect + any explicitly set forwarding rules. + ''; + }; + virtualisation.vlans = mkOption { type = types.listOf types.ints.unsigned; @@ -936,10 +950,11 @@ in else "'guestfwd=${proto}:${guest.address}:${toString guest.port}-" + "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}'," ); + restrictNetworkOption = lib.optionalString cfg.restrictNetwork "restrict=on,"; in [ "-net nic,netdev=user.0,model=virtio" - "-netdev user,id=user.0,${forwardingOptions}\"$QEMU_NET_OPTS\"" + "-netdev user,id=user.0,${forwardingOptions}${restrictNetworkOption}\"$QEMU_NET_OPTS\"" ]; # FIXME: Consolidate this one day. |