Re: [libvirt] [RFC] Unify KVM kernel-space and user-space code into a single project
by Antoine Martin
Hi,
I am moving this thread here as this seems more appropriate.
Sorry it has taken so long..
Here are 2 things that really get in the way of moving my existing
installations to libvirt:
* I tend to store much meta data with each VM instance: it can be things
like ownership (contact details as text), monitoring info (sms phone
numbers), backup (list of paths), firewall rules (custom syntax, with
failover rules, etc), etc.
At the moment, these extra bits of information consist of just a few
optional lines of shell in each VM's definition file. I can extend these
whenever I need, enumerate the VMs using the standard mechanism and
trigger my specific actions as needed (firewall rules, backup or whatever).
I see no way of doing this with libvirt. But please correct me if I am
wrong.
* not everything is exposed via libvirt:
virsh can retrieve vncdisplay
but libvirt (or at least the python bindings) does not. How come?
This happens to be one thing I need for writing a libvirt backend for my
virtual desktop software.
Cheers
Antoine
Antoine Martin wrote:
> Hi Daniel,
>
> I'll take a look and get back to you asap.
>
> Cheers
> Antoine
>
> Daniel P. Berrange wrote:
>> On Tue, Mar 23, 2010 at 03:00:28AM +0700, Antoine Martin wrote:
>>> On 03/23/2010 02:15 AM, Anthony Liguori wrote:
>>>> On 03/22/2010 12:55 PM, Avi Kivity wrote:
>>>>>> Lets look at the ${HOME}/.qemu/qmp/ enumeration method suggested by
>>>>>> Anthony.
>>>>>> There's numerous ways that this can break:
>>>>> I don't like it either. We have libvirt for enumerating guests.
>>>> We're stuck in a rut with libvirt and I think a lot of the
>>>> dissatisfaction with qemu is rooted in that. It's not libvirt that's
>>>> the probably, but the relationship between qemu and libvirt.
>>> +1
>>> The obvious reason why so many people still use shell scripts rather
>>> than libvirt is because if it just doesn't provide what they need.
>>> Every time I've looked at it (and I've been looking for a better
>>> solution for many years), it seems that it would have provided most of
>>> the things I needed, but the remaining bits were unsolvable.
>> If you happen to remember what missing features prevented you choosing
>> libvirt, that would be invaluable information for us, to see if there
>> are quick wins that will help out. We got very useful feedback when
>> recently asking people this same question
>
>> http://rwmj.wordpress.com/2010/01/07/quick-quiz-what-stops-you-from-using...
>
>> Allowing arbitrary passthrough of QEMU commands/args will solve some of
>> these issues, but certainly far from solving all of them. eg guest cut+
>> paste, host side control of guest screen resolution, easier x509/TLS
>> configuration for remote management, soft reboot, Windows desktop support
>> for virt-manager, host network interface management/setup, etc
>
>> Regards,
>> Daniel
14 years, 7 months
- 5
- 13
[libvirt] [PATCH] nwfilter: Process DHCP option to determine whether packet is a DHCP_OFFER
by Stefan Berger
I mistakenly took the op field in the DHCP message as the DHCP_OFFER
type. Rather than basing the decision to read the VM's IP address on
that field, process the appended DHCP options where option 53 indicates
the actual type of the packet. I am also reading the broadcast address
of the VM, but don't use it so far.
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
---
src/nwfilter/nwfilter_learnipaddr.c | 61 +++++++++++++++++++++++++++++++++---
1 file changed, 56 insertions(+), 5 deletions(-)
Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c
+++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c
@@ -64,6 +64,13 @@ struct f_arphdr {
} ATTRIBUTE_PACKED;
+struct dhcp_option {
+ uint8_t code;
+ uint8_t len;
+ uint8_t value[0]; /* length varies */
+} ATTRIBUTE_PACKED;
+
+
/* structure representing DHCP message */
struct dhcp {
uint8_t op;
@@ -78,9 +85,12 @@ struct dhcp {
uint32_t siaddr;
uint32_t giaddr;
uint8_t chaddr[16];
- /* omitted */
+ uint8_t zeroes[192];
+ uint32_t magic;
+ struct dhcp_option options[0];
} ATTRIBUTE_PACKED;
+#define DHCP_MSGT_DHCPOFFER 2
struct ether_vlan_header
{
@@ -212,6 +222,40 @@ virNWFilterGetIpAddrForIfname(const char
#ifdef HAVE_LIBPCAP
+static void
+procDHCPOpts(struct dhcp *dhcp, int dhcp_opts_len,
+ uint32_t *vmaddr, uint32_t *bcastaddr,
+ enum howDetect *howDetected) {
+ struct dhcp_option *dhcpopt = &dhcp->options[0];
+
+ while (dhcp_opts_len >= 2) {
+
+ switch (dhcpopt->code) {
+
+ case 28: /* Broadcast address */
+ if (dhcp_opts_len >= 6) {
+ uint32_t *tmp = (uint32_t *)&dhcpopt->value;
+ (*bcastaddr) = ntohl(*tmp);
+ }
+ break;
+
+ case 53: /* Message type */
+ if (dhcp_opts_len >= 3) {
+ uint8_t *val = (uint8_t *)&dhcpopt->value;
+ switch (*val) {
+ case DHCP_MSGT_DHCPOFFER:
+ *vmaddr = dhcp->yiaddr;
+ *howDetected = DETECT_DHCP;
+ break;
+ }
+ }
+ }
+ dhcp_opts_len -= (2 + dhcpopt->len);
+ dhcpopt = (struct dhcp_option*)((char *)dhcpopt + 2 + dhcpopt->len);
+ }
+}
+
+
/**
* learnIPAddressThread
* arg: pointer to virNWFilterIPAddrLearnReq structure
@@ -236,12 +280,13 @@ learnIPAddressThread(void *arg)
struct ether_header *ether_hdr;
struct ether_vlan_header *vlan_hdr;
virNWFilterIPAddrLearnReqPtr req = arg;
- uint32_t vmaddr = 0;
+ uint32_t vmaddr = 0, bcastaddr = 0;
unsigned int ethHdrSize;
char *listen_if = (strlen(req->linkdev) != 0) ? req->linkdev
: req->ifname;
int to_ms = (strlen(req->linkdev) != 0) ? 1000
: 0;
+ int dhcp_opts_len;
char macaddr[VIR_MAC_STRING_BUFLEN];
virBuffer buf = VIR_BUFFER_INITIALIZER;
char *filter= NULL;
@@ -382,12 +427,18 @@ learnIPAddressThread(void *arg)
sizeof(struct dhcp)) {
struct dhcp *dhcp = (struct dhcp *)
((char *)udphdr + sizeof(udphdr));
- if (dhcp->op == 2 /* DHCP OFFER */ &&
+ if (dhcp->op == 2 /* BOOTREPLY */ &&
!memcmp(&dhcp->chaddr[0],
req->macaddr,
6)) {
- vmaddr = dhcp->yiaddr;
- howDetected = DETECT_DHCP;
+ dhcp_opts_len = header.len -
+ (ethHdrSize + iphdr->ihl * 4 +
+ sizeof(struct udphdr) +
+ sizeof(struct dhcp));
+ procDHCPOpts(dhcp, dhcp_opts_len,
+ &vmaddr,
+ &bcastaddr,
+ &howDetected);
}
}
}
14 years, 7 months
- 2
- 1
[libvirt] [PATCH] Fix error in nwfilter test driver
by Stefan Berger
Trivial fix for the c&p error in the nwfilter test driver.
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
Index: libvirt-acl/src/test/test_driver.c
===================================================================
--- libvirt-acl.orig/src/test/test_driver.c
+++ libvirt-acl/src/test/test_driver.c
@@ -5212,7 +5212,7 @@ static virDrvOpenStatus testNWFilterOpen
if (STRNEQ(conn->driver->name, "Test"))
return VIR_DRV_OPEN_DECLINED;
- conn->secretPrivateData = conn->privateData;
+ conn->nwfilterPrivateData = conn->privateData;
return VIR_DRV_OPEN_SUCCESS;
}
14 years, 7 months
- 2
- 2
[libvirt] libvirt: C++ or Java
by Gokhale, Shashibhushan
Hello,
I am planning to develop a management application for managing Redhat Xen and Redhat KVM hypervisors. I am evaluating the Java bindings versus the C++ version of libvirt. As part of evaluation, I could not find meaningful answers to the questions below. Hence, I thought that people on this mailing list would be the most appropriate to comment on them. Can you please let me know your views?
1. Are all functions that are available in C API available in Java?
2. Are Java bindings added along with every enhancement to C API?
3. If answer to above question is negative, typically how long does it takes for the addition of Java bindings for the enhancement?
4. Most of libvirt based third party management applications use which of Java bindings or C API?
5. What are your good/bad experiences while using either of C API or Java bindings?
6. What is your concluding personal recommendation?
And finally, since libvirt is a Redhat Emerging Technology project, does Redhat or any other third party service providers provide paid assistance, support?
Thanks,
Shashi
14 years, 7 months
- 1
- 0
[libvirt] [RESEND][PATCH][QEMU driver] Catch cdrom change error
by Ryan Harper
Currently when we attempt to change the cdrom in a qemu VM the monitor
doesn't generate an error if the target filename doesn't exist. I've
submitted a patch[1] for this. This patch is the libvirt qemu-driver
side which catches the error message from the monitor and reportes the
error to libvirt. This means that virsh attach-disk cdrom commands
won't appear to succeed when qemu change command actually failed.
I've tested this patch on an older libvirt (rebuild libvirt-0.7.0 on my
ubuntu host) but haven't rebuilt against git head since I can't
quite compile that on my host.
1. http://lists.gnu.org/archive/html/qemu-devel/2010-03/msg01935.html
Signed-off-by: Ryan Harper <ryanh(a)us.ibm.com>
diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c
index 1596e59..f868907 100644
--- a/src/qemu/qemu_monitor_text.c
+++ b/src/qemu/qemu_monitor_text.c
@@ -905,7 +905,14 @@ int qemuMonitorTextChangeMedia(qemuMonitorPtr mon,
qemuReportError(VIR_ERR_OPERATION_FAILED,
_("could not eject media on %s: %s"), devname, reply);
goto cleanup;
- }
+ }
+
+ /* Could not open message indicates bad filename */
+ if (strstr(reply, "\nCould not open ")) {
+ qemuReportError(VIR_ERR_OPERATION_FAILED,
+ _("could not change media on %s: %s"), devname, reply);
+ goto cleanup;
+ }
ret = 0;
--
Ryan Harper
Software Engineer; Linux Technology Center
IBM Corp., Austin, Tx
ryanh(a)us.ibm.com
14 years, 7 months
- 2
- 1
[libvirt] Documentation: misleading examples
by redshift＠gmx.com
Hello,
at http://libvirt.org/formatdomain.html#elementsNICS there are three
examples of interfaces with a particular MAC address specified. I
understand the provided mac address is more a placeholder than a real
value; but since '11:22:33:44:55:66' seems to be a multicast address[1],
I would suggest providing '00:11:22:33:44:55' as example.
Best regards
[1] http://en.wikipedia.org/wiki/MAC_address#Address_details
14 years, 7 months
- 2
- 1
[libvirt] [PATCH] More event callback fixes
by Daniel P. Berrange
In a couple of cases typos meant we were firing the wrong type
of event. In the python code my previous commit accidentally
missed some chunks of the code.
* python/libvirt-override-virConnect.py: Add missing python glue
accidentally left out of previous commit
* src/conf/domain_event.c, src/qemu/qemu_monitor_json.c: Fix typos
in event name / method name to invoke
---
python/libvirt-override-virConnect.py | 48 +++++++++++++++++++++++++++++++++
src/conf/domain_event.c | 2 +-
src/qemu/qemu_monitor_json.c | 2 +-
3 files changed, 50 insertions(+), 2 deletions(-)
diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py
index 444a499..b49f786 100644
--- a/python/libvirt-override-virConnect.py
+++ b/python/libvirt-override-virConnect.py
@@ -63,6 +63,54 @@
except AttributeError:
pass
+ def dispatchDomainEventRTCChangeCallback(self, dom, offset, cbData):
+ """Dispatches events to python user domain event callbacks
+ """
+ try:
+ cb = cbData["cb"]
+ opaque = cbData["opaque"]
+
+ cb(self, virDomain(self, _obj=dom), offset ,opaque)
+ return 0
+ except AttributeError:
+ pass
+
+ def dispatchDomainEventWatchdogCallback(self, dom, action, cbData):
+ """Dispatches events to python user domain event callbacks
+ """
+ try:
+ cb = cbData["cb"]
+ opaque = cbData["opaque"]
+
+ cb(self, virDomain(self, _obj=dom), action, opaque)
+ return 0
+ except AttributeError:
+ pass
+
+ def dispatchDomainEventIOErrorCallback(self, dom, srcPath, devAlias, action, cbData):
+ """Dispatches events to python user domain event callbacks
+ """
+ try:
+ cb = cbData["cb"]
+ opaque = cbData["opaque"]
+
+ cb(self, virDomain(self, _obj=dom), opaque)
+ return 0
+ except AttributeError:
+ pass
+
+ def dispatchDomainEventGraphicsCallback(self, dom, phase, localAddr, remoteAddr, authScheme, subject, cbData):
+ """Dispatches events to python user domain event callbacks
+ """
+ try:
+ cb = cbData["cb"]
+ opaque = cbData["opaque"]
+
+ cb(self, virDomain(self, _obj=dom), phase, localAddr, remoteAddr, authScheme, subject, opaque)
+ return 0
+ except AttributeError:
+ pass
+
def domainEventDeregisterAny(self, callbackID):
"""Removes a Domain Event Callback. De-registering for a
domain callback will disable delivery of this event type """
diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c
index 07d6a55..e3ce5ba 100644
--- a/src/conf/domain_event.c
+++ b/src/conf/domain_event.c
@@ -660,7 +660,7 @@ virDomainEventPtr virDomainEventIOErrorNewFromObj(virDomainObjPtr obj,
obj->def->id, obj->def->name, obj->def->uuid);
if (ev) {
- ev->data.watchdog.action = action;
+ ev->data.ioError.action = action;
if (!(ev->data.ioError.srcPath = strdup(srcPath)) ||
!(ev->data.ioError.devAlias = strdup(devAlias))) {
virDomainEventFree(ev);
diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
index 507e935..00bb275 100644
--- a/src/qemu/qemu_monitor_json.c
+++ b/src/qemu/qemu_monitor_json.c
@@ -536,7 +536,7 @@ static void qemuMonitorJSONHandleWatchdog(qemuMonitorPtr mon, virJSONValuePtr da
} else {
actionID = VIR_DOMAIN_EVENT_WATCHDOG_NONE;
}
- qemuMonitorEmitRTCChange(mon, actionID);
+ qemuMonitorEmitWatchdog(mon, actionID);
}
VIR_ENUM_DECL(qemuMonitorIOErrorAction)
--
1.6.6.1
14 years, 7 months
- 2
- 1
[libvirt] [PATCH v2]
by Stefan Berger
This patch adds new test cases to the existing nwfilter test program and
adds a test script that must be run while a VM is running. This test
script verifies that input network filter XML creates expected
user-defined tables and rules on ebtables, iptables & ip6tables layer
and verifies their content against expected content. The idea is that
these tools always return exactly the same output when displaying the
content of a user-defined table so that the diff tool can be used for
simple text comparison. All supported protocols have at least one test
case.
This test program is not run automatically since it requires a running
VM.
For all tests to pass the previously posted ICMP fix patch must be applied.
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
---
tests/nwfiltervmtest.sh | 186 ++++++++++++++++++
tests/nwfilterxml2fwallout/ah-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/ah-test.fwall | 19 +
tests/nwfilterxml2fwallout/all-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/all-test.fwall | 19 +
tests/nwfilterxml2fwallout/arp-test.fwall | 9
tests/nwfilterxml2fwallout/esp-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/esp-test.fwall | 19 +
tests/nwfilterxml2fwallout/icmp-direction-test.fwall | 16 +
tests/nwfilterxml2fwallout/icmp-direction2-test.fwall | 16 +
tests/nwfilterxml2fwallout/icmp-direction3-test.fwall | 16 +
tests/nwfilterxml2fwallout/icmp-test.fwall | 16 +
tests/nwfilterxml2fwallout/icmpv6-test.fwall | 16 +
tests/nwfilterxml2fwallout/igmp-test.fwall | 19 +
tests/nwfilterxml2fwallout/ip-test.fwall | 12 +
tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 12 +
tests/nwfilterxml2fwallout/ipv6-test.fwall | 14 +
tests/nwfilterxml2fwallout/mac-test.fwall | 12 +
tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/sctp-ipv6-test.xml | 19 +
tests/nwfilterxml2fwallout/sctp-test.fwall | 19 +
tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/tcp-test.fwall | 19 +
tests/nwfilterxml2fwallout/udp-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/udp-ipv6-test.xml | 19 +
tests/nwfilterxml2fwallout/udp-test.fwall | 19 +
tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 19 +
tests/nwfilterxml2fwallout/udplite-test.fwall | 19 +
tests/nwfilterxml2xmlin/icmp-direction-test.xml | 15 +
tests/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 +
tests/nwfilterxml2xmlin/icmp-direction3-test.xml | 10
tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 +
tests/nwfilterxml2xmlout/icmp-direction-test.xml | 12 +
tests/nwfilterxml2xmlout/icmp-direction2-test.xml | 12 +
tests/nwfilterxml2xmlout/icmp-direction3-test.xml | 9
tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml | 9
tests/nwfilterxml2xmltest.c | 4
37 files changed, 748 insertions(+)
Index: libvirt-acl/tests/nwfiltervmtest.sh
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfiltervmtest.sh
@@ -0,0 +1,191 @@
+#!/bin/bash
+
+VIRSH=virsh
+ORIG_IFNAME="vnet0"
+
+TMPFILE1="/tmp/nwfiltervmtest1.txt"
+TMPFILE2="/tmp/nwfiltervmtest2.txt"
+
+function usage() {
+ local cmd="$0"
+ echo "Usage: ${cmd} [--help|-h|-?] [--ifname|-i <interfacename>"
+ cat <<EOF
+
+Options:
+ --help,-h,-? : Display this help screen.
+ --ifname, -i : Name of the backend interface of the VM. Default 'vnet0'
+
+Run this program while a KVM VM is running (preferably as only VM on the
+system) and one of its interfaces uses a filter called 'testcase'. The name
+of the interface of the VM is anticipated to be 'vnet0' unless set by the
+'--ifname' option. The following interface description fulfills this
+requirement:
+
+ <interface type='bridge'>
+ <source bridge='virbr0'/>
+ <target dev='vnet0'/>
+ <filterref filter='testcase'/>
+ </interface>
+
+The individual tests are validated using string comparison where the output
+of ebtables, iptables and ip6tables is compared against expected output. As
+long as the output of those tools is the same, the tests should all pass.
+The tests were developed on Fedore Core 12.
+
+Known problems: None of the running VMs' names may have spaces.
+EOF
+}
+
+
+function doTest() {
+ local xmlfile="$1"
+ local fwallfile="$2"
+ local ifname="$3"
+ local cmd line tmpfile tmpfile2
+ local linenums ctr=0
+ local regex="s/${ORIG_IFNAME}/${ifname}/g"
+
+ if [ ! -r "${xmlfile}" ]; then
+ echo "FAIL : Cannot access filter XML file ${xmlfile}."
+ return 1
+ fi
+
+ tmpfile="${TMPFILE1}"
+ tmpfile2="${TMPFILE2}"
+
+ ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null
+
+ exec 4<&0
+
+ exec < ${fwallfile}
+
+ read line
+ while [ "x${line}x" != "xx" ]; do
+ cmd=`echo ${line##\#} | sed ${regex}`
+
+ exec ${cmd} | grep -v "^Bridge" | grep -v "^$" > ${tmpfile}
+
+ rm ${tmpfile2} 2>/dev/null
+ touch ${tmpfile2}
+
+ while [ 1 ]; do
+ read
+
+ line="${REPLY}"
+
+ if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then
+
+ diff ${tmpfile} ${tmpfile2} >/dev/null
+
+ if [ $? -ne 0 ]; then
+ echo "FAIL ${xmlfile} : ${cmd}"
+ diff ${tmpfile} ${tmpfile2}
+ else
+ echo "PASS ${xmlfile} : ${cmd}"
+ fi
+
+ break;
+
+ fi
+ echo "${line}" | sed ${regex} >> ${tmpfile2}
+ done
+ done
+
+ exec 0<&4
+ exec 4<&-
+
+ rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null
+}
+
+
+function runTests() {
+ local ifname="$1"
+ local xmldir="$2"
+ local fwalldir="$3"
+ local fwallfiles f
+
+ pushd ${PWD} > /dev/null
+ cd ${fwalldir}
+ fwallfiles=`ls *.fwall`
+ popd > /dev/null
+
+ for fil in ${fwallfiles}; do
+ f=${fil%%.fwall}
+ doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${ifname}"
+ done
+}
+
+
+function checkVM() {
+ local vmname="$1"
+ local ifname="$2"
+ local nwfilter="$3"
+ local f i c
+
+ c=`${VIRSH} dumpxml ${vmname} | grep -c "<interface"`
+ if [ ${c} -ne 1 ]; then
+ echo "VM '${vmname}' has multiple interfaces. I cannot tell for sure "
+ echo "whether this VM has the correct interface name '${ifname}' and "
+ echo "reference the filter '${nwfilter}'. Cowardly skipping this VM..."
+ return 1
+ fi
+
+ f=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \
+ sed "s/.*filterref filter='\([a-zA-Z0-9_]\+\)'.*/\1/"`
+ i=`{ ${VIRSH} dumpxml ${vmname} | tr -d "\n"; echo; } | \
+ sed "s/.*\<interface.*target dev='\([a-zA-Z0-9_]\+\)'.*<\/interface>.*/\1/"`
+
+ if [ "x${i}x" == "x${ifname}x" ] && [ "x${f}x" == "x${nwfilter}x" ]; then
+ return 0
+ fi
+
+ return 1
+}
+
+
+function main() {
+ local prgname="$0"
+ local ifname="${ORIG_IFNAME}"
+ local xmldir="nwfilterxml2xmlin"
+ local fwalldir="nwfilterxml2fwallout"
+ local found=0 vms
+ local filtername="testcase"
+
+ while [ $# -ne 0 ]; do
+ case "$1" in
+ --help|-h|-\?) usage ${prgname}; exit 0;;
+ --ifname|-i) shift 1; ifname="$1";;
+ *) usage ${prgname}; exit 1;;
+ esac
+ shift 1
+ done
+
+ if [ `uname` != "Linux" ]; then
+ echo "This script will only run on Linux."
+ exit 1;
+ fi
+
+ vms=`${VIRSH} list | grep running | gawk '{print $2}'`
+ if [ "x${vms}x" == "xx" ]; then
+ echo "Error: Need a running VM."
+ exit 1;
+ fi
+
+ for vm in ${vms}; do
+ checkVM "${vm}" "${ifname}" "${filtername}"
+ if [ $? -eq 0 ]; then
+ found=1;
+ break;
+ fi
+ done
+
+ if [ ${found} -eq 0 ]; then
+ echo "Error: Suitable VM seems not to be running. Check the help screen";
+ echo "to (--help) to read about requirements to the running VM.";
+ exit 1;
+ fi
+
+ runTests "${ifname}" "${xmldir}" "${fwalldir}"
+}
+
+main "$@"
Index: libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/arp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L PREROUTING
+-i vnet0 -j libvirt-I-vnet0
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/mac-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0
+-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT
+-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT
+-d aa:bb:cc:dd:ee:ff -j ACCEPT
+-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/ip-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT
+-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT
+-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/ipv6-test.fwall
@@ -0,0 +1,14 @@
+#ebtables -t nat -L PREROUTING
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/udp-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21
+RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/tcp-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21
+RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED
+ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111
+ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21
+ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/all-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-test.fwall
@@ -0,0 +1,16 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED
+RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255
+ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11
+ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/igmp-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/icmpv6-test.fwall
@@ -0,0 +1,16 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED
+RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255
+ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11
+ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.xml
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21
+RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED
+ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111
+ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.xml
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21
+RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED
+ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111
+ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/ah-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN ah ::/0 a:b:c::/128 DSCP match 0x21
+RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED
+ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21
+ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/ah-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/all-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN all ::/0 a:b:c::/128 DSCP match 0x21
+RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED
+ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21
+ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/esp-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN esp ::/0 a:b:c::/128 DSCP match 0x21
+RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED
+ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21
+ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/esp-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/sctp-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21
+RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED
+ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111
+ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/udp-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21
+RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED
+ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111
+ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-ipv6-test.fwall
@@ -0,0 +1,19 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21
+RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED
+ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21
+ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/udplite-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED
+ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21
+
Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
@@ -0,0 +1,14 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='drop' direction='inout'>
+ <!-- should use $MAC for MAC address, but tests would depend on VM's
+ MAC address -->
+ <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+ </rule>
+
+ <rule action='drop' direction='in'>
+ <!-- not accepting incoming traffic from a certain MAC address -->
+ <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+ </rule>
+
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmltest.c
===================================================================
--- libvirt-acl.orig/tests/nwfilterxml2xmltest.c
+++ libvirt-acl/tests/nwfilterxml2xmltest.c
@@ -114,6 +114,10 @@ mymain(int argc, char **argv)
DO_TEST("ref-test");
DO_TEST("ref-rule-test");
+ DO_TEST("ipt-no-macspoof-test");
+ DO_TEST("icmp-direction-test");
+ DO_TEST("icmp-direction2-test");
+ DO_TEST("icmp-direction3-test");
return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE);
}
Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml
@@ -0,0 +1,9 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='drop' direction='inout' priority='500'>
+ <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+ </rule>
+ <rule action='drop' direction='in' priority='500'>
+ <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
@@ -0,0 +1,12 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC
+DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA
+#iptables -L HI-vnet0
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+
Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+ <!-- allow incoming ICMP Echo Reply -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Request -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml
@@ -0,0 +1,12 @@
+<filter name='testcase' chain='root'>
+ <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction-test.fwall
@@ -0,0 +1,16 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+
Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <!-- allow incoming ICMP Echo Request -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Reply -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml
@@ -0,0 +1,12 @@
+<filter name='testcase' chain='root'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction2-test.fwall
@@ -0,0 +1,16 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+
Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml
@@ -0,0 +1,10 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <!-- drop all other traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml
@@ -0,0 +1,9 @@
+<filter name='testcase' chain='root'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <rule action='drop' direction='inout' priority='600'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2fwallout/icmp-direction3-test.fwall
@@ -0,0 +1,16 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+
Index: libvirt-acl/tests/Makefile.am
===================================================================
--- libvirt-acl.orig/tests/Makefile.am
+++ libvirt-acl/tests/Makefile.am
@@ -74,7 +74,9 @@ EXTRA_DIST = \
xml2vmxdata \
nwfilterxml2xmlout \
nwfilterxml2xmlin \
+ nwfilterxml2fwallout \
nwfilterschematest \
+ nwfiltervmtest.sh \
$(patsubst %,qemuhelpdata/%,$(qemuhelpdata))
noinst_PROGRAMS = virshtest conftest \
14 years, 7 months
- 4
- 7
[libvirt] [PATCH] nwfilter: More XML parser test cases
by Stefan Berger
This patch adds a couple more nwfilter test cases for the XML parser tests.
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
Index: libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
@@ -0,0 +1,14 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='drop' direction='inout'>
+ <!-- should use $MAC for MAC address, but tests would depend on VM's
+ MAC address -->
+ <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+ </rule>
+
+ <rule action='drop' direction='in'>
+ <!-- not accepting incoming traffic from a certain MAC address -->
+ <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+ </rule>
+
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmltest.c
===================================================================
--- libvirt-acl.orig/tests/nwfilterxml2xmltest.c
+++ libvirt-acl/tests/nwfilterxml2xmltest.c
@@ -114,6 +114,10 @@ mymain(int argc, char **argv)
DO_TEST("ref-test");
DO_TEST("ref-rule-test");
+ DO_TEST("ipt-no-macspoof-test");
+ DO_TEST("icmp-direction-test");
+ DO_TEST("icmp-direction2-test");
+ DO_TEST("icmp-direction3-test");
return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE);
}
Index: libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/ipt-no-macspoof-test.xml
@@ -0,0 +1,9 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='drop' direction='inout' priority='500'>
+ <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+ </rule>
+ <rule action='drop' direction='in' priority='500'>
+ <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+ <!-- allow incoming ICMP Echo Reply -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Request -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction-test.xml
@@ -0,0 +1,12 @@
+<filter name='testcase' chain='root'>
+ <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction2-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <!-- allow incoming ICMP Echo Request -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Reply -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction2-test.xml
@@ -0,0 +1,12 @@
+<filter name='testcase' chain='root'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlin/icmp-direction3-test.xml
@@ -0,0 +1,10 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <!-- drop all other traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-acl/tests/nwfilterxml2xmlout/icmp-direction3-test.xml
@@ -0,0 +1,9 @@
+<filter name='testcase' chain='root'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <rule action='drop' direction='inout' priority='600'>
+ <all/>
+ </rule>
+</filter>
14 years, 7 months
- 2
- 1
[libvirt] Domain not stable while created...
by Sankamesh
Hello
Thanks for the reply. Now I use virsh -c "xen:///" define libvirt-ttylinux.xml (domain is created) and "virsh start ttyimage" the image starts and shuts down immediately. This time I can view the domain even after the shut down.
So is there any reason for the image being shutdown immediately?
What else should I check??
Thanks in advance.
________________________________
> Hello,
>
> I am using Scientific Linux 5.4 and xen. I want to deploy a sample ttyimage by creating a domain using virsh create.
>
> My configuration file is :
> -----------------------------------------------------------------------------------------------------
> <?xml version="1.0" encoding="utf-8"?>
> <domain type='xen'>
> <name>ttyimage</name>
> <os>
> <type>linux</type>
> <kernel>/boot/vmlinuz-2.6.18-164.2.1.el5xen</kernel>
> </os>
> <memory>65536</memory>
> <vcpu>1</vcpu>
> <on_poweroff>destroy</on_poweroff>
> <on_reboot>restart</on_reboot>
> <on_crash>destroy</on_crash>
> <devices>
> <graphics type='vnc' port='5900'/>
> <disk type='file'>
> <source file='/usr/local/ttylinux-xen-libvirt/ttylinux-xen.img' />
> <target dev='sda' />
> </disk>
> <interface type='bridge'>
> <source bridge='virbr0' />
> <mac address='00:1d:60:ec:ae:1c' />
> <target dev='testnimb-0' />
> </interface>
> </devices>
> </domain>
> -------------------------------------------------------------------------------------------------------
>
> when I use "virsh -c "xen:///" create libvirt-ttylinux.xml " to create a domain, the domain is crated and i can view the image (in paused mode) using the virt-manager. and when I resume the image it ,disappears (domain gets destroyed) after nearly 10 seconds.....
> Further when I use vncviewer localhost::5900 when the image is running (during the 10 sec) ,i can view the console. But it closes once the domain is destroyed.
>
> Can someone explain why the image is not stable??? how can I make the domain to be stable????
>
> Thanks in advance
Using 'virsh create guest.xml' cmds can simply activate the guest, which only exist active domain instead of define domain,
and the guest will disappear if it isn't in define domain and you carry out some operations, e.g. 'destroy' or 'shutdown' or
'save' etc. so you should correctly use virsh cmds:
FYI,
virsh -c xen:/// define libvirt-ttylinux.xml
virsh start guestname
Alex
Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php
14 years, 7 months
- 1
- 0