[libvirt] [PATCH] Allow one-or-more <boot dev="..."/> entries
by Philipp Hahn
According to docs/formatdomain.html.in, "The boot element can be
repeated multiple times to setup a priority list of boot devices to try
in turn." The Relax-NG schema required / allowed exactly one entry.
Signed-off-by: Philipp Hahn <hahn(a)univention.de>
---
docs/schemas/domain.rng | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
14 years, 5 months
[libvirt] [PATCH] virsh: remove a doubled up include for errno.h
by Justin Clift
---
Noticed a doubled up include for errno.h. Pretty sure it's not
needed.
tools/virsh.c | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/tools/virsh.c b/tools/virsh.c
index 3057115..0bf7443 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -28,7 +28,6 @@
#include <time.h>
#include <limits.h>
#include <assert.h>
-#include <errno.h>
#include <sys/stat.h>
#include <inttypes.h>
#include <signal.h>
--
1.7.0.1
14 years, 5 months
[libvirt] Suggest to enter freeze for 0.8.2 this week-end
by Daniel Veillard
As previously suggested, I think it's time to get a new release going,
and if we want to have it by end of the month it would be good to enter
feature freeze over the week-end. I am seeing some un-ack'ed patches
on list though so maybe we need to be a bit flexible, but the general
principle is that we would ACK and push only bug fixes and not new feature
starting from Monday. This doesn't affect documentation :-)
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
14 years, 5 months
[libvirt] [PATCH] [TCK] nwfilter: apply filters and check firewall rules
by Stefan Berger
Hi!
This is a patch I previously posted for use in the tests/ directory of
libvirt. Now I ported it to the TCK project and extended the script with
output in the Test Anything Protocol (TAP) format. It now allows
multiple output formats chosen via command line parameter supporting TAP
(--tap-test), the output format used in the libvirt tests directory (the
'.' and '!') (--libvirt-test) and one where all tests are displayed
(--verbose).
The program basically creates a filter called testcase and two VMs where
one of them references the testcase filter and the other a filter called
nwfiltertestfilter. The testcase filter is then subsequently modified
and the effect on iptables,ebtables and ip6tables verified against
expected output for both VMs. The VMs are torn down at the end and the
test filters removed.
For all the tests to run successfully, the last outstanding patch that
would need to go in is this one here:
https://www.redhat.com/archives/libvir-list/2010-June/msg00326.html
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
---
scripts/nwfilter/100-apply-verify.t | 10
scripts/nwfilter/nwfilter2vmtest.sh |
581 ++++++++++
scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 32
scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall | 30
scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 9
scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall | 24
scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 68 +
scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall | 12
scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 19
scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall | 13
scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall | 12
scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall | 9
scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 73 +
scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall | 26
scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/all-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 33
scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml | 12
scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml | 56
scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml | 15
scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml | 15
scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml | 10
scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml | 34
scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14
scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml | 43
scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml | 23
scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml | 33
scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml | 4
scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml | 18
61 files changed, 2005 insertions(+)
Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
@@ -0,0 +1,581 @@
+#!/bin/bash
+
+ORIG_IFNAME="vnet0"
+ATTACH_IFNAME="attach0"
+TESTFILTERNAME="nwfiltertestfilter"
+TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat"
+
+LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd`
+if [ "x${LIBVIRTD}x" == "xx" ]; then
+ LIBVIRTD=`type -P libvirtd`
+fi
+
+VIRSH=`type -P ${PWD}/../tools/virsh`
+if [ "x${VIRSH}x" == "xx" ]; then
+ VIRSH=`type -P virsh`
+fi
+
+LD_LIBRARY_PATH="${PWD}../src/.libs/"
+
+# Maybe no libvirtd was built
+[ -z ${LIBVIRTD} ] && exit 0;
+
+FLAG_WAIT="$((1<<0))"
+FLAG_ATTACH="$((1<<1))"
+FLAG_VERBOSE="$((1<<2))"
+FLAG_LIBVIRT_TEST="$((1<<3))"
+FLAG_TAP_TEST="$((1<<4))"
+
+failctr=0
+passctr=0
+attachfailctr=0
+attachctr=0
+
+TAP_FAIL_LIST=""
+TAP_FAIL_CTR=0
+TAP_TOT_CTR=0
+
+function usage() {
+ local cmd="$0"
+cat <<EOF
+Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose]
+ [--libvirt-test] [--tap-test]
+
+Options:
+ --help,-h,-? : Display this help screen.
+ --noattach : Skip tests that attach and detach a network interface
+ --wait : Wait for the user to press the enter key once an error
+ was detected
+ --verbose : Verbose output
+ --libvirt-test : Use the libvirt test output format
+ --tap-test : TAP format output
+
+This test will create two virtual machines. The one virtual machine
+will use a filter called '${TESTFILTERNAME}', and reference the filter
+'clean-traffic' which should be available by default with every install.
+The other virtual machine will reference the filter 'testcase' and will
+have its filter permanently updated.
+EOF
+}
+
+
+function tap_fail() {
+ echo "not ok $1 - ${2:0:66}"
+ TAP_FAIL_LIST+="$1 "
+ ((TAP_FAIL_CTR++))
+ ((TAP_TOT_CTR++))
+}
+
+function tap_pass() {
+ echo "ok $1 - ${2:0:70}"
+ ((TAP_TOT_CTR++))
+}
+
+function tap_final() {
+ local okay
+
+ [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests ${TAP_FAIL_LIST}"
+
+ okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l`
+ echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay"
+}
+
+# A wrapper for mktemp in case it does not exist
+# Echos the name of a temporary file.
+function mktmpfile() {
+ local tmp
+ type -P mktemp > /dev/null
+ if [ $? -eq 0 ]; then
+ tmp=$(mktemp -t nwfvmtest.XXXXXX)
+ echo ${tmp}
+ else
+ while :; do
+ tmp="/tmp/nwfvmtest.${RANDOM}"
+ if [ ! -f ${tmp} ]; then
+ touch ${tmp}
+ chmod 666 ${tmp}
+ echo ${tmp}
+ break
+ fi
+ done
+ fi
+ return 0
+}
+
+
+function checkExpectedOutput() {
+ local xmlfile="$1"
+ local fwallfile="$2"
+ local ifname="$3"
+ local flags="$4"
+ local skipregex="$5"
+ local regex="s/${ORIG_IFNAME}/${ifname}/g"
+ local cmd line tmpfile tmpfile2 skip
+
+ tmpfile=`mktmpfile`
+ tmpfile2=`mktmpfile`
+
+ exec 4<${fwallfile}
+
+ read <&4
+ line="${REPLY}"
+
+ while [ "x${line}x" != "xx" ]; do
+ cmd=`echo ${line##\#} | sed ${regex}`
+
+ skip=0
+ if [ "x${skipregex}x" != "xx" ]; then
+ skip=`echo ${cmd} | grep -c -E ${skipregex}`
+ fi
+
+ eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null
+
+ rm ${tmpfile2} 2>/dev/null
+ touch ${tmpfile2}
+
+ while [ 1 ]; do
+ read <&4
+ line="${REPLY}"
+
+ if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then
+
+ if [ ${skip} -ne 0 ]; then
+ break
+ fi
+
+ diff ${tmpfile} ${tmpfile2} >/dev/null
+
+ if [ $? -ne 0 ]; then
+ if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then
+ echo "FAIL ${xmlfile} : ${cmd}"
+ diff ${tmpfile} ${tmpfile2}
+ fi
+ ((failctr++))
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "tmp files: $tmpfile, $tmpfile2"
+ echo "Press enter"
+ read
+ fi
+ [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \
+ test_result $((passctr+failctr)) "" 1
+ [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \
+ tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}"
+ else
+ ((passctr++))
+ [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \
+ echo "PASS ${xmlfile} : ${cmd}"
+ [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \
+ test_result $((passctr+failctr)) "" 0
+ [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \
+ tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}"
+ fi
+
+ break
+
+ fi
+ echo "${line}" | sed ${regex} >> ${tmpfile2}
+ done
+ done
+
+ exec 4>&-
+
+ rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null
+}
+
+
+function doTest() {
+ local xmlfile="$1"
+ local fwallfile="$2"
+ local vm1name="$3"
+ local vm2name="$4"
+ local flags="$5"
+ local testnum="$6"
+ local linenums ctr=0
+ local tmpfile b msg rc
+
+ if [ ! -r "${xmlfile}" ]; then
+ echo "FAIL : Cannot access filter XML file ${xmlfile}."
+ return 1
+ fi
+
+ ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null
+
+ checkExpectedOutput "${xmlfile}" "${fwallfile}" "${vm1name}" "${flags}" \
+ ""
+
+ checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+ "${vm2name}" "${flags}" ""
+
+ if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then
+
+ tmpfile=`mktmpfile`
+
+ b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \
+ sed "s/.*\<interface.*source
bridge='\([a-zA-Z0-9_]\+\)'.*<\/interface>.*/\1/"`
+
+ cat >>${tmpfile} <<EOF
+<interface type='bridge'>
+ <source bridge='${b}'/>
+ <mac address='52:54:00:11:22:33'/>
+ <target dev='${ATTACH_IFNAME}'/>
+ <filterref filter='testcase'/>
+</interface>
+EOF
+ msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" > /dev/null`
+ rc=$?
+
+ ((attachctr++))
+
+ if [ $rc -eq 0 ]; then
+ checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \
+ "${flags}" "(PRE|POST)ROUTING"
+ checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+ "${vm2name}" "${flags}" "(PRE|POST)ROUTING"
+ msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"`
+ if [ $? -ne 0 ]; then
+ echo "FAIL: Detach of interface failed."
+ fi
+ else
+ if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+ # In case of TAP, run the test anyway so we get to the full number
+ # of tests
+ checkExpectedOutput "${xmlfile}" "${fwallfile}"
"${ATTACH_IFNAME}" \
+ "${flags}" "" #"(PRE|POST)ROUTING"
+ checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+ "${vm2name}" "${flags}" #"(PRE|POST)ROUTING"
+ fi
+
+ ((attachfailctr++))
+ if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then
+ echo "FAIL: Could not attach interface to vm ${vm1name}."
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter"
+ read
+ fi
+ fi
+ fi
+
+ rm -rf ${tmpfile}
+ fi
+
+ return 0
+}
+
+
+function runTests() {
+ local vm1name="$1"
+ local vm2name="$2"
+ local xmldir="$3"
+ local fwalldir="$4"
+ local flags="$5"
+ local fwallfiles f c
+ local tap_total=0 ctr=0
+
+ pushd ${PWD} > /dev/null
+ cd ${fwalldir}
+ fwallfiles=`ls *.fwall`
+ popd > /dev/null
+
+ if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+ # Need to count the number of total tests
+ for fil in ${fwallfiles}; do
+ c=$(grep -c "^#" ${fwalldir}/${fil})
+ ((tap_total+=c))
+ ((ctr++))
+ done
+ c=$(grep -c "^#" "${TESTVM2FWALLDATA}")
+ ((tap_total+=c*ctr))
+ [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2))
+ echo "1..${tap_total}"
+ fi
+
+ for fil in ${fwallfiles}; do
+ f=${fil%%.fwall}
+ doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${vm1name}" \
+ "${vm2name}" "${flags}"
+ done
+
+ if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then
+ test_final $((passctr+failctr)) $failctr
+ elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+ tap_final
+ else
+ echo ""
+ echo "Summary: ${failctr} failures, ${passctr} passes,"
+ if [ ${attachctr} -ne 0 ]; then
+ echo " ${attachfailctr} interface attachment failures
with ${attachctr} attempts"
+ fi
+ fi
+}
+
+
+function createVM() {
+ local vmname="$1"
+ local filtername="$2"
+ local ipaddr="$3"
+ local macaddr="$4"
+ local flags="$5"
+ local res
+ local tmpfile='mktmpfile'
+
+ cat > ${tmpfile} << EOF
+ <domain type='kvm'>
+ <name>${vmname}</name>
+ <memory>32768</memory>
+ <currentMemory>32768</currentMemory>
+ <vcpu>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-0.11'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-kvm</emulator>
+ <interface type='bridge'>
+ <mac address='${macaddr}'/>
+ <source bridge='virbr0'/>
+ <filterref filter='${filtername}'>
+ <parameter name='IP' value='${ipaddr}'/>
+ </filterref>
+ <target dev='${vmname}'/>
+ </interface>
+ <console type='pty'>
+ </console>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ </devices>
+ </domain>
+EOF
+
+ res=$(${VIRSH} define ${tmpfile})
+ if [ $? -ne 0 ]; then
+ echo "Could not define VM ${vmname} : ${res}"
+ return 1
+ fi
+
+ res=$(${VIRSH} start ${vmname})
+ if [ $? -ne 0 ]; then
+ echo "Could not start VM ${vmname} : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ $(${VIRSH} undefine ${vmname})
+ return 1
+ fi
+
+ [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM ${vmname}."
+
+ rm -rf ${tmpfile}
+
+ return 0
+}
+
+
+function destroyVM() {
+ local vmname="$1"
+ local flags="$2"
+ local res
+
+ res=$(${VIRSH} destroy ${vmname})
+ if [ $? -ne 0 ]; then
+ echo "Could not destroy VM ${vmname} : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+
+ res=$(${VIRSH} undefine ${vmname})
+ if [ $? -ne 0 ]; then
+ echo "Could not undefine VM ${vmname} : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+
+ [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM ${vmname}."
+
+ return 0
+}
+
+
+function createTestFilters() {
+ local flags="$1"
+ local tmpfile=`mktmpfile`
+ local res
+
+ cat >${tmpfile} << EOF
+<filter name="${TESTFILTERNAME}">
+ <filterref filter='clean-traffic'/>
+
+ <rule action='drop' direction='inout' priority='1000'>
+ <all/>
+ </rule>
+
+ <rule action='drop' direction='inout' priority='1000'>
+ <all-ipv6/>
+ </rule>
+</filter>
+EOF
+ res=$(${VIRSH} nwfilter-define ${tmpfile})
+ if [ $? -ne 0 ]; then
+ echo "Could not define filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ rm -rf ${tmpfile}
+ return 1
+ fi
+
+ cat >${tmpfile} << EOF
+<filter name="testcase">
+</filter>
+EOF
+ res=$(${VIRSH} nwfilter-define ${tmpfile})
+ if [ $? -ne 0 ]; then
+ echo "Could not define filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ rm -rf ${tmpfile}
+ return 1
+ fi
+
+ rm -rf ${tmpfile}
+
+ return 0
+}
+
+
+function deleteTestFilter() {
+ local flags="$1"
+ local res
+
+ res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME})
+ if [ $? -ne 0 ]; then
+ echo "Could not undefine filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+ res=$(${VIRSH} nwfilter-undefine testcase)
+ if [ $? -ne 0 ]; then
+ echo "Could not undefine filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+ return 0
+}
+
+
+function main() {
+ local prgname="$0"
+ local vm1 vm2
+ local xmldir="nwfilterxml2xmlin"
+ local fwalldir="nwfilterxml2fwallout"
+ local found=0 vms res
+ local filtername="testcase"
+ local libvirtdpid=-1
+ local flags OPWD
+
+ ((flags=${FLAG_ATTACH}))
+
+ while [ $# -ne 0 ]; do
+ case "$1" in
+ --help|-h|-\?) usage ${prgname}; exit 0;;
+ --noattach) ((flags ^= FLAG_ATTACH ));;
+ --wait) ((flags |= FLAG_WAIT ));;
+ --verbose) ((flags |= FLAG_VERBOSE ));;
+ --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));;
+ --tap-test) ((flags |= FLAG_TAP_TEST ));;
+ *) usage ${prgname}; exit 1;;
+ esac
+ shift 1
+ done
+
+ if [ `uname` != "Linux" ]; then
+ echo "This script will only run on Linux."
+ exit 1;
+ fi
+
+ if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then
+ pushd ${PWD} > /dev/null
+ . test-lib.sh
+ test_intro $this_test
+ popd > /dev/null
+ fi
+
+ res=$(${VIRSH} capabilities 2>/dev/null 1>/dev/null)
+
+ if [ $? -ne 0 ]; then
+ if [ "x${LIBVIRTD}x" == "xx" ]; then
+ echo "Cannot find libvirtd. Exiting."
+ exit 1
+ fi
+
+ rm -rf pid-file 2>/dev/null
+ ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null &
+ libvirtdpid=$!
+ sleep 2
+
+ res=$(${VIRSH} capabilities 2>/dev/null 1>/dev/null)
+ if [ $? -ne 0 ]; then
+ echo "Could not start the libvirt daemon : $res"
+ echo "Exiting."
+ exit 1
+ fi
+ fi
+
+ vm1="testvm${RANDOM}"
+ vm2="testvm${RANDOM}"
+
+ createTestFilters "${flags}"
+ if [ $? -ne 0 ]; then
+ exit 1;
+ fi
+
+ createVM "${vm1}" "testcase" "10.2.2.2" "52:54:0:0:0:1" "${flags}"
+ if [ $? -ne 0 ]; then
+ echo "Could not create VM ${vm1}. Exiting."
+ exit 1
+ fi
+
+ createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1" "52:54:0:9f:33:da" \
+ "${flags}"
+ if [ $? -ne 0 ]; then
+ echo "Could not create VM ${vm2}. Exiting."
+ destroyVM "${vm1}" "${flags}"
+ exit 1
+ fi
+
+ runTests "${vm1}" "${vm2}" "${xmldir}" "${fwalldir}" "${flags}"
+
+ destroyVM "${vm1}" "${flags}"
+ destroyVM "${vm2}" "${flags}"
+ deleteTestFilter "${flags}"
+
+ [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid}
+ rm -rf pid-file 2>/dev/null
+
+ return 0
+}
+
+main "$@"
Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/100-apply-verify.t
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+pwd=$(dirname $0)
+
+pushd ${PWD} > /dev/null
+
+cd ${pwd}
+bash ./nwfilter2vmtest.sh --tap-test --noattach
+
+popd > /dev/null
\ No newline at end of file
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype
12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f
-j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff
-j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j
ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype
0xffff -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml
@@ -0,0 +1,33 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='arp'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ hwtype='12'
+ protocoltype='34'
+ opcode='Request'
+ arpsrcmacaddr='1:2:3:4:5:6'
+ arpdstmacaddr='a:b:c:d:e:f'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='1' hwtype='255' protocoltype='255'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='11' hwtype='256' protocoltype='256'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65535' hwtype='65535' protocoltype='65535' />
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65536' hwtype='65536' protocoltype='65536' />
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat
@@ -0,0 +1,73 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -j I-vnet0-ipv4
+-p ARP -j I-vnet0-arp
+-p 0x8035 -j I-vnet0-rarp
+-p 0x835 -j ACCEPT
+-j DROP
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -j O-vnet0-ipv4
+-p ARP -j O-vnet0-arp
+-p 0x8035 -j O-vnet0-rarp
+-j DROP
+#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$"
+-s ! 52:54:0:9f:33:da -j DROP
+-p IPv4 --ip-src ! 10.1.1.1 -j DROP
+#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$"
+-j ACCEPT
+#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$"
+-s ! 52:54:0:9f:33:da -j DROP
+-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP
+-p ARP --arp-ip-src ! 10.1.1.1 -j DROP
+-p ARP --arp-op Request -j ACCEPT
+-p ARP --arp-op Reply -j ACCEPT
+-j DROP
+#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$"
+-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP
+-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP
+-p ARP --arp-op Request -j ACCEPT
+-p ARP --arp-op Reply -j ACCEPT
+-j DROP
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+DROP all ::/0 ::/0
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all ::/0 ::/0
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+DROP all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ah srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <all srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml
@@ -0,0 +1,12 @@
+<filter name='testcase' chain='root'>
+ <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid>
+ <rule action='drop' direction='out' priority='500'>
+ <icmp connlimit-above='1'/>
+ </rule>
+ <rule action='drop' direction='out' priority='500'>
+ <tcp connlimit-above='2'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <esp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml
@@ -0,0 +1,56 @@
+<filter name='testcase'>
+ <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+
+ <rule action='accept' direction='in'>
+ <mac protocolid='0x1234'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ srcipaddr='10.1.2.3' srcipmask='255.255.255.255'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ protocol='udp'
+ srcportstart='0x123' srcportend='0x234'
+ dstportstart='0x3456' dstportend='0x4567'
+ dscp='0x32'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
+ srcipaddr='::10.1.2.3' srcipmask='22'
+ dstipaddr='::10.1.2.3'
+ dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
+ protocol='tcp'
+ srcportstart='0x111' srcportend='400'
+ dstportstart='0x3333' dstportend='65535'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ hwtype='0x12'
+ protocoltype='0x56'
+ opcode='Request'
+ arpsrcmacaddr='1:2:3:4:5:6'
+ arpdstmacaddr='a:b:c:d:e:f'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='0x22'
+ srcportstart='0x123' srcportend='400'
+ dstportstart='0x234' dstportend='0x444'/>
+ </rule>
+
+ <rule action='accept' direction='in'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='0x40'
+ srcportstart='0x20' srcportend='0x21'
+ dstportstart='0x100' dstportend='0x1111'/>
+ </rule>
+
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+ <!-- allow incoming ICMP Echo Reply -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Request -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <!-- allow incoming ICMP Echo Request -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Reply -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml
@@ -0,0 +1,10 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <!-- drop all other traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <icmp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2' type='12' code='11'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33' type='255' code='255'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33' type='256' code='256'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <icmpv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2' type='12' code='11'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmpv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33' type='255' code='255'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmpv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33' type='256' code='256'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <igmp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <igmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <igmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml
@@ -0,0 +1,34 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ srcipaddr='10.1.2.3' srcipmask='255.255.255.255'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ protocol='udp'
+ srcportstart='20' srcportend='22'
+ dstportstart='100' dstportend='101'
+ />
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <ip srcipaddr='10.1.2.3' srcipmask='255.255.128.0'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.0'
+ protocol='17' dscp='63'
+ />
+ </rule>
+
+ <rule action='accept' direction='in'>
+ <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.254'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.128'
+ protocol='255' dscp='64'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.127'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.254'
+ protocol='256' dscp='64'
+ />
+ </rule>
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
@@ -0,0 +1,14 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='drop' direction='inout'>
+ <!-- should use $MAC for MAC address, but tests would depend on VM's
+ MAC address -->
+ <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+ </rule>
+
+ <rule action='drop' direction='in'>
+ <!-- not accepting incoming traffic from a certain MAC address -->
+ <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+ </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml
@@ -0,0 +1,43 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
+ srcipaddr='::10.1.2.3' srcipmask='22'
+ dstipaddr='::10.1.2.3'
+ dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
+ protocol='udp'
+ srcportstart='20' srcportend='22'
+ dstportstart='100' dstportend='101'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ipv6 srcipaddr='1::2' srcipmask='128'
+ dstipaddr='a:b:c::'
+ dstipmask='ffff:ffff:ffff:ffff:8000::'
+ protocol='6'
+ srcportstart='20' srcportend='22'
+ dstportstart='100' dstportend='101'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ipv6 srcipaddr='1::2' srcipmask='128'
+ dstipaddr='a:b:c::'
+ dstipmask='ffff:ffff:ffff:ffff:8000::'
+ protocol='6'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ipv6 srcipaddr='1::2' srcipmask='128'
+ dstipaddr='a:b:c::'
+ dstipmask='ffff:ffff:ffff:ffff:8000::'
+ protocol='18'
+ />
+ </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml
@@ -0,0 +1,23 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='arp'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='ipv4'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='1536'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='15'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='65535'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml
@@ -0,0 +1,33 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='rarp'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ hwtype='12'
+ protocoltype='34'
+ opcode='Request'
+ arpsrcmacaddr='1:2:3:4:5:6'
+ arpdstmacaddr='a:b:c:d:e:f'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='1' hwtype='255' protocoltype='255'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='11' hwtype='256' protocoltype='256'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65535' hwtype='65535' protocoltype='65535' />
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65536' hwtype='65536' protocoltype='65536' />
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase'>
+ <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid>
+ <filterref filter='clean-traffic'/>
+ <rule action='accept' direction='out'>
+ <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='arp'/>
+ </rule>
+ <rule action='accept' direction='out'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='out'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml
@@ -0,0 +1,4 @@
+<filter name='testcase'>
+ <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid>
+ <filterref filter='clean-traffic'/>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <sctp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in' statematch='false'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in' statematch='0'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c' srcipmask='128'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udplite srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN ah ::/0 a:b:c::/128 DSCP match
0x21state ESTABLISHED
+RETURN ah ::/0 ::10.1.2.3/128 DSCP match
0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match
0x02state ESTABLISHED
+ACCEPT ah a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT ah ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT ah ::/0 a:b:c::/128 DSCP match
0x21
+ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match
0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall
@@ -0,0 +1,32 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN all ::/0 a:b:c::/128 DSCP match
0x21state ESTABLISHED
+RETURN all ::/0 ::10.1.2.3/128 DSCP match
0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match
0x02state ESTABLISHED
+ACCEPT all a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT all ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT all ::/0 a:b:c::/128 DSCP match
0x21
+ACCEPT all ::/0 ::10.1.2.3/128 DSCP match
0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+#ip6tables -L FORWARD --line-number | grep libvirt
+1 libvirt-in all anywhere anywhere
+2 libvirt-out all anywhere anywhere
+3 libvirt-in-post all anywhere anywhere
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall
@@ -0,0 +1,30 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN all -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
+#iptables -L FORWARD --line-number | grep libvirt
+1 libvirt-in all -- anywhere anywhere
+2 libvirt-out all -- anywhere anywhere
+3 libvirt-in-post all -- anywhere anywhere
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall
@@ -0,0 +1,24 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1
+DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2
+RETURN all -- 0.0.0.0/0 0.0.0.0/0 state
NEW,ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1
+DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN esp ::/0 a:b:c::/128 DSCP match
0x21state ESTABLISHED
+RETURN esp ::/0 ::10.1.2.3/128 DSCP match
0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match
0x02state ESTABLISHED
+ACCEPT esp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT esp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT esp ::/0 a:b:c::/128 DSCP match
0x21
+ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match
0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall
@@ -0,0 +1,68 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst
10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport
13398:17767 -j ACCEPT
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d
aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst
::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp
--ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype
18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f
-j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p 0x1234 -j ACCEPT
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state
NEW,ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092
+#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp ::/0 a:b:c::/128 tcp
spts:256:4369 dpts:32:33 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp ::/0 a:b:c::/128 tcp
spts:256:4369 dpts:32:33
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
8 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
0 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
0 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
8 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state
NEW,ESTABLISHED
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state
ESTABLISHED
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED
+RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state
NEW,ESTABLISHED
+ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11
+ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall
@@ -0,0 +1,26 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state
NEW,ESTABLISHED
+RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP
match 0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmpv6 a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state
NEW,ESTABLISHED
+ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11
+ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP
match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst
10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT
+-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F
--ip-proto udp -j ACCEPT
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT
+-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT
+
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC !
12:34:56:78:9A:BC
+DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC !
AA:AA:AA:AA:AA:AA
+#iptables -L HI-vnet0
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall
@@ -0,0 +1,13 @@
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d
aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst
::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp
--ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst
1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport
100:101 --ip6-dport 20:22 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst
1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport
65535 --ip6-dport 255:256 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst
1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
--ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport
20:22 --ip6-dport 100:101 -j ACCEPT
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
--ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport
255:256 --ip6-dport 65535 -j ACCEPT
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
--ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT
+-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT
+-d aa:bb:cc:dd:ee:ff -j ACCEPT
+-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v
"^Bridge" | grep -v "^$"
+-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request
--arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst
a:b:c:d:e:f -j ACCEPT
+-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype
0xff -j ACCEPT
+-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j
ACCEPT
+-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype
0xffff -j ACCEPT
+-p RARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp ::/0 a:b:c::/128 DSCP match
0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN sctp ::/0 ::10.1.2.3/128 DSCP match
0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match
0x02state ESTABLISHED
+ACCEPT sctp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT sctp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp ::/0 a:b:c::/128 DSCP match
0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match
0x3fsctp spt:65535 dpts:255:256
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fsctp spt:65535 dpts:255:256
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN tcp ::/0 a:b:c::/128 DSCP match
0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN tcp ::/0 ::10.1.2.3/128 DSCP match
0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match
0x02state ESTABLISHED
+ACCEPT tcp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT tcp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT tcp ::/0 a:b:c::/128 DSCP match
0x21tcp spts:100:1111 dpts:20:21
+ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match
0x3ftcp spt:65535 dpts:255:256
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21tcp spts:100:1111 dpts:20:21
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3ftcp spt:65535 dpts:255:256
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21tcp spts:100:1111 dpts:20:21
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3ftcp spt:65535 dpts:255:256
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp ::/0 ::/0 DSCP match
0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN udp ::/0 ::10.1.2.3/128 DSCP match
0x3fudp spt:65535 dpts:255:256 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match
0x02state ESTABLISHED
+ACCEPT udp ::/0 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT udp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp ::/0 ::/0 DSCP match
0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match
0x3fudp spt:65535 dpts:255:256
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fudp spt:65535 dpts:255:256 state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fudp spt:65535 dpts:255:256
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udplite ::/0 a:b:c::/128 DSCP
match 0x21state ESTABLISHED
+RETURN udplite ::/0 ::10.1.2.3/128 DSCP
match 0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP
match 0x02state ESTABLISHED
+ACCEPT udplite a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT udplite ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udplite ::/0 a:b:c::/128 DSCP
match 0x21
+ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP
match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21state ESTABLISHED
+RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP
match 0x02state ESTABLISHED
+ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21
+ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
14 years, 5 months
[libvirt] [PATCH] nwfilter: extensions of docs with advanced filtering topics
by Stefan Berger
As requested, here a couple of paragraphs about the recently added
statematch attribute and some advanced (and tricky) traffic filtering
topics.
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
---
docs/formatnwfilter.html.in | 117
++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 117 insertions(+)
Index: libvirt-acl/docs/formatnwfilter.html.in
===================================================================
--- libvirt-acl.orig/docs/formatnwfilter.html.in
+++ libvirt-acl/docs/formatnwfilter.html.in
@@ -277,6 +277,13 @@
Valid values are in the range of 0 to 1000. If this attribute
is not
provided, the value 500 will automatically be assigned.
</li>
+ <li>
+ statematch -- optional; possible values are '0' or 'false' to
+ turn the underlying connection state matching off; default is
'true'
+ <br>
+ Also read the section on <a href="#nwfelemsRulesAdv">advanced
configuration</a>
+ topics.
+ </li>
</ul>
<p>
The above example indicates that the traffic of type <code>ip</code>
@@ -1117,6 +1124,116 @@
<br><br>
</p>
+ <h3><a name="nwfelemsRulesAdv">Advanced Filter Configuration
Topics</a></h3>
+ <p>
+ The following sections discuss advanced filter configuration
+ topics.
+ </p>
+ <h4><a name="nwfelemsRulesAdvTracking">Connection tracking</a></h4>
+ <p>
+ The network filtering subsystem (on Linux) makes use of the connection
+ tracking support of iptables. This helps in enforcing the
+ directionality of network traffic (state match) as well as
+ counting and limiting the number of simultaneous connections towards
+ a VM. As an example, if a VM has TCP port 8080
+ open, clients may connect to it on port 8080. The tracking of the
+ connection then prevents the client from initiating a connection from
+ (TCP client) port 8080 to the host back (after previously having
+ gained access to the VM). More importantly, tracking helps to prevent
+ remote attackers to establish a connection back to a VM for example
+ if the user inside the VM has established a connection to
+ port 80 on an attacker site, then the attacker won't be able to
+ initiate a connection from TCP port 80 towards the VM.
+ By default the connection state match that enables the enforcement
+ of directionality of traffic is turned on. <br>
+ The following shows an example XML fragement where this feature
has been
+ turned off for incoming connections to TCP port 12345.
+ </p>
+<pre>
+ [...]
+ <rule direction='in' action='accept' statematch='false'>
+ <tcp dstportstart='12345'/>
+ </rule>
+ [...]
+</pre>
+ <p>
+ This now allows incoming traffic to TCP port 12345, but would also
+ enable the initiation from (client) TCP port 12345 within the VM,
+ which may or may not be desirable.
+ </p>
+
+ <h4><a name="nwfelemsRulesAdvLimiting">Limiting Number of
Connections</a></h4>
+ <p>
+ To limit the number of connections a VM may establish, a rule must
+ be provided that sets a limit of connections for a given
+ type of traffic. If for example a VM
+ is supposed to be allowed to only ping one other IP address at a time
+ and is supposed to have only one active incoming ssh connection at a
+ time, the following XML fragment can be used to achieve this.
+ </p>
+<pre>
+ [...]
+ <rule action='drop' direction='in' priority='400'>
+ <tcp connlimit-above='1'/>
+ </rule>
+ <rule action='accept' direction='in' priority='500'>
+ <tcp dstportstart='22'/>
+ </rule>
+ <rule action='drop' direction='out' priority='400'>
+ <icmp connlimit-above='1'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <udp dstportstart='53'/>
+ </rule>
+ <rule action='drop' direction='inout' priority='1000'>
+ <all/>
+ </rule>
+ [...]
+</pre>
+ <p>
+ Note that the rule for the limit has to logically appear
+ before the rule for accepting the traffic.<br>
+ An additional rule for letting DNS traffic to port 22
+ go out the VM has been added to avoid ssh sessions not
+ getting established for reasons related to DNS lookup failures
+ by the ssh daemon. Leaving this rule out may otherwise lead to
+ fun-filled debugging joy.
+ <br><br>
+ Lot of care must be taken with timeouts related
+ to tracking of traffic. An ICMP ping that
+ the user may have terminated inside the VM may have a long
+ timeout in the host's connection tracking system and therefore
+ not allow another ICMP ping to go through for a while. Therefore,
+ the timeouts have to be tuned in the host's sysfs, i.e.,
+ </p>
+
+<pre>
+ echo 3 > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout
+</pre>
+ <p>
+ sets the ICMP connection tracking timeout to 3 seconds. The
+ effect of this is that once one ping is terminated, another
+ one can start after 3 seconds.<br>
+ Further, we want to point out that a client that for whatever
+ reason has not properly closed a TCP connection may cause a
+ connection to be held open for a longer period of time,
+ depending to what timeout the <code>TCP established</code> state
+ timeout has been set to on the host. Also, idle connections may time
+ out in the connection tracking system but can be reactivated once
+ packets are exchanged. However, a newly initated connection may force
+ an idle connection into TCP backoff if the number of allowed
connections
+ is set to a too low limit, the new connection is established
+ and hits (not exceeds) the limit of allowed connections and for
+ example a key is pressed on the old ssh session, which now has become
+ unresponsive due to traffic being dropped.
+ Therefore, the limit of connections should be rather high so that
+ fluctuations in new TCP connections don't cause odd
+ traffic behavior in relaton to idle connections.
+ </p>
+
<h2><a name="nwfcli">Command line tools</a></h2>
<p>
The libvirt command line tool <code>virsh</code> has been extended
14 years, 5 months
[libvirt] [PATCH] libvirt-java-0.4.5 where libvirt-java-0.4.6 Refactored and Modify
by Luis Carlos Moreira da Costa
Thu Jun 17 2010 Luis Carlos Moreira da Costa <tcljava(a)gmail.com>
* Refactored the all code of the libvirt.
* Modify the method toString() to Strng.format in all classes.
* Add final in classes, methods and attributes.
* Alter of test Junit.
* Modify and alter javadoc the methods.
* Add .project and .classpath in Eclipse Galileo IDE.
*Luís Carlos Moreira da Costa*
*Engenharia & Tecnologia**
**---------------------------------------------------------**
**ALOG Data Centers do Brasil**
**Excelência em Projetos de Hosting*
Rua Dr. Miguel Couto, 58 -- Centro
CEP 01008-010 -- São Paulo (SP)
Telefone: (11) 3524-4970 (11) 8476-0040
*http://www.alog.com.br* <http://www.alog.com.br/>
14 years, 5 months
[libvirt] [PATCH 2/2] virsh: add new --details option to vol-list
by Justin Clift
This patch adds a new --details option to the virsh vol-list
command, making its output more useful to people who use virsh
for significant lengths of time.
---
Output from the new option (hopefully this doesn't wrap):
virsh # pool-list
Name State Autostart
-----------------------------------------
default active yes
image_dir active yes
tmp active no
virsh # vol-list default
Name Path
---------------------------------------------------------------------------------------------
CentOS-5.5-x86_64-bin-DVD-1of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso
CentOS-5.5-x86_64-bin-DVD-2of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso
virsh # vol-list image_dir
Name Path
-------------------------------------------------------------------------
snap1.img /export/backend/centos_home/jc/tmp/images/snap1.img
testimage1 /export/backend/centos_home/jc/tmp/images/testimage1
virsh # vol-list tmp
Name Path
------------------------------------------
disk1.img /tmp/images/disk1.img
disk2.img /tmp/images/disk2.img
disk3.img /tmp/images/disk3.img
disk4.img /tmp/images/disk4.img
disk5.img /tmp/images/disk5.img
disk6.img /tmp/images/disk6.img
virsh # vol-list default --details
Name Type Capacity Allocation
Path
----------------------------------------------------------------
CentOS-5.5-x86_64-bin-DVD-1of2.iso file 4.09 GB 4.10 GB
/var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso
CentOS-5.5-x86_64-bin-DVD-2of2.iso file 412.33 MB 412.74 MB
/var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso
virsh # vol-list image_dir --details
Name Type Capacity Allocation
Path
----------------------------------------------------------
snap1.img file 20.00 GB 140.00 KB
/export/backend/centos_home/jc/tmp/images/snap1.img
testimage1 file 20.00 GB 20.02 GB
/export/backend/centos_home/jc/tmp/images/testimage1
virsh # vol-list tmp --details
Name Type Capacity Allocation Path
-------------------------------------------------------------
disk1.img file 20.00 GB 136.00 KB /tmp/images/disk1.img
disk2.img file 20.00 GB 136.00 KB /tmp/images/disk2.img
disk3.img file 20.00 GB 136.00 KB /tmp/images/disk3.img
disk4.img file 20.00 GB 136.00 KB /tmp/images/disk4.img
disk5.img file 20.00 GB 136.00 KB /tmp/images/disk5.img
disk6.img file 20.00 GB 136.00 KB /tmp/images/disk6.img
virsh #
Much more practical than running vol-info individually on each volume.
tools/virsh.c | 212 ++++++++++++++++++++++++++++++++++++++++++++++++-------
tools/virsh.pod | 4 +-
2 files changed, 189 insertions(+), 27 deletions(-)
diff --git a/tools/virsh.c b/tools/virsh.c
index afa84e6..7a12e15 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -6047,67 +6047,227 @@ static const vshCmdInfo info_vol_list[] = {
static const vshCmdOptDef opts_vol_list[] = {
{"pool", VSH_OT_DATA, VSH_OFLAG_REQ, N_("pool name or uuid")},
+ {"details", VSH_OT_BOOL, 0, N_("display extended details for volumes")},
{NULL, 0, 0, NULL}
};
static int
cmdVolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED)
{
+ virStorageVolInfo **volumeInfos = NULL;
virStoragePoolPtr pool;
- int maxactive = 0, i;
+ int details = vshCommandOptBool(cmd, "details");
+ int maxName = 0, maxPath = 0;
+ int numVolumes = 0, i;
char **activeNames = NULL;
+ char **volumePaths = NULL;
+ /* Check the connection to libvirtd daemon is still working */
if (!vshConnectionUsability(ctl, ctl->conn, TRUE))
return FALSE;
+ /* Look up the pool information given to us by the user */
if (!(pool = vshCommandOptPool(ctl, cmd, "pool", NULL)))
return FALSE;
- maxactive = virStoragePoolNumOfVolumes(pool);
- if (maxactive < 0) {
+ /* Determine the number of volumes in the pool */
+ numVolumes = virStoragePoolNumOfVolumes(pool);
+ if (numVolumes < 0) {
virStoragePoolFree(pool);
vshError(ctl, "%s", _("Failed to list active vols"));
return FALSE;
}
- if (maxactive) {
- activeNames = vshMalloc(ctl, sizeof(char *) * maxactive);
- if ((maxactive = virStoragePoolListVolumes(pool, activeNames,
- maxactive)) < 0) {
+ /* Retrieve the list of volume names in the pool */
+ if (numVolumes) {
+ activeNames = vshMalloc(ctl, sizeof(char *) * numVolumes);
+ if ((numVolumes = virStoragePoolListVolumes(pool, activeNames,
+ numVolumes)) < 0) {
vshError(ctl, "%s", _("Failed to list active vols"));
VIR_FREE(activeNames);
virStoragePoolFree(pool);
return FALSE;
}
- qsort(&activeNames[0], maxactive, sizeof(char *), namesorter);
+ /* Sort the volume names */
+ qsort(&activeNames[0], numVolumes, sizeof(char *), namesorter);
}
- vshPrintExtra(ctl, "%-20s %-40s\n", _("Name"), _("Path"));
- vshPrintExtra(ctl, "-----------------------------------------\n");
- for (i = 0; i < maxactive; i++) {
- virStorageVolPtr vol = virStorageVolLookupByName(pool, activeNames[i]);
- char *path;
+ /* Set aside memory for volume information pointers */
+ volumePaths = vshMalloc(ctl, sizeof(char *) * numVolumes);
+ volumeInfos = vshMalloc(ctl, sizeof(virStorageVolInfo *) * numVolumes);
- /* this kind of work with vols is not atomic operation */
- if (!vol) {
- VIR_FREE(activeNames[i]);
- continue;
- }
+ /* Collect the rest of the volume information for display */
+ for (i = 0; i < numVolumes; i++) {
+ int stringLength;
+ virStorageVolPtr vol = virStorageVolLookupByName(pool,
+ activeNames[i]);
- if ((path = virStorageVolGetPath(vol)) == NULL) {
- virStorageVolFree(vol);
- continue;
+ /* Retrieve the volume path */
+ if ((volumePaths[i] = virStorageVolGetPath(vol)) == NULL) {
+ /* Something went wrong retrieving a volume path, cope with it */
+ volumePaths[i] = vshStrdup(ctl, _("unknown"));
}
+ /* Keep the length of path string if longest so far */
+ stringLength = strlen(volumePaths[i]);
+ if (stringLength > maxPath)
+ maxPath = stringLength;
+
+ /* Keep the length of name string if longest so far */
+ stringLength = strlen(activeNames[i]);
+ if (stringLength > maxName)
+ maxName = stringLength;
+
+ /* Retrieve the volume capacity and allocation */
+ volumeInfos[i] = vshMalloc(ctl, sizeof(virStorageVolInfo));
+ if (virStorageVolGetInfo(vol, volumeInfos[i]) != 0) {
+ /* Something went wrong retrieving volume info, cope with it */
+ volumeInfos[i] = NULL;
+ }
- vshPrint(ctl, "%-20s %-40s\n",
- virStorageVolGetName(vol),
- path);
- VIR_FREE(path);
+ /* Cleanup memory allocation */
virStorageVolFree(vol);
- VIR_FREE(activeNames[i]);
}
+
+ /* Display the volume information */
+ vshDebug(ctl, 5, "Longest name string = %d chars\n", maxName);
+ vshDebug(ctl, 5, "Longest path string = %d chars\n", maxPath);
+ if (details) {
+ virBuffer formatStr = VIR_BUFFER_INITIALIZER;
+
+ /* Is the output too long to fit on one line? */
+ if ((maxName + maxPath + 30) < 80) {
+ virBuffer headerStr = VIR_BUFFER_INITIALIZER;
+
+ /* Output is not too long - use one line per entry */
+ virBufferVSprintf(&formatStr,
+ "%%-%us %%-6s %%-10s %%-10s %%-%us\n",
+ maxName < 5 ? 5 : maxName,
+ maxPath);
+ virBufferVSprintf(&headerStr,
+ virBufferContentAndReset(&formatStr),
+ _("Name"), _("Type"), _("Capacity"),
+ _("Allocation"), _("Path"));
+ unsigned int headerLength = strlen(headerStr.d);
+ vshPrintExtra(ctl, "%s", virBufferContentAndReset(&headerStr));
+
+ /* Display an underline of appropriate length */
+ for (i = 0; i < headerLength - 1; i++)
+ vshPrintExtra(ctl, "-");
+ vshPrintExtra(ctl, "\n");
+
+ /* Define output format - one line per row of volume info */
+ virBufferVSprintf(&formatStr,
+ "%%-%us %%-6s %%-10s %%-10s %%-%us\n",
+ maxName < 5 ? 5 : maxName,
+ maxPath);
+ } else {
+ /* Output IS too long - use two lines per entry */
+ virBufferVSprintf(&formatStr,
+ "%%-%us %%-6s %%-10s %%-10s\n %%-%us\n",
+ maxName < 5 ? 5 : maxName,
+ maxPath);
+ vshPrintExtra(ctl, virBufferContentAndReset(&formatStr),
+ _("Name"), _("Type"), _("Capacity"),
+ _("Allocation"), _("Path"));
+
+ /* Display an underline of appropriate length */
+ if ((maxName + 30) > (maxPath + 6)) {
+ /* 30 = # chars in the header not including the name field
+ * 6 = Padding number picked out of the air that seems
+ * to work ok
+ */
+ for (i = 0; i < maxName + 30; i++)
+ vshPrintExtra(ctl, "-");
+ } else {
+ for (i = 0; i < maxPath + 6; i++)
+ vshPrintExtra(ctl, "-");
+ }
+ vshPrintExtra(ctl, "\n");
+
+ /* Define output format - two lines per row of volume info */
+ virBufferVSprintf(&formatStr,
+ "%%-%us %%-6s %%-10s %%-10s\n %%-%us\n",
+ maxName < 5 ? 5 : maxName,
+ maxPath);
+ }
+
+ /* Display the volume detail rows */
+ for (i = 0; i < numVolumes; i++) {
+ /* Do we have detailed sizing info? */
+ if (volumeInfos[i] != NULL) {
+ /* We have detailed sizing info */
+ double capVal, allocVal;
+ const char *capUnit, *allocUnit;
+ virBuffer capBufStr = VIR_BUFFER_INITIALIZER;
+ virBuffer allocBufStr = VIR_BUFFER_INITIALIZER;
+
+ /* Determine the capacity value to show */
+ capVal = prettyCapacity(volumeInfos[i]->capacity, &capUnit);
+ virBufferVSprintf(&capBufStr, "%.2lf %s", capVal, capUnit);
+
+ /* Determine the allocation value to show */
+ allocVal = prettyCapacity(volumeInfos[i]->allocation,
+ &allocUnit);
+ virBufferVSprintf(&allocBufStr, "%.2lf %s", allocVal,
+ allocUnit);
+
+ /* Output volume details, showing all volume info */
+ vshPrintExtra(ctl, formatStr.d,
+ activeNames[i],
+ volumeInfos[i]->type == VIR_STORAGE_VOL_FILE ?
+ _("file") : _("block"),
+ virBufferContentAndReset(&capBufStr),
+ virBufferContentAndReset(&allocBufStr),
+ volumePaths[i]);
+
+ /* Cleanup memory allocation */
+ VIR_FREE(volumeInfos[i]);
+ } else {
+ /* We don't have detailed sizing info, so output
+ * what we have */
+ vshPrintExtra(ctl, formatStr.d,
+ activeNames[i],
+ _("unknown"),
+ _("unknown"),
+ _("unknown"),
+ volumePaths[i]);
+ }
+
+ /* Cleanup memory allocation for this volume */
+ VIR_FREE(volumePaths[i]);
+ VIR_FREE(activeNames[i]);
+ }
+ } else {
+ /* Only basic volume information needs to be shown */
+ if (maxName < 20) /* Minimum column widths in the output */
+ maxName = 20;
+ if (maxPath < 4) /* Minimum column widths in the output */
+ maxPath = 4;
+ virBuffer outputStr = VIR_BUFFER_INITIALIZER;
+ virBufferVSprintf(&outputStr, "%%-%us %%-%us\n", maxName, maxPath);
+
+ /* Output header */
+ vshPrintExtra(ctl, outputStr.d, _("Name"), _("Path"));
+
+ /* Display underline */
+ for (i = 0; i < maxName + maxPath + 1; i++)
+ vshPrintExtra(ctl, "-");
+ vshPrintExtra(ctl, "\n");
+
+ /* Output the volume information rows */
+ for (i = 0; i < numVolumes; i++) {
+ vshPrint(ctl, outputStr.d, activeNames[i], volumePaths[i]);
+ }
+
+ /* Cleanup memory allocation */
+ virBufferFreeAndReset(&outputStr);
+ }
+
+ /* Cleanup remaining memory allocation */
+ VIR_FREE(volumePaths);
+ VIR_FREE(volumeInfos);
VIR_FREE(activeNames);
virStoragePoolFree(pool);
return TRUE;
diff --git a/tools/virsh.pod b/tools/virsh.pod
index 8432b44..0f387e6 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -839,10 +839,12 @@ Returns basic information about the given storage volume.
I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool the volume is in.
I<vol-name-or-key-or-path> is the name or key or path of the volume to return information for.
-=item B<vol-list> I<--pool> I<pool-or-uuid>
+=item B<vol-list> I<--pool> I<pool-or-uuid> optional I<--details>
Return the list of volumes in the given storage pool.
I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool.
+The I<--details> option instructs virsh to additionally display volume
+persistence and capacity related information where available.
=item B<vol-pool> I<vol-key-or-path>
--
1.7.0.1
14 years, 5 months
[libvirt] [PATCH v2] qemu: Fix crash on failed VM startup
by Cole Robinson
If VM startup fails early enough (can't find a referenced USB device),
libvirtd will crash trying to clear the VNC port bit, since port = 0,
which overflows us out of the bitmap bounds.
Fix this by being more defensive in the bitmap operations, and only
clearing a previously set VNC port.
v2: Add safety check to all relevant bitmap ops.
Signed-off-by: Cole Robinson <crobinso(a)redhat.com>
---
src/qemu/qemu_driver.c | 2 +-
src/util/bitmap.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index c8cd50a..f5a1310 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3741,7 +3741,7 @@ retry:
if ((vm->def->ngraphics == 1) &&
vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC &&
vm->def->graphics[0]->data.vnc.autoport &&
- vm->def->graphics[0]->data.vnc.port != -1) {
+ vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) {
if (virBitmapClearBit(driver->reservedVNCPorts,
vm->def->graphics[0]->data.vnc.port - \
QEMU_VNC_PORT_MIN) < 0) {
diff --git a/src/util/bitmap.c b/src/util/bitmap.c
index 69094a5..cef3fc4 100644
--- a/src/util/bitmap.c
+++ b/src/util/bitmap.c
@@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap)
*/
int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
{
- if (b > bitmap->size - 1)
+ if (bitmap->size <= b)
return -1;
bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b));
@@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b)
*/
int virBitmapClearBit(virBitmapPtr bitmap, size_t b)
{
- if (b > bitmap->size - 1)
+ if (bitmap->size <= b)
return -1;
bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b));
@@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result)
{
uint32_t bit;
- if (b > bitmap->size - 1)
+ if (bitmap->size <= b)
return -1;
bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &
--
1.6.6.1
14 years, 5 months
[libvirt] [PATCH] Fix description of virStorageVolGetInfo()
by Philipp Hahn
Probably a copy-paste-bug in python/libvirt-override-api.xml:
virStorageVolGetInfo() extracts information about a "storage volume",
not the "storage pool" as virStoragePoolGetInfo() does.
Signed-off-by: Philipp Hahn <hahn(a)univention.de>
---
python/libvirt-override-api.xml | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
14 years, 5 months
[libvirt] [PATCHv2 0/2] virsh: add new --details option flag to pool-list and vol-list
by Justin Clift
Hi all,
The following two patches add a new "--details" option flag to the virsh
pool-list and vol-list commands.
Adding these because trying to get sizing information for large numbers
of pools or volumes is presently difficult, having to run the pool-info
or vol-info command on each one individually.
This shows the required info much more easily. :)
+ The first patch is for the pool-list command, and was pretty
straightforward.
+ The second patch is for the vol-list command, and has been rewritten
from the first submission. If the --details option is not specified,
then the output is exactly as it has been historically, with only
name and path info and the same fixed column widths. If the
--details option is given now, additional info is shown and all
column widths are sized to their widest string.
Additionally the code in the 2nd version of the second patch is
cleaner structured than the first version.
Decent examples of the output from each command are in their email comments.
Open for suggestions and better ideas of course. :)
Regards and best wishes,
Justin Clift
--
Salasaga - Open Source eLearning IDE
http://www.salasaga.org
14 years, 5 months