March 2011 - Devel - Libvirt List Archives

[libvirt] [PATCH] maint: avoid locale-sensitivity in string case comparisons

by Eric Blake

strcase{cmp/str} have the drawback of being sensitive to the global locale; this is unacceptable in a library setting. Prefer a hard-coded C locale alternative for all but virsh, which is user facing and where the global locale isn't changing externally. * .gnulib: Update to latest, for c-strcasestr change. * bootstrap.conf (gnulib_modules): Drop strcasestr, add c-strcase and c-strcasestr. * cfg.mk (sc_avoid_strcase): New rule. (exclude_file_name_regexp--sc_avoid_strcase): New exception. * src/internal.h (STRCASEEQ, STRCASENEQ, STRCASEEQLEN) (STRCASENEQLEN): Adjust offenders. * src/qemu/qemu_monitor_text.c (qemuMonitorTextEjectMedia): Likewise. * tools/virsh.c (namesorter): Document exception. --- Inspired by today's earlier patch that started using strcasester. This also goes along with our policy of no ctype, just c-ctype. .gnulib | 2 +- bootstrap.conf | 3 ++- cfg.mk | 7 +++++++ src/internal.h | 10 ++++++---- src/qemu/qemu_monitor_text.c | 3 ++- tools/virsh.c | 1 + 6 files changed, 19 insertions(+), 7 deletions(-) diff --git a/.gnulib b/.gnulib index 422ab2e..790645d 160000 --- a/.gnulib +++ b/.gnulib @@ -1 +1 @@ -Subproject commit 422ab2e0d70ed348e2fd0a82558be38e5859011a +Subproject commit 790645d837f8084991421107fba639b110d58335 diff --git a/bootstrap.conf b/bootstrap.conf index 6e10828..733c354 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -22,6 +22,8 @@ gnulib_modules=' areadlink base64 c-ctype +c-strcase +c-strcasestr canonicalize-lgpl chown close @@ -63,7 +65,6 @@ sigpipe snprintf socket stpcpy -strcasestr strchrnul strndup strerror diff --git a/cfg.mk b/cfg.mk index ac419f7..f802cee 100644 --- a/cfg.mk +++ b/cfg.mk @@ -349,6 +349,11 @@ sc_avoid_ctype_macros: halt="don't use ctype macros (use c-ctype.h)" \ $(_sc_search_regexp) +sc_avoid_strcase: + @prohibit='\bstrn?case(cmp|str) *\(' \ + halt="don't use raw strcase functions (use c-strcase instead)" \ + $(_sc_search_regexp) + sc_prohibit_virBufferAdd_with_string_literal: @prohibit='\<virBufferAdd *\([^,]+, *"[^"]' \ halt='use virBufferAddLit, not virBufferAdd, with a string literal' \ @@ -547,6 +552,8 @@ _makefile_at_at_check_exceptions = ' && !/(SCHEMA|SYSCONF)DIR/' syntax-check: $(top_srcdir)/HACKING # List all syntax-check exemptions: +exclude_file_name_regexp--sc_avoid_strcase = ^tools/virsh\.c$$ + _src1=libvirt|fdstream|qemu/qemu_monitor|util/(command|util)|xen/xend_internal exclude_file_name_regexp--sc_avoid_write = \ ^(src/($(_src1))|daemon/libvirtd|tools/console)\.c$$ diff --git a/src/internal.h b/src/internal.h index be97801..2afbd8d 100644 --- a/src/internal.h +++ b/src/internal.h @@ -44,6 +44,8 @@ # include "libvirt_internal.h" +# include "c-strcase.h" + /* On architectures which lack these limits, define them (ie. Cygwin). * Note that the libvirt code should be robust enough to handle the * case where actual value is longer than these limits (eg. by setting @@ -64,13 +66,13 @@ /* String equality tests, suggested by Jim Meyering. */ # define STREQ(a,b) (strcmp(a,b) == 0) -# define STRCASEEQ(a,b) (strcasecmp(a,b) == 0) +# define STRCASEEQ(a,b) (c_strcasecmp(a,b) == 0) # define STRNEQ(a,b) (strcmp(a,b) != 0) -# define STRCASENEQ(a,b) (strcasecmp(a,b) != 0) +# define STRCASENEQ(a,b) (c_strcasecmp(a,b) != 0) # define STREQLEN(a,b,n) (strncmp(a,b,n) == 0) -# define STRCASEEQLEN(a,b,n) (strncasecmp(a,b,n) == 0) +# define STRCASEEQLEN(a,b,n) (c_strncasecmp(a,b,n) == 0) # define STRNEQLEN(a,b,n) (strncmp(a,b,n) != 0) -# define STRCASENEQLEN(a,b,n) (strncasecmp(a,b,n) != 0) +# define STRCASENEQLEN(a,b,n) (c_strncasecmp(a,b,n) != 0) # define STRPREFIX(a,b) (strncmp(a,b,strlen(b)) == 0) # define STRSKIP(a,b) (STRPREFIX(a,b) ? (a) + strlen(b) : NULL) diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c index e0e3292..168c60f 100644 --- a/src/qemu/qemu_monitor_text.c +++ b/src/qemu/qemu_monitor_text.c @@ -33,6 +33,7 @@ #include "qemu_monitor_text.h" #include "qemu_command.h" #include "c-ctype.h" +#include "c-strcasestr.h" #include "memory.h" #include "logging.h" #include "driver.h" @@ -934,7 +935,7 @@ int qemuMonitorTextEjectMedia(qemuMonitorPtr mon, /* If the command failed qemu prints: * device not found, device is locked ... * No message is printed on success it seems */ - if (strcasestr(reply, "device ")) { + if (c_strcasestr(reply, "device ")) { qemuReportError(VIR_ERR_OPERATION_FAILED, _("could not eject media on %s: %s"), devname, reply); goto cleanup; diff --git a/tools/virsh.c b/tools/virsh.c index faeaf47..3c759b9 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -432,6 +432,7 @@ static int namesorter(const void *a, const void *b) { const char **sa = (const char**)a; const char **sb = (const char**)b; + /* User visible sort, so we want locale-specific case comparison. */ return strcasecmp(*sa, *sb); } -- 1.7.4

13 years, 7 months

2
2
0 / 0

[libvirt] [RFC] Add flag for virsh undefine to remove/wipe the disk devices

by Osier Yang

Hi, All I'm thinking to introduce a new flag (something like --remove-disks, --wipe-disks) for "virsh undefine", so that the user can choose whether to remove/wipe the disk devices or not, have seen this requirement in many places, @libvirt-users, public #virt, and also we have a bug of this function. So, IMHO this is a reasonable requirement, following is the rough thoughts: 1) General idea. As we don't have a API which can get all the disk devices of a domain, perhaps need to write functions to parse domain xml to extract the disks' path (this is annoyed, but seems don't other way), and then lookup them by storage volume API (virStorageVolLookupByPath), and then can remove or wipe the volume by (virStorageVolDelete/virStorageVolWipe). And for the disk path which doesn't belong to any storage pool, simply remove it by "unlink()"? 2) Which type of devices can not be removed/wiped. * Can't delete/wipe ISCSI/SCSI vol. * Vol doesn't exists (which will throw an warning when do virStorageVolLookupByPath). * Have no write permission on the parent directory of the disk path. * Can't delete/wipe the disk device which is passthrough'ed from host, (e.g. /dev/sr0 as a CDROM device for guest) * The storage pool which the disk device belongs to as a vol is marked as "share" * The storage pool which the disk device belongs as a vol is readonly * can't delete disk device of network type. * Any others? For these situations, we need to do checking and throw straightforward warnings to tell user why it can't be removed/wiped. Any idea is welcomed. Thanks. CC'ed Eric, as I saw you talked about this somewhere. (#virt?), :-) Regards Osier

13 years, 7 months

6
13
0 / 0

[libvirt] [libvirt-php][PATCH] Fix virConnectClose failed issue on list_domains

by warp.kawada＠gmail.com

This patch for libvirt-php Pre-4.2 version. I checked with libvirt 0.8.8 version. I fixed irConnectClose failed issue on list_domains. And web example codes updated for 0.8.8 API. This issue is: $domains = libvirt_list_domains($conn); PHP Warning: main(): virConnectClose failed with 1 on destructor: (null) And if ssh connect to remote host then some netcat processes remain on remote host. # ps axu|grep libvirt|grep 'nc -U' apache 27867 0.0 0.0 7332 368 ? Ss 12:09 0:00 nc -U /var/run/libvirt/libvirt-sock apache 27871 0.0 0.0 7332 372 ? Ss 12:09 0:00 nc -U /var/run/libvirt/libvirt-sock apache 27875 0.0 0.0 7332 368 ? Ss 12:09 0:00 nc -U /var/run/libvirt/libvirt-sock Thanks for libvirt-php. Regards, == Yukihiro Kawada diff --git a/examples/libvirt.php b/examples/libvirt.php index 10e7e38..8a54acd 100644 --- a/examples/libvirt.php +++ b/examples/libvirt.php @@ -22,7 +22,7 @@ } function get_hostname() { - return libvirt_get_hostname($this->conn); + return libvirt_connect_get_hostname($this->conn); } function get_domain_object($nameRes) { @@ -178,30 +178,23 @@ } function get_uri() { - return libvirt_get_uri($this->conn); + return libvirt_connect_get_uri($this->conn); } function get_domain_count() { - $ac = libvirt_get_active_domain_count($this->conn); - $ic = libvirt_get_inactive_domain_count($this->conn); - $tc = libvirt_get_domain_count($this->conn); - - return array( - 'active' => $ac, - 'inactive' => $ic, - 'total' => $tc - ); + return libvirt_domain_get_counts($this->conn); } function get_domains() { $domNames = array(); $doms = libvirt_list_domains($this->conn); - foreach ($doms as $dom) { - $tmp = libvirt_domain_get_uuid_string($dom); - $domNames[$tmp] = libvirt_domain_get_name($dom); + foreach ($doms as $nam) { + $dom = libvirt_domain_lookup_by_name($this->conn, $nam); + $tmp = libvirt_domain_get_uuid_string($dom); + $domNames[$tmp] = $nam; } - + unset($doms); ksort($domNames); return $domNames; } @@ -316,7 +309,7 @@ $ret = array(); if ($name != false) { - $dom=libvirt_domain_lookup_by_name($this->conn, $name); + $dom = libvirt_domain_lookup_by_name($this->conn, $name); if (!$dom) return false; diff --git a/src/libvirt-php.cb/src/libvirt-php.c index 5e77994..f5a927b 100644 --- a/src/libvirt-php.c +++ b/src/libvirt-php.c @@ -3467,7 +3467,7 @@ PHP_FUNCTION(libvirt_list_domains) int *ids; char **names; const char *name; - int i; + int i, rv; virDomainPtr domain=NULL; GET_CONNECTION_FROM_ARGS("r",&zconn); @@ -3490,6 +3490,12 @@ PHP_FUNCTION(libvirt_list_domains) } efree(ids); + rv = virDomainFree (domain); // Y.Kawada + if (rv != 0) { + php_error_docref(NULL TSRMLS_CC, E_WARNING,"virDomainFree failed with %i on list_domain: %s", rv, LIBVIRT_G (last_error)); + } + domain = NULL; + expectedcount=virConnectNumOfDefinedDomains (conn->conn); names=emalloc(expectedcount*sizeof(char *)); count=virConnectListDefinedDomains (conn->conn,names ,expectedcount);

13 years, 7 months

3
2
0 / 0

[libvirt] daily report

by Wen Congyang

- discuss the bug of libvirt that will cause libvirtd crashed.

13 years, 7 months

1
1
0 / 0

[libvirt] Can't get connection to libvirt if one of the guests' monitor is occupied by other app

by Osier Yang

Hi, As $subject, e.g. the monitor is being used by netcat. Is it expected? Should we only skip to reconnect the domain monitor which is being locked by other app with a timeout specified on "qemuMonitorOpenUnix" (it blocks when trying to connect to the unix socket)? so that it can get a connection, and could manage other domains. How to produce: 1) # service libvirtd stop 2) # nc -U /var/lib/libvirt/qemu/$guest.monitor 3) # virsh (hangs forever if nc process is not killed) Regards Osier

13 years, 7 months

2
1
0 / 0

[libvirt] [PATCH] qemu: Ignore libvirt debug messages in qemu log

by Jiri Denemark

qemu driver uses a 4K buffer for reading qemu log file. This is enough when only qemu's output is present in the log file. However, when debugging messages are turned on, intermediate libvirt process fills the log with a bunch of debugging messages before it executes qemu binary. In such a case the buffer may become too small. However, we are not really interested in libvirt messages so they can be filtered out from the buffer. --- src/qemu/qemu_process.c | 47 +++++++++++++++++++++++++++++++++++++---------- 1 files changed, 37 insertions(+), 10 deletions(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index e31e1b4..bc117a4 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -762,11 +762,21 @@ qemuProcessReadLogOutput(virDomainObjPtr vm, { int retries = (timeout*10); int got = 0; + char *debug = NULL; + int ret = -1; + char *filter_next = buf; + buf[0] = '\0'; + if (virAsprintf(&debug, ": %d: debug : ", vm->pid) < 0) { + virReportOOMError(); + return -1; + } + while (retries) { - ssize_t func_ret, ret; + ssize_t func_ret, bytes; int isdead = 0; + char *eol; func_ret = func(vm, buf, fd); @@ -775,32 +785,46 @@ qemuProcessReadLogOutput(virDomainObjPtr vm, /* Any failures should be detected before we read the log, so we * always have something useful to report on failure. */ - ret = saferead(fd, buf+got, buflen-got-1); - if (ret < 0) { + bytes = saferead(fd, buf+got, buflen-got-1); + if (bytes < 0) { virReportSystemError(errno, _("Failure while reading %s log output"), what); - return -1; + goto cleanup; } - got += ret; + got += bytes; buf[got] = '\0'; + + /* Filter out debug messages from intermediate libvirt process */ + while ((eol = strchr(filter_next, '\n'))) { + char *p = strstr(filter_next, debug); + if (p && p < eol) { + memmove(filter_next, eol + 1, got - (eol - buf)); + got -= eol + 1 - filter_next; + } else { + filter_next = eol + 1; + } + } + if (got == buflen-1) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("Out of space while reading %s log output: %s"), what, buf); - return -1; + goto cleanup; } if (isdead) { qemuReportError(VIR_ERR_INTERNAL_ERROR, _("Process exited while reading %s log output: %s"), what, buf); - return -1; + goto cleanup; } - if (func_ret <= 0) - return func_ret; + if (func_ret <= 0) { + ret = func_ret; + goto cleanup; + } usleep(100*1000); retries--; @@ -809,7 +833,10 @@ qemuProcessReadLogOutput(virDomainObjPtr vm, qemuReportError(VIR_ERR_INTERNAL_ERROR, _("Timed out while reading %s log output: %s"), what, buf); - return -1; + +cleanup: + VIR_FREE(debug); + return ret; } -- 1.7.4.1

13 years, 7 months

2
2
0 / 0

[libvirt] How to get the IP address of a Domain?

by 徐滕

HI,all: I'm new to libvirt, and have some questions about How to get the IP address of a Domain? I searched the old mails int the mail-list ,found one way to do this,it is first get the mac address of the Domain,then used some sniffer or arp tools to fetch the IP address , but: Q1: Is there any APIs of libvirt to get the domain's IP address directly? If does not exist now , have any plan to add this api or some extra tools to do this ,just like the vm-tools on VMware ESX? Q2: How to get the domain's mac? I download the virt-manager src, searching it's source to find how to do this : in details.py , this line seems to get the mac address: in function update_hwlist(hwtype, info, name, icon_name): Line 2475 for net in self.vm.get_network_devices(): mac = net.macaddr update_hwlist(HW_LIST_TYPE_NIC, net, "NIC %s" % mac[-9:], "network-idle") then ,I looked into domains.py, in function get_network_devices(): def get_network_devices(self, refresh_if_necc=True): return self._build_device_list("interface", refresh_if_necc) next, go to function _build_device_list() def _build_device_list(self, device_type, refresh_if_necc=True, inactive=False): guest = self._get_guest(refresh_if_necc=refresh_if_necc, inactive=inactive) devs = guest.get_devices(device_type) count = 0 for dev in devs: dev.vmmindex = count count += 1 return devs finally ,in funciton _get_guest(self, inactive=False, refresh_if_necc=True) def _get_guest(self, inactive=False, refresh_if_necc=True): raise NotImplementedError() this puzzled me , only raise a exception NotImplentedError(),but not deal with it . How to get the mac address? Sorry ,I 'm new to Python either... Really appreciate for your help! wade

13 years, 8 months

4
3
0 / 0

[libvirt] [PATCH] docs: mention C89 syntax preferences

by Eric Blake

* docs/hacking.html.in (Code formatting): Document that // comment and declaration-after-statement are discouraged. * HACKING: Regenerate. --- Any comments on the wording chosen here? Should this go in for 0.9.0? HACKING | 6 ++++++ docs/hacking.html.in | 10 ++++++++++ 2 files changed, 16 insertions(+), 0 deletions(-) diff --git a/HACKING b/HACKING index b2ceaa7..686328c 100644 --- a/HACKING +++ b/HACKING @@ -127,6 +127,12 @@ Note that sometimes you'll have to post-process that output further, by piping it through "expand -i", since some leading TABs can get through. Usually they're in macro definitions or strings, and should be converted anyhow. +Libvirt requires a C99 compiler for various reasons. However, most of the code +base prefers to stick to C89 syntax unless there is a compelling reason +otherwise. For example, it is preferable to use "/* */" comments rather than +"//". Also, when declaring local variables, the prevailing style has been to +declare them at the beginning of a scope, rather than immediately before use. + Curly braces ============ diff --git a/docs/hacking.html.in b/docs/hacking.html.in index e0484dd..dd8eeb8 100644 --- a/docs/hacking.html.in +++ b/docs/hacking.html.in @@ -152,6 +152,16 @@ anyhow. </p> + <p> + Libvirt requires a C99 compiler for various reasons. However, + most of the code base prefers to stick to C89 syntax unless + there is a compelling reason otherwise. For example, it is + preferable to use <code>/* */</code> comments rather + than <code>//</code>. Also, when declaring local variables, the + prevailing style has been to declare them at the beginning of a + scope, rather than immediately before use. + </p> + <h2><a name="curly_braces">Curly braces</a></h2> -- 1.7.4

13 years, 8 months

2
2
0 / 0

Re: [libvirt] libvir-list Digest, Vol 64, Issue 243

by SanitYey o

Hello, I want to know, could libvirt open a console for a specific guest os? like Virt Manager or virt-viewer does. How can I fetch a console or VNC screen by libvirt? Or do I need some other method? how do I use vncdisplay or gtk-vnc to get that? thank you very much ! Best Regards.

13 years, 8 months

2
1
0 / 0

[libvirt] [TCK] nwfilter: add tests for reject, drop and accept targets

by Stefan Berger

This patch adds test cases for the reject, drop and accept targets. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com> --- scripts/nwfilter/nwfilterxml2fwallout/target-test.fwall | 61 ++++++++++++++ scripts/nwfilter/nwfilterxml2xmlin/target-test.xml | 66 ++++++++++++++++ scripts/nwfilter/nwfilterxml2xmlin/target-test2.xml | 18 ++++ 3 files changed, 145 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/target-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/target-test.xml @@ -0,0 +1,66 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' comment='accept rule -- dir out'/> + </rule> + <rule action='drop' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' comment='drop rule -- dir out'/> + </rule> + <rule action='reject' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' comment='reject rule -- dir out'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' comment='accept rule -- dir in'/> + </rule> + <rule action='drop' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' comment='drop rule -- dir in'/> + </rule> + <rule action='reject' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' comment='reject rule -- dir in'/> + </rule> + <rule action='accept' direction='inout'> + <all comment='accept rule -- dir inout'/> + </rule> + <rule action='drop' direction='in'> + <all comment='drop rule -- dir inout'/> + </rule> + <rule action='reject' direction='in'> + <all comment='reject rule -- dir inout'/> + </rule> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='drop' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='reject' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> + <rule action='drop' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> + <rule action='reject' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/target-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/target-test.fwall @@ -0,0 +1,61 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY/* accept rule -- dir out */ +DROP all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02/* drop rule -- dir out */ +REJECT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02/* reject rule -- dir out */ reject-with icmp-port-unreachable +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL/* accept rule -- dir in */ +DROP all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21/* drop rule -- dir in */ +REJECT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21/* reject rule -- dir in */ reject-with icmp-port-unreachable +RETURN all -- 0.0.0.0/0 0.0.0.0/0 /* accept rule -- dir inout */ +DROP all -- 0.0.0.0/0 0.0.0.0/0 /* drop rule -- dir inout */ +REJECT all -- 0.0.0.0/0 0.0.0.0/0 /* reject rule -- dir inout */ reject-with icmp-port-unreachable +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL/* accept rule -- dir out */ +DROP all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02/* drop rule -- dir out */ +REJECT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02/* reject rule -- dir out */ reject-with icmp-port-unreachable +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY/* accept rule -- dir in */ +DROP all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21/* drop rule -- dir in */ +REJECT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21/* reject rule -- dir in */ reject-with icmp-port-unreachable +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* accept rule -- dir inout */ +DROP all -- 0.0.0.0/0 0.0.0.0/0 /* drop rule -- dir inout */ +REJECT all -- 0.0.0.0/0 0.0.0.0/0 /* reject rule -- dir inout */ reject-with icmp-port-unreachable +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY/* accept rule -- dir out */ +DROP all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02/* drop rule -- dir out */ +REJECT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02/* reject rule -- dir out */ reject-with icmp-port-unreachable +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL/* accept rule -- dir in */ +DROP all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21/* drop rule -- dir in */ +REJECT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21/* reject rule -- dir in */ reject-with icmp-port-unreachable +RETURN all -- 0.0.0.0/0 0.0.0.0/0 /* accept rule -- dir inout */ +DROP all -- 0.0.0.0/0 0.0.0.0/0 /* drop rule -- dir inout */ +REJECT all -- 0.0.0.0/0 0.0.0.0/0 /* reject rule -- dir inout */ reject-with icmp-port-unreachable +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD --line-number | grep libvirt +1 libvirt-in all -- anywhere anywhere +2 libvirt-out all -- anywhere anywhere +3 libvirt-in-post all -- anywhere anywhere +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j DROP +-p ARP -s 1:2:3:4:5:6 -j DROP +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p IPv4 -d aa:bb:cc:dd:ee:ff -j DROP +-p IPv4 -d aa:bb:cc:dd:ee:ff -j DROP + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/target-test2.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/target-test2.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='in'> + <tcp dstportstart='22' state='NONE'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcportstart='22' state='NONE'/> + </rule> + <rule action='accept' direction='in'> + <tcp dstportstart='80'/> + </rule> + <rule action='reject' direction='inout'> + <tcp/> + </rule> + <rule action='drop' direction='inout'> + <all/> + </rule> +</filter>

13 years, 8 months

2
2
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Devel March 2011