This patch extends the NWFilter driver for Linux (ebiptables) to create rules for each member of a previously introduced list. If for example an attribute value (internally) looks like this: IP = [10.0.0.1, 10.0.0.2, 10.0.0.3] then 3 rules will be generated for a rule accessing the variable 'IP', one for each member of the list. The effect of this is that this now allows for filtering for multiple values in one field. This can then be used to support for filtering/allowing of multiple IP addresses per interface. An iterator is introduced that extracts each member of a list and puts it into a hash table which then is passed to the function creating a rule. For the above example the iterator would cause 3 loops. v5: - Addressing Eric Blake's comments: new functions (with new callers) return '-1' on error v4: - changed iterator to access multiple lists' elements at the same index; previous behavior was to produce all combinations of all the elements in the given lists v2: - pass the iterator all the way to the function that accesses the hash table and provide a function to pick the value of a variable that is reflected by the current state of the iterator Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; --- src/conf/nwfilter_params.c | 204 ++++++++++++++++++++++++++++++ src/conf/nwfilter_params.h | 27 +++ src/libvirt_private.syms | 4 src/nwfilter/nwfilter_ebiptables_driver.c | 81 +++++++---- 4 files changed, 289 insertions(+), 27 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -192,7 +192,7 @@ static const struct ushort_map l3_protoc static int -printVar(virNWFilterHashTablePtr vars, +printVar(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item, int *done) @@ -200,22 +200,11 @@ printVar(virNWFilterHashTablePtr vars, *done = 0; if ((item->flags & NWFILTER_ENTRY_ITEM_FLAG_HAS_VAR)) { - virNWFilterVarValuePtr varval; const char *val; - varval = virHashLookup(vars->hashTable, item->var); - if (!varval) { - virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, - _("cannot find value for '%s'"), - item->var); - return 1; - } - - val = virNWFilterVarValueGetSimple(varval); + val = virNWFilterVarCombIterGetVarValue(vars, item->var); if (!val) { - virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, - _("cannot get simple value of '%s'"), - item->var); + /* error has been reported */ return 1; } @@ -234,7 +223,7 @@ printVar(virNWFilterHashTablePtr vars, static int -_printDataType(virNWFilterHashTablePtr vars, +_printDataType(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item, bool asHex) @@ -329,7 +318,7 @@ _printDataType(virNWFilterHashTablePtr v static int -printDataType(virNWFilterHashTablePtr vars, +printDataType(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item) { @@ -338,7 +327,7 @@ printDataType(virNWFilterHashTablePtr va static int -printDataTypeAsHex(virNWFilterHashTablePtr vars, +printDataTypeAsHex(virNWFilterVarCombIterPtr vars, char *buf, int bufsize, nwItemDescPtr item) { @@ -406,7 +395,7 @@ ebiptablesAddRuleInst(virNWFilterRuleIns static int ebtablesHandleEthHdr(virBufferPtr buf, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, ethHdrDataDefPtr ethHdr, bool reverse) { @@ -884,7 +873,7 @@ iptablesInstCommand(virBufferPtr buf, static int iptablesHandleSrcMacAddr(virBufferPtr buf, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, nwItemDescPtr srcMacAddr, int directionIn, bool *srcmacskipped) @@ -921,7 +910,7 @@ err_exit: static int iptablesHandleIpHdr(virBufferPtr buf, virBufferPtr afterStateMatch, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, ipHdrDataDefPtr ipHdr, int directionIn, bool *skipRule, bool *skipMatch, @@ -1095,7 +1084,7 @@ err_exit: static int iptablesHandlePortData(virBufferPtr buf, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, portDataDefPtr portData, int directionIn) { @@ -1201,7 +1190,7 @@ _iptablesCreateRuleInstance(int directio virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, virNWFilterRuleInstPtr res, const char *match, bool defMatch, const char *accept_target, @@ -1687,7 +1676,7 @@ static int iptablesCreateRuleInstanceStateCtrl(virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, virNWFilterRuleInstPtr res, bool isIPv6) { @@ -1812,7 +1801,7 @@ static int iptablesCreateRuleInstance(virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, virNWFilterRuleInstPtr res, bool isIPv6) { @@ -1937,7 +1926,7 @@ ebtablesCreateRuleInstance(char chainPre virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, virNWFilterRuleInstPtr res, bool reverse) { @@ -2429,7 +2418,7 @@ ebiptablesCreateRuleInstance(virConnectP virNWFilterDefPtr nwfilter, virNWFilterRuleDefPtr rule, const char *ifname, - virNWFilterHashTablePtr vars, + virNWFilterVarCombIterPtr vars, virNWFilterRuleInstPtr res) { int rc = 0; @@ -2513,6 +2502,44 @@ ebiptablesCreateRuleInstance(virConnectP return rc; } +static int +ebiptablesCreateRuleInstanceIterate( + virConnectPtr conn ATTRIBUTE_UNUSED, + enum virDomainNetType nettype ATTRIBUTE_UNUSED, + virNWFilterDefPtr nwfilter, + virNWFilterRuleDefPtr rule, + const char *ifname, + virNWFilterHashTablePtr vars, + virNWFilterRuleInstPtr res) +{ + int rc = 0; + virNWFilterVarCombIterPtr vciter; + + /* rule->vars holds all the variables names that this rule will access. + * iterate over all combinations of the variables' values and instantiate + * the filtering rule with each combination. + */ + vciter = virNWFilterVarCombIterCreate(vars, rule->vars, rule->nvars); + if (!vciter) + return 1; + + do { + rc = ebiptablesCreateRuleInstance(conn, + nettype, + nwfilter, + rule, + ifname, + vciter, + res); + if (rc) + break; + vciter = virNWFilterVarCombIterNext(vciter); + } while (vciter != NULL); + + virNWFilterVarCombIterFree(vciter); + + return rc; +} static int ebiptablesFreeRuleInstance(void *_inst) @@ -3896,7 +3923,7 @@ virNWFilterTechDriver ebiptables_driver .init = ebiptablesDriverInit, .shutdown = ebiptablesDriverShutdown, - .createRuleInstance = ebiptablesCreateRuleInstance, + .createRuleInstance = ebiptablesCreateRuleInstanceIterate, .applyNewRules = ebiptablesApplyNewRules, .tearNewRules = ebiptablesTearNewRules, .tearOldRules = ebiptablesTearOldRules, Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -222,6 +222,210 @@ virNWFilterVarValueAddValue(virNWFilterV return rc; } +void +virNWFilterVarCombIterFree(virNWFilterVarCombIterPtr ci) +{ + unsigned int i; + + if (!ci) + return; + + for (i = 0; i < ci->nIter; i++) + VIR_FREE(ci->iter[i].varNames); + + VIR_FREE(ci); +} + +static int +virNWFilterVarCombIterGetIndexByIterId(virNWFilterVarCombIterPtr ci, + unsigned int iterId) +{ + unsigned int i; + + for (i = 0; i < ci->nIter; i++) + if (ci->iter[i].iterId == iterId) + return i; + + return -1; +} + +static void +virNWFilterVarCombIterEntryInit(virNWFilterVarCombIterEntryPtr cie, + unsigned int iterId) +{ + memset(cie, 0, sizeof(*cie)); + cie->iterId = iterId; +} + +static int +virNWFilterVarCombIterAddVariable(virNWFilterVarCombIterEntryPtr cie, + virNWFilterHashTablePtr hash, + const char *varName) +{ + virNWFilterVarValuePtr varValue; + unsigned int cardinality; + + varValue = virHashLookup(hash->hashTable, varName); + if (varValue == NULL) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not find value for variable '%s'"), + varName); + return -1; + } + + cardinality = virNWFilterVarValueGetCardinality(varValue); + + if (cie->nVarNames == 0) { + cie->maxValue = cardinality - 1; + } else { + if (cie->maxValue != cardinality - 1) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Cardinality of list items must be " + "the same for processing them in " + "parallel")); + return -1; + } + } + + if (VIR_EXPAND_N(cie->varNames, cie->nVarNames, 1) < 0) { + virReportOOMError(); + return -1; + } + + cie->varNames[cie->nVarNames - 1] = varName; + + return 0; +} + +/* + * Create an iterator over the contents of the given variables. All variables + * must have entries in the hash table. + * The iterator that is created processes all given variables in parallel, + * meaning it will access $ITEM1[0] and $ITEM2[0] then $ITEM1[1] and $ITEM2[1] + * up to $ITEM1[n] and $ITEM2[n]. For this to work, the cardinality of all + * processed lists must be the same. + * The notation $ITEM1 and $ITEM2 (in one rule) therefore will always have to + * process the items in parallel. This will be an implicit notation for + * $ITEM1[@0] and $ITEM2[@0] to 'lock' the two together. Future notations of + * $ITEM1[@1] and $ITEM2[@2] will make them be processed independently, + * which then would cause all combinations of the items of the two lists to + * be created. + */ +virNWFilterVarCombIterPtr +virNWFilterVarCombIterCreate(virNWFilterHashTablePtr hash, + char * const *vars, unsigned int nVars) +{ + virNWFilterVarCombIterPtr res; + unsigned int i, iterId; + int iterIndex; + + if (VIR_ALLOC_VAR(res, virNWFilterVarCombIterEntry, 1) < 0) { + virReportOOMError(); + return NULL; + } + + res->hashTable = hash; + + /* create the default iterator to support @0 */ + iterId = 0; + + res->nIter = 1; + virNWFilterVarCombIterEntryInit(&res->iter[0], iterId); + + for (i = 0; i < nVars; i++) { + + /* currently always access @0 */ + iterId = 0; + + iterIndex = virNWFilterVarCombIterGetIndexByIterId(res, iterId); + if (iterIndex < 0) { + /* future: create new iterator. for now it's a bug */ + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not find iterator with id %u"), + iterId); + goto err_exit; + } + + if (virNWFilterVarCombIterAddVariable(&res->iter[iterIndex], + hash, vars[i]) < 0) + goto err_exit; + } + + return res; + +err_exit: + virNWFilterVarCombIterFree(res); + return NULL; +} + +virNWFilterVarCombIterPtr +virNWFilterVarCombIterNext(virNWFilterVarCombIterPtr ci) +{ + unsigned int i; + + for (i = 0; i < ci->nIter; i++) { + ci->iter[i].curValue++; + if (ci->iter[i].curValue <= ci->iter[i].maxValue) + break; + else + ci->iter[i].curValue = 0; + } + + if (ci->nIter == i) { + virNWFilterVarCombIterFree(ci); + return NULL; + } + + return ci; +} + +const char * +virNWFilterVarCombIterGetVarValue(virNWFilterVarCombIterPtr ci, + const char *varName) +{ + unsigned int i; + bool found = false; + const char *res = NULL; + virNWFilterVarValuePtr value; + unsigned int iterIndex; + + /* currently always accessing iter @0 */ + iterIndex = 0; + + for (i = 0; i < ci->iter[iterIndex].nVarNames; i++) { + if (STREQ(ci->iter[iterIndex].varNames[i], varName)) { + found = true; + break; + } + } + + if (!found) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not find variable '%s' in iterator"), + varName); + return NULL; + } + + value = virHashLookup(ci->hashTable->hashTable, varName); + if (!value) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not find value for variable '%s'"), + varName); + return NULL; + } + + res = virNWFilterVarValueGetNthValue(value, ci->iter[iterIndex].curValue); + if (!res) { + virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, + _("Could not get nth (%u) value of " + "variable '%s'"), + ci->iter[iterIndex].curValue, varName); + return NULL; + } + + return res; +} + static void hashDataFree(void *payload, const void *name ATTRIBUTE_UNUSED) { Index: libvirt-acl/src/conf/nwfilter_params.h =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.h +++ libvirt-acl/src/conf/nwfilter_params.h @@ -88,4 +88,31 @@ int virNWFilterHashTablePutAll(virNWFilt # define VALID_VARVALUE \ "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.:" +typedef struct _virNWFilterVarCombIterEntry virNWFilterVarCombIterEntry; +typedef virNWFilterVarCombIterEntry *virNWFilterVarCombIterEntryPtr; +struct _virNWFilterVarCombIterEntry { + unsigned int iterId; + const char **varNames; + size_t nVarNames; + unsigned int maxValue; + unsigned int curValue; +}; + +typedef struct _virNWFilterVarCombIter virNWFilterVarCombIter; +typedef virNWFilterVarCombIter *virNWFilterVarCombIterPtr; +struct _virNWFilterVarCombIter { + virNWFilterHashTablePtr hashTable; + size_t nIter; + virNWFilterVarCombIterEntry iter[0]; +}; +virNWFilterVarCombIterPtr virNWFilterVarCombIterCreate( + virNWFilterHashTablePtr hash, + char * const *vars, unsigned int nVars); + +void virNWFilterVarCombIterFree(virNWFilterVarCombIterPtr ci); +virNWFilterVarCombIterPtr virNWFilterVarCombIterNext( + virNWFilterVarCombIterPtr ci); +const char *virNWFilterVarCombIterGetVarValue(virNWFilterVarCombIterPtr ci, + const char *varname); + #endif /* NWFILTER_PARAMS_H */ Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -885,6 +885,10 @@ virNWFilterHashTableFree; virNWFilterHashTablePut; virNWFilterHashTablePutAll; virNWFilterHashTableRemoveEntry; +virNWFilterVarCombIterCreate; +virNWFilterVarCombIterFree; +virNWFilterVarCombIterGetVarValue; +virNWFilterVarCombIterNext; virNWFilterVarValueCreateSimple; virNWFilterVarValueCreateSimpleCopyValue; virNWFilterVarValueGetSimple;

This patch modifies the NWFilter parameter parser to support multiple elements with the same name and to internally build a list of items. An example of the XML looks like this: <parameter name='TEST' value='10.1.2.3'/> <parameter name='TEST' value='10.2.3.4'/> <parameter name='TEST' value='10.1.1.1'/> The list of values is then stored in the newly introduced data type virNWFilterVarValue. The XML formatter is also adapted to print out all items in alphabetical order sorted by 'name'. This patch also fixes a bug in the XML schema on the way. v5: - Addressing Eric Blake's comments v4: - schema: removed the <optional> node in favor of the <zeroOrMore> node v3: - Follow Daniel Berrange's suggestion of parsing a list as shown above - Rewrote XML formatter to print out parameters in alphabetical order v2: - check that each item in the list only contains allowed characters Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; --- docs/schemas/nwfilter.rng | 4 +- src/conf/nwfilter_params.c | 75 ++++++++++++++++++++++++++++++++------------- 2 files changed, 56 insertions(+), 23 deletions(-) Index: libvirt-acl/src/conf/nwfilter_params.c =================================================================== --- libvirt-acl.orig/src/conf/nwfilter_params.c +++ libvirt-acl/src/conf/nwfilter_params.c @@ -604,7 +604,7 @@ isValidVarName(const char *var) static bool isValidVarValue(const char *value) { - return value[strspn(value, VALID_VARVALUE)] == 0; + return (value[strspn(value, VALID_VARVALUE)] == 0) && (strlen(value) != 0); } static virNWFilterVarValuePtr @@ -636,15 +636,22 @@ virNWFilterParseParamAttributes(xmlNodeP if (nam != NULL && val != NULL) { if (!isValidVarName(nam)) goto skip_entry; - value = virNWFilterParseVarValue(val); - if (!value) + if (!isValidVarValue(val)) goto skip_entry; - if (virNWFilterHashTablePut(table, nam, value, 1)) { - VIR_FREE(nam); - VIR_FREE(val); - virNWFilterVarValueFree(value); - virNWFilterHashTableFree(table); - return NULL; + value = virHashLookup(table->hashTable, nam); + if (value) { + /* add value to existing value -> list */ + if (!virNWFilterVarValueAddValue(value, val)) { + value = NULL; + goto err_exit; + } + val = NULL; + } else { + value = virNWFilterParseVarValue(val); + if (!value) + goto skip_entry; + if (virNWFilterHashTablePut(table, nam, value, 1)) + goto err_exit; } value = NULL; } @@ -657,39 +664,65 @@ skip_entry: cur = cur->next; } return table; + +err_exit: + VIR_FREE(nam); + VIR_FREE(val); + virNWFilterVarValueFree(value); + virNWFilterHashTableFree(table); + return NULL; } -static void -_formatParameterAttrs(void *payload, const void *name, void *data) +static int +virNWFilterFormatParameterNameSorter(const virHashKeyValuePairPtr a, + const virHashKeyValuePairPtr b) { - virBufferPtr buf = data; - - virBufferAsprintf(buf, " <parameter name='%s' value='%s'/>\n", - (const char *)name, - (char *)payload); + return strcmp((const char *)a->key, (const char *)b->key); } - int virNWFilterFormatParamAttributes(virBufferPtr buf, virNWFilterHashTablePtr table, const char *filterref) { - int count = virHashSize(table->hashTable); + char **keys; + int i, j, card, numKeys; + virNWFilterVarValuePtr value; + + numKeys = virHashSize(table->hashTable); - if (count < 0) { + if (numKeys < 0) { virNWFilterReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("missing filter parameter table")); return -1; } + + keys = (char **)virHashGetKeys(table->hashTable, + virNWFilterFormatParameterNameSorter); + if (!keys) + return -1; + virBufferAsprintf(buf, "<filterref filter='%s'", filterref); - if (count) { + if (numKeys) { virBufferAddLit(buf, ">\n"); - virHashForEach(table->hashTable, _formatParameterAttrs, buf); + for (i = 0; i < numKeys; i++) { + value = virHashLookup(table->hashTable, keys[i]); + card = virNWFilterVarValueGetCardinality(value); + + for (j = 0; j < card; j++) + virBufferAsprintf(buf, + " <parameter name='%s' value='%s'/>\n", + keys[i], + virNWFilterVarValueGetNthValue(value, j)); + + } virBufferAddLit(buf, "</filterref>\n"); } else { virBufferAddLit(buf, "/>\n"); } + + virHashFreeKeys(table->hashTable, (void **)keys); + return 0; } Index: libvirt-acl/docs/schemas/nwfilter.rng =================================================================== --- libvirt-acl.orig/docs/schemas/nwfilter.rng +++ libvirt-acl/docs/schemas/nwfilter.rng @@ -312,7 +312,7 @@ <attribute name="filter"> <data type="NCName"/> </attribute> - <optional> + <zeroOrMore> <element name="parameter"> <attribute name="name"> <ref name="filter-param-name"/> @@ -321,7 +321,7 @@ <ref name="filter-param-value"/> </attribute> </element> - </optional> + </zeroOrMore> </define> <define name="rule-node-attributes">

This patch adds test cases for parsing of parameters with multiple occurrances of the same name. v5: - Addressing Eric Blake's comments: added more tests Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; --- tests/nwfilterxml2xmlin/attr-value-test.xml | 27 +++++++++++++++++++++++++++ tests/nwfilterxml2xmlout/attr-value-test.xml | 22 ++++++++++++++++++++++ tests/nwfilterxml2xmltest.c | 2 ++ 3 files changed, 51 insertions(+) Index: libvirt-acl/tests/nwfilterxml2xmlin/attr-value-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlin/attr-value-test.xml @@ -0,0 +1,27 @@ +<filter name='testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'> + <parameter name='a' value='1.2.3.4'/> + <parameter name='a' value='1.2.3.5'/> + <parameter name='c' value='1.1.1.1'/> + <parameter name='b' value='1.2.3.10'/> + <parameter name='a' value='1.2.3.6'/> + <parameter name='b' value='1.2.3.11'/> + <parameter name='c' value='2.2.2.2'/> + <parameter name='b' value='1.2.3.12'/> + </filterref> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmlout/attr-value-test.xml =================================================================== --- /dev/null +++ libvirt-acl/tests/nwfilterxml2xmlout/attr-value-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'> + <parameter name='a' value='1.2.3.4'/> + <parameter name='a' value='1.2.3.5'/> + <parameter name='a' value='1.2.3.6'/> + <parameter name='b' value='1.2.3.10'/> + <parameter name='b' value='1.2.3.11'/> + <parameter name='b' value='1.2.3.12'/> + <parameter name='c' value='1.1.1.1'/> + <parameter name='c' value='2.2.2.2'/> + </filterref> + <rule action='accept' direction='out' priority='500'> + <mac srcmacaddr='01:02:03:04:05:06' srcmacmask='ff:ff:ff:ff:ff:ff' protocolid='arp'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <tcp srcmacaddr='01:02:03:04:05:06' dstipaddr='10.1.2.3' dstipmask='32' dscp='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <udp-ipv6 srcmacaddr='01:02:03:04:05:06' dstipaddr='a:b:c::d:e:f' dstipmask='128' dscp='2'/> + </rule> +</filter> Index: libvirt-acl/tests/nwfilterxml2xmltest.c =================================================================== --- libvirt-acl.orig/tests/nwfilterxml2xmltest.c +++ libvirt-acl/tests/nwfilterxml2xmltest.c @@ -150,6 +150,8 @@ mymain(void) DO_TEST("chain_prefixtest1", true); /* derived from arp-test */ + DO_TEST("attr-value-test", false); + return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE); }

On 11/02/2011 07:21 PM, Eric Blake wrote: Pushed this series now as well with tweaks applied.