- Devel - libvirt List Archives

[PATCH] conf: Assert virDomainChrDeviceState and virConnectDomainEventAgentLifecycleState enums are in sync
by Michal Privoznik 20 May '26

20 May '26

From: Michal Privoznik <mprivozn(a)redhat.com> When QEMU driver emits agent connected/disconnected events (inside of processSerialChangedEvent()) it declares a variable of virDomainChrDeviceState enum, and then passes this variable to virDomainEventAgentLifecycleNewFromObj(). But we document the agent lifecycle state to be of virConnectDomainEventAgentLifecycleState enum. Therefore, make sure values from virConnectDomainEventAgentLifecycleState enum are of the same value as those invirDomainChrDeviceState enum. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/conf/domain_conf.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index bdfb99ed1d..d17f6352bd 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1243,6 +1243,11 @@ typedef enum { VIR_DOMAIN_CHR_DEVICE_STATE_LAST } virDomainChrDeviceState; +G_STATIC_ASSERT((int)VIR_DOMAIN_CHR_DEVICE_STATE_CONNECTED == + (int)VIR_CONNECT_DOMAIN_EVENT_AGENT_LIFECYCLE_STATE_CONNECTED); +G_STATIC_ASSERT((int)VIR_DOMAIN_CHR_DEVICE_STATE_DISCONNECTED == + (int)VIR_CONNECT_DOMAIN_EVENT_AGENT_LIFECYCLE_STATE_DISCONNECTED); + VIR_ENUM_DECL(virDomainChrDeviceState); typedef enum { -- 2.53.0

2 1

[PATCH] cpu_map: Add Neoverse-V2 CPU model
by Jonathan Davies 20 May '26

20 May '26

Add Neoverse V2 as a supported cpu model. Signed-off-by: Jonathan Davies <jonathan.davies(a)nutanix.com> --- src/cpu_map/arm_Neoverse-V2.xml | 6 ++++++ src/cpu_map/index.xml | 1 + src/cpu_map/meson.build | 1 + 3 files changed, 8 insertions(+) create mode 100644 src/cpu_map/arm_Neoverse-V2.xml diff --git a/src/cpu_map/arm_Neoverse-V2.xml b/src/cpu_map/arm_Neoverse-V2.xml new file mode 100644 index 0000000000..b8d75ad602 --- /dev/null +++ b/src/cpu_map/arm_Neoverse-V2.xml @@ -0,0 +1,6 @@ +<cpus> + <model name='Neoverse-V2'> + <vendor name='ARM'/> + <pvr value='0xd4f'/> + </model> +</cpus> diff --git a/src/cpu_map/index.xml b/src/cpu_map/index.xml index 57a28d1d1d..82f3f95166 100644 --- a/src/cpu_map/index.xml +++ b/src/cpu_map/index.xml @@ -220,6 +220,7 @@ <include filename='arm_Neoverse-N1.xml'/> <include filename='arm_Neoverse-N2.xml'/> <include filename='arm_Neoverse-V1.xml'/> + <include filename='arm_Neoverse-V2.xml'/> </group> <group name='Qualcomm-based CPU models'> diff --git a/src/cpu_map/meson.build b/src/cpu_map/meson.build index 2b6b1bf3ea..952be9296c 100644 --- a/src/cpu_map/meson.build +++ b/src/cpu_map/meson.build @@ -12,6 +12,7 @@ cpumap_data = [ 'arm_Neoverse-N1.xml', 'arm_Neoverse-N2.xml', 'arm_Neoverse-V1.xml', + 'arm_Neoverse-V2.xml', 'arm_Tengyun-S2500.xml', 'arm_ThunderX299xx.xml', 'arm_vendors.xml', -- 2.43.0

2 1

[PATCH] NEWS: add latest ZFS driver changes
by George Melikov 19 May '26

19 May '26

From: George Melikov <mail(a)gmelikov.ru> Signed-off-by: George Melikov <mail(a)gmelikov.ru> --- NEWS.rst | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/NEWS.rst b/NEWS.rst index 2ecea251da..6ef55124a7 100644 --- a/NEWS.rst +++ b/NEWS.rst @@ -25,8 +25,20 @@ v12.4.0 (unreleased) * **Improvements** + * storage: ZFS: Implement native volume resizing (since v11.7.0) + + The ZFS storage driver now supports ``resizeVol`` allowing online + resizing of zvols via ``zfs set volsize``. Since ZFS is always + thin-provisioned, resize is essentially a size limit change. + * **Bug fixes** + * storage: ZFS: Fix incorrect volsize and refreservation on zvol creation + + When creating a zvol, the ZFS driver listed all volumes in the pool and + updated the new volume's size with data from the last volume in the list + rather than the matching one. Now it correctly returns on valid one. + * esx/vmware: VMs are tracked under different UUIDs by default The VMWare-related drivers were using allegedly unique IDs for domains, but -- 2.53.0

2 1

[PATCH 0/2] virnetdevbandwidth: Only clear qdisc for defined directions
by Wesley Hershberger 19 May '26

19 May '26

The first part of this description is taken from the bug report: https://gitlab.com/libvirt/libvirt/-/work_items/875 By default, a macvtap device will have the qdisc for the tap set to `noqueue` to prevent lock contention limiting the available bandwidth for the VM (see [BZ 1329644](https://bugzilla.redhat.com/show_bug.cgi?id=1329644)) ```xml <interface type='direct'> <mac address='52:54:00:f5:7e:97'/> <source dev='ens2f0np0' mode='passthrough'/> <target dev='macvtap0'/> <model type='virtio'/> <alias name='net1'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </interface> ``` ``` 12: macvtap0@ens2f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 500 ``` However, defining an interface with only an `inbound` bandwidth limit sets the iface's root qdisc to the system default: ```xml <interface type='direct'> <mac address='52:54:00:05:8f:18'/> <source dev='ens2f0np0' mode='passthrough'/> <bandwidth> <inbound average='3125000' peak='3125000'/> </bandwidth> <target dev='macvtap5'/> <model type='virtio'/> <alias name='net0'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> ``` ``` 16: macvtap5@ens2f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 500 ``` If I understand correctly, the `root` and `ingress` directions can be configured independently. So the above bandwidth definition should correspond to this (configured manually): ``` $ sudo tc qdisc show dev macvtap5 qdisc noqueue 8007: root refcnt 2 qdisc ingress ffff: parent ffff:fff1 ---------------- ``` Rather than: ``` $ sudo tc qdisc show dev macvtap6 qdisc fq_codel 0: root refcnt 2 limit 10240p flows 1024 quantum 1514 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64 qdisc ingress ffff: parent ffff:fff1 ---------------- ``` When libvirt sets up a macvtap device, qemuDomainInterfaceSetDefaultQDisc configures qdisc noqueue for the interface. However, if bandwidth limits are defined, it also calls virNetDevBandwidthSet, which will call virNetDevBandwidthClear before reconfiguring the qdisc for the tx/rx. If only rx is defined, the root qdisc will be the system default. d53b0923539 prevents the noqueue configuration from being lost when reconfiguring bandwidth limits. All usages of virNetDevBandwidthSet are either covered by a call to qemuDomainInterfaceSetDefaultQDisc or qdisc noqueue does not apply there. This change doesn't change the semantics of virNetDevBandwidthClear. Alternatively, virNetDevBandwidthSet/virNetDevBandwidthClear could take a default qdisc which would be used to call virNetDevBandwidthSetRootQDisc in virNetDevBandwidthClear, removing the need for the two changes in d53b0923539. I've confirmed that the fix works when creating a domain with an ingress-only bandwidth limit. Please let me know what you think. Thanks! Signed-off-by: Wesley Hershberger <wesley.hershberger(a)canonical.com> --- Wesley Hershberger (2): virnetdevbandwidth: Split virNetDevBandwidthClear into two helpers virnetdevbandwidth: Only clear qdisc for defined directions src/util/virnetdevbandwidth.c | 70 +++++++++++++++++++++++++++++-------------- src/util/virnetdevbandwidth.h | 2 ++ 2 files changed, 49 insertions(+), 23 deletions(-) --- base-commit: 543280d8c8fe06526ce9871e7d25f46f6ee89017 change-id: 20260506-qdisc-clear-11a1f86407a2 Best regards, -- Wesley Hershberger <wesley.hershberger(a)canonical.com>

2 5

[PATCH] virTypedParamsValidateTemplate: Fix counting of templates
by Peter Krempa 19 May '26

19 May '26

From: Peter Krempa <pkrempa(a)redhat.com> There are 2 bugs in virTypedParamsValidateTemplate's counting of the passed amount of templates: - the condition looked for empty strings rather than non-empty ones - the count was 1 more than the amount of templates due to use of post-increment directly in the condition Fixes: 45617351585caa2c5bcc51af48bd32fd750e7afd Closes: https://gitlab.com/libvirt/libvirt/-/work_items/880 Signed-off-by: Peter Krempa <pkrempa(a)redhat.com> --- src/util/virtypedparam.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/util/virtypedparam.c b/src/util/virtypedparam.c index 92f25cea39..bca7478109 100644 --- a/src/util/virtypedparam.c +++ b/src/util/virtypedparam.c @@ -213,8 +213,8 @@ virTypedParamsValidateTemplate(virTypedParameterPtr params, /* we need to copy the list of templates because * 'virTypedParamsValidateInternal' will need to sort it */ - while (*templates[ntemplates++].name == '\0') - ; + while (*templates[ntemplates].name != '\0') + ntemplates++; templ_copy = g_new0(virTypedParamValidationTemplate, ntemplates); memcpy(templ_copy, templates, sizeof(*templates) * ntemplates); -- 2.54.0

2 1

[PATCH] Revert "esx: switch VIR_FREE->g_free in esx*Free*()"
by Martin Kletzander 19 May '26

19 May '26

From: Martin Kletzander <mkletzan(a)redhat.com> This reverts commit 443c79dd7f7d4051fc0084baaa6c56a55d2aace4. Change from VIR_FREE() to g_free meant there is a possible double free when there is an error during parsing because the parsing it done directly into the parsedUri member of the esxPrivate, free'd when it fails and then the caller calls free on it again. Changing back to VIR_FREE() means there is no double free and no crash. Reproducible easily with `virsh -c esx://l?no_verify=2`. Signed-off-by: Martin Kletzander <mkletzan(a)redhat.com> --- src/esx/esx_driver.c | 2 +- src/esx/esx_stream.c | 4 ++-- src/esx/esx_util.c | 13 +++++++------ 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c index 010c62b8e880..6ff0db48ac02 100644 --- a/src/esx/esx_driver.c +++ b/src/esx/esx_driver.c @@ -63,7 +63,7 @@ esxFreePrivate(esxPrivate **priv) esxUtil_FreeParsedUri(&(*priv)->parsedUri); virObjectUnref((*priv)->caps); virObjectUnref((*priv)->xmlopt); - g_free(*priv); + VIR_FREE(*priv); } diff --git a/src/esx/esx_stream.c b/src/esx/esx_stream.c index 143b2405ed49..c1dd80806feb 100644 --- a/src/esx/esx_stream.c +++ b/src/esx/esx_stream.c @@ -321,8 +321,8 @@ esxFreeStreamPrivate(esxStreamPrivate **priv) return; esxVI_CURL_Free(&(*priv)->curl); - g_free((*priv)->backlog); - g_free(*priv); + VIR_FREE((*priv)->backlog); + VIR_FREE(*priv); } static int diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c index a6275babd542..1443ec3b9e46 100644 --- a/src/esx/esx_util.c +++ b/src/esx/esx_util.c @@ -165,13 +165,14 @@ esxUtil_FreeParsedUri(esxUtil_ParsedUri **parsedUri) if (!parsedUri || !(*parsedUri)) return; - g_free((*parsedUri)->transport); - g_free((*parsedUri)->vCenter); - g_free((*parsedUri)->proxy_hostname); - g_free((*parsedUri)->path); - g_free((*parsedUri)->cacert); - g_free(*parsedUri); + VIR_FREE((*parsedUri)->transport); + VIR_FREE((*parsedUri)->vCenter); + VIR_FREE((*parsedUri)->proxy_hostname); + VIR_FREE((*parsedUri)->path); + VIR_FREE((*parsedUri)->cacert); + + VIR_FREE(*parsedUri); } -- 2.54.0

3 4

[PATCH 0/5] buildsys: Remove support for MIPS host
by Philippe Mathieu-Daudé 18 May '26

18 May '26

During the v10.2 development cycle we deprecated MIPS host support (mostly because Debian which we use to test in our CI dropped the architecture when releasing Debian 13). This series removes host support for MIPS. Philippe Mathieu-Daudé (5): buildsys: Remove MIPS cross containers buildsys: Remove support for MIPS hosts hw/mips: Include missing 'cpu.h' header buildsys: Remove MIPS KVM buildsys: Remove MIPS TCG backend MAINTAINERS | 15 - docs/about/deprecated.rst | 8 - docs/about/removed-features.rst | 6 + docs/system/target-mips.rst | 2 - configure | 20 - meson.build | 12 +- include/qemu/timer.h | 30 - include/user/thunk.h | 2 +- linux-user/include/host/mips64/host-signal.h | 75 - target/mips/kvm_mips.h | 28 - tcg/mips64/tcg-target-con-set.h | 30 - tcg/mips64/tcg-target-con-str.h | 20 - tcg/mips64/tcg-target-has.h | 69 - tcg/mips64/tcg-target-mo.h | 13 - tcg/mips64/tcg-target.h | 75 - tcg/mips64/tcg-target-opc.h.inc | 1 - hw/intc/mips_gic.c | 11 +- hw/mips/loongson3_virt.c | 67 +- hw/mips/malta.c | 1 - hw/mips/mips_int.c | 7 +- linux-user/mmap.c | 2 +- target/mips/cpu.c | 5 - target/mips/kvm.c | 1283 -------- target/mips/system/cp0_timer.c | 12 +- target/mips/system/physaddr.c | 1 - util/cacheflush.c | 16 - tcg/mips64/tcg-target.c.inc | 2605 ----------------- .gitlab-ci.d/container-cross.yml | 6 - .gitlab-ci.d/containers.yml | 1 - .gitlab-ci.d/crossbuilds.yml | 22 - target/mips/meson.build | 6 +- tests/docker/Makefile.include | 1 - .../dockerfiles/debian-mips64el-cross.docker | 187 -- .../dockerfiles/debian-mipsel-cross.docker | 187 -- tests/lcitool/refresh | 12 - 35 files changed, 32 insertions(+), 4806 deletions(-) delete mode 100644 linux-user/include/host/mips64/host-signal.h delete mode 100644 target/mips/kvm_mips.h delete mode 100644 tcg/mips64/tcg-target-con-set.h delete mode 100644 tcg/mips64/tcg-target-con-str.h delete mode 100644 tcg/mips64/tcg-target-has.h delete mode 100644 tcg/mips64/tcg-target-mo.h delete mode 100644 tcg/mips64/tcg-target.h delete mode 100644 tcg/mips64/tcg-target-opc.h.inc delete mode 100644 target/mips/kvm.c delete mode 100644 tcg/mips64/tcg-target.c.inc delete mode 100644 tests/docker/dockerfiles/debian-mips64el-cross.docker delete mode 100644 tests/docker/dockerfiles/debian-mipsel-cross.docker -- 2.53.0

2 9

Plans for 12.4.0 release (freeze on 2026-05-25)
by Jiri Denemark 18 May '26

18 May '26

We are getting close to 12.4.0 release of libvirt. To aim for the release on Monday 01 Jun I suggest entering the freeze on Monday 25 May and tagging RC2 on Thursday 28 May. I hope this works for everyone. Jirka

1 0

[PATCH] virauth: Verify virConnectAuth::cb is set in virAuthGetPasswordPath()
by Michal Privoznik 18 May '26

18 May '26

From: Michal Privoznik <mprivozn(a)redhat.com> Simirarly to virAuthGetUsernamePath() check whether callback used to collect credentials is actually set before calling it. This bug is easily reproducible, for instance as: int credtype[] = { VIR_CRED_PASSPHRASE }; virConnectPtr conn = virConnectOpenAuth("esx://root@example.com/", &(virConnectAuth){ .credtype = credtype, .ncredtype = 1, .cb = NULL }, 0); Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- src/util/virauth.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/util/virauth.c b/src/util/virauth.c index fd4b13de7a..2820220897 100644 --- a/src/util/virauth.c +++ b/src/util/virauth.c @@ -229,6 +229,12 @@ virAuthGetPasswordPath(const char *path, return NULL; } + if (!auth->cb) { + virReportError(VIR_ERR_INVALID_ARG, "%s", + _("Missing authentication callback")); + return NULL; + } + prompt = g_strdup_printf(_("Enter %1$s's password for %2$s"), username, hostname); if (!(cred = virAuthAskCredential(auth, prompt, false))) -- 2.53.0

2 1

[PATCH v7 0/4] nwfilter: add nwfilter nftables driver
by Dion Bosschieter 18 May '26

18 May '26

This series aims to implement nftables as a backend driver for the nwfilter feature. The idea is that it will replace the ebiptables driver and provide an easy way for users to switch from one driver to another. The 1st patch introduces the new nwfilter driver. After which nwfilter allows users to choose it in the 2nd patch. The third patch introduces unit testing of the new nftables driver. Finally the last patch introduces a new element to the nwfilterbinding XML which is used to detect and run a cleanup on the old firewall rules defined via the previous used nwfilter firewall backend. - Implemented very basic nwfilter.conf reading, choosing a nwfilter driver based on the name of the drivers (nftables/ebiptables). Defaults to the nftables driver, based on the firewall_backend_priority meson option, following the bridge driver logic. - Implemented nft tracing and counters usable via nwfilter.conf options "enable_trace" and "enable_counters" - Resolves issue https://gitlab.com/libvirt/libvirt/-/issues/603, benchmarks showed that the amount of iifname jumps for each interface in the root chains is the cause for this. Switched the nftables driver towards a vmap (verdict map) so we can have 1 rule that jumps to the correct root input/output chain per interface. Which improves throughput as when the number of interface check and jump rules increases the throughput decreases. The issue describes the interface matching works using the interface name and the majority of the effort is the strncpy, this patch also switches nftables to an interface_index compare instead. However, just using the interface_index is not enough, the amount of oif and iif jump rules causes quite the performance degradation, the vmap instead solves this. - Split rules into separate tables: "libvirt_nwfilter_ethernet" and "libvirt_nwfilter_inet" to preserve existing firewall behavior. - Reworked chain logic for clarity with root -input/-output chains per interface. input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). - Stuck with prerouting and postrouting as hooks for input / output on the _ethernet and _inet table. This makes it easier to merge the tables in the future. Saving management of two tables and decreasing the amount of tables a packet sees. Currently ebtables filtering happens via PREROUTING and POSTROUTING hooks, while ip/ip6tables filtering happens in the output/forward hooks. - Stuck with 2 tables for compatibility reasons with eb iptables, unifying into 1 table will break users firewall definitions, which depend on being able to do accepts on ethernet rules (which currently get defined via ebtables) and additional filtering via the ip rules (which currently get defined via ip(6)tables). The nwfilter_nftables_driver keeps splitting the ethernet and inet rules in seperate tables "libvirt-nwfilter-ethernet" and "libvirt-nwfilter-other". - Rewrote chain logic, so it is easier to understand, input in the VM interface is filtered in the -input chain(s), output out of the VM inteface is filtered in the -output chain(s). _ethernet and _inet table follow the same style and hook in the same way. - Simplified conntrack handling: rules with accept+conntrack are duplicated to the opposite chain for symmetric behavior, to support the existing ebiptables logic. - Firewall updates continue use tmp names for atomic replacement. Unsupported nwfilter features (for now): - IPSets (potential future support via nft sets) - Reject due to filtering in pre/postrouting, using drop instead of reject, copying logic from existing ebiptables ebtables actions Future improvements: - Use `nft -f` for atomic rule application. - Optional single-table mode via nwfilter.conf. - Optimize boot phase with chain hash comparison. --- Changes in v7: - Add backend XML element to virnwfilterbinding, to support switching from nwfilter firewall backend Changes in v6: - Add STP support - Add GARP support - Remove comment "priority=%" leftover from debugging Changes in v5: - Fix rarp support via nft raw payload expression Changes in v4: - Fix rarp nft commands "arp saddr ether" "arp daddr ether" - Filter chain creation, don't create unnecessary chains - Apply danpb seperate argument suggestion - Fix table not existing errors in drop all rules - Fix table not existing errors in apply basic rules Changes in v3: - Renamed -other to -inet - Renamed - to _ in table names - Updated rule / chain sorting on ethernet table to to copy ebtables logic - Fix possible broken revert path - Fix remove rules not working in some cases, EBUSY - Shared functions camel case commit - Rename config option - Add extra config params, enable_trace, enable_counters This required passing the config struct to the ebip/nft nwfilter drivers - Add extra augeaus files Changes in v2: - Rename {ebip,nf}tables specific test files in 1 directory instead of seperating them in different directories. - Added default nwfilter.conf file in git, documented including augeas files - Replaced hardcoding of default driver based on existing firewall_backend_priority meson option. - Added nwfilter_driver_conf.{h,c} for configuration handling, to match the common pattern used in other drivers. Dion Bosschieter (4): nwfilter: add nwfilter nftables driver nwfilter: allow use of nftables nwfilter driver via nwfilter.conf nwfilter: add unit tests and test data for nwfilter nftables driver nwfilter: add used firewall backend to nwfilterbinding libvirt.spec.in | 7 + po/POTFILES | 2 + src/conf/schemas/nwfilterbinding.rng | 7 + src/conf/virnwfilterbindingdef.c | 17 +- src/conf/virnwfilterbindingdef.h | 1 + src/conf/virnwfilterobj.h | 20 - src/nwfilter/libvirtd_nwfilter.aug | 45 + src/nwfilter/meson.build | 38 + src/nwfilter/nwfilter.conf.in | 50 + src/nwfilter/nwfilter_driver.c | 67 +- src/nwfilter/nwfilter_driver_conf.c | 214 + src/nwfilter/nwfilter_driver_conf.h | 69 + src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 144 +- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 2884 ++++++++++++++ src/nwfilter/nwfilter_nftables_driver.h | 28 + src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + tests/meson.build | 2 + tests/nwfilternftablestest.c | 426 ++ .../ah-ipv6-linux.nftables.args | 298 ++ .../ah-linux.nftables.args | 292 ++ .../all-ipv6-linux.nftables.args | 280 ++ .../all-linux.nftables.args | 274 ++ .../arp-linux.nftables.args | 285 ++ .../comment-linux.nftables.args | 502 +++ .../conntrack-linux.nftables.args | 190 + .../esp-ipv6-linux.nftables.args | 298 ++ .../esp-linux.nftables.args | 292 ++ .../example-1-linux.nftables.args | 252 ++ .../example-2-linux.nftables.args | 352 ++ .../hex-data-linux.nftables.args | 368 ++ .../icmp-direction-linux.nftables.args | 226 ++ .../icmp-direction2-linux.nftables.args | 226 ++ .../icmp-direction3-linux.nftables.args | 176 + .../icmp-linux.nftables.args | 248 ++ .../icmpv6-linux.nftables.args | 316 ++ .../igmp-linux.nftables.args | 292 ++ .../ip-linux.nftables.args | 199 + .../ipt-no-macspoof-linux.nftables.args | 166 + .../ipv6-linux.nftables.args | 481 +++ .../iter1-linux.nftables.args | 292 ++ .../iter2-linux.nftables.args | 3532 +++++++++++++++++ .../iter3-linux.nftables.args | 410 ++ .../mac-linux.nftables.args | 176 + .../rarp-linux.nftables.args | 207 + .../sctp-ipv6-linux.nftables.args | 316 ++ .../sctp-linux.nftables.args | 316 ++ .../stp-linux.nftables.args | 233 ++ .../target-linux.nftables.args | 454 +++ .../target2-linux.nftables.args | 302 ++ .../tcp-ipv6-linux.nftables.args | 316 ++ .../tcp-linux.nftables.args | 452 +++ .../udp-ipv6-linux.nftables.args | 316 ++ .../udp-linux.nftables.args | 316 ++ .../udplite-ipv6-linux.nftables.args | 298 ++ .../udplite-linux.nftables.args | 292 ++ .../vlan-linux.nftables.args | 257 ++ tests/nwfilterxml2nftfirewalltest.c | 432 ++ .../filter-vars.xml | 1 + .../simple-backend.xml | 10 + tests/virnwfilterbindingxml2xmltest.c | 1 + 64 files changed, 18865 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/nwfilter_nftables_driver.c create mode 100644 src/nwfilter/nwfilter_nftables_driver.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in create mode 100644 tests/nwfilternftablestest.c create mode 100755 tests/nwfilterxml2firewalldata/ah-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ah-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/all-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/arp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/comment-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/conntrack-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/esp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/example-2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/hex-data-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-direction3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/icmpv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/igmp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ip-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter1-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/iter3-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/mac-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/rarp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/sctp-linux.nftables.args create mode 100644 tests/nwfilterxml2firewalldata/stp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/target2-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/tcp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udp-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-ipv6-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/udplite-linux.nftables.args create mode 100755 tests/nwfilterxml2firewalldata/vlan-linux.nftables.args create mode 100644 tests/nwfilterxml2nftfirewalltest.c create mode 100644 tests/virnwfilterbindingxml2xmldata/simple-backend.xml -- 2.43.0

1 4