- Devel - libvirt List Archives

[libvirt] [PATCH] esx: Use bool instead of int where appropriated
by Matthias Bolte 24 Jun '10

24 Jun '10

--- src/esx/esx_util.c | 10 ++-- src/esx/esx_util.h | 10 ++-- src/esx/esx_vmx.c | 126 +++++++++++++++++++++++++++------------------------ src/esx/esx_vmx.h | 2 +- 4 files changed, 78 insertions(+), 70 deletions(-) diff --git a/src/esx/esx_util.c b/src/esx/esx_util.c index 27c3a12..d79de2c 100644 --- a/src/esx/esx_util.c +++ b/src/esx/esx_util.c @@ -380,7 +380,7 @@ esxUtil_ResolveHostname(const char *hostname, int esxUtil_GetConfigString(virConfPtr conf, const char *name, char **string, - int optional) + bool optional) { virConfValuePtr value; @@ -427,7 +427,7 @@ esxUtil_GetConfigString(virConfPtr conf, const char *name, char **string, int esxUtil_GetConfigUUID(virConfPtr conf, const char *name, unsigned char *uuid, - int optional) + bool optional) { virConfValuePtr value; @@ -472,7 +472,7 @@ esxUtil_GetConfigUUID(virConfPtr conf, const char *name, unsigned char *uuid, int esxUtil_GetConfigLong(virConfPtr conf, const char *name, long long *number, - long long default_, int optional) + long long default_, bool optional) { virConfValuePtr value; @@ -520,8 +520,8 @@ esxUtil_GetConfigLong(virConfPtr conf, const char *name, long long *number, int -esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, int *boolean_, - int default_, int optional) +esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, bool *boolean_, + bool default_, bool optional) { virConfValuePtr value; diff --git a/src/esx/esx_util.h b/src/esx/esx_util.h index 26c456d..a1927a6 100644 --- a/src/esx/esx_util.h +++ b/src/esx/esx_util.h @@ -56,15 +56,15 @@ int esxUtil_ResolveHostname(const char *hostname, char *ipAddress, size_t ipAddress_length); int esxUtil_GetConfigString(virConfPtr conf, const char *name, char **string, - int optional); + bool optional); int esxUtil_GetConfigUUID(virConfPtr conf, const char *name, - unsigned char *uuid, int optional); + unsigned char *uuid, bool optional); int esxUtil_GetConfigLong(virConfPtr conf, const char *name, long long *number, - long long default_, int optional); + long long default_, bool optional); -int esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, int *boolean_, - int default_, int optional); +int esxUtil_GetConfigBoolean(virConfPtr conf, const char *name, bool *boolean_, + bool default_, bool optional); #endif /* __ESX_UTIL_H__ */ diff --git a/src/esx/esx_vmx.c b/src/esx/esx_vmx.c index 032f5bc..e10e745 100644 --- a/src/esx/esx_vmx.c +++ b/src/esx/esx_vmx.c @@ -914,7 +914,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, int controller; int bus; int port; - int present; // boolean + bool present; int scsi_virtualDev[4] = { -1, -1, -1, -1 }; int unit; @@ -934,7 +934,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, /* vmx:config.version */ if (esxUtil_GetConfigLong(conf, "config.version", &config_version, 0, - 0) < 0) { + false) < 0) { goto cleanup; } @@ -947,7 +947,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, /* vmx:virtualHW.version */ if (esxUtil_GetConfigLong(conf, "virtualHW.version", &virtualHW_version, 0, - 0) < 0) { + false) < 0) { goto cleanup; } @@ -991,17 +991,17 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, /* vmx:uuid.bios -> def:uuid */ /* FIXME: Need to handle 'uuid.action = "create"' */ - if (esxUtil_GetConfigUUID(conf, "uuid.bios", def->uuid, 1) < 0) { + if (esxUtil_GetConfigUUID(conf, "uuid.bios", def->uuid, true) < 0) { goto cleanup; } /* vmx:displayName -> def:name */ - if (esxUtil_GetConfigString(conf, "displayName", &def->name, 1) < 0) { + if (esxUtil_GetConfigString(conf, "displayName", &def->name, true) < 0) { goto cleanup; } /* vmx:memsize -> def:maxmem */ - if (esxUtil_GetConfigLong(conf, "memsize", &memsize, 32, 1) < 0) { + if (esxUtil_GetConfigLong(conf, "memsize", &memsize, 32, true) < 0) { goto cleanup; } @@ -1015,7 +1015,8 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, def->maxmem = memsize * 1024; /* Scale from megabytes to kilobytes */ /* vmx:sched.mem.max -> def:memory */ - if (esxUtil_GetConfigLong(conf, "sched.mem.max", &memory, memsize, 1) < 0) { + if (esxUtil_GetConfigLong(conf, "sched.mem.max", &memory, memsize, + true) < 0) { goto cleanup; } @@ -1030,7 +1031,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, } /* vmx:numvcpus -> def:vcpus */ - if (esxUtil_GetConfigLong(conf, "numvcpus", &numvcpus, 1, 1) < 0) { + if (esxUtil_GetConfigLong(conf, "numvcpus", &numvcpus, 1, true) < 0) { goto cleanup; } @@ -1046,7 +1047,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, /* vmx:sched.cpu.affinity -> def:cpumask */ // VirtualMachine:config.cpuAffinity.affinitySet if (esxUtil_GetConfigString(conf, "sched.cpu.affinity", &sched_cpu_affinity, - 1) < 0) { + true) < 0) { goto cleanup; } @@ -1128,7 +1129,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, } /* vmx:guestOS -> def:os.arch */ - if (esxUtil_GetConfigString(conf, "guestOS", &guestOS, 1) < 0) { + if (esxUtil_GetConfigString(conf, "guestOS", &guestOS, true) < 0) { goto cleanup; } @@ -1370,7 +1371,7 @@ esxVMX_ParseConfig(esxVI_Context *ctx, virCapsPtr caps, const char *vmx, int esxVMX_ParseVNC(virConfPtr conf, virDomainGraphicsDefPtr *def) { - int enabled = 0; // boolean + bool enabled = false; long long port = 0; if (def == NULL || *def != NULL) { @@ -1379,7 +1380,7 @@ esxVMX_ParseVNC(virConfPtr conf, virDomainGraphicsDefPtr *def) } if (esxUtil_GetConfigBoolean(conf, "RemoteDisplay.vnc.enabled", &enabled, - 0, 1) < 0) { + false, true) < 0) { return -1; } @@ -1395,13 +1396,13 @@ esxVMX_ParseVNC(virConfPtr conf, virDomainGraphicsDefPtr *def) (*def)->type = VIR_DOMAIN_GRAPHICS_TYPE_VNC; if (esxUtil_GetConfigLong(conf, "RemoteDisplay.vnc.port", &port, -1, - 1) < 0 || + true) < 0 || esxUtil_GetConfigString(conf, "RemoteDisplay.vnc.ip", - &(*def)->data.vnc.listenAddr, 1) < 0 || + &(*def)->data.vnc.listenAddr, true) < 0 || esxUtil_GetConfigString(conf, "RemoteDisplay.vnc.keymap", - &(*def)->data.vnc.keymap, 1) < 0 || + &(*def)->data.vnc.keymap, true) < 0 || esxUtil_GetConfigString(conf, "RemoteDisplay.vnc.password", - &(*def)->data.vnc.passwd, 1) < 0) { + &(*def)->data.vnc.passwd, true) < 0) { goto failure; } @@ -1432,7 +1433,7 @@ esxVMX_ParseVNC(virConfPtr conf, virDomainGraphicsDefPtr *def) int -esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, +esxVMX_ParseSCSIController(virConfPtr conf, int controller, bool *present, int *virtualDev) { char present_name[32]; @@ -1456,7 +1457,8 @@ esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, snprintf(virtualDev_name, sizeof(virtualDev_name), "scsi%d.virtualDev", controller); - if (esxUtil_GetConfigBoolean(conf, present_name, present, 0, 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, present_name, present, false, + true) < 0) { goto failure; } @@ -1465,7 +1467,7 @@ esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, } if (esxUtil_GetConfigString(conf, virtualDev_name, &virtualDev_string, - 1) < 0) { + true) < 0) { goto failure; } @@ -1542,16 +1544,16 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virCapsPtr caps, virConfPtr conf, char *prefix = NULL; char present_name[32] = ""; - int present = 0; + bool present = false; char startConnected_name[32] = ""; - int startConnected = 0; + bool startConnected = false; char deviceType_name[32] = ""; char *deviceType = NULL; char clientDevice_name[32] = ""; - int clientDevice = 0; + bool clientDevice = false; char fileType_name[32] = ""; char *fileType = NULL; @@ -1560,7 +1562,7 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virCapsPtr caps, virConfPtr conf, char *fileName = NULL; char writeThrough_name[32] = ""; - int writeThrough = 0; + bool writeThrough = false; if (def == NULL || *def != NULL) { ESX_ERROR(VIR_ERR_INTERNAL_ERROR, "%s", _("Invalid argument")); @@ -1685,13 +1687,14 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virCapsPtr caps, virConfPtr conf, ESX_BUILD_VMX_NAME(writeThrough); /* vmx:present */ - if (esxUtil_GetConfigBoolean(conf, present_name, &present, 0, 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, present_name, &present, false, + true) < 0) { goto cleanup; } /* vmx:startConnected */ if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, - 1, 1) < 0) { + true, true) < 0) { goto cleanup; } @@ -1701,13 +1704,13 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virCapsPtr caps, virConfPtr conf, } /* vmx:deviceType -> def:type */ - if (esxUtil_GetConfigString(conf, deviceType_name, &deviceType, 1) < 0) { + if (esxUtil_GetConfigString(conf, deviceType_name, &deviceType, true) < 0) { goto cleanup; } /* vmx:clientDevice */ - if (esxUtil_GetConfigBoolean(conf, clientDevice_name, &clientDevice, 0, - 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, clientDevice_name, &clientDevice, false, + true) < 0) { goto cleanup; } @@ -1720,18 +1723,18 @@ esxVMX_ParseDisk(esxVI_Context *ctx, virCapsPtr caps, virConfPtr conf, } /* vmx:fileType -> def:type */ - if (esxUtil_GetConfigString(conf, fileType_name, &fileType, 1) < 0) { + if (esxUtil_GetConfigString(conf, fileType_name, &fileType, true) < 0) { goto cleanup; } /* vmx:fileName -> def:src, def:type */ - if (esxUtil_GetConfigString(conf, fileName_name, &fileName, 0) < 0) { + if (esxUtil_GetConfigString(conf, fileName_name, &fileName, false) < 0) { goto cleanup; } /* vmx:writeThrough -> def:cachemode */ - if (esxUtil_GetConfigBoolean(conf, writeThrough_name, &writeThrough, 0, - 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, writeThrough_name, &writeThrough, false, + true) < 0) { goto cleanup; } @@ -1893,10 +1896,10 @@ esxVMX_ParseEthernet(virConfPtr conf, int controller, virDomainNetDefPtr *def) char prefix[48] = ""; char present_name[48] = ""; - int present = 0; + bool present = false; char startConnected_name[48] = ""; - int startConnected = 0; + bool startConnected = false; char connectionType_name[48] = ""; char *connectionType = NULL; @@ -1953,13 +1956,14 @@ esxVMX_ParseEthernet(virConfPtr conf, int controller, virDomainNetDefPtr *def) ESX_BUILD_VMX_NAME(vnet); /* vmx:present */ - if (esxUtil_GetConfigBoolean(conf, present_name, &present, 0, 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, present_name, &present, false, + true) < 0) { goto cleanup; } /* vmx:startConnected */ - if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, 1, - 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, + true, true) < 0) { goto cleanup; } @@ -1970,15 +1974,16 @@ esxVMX_ParseEthernet(virConfPtr conf, int controller, virDomainNetDefPtr *def) /* vmx:connectionType -> def:type */ if (esxUtil_GetConfigString(conf, connectionType_name, &connectionType, - 1) < 0) { + true) < 0) { goto cleanup; } /* vmx:addressType, vmx:generatedAddress, vmx:address -> def:mac */ - if (esxUtil_GetConfigString(conf, addressType_name, &addressType, 1) < 0 || + if (esxUtil_GetConfigString(conf, addressType_name, &addressType, + true) < 0 || esxUtil_GetConfigString(conf, generatedAddress_name, &generatedAddress, - 1) < 0 || - esxUtil_GetConfigString(conf, address_name, &address, 1) < 0) { + true) < 0 || + esxUtil_GetConfigString(conf, address_name, &address, true) < 0) { goto cleanup; } @@ -2010,8 +2015,8 @@ esxVMX_ParseEthernet(virConfPtr conf, int controller, virDomainNetDefPtr *def) } /* vmx:virtualDev, vmx:features -> def:model */ - if (esxUtil_GetConfigString(conf, virtualDev_name, &virtualDev, 1) < 0 || - esxUtil_GetConfigLong(conf, features_name, &features, 0, 1) < 0) { + if (esxUtil_GetConfigString(conf, virtualDev_name, &virtualDev, true) < 0 || + esxUtil_GetConfigLong(conf, features_name, &features, 0, true) < 0) { goto cleanup; } @@ -2043,13 +2048,14 @@ esxVMX_ParseEthernet(virConfPtr conf, int controller, virDomainNetDefPtr *def) if ((connectionType == NULL || STRCASEEQ(connectionType, "bridged") || STRCASEEQ(connectionType, "custom")) && - esxUtil_GetConfigString(conf, networkName_name, &networkName, 0) < 0) { + esxUtil_GetConfigString(conf, networkName_name, &networkName, + false) < 0) { goto cleanup; } /* vmx:vnet -> def:data.ifname */ if (connectionType != NULL && STRCASEEQ(connectionType, "custom") && - esxUtil_GetConfigString(conf, vnet_name, &vnet, 0) < 0) { + esxUtil_GetConfigString(conf, vnet_name, &vnet, false) < 0) { goto cleanup; } @@ -2126,10 +2132,10 @@ esxVMX_ParseSerial(esxVI_Context *ctx, virConfPtr conf, int port, char prefix[48] = ""; char present_name[48] = ""; - int present = 0; + bool present = false; char startConnected_name[48] = ""; - int startConnected = 0; + bool startConnected = false; char fileType_name[48] = ""; char *fileType = NULL; @@ -2163,13 +2169,14 @@ esxVMX_ParseSerial(esxVI_Context *ctx, virConfPtr conf, int port, ESX_BUILD_VMX_NAME(fileName); /* vmx:present */ - if (esxUtil_GetConfigBoolean(conf, present_name, &present, 0, 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, present_name, &present, false, + true) < 0) { goto cleanup; } /* vmx:startConnected */ - if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, 1, - 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, + true, true) < 0) { goto cleanup; } @@ -2179,12 +2186,12 @@ esxVMX_ParseSerial(esxVI_Context *ctx, virConfPtr conf, int port, } /* vmx:fileType -> def:type */ - if (esxUtil_GetConfigString(conf, fileType_name, &fileType, 0) < 0) { + if (esxUtil_GetConfigString(conf, fileType_name, &fileType, false) < 0) { goto cleanup; } /* vmx:fileName -> def:data.file.path */ - if (esxUtil_GetConfigString(conf, fileName_name, &fileName, 0) < 0) { + if (esxUtil_GetConfigString(conf, fileName_name, &fileName, false) < 0) { goto cleanup; } @@ -2255,10 +2262,10 @@ esxVMX_ParseParallel(esxVI_Context *ctx, virConfPtr conf, int port, char prefix[48] = ""; char present_name[48] = ""; - int present = 0; + bool present = false; char startConnected_name[48] = ""; - int startConnected = 0; + bool startConnected = false; char fileType_name[48] = ""; char *fileType = NULL; @@ -2292,13 +2299,14 @@ esxVMX_ParseParallel(esxVI_Context *ctx, virConfPtr conf, int port, ESX_BUILD_VMX_NAME(fileName); /* vmx:present */ - if (esxUtil_GetConfigBoolean(conf, present_name, &present, 0, 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, present_name, &present, false, + true) < 0) { goto cleanup; } /* vmx:startConnected */ - if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, 1, - 1) < 0) { + if (esxUtil_GetConfigBoolean(conf, startConnected_name, &startConnected, + true, true) < 0) { goto cleanup; } @@ -2308,12 +2316,12 @@ esxVMX_ParseParallel(esxVI_Context *ctx, virConfPtr conf, int port, } /* vmx:fileType -> def:type */ - if (esxUtil_GetConfigString(conf, fileType_name, &fileType, 0) < 0) { + if (esxUtil_GetConfigString(conf, fileType_name, &fileType, false) < 0) { goto cleanup; } /* vmx:fileName -> def:data.file.path */ - if (esxUtil_GetConfigString(conf, fileName_name, &fileName, 0) < 0) { + if (esxUtil_GetConfigString(conf, fileName_name, &fileName, false) < 0) { goto cleanup; } diff --git a/src/esx/esx_vmx.h b/src/esx/esx_vmx.h index 9b66ab8..b7522ad 100644 --- a/src/esx/esx_vmx.h +++ b/src/esx/esx_vmx.h @@ -72,7 +72,7 @@ int esxVMX_ParseVNC(virConfPtr conf, virDomainGraphicsDefPtr *def); int -esxVMX_ParseSCSIController(virConfPtr conf, int controller, int *present, +esxVMX_ParseSCSIController(virConfPtr conf, int controller, bool *present, int *virtualDev); int -- 1.7.0.4

2 2

[libvirt] [PATCH] Cleanup some LIBADD and CFLAGS
by Matthias Bolte 24 Jun '10

24 Jun '10

Move libnl to libvirt_util.la, because macvtap.c requires it. Add GnuTLS to libvirt_driver.la, because libvirt.c calls gcrypt functions. When built without loadable driver modules, then the remote driver pulls in GnuTLS. Move libgnu.la from libvirt_parthelper_CFLAGS to libvirt_parthelper_LDADD. --- src/Makefile.am | 13 ++++++------- 1 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index 5109302..ece18a6 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -418,8 +418,8 @@ libvirt_la_LIBADD = $(libvirt_la_BUILT_LIBADD) libvirt_la_BUILT_LIBADD = libvirt_util.la libvirt_util_la_SOURCES = \ $(UTIL_SOURCES) -libvirt_util_la_CFLAGS = $(CAPNG_CFLAGS) $(YAJL_CFLAGS) -libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIB_PTHREAD) +libvirt_util_la_CFLAGS = $(CAPNG_CFLAGS) $(YAJL_CFLAGS) $(LIBNL_CFLAGS) +libvirt_util_la_LIBADD = $(CAPNG_LIBS) $(YAJL_LIBS) $(LIBNL_LIBS) $(LIB_PTHREAD) noinst_LTLIBRARIES += libvirt_conf.la @@ -439,9 +439,9 @@ noinst_LTLIBRARIES += libvirt_driver.la libvirt_la_BUILT_LIBADD += libvirt_driver.la libvirt_driver_la_SOURCES = $(DRIVER_SOURCES) -libvirt_driver_la_CFLAGS = $(NUMACTL_CFLAGS) \ +libvirt_driver_la_CFLAGS = $(NUMACTL_CFLAGS) $(GNUTLS_CFLAGS) \ -I@top_srcdir@/src/conf -libvirt_driver_la_LIBADD = $(NUMACTL_LIBS) +libvirt_driver_la_LIBADD = $(NUMACTL_LIBS) $(GNUTLS_LIBS) USED_SYM_FILES = libvirt_private.syms @@ -1001,7 +1001,6 @@ libvirt_la_LDFLAGS = $(VERSION_SCRIPT_FLAGS)$(LIBVIRT_SYMBOL_FILE) \ $(CYGWIN_EXTRA_LDFLAGS) $(MINGW_EXTRA_LDFLAGS) libvirt_la_BUILT_LIBADD += ../gnulib/lib/libgnu.la libvirt_la_LIBADD += $(LIBXML_LIBS) \ - $(LIBPCAP_LIBS) $(LIBNL_LIBS) \ $(DRIVER_MODULE_LIBS) \ $(CYGWIN_EXTRA_LIBADD) libvirt_la_CFLAGS = $(COVERAGE_CFLAGS) -DIN_LIBVIRT @@ -1038,8 +1037,8 @@ libexec_PROGRAMS += libvirt_parthelper libvirt_parthelper_SOURCES = $(STORAGE_HELPER_DISK_SOURCES) libvirt_parthelper_LDFLAGS = $(WARN_LDFLAGS) $(COVERAGE_LDFLAGS) -libvirt_parthelper_LDADD = $(LIBPARTED_LIBS) -libvirt_parthelper_CFLAGS = $(LIBPARTED_CFLAGS) ../gnulib/lib/libgnu.la +libvirt_parthelper_LDADD = $(LIBPARTED_LIBS) ../gnulib/lib/libgnu.la +libvirt_parthelper_CFLAGS = $(LIBPARTED_CFLAGS) endif endif EXTRA_DIST += $(STORAGE_HELPER_DISK_SOURCES) -- 1.7.0.4

2 2

[libvirt] [PATCH v2] [TCK] nwfilter: apply filters and check firewall rules
by Stefan Berger 24 Jun '10

24 Jun '10

V2: - Following Daniel Berrange's suggestions: - if LIBVIRT_TCK_CONFIG is set, grep for the last occurrence of "^uri/s*=" and assign the value to LIBVIRT_URI - check that LIBVIRT_URI is set to qemu:///system, otherwise skip test - if allowed, remove all VMs and nwfilters starting with tck- - rename all VMs and nwfilters created by this test program to start with 'tck-' - other: - terminate if sourcing the test-lib.sh from libvirt's tests dir is missing (would need to be copied) - redirect stderr to stdout whereever output is read into a variable This is a patch I previously posted for use in the tests/ directory of libvirt. Now I ported it to the TCK project and extended the script with output in the Test Anything Protocol (TAP) format. It now allows multiple output formats chosen via command line parameter supporting TAP (--tap-test), the output format used in the libvirt tests directory (the '.' and '!') (--libvirt-test) and one where all tests are displayed (--verbose). The program basically creates a filter called tck-testcase and two VMs where one of them references the tck-testcase filter and the other a filter called nwfiltertestfilter. The tck-testcase filter is then subsequently modified and the effect on iptables,ebtables and ip6tables verified against expected output for both VMs. The VMs are torn down at the end and the test filters removed. For all the tests to run successfully, the last outstanding patch that would need to go in is this one here: https://www.redhat.com/archives/libvir-list/2010-June/msg00326.html Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- scripts/nwfilter/100-apply-verify.t | 10 scripts/nwfilter/nwfilter2vmtest.sh | 635 ++++++++++ scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 32 scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall | 30 scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall | 24 scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 68 + scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 19 scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall | 13 scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 73 + scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall | 26 scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/all-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml | 12 scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml | 56 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml | 34 scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml | 43 scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml | 23 scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml | 4 scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml | 18 61 files changed, 2059 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -0,0 +1,635 @@ +#!/bin/bash + +ORIG_IFNAME="vnet0" +ATTACH_IFNAME="attach0" +TESTFILTERNAME="nwfiltertestfilter" +TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat" + + +LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd` +if [ "x${LIBVIRTD}x" == "xx" ]; then + LIBVIRTD=`type -P libvirtd` +fi + +VIRSH=`type -P ${PWD}/../tools/virsh` +if [ "x${VIRSH}x" == "xx" ]; then + VIRSH=`type -P virsh` +fi + +LD_LIBRARY_PATH="${PWD}../src/.libs/" + +uri="qemu:///system" +if [ "x${LIBVIRT_TCK_CONFIG}x" != "xx" ]; then + uri_exp=`cat ${LIBVIRT_TCK_CONFIG} | grep "^uri\s*=" | tail -n 1` + if [ "x${uri_exp}x" != "xx" ]; then + eval ${uri_exp} + fi +fi +LIBVIRT_URI=${uri} + +# Maybe no libvirtd was built +[ -z ${LIBVIRTD} ] && exit 0; + +FLAG_WAIT="$((1<<0))" +FLAG_ATTACH="$((1<<1))" +FLAG_VERBOSE="$((1<<2))" +FLAG_LIBVIRT_TEST="$((1<<3))" +FLAG_TAP_TEST="$((1<<4))" + +failctr=0 +passctr=0 +attachfailctr=0 +attachctr=0 + +TAP_FAIL_LIST="" +TAP_FAIL_CTR=0 +TAP_TOT_CTR=0 + +function usage() { + local cmd="$0" +cat <<EOF +Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose] + [--libvirt-test] [--tap-test] + +Options: + --help,-h,-? : Display this help screen. + --noattach : Skip tests that attach and detach a network interface + --wait : Wait for the user to press the enter key once an error + was detected + --verbose : Verbose output + --libvirt-test : Use the libvirt test output format + --tap-test : TAP format output + +This test will create two virtual machines. The one virtual machine +will use a filter called '${TESTFILTERNAME}', and reference the filter +'clean-traffic' which should be available by default with every install. +The other virtual machine will reference the filter 'tck-testcase' and will +have its filter permanently updated. +EOF +} + + +function tap_fail() { + echo "not ok $1 - ${2:0:66}" + TAP_FAIL_LIST+="$1 " + ((TAP_FAIL_CTR++)) + ((TAP_TOT_CTR++)) +} + +function tap_pass() { + echo "ok $1 - ${2:0:70}" + ((TAP_TOT_CTR++)) +} + +function tap_final() { + local okay + + [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests ${TAP_FAIL_LIST}" + + okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l` + echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay" +} + +# A wrapper for mktemp in case it does not exist +# Echos the name of a temporary file. +function mktmpfile() { + local tmp + type -P mktemp > /dev/null + if [ $? -eq 0 ]; then + tmp=$(mktemp -t nwfvmtest.XXXXXX) + echo ${tmp} + else + while :; do + tmp="/tmp/nwfvmtest.${RANDOM}" + if [ ! -f ${tmp} ]; then + touch ${tmp} + chmod 666 ${tmp} + echo ${tmp} + break + fi + done + fi + return 0 +} + + +function checkExpectedOutput() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local flags="$4" + local skipregex="$5" + local regex="s/${ORIG_IFNAME}/${ifname}/g" + local cmd line tmpfile tmpfile2 skip + + tmpfile=`mktmpfile` + tmpfile2=`mktmpfile` + + exec 4<${fwallfile} + + read <&4 + line="${REPLY}" + + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + skip=0 + if [ "x${skipregex}x" != "xx" ]; then + skip=`echo ${cmd} | grep -c -E ${skipregex}` + fi + + eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read <&4 + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + if [ ${skip} -ne 0 ]; then + break + fi + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + fi + ((failctr++)) + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "tmp files: $tmpfile, $tmpfile2" + echo "Press enter" + read + fi + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 1 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}" + else + ((passctr++)) + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \ + echo "PASS ${xmlfile} : ${cmd}" + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 0 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}" + fi + + break + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 4>&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local vm1name="$3" + local vm2name="$4" + local flags="$5" + local testnum="$6" + local linenums ctr=0 + local tmpfile b msg rc + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${vm1name}" "${flags}" \ + "" + + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "" + + if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then + + tmpfile=`mktmpfile` + + b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*source bridge='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + cat >>${tmpfile} <<EOF +<interface type='bridge'> + <source bridge='${b}'/> + <mac address='52:54:00:11:22:33'/> + <target dev='${ATTACH_IFNAME}'/> + <filterref filter='tck-testcase'/> +</interface> +EOF + msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" > /dev/null` + rc=$? + + ((attachctr++)) + + if [ $rc -eq 0 ]; then + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "(PRE|POST)ROUTING" + msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"` + if [ $? -ne 0 ]; then + echo "FAIL: Detach of interface failed." + fi + else + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # In case of TAP, run the test anyway so we get to the full number + # of tests + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "" #"(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" #"(PRE|POST)ROUTING" + fi + + ((attachfailctr++)) + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL: Could not attach interface to vm ${vm1name}." + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter" + read + fi + fi + fi + + rm -rf ${tmpfile} + fi + + return 0 +} + + +function runTests() { + local vm1name="$1" + local vm2name="$2" + local xmldir="$3" + local fwalldir="$4" + local flags="$5" + local fwallfiles f c + local tap_total=0 ctr=0 + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # Need to count the number of total tests + for fil in ${fwallfiles}; do + c=$(grep -c "^#" ${fwalldir}/${fil}) + ((tap_total+=c)) + ((ctr++)) + done + c=$(grep -c "^#" "${TESTVM2FWALLDATA}") + ((tap_total+=c*ctr)) + [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2)) + echo "1..${tap_total}" + fi + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${vm1name}" \ + "${vm2name}" "${flags}" + done + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + test_final $((passctr+failctr)) $failctr + elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + tap_final + else + echo "" + echo "Summary: ${failctr} failures, ${passctr} passes," + if [ ${attachctr} -ne 0 ]; then + echo " ${attachfailctr} interface attachment failures with ${attachctr} attempts" + fi + fi +} + + +function createVM() { + local vmname="$1" + local filtername="$2" + local ipaddr="$3" + local macaddr="$4" + local flags="$5" + local res + local tmpfile='mktmpfile' + + cat > ${tmpfile} << EOF + <domain type='kvm'> + <name>${vmname}</name> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-0.11'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-kvm</emulator> + <interface type='bridge'> + <mac address='${macaddr}'/> + <source bridge='virbr0'/> + <filterref filter='${filtername}'> + <parameter name='IP' value='${ipaddr}'/> + </filterref> + <target dev='${vmname}'/> + </interface> + <console type='pty'> + </console> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + </devices> + </domain> +EOF + + res=$(${VIRSH} define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define VM ${vmname} : ${res}" + return 1 + fi + + res=$(${VIRSH} start ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not start VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + $(${VIRSH} undefine ${vmname}) + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM ${vmname}." + + rm -rf ${tmpfile} + + return 0 +} + + +function destroyVM() { + local vmname="$1" + local flags="$2" + local res + + res=$(${VIRSH} destroy ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not destroy VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + res=$(${VIRSH} undefine ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not undefine VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM ${vmname}." + + return 0 +} + + +function createTestFilters() { + local flags="$1" + local tmpfile=`mktmpfile` + local res + + cat >${tmpfile} << EOF +<filter name="${TESTFILTERNAME}"> + <filterref filter='clean-traffic'/> + + <rule action='drop' direction='inout' priority='1000'> + <all/> + </rule> + + <rule action='drop' direction='inout' priority='1000'> + <all-ipv6/> + </rule> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + cat >${tmpfile} << EOF +<filter name="tck-testcase"> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + rm -rf ${tmpfile} + + return 0 +} + + +function deleteTestFilter() { + local flags="$1" + local res + + res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME} 2>&1) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + res=$(${VIRSH} nwfilter-undefine tck-testcase 2>&1) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + return 0 +} + + +function main() { + local prgname="$0" + local vm1 vm2 + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms res + local filtername="tck-testcase" + local libvirtdpid=-1 + local flags OPWD + + ((flags=${FLAG_ATTACH})) + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --noattach) ((flags ^= FLAG_ATTACH ));; + --wait) ((flags |= FLAG_WAIT ));; + --verbose) ((flags |= FLAG_VERBOSE ));; + --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));; + --tap-test) ((flags |= FLAG_TAP_TEST ));; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + if [ "${LIBVIRT_URI}" != "qemu:///system" ]; then + echo "1..0 # Skipped: Only valid for Qemu system driver" + exit 0 + fi + + for name in `virsh nwfilter-list | awk '{print $2}'` + do + case ${name} in + tck*) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then + res=$(virsh nwfilter-undefine ${name} 2>&1) + if [ $? -ne 0 ]; then + echo "Bail out! Could not undefine nwfiler ${name}: ${res}" + exit 0 + fi + else + echo "Bail out! Filter ${name} already exists, use --force to clean" + exit 1 + fi + esac + done + + for name in `virsh nwfilter-list | awk '{print $2}'` + do + case ${name} in + tck*) + if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then + res=$(virsh undefine ${name} 2>&1) + if [ $? -ne 0 ]; then + echo "Bail out! Could not undefine domain ${name}: ${res}" + exit 1 + fi + else + echo "Bail out! Domain ${name} already exists, use --force to clean" + exit 1 + fi + esac + done + fi + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + pushd ${PWD} > /dev/null + . test-lib.sh + if [ $? -ne 0 ]; then + exit 1 + fi + test_intro $this_test + popd > /dev/null + fi + + res=$(${VIRSH} capabilities 2>&1) + + if [ $? -ne 0 ]; then + if [ "x${LIBVIRTD}x" == "xx" ]; then + echo "Cannot find libvirtd. Exiting." + exit 1 + fi + + rm -rf pid-file 2>/dev/null + ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null & + libvirtdpid=$! + sleep 2 + + res=$(${VIRSH} capabilities 2>&1) + if [ $? -ne 0 ]; then + echo "Could not start the libvirt daemon : $res" + echo "Exiting." + exit 1 + fi + fi + + vm1="tck-testvm${RANDOM}" + vm2="tck-testvm${RANDOM}" + + createTestFilters "${flags}" + if [ $? -ne 0 ]; then + exit 1; + fi + + createVM "${vm1}" "tck-testcase" "10.2.2.2" "52:54:0:0:0:1" "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm1}. Exiting." + exit 1 + fi + + createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1" "52:54:0:9f:33:da" \ + "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm2}. Exiting." + destroyVM "${vm1}" "${flags}" + exit 1 + fi + + runTests "${vm1}" "${vm2}" "${xmldir}" "${fwalldir}" "${flags}" + + destroyVM "${vm1}" "${flags}" + destroyVM "${vm2}" "${flags}" + deleteTestFilter "${flags}" + + [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid} + rm -rf pid-file 2>/dev/null + + return 0 +} + +main "$@" Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/100-apply-verify.t @@ -0,0 +1,10 @@ +#!/bin/bash + +pwd=$(dirname $0) + +pushd ${PWD} > /dev/null + +cd ${pwd} +bash ./nwfilter2vmtest.sh --tap-test --noattach + +popd > /dev/null \ No newline at end of file Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml @@ -0,0 +1,33 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat @@ -0,0 +1,73 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j I-vnet0-ipv4 +-p ARP -j I-vnet0-arp +-p 0x8035 -j I-vnet0-rarp +-p 0x835 -j ACCEPT +-j DROP +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j O-vnet0-ipv4 +-p ARP -j O-vnet0-arp +-p 0x8035 -j O-vnet0-rarp +-j DROP +#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p IPv4 --ip-src ! 10.1.1.1 -j DROP +#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-j ACCEPT +#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-src ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml @@ -0,0 +1,12 @@ +<filter name='tck-testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml @@ -0,0 +1,56 @@ +<filter name='tck-testcase'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='tck-testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='tck-testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='tck-testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <igmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml @@ -0,0 +1,34 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='out'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.128.0' + dstipaddr='10.1.2.3' dstipmask='255.255.255.0' + protocol='17' dscp='63' + /> + </rule> + + <rule action='accept' direction='in'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.254' + dstipaddr='10.1.2.3' dstipmask='255.255.255.128' + protocol='255' dscp='64' + /> + </rule> + + <rule action='accept' direction='inout'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.127' + dstipaddr='10.1.2.3' dstipmask='255.255.255.254' + protocol='256' dscp='64' + /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml @@ -0,0 +1,43 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='18' + /> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml @@ -0,0 +1,23 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='1536'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='15'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='65535'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml @@ -0,0 +1,33 @@ +<filter name='tck-testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='rarp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml @@ -0,0 +1,4 @@ +<filter name='tck-testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in' statematch='false'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in' statematch='0'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml @@ -0,0 +1,22 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml @@ -0,0 +1,18 @@ +<filter name='tck-testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,32 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FORWARD --line-number | grep libvirt +1 libvirt-in all anywhere anywhere +2 libvirt-out all anywhere anywhere +3 libvirt-in-post all anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,30 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD --line-number | grep libvirt +1 libvirt-in all -- anywhere anywhere +2 libvirt-out all -- anywhere anywhere +3 libvirt-in-post all -- anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall @@ -0,0 +1,24 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +RETURN all -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall @@ -0,0 +1,68 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p 0x1234 -j ACCEPT +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 +#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,26 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,13 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v "^Bridge" | grep -v "^$" +-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0

2 1

[libvirt] [PATCH v2 0/2] Fix problems on using lxc with cgroup ns subsystem
by Ryota Ozaki 24 Jun '10

24 Jun '10

The patch set fixes two problems of lxc that happen when ns subsystem is enabled with memory subsystem at the same time. The fist problem is that cgroup subdirectories that are automatically created by ns subsystem remain after domain shutdown. The second problem is that memory usage is not properly accounted. v2 fixes a bunch of defects pointed out by Eric Blake. Changes from v1: - correct readdir error handling - avoid stack-allocating PATH_MAX, use virAsprintf() instead - add missing closedir() - ensure _() in the string of VIR_ERROR - change the flag of virCgroupMakeGroup from int to bool - fix typo in commit log - change some 'child' to 'descendant' in commit log to make representation proper Ryota Ozaki (2): cgroup: Change virCgroupRemove to remove all descendant groups at first cgroup: Enable memory.use_hierarchy of cgroup for domain src/util/cgroup.c | 122 +++++++++++++++++++++++++++++++++++++++++++++++++---- 1 files changed, 114 insertions(+), 8 deletions(-)

2 5

[libvirt] [PATCH 0/2] virsh: document and improve cdrom-change semantics
by Eric Blake 23 Jun '10

23 Jun '10

http://bugzilla.redhat.com/601143 complained that there was no documentation of the fact that 'attach-disk' on a floppy or cdrom is really way to change the contents of the media in that disk, rather than a request to add a second virtual device. Back in March, we changed things to add a new command to make better sense at the API level, but didn't expose it well in virsh. Eric Blake (2): virsh: document attach-disk better virsh: introduce change-disk command tools/virsh.c | 122 +++++++++++++++++++++++++++++++++++++++++++++++++++++- tools/virsh.pod | 24 ++++++++++- 2 files changed, 141 insertions(+), 5 deletions(-)

2 7

[libvirt] network: allow tftp port if tftp is defined
by apevec＠gmail.com 23 Jun '10

23 Jun '10

From: Alan Pevec <apevec(a)redhat.com> Libvirt managed virtual network can provide TFTP service, in which case port 69/udp needs to be opened. 1/2 bridge_driver.c: fix file description 2/2 network: allow tftp port if tftp is defined

3 5

[libvirt] [PATCH] Add missing parameter in python Disk IO error callback
by Daniel P. Berrange 23 Jun '10

23 Jun '10

The IO error callback was forgetting to pass the action parameter, causing a stack trace when IO errors arrive * python/libvirt-override-virConnect.py: Add missing action parameter in IO error callback --- python/libvirt-override-virConnect.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/python/libvirt-override-virConnect.py b/python/libvirt-override-virConnect.py index df39b79..1a1cdd0 100644 --- a/python/libvirt-override-virConnect.py +++ b/python/libvirt-override-virConnect.py @@ -94,7 +94,7 @@ cb = cbData["cb"] opaque = cbData["opaque"] - cb(self, virDomain(self, _obj=dom), srcPath, devAlias, opaque) + cb(self, virDomain(self, _obj=dom), srcPath, devAlias, action, opaque) return 0 except AttributeError: pass -- 1.6.6.1

2 1

[libvirt] [PATCH 0/2][RESEND] Fix problems on using lxc with cgroup ns subsystem
by Ryota Ozaki 23 Jun '10

23 Jun '10

The patch set fixes two problems of lxc that happen when ns subsystem is enabled with memory subsystem at the same time. The fist problem is that cgroup subdirectories that are automatically created by ns subsystem remain after domain shutdown. The second problem is that memory usage is not properly accounted. Ryota Ozaki (2): cgroup: Change virCgroupRemove to remove all child groups at first cgroup: Enable memory.use_hierarchy of cgroup for domain

2 8

[libvirt] [PATCH] Improve some error messages about unsupported APIs/URIs
by Daniel P. Berrange 23 Jun '10

23 Jun '10

If there is no driver for a URI we report "no hypervisor driver available" This is bad because not all virt drivers are hypervisors (ie container based virt). If there is no driver support for an API we report "this function is not supported by the hypervisor" This is bad for the same reason, and additionally because it is also used for the network, interface & storage drivers. * src/util/virterror.c: Improve error messages --- src/util/virterror.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/util/virterror.c b/src/util/virterror.c index 96dd1e7..9f632ec 100644 --- a/src/util/virterror.c +++ b/src/util/virterror.c @@ -760,15 +760,15 @@ virErrorMsg(virErrorNumber error, const char *info) break; case VIR_ERR_NO_SUPPORT: if (info == NULL) - errmsg = _("this function is not supported by the hypervisor"); + errmsg = _("this function is not supported by the connection driver"); else - errmsg = _("this function is not supported by the hypervisor: %s"); + errmsg = _("this function is not supported by the connection driver: %s"); break; case VIR_ERR_NO_CONNECT: if (info == NULL) - errmsg = _("no hypervisor driver available"); + errmsg = _("no connection driver available"); else - errmsg = _("no hypervisor driver available for %s"); + errmsg = _("no connection driver available for %s"); break; case VIR_ERR_INVALID_CONN: if (info == NULL) -- 1.6.6.1

5 8

[libvirt] [PATCH] Fix several undefined symbol errors in loadable driver modules
by Matthias Bolte 23 Jun '10

23 Jun '10

Link all loadable driver modules to libvirt.la and libgnu.la. Add several missing symbols to libvirt_private.syms in order to have them properly exported. --- src/Makefile.am | 25 ++++++++++++++++++++++--- src/libvirt_private.syms | 25 +++++++++++++++++++++++++ tests/Makefile.am | 6 +++++- 3 files changed, 52 insertions(+), 4 deletions(-) diff --git a/src/Makefile.am b/src/Makefile.am index ece18a6..588adf5 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -456,6 +456,7 @@ libvirt_driver_test_la_CFLAGS = \ -I@top_srcdir@/src/conf if WITH_DRIVER_MODULES libvirt_driver_test_la_LDFLAGS = -module -avoid-version +libvirt_driver_test_la_LIBADD = libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_test_la_SOURCES = $(TEST_DRIVER_SOURCES) endif @@ -475,6 +476,7 @@ libvirt_driver_remote_la_LDFLAGS = libvirt_driver_remote_la_LIBADD = $(GNUTLS_LIBS) $(SASL_LIBS) if WITH_DRIVER_MODULES libvirt_driver_remote_la_LDFLAGS += -module -avoid-version +libvirt_driver_remote_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_remote_la_SOURCES = $(REMOTE_DRIVER_SOURCES) @@ -525,6 +527,7 @@ libvirt_driver_xen_la_LDFLAGS = libvirt_driver_xen_la_LIBADD = $(XEN_LIBS) if WITH_DRIVER_MODULES libvirt_driver_xen_la_LDFLAGS += -module -avoid-version +libvirt_driver_xen_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_xen_la_SOURCES = $(XEN_DRIVER_SOURCES) endif @@ -539,6 +542,10 @@ endif libvirt_driver_phyp_la_LIBADD = $(LIBSSH2_LIBS) libvirt_driver_phyp_la_CFLAGS = $(LIBSSH2_CFLAGS) \ -I@top_srcdir@/src/conf +if WITH_DRIVER_MODULES +libvirt_driver_phyp_la_LDFLAGS = -module -avoid-version +libvirt_driver_phyp_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la +endif libvirt_driver_phyp_la_SOURCES = $(PHYP_DRIVER_SOURCES) endif @@ -553,6 +560,7 @@ libvirt_driver_openvz_la_CFLAGS = \ -I@top_srcdir@/src/conf if WITH_DRIVER_MODULES libvirt_driver_openvz_la_LDFLAGS = -module -avoid-version +libvirt_driver_openvz_la_LIBADD = libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_openvz_la_SOURCES = $(OPENVZ_DRIVER_SOURCES) endif @@ -566,10 +574,11 @@ libvirt_la_BUILT_LIBADD += libvirt_driver_vbox.la endif libvirt_driver_vbox_la_CFLAGS = \ -I@top_srcdir@/src/conf +libvirt_driver_vbox_la_LIBADD = $(DLOPEN_LIBS) if WITH_DRIVER_MODULES libvirt_driver_vbox_la_LDFLAGS = -module -avoid-version +libvirt_driver_vbox_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif -libvirt_driver_vbox_la_LIBADD = $(DLOPEN_LIBS) libvirt_driver_vbox_la_SOURCES = $(VBOX_DRIVER_SOURCES) endif @@ -586,6 +595,7 @@ libvirt_driver_xenapi_la_LDFLAGS = libvirt_driver_xenapi_la_LIBADD = $(LIBXENSERVER_LIBS) $(LIBCURL_LIBS) if WITH_DRIVER_MODULES libvirt_driver_xenapi_la_LDFLAGS += -module -avoid-version +libvirt_driver_xenapi_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_xenapi_la_SOURCES = $(XENAPI_DRIVER_SOURCES) endif @@ -604,6 +614,7 @@ libvirt_driver_qemu_la_LDFLAGS = libvirt_driver_qemu_la_LIBADD = $(NUMACTL_LIBS) if WITH_DRIVER_MODULES libvirt_driver_qemu_la_LDFLAGS += -module -avoid-version +libvirt_driver_qemu_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_qemu_la_SOURCES = $(QEMU_DRIVER_SOURCES) @@ -629,6 +640,7 @@ libvirt_driver_lxc_la_CFLAGS = \ -I@top_srcdir@/src/conf if WITH_DRIVER_MODULES libvirt_driver_lxc_la_LDFLAGS = -module -avoid-version +libvirt_driver_lxc_la_LIBADD = libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_lxc_la_SOURCES = $(LXC_DRIVER_SOURCES) @@ -654,6 +666,7 @@ libvirt_driver_uml_la_LDFLAGS = libvirt_driver_uml_la_LIBADD = $(NUMACTL_LIBS) if WITH_DRIVER_MODULES libvirt_driver_uml_la_LDFLAGS += -module -avoid-version +libvirt_driver_uml_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_uml_la_SOURCES = $(UML_DRIVER_SOURCES) endif @@ -673,6 +686,7 @@ libvirt_driver_one_la_LIBADD = $(XMLRPC_LIBS) #libvirt_driver_one_la_CFLAGS = "-DWITH_ONE" if WITH_DRIVER_MODULES libvirt_driver_one_la_LDFLAGS += -module -avoid-version +libvirt_driver_one_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_one_la_SOURCES = $(ONE_DRIVER_SOURCES) endif @@ -696,6 +710,7 @@ libvirt_driver_esx_la_LDFLAGS = libvirt_driver_esx_la_LIBADD = $(LIBCURL_LIBS) if WITH_DRIVER_MODULES libvirt_driver_esx_la_LDFLAGS += -module -avoid-version +libvirt_driver_esx_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_esx_la_SOURCES = $(ESX_DRIVER_SOURCES) libvirt_driver_esx_la_DEPENDENCIES = $(ESX_DRIVER_GENERATED) @@ -713,6 +728,7 @@ libvirt_driver_network_la_CFLAGS = \ -I@top_srcdir@/src/conf if WITH_DRIVER_MODULES libvirt_driver_network_la_LDFLAGS = -module -avoid-version +libvirt_driver_network_la_LIBADD = libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_network_la_SOURCES = $(NETWORK_DRIVER_SOURCES) endif @@ -734,6 +750,7 @@ libvirt_driver_interface_la_LDFLAGS = libvirt_driver_interface_la_LIBADD = $(NETCF_LIBS) if WITH_DRIVER_MODULES libvirt_driver_interface_la_LDFLAGS += -module -avoid-version +libvirt_driver_interface_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_interface_la_SOURCES = $(INTERFACE_DRIVER_SOURCES) endif @@ -750,7 +767,7 @@ libvirt_driver_secret_la_CFLAGS = \ -I@top_srcdir@/src/conf if WITH_DRIVER_MODULES libvirt_driver_secret_la_LDFLAGS = -module -avoid-version -libvirt_driver_secret_la_LIBADD = ../gnulib/lib/libgnu.la +libvirt_driver_secret_la_LIBADD = libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_secret_la_SOURCES = $(SECRET_DRIVER_SOURCES) endif @@ -771,6 +788,7 @@ noinst_LTLIBRARIES += libvirt_driver_storage.la endif if WITH_DRIVER_MODULES libvirt_driver_storage_la_LDFLAGS += -module -avoid-version +libvirt_driver_storage_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_storage_la_SOURCES += $(STORAGE_DRIVER_SOURCES) libvirt_driver_storage_la_SOURCES += $(STORAGE_DRIVER_FS_SOURCES) @@ -826,6 +844,7 @@ endif if WITH_DRIVER_MODULES libvirt_driver_nodedev_la_LDFLAGS += -module -avoid-version +libvirt_driver_nodedev_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif endif @@ -843,7 +862,7 @@ libvirt_driver_nwfilter_la_LDFLAGS = libvirt_driver_nwfilter_la_LIBADD = $(LIBPCAP_LIBS) if WITH_DRIVER_MODULES libvirt_driver_nwfilter_la_LDFLAGS += -module -avoid-version -libvirt_driver_nwfilter_la_LIBADD += ../gnulib/lib/libgnu.la +libvirt_driver_nwfilter_la_LIBADD += libvirt.la ../gnulib/lib/libgnu.la endif libvirt_driver_nwfilter_la_SOURCES = $(NWFILTER_DRIVER_SOURCES) endif diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms index 4e61e55..b6d36a2 100644 --- a/src/libvirt_private.syms +++ b/src/libvirt_private.syms @@ -4,6 +4,11 @@ # +# authhelper.h +virRequestUsername; +virRequestPassword; + + # bitmap.h virBitmapAlloc; virBitmapFree; @@ -17,6 +22,8 @@ virBufferVSprintf; virBufferEscapeString; virBufferAdd; virBufferAddChar; +virBufferStrcat; +virBufferUse; virBufferContentAndReset; virBufferError; virBufferURIEncodeString; @@ -139,7 +146,9 @@ virDomainDeleteConfig; virDomainDeviceDefFree; virDomainDeviceDefParse; virDomainDeviceTypeToString; +virDomainDiskTypeToString; virDomainDiskBusTypeToString; +virDomainDiskCacheTypeToString; virDomainDiskDefFree; virDomainDiskDeviceTypeToString; virDomainDiskInsert; @@ -222,6 +231,7 @@ virDomainSnapshotHasChildren; virDomainSnapshotObjUnref; virDomainSnapshotDefParseString; virDomainSnapshotDefFormat; +virDomainSnapshotDefFree; virDomainSnapshotAssignDef; virDomainObjAssignDef; @@ -494,6 +504,8 @@ virNodeDeviceObjListFree; virNodeDeviceDefFree; virNodeDevCapsDefFree; virNodeDeviceDefFormat; +virNodeDeviceDefParseFile; +virNodeDeviceDefParseNode; virNodeDeviceDefParseString; virNodeDeviceObjLock; virNodeDeviceObjUnlock; @@ -633,6 +645,7 @@ virStorageFileIsSharedFS; # threads.h virMutexInit; +virMutexInitRecursive; virMutexDestroy; virMutexLock; virMutexUnlock; @@ -645,13 +658,20 @@ virCondSignal; virCondBroadcast; # util.h +virBuildPathInternal; +virDirCreate; +virFileOperation; virFileReadAll; virFileWriteStr; +virFileStripSuffix; +virFork; virStrToLong_i; virStrToLong_ll; virStrToLong_ull; virStrToLong_ui; virStrToDouble; +virStrcpy; +virStrncpy; virFileLinkPointsTo; virFileResolveLink; saferead; @@ -687,6 +707,7 @@ virParseVersionString; virPipeReadUntilEOF; virAsprintf; virRun; +virRunWithHook; virSkipSpaces; virKillProcess; virGetUserDirectory; @@ -697,6 +718,10 @@ virFileFindMountPoint; virFileWaitForDevices; virFileMatchesNameSuffix; virArgvToString; +virRandom; +virRandomInitialize; +virIndexToDiskName; + # interface.h ifaceCtrl; diff --git a/tests/Makefile.am b/tests/Makefile.am index a3661f6..a6a8fea 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -39,6 +39,10 @@ LDADDS = \ $(LIBSOCKET) \ $(COVERAGE_LDFLAGS) +if WITH_DRIVER_MODULES +LDADDS += ../src/libvirt.la +endif + EXTRA_DIST = \ oomtrace.pl \ test-lib.sh \ @@ -329,7 +333,7 @@ nodeinfotest_LDADD = $(LDADDS) statstest_SOURCES = \ statstest.c testutils.h testutils.c -statstest_LDADD = $(LDADDS) +statstest_LDADD = ../src/libvirt_driver_xen.la $(LDADDS) if WITH_SECDRIVER_SELINUX seclabeltest_SOURCES = \ -- 1.7.0.4

3 5

[libvirt] Comments on the libvirt java changes
by Bryan Kearney 23 Jun '10

23 Jun '10

Luis: I have looked over the patches which you have posted up at http://github.com/LuisCM/libvirt-java-0.4.6/commits/master. First and formost, thank you for your interest in libvirt and hte java bindings. A couple of minor comments. It would be easier for me if the repo did not have a version number, and if it were just a clone of the main repo with changes on top of it. Second, please try and remove trailing white spaces from flies you check in. Most IDE's allow this by default. Finally, please try and seperate out style/formatting chnages from functional ones. It makes it easier to know what to bring in. Now.. Commit fc394b15e6e1f0f5135bdfd3335b6cc26b635ae7 =============================================== This was a big change, but the pattern I see is: 1) Make everything final 2) ( xxxx ) instead of (xxx) 3) Comment clean up. 4) Explict use of this. Is that correct? Are there other items in there? If so, on (1) what is the reason for maknig everything final? Is this a performance choice? I personally tend to make nothing private since it limits what others can do with the code. Final seems to add in similar contraints. Commit 44055c0ab13c56190e9cc00f71b71e23b2fc7c9b =============================================== This looks like adding some better toStrings. Is that correct? -- bk

1 0

[libvirt] how to setup libvirt development environment...
by Avdhoot Joshi 22 Jun '10

22 Jun '10

Hi, Installed RHEL 5.5 on AMD Opteron. [root@wlng-ppcore-nd3 ~]# uname -a Linux wlng-ppcore-nd3 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux [root@wlng-ppcore-nd3 ~]# virsh version Compiled against library: libvir 0.6.3 Using library: libvir 0.6.3 Using API: QEMU 0.6.3 Running hypervisor: QEMU 0.9.1 This is the default version of virsh using libvirt 0.6.3. Downloaded libvirt 0.8.1, configured it as follows: $ configure $ make $ make install What should be done so that virsh uses the latest 0.8.1 libvirtd binary, how to completely stop 0.6.3? I want to execute a program using virDomainMemoryStats which is not available in 0.6.3 libvirt. Thanks, Avdhoot

2 1

[libvirt] [PATCH] Don't leak open fd to virsh in libvirt-guests init script
by Jiri Denemark 22 Jun '10

22 Jun '10

Running virsh while having /var/lib/libvirt/libvirt-guests file open makes SELinux emit messages about preventing virsh from reading that file. Since virsh doesn't really want to read anything, it's better to run it with /dev/null on stdin to prevent those messages. --- daemon/libvirt-guests.init.in | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/daemon/libvirt-guests.init.in b/daemon/libvirt-guests.init.in index 17e6824..f99c070 100644 --- a/daemon/libvirt-guests.init.in +++ b/daemon/libvirt-guests.init.in @@ -61,7 +61,7 @@ run_virsh() { conn="-c $uri" fi - virsh $conn "$@" + virsh $conn "$@" </dev/null } run_virsh_c() { -- 1.7.1

2 2

[libvirt] [PATCH v3] nwfilter: fix loadable module support
by Stefan Berger 22 Jun '10

22 Jun '10

Following Daniel Berrange's multiple helpful suggestions for improving this patch and introducing another driver interface, I now wrote the below patch where the nwfilter driver registers the functions to instantiate and teardown the nwfilters with a function in conf/domain_nwfilter.c called virDomainConfNWFilterRegister. Previous helper functions that were called from qemu_driver.c and qemu_conf.c were move into conf/domain_nwfilter.h with slight renaming done for consistency. Those functions now call the function expored by domain_nwfilter.c, which in turn call the functions of the new driver interface, if available. V3: no more inline functions Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- src/Makefile.am | 3 + src/conf/domain_nwfilter.c | 61 +++++++++++++++++++++++++++++++++ src/conf/domain_nwfilter.h | 43 +++++++++++++++++++++++ src/libvirt_private.syms | 5 ++ src/nwfilter/nwfilter_driver.c | 23 ++++++++++++ src/nwfilter/nwfilter_gentech_driver.h | 17 --------- src/qemu/qemu_conf.c | 17 ++++----- src/qemu/qemu_driver.c | 10 ++--- 8 files changed, 148 insertions(+), 31 deletions(-) Index: libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_gentech_driver.h +++ libvirt-acl/src/nwfilter/nwfilter_gentech_driver.h @@ -67,21 +67,4 @@ void virNWFilterDomainFWUpdateCB(void *p const char *name ATTRIBUTE_UNUSED, void *data); - -/* tear down an interface's filter before tearing down the interface */ -static inline void -virNWFilterTearNWFilter(virDomainNetDefPtr net) { - if ((net->filter) && (net->ifname)) - virNWFilterTeardownFilter(net); -} - - -static inline void -virNWFilterTearVMNWFilters(virDomainObjPtr vm) { - int i; - - for (i = 0; i < vm->def->nnets; i++) - virNWFilterTearNWFilter(vm->def->nets[i]); -} - #endif Index: libvirt-acl/src/qemu/qemu_conf.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_conf.c +++ libvirt-acl/src/qemu/qemu_conf.c @@ -54,7 +54,7 @@ #include "network.h" #include "macvtap.h" #include "cpu/cpu.h" -#include "nwfilter/nwfilter_gentech_driver.h" +#include "domain_nwfilter.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -1514,9 +1514,10 @@ int qemudExtractVersion(struct qemud_dri /** * qemudPhysIfaceConnect: * @conn: pointer to virConnect object + * @driver: pointer to the qemud_driver * @net: pointer to he VM's interface description with direct device type - * @linkdev: The name of the physical interface to link the macvtap to - * @brmode: The mode to put the macvtap device into + * @qemuCmdFlags: flags for qemu + * @vmuuid: The UUID of the VM (needed by 802.1Qbh) * * Returns a filedescriptor on success or -1 in case of error. */ @@ -1555,7 +1556,7 @@ qemudPhysIfaceConnect(virConnectPtr conn if (rc >= 0) { if ((net->filter) && (net->ifname)) { - err = virNWFilterInstantiateFilter(conn, net); + err = virDomainConfNWFilterInstantiate(conn, net); if (err) { close(rc); rc = -1; @@ -1688,7 +1689,7 @@ qemudNetworkIfaceConnect(virConnectPtr c if (tapfd >= 0) { if ((net->filter) && (net->ifname)) { - err = virNWFilterInstantiateFilter(conn, net); + err = virDomainConfNWFilterInstantiate(conn, net); if (err) { close(tapfd); tapfd = -1; @@ -4207,7 +4208,7 @@ int qemudBuildCommandLine(virConnectPtr goto error; if (VIR_REALLOC_N(*vmfds, (*nvmfds)+1) < 0) { - virNWFilterTearNWFilter(net); + virDomainConfNWFilterTeardown(net); close(tapfd); goto no_memory; } @@ -4226,7 +4227,7 @@ int qemudBuildCommandLine(virConnectPtr goto error; if (VIR_REALLOC_N(*vmfds, (*nvmfds)+1) < 0) { - virNWFilterTearNWFilter(net); + virDomainConfNWFilterTeardown(net); close(tapfd); goto no_memory; } @@ -4766,7 +4767,7 @@ int qemudBuildCommandLine(virConnectPtr virReportOOMError(); error: for (i = 0; i <= last_good_net; i++) - virNWFilterTearNWFilter(def->nets[i]); + virDomainConfNWFilterTeardown(def->nets[i]); if (vmfds && *vmfds) { for (i = 0; i < *nvmfds; i++) Index: libvirt-acl/src/qemu/qemu_driver.c =================================================================== --- libvirt-acl.orig/src/qemu/qemu_driver.c +++ libvirt-acl/src/qemu/qemu_driver.c @@ -81,7 +81,7 @@ #include "xml.h" #include "cpu/cpu.h" #include "macvtap.h" -#include "nwfilter/nwfilter_gentech_driver.h" +#include "domain_nwfilter.h" #include "hooks.h" #include "storage_file.h" @@ -3576,7 +3576,7 @@ static int qemudStartVMDaemon(virConnect VIR_FREE(progenv); if (ret == -1) /* The VM failed to start; tear filters before taps */ - virNWFilterTearVMNWFilters(vm); + virDomainConfVMNWFilterTeardown(vm); if (vmfds) { for (i = 0 ; i < nvmfds ; i++) { @@ -3668,7 +3668,7 @@ static void qemudShutdownVMDaemon(struct * reporting so we don't squash a legit error. */ orig_err = virSaveLastError(); - virNWFilterTearVMNWFilters(vm); + virDomainConfVMNWFilterTeardown(vm); if (driver->macFilter) { def = vm->def; @@ -7640,7 +7640,7 @@ cleanup: VIR_WARN0("Unable to release PCI address on NIC"); if (ret != 0) - virNWFilterTearNWFilter(net); + virDomainConfNWFilterTeardown(net); VIR_FREE(nicstr); VIR_FREE(netstr); @@ -8609,7 +8609,7 @@ qemudDomainDetachNetDevice(struct qemud_ } qemuDomainObjExitMonitorWithDriver(driver, vm); - virNWFilterTearNWFilter(detach); + virDomainConfNWFilterTeardown(detach); #if WITH_MACVTAP if (detach->type == VIR_DOMAIN_NET_TYPE_DIRECT) { Index: libvirt-acl/src/Makefile.am =================================================================== --- libvirt-acl.orig/src/Makefile.am +++ libvirt-acl/src/Makefile.am @@ -97,7 +97,8 @@ DRIVER_SOURCES = \ # Domain driver generic impl APIs DOMAIN_CONF_SOURCES = \ conf/capabilities.c conf/capabilities.h \ - conf/domain_conf.c conf/domain_conf.h + conf/domain_conf.c conf/domain_conf.h \ + conf/domain_nwfilter.c conf/domain_nwfilter.h DOMAIN_EVENT_SOURCES = \ conf/domain_event.c conf/domain_event.h Index: libvirt-acl/src/conf/domain_nwfilter.h =================================================================== --- /dev/null +++ libvirt-acl/src/conf/domain_nwfilter.h @@ -0,0 +1,43 @@ +/* + * domain_nwfilter.h: + * + * Copyright (C) 2010 IBM Corporation + * Copyright (C) 2010 Red Hat, Inc. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ +#ifndef DOMAIN_NWFILTER_H +# define DOMAIN_NWFILTER_H + +typedef int (*virDomainConfInstantiateNWFilter)(virConnectPtr conn, + virDomainNetDefPtr net); +typedef void (*virDomainConfTeardownNWFilter)(virDomainNetDefPtr net); + +typedef struct { + virDomainConfInstantiateNWFilter instantiateFilter; + virDomainConfTeardownNWFilter teardownFilter; +} virDomainConfNWFilterDriver; +typedef virDomainConfNWFilterDriver *virDomainConfNWFilterDriverPtr; + +void virDomainConfNWFilterRegister(virDomainConfNWFilterDriverPtr driver); + +int virDomainConfNWFilterInstantiate(virConnectPtr conn, + virDomainNetDefPtr net); +void virDomainConfNWFilterTeardown(virDomainNetDefPtr net); +void virDomainConfVMNWFilterTeardown(virDomainObjPtr vm); + +#endif /* DOMAIN_NWFILTER_H */ Index: libvirt-acl/src/conf/domain_nwfilter.c =================================================================== --- /dev/null +++ libvirt-acl/src/conf/domain_nwfilter.c @@ -0,0 +1,61 @@ +/* + * domain_nwfilter.c: + * + * Copyright (C) 2010 IBM Corporation + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * Author: Stefan Berger <stefanb(a)us.ibm.com> + */ + +#include <config.h> + +#include "internal.h" + +#include "datatypes.h" +#include "domain_conf.h" +#include "domain_nwfilter.h" + +static virDomainConfNWFilterDriverPtr nwfilterDriver; + +void +virDomainConfNWFilterRegister(virDomainConfNWFilterDriverPtr driver) { + nwfilterDriver = driver; +} + +int +virDomainConfNWFilterInstantiate(virConnectPtr conn, + virDomainNetDefPtr net) { + if (nwfilterDriver != NULL) + return nwfilterDriver->instantiateFilter(conn, net); + /* driver module not available -- don't indicate failure */ + return 0; +} + +void +virDomainConfNWFilterTeardown(virDomainNetDefPtr net) { + if (nwfilterDriver != NULL) + nwfilterDriver->teardownFilter(net); +} + +void +virDomainConfVMNWFilterTeardown(virDomainObjPtr vm) { + int i; + + if (nwfilterDriver != NULL) { + for (i = 0; i < vm->def->nnets; i++) + virDomainConfNWFilterTeardown(vm->def->nets[i]); + } +} Index: libvirt-acl/src/libvirt_private.syms =================================================================== --- libvirt-acl.orig/src/libvirt_private.syms +++ libvirt-acl/src/libvirt_private.syms @@ -264,6 +264,11 @@ virDomainEventDispatchDefaultFunc; virDomainEventDispatch; virDomainEventQueueDispatch; +# domain_nwfilter.h +virDomainConfNWFilterRegister; +virDomainConfNWFilterInstantiate; +virDomainConfNWFilterTeardown; +virDomainConfVMNWFilterTeardown; # ebtables.h ebtablesAddForwardAllowIn; Index: libvirt-acl/src/nwfilter/nwfilter_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_driver.c @@ -33,6 +33,7 @@ #include "datatypes.h" #include "memory.h" #include "domain_conf.h" +#include "domain_nwfilter.h" #include "nwfilter_driver.h" #include "nwfilter_gentech_driver.h" @@ -410,6 +411,20 @@ cleanup: } +static int +nwfilterInstantiateFilter(virConnectPtr conn, + virDomainNetDefPtr net) { + return virNWFilterInstantiateFilter(conn, net); +} + + +static void +nwfilterTeardownFilter(virDomainNetDefPtr net) { + if ((net->ifname) && (net->filter)) + virNWFilterTeardownFilter(net); +} + + static virNWFilterDriver nwfilterDriver = { .name = "nwfilter", .open = nwfilterOpen, @@ -432,8 +447,16 @@ static virStateDriver stateDriver = { .active = nwfilterDriverActive, }; + +static virDomainConfNWFilterDriver domainNWFilterDriver = { + .instantiateFilter = nwfilterInstantiateFilter, + .teardownFilter = nwfilterTeardownFilter, +}; + + int nwfilterRegister(void) { virRegisterNWFilterDriver(&nwfilterDriver); virRegisterStateDriver(&stateDriver); + virDomainConfNWFilterRegister(&domainNWFilterDriver); return 0; }

3 8

[libvirt] New release 0.4.6
by Luis Carlos Moreira da Costa 21 Jun '10

21 Jun '10

/Dear List, / /Thu Jun 17 2010 Luis Carlos Moreira da Costa <tcljava(a)gmail.com>/ / * Refactored the all code of the libvirt. * Modify the method toString() to String.format in all classes contains. * Add final in classes, methods and attributes. * Alter of test JUnit. * Add .project and .classpath in Eclipse Galileo IDE./ */ Atention: And eventually transforming it to an OSGi version!/* /Luís Carlos Moreira da Costa Eclipse RAP, RCP, eRCP, GMF, OSGI, Spring-DM and Pentaho Developer Regional Communities/Brazil http://wiki.eclipse.org/Regional_Communities/Brazil/

2 1

[libvirt] [PATCH 0/4] Change per-connection hashes to be indexed by UUIDs
by Jiri Denemark 21 Jun '10

21 Jun '10

While working at the area, I also made few other cleanups... Jiri Denemark (4): Index hashes by UUID instead of name Remove unnecessary check for non-NULL uuid Do not free static buffer with UUID Misc cleanups src/datatypes.c | 83 ++++++++++++++++++++++++++++-------------------------- 1 files changed, 43 insertions(+), 40 deletions(-)

3 11

[libvirt] [PATCH] Allow one-or-more <boot dev="..."/> entries
by Philipp Hahn 21 Jun '10

21 Jun '10

According to docs/formatdomain.html.in, "The boot element can be repeated multiple times to setup a priority list of boot devices to try in turn." The Relax-NG schema required / allowed exactly one entry. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- docs/schemas/domain.rng | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-)

3 2

[libvirt] [PATCH] virsh: remove a doubled up include for errno.h
by Justin Clift 21 Jun '10

21 Jun '10

--- Noticed a doubled up include for errno.h. Pretty sure it's not needed. tools/virsh.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index 3057115..0bf7443 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -28,7 +28,6 @@ #include <time.h> #include <limits.h> #include <assert.h> -#include <errno.h> #include <sys/stat.h> #include <inttypes.h> #include <signal.h> -- 1.7.0.1

3 2

[libvirt] Suggest to enter freeze for 0.8.2 this week-end
by Daniel Veillard 19 Jun '10

19 Jun '10

As previously suggested, I think it's time to get a new release going, and if we want to have it by end of the month it would be good to enter feature freeze over the week-end. I am seeing some un-ack'ed patches on list though so maybe we need to be a bit flexible, but the general principle is that we would ACK and push only bug fixes and not new feature starting from Monday. This doesn't affect documentation :-) Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel(a)veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/

3 3

[libvirt] [PATCH] [TCK] nwfilter: apply filters and check firewall rules
by Stefan Berger 18 Jun '10

18 Jun '10

Hi! This is a patch I previously posted for use in the tests/ directory of libvirt. Now I ported it to the TCK project and extended the script with output in the Test Anything Protocol (TAP) format. It now allows multiple output formats chosen via command line parameter supporting TAP (--tap-test), the output format used in the libvirt tests directory (the '.' and '!') (--libvirt-test) and one where all tests are displayed (--verbose). The program basically creates a filter called testcase and two VMs where one of them references the testcase filter and the other a filter called nwfiltertestfilter. The testcase filter is then subsequently modified and the effect on iptables,ebtables and ip6tables verified against expected output for both VMs. The VMs are torn down at the end and the test filters removed. For all the tests to run successfully, the last outstanding patch that would need to go in is this one here: https://www.redhat.com/archives/libvir-list/2010-June/msg00326.html Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- scripts/nwfilter/100-apply-verify.t | 10 scripts/nwfilter/nwfilter2vmtest.sh | 581 ++++++++++ scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 32 scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall | 30 scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall | 24 scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 68 + scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall | 23 scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 19 scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall | 13 scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall | 12 scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall | 9 scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 73 + scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 26 scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 28 scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall | 26 scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/all-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml | 12 scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml | 56 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml | 15 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml | 10 scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml | 34 scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14 scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml | 43 scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml | 23 scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml | 33 scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml | 18 scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml | 4 scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml | 22 scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml | 19 scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml | 18 61 files changed, 2005 insertions(+) Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh @@ -0,0 +1,581 @@ +#!/bin/bash + +ORIG_IFNAME="vnet0" +ATTACH_IFNAME="attach0" +TESTFILTERNAME="nwfiltertestfilter" +TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat" + +LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd` +if [ "x${LIBVIRTD}x" == "xx" ]; then + LIBVIRTD=`type -P libvirtd` +fi + +VIRSH=`type -P ${PWD}/../tools/virsh` +if [ "x${VIRSH}x" == "xx" ]; then + VIRSH=`type -P virsh` +fi + +LD_LIBRARY_PATH="${PWD}../src/.libs/" + +# Maybe no libvirtd was built +[ -z ${LIBVIRTD} ] && exit 0; + +FLAG_WAIT="$((1<<0))" +FLAG_ATTACH="$((1<<1))" +FLAG_VERBOSE="$((1<<2))" +FLAG_LIBVIRT_TEST="$((1<<3))" +FLAG_TAP_TEST="$((1<<4))" + +failctr=0 +passctr=0 +attachfailctr=0 +attachctr=0 + +TAP_FAIL_LIST="" +TAP_FAIL_CTR=0 +TAP_TOT_CTR=0 + +function usage() { + local cmd="$0" +cat <<EOF +Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose] + [--libvirt-test] [--tap-test] + +Options: + --help,-h,-? : Display this help screen. + --noattach : Skip tests that attach and detach a network interface + --wait : Wait for the user to press the enter key once an error + was detected + --verbose : Verbose output + --libvirt-test : Use the libvirt test output format + --tap-test : TAP format output + +This test will create two virtual machines. The one virtual machine +will use a filter called '${TESTFILTERNAME}', and reference the filter +'clean-traffic' which should be available by default with every install. +The other virtual machine will reference the filter 'testcase' and will +have its filter permanently updated. +EOF +} + + +function tap_fail() { + echo "not ok $1 - ${2:0:66}" + TAP_FAIL_LIST+="$1 " + ((TAP_FAIL_CTR++)) + ((TAP_TOT_CTR++)) +} + +function tap_pass() { + echo "ok $1 - ${2:0:70}" + ((TAP_TOT_CTR++)) +} + +function tap_final() { + local okay + + [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests ${TAP_FAIL_LIST}" + + okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l` + echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay" +} + +# A wrapper for mktemp in case it does not exist +# Echos the name of a temporary file. +function mktmpfile() { + local tmp + type -P mktemp > /dev/null + if [ $? -eq 0 ]; then + tmp=$(mktemp -t nwfvmtest.XXXXXX) + echo ${tmp} + else + while :; do + tmp="/tmp/nwfvmtest.${RANDOM}" + if [ ! -f ${tmp} ]; then + touch ${tmp} + chmod 666 ${tmp} + echo ${tmp} + break + fi + done + fi + return 0 +} + + +function checkExpectedOutput() { + local xmlfile="$1" + local fwallfile="$2" + local ifname="$3" + local flags="$4" + local skipregex="$5" + local regex="s/${ORIG_IFNAME}/${ifname}/g" + local cmd line tmpfile tmpfile2 skip + + tmpfile=`mktmpfile` + tmpfile2=`mktmpfile` + + exec 4<${fwallfile} + + read <&4 + line="${REPLY}" + + while [ "x${line}x" != "xx" ]; do + cmd=`echo ${line##\#} | sed ${regex}` + + skip=0 + if [ "x${skipregex}x" != "xx" ]; then + skip=`echo ${cmd} | grep -c -E ${skipregex}` + fi + + eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null + + rm ${tmpfile2} 2>/dev/null + touch ${tmpfile2} + + while [ 1 ]; do + read <&4 + line="${REPLY}" + + if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx" ]; then + + if [ ${skip} -ne 0 ]; then + break + fi + + diff ${tmpfile} ${tmpfile2} >/dev/null + + if [ $? -ne 0 ]; then + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL ${xmlfile} : ${cmd}" + diff ${tmpfile} ${tmpfile2} + fi + ((failctr++)) + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "tmp files: $tmpfile, $tmpfile2" + echo "Press enter" + read + fi + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 1 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}" + else + ((passctr++)) + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \ + echo "PASS ${xmlfile} : ${cmd}" + [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \ + test_result $((passctr+failctr)) "" 0 + [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \ + tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}" + fi + + break + + fi + echo "${line}" | sed ${regex} >> ${tmpfile2} + done + done + + exec 4>&- + + rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null +} + + +function doTest() { + local xmlfile="$1" + local fwallfile="$2" + local vm1name="$3" + local vm2name="$4" + local flags="$5" + local testnum="$6" + local linenums ctr=0 + local tmpfile b msg rc + + if [ ! -r "${xmlfile}" ]; then + echo "FAIL : Cannot access filter XML file ${xmlfile}." + return 1 + fi + + ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null + + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${vm1name}" "${flags}" \ + "" + + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "" + + if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then + + tmpfile=`mktmpfile` + + b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \ + sed "s/.*\<interface.*source bridge='$[a-zA-Z0-9_]\+$'.*<\/interface>.*/\1/"` + + cat >>${tmpfile} <<EOF +<interface type='bridge'> + <source bridge='${b}'/> + <mac address='52:54:00:11:22:33'/> + <target dev='${ATTACH_IFNAME}'/> + <filterref filter='testcase'/> +</interface> +EOF + msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" > /dev/null` + rc=$? + + ((attachctr++)) + + if [ $rc -eq 0 ]; then + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" "(PRE|POST)ROUTING" + msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"` + if [ $? -ne 0 ]; then + echo "FAIL: Detach of interface failed." + fi + else + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # In case of TAP, run the test anyway so we get to the full number + # of tests + checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \ + "${flags}" "" #"(PRE|POST)ROUTING" + checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \ + "${vm2name}" "${flags}" #"(PRE|POST)ROUTING" + fi + + ((attachfailctr++)) + if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then + echo "FAIL: Could not attach interface to vm ${vm1name}." + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter" + read + fi + fi + fi + + rm -rf ${tmpfile} + fi + + return 0 +} + + +function runTests() { + local vm1name="$1" + local vm2name="$2" + local xmldir="$3" + local fwalldir="$4" + local flags="$5" + local fwallfiles f c + local tap_total=0 ctr=0 + + pushd ${PWD} > /dev/null + cd ${fwalldir} + fwallfiles=`ls *.fwall` + popd > /dev/null + + if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + # Need to count the number of total tests + for fil in ${fwallfiles}; do + c=$(grep -c "^#" ${fwalldir}/${fil}) + ((tap_total+=c)) + ((ctr++)) + done + c=$(grep -c "^#" "${TESTVM2FWALLDATA}") + ((tap_total+=c*ctr)) + [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2)) + echo "1..${tap_total}" + fi + + for fil in ${fwallfiles}; do + f=${fil%%.fwall} + doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${vm1name}" \ + "${vm2name}" "${flags}" + done + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + test_final $((passctr+failctr)) $failctr + elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then + tap_final + else + echo "" + echo "Summary: ${failctr} failures, ${passctr} passes," + if [ ${attachctr} -ne 0 ]; then + echo " ${attachfailctr} interface attachment failures with ${attachctr} attempts" + fi + fi +} + + +function createVM() { + local vmname="$1" + local filtername="$2" + local ipaddr="$3" + local macaddr="$4" + local flags="$5" + local res + local tmpfile='mktmpfile' + + cat > ${tmpfile} << EOF + <domain type='kvm'> + <name>${vmname}</name> + <memory>32768</memory> + <currentMemory>32768</currentMemory> + <vcpu>1</vcpu> + <os> + <type arch='x86_64' machine='pc-0.11'>hvm</type> + <boot dev='hd'/> + </os> + <features> + <acpi/> + <apic/> + </features> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-kvm</emulator> + <interface type='bridge'> + <mac address='${macaddr}'/> + <source bridge='virbr0'/> + <filterref filter='${filtername}'> + <parameter name='IP' value='${ipaddr}'/> + </filterref> + <target dev='${vmname}'/> + </interface> + <console type='pty'> + </console> + <input type='mouse' bus='ps2'/> + <graphics type='vnc' port='-1' autoport='yes'/> + </devices> + </domain> +EOF + + res=$(${VIRSH} define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define VM ${vmname} : ${res}" + return 1 + fi + + res=$(${VIRSH} start ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not start VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + $(${VIRSH} undefine ${vmname}) + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM ${vmname}." + + rm -rf ${tmpfile} + + return 0 +} + + +function destroyVM() { + local vmname="$1" + local flags="$2" + local res + + res=$(${VIRSH} destroy ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not destroy VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + res=$(${VIRSH} undefine ${vmname}) + if [ $? -ne 0 ]; then + echo "Could not undefine VM ${vmname} : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + + [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM ${vmname}." + + return 0 +} + + +function createTestFilters() { + local flags="$1" + local tmpfile=`mktmpfile` + local res + + cat >${tmpfile} << EOF +<filter name="${TESTFILTERNAME}"> + <filterref filter='clean-traffic'/> + + <rule action='drop' direction='inout' priority='1000'> + <all/> + </rule> + + <rule action='drop' direction='inout' priority='1000'> + <all-ipv6/> + </rule> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + cat >${tmpfile} << EOF +<filter name="testcase"> +</filter> +EOF + res=$(${VIRSH} nwfilter-define ${tmpfile}) + if [ $? -ne 0 ]; then + echo "Could not define filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + rm -rf ${tmpfile} + return 1 + fi + + rm -rf ${tmpfile} + + return 0 +} + + +function deleteTestFilter() { + local flags="$1" + local res + + res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME}) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + res=$(${VIRSH} nwfilter-undefine testcase) + if [ $? -ne 0 ]; then + echo "Could not undefine filter : ${res}" + if [ $((flags & FLAG_WAIT)) -ne 0 ]; then + echo "Press enter." + read + fi + return 1 + fi + return 0 +} + + +function main() { + local prgname="$0" + local vm1 vm2 + local xmldir="nwfilterxml2xmlin" + local fwalldir="nwfilterxml2fwallout" + local found=0 vms res + local filtername="testcase" + local libvirtdpid=-1 + local flags OPWD + + ((flags=${FLAG_ATTACH})) + + while [ $# -ne 0 ]; do + case "$1" in + --help|-h|-\?) usage ${prgname}; exit 0;; + --noattach) ((flags ^= FLAG_ATTACH ));; + --wait) ((flags |= FLAG_WAIT ));; + --verbose) ((flags |= FLAG_VERBOSE ));; + --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));; + --tap-test) ((flags |= FLAG_TAP_TEST ));; + *) usage ${prgname}; exit 1;; + esac + shift 1 + done + + if [ `uname` != "Linux" ]; then + echo "This script will only run on Linux." + exit 1; + fi + + if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then + pushd ${PWD} > /dev/null + . test-lib.sh + test_intro $this_test + popd > /dev/null + fi + + res=$(${VIRSH} capabilities 2>/dev/null 1>/dev/null) + + if [ $? -ne 0 ]; then + if [ "x${LIBVIRTD}x" == "xx" ]; then + echo "Cannot find libvirtd. Exiting." + exit 1 + fi + + rm -rf pid-file 2>/dev/null + ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null & + libvirtdpid=$! + sleep 2 + + res=$(${VIRSH} capabilities 2>/dev/null 1>/dev/null) + if [ $? -ne 0 ]; then + echo "Could not start the libvirt daemon : $res" + echo "Exiting." + exit 1 + fi + fi + + vm1="testvm${RANDOM}" + vm2="testvm${RANDOM}" + + createTestFilters "${flags}" + if [ $? -ne 0 ]; then + exit 1; + fi + + createVM "${vm1}" "testcase" "10.2.2.2" "52:54:0:0:0:1" "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm1}. Exiting." + exit 1 + fi + + createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1" "52:54:0:9f:33:da" \ + "${flags}" + if [ $? -ne 0 ]; then + echo "Could not create VM ${vm2}. Exiting." + destroyVM "${vm1}" "${flags}" + exit 1 + fi + + runTests "${vm1}" "${vm2}" "${xmldir}" "${fwalldir}" "${flags}" + + destroyVM "${vm1}" "${flags}" + destroyVM "${vm2}" "${flags}" + deleteTestFilter "${flags}" + + [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid} + rm -rf pid-file 2>/dev/null + + return 0 +} + +main "$@" Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/100-apply-verify.t @@ -0,0 +1,10 @@ +#!/bin/bash + +pwd=$(dirname $0) + +pushd ${PWD} > /dev/null + +cd ${pwd} +bash ./nwfilter2vmtest.sh --tap-test --noattach + +popd > /dev/null \ No newline at end of file Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml @@ -0,0 +1,33 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat @@ -0,0 +1,73 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j I-vnet0-ipv4 +-p ARP -j I-vnet0-arp +-p 0x8035 -j I-vnet0-rarp +-p 0x835 -j ACCEPT +-j DROP +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -j O-vnet0-ipv4 +-p ARP -j O-vnet0-arp +-p 0x8035 -j O-vnet0-rarp +-j DROP +#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p IPv4 --ip-src ! 10.1.1.1 -j DROP +#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$" +-j ACCEPT +#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-s ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-src ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$" +-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP +-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP +-p ARP --arp-op Request -j ACCEPT +-p ARP --arp-op Reply -j ACCEPT +-j DROP +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ah srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <ah srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <all srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <all srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml @@ -0,0 +1,12 @@ +<filter name='testcase' chain='root'> + <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid> + <rule action='drop' direction='out' priority='500'> + <icmp connlimit-above='1'/> + </rule> + <rule action='drop' direction='out' priority='500'> + <tcp connlimit-above='2'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <esp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <esp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml @@ -0,0 +1,56 @@ +<filter name='testcase'> + <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid> + + <rule action='accept' direction='in'> + <mac protocolid='0x1234'/> + </rule> + + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='0x123' srcportend='0x234' + dstportstart='0x3456' dstportend='0x4567' + dscp='0x32'/> + </rule> + + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='tcp' + srcportstart='0x111' srcportend='400' + dstportstart='0x3333' dstportend='65535'/> + </rule> + + <rule action='accept' direction='out'> + <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='0x12' + protocoltype='0x56' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='0x22' + srcportstart='0x123' srcportend='400' + dstportstart='0x234' dstportend='0x444'/> + </rule> + + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='0x40' + srcportstart='0x20' srcportend='0x21' + dstportstart='0x100' dstportend='0x1111'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml @@ -0,0 +1,15 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> +  + <rule action='accept' direction='in' priority='500'> + <icmp type='8'/> + </rule> +  + <rule action='accept' direction='out' priority='500'> + <icmp type='0'/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <icmp/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml @@ -0,0 +1,10 @@ +<filter name='testcase'> + <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> +  + <rule action='drop' direction='inout' priority='600'> + <all/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml @@ -0,0 +1,19 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2' type='12' code='11'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' type='255' code='255'/> + </rule> + <rule action='accept' direction='in'> + <icmpv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33' type='256' code='256'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <igmp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <igmp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml @@ -0,0 +1,34 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + srcipaddr='10.1.2.3' srcipmask='255.255.255.255' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='out'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.128.0' + dstipaddr='10.1.2.3' dstipmask='255.255.255.0' + protocol='17' dscp='63' + /> + </rule> + + <rule action='accept' direction='in'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.254' + dstipaddr='10.1.2.3' dstipmask='255.255.255.128' + protocol='255' dscp='64' + /> + </rule> + + <rule action='accept' direction='inout'> + <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.127' + dstipaddr='10.1.2.3' dstipmask='255.255.255.254' + protocol='256' dscp='64' + /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml @@ -0,0 +1,14 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='drop' direction='inout'> +  + <all match='no' srcmacaddr='12:34:56:78:9a:bc'/> + </rule> + + <rule action='drop' direction='in'> +  + <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml @@ -0,0 +1,43 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80' + srcipaddr='::10.1.2.3' srcipmask='22' + dstipaddr='::10.1.2.3' + dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000' + protocol='udp' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='20' srcportend='22' + dstportstart='100' dstportend='101' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='6' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536' + /> + </rule> + + <rule action='accept' direction='inout'> + <ipv6 srcipaddr='1::2' srcipmask='128' + dstipaddr='a:b:c::' + dstipmask='ffff:ffff:ffff:ffff:8000::' + protocol='18' + /> + </rule> + +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml @@ -0,0 +1,23 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='ipv4'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='1536'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='15'/> + </rule> + <rule action='accept' direction='in'> + <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + protocolid='65535'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml @@ -0,0 +1,33 @@ +<filter name='testcase'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='rarp' + dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff' + hwtype='12' + protocoltype='34' + opcode='Request' + arpsrcmacaddr='1:2:3:4:5:6' + arpdstmacaddr='a:b:c:d:e:f'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='1' hwtype='255' protocoltype='255'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='11' hwtype='256' protocoltype='256'/> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65535' hwtype='65535' protocoltype='65535' /> + </rule> + + <rule action='accept' direction='out'> + <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + opcode='65536' hwtype='65536' protocoltype='65536' /> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> + <rule action='accept' direction='out'> + <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff' + protocolid='arp'/> + </rule> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml @@ -0,0 +1,4 @@ +<filter name='testcase'> + <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid> + <filterref filter='clean-traffic'/> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <sctp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <sctp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <tcp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <tcp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in' statematch='false'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in' statematch='0'> + <tcp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c' srcipmask='128' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml @@ -0,0 +1,22 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udp srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='33' + srcportstart='20' srcportend='21' + dstportstart='100' dstportend='1111'/> + </rule> + <rule action='accept' direction='in'> + <udp srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='32' + dscp='63' + srcportstart='255' srcportend='256' + dstportstart='65535' dstportend='65536'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml @@ -0,0 +1,19 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + dstipaddr='a:b:c::d:e:f' dstipmask='128' + srcipaddr='f:e:d::c:b:a' srcipmask='127' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='a:b:c::' srcipmask='128' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite-ipv6 srcmacaddr='1:2:3:4:5:6' + srcipaddr='::10.1.2.3' srcipmask='129' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml @@ -0,0 +1,18 @@ +<filter name='testcase' chain='root'> + <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid> + <rule action='accept' direction='out'> + <udplite srcmacaddr='1:2:3:4:5:6' + dstipaddr='10.1.2.3' dstipmask='255.255.255.255' + dscp='2'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> + <rule action='accept' direction='in'> + <udplite srcmacaddr='1:2:3:4:5:6' + srcipaddr='10.1.2.3' srcipmask='22' + dscp='33'/> + </rule> +</filter> Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -0,0 +1,32 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT all ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FORWARD --line-number | grep libvirt +1 libvirt-in all anywhere anywhere +2 libvirt-out all anywhere anywhere +3 libvirt-in-post all anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall @@ -0,0 +1,30 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L FORWARD --line-number | grep libvirt +1 libvirt-in all -- anywhere anywhere +2 libvirt-out all -- anywhere anywhere +3 libvirt-in-post all -- anywhere anywhere Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall @@ -0,0 +1,24 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +RETURN all -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1 +DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall @@ -0,0 +1,68 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT +-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p 0x1234 -j ACCEPT +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state NEW,ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 +#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::/128 tcp spts:256:4369 dpts:32:33 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 state NEW,ESTABLISHED +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0 +DROP icmp -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state NEW,ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 +DROP all -- 0.0.0.0/0 0.0.0.0/0 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall @@ -0,0 +1,23 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 +ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall @@ -0,0 +1,26 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 +ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT +-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT +-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall @@ -0,0 +1,19 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! 12:34:56:78:9A:BC +DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC ! AA:AA:AA:AA:AA:AA +#iptables -L HI-vnet0 +Chain HI-vnet0 (1 references) +target prot opt source destination +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall @@ -0,0 +1,13 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT +-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT +-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall @@ -0,0 +1,12 @@ +#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-i vnet0 -j libvirt-I-vnet0 +#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$" +-o vnet0 -j libvirt-O-vnet0 +#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p ARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$" +-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT +-d aa:bb:cc:dd:ee:ff -j ACCEPT +-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall @@ -0,0 +1,9 @@ +#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v "^Bridge" | grep -v "^$" +-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT +-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT +-p RARP -s 1:2:3:4:5:6 -j ACCEPT +#ebtables -t nat -L PREROUTING | grep vnet0 +-i vnet0 -j libvirt-I-vnet0 + Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21sctp spts:100:1111 dpts:20:21 +ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 +ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21tcp spts:100:1111 dpts:20:21 +ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp ::/0 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp ::/0 ::/0 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED +RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED +ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x21udp spts:100:1111 dpts:20:21 +ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -0,0 +1,28 @@ +#ip6tables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED +RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED +#ip6tables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED +ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite ::/0 a:b:c::/128 DSCP match 0x21 +ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP match 0x21 +#ip6tables -L INPUT -n --line-numbers | grep libvirt +1 libvirt-host-in all ::/0 ::/0 +#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-in-post -n | grep vnet0 +ACCEPT all ::/0 ::/0 PHYSDEV match --physdev-in vnet0 +#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall =================================================================== --- /dev/null +++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall @@ -0,0 +1,26 @@ +#iptables -L FI-vnet0 -n +Chain FI-vnet0 (1 references) +target prot opt source destination +RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21state ESTABLISHED +#iptables -L FO-vnet0 -n +Chain FO-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP match 0x02state ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED +#iptables -L HI-vnet0 -n +Chain HI-vnet0 (1 references) +target prot opt source destination +ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC 01:02:03:04:05:06 DSCP match 0x02 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP match 0x21 +#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " " +HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in -n | grep vnet0 | tr -s " " +FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-in-post -n | grep vnet0 +ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 +#iptables -L libvirt-out -n | grep vnet0 | tr -s " " +FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0

2 3

[libvirt] [PATCH] nwfilter: extensions of docs with advanced filtering topics
by Stefan Berger 18 Jun '10

18 Jun '10

As requested, here a couple of paragraphs about the recently added statematch attribute and some advanced (and tricky) traffic filtering topics. Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com> --- docs/formatnwfilter.html.in | 117 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 117 insertions(+) Index: libvirt-acl/docs/formatnwfilter.html.in =================================================================== --- libvirt-acl.orig/docs/formatnwfilter.html.in +++ libvirt-acl/docs/formatnwfilter.html.in @@ -277,6 +277,13 @@ Valid values are in the range of 0 to 1000. If this attribute is not provided, the value 500 will automatically be assigned. </li> + <li> + statematch -- optional; possible values are '0' or 'false' to + turn the underlying connection state matching off; default is 'true' + <br> + Also read the section on <a href="#nwfelemsRulesAdv">advanced configuration</a> + topics. + </li> </ul> <p> The above example indicates that the traffic of type <code>ip</code> @@ -1117,6 +1124,116 @@ <br><br> </p> + <h3><a name="nwfelemsRulesAdv">Advanced Filter Configuration Topics</a></h3> + <p> + The following sections discuss advanced filter configuration + topics. + </p> + <h4><a name="nwfelemsRulesAdvTracking">Connection tracking</a></h4> + <p> + The network filtering subsystem (on Linux) makes use of the connection + tracking support of iptables. This helps in enforcing the + directionality of network traffic (state match) as well as + counting and limiting the number of simultaneous connections towards + a VM. As an example, if a VM has TCP port 8080 + open, clients may connect to it on port 8080. The tracking of the + connection then prevents the client from initiating a connection from + (TCP client) port 8080 to the host back (after previously having + gained access to the VM). More importantly, tracking helps to prevent + remote attackers to establish a connection back to a VM for example + if the user inside the VM has established a connection to + port 80 on an attacker site, then the attacker won't be able to + initiate a connection from TCP port 80 towards the VM. + By default the connection state match that enables the enforcement + of directionality of traffic is turned on. <br> + The following shows an example XML fragement where this feature has been + turned off for incoming connections to TCP port 12345. + </p> +<pre> + [...] + <rule direction='in' action='accept' statematch='false'> + <tcp dstportstart='12345'/> + </rule> + [...] +</pre> + <p> + This now allows incoming traffic to TCP port 12345, but would also + enable the initiation from (client) TCP port 12345 within the VM, + which may or may not be desirable. + </p> + + <h4><a name="nwfelemsRulesAdvLimiting">Limiting Number of Connections</a></h4> + <p> + To limit the number of connections a VM may establish, a rule must + be provided that sets a limit of connections for a given + type of traffic. If for example a VM + is supposed to be allowed to only ping one other IP address at a time + and is supposed to have only one active incoming ssh connection at a + time, the following XML fragment can be used to achieve this. + </p> +<pre> + [...] + <rule action='drop' direction='in' priority='400'> + <tcp connlimit-above='1'/> + </rule> + <rule action='accept' direction='in' priority='500'> + <tcp dstportstart='22'/> + </rule> + <rule action='drop' direction='out' priority='400'> + <icmp connlimit-above='1'/> + </rule> + <rule action='accept' direction='out' priority='500'> + <icmp/> + </rule> + <rule action='accept' direction='out' priority='500'> + <udp dstportstart='53'/> + </rule> + <rule action='drop' direction='inout' priority='1000'> + <all/> + </rule> + [...] +</pre> + <p> + Note that the rule for the limit has to logically appear + before the rule for accepting the traffic.<br> + An additional rule for letting DNS traffic to port 22 + go out the VM has been added to avoid ssh sessions not + getting established for reasons related to DNS lookup failures + by the ssh daemon. Leaving this rule out may otherwise lead to + fun-filled debugging joy. + <br><br> + Lot of care must be taken with timeouts related + to tracking of traffic. An ICMP ping that + the user may have terminated inside the VM may have a long + timeout in the host's connection tracking system and therefore + not allow another ICMP ping to go through for a while. Therefore, + the timeouts have to be tuned in the host's sysfs, i.e., + </p> + +<pre> + echo 3 > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout +</pre> + <p> + sets the ICMP connection tracking timeout to 3 seconds. The + effect of this is that once one ping is terminated, another + one can start after 3 seconds.<br> + Further, we want to point out that a client that for whatever + reason has not properly closed a TCP connection may cause a + connection to be held open for a longer period of time, + depending to what timeout the <code>TCP established</code> state + timeout has been set to on the host. Also, idle connections may time + out in the connection tracking system but can be reactivated once + packets are exchanged. However, a newly initated connection may force + an idle connection into TCP backoff if the number of allowed connections + is set to a too low limit, the new connection is established + and hits (not exceeds) the limit of allowed connections and for + example a key is pressed on the old ssh session, which now has become + unresponsive due to traffic being dropped. + Therefore, the limit of connections should be rather high so that + fluctuations in new TCP connections don't cause odd + traffic behavior in relaton to idle connections. + </p> + <h2><a name="nwfcli">Command line tools</a></h2> <p> The libvirt command line tool <code>virsh</code> has been extended

2 2

[libvirt] [PATCH] libvirt-java-0.4.5 where libvirt-java-0.4.6 Refactored and Modify
by Luis Carlos Moreira da Costa 18 Jun '10

18 Jun '10

Thu Jun 17 2010 Luis Carlos Moreira da Costa <tcljava(a)gmail.com> * Refactored the all code of the libvirt. * Modify the method toString() to Strng.format in all classes. * Add final in classes, methods and attributes. * Alter of test Junit. * Modify and alter javadoc the methods. * Add .project and .classpath in Eclipse Galileo IDE. *Luís Carlos Moreira da Costa* *Engenharia & Tecnologia** **---------------------------------------------------------** **ALOG Data Centers do Brasil** **Excelência em Projetos de Hosting* Rua Dr. Miguel Couto, 58 -- Centro CEP 01008-010 -- São Paulo (SP) Telefone: (11) 3524-4970 (11) 8476-0040 *http://www.alog.com.br* <http://www.alog.com.br/>

2 1

[libvirt] [PATCH 2/2] virsh: add new --details option to vol-list
by Justin Clift 18 Jun '10

18 Jun '10

This patch adds a new --details option to the virsh vol-list command, making its output more useful to people who use virsh for significant lengths of time. --- Output from the new option (hopefully this doesn't wrap): virsh # pool-list Name State Autostart ----------------------------------------- default active yes image_dir active yes tmp active no virsh # vol-list default Name Path --------------------------------------------------------------------------------------------- CentOS-5.5-x86_64-bin-DVD-1of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso CentOS-5.5-x86_64-bin-DVD-2of2.iso /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso virsh # vol-list image_dir Name Path ------------------------------------------------------------------------- snap1.img /export/backend/centos_home/jc/tmp/images/snap1.img testimage1 /export/backend/centos_home/jc/tmp/images/testimage1 virsh # vol-list tmp Name Path ------------------------------------------ disk1.img /tmp/images/disk1.img disk2.img /tmp/images/disk2.img disk3.img /tmp/images/disk3.img disk4.img /tmp/images/disk4.img disk5.img /tmp/images/disk5.img disk6.img /tmp/images/disk6.img virsh # vol-list default --details Name Type Capacity Allocation Path ---------------------------------------------------------------- CentOS-5.5-x86_64-bin-DVD-1of2.iso file 4.09 GB 4.10 GB /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-1of2.iso CentOS-5.5-x86_64-bin-DVD-2of2.iso file 412.33 MB 412.74 MB /var/lib/libvirt/images/CentOS-5.5-x86_64-bin-DVD-2of2.iso virsh # vol-list image_dir --details Name Type Capacity Allocation Path ---------------------------------------------------------- snap1.img file 20.00 GB 140.00 KB /export/backend/centos_home/jc/tmp/images/snap1.img testimage1 file 20.00 GB 20.02 GB /export/backend/centos_home/jc/tmp/images/testimage1 virsh # vol-list tmp --details Name Type Capacity Allocation Path ------------------------------------------------------------- disk1.img file 20.00 GB 136.00 KB /tmp/images/disk1.img disk2.img file 20.00 GB 136.00 KB /tmp/images/disk2.img disk3.img file 20.00 GB 136.00 KB /tmp/images/disk3.img disk4.img file 20.00 GB 136.00 KB /tmp/images/disk4.img disk5.img file 20.00 GB 136.00 KB /tmp/images/disk5.img disk6.img file 20.00 GB 136.00 KB /tmp/images/disk6.img virsh # Much more practical than running vol-info individually on each volume. tools/virsh.c | 212 ++++++++++++++++++++++++++++++++++++++++++++++++------- tools/virsh.pod | 4 +- 2 files changed, 189 insertions(+), 27 deletions(-) diff --git a/tools/virsh.c b/tools/virsh.c index afa84e6..7a12e15 100644 --- a/tools/virsh.c +++ b/tools/virsh.c @@ -6047,67 +6047,227 @@ static const vshCmdInfo info_vol_list[] = { static const vshCmdOptDef opts_vol_list[] = { {"pool", VSH_OT_DATA, VSH_OFLAG_REQ, N_("pool name or uuid")}, + {"details", VSH_OT_BOOL, 0, N_("display extended details for volumes")}, {NULL, 0, 0, NULL} }; static int cmdVolList(vshControl *ctl, const vshCmd *cmd ATTRIBUTE_UNUSED) { + virStorageVolInfo **volumeInfos = NULL; virStoragePoolPtr pool; - int maxactive = 0, i; + int details = vshCommandOptBool(cmd, "details"); + int maxName = 0, maxPath = 0; + int numVolumes = 0, i; char **activeNames = NULL; + char **volumePaths = NULL; + /* Check the connection to libvirtd daemon is still working */ if (!vshConnectionUsability(ctl, ctl->conn, TRUE)) return FALSE; + /* Look up the pool information given to us by the user */ if (!(pool = vshCommandOptPool(ctl, cmd, "pool", NULL))) return FALSE; - maxactive = virStoragePoolNumOfVolumes(pool); - if (maxactive < 0) { + /* Determine the number of volumes in the pool */ + numVolumes = virStoragePoolNumOfVolumes(pool); + if (numVolumes < 0) { virStoragePoolFree(pool); vshError(ctl, "%s", _("Failed to list active vols")); return FALSE; } - if (maxactive) { - activeNames = vshMalloc(ctl, sizeof(char *) * maxactive); - if ((maxactive = virStoragePoolListVolumes(pool, activeNames, - maxactive)) < 0) { + /* Retrieve the list of volume names in the pool */ + if (numVolumes) { + activeNames = vshMalloc(ctl, sizeof(char *) * numVolumes); + if ((numVolumes = virStoragePoolListVolumes(pool, activeNames, + numVolumes)) < 0) { vshError(ctl, "%s", _("Failed to list active vols")); VIR_FREE(activeNames); virStoragePoolFree(pool); return FALSE; } - qsort(&activeNames[0], maxactive, sizeof(char *), namesorter); + /* Sort the volume names */ + qsort(&activeNames[0], numVolumes, sizeof(char *), namesorter); } - vshPrintExtra(ctl, "%-20s %-40s\n", _("Name"), _("Path")); - vshPrintExtra(ctl, "-----------------------------------------\n"); - for (i = 0; i < maxactive; i++) { - virStorageVolPtr vol = virStorageVolLookupByName(pool, activeNames[i]); - char *path; + /* Set aside memory for volume information pointers */ + volumePaths = vshMalloc(ctl, sizeof(char *) * numVolumes); + volumeInfos = vshMalloc(ctl, sizeof(virStorageVolInfo *) * numVolumes); - /* this kind of work with vols is not atomic operation */ - if (!vol) { - VIR_FREE(activeNames[i]); - continue; - } + /* Collect the rest of the volume information for display */ + for (i = 0; i < numVolumes; i++) { + int stringLength; + virStorageVolPtr vol = virStorageVolLookupByName(pool, + activeNames[i]); - if ((path = virStorageVolGetPath(vol)) == NULL) { - virStorageVolFree(vol); - continue; + /* Retrieve the volume path */ + if ((volumePaths[i] = virStorageVolGetPath(vol)) == NULL) { + /* Something went wrong retrieving a volume path, cope with it */ + volumePaths[i] = vshStrdup(ctl, _("unknown")); } + /* Keep the length of path string if longest so far */ + stringLength = strlen(volumePaths[i]); + if (stringLength > maxPath) + maxPath = stringLength; + + /* Keep the length of name string if longest so far */ + stringLength = strlen(activeNames[i]); + if (stringLength > maxName) + maxName = stringLength; + + /* Retrieve the volume capacity and allocation */ + volumeInfos[i] = vshMalloc(ctl, sizeof(virStorageVolInfo)); + if (virStorageVolGetInfo(vol, volumeInfos[i]) != 0) { + /* Something went wrong retrieving volume info, cope with it */ + volumeInfos[i] = NULL; + } - vshPrint(ctl, "%-20s %-40s\n", - virStorageVolGetName(vol), - path); - VIR_FREE(path); + /* Cleanup memory allocation */ virStorageVolFree(vol); - VIR_FREE(activeNames[i]); } + + /* Display the volume information */ + vshDebug(ctl, 5, "Longest name string = %d chars\n", maxName); + vshDebug(ctl, 5, "Longest path string = %d chars\n", maxPath); + if (details) { + virBuffer formatStr = VIR_BUFFER_INITIALIZER; + + /* Is the output too long to fit on one line? */ + if ((maxName + maxPath + 30) < 80) { + virBuffer headerStr = VIR_BUFFER_INITIALIZER; + + /* Output is not too long - use one line per entry */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + virBufferVSprintf(&headerStr, + virBufferContentAndReset(&formatStr), + _("Name"), _("Type"), _("Capacity"), + _("Allocation"), _("Path")); + unsigned int headerLength = strlen(headerStr.d); + vshPrintExtra(ctl, "%s", virBufferContentAndReset(&headerStr)); + + /* Display an underline of appropriate length */ + for (i = 0; i < headerLength - 1; i++) + vshPrintExtra(ctl, "-"); + vshPrintExtra(ctl, "\n"); + + /* Define output format - one line per row of volume info */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + } else { + /* Output IS too long - use two lines per entry */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s\n %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + vshPrintExtra(ctl, virBufferContentAndReset(&formatStr), + _("Name"), _("Type"), _("Capacity"), + _("Allocation"), _("Path")); + + /* Display an underline of appropriate length */ + if ((maxName + 30) > (maxPath + 6)) { + /* 30 = # chars in the header not including the name field + * 6 = Padding number picked out of the air that seems + * to work ok + */ + for (i = 0; i < maxName + 30; i++) + vshPrintExtra(ctl, "-"); + } else { + for (i = 0; i < maxPath + 6; i++) + vshPrintExtra(ctl, "-"); + } + vshPrintExtra(ctl, "\n"); + + /* Define output format - two lines per row of volume info */ + virBufferVSprintf(&formatStr, + "%%-%us %%-6s %%-10s %%-10s\n %%-%us\n", + maxName < 5 ? 5 : maxName, + maxPath); + } + + /* Display the volume detail rows */ + for (i = 0; i < numVolumes; i++) { + /* Do we have detailed sizing info? */ + if (volumeInfos[i] != NULL) { + /* We have detailed sizing info */ + double capVal, allocVal; + const char *capUnit, *allocUnit; + virBuffer capBufStr = VIR_BUFFER_INITIALIZER; + virBuffer allocBufStr = VIR_BUFFER_INITIALIZER; + + /* Determine the capacity value to show */ + capVal = prettyCapacity(volumeInfos[i]->capacity, &capUnit); + virBufferVSprintf(&capBufStr, "%.2lf %s", capVal, capUnit); + + /* Determine the allocation value to show */ + allocVal = prettyCapacity(volumeInfos[i]->allocation, + &allocUnit); + virBufferVSprintf(&allocBufStr, "%.2lf %s", allocVal, + allocUnit); + + /* Output volume details, showing all volume info */ + vshPrintExtra(ctl, formatStr.d, + activeNames[i], + volumeInfos[i]->type == VIR_STORAGE_VOL_FILE ? + _("file") : _("block"), + virBufferContentAndReset(&capBufStr), + virBufferContentAndReset(&allocBufStr), + volumePaths[i]); + + /* Cleanup memory allocation */ + VIR_FREE(volumeInfos[i]); + } else { + /* We don't have detailed sizing info, so output + * what we have */ + vshPrintExtra(ctl, formatStr.d, + activeNames[i], + _("unknown"), + _("unknown"), + _("unknown"), + volumePaths[i]); + } + + /* Cleanup memory allocation for this volume */ + VIR_FREE(volumePaths[i]); + VIR_FREE(activeNames[i]); + } + } else { + /* Only basic volume information needs to be shown */ + if (maxName < 20) /* Minimum column widths in the output */ + maxName = 20; + if (maxPath < 4) /* Minimum column widths in the output */ + maxPath = 4; + virBuffer outputStr = VIR_BUFFER_INITIALIZER; + virBufferVSprintf(&outputStr, "%%-%us %%-%us\n", maxName, maxPath); + + /* Output header */ + vshPrintExtra(ctl, outputStr.d, _("Name"), _("Path")); + + /* Display underline */ + for (i = 0; i < maxName + maxPath + 1; i++) + vshPrintExtra(ctl, "-"); + vshPrintExtra(ctl, "\n"); + + /* Output the volume information rows */ + for (i = 0; i < numVolumes; i++) { + vshPrint(ctl, outputStr.d, activeNames[i], volumePaths[i]); + } + + /* Cleanup memory allocation */ + virBufferFreeAndReset(&outputStr); + } + + /* Cleanup remaining memory allocation */ + VIR_FREE(volumePaths); + VIR_FREE(volumeInfos); VIR_FREE(activeNames); virStoragePoolFree(pool); return TRUE; diff --git a/tools/virsh.pod b/tools/virsh.pod index 8432b44..0f387e6 100644 --- a/tools/virsh.pod +++ b/tools/virsh.pod @@ -839,10 +839,12 @@ Returns basic information about the given storage volume. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool the volume is in. I<vol-name-or-key-or-path> is the name or key or path of the volume to return information for. -=item B<vol-list> I<--pool> I<pool-or-uuid> +=item B<vol-list> I<--pool> I<pool-or-uuid> optional I<--details> Return the list of volumes in the given storage pool. I<--pool> I<pool-or-uuid> is the name or UUID of the storage pool. +The I<--details> option instructs virsh to additionally display volume +persistence and capacity related information where available. =item B<vol-pool> I<vol-key-or-path> -- 1.7.0.1

2 3

[libvirt] [PATCH v2] qemu: Fix crash on failed VM startup
by Cole Robinson 18 Jun '10

18 Jun '10

If VM startup fails early enough (can't find a referenced USB device), libvirtd will crash trying to clear the VNC port bit, since port = 0, which overflows us out of the bitmap bounds. Fix this by being more defensive in the bitmap operations, and only clearing a previously set VNC port. v2: Add safety check to all relevant bitmap ops. Signed-off-by: Cole Robinson <crobinso(a)redhat.com> --- src/qemu/qemu_driver.c | 2 +- src/util/bitmap.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index c8cd50a..f5a1310 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -3741,7 +3741,7 @@ retry: if ((vm->def->ngraphics == 1) && vm->def->graphics[0]->type == VIR_DOMAIN_GRAPHICS_TYPE_VNC && vm->def->graphics[0]->data.vnc.autoport && - vm->def->graphics[0]->data.vnc.port != -1) { + vm->def->graphics[0]->data.vnc.port >= QEMU_VNC_PORT_MIN) { if (virBitmapClearBit(driver->reservedVNCPorts, vm->def->graphics[0]->data.vnc.port - \ QEMU_VNC_PORT_MIN) < 0) { diff --git a/src/util/bitmap.c b/src/util/bitmap.c index 69094a5..cef3fc4 100644 --- a/src/util/bitmap.c +++ b/src/util/bitmap.c @@ -100,7 +100,7 @@ void virBitmapFree(virBitmapPtr bitmap) */ int virBitmapSetBit(virBitmapPtr bitmap, size_t b) { - if (b > bitmap->size - 1) + if (bitmap->size <= b) return -1; bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] |= (1 << VIR_BITMAP_BIT_OFFSET(b)); @@ -118,7 +118,7 @@ int virBitmapSetBit(virBitmapPtr bitmap, size_t b) */ int virBitmapClearBit(virBitmapPtr bitmap, size_t b) { - if (b > bitmap->size - 1) + if (bitmap->size <= b) return -1; bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] &= ~(1 << VIR_BITMAP_BIT_OFFSET(b)); @@ -140,7 +140,7 @@ int virBitmapGetBit(virBitmapPtr bitmap, size_t b, bool *result) { uint32_t bit; - if (b > bitmap->size - 1) + if (bitmap->size <= b) return -1; bit = bitmap->map[VIR_BITMAP_UNIT_OFFSET(b)] & -- 1.6.6.1

3 3

[libvirt] [PATCH] Fix description of virStorageVolGetInfo()
by Philipp Hahn 18 Jun '10

18 Jun '10

Probably a copy-paste-bug in python/libvirt-override-api.xml: virStorageVolGetInfo() extracts information about a "storage volume", not the "storage pool" as virStoragePoolGetInfo() does. Signed-off-by: Philipp Hahn <hahn(a)univention.de> --- python/libvirt-override-api.xml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

3 2