- Devel - libvirt List Archives

[libvirt] [PATCH] Fix virNodeDeviceListCaps always returns empty
by Jincheng Miao 29 Mar '14

29 Mar '14

virNodeDeviceListCaps will always return empty for a pci nodedevice, actually it should return 'pci'. It is because the loop variable ncaps isn't increased. https://bugzilla.redhat.com/show_bug.cgi?id=1081932 Signed-off-by: Jincheng Miao <jmiao(a)redhat.com> --- src/node_device/node_device_driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/node_device/node_device_driver.c b/src/node_device/node_device_driver.c index 1f3a083..6906463 100644 --- a/src/node_device/node_device_driver.c +++ b/src/node_device/node_device_driver.c @@ -420,7 +420,7 @@ nodeDeviceListCaps(virNodeDevicePtr dev, char **const names, int maxnames) goto cleanup; for (caps = obj->def->caps; caps && ncaps < maxnames; caps = caps->next) { - if (VIR_STRDUP(names[ncaps], virNodeDevCapTypeToString(caps->type)) < 0) + if (VIR_STRDUP(names[ncaps++], virNodeDevCapTypeToString(caps->type)) < 0) goto cleanup; } ret = ncaps; -- 1.8.2.1

2 1

[libvirt] [PATCH v5 for 2.0 0/3] ABI change: change group name of option table to match with option name
by Amos Kong 28 Mar '14

28 Mar '14

This patchset changes group names of option tables to match with option name, this breakes ABI, release note was updated. V4: fix tpmdev, add name matching test (markus) V5: adjust patch order (paolo) Amos Kong (3): only add qemu_tpmdev_opts when CONFIG_TPM is defined update names in option tables to match with actual command-line spelling abort QEMU if group name in option table doesn't match with defined option name hw/acpi/core.c | 8 ++++---- hw/nvram/fw_cfg.c | 4 ++-- include/qemu/option.h | 2 +- qemu-options.h | 12 ++++++++++++ util/qemu-config.c | 28 ++++++++++++++++++++++++++++ vl.c | 37 +++++++++++++------------------------ 6 files changed, 60 insertions(+), 31 deletions(-) -- 1.8.5.3

4 10

[libvirt] [PATCH 0/3] Improve support for mocking APIs in tests
by Daniel P. Berrange 28 Mar '14

28 Mar '14

This short series introduces some helpers for mocking tests, provides a generic DBus mock helper using them and switches the systemd test to use these helpers. This will remove much code duplication in a later firewall test. Daniel P. Berrange (3): Introduce a new set of helper macros for mocking symbols Create a re-usable DBus LD_PRELOAD mock library Switch systemd test to use generic dbus mock tests/Makefile.am | 23 +++-- tests/virmock.h | 264 +++++++++++++++++++++++++++++++++++++++++++++++++ tests/virmockdbus.c | 64 ++++++++++++ tests/virsystemdmock.c | 132 ------------------------- tests/virsystemdtest.c | 86 +++++++++++++++- 5 files changed, 422 insertions(+), 147 deletions(-) create mode 100644 tests/virmock.h create mode 100644 tests/virmockdbus.c delete mode 100644 tests/virsystemdmock.c -- 1.8.5.3

2 4

[libvirt] [PATCH tck] 300-vsitype.t: skip earlier if lldptool is not available
by Mike Latimer 28 Mar '14

28 Mar '14

Move the test for /usr/sbin/lldptool up so libvirt-tck will report the skip and reason, rather than passing the test as 'ok'. --- scripts/nwfilter/300-vsitype.t | 48 ++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/scripts/nwfilter/300-vsitype.t b/scripts/nwfilter/300-vsitype.t index 3d06803..58e8469 100644 --- a/scripts/nwfilter/300-vsitype.t +++ b/scripts/nwfilter/300-vsitype.t @@ -26,7 +26,14 @@ The test case validates that the corrrect VSI is set in the adjacent switch use strict; use warnings; -use Test::More tests => 3; +use Test::More; + +if ( ! -e '/usr/sbin/lldptool' ) { + eval "use Test::More skip_all => \"lldptool is not available\";"; +} else { + eval "use Test::More tests => 3"; +} + use Sys::Virt::TCK; use Sys::Virt::TCK::NetworkHelpers; @@ -41,34 +48,29 @@ END { $tck->cleanup if $tck; } -SKIP: { - skip "lldptool not present", 3 unless -e "/usr/sbin/lldptool"; - # creating domain - my $dom1; - my $dom_name ="tck8021Qbgtest"; +my $dom1; +my $dom_name ="tck8021Qbgtest"; # speficy mode="vepa" for a direct interface - $dom1 = prepare_test_disk_and_vm($tck, $conn, $dom_name, "vepa"); - $dom1->create(); +$dom1 = prepare_test_disk_and_vm($tck, $conn, $dom_name, "vepa"); +$dom1->create(); - ok($dom1->get_id() > 0, "running domain has an ID > 0"); - my $xml = $dom1->get_xml_description; - diag $xml; - my $mac1 = get_first_macaddress($dom1); - diag "mac is $mac1"; +ok($dom1->get_id() > 0, "running domain has an ID > 0"); +my $xml = $dom1->get_xml_description; +diag $xml; +my $mac1 = get_first_macaddress($dom1); +diag "mac is $mac1"; - sleep(30); +sleep(30); # check vsi information - diag "Verifying VSI information using lldptool"; - my $lldptool = `/usr/sbin/lldptool -t -i eth2 -V vdp mode`; - diag $lldptool; +diag "Verifying VSI information using lldptool"; +my $lldptool = `/usr/sbin/lldptool -t -i eth2 -V vdp mode`; +diag $lldptool; # check if instance is listed - ok($lldptool =~ "instance", "check instance"); - ok($lldptool =~ $mac1, "check mac as well"); - - shutdown_vm_gracefully($dom1); - exit 0; +ok($lldptool =~ "instance", "check instance"); +ok($lldptool =~ $mac1, "check mac as well"); -}; +shutdown_vm_gracefully($dom1); +exit 0; -- 1.8.4.5

2 3

[libvirt] [PATCH 0/2] Fix virHostdev with session libvirt
by Ján Tomko 28 Mar '14

28 Mar '14

Reported by Richard W.M. Jones: https://www.redhat.com/archives/libvir-list/2014-March/msg01780.html Ján Tomko (2): Remove double free in virHostdevManagerDispose Create hostdevmgr in UserRuntimeDirectory for session libvirt src/util/virhostdev.c | 42 +++++++++++++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 9 deletions(-) -- 1.8.3.2

2 4

[libvirt] [PATCH] Expose SLIRP attributes
by Michal Privoznik 28 Mar '14

28 Mar '14

We allow users to use SLIRP stack. However, there are some knobs which are not exposed to users, such as host network address, DNS server, smb, and others. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com> --- docs/formatdomain.html.in | 7 +- docs/schemas/domaincommon.rng | 23 +++++- src/conf/domain_conf.c | 88 ++++++++++++++++++++++ src/conf/domain_conf.h | 6 ++ src/qemu/qemu_command.c | 19 +++++ .../qemuxml2argvdata/qemuxml2argv-net-user-ip.args | 7 ++ .../qemuxml2argvdata/qemuxml2argv-net-user-ip.xml | 33 ++++++++ tests/qemuxml2argvtest.c | 1 + 8 files changed, 180 insertions(+), 4 deletions(-) create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.args create mode 100644 tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.xml diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 7f90455..0a353ca 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -3225,7 +3225,11 @@ starting from <code>10.0.2.15</code>. The default router will be <code>10.0.2.2</code> and the DNS server will be <code>10.0.2.3</code>. This networking is the only option for unprivileged users who need their - VMs to have outgoing access. + VMs to have outgoing access. <span class="since">Since 1.2.3</span> the + user network can have the <ip/> element to override the default + network of <code>10.0.2.0/24</code>. For example it can be set to + <code>192.168.2.0/24</code>. The whole element and its attributes are + optional. </p> <pre> @@ -3235,6 +3239,7 @@ ... <interface type='user'> <mac address="00:11:22:33:44:55"/> + <ip address="192.168.2.0" prefix="24" dns="192.168.2.3" dhcpstart="192.168.2.9"/> </interface> </devices> ...</pre> diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng index bcd8142..5745ce7 100644 --- a/docs/schemas/domaincommon.rng +++ b/docs/schemas/domaincommon.rng @@ -2152,9 +2152,26 @@ </optional> <optional> <element name="ip"> - <attribute name="address"> - <ref name="ipv4Addr"/> - </attribute> + <optional> + <attribute name="address"> + <ref name="ipv4Addr"/> + </attribute> + </optional> + <optional> + <attribute name="prefix"> + <data type="integer"/> + </attribute> + </optional> + <optional> + <attribute name="dns"> + <ref name="ipv4Addr"/> + </attribute> + </optional> + <optional> + <attribute name="dhcpstart"> + <ref name="ipv4Addr"/> + </attribute> + </optional> <empty/> </element> </optional> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c index 6fb216e..aec14ed 100644 --- a/src/conf/domain_conf.c +++ b/src/conf/domain_conf.c @@ -1539,6 +1539,11 @@ void virDomainNetDefFree(virDomainNetDefPtr def) break; case VIR_DOMAIN_NET_TYPE_USER: + VIR_FREE(def->data.user.ipaddr); + VIR_FREE(def->data.user.dns); + VIR_FREE(def->data.user.dhcpstart); + break; + case VIR_DOMAIN_NET_TYPE_LAST: break; } @@ -6669,6 +6674,9 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, char *mode = NULL; char *linkstate = NULL; char *addrtype = NULL; + char *prefix = NULL; + char *dns = NULL; + char *dhcpstart = NULL; virNWFilterHashTablePtr filterparams = NULL; virDomainActualNetDefPtr actual = NULL; xmlNodePtr oldnode = ctxt->node; @@ -6750,6 +6758,13 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, def->type == VIR_DOMAIN_NET_TYPE_BRIDGE) && xmlStrEqual(cur->name, BAD_CAST "ip")) { address = virXMLPropString(cur, "address"); + } else if (!address && + def->type == VIR_DOMAIN_NET_TYPE_USER && + xmlStrEqual(cur->name, BAD_CAST "ip")) { + address = virXMLPropString(cur, "address"); + prefix = virXMLPropString(cur, "prefix"); + dns = virXMLPropString(cur, "dns"); + dhcpstart = virXMLPropString(cur, "dhcpstart"); } else if (!ifname && xmlStrEqual(cur->name, BAD_CAST "target")) { ifname = virXMLPropString(cur, "dev"); @@ -6988,6 +7003,59 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, break; case VIR_DOMAIN_NET_TYPE_USER: + if (prefix) { + if (!address) { + virReportError(VIR_ERR_XML_ERROR, "%s", + _("can't use prefix without an address")); + goto error; + } + + if (virStrToLong_i(prefix, NULL, 10, &def->data.user.prefix) < 0 || + def->data.user.prefix < 0) { + virReportError(VIR_ERR_XML_ERROR, + _("Invalid prefix: '%s'"), prefix); + goto error; + } + } else { + def->data.user.prefix = -1; + } + + if (address) { + if (virSocketAddrParse(NULL, address, AF_UNSPEC) < 0) { + virReportError(VIR_ERR_XML_ERROR, + _("Invalid address: '%s'"), address); + goto error; + } + + def->data.user.ipaddr = address; + address = NULL; + } + + if (dns) { + if (virSocketAddrParse(NULL, dns, AF_UNSPEC) < 0) { + virReportError(VIR_ERR_XML_ERROR, + _("Invalid dns address: '%s'"), dns); + goto error; + } + + def->data.user.dns = dns; + dns = NULL; + } + + if (dhcpstart) { + if (virSocketAddrParse(NULL, dhcpstart, AF_UNSPEC) < 0) { + virReportError(VIR_ERR_XML_ERROR, + _("Invalid dhcpstart address: '%s'"), + dhcpstart); + goto error; + } + + def->data.user.dhcpstart = dhcpstart; + dhcpstart = NULL; + } + + break; + case VIR_DOMAIN_NET_TYPE_LAST: break; } @@ -7134,6 +7202,9 @@ virDomainNetDefParseXML(virDomainXMLOptionPtr xmlopt, VIR_FREE(mode); VIR_FREE(linkstate); VIR_FREE(addrtype); + VIR_FREE(prefix); + VIR_FREE(dns); + VIR_FREE(dhcpstart); virNWFilterHashTableFree(filterparams); return def; @@ -15766,6 +15837,23 @@ virDomainNetDefFormat(virBufferPtr buf, break; case VIR_DOMAIN_NET_TYPE_USER: + if (def->data.user.ipaddr || + def->data.user.dns || + def->data.user.dhcpstart) { + virBufferAddLit(buf, "<ip"); + + if (def->data.user.ipaddr) { + virBufferAsprintf(buf, " address='%s'", def->data.user.ipaddr); + if (def->data.user.prefix >= 0) + virBufferAsprintf(buf, " prefix='%d'", def->data.user.prefix); + } + + virBufferEscapeString(buf, " dns='%s'", def->data.user.dns); + virBufferEscapeString(buf, " dhcpstart='%s'", def->data.user.dhcpstart); + virBufferAddLit(buf, "/>\n"); + } + break; + case VIR_DOMAIN_NET_TYPE_LAST: break; } diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index f3f24c4..b5d52e9 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -1046,6 +1046,12 @@ struct _virDomainNetDef { struct { virDomainHostdevDef def; } hostdev; + struct { + char *ipaddr; + int prefix; + char *dns; + char *dhcpstart; + } user; } data; /* virtPortProfile is used by network/bridge/direct/hostdev */ virNetDevVPortProfilePtr virtPortProfile; diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c index 9a314bf..f17061e 100644 --- a/src/qemu/qemu_command.c +++ b/src/qemu/qemu_command.c @@ -5156,6 +5156,25 @@ qemuBuildHostNetStr(virDomainNetDefPtr net, break; case VIR_DOMAIN_NET_TYPE_USER: + virBufferAddLit(&buf, "user"); + if (net->data.user.ipaddr) { + virBufferAsprintf(&buf, "%cnet=%s", type_sep, + net->data.user.ipaddr); + type_sep = ','; + if (net->data.user.prefix >= 0) + virBufferAsprintf(&buf, "/%d", net->data.user.prefix); + } + if (net->data.user.dns) { + virBufferAsprintf(&buf, "%cdns=%s", type_sep, net->data.user.dns); + type_sep = ','; + } + if (net->data.user.dhcpstart) { + virBufferAsprintf(&buf, "%cdhcpstart=%s", type_sep, + net->data.user.dhcpstart); + type_sep = ','; + } + break; + default: virBufferAddLit(&buf, "user"); break; diff --git a/tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.args b/tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.args new file mode 100644 index 0000000..3e355f3 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.args @@ -0,0 +1,7 @@ +LC_ALL=C PATH=/bin HOME=/home/test USER=test LOGNAME=test QEMU_AUDIO_DRV=none \ +/usr/bin/qemu -S -M pc -m 214 -smp 1 -nographic \ +-monitor unix:/tmp/test-monitor,server,nowait \ +-no-acpi -boot c -usb -hda /dev/HostVG/QEMUGuest1 \ +-net nic,macaddr=00:11:22:33:44:55,vlan=0,model=rtl8139 \ +-net user,net=192.168.2.0/24,dns=192.168.2.3,dhcpstart=192.168.2.9,vlan=0 \ +-serial none -parallel none diff --git a/tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.xml b/tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.xml new file mode 100644 index 0000000..5c36c77 --- /dev/null +++ b/tests/qemuxml2argvdata/qemuxml2argv-net-user-ip.xml @@ -0,0 +1,33 @@ +<domain type='qemu'> + <name>QEMUGuest1</name> + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> + <memory unit='KiB'>219136</memory> + <currentMemory unit='KiB'>219136</currentMemory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='i686' machine='pc'>hvm</type> + <boot dev='hd'/> + </os> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu</emulator> + <disk type='block' device='disk'> + <driver name='qemu' type='raw'/> + <source dev='/dev/HostVG/QEMUGuest1'/> + <target dev='hda' bus='ide'/> + <address type='drive' controller='0' bus='0' target='0' unit='0'/> + </disk> + <controller type='usb' index='0'/> + <controller type='ide' index='0'/> + <controller type='pci' index='0' model='pci-root'/> + <interface type='user'> + <ip address='192.168.2.0' prefix='24' dns='192.168.2.3' dhcpstart='192.168.2.9'/> + <mac address='00:11:22:33:44:55'/> + <model type='rtl8139'/> + </interface> + <memballoon model='virtio'/> + </devices> +</domain> diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c index 56854dc..02ed4ba 100644 --- a/tests/qemuxml2argvtest.c +++ b/tests/qemuxml2argvtest.c @@ -923,6 +923,7 @@ mymain(void) DO_TEST("misc-no-reboot", NONE); DO_TEST("misc-uuid", QEMU_CAPS_NAME, QEMU_CAPS_UUID); DO_TEST("net-user", NONE); + DO_TEST("net-user-ip", NONE); DO_TEST("net-virtio", NONE); DO_TEST("net-virtio-device", QEMU_CAPS_DEVICE, QEMU_CAPS_NODEFCONFIG, QEMU_CAPS_VIRTIO_TX_ALG); -- 1.9.0

5 14

Re: [libvirt] [PATCH] migration: Fix possible bug for migrate cancel
by Eric Blake 28 Mar '14

28 Mar '14

[adding libvirt] On 03/24/2014 09:47 AM, Paolo Bonzini wrote: > Il 24/03/2014 14:04, arei.gonglei(a)huawei.com ha scritto: >> From: zengjunliang <zengjunliang(a)huawei.com> >> >> Return error for migrate cancel, when migration status is not >> MIG_STATE_SETUP or MIG_STATE_ACTIVE. Thus, libvirt can can >> perceive the operation fails. >> >> Signed-off-by: zengjunliang <zengjunliang(a)huawei.com> >> Signed-off-by: Gonglei <arei.gonglei(a)huawei.com> > > I think this is done on purpose, because canceling migration is racy. > Instead, libvirt should do "query-migrate" and check if the migration > was completed or canceled. Can you please give more details at how you are triggering the problem with libvirt? I think Paolo is probably right - the bug is more likely to be in libvirt not expecting the race and not recovering correctly when the race occurs, than it is to be in changing qemu's state algorithm. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org

4 5

[libvirt] [PATCH tck] Remove /128 from ip6tables output
by Mike Latimer 28 Mar '14

28 Mar '14

Due to iptables commit 945353a2 (in iptables v1.4.20 and higher), ip6tables no longer prints out /128. This patch removes /128 from output files, and replaces '/128' in command output with ' ' to remain compatible with older versions of ip6tables. --- scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 24 +++++++++++----------- scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 24 +++++++++++----------- scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall | 12 +++++------ scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 24 +++++++++++----------- scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 12 +++++------ scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 14 ++++++------- scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 24 +++++++++++----------- scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 24 +++++++++++----------- scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 24 +++++++++++----------- scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 24 +++++++++++----------- 10 files changed, 103 insertions(+), 103 deletions(-) diff --git a/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall index 8c10b04..64db89d 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN ah ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN ah ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN ah ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT ah a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -ACCEPT ah ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT ah a:b:c::d:e:f f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT ah a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +ACCEPT ah ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN ah ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN ah ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN ah ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN ah ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall index f053b39..c56b85a 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN all ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN all ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN all ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT all a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -ACCEPT all ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT all a:b:c::d:e:f f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT all a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +ACCEPT all ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN all ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN all ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN all ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN all ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall index 038d2cb..32c5078 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/comment-test.fwall @@ -28,24 +28,24 @@ FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 #iptables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 --physdev-is-bridged -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN tcp ::/0 a:b:c::/128 DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL/* tcp/ipv6 rule */ +RETURN tcp ::/0 a:b:c:: DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL/* tcp/ipv6 rule */ RETURN udp ::/0 ::/0 state ESTABLISHED ctdir ORIGINAL/* `ls`;${COLUMNS};$(ls);"test";&'3 spaces' */ RETURN sctp ::/0 ::/0 state ESTABLISHED ctdir ORIGINAL/* comment with lone ', `, ", `, \, $x, and two spaces */ RETURN ah ::/0 ::/0 state ESTABLISHED ctdir ORIGINAL/* tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp} */ -#ip6tables -L FO-vnet0 -n +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x39 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED ctdir REPLY/* tcp/ipv6 rule */ +ACCEPT tcp a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x39 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED ctdir REPLY/* tcp/ipv6 rule */ ACCEPT udp ::/0 ::/0 state NEW,ESTABLISHED ctdir REPLY/* `ls`;${COLUMNS};$(ls);"test";&'3 spaces' */ ACCEPT sctp ::/0 ::/0 state NEW,ESTABLISHED ctdir REPLY/* comment with lone ', `, ", `, \, $x, and two spaces */ ACCEPT ah ::/0 ::/0 state NEW,ESTABLISHED ctdir REPLY/* tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp} */ -#ip6tables -L HI-vnet0 -n +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN tcp ::/0 a:b:c::/128 DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL/* tcp/ipv6 rule */ +RETURN tcp ::/0 a:b:c:: DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL/* tcp/ipv6 rule */ RETURN udp ::/0 ::/0 state ESTABLISHED ctdir ORIGINAL/* `ls`;${COLUMNS};$(ls);"test";&'3 spaces' */ RETURN sctp ::/0 ::/0 state ESTABLISHED ctdir ORIGINAL/* comment with lone ', `, ", `, \, $x, and two spaces */ RETURN ah ::/0 ::/0 state ESTABLISHED ctdir ORIGINAL/* tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp} */ diff --git a/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall index dbdaa36..cf3faaa 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN esp ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN esp ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN esp ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT esp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -ACCEPT esp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT esp a:b:c::d:e:f f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT esp a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +ACCEPT esp ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN esp ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN esp ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN esp ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN esp ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall index 2ed979e..0aaa50c 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall @@ -28,18 +28,18 @@ FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vnet0 #iptables -L libvirt-out -n | grep vnet0 | tr -s " " FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 --physdev-is-bridged -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN tcp ::/0 a:b:c::/128 DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN tcp ::/0 a:b:c:: DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x39 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT tcp a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x39 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN tcp ::/0 a:b:c::/128 DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL +RETURN tcp ::/0 a:b:c:: DSCP match 0x39 tcp spts:256:4369 dpts:32:33 state ESTABLISHED ctdir ORIGINAL #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 #ip6tables -L libvirt-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall index 4749f84..b25a0e7 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall @@ -1,16 +1,16 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED -#ip6tables -L FO-vnet0 -n +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT icmpv6 a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED -ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED -#ip6tables -L HI-vnet0 -n +ACCEPT icmpv6 a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED +ACCEPT icmpv6 ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED +RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall index 40d51f7..90c2284 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL -RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN sctp ::/0 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN sctp ::/0 a:b:c:: DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL +RETURN sctp ::/0 ::10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT sctp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED ctdir REPLY -ACCEPT sctp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT sctp a:b:c::d:e:f ::/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT sctp a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED ctdir REPLY +ACCEPT sctp ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN sctp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN sctp ::/0 a:b:c::/128 DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL -RETURN sctp ::/0 ::10.1.2.3/128 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL +RETURN sctp ::/0 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN sctp ::/0 a:b:c:: DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL +RETURN sctp ::/0 ::10.1.2.3 DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall index 2a794b8..a294a26 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL -RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN tcp ::/0 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN tcp ::/0 a:b:c:: DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL +RETURN tcp ::/0 ::10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT tcp a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED ctdir REPLY -ACCEPT tcp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT tcp a:b:c::d:e:f ::/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT tcp a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED ctdir REPLY +ACCEPT tcp ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN tcp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN tcp ::/0 a:b:c::/128 DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL -RETURN tcp ::/0 ::10.1.2.3/128 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL +RETURN tcp ::/0 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN tcp ::/0 a:b:c:: DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL +RETURN tcp ::/0 ::10.1.2.3 DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall index 0a75421..dafaea5 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN udp ::/0 ::a:b:c/128 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL -RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN udp ::/0 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN udp ::/0 ::a:b:c DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL +RETURN udp ::/0 ::10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT udp ::a:b:c/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED ctdir REPLY -ACCEPT udp ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT udp a:b:c::d:e:f ::/0 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT udp ::a:b:c ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED ctdir REPLY +ACCEPT udp ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN udp ::/0 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN udp ::/0 ::a:b:c/128 DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL -RETURN udp ::/0 ::10.1.2.3/128 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL +RETURN udp ::/0 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN udp ::/0 ::a:b:c DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED ctdir ORIGINAL +RETURN udp ::/0 ::10.1.2.3 DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " diff --git a/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall b/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall index 9173222..815a8c0 100644 --- a/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall +++ b/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall @@ -1,21 +1,21 @@ -#ip6tables -L FI-vnet0 -n +#ip6tables -L FI-vnet0 -n | sed 's/\/128/ /' Chain FI-vnet0 (1 references) target prot opt source destination -RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -#ip6tables -L FO-vnet0 -n +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN udplite ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN udplite ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +#ip6tables -L FO-vnet0 -n | sed 's/\/128/ /' Chain FO-vnet0 (1 references) target prot opt source destination -ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL -ACCEPT udplite a:b:c::/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -ACCEPT udplite ::10.1.2.3/128 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY -#ip6tables -L HI-vnet0 -n +ACCEPT udplite a:b:c::d:e:f f:e:d::c:b:a/127 DSCP match 0x02state ESTABLISHED ctdir ORIGINAL +ACCEPT udplite a:b:c:: ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +ACCEPT udplite ::10.1.2.3 ::/0 MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED ctdir REPLY +#ip6tables -L HI-vnet0 -n | sed 's/\/128/ /' Chain HI-vnet0 (1 references) target prot opt source destination -RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY -RETURN udplite ::/0 a:b:c::/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL -RETURN udplite ::/0 ::10.1.2.3/128 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED ctdir REPLY +RETURN udplite ::/0 a:b:c:: DSCP match 0x21state ESTABLISHED ctdir ORIGINAL +RETURN udplite ::/0 ::10.1.2.3 DSCP match 0x21state ESTABLISHED ctdir ORIGINAL #ip6tables -L INPUT -n --line-numbers | grep libvirt 1 libvirt-host-in all ::/0 ::/0 #ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " " -- 1.8.4.5

2 1

[libvirt] [PATCH tck] Adapt network tests to changed cli tool formats
by Daniel P. Berrange 28 Mar '14

28 Mar '14

The network tests invoke various ifconfig and route commands to test network setup, and also grep for dnsmasq/radvd args. Switch to use 'ip' since ifconfig and route commands are not installed by default on recent distros any more and their output formats have also changed. Remove grepping for dnsmasq args since libvirt uses a config file now too. Also avoid looking for radvd, since we let dnsmasq handle IPv6 too now. --- .../networks/networkxml2hostout/tck-testnet-1.dat | 20 ++++----- .../networks/networkxml2hostout/tck-testnet-2.dat | 16 +++---- .../networks/networkxml2hostout/tck-testnet-3.dat | 51 +++++++--------------- 3 files changed, 33 insertions(+), 54 deletions(-) diff --git a/scripts/networks/networkxml2hostout/tck-testnet-1.dat b/scripts/networks/networkxml2hostout/tck-testnet-1.dat index da1a51e..977489f 100644 --- a/scripts/networks/networkxml2hostout/tck-testnet-1.dat +++ b/scripts/networks/networkxml2hostout/tck-testnet-1.dat @@ -1,19 +1,19 @@ #iptables -t nat -L -n | grep ' 10\.1\.2\.' +RETURN all -- 10.1.2.0/24 224.0.0.0/24 +RETURN all -- 10.1.2.0/24 255.255.255.255 MASQUERADE tcp -- 10.1.2.0/24 !10.1.2.0/24 masq ports: 1024-65535 MASQUERADE udp -- 10.1.2.0/24 !10.1.2.0/24 masq ports: 1024-65535 MASQUERADE all -- 10.1.2.0/24 !10.1.2.0/24 -#iptables -n -L FORWARD | grep ' 10\.1\.2\.' +#iptables -n -L FORWARD | grep ' 10\.1\.2\.' | sed -e 's/ctstate/state/' ACCEPT all -- 0.0.0.0/0 10.1.2.0/24 state RELATED,ESTABLISHED ACCEPT all -- 10.1.2.0/24 0.0.0.0/0 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 10\.1\.2\.1*$.*|\1|p' -listen-address 10.1.2.1 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$dhcp-range 10\.1\.2\.2\,10\.1\.2\.254*$.*|\1|p' -dhcp-range 10.1.2.2,10.1.2.254 -#route -n | grep '10\.1\.2\.' -10.1.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tck-testbr +#ip -o route show dev tck-testbr | gawk '{print $1" "$7}' +10.1.2.0/24 10.1.2.1 +#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$\/dnsmasq\/tck-testnet.conf$.*|\1|p' +/dnsmasq/tck-testnet.conf #brctl show | grep tck-testbr | gawk '{print $1" "$3}' tck-testbr yes -#ifconfig tck-testbr | grep ':10\.1\.2\.' - inet addr:10.1.2.1 Bcast:10.1.2.255 Mask:255.255.255.0 +#ip -o addr show dev tck-testbr | gawk '{print $4" "$6}' +10.1.2.1/24 10.1.2.255 #virsh net-list | grep tck-testnet -tck-testnet active no + tck-testnet active no no diff --git a/scripts/networks/networkxml2hostout/tck-testnet-2.dat b/scripts/networks/networkxml2hostout/tck-testnet-2.dat index b2f4315..72ba48b 100644 --- a/scripts/networks/networkxml2hostout/tck-testnet-2.dat +++ b/scripts/networks/networkxml2hostout/tck-testnet-2.dat @@ -2,15 +2,13 @@ ACCEPT all -- 0.0.0.0/0 10.1.2.0/24 ACCEPT all -- 10.1.2.0/24 0.0.0.0/0 #iptables -t nat -L -n | grep ' 10\.1\.2\.' -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 10\.1\.2\.1$.*|\1|p' -listen-address 10.1.2.1 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$dhcp-range 10\.1\.2\.2,10\.1\.2\.254$.*|\1|p' -dhcp-range 10.1.2.2,10.1.2.254 -#route -n | grep '10\.1\.2\.' -10.1.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tck-testbr +#ip -o route show dev tck-testbr | gawk '{print $1" "$7}' +10.1.2.0/24 10.1.2.1 +#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$\/dnsmasq\/tck-testnet.conf$.*|\1|p' +/dnsmasq/tck-testnet.conf #brctl show | grep tck-testbr | gawk '{print $1" "$3}' tck-testbr yes -#ifconfig tck-testbr | grep ':10\.1\.2\.' - inet addr:10.1.2.1 Bcast:10.1.2.255 Mask:255.255.255.0 +#ip -o addr show dev tck-testbr | gawk '{print $4" "$6}' +10.1.2.1/24 10.1.2.255 #virsh net-list | grep tck-testnet -tck-testnet active no + tck-testnet active no no diff --git a/scripts/networks/networkxml2hostout/tck-testnet-3.dat b/scripts/networks/networkxml2hostout/tck-testnet-3.dat index 36c7b32..f9417fc 100644 --- a/scripts/networks/networkxml2hostout/tck-testnet-3.dat +++ b/scripts/networks/networkxml2hostout/tck-testnet-3.dat @@ -1,8 +1,10 @@ #iptables -t nat -L -n | grep ' 10\.1\.2\.' +RETURN all -- 10.1.2.0/24 224.0.0.0/24 +RETURN all -- 10.1.2.0/24 255.255.255.255 MASQUERADE tcp -- 10.1.2.0/24 !10.1.2.0/24 masq ports: 1024-65535 MASQUERADE udp -- 10.1.2.0/24 !10.1.2.0/24 masq ports: 1024-65535 MASQUERADE all -- 10.1.2.0/24 !10.1.2.0/24 -#iptables -n -L FORWARD | grep ' 10\.1\.2\.' +#iptables -n -L FORWARD | grep ' 10\.1\.2\.' | sed -e 's/ctstate/state/' ACCEPT all -- 0.0.0.0/0 10.1.2.0/24 state RELATED,ESTABLISHED ACCEPT all -- 10.1.2.0/24 0.0.0.0/0 #ip6tables -n -L FORWARD | grep ' 2001:db8:ac10' @@ -10,40 +12,19 @@ ACCEPT all ::/0 2001:db8:ac10:fd01::/64 ACCEPT all 2001:db8:ac10:fd01::/64 ::/0 ACCEPT all ::/0 2001:db8:ac10:fe01::/64 ACCEPT all 2001:db8:ac10:fe01::/64 ::/0 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 10\.1\.2\.1$.*|\1|p' -listen-address 10.1.2.1 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 192\.168\.123\.1$.*|\1|p' -listen-address 192.168.123.1 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 172\.28\.255\.241$.*|\1|p' -listen-address 172.28.255.241 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$dhcp-range 10\.1\.2\.2,10\.1\.2\.254$.*|\1|p' -dhcp-range 10.1.2.2,10.1.2.254 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 2001\:db8\:ac10\:fe01\:\:1$.*|\1|p' -listen-address 2001:db8:ac10:fe01::1 -#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$listen-address 2001\:db8\:ac10\:fd01\:\:1$.*|\1|p' -listen-address 2001:db8:ac10:fd01::1 -#ps aux | sed -n '/radvd --.*tck-testnet-/ s|.*$\/radvd\/tck-testnet-radvd.conf$.*|\1|p' -/radvd/tck-testnet-radvd.conf -#route -n | grep '10\.1\.2\.' -10.1.2.0 0.0.0.0 255.255.255.0 U 0 0 0 tck-testbr -#route -n | grep '192\.168\.123\.' -192.168.123.0 0.0.0.0 255.255.255.0 U 0 0 0 tck-testbr -#route -n | grep '172\.28\.255\.240' -172.28.255.240 0.0.0.0 255.255.255.240 U 0 0 0 tck-testbr +#ps aux | sed -n '/dnsmasq .*tck-testnet/ s|.*$\/dnsmasq\/tck-testnet.conf$.*|\1|p' +/dnsmasq/tck-testnet.conf #brctl show | grep tck-testbr | gawk '{print $1" "$3}' tck-testbr yes -#ifconfig tck-testbr | grep ':10\.1\.2\.' - inet addr:10.1.2.1 Bcast:10.1.2.255 Mask:255.255.255.0 -#ifconfig tck-testbr | grep 'inet6 addr: 2001' - inet6 addr: 2001:db8:ac10:fd01::1/64 Scope:Global - inet6 addr: 2001:db8:ac10:fe01::1/64 Scope:Global -#ip addr show tck-testbr | grep "inet " - inet 10.1.2.1/24 brd 10.1.2.255 scope global tck-testbr - inet 192.168.123.1/24 brd 192.168.123.255 scope global tck-testbr - inet 172.28.255.241/28 brd 172.28.255.255 scope global tck-testbr -#ip route show dev tck-testbr -172.28.255.240/28 proto kernel scope link src 172.28.255.241 -10.1.2.0/24 proto kernel scope link src 10.1.2.1 -192.168.123.0/24 proto kernel scope link src 192.168.123.1 +#ip -o addr show dev tck-testbr | gawk '{print $4" "$6}' +10.1.2.1/24 10.1.2.255 +192.168.123.1/24 192.168.123.255 +172.28.255.241/28 172.28.255.255 +2001:db8:ac10:fd01::1/64 global +2001:db8:ac10:fe01::1/64 global +#ip -o route show dev tck-testbr | gawk '{print $1" "$7}' +10.1.2.0/24 10.1.2.1 +172.28.255.240/28 172.28.255.241 +192.168.123.0/24 192.168.123.1 #virsh net-list | grep tck-testnet -tck-testnet active no + tck-testnet active no no -- 1.8.5.3

2 2

[libvirt] Device attach / detach problem for passthrough/SR-IOV in libvirt
by Mohsen Ghaemi 28 Mar '14

28 Mar '14

Hi all I just encountered a problem in libvirt while was trying to attach and detach a sr-iov vf to my VM The version of my libvirt is 1.1.1-0ubuntu8.5 I tried to attach the device using following xml <interface type='hostdev' managed='yes'> <mac address='5c:01:fd:12:34:58'/> <source> <address type='pci' domain='0x0000' bus='0x04' slot='0x01' function='0x1'/> </source> </interface> When i attached device it worked properly and i managed to ping another host. virsh # attach-device t5 1.xml Device attached successfully But when i detached it still i had network traffic in my VM but libvirt (virsh) said that virsh # detach-device t5 1.xml Device detached successfully The next time i tried to attach it libvirt said that virsh # attach-device t5 1.xml error: Failed to attach device from 1.xml error: Requested operation is not valid: PCI device 0000:04:01.1 is in use by domain t5 and when i continue this action after the 'domain' i receive some strange characters which might come from the memory space (memory content) like some addresses, links or some characters I tried it with different VMs and different guest OSs that the same happend. The same action was done with another host running libvirt version Installed: 1.0.2-0ubuntu11.13.04.5~cloud1 Candidate: 1.0.2-0ubuntu11.13.04.5~cloud1 and it worked pretty OK. No problem. Do you have any idea what is wrong? More information: Kernel : 3.8.0-37-generic /etc/libvirt/qemu.conf : security_driver = "none" root@compute01:~# ethtool -i eth5 driver: bnx2x version: 1.78.58 firmware-version: bc 7.4.22 phy 1.34 bus-info: 0000:04:00.1 supports-statistics: yes supports-test: yes supports-eeprom-access: yes supports-register-dump: yes

3 3