On Tue, Aug 11, 2026 at 01:57:02PM +0200, Dion Bosschieter wrote:
Change the nwfilter driver loading mechanism to read from nwfilter.conf. By default, it will use the nftables driver, which follows the firewall_backend bridge driver config logic.
Added extra nwfilter config options "enable_trace" and "enable_counters" to allow users to toggle nftable driver specific features.
Added nftables to *filter_tech_drivers as an available driver option for users to choose from.
Signed-off-by: Dion Bosschieter <dionbosschieter@gmail.com> --- libvirt.spec.in | 7 + po/POTFILES | 1 + src/conf/virnwfilterobj.h | 20 -- src/nwfilter/libvirtd_nwfilter.aug | 45 +++++ src/nwfilter/meson.build | 37 ++++ src/nwfilter/nwfilter.conf.in | 50 +++++ src/nwfilter/nwfilter_driver.c | 66 +++---- src/nwfilter/nwfilter_driver_conf.c | 214 +++++++++++++++++++++ src/nwfilter/nwfilter_driver_conf.h | 69 +++++++ src/nwfilter/nwfilter_ebiptables_driver.c | 4 +- src/nwfilter/nwfilter_ebiptables_driver.h | 2 +- src/nwfilter/nwfilter_gentech_driver.c | 65 +++---- src/nwfilter/nwfilter_gentech_driver.h | 5 +- src/nwfilter/nwfilter_nftables_driver.c | 35 ++-- src/nwfilter/nwfilter_tech_driver.h | 3 +- src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 + 16 files changed, 511 insertions(+), 119 deletions(-) create mode 100644 src/nwfilter/libvirtd_nwfilter.aug create mode 100644 src/nwfilter/nwfilter.conf.in create mode 100644 src/nwfilter/nwfilter_driver_conf.c create mode 100644 src/nwfilter/nwfilter_driver_conf.h create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in diff --git a/src/nwfilter/test_libvirtd_nwfilter.aug.in b/src/nwfilter/test_libvirtd_nwfilter.aug.in new file mode 100644 index 0000000000..e6e62550e4 --- /dev/null +++ b/src/nwfilter/test_libvirtd_nwfilter.aug.in @@ -0,0 +1,7 @@ +module Test_libvirtd_nwfilter = + @CONFIG@ + + test Libvirtd_nwfilter.lns get conf = +{ "firewall_backend" = "nftables" }
This needed changing to @FIREWALL_BACKEND@ instead of hardcoding 'nftables', since the default changes at build time based on the platform.
+{ "enable_trace" = "0" } +{ "enable_counters" = "0" } -- 2.53.0
With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|