9:50 a.m.
Hi!
This is a patch I previously posted for use in the tests/ directory of
libvirt. Now I ported it to the TCK project and extended the script with
output in the Test Anything Protocol (TAP) format. It now allows
multiple output formats chosen via command line parameter supporting TAP
(--tap-test), the output format used in the libvirt tests directory (the
'.' and '!') (--libvirt-test) and one where all tests are displayed
(--verbose).
The program basically creates a filter called testcase and two VMs where
one of them references the testcase filter and the other a filter called
nwfiltertestfilter. The testcase filter is then subsequently modified
and the effect on iptables,ebtables and ip6tables verified against
expected output for both VMs. The VMs are torn down at the end and the
test filters removed.
For all the tests to run successfully, the last outstanding patch that
would need to go in is this one here:
https://www.redhat.com/archives/libvir-list/2010-June/msg00326.html
Signed-off-by: Stefan Berger <stefanb(a)us.ibm.com>
---
scripts/nwfilter/100-apply-verify.t | 10
scripts/nwfilter/nwfilter2vmtest.sh |
581 ++++++++++
scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall | 32
scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall | 30
scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall | 9
scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall | 24
scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall | 68 +
scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall | 23
scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall | 12
scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall | 19
scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall | 13
scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall | 12
scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall | 9
scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat | 73 +
scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall | 26
scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall | 28
scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall | 26
scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/all-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml | 33
scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml | 12
scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml | 56
scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml | 15
scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml | 15
scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml | 10
scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml | 34
scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml | 14
scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml | 43
scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml | 23
scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml | 33
scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml | 18
scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml | 4
scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml | 22
scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml | 19
scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml | 18
61 files changed, 2005 insertions(+)
Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
@@ -0,0 +1,581 @@
+#!/bin/bash
+
+ORIG_IFNAME="vnet0"
+ATTACH_IFNAME="attach0"
+TESTFILTERNAME="nwfiltertestfilter"
+TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat"
+
+LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd`
+if [ "x${LIBVIRTD}x" == "xx" ]; then
+ LIBVIRTD=`type -P libvirtd`
+fi
+
+VIRSH=`type -P ${PWD}/../tools/virsh`
+if [ "x${VIRSH}x" == "xx" ]; then
+ VIRSH=`type -P virsh`
+fi
+
+LD_LIBRARY_PATH="${PWD}../src/.libs/"
+
+# Maybe no libvirtd was built
+[ -z ${LIBVIRTD} ] && exit 0;
+
+FLAG_WAIT="$((1<<0))"
+FLAG_ATTACH="$((1<<1))"
+FLAG_VERBOSE="$((1<<2))"
+FLAG_LIBVIRT_TEST="$((1<<3))"
+FLAG_TAP_TEST="$((1<<4))"
+
+failctr=0
+passctr=0
+attachfailctr=0
+attachctr=0
+
+TAP_FAIL_LIST=""
+TAP_FAIL_CTR=0
+TAP_TOT_CTR=0
+
+function usage() {
+ local cmd="$0"
+cat <<EOF
+Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose]
+ [--libvirt-test] [--tap-test]
+
+Options:
+ --help,-h,-? : Display this help screen.
+ --noattach : Skip tests that attach and detach a network interface
+ --wait : Wait for the user to press the enter key once an error
+ was detected
+ --verbose : Verbose output
+ --libvirt-test : Use the libvirt test output format
+ --tap-test : TAP format output
+
+This test will create two virtual machines. The one virtual machine
+will use a filter called '${TESTFILTERNAME}', and reference the filter
+'clean-traffic' which should be available by default with every install.
+The other virtual machine will reference the filter 'testcase' and will
+have its filter permanently updated.
+EOF
+}
+
+
+function tap_fail() {
+ echo "not ok $1 - ${2:0:66}"
+ TAP_FAIL_LIST+="$1 "
+ ((TAP_FAIL_CTR++))
+ ((TAP_TOT_CTR++))
+}
+
+function tap_pass() {
+ echo "ok $1 - ${2:0:70}"
+ ((TAP_TOT_CTR++))
+}
+
+function tap_final() {
+ local okay
+
+ [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests
${TAP_FAIL_LIST}"
+
+ okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l`
+ echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay"
+}
+
+# A wrapper for mktemp in case it does not exist
+# Echos the name of a temporary file.
+function mktmpfile() {
+ local tmp
+ type -P mktemp > /dev/null
+ if [ $? -eq 0 ]; then
+ tmp=$(mktemp -t nwfvmtest.XXXXXX)
+ echo ${tmp}
+ else
+ while :; do
+ tmp="/tmp/nwfvmtest.${RANDOM}"
+ if [ ! -f ${tmp} ]; then
+ touch ${tmp}
+ chmod 666 ${tmp}
+ echo ${tmp}
+ break
+ fi
+ done
+ fi
+ return 0
+}
+
+
+function checkExpectedOutput() {
+ local xmlfile="$1"
+ local fwallfile="$2"
+ local ifname="$3"
+ local flags="$4"
+ local skipregex="$5"
+ local regex="s/${ORIG_IFNAME}/${ifname}/g"
+ local cmd line tmpfile tmpfile2 skip
+
+ tmpfile=`mktmpfile`
+ tmpfile2=`mktmpfile`
+
+ exec 4<${fwallfile}
+
+ read <&4
+ line="${REPLY}"
+
+ while [ "x${line}x" != "xx" ]; do
+ cmd=`echo ${line##\#} | sed ${regex}`
+
+ skip=0
+ if [ "x${skipregex}x" != "xx" ]; then
+ skip=`echo ${cmd} | grep -c -E ${skipregex}`
+ fi
+
+ eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null
+
+ rm ${tmpfile2} 2>/dev/null
+ touch ${tmpfile2}
+
+ while [ 1 ]; do
+ read <&4
+ line="${REPLY}"
+
+ if [ "${line:0:1}" == "#" ] || [ "x${line}x" ==
"xx" ]; then
+
+ if [ ${skip} -ne 0 ]; then
+ break
+ fi
+
+ diff ${tmpfile} ${tmpfile2} >/dev/null
+
+ if [ $? -ne 0 ]; then
+ if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then
+ echo "FAIL ${xmlfile} : ${cmd}"
+ diff ${tmpfile} ${tmpfile2}
+ fi
+ ((failctr++))
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "tmp files: $tmpfile, $tmpfile2"
+ echo "Press enter"
+ read
+ fi
+ [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \
+ test_result $((passctr+failctr)) "" 1
+ [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \
+ tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}"
+ else
+ ((passctr++))
+ [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \
+ echo "PASS ${xmlfile} : ${cmd}"
+ [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \
+ test_result $((passctr+failctr)) "" 0
+ [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \
+ tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}"
+ fi
+
+ break
+
+ fi
+ echo "${line}" | sed ${regex} >> ${tmpfile2}
+ done
+ done
+
+ exec 4>&-
+
+ rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null
+}
+
+
+function doTest() {
+ local xmlfile="$1"
+ local fwallfile="$2"
+ local vm1name="$3"
+ local vm2name="$4"
+ local flags="$5"
+ local testnum="$6"
+ local linenums ctr=0
+ local tmpfile b msg rc
+
+ if [ ! -r "${xmlfile}" ]; then
+ echo "FAIL : Cannot access filter XML file ${xmlfile}."
+ return 1
+ fi
+
+ ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null
+
+ checkExpectedOutput "${xmlfile}" "${fwallfile}"
"${vm1name}" "${flags}" \
+ ""
+
+ checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+ "${vm2name}" "${flags}" ""
+
+ if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then
+
+ tmpfile=`mktmpfile`
+
+ b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \
+ sed "s/.*\<interface.*source
bridge='\([a-zA-Z0-9_]\+\)'.*<\/interface>.*/\1/"`
+
+ cat >>${tmpfile} <<EOF
+<interface type='bridge'>
+ <source bridge='${b}'/>
+ <mac address='52:54:00:11:22:33'/>
+ <target dev='${ATTACH_IFNAME}'/>
+ <filterref filter='testcase'/>
+</interface>
+EOF
+ msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" >
/dev/null`
+ rc=$?
+
+ ((attachctr++))
+
+ if [ $rc -eq 0 ]; then
+ checkExpectedOutput "${xmlfile}" "${fwallfile}"
"${ATTACH_IFNAME}" \
+ "${flags}" "(PRE|POST)ROUTING"
+ checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}"
\
+ "${vm2name}" "${flags}" "(PRE|POST)ROUTING"
+ msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"`
+ if [ $? -ne 0 ]; then
+ echo "FAIL: Detach of interface failed."
+ fi
+ else
+ if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+ # In case of TAP, run the test anyway so we get to the full number
+ # of tests
+ checkExpectedOutput "${xmlfile}" "${fwallfile}"
"${ATTACH_IFNAME}" \
+ "${flags}" "" #"(PRE|POST)ROUTING"
+ checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}"
\
+ "${vm2name}" "${flags}" #"(PRE|POST)ROUTING"
+ fi
+
+ ((attachfailctr++))
+ if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then
+ echo "FAIL: Could not attach interface to vm ${vm1name}."
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter"
+ read
+ fi
+ fi
+ fi
+
+ rm -rf ${tmpfile}
+ fi
+
+ return 0
+}
+
+
+function runTests() {
+ local vm1name="$1"
+ local vm2name="$2"
+ local xmldir="$3"
+ local fwalldir="$4"
+ local flags="$5"
+ local fwallfiles f c
+ local tap_total=0 ctr=0
+
+ pushd ${PWD} > /dev/null
+ cd ${fwalldir}
+ fwallfiles=`ls *.fwall`
+ popd > /dev/null
+
+ if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+ # Need to count the number of total tests
+ for fil in ${fwallfiles}; do
+ c=$(grep -c "^#" ${fwalldir}/${fil})
+ ((tap_total+=c))
+ ((ctr++))
+ done
+ c=$(grep -c "^#" "${TESTVM2FWALLDATA}")
+ ((tap_total+=c*ctr))
+ [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2))
+ echo "1..${tap_total}"
+ fi
+
+ for fil in ${fwallfiles}; do
+ f=${fil%%.fwall}
+ doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}"
"${vm1name}" \
+ "${vm2name}" "${flags}"
+ done
+
+ if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then
+ test_final $((passctr+failctr)) $failctr
+ elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+ tap_final
+ else
+ echo ""
+ echo "Summary: ${failctr} failures, ${passctr} passes,"
+ if [ ${attachctr} -ne 0 ]; then
+ echo " ${attachfailctr} interface attachment failures
with ${attachctr} attempts"
+ fi
+ fi
+}
+
+
+function createVM() {
+ local vmname="$1"
+ local filtername="$2"
+ local ipaddr="$3"
+ local macaddr="$4"
+ local flags="$5"
+ local res
+ local tmpfile='mktmpfile'
+
+ cat > ${tmpfile} << EOF
+ <domain type='kvm'>
+ <name>${vmname}</name>
+ <memory>32768</memory>
+ <currentMemory>32768</currentMemory>
+ <vcpu>1</vcpu>
+ <os>
+ <type arch='x86_64' machine='pc-0.11'>hvm</type>
+ <boot dev='hd'/>
+ </os>
+ <features>
+ <acpi/>
+ <apic/>
+ </features>
+ <clock offset='utc'/>
+ <on_poweroff>destroy</on_poweroff>
+ <on_reboot>restart</on_reboot>
+ <on_crash>destroy</on_crash>
+ <devices>
+ <emulator>/usr/bin/qemu-kvm</emulator>
+ <interface type='bridge'>
+ <mac address='${macaddr}'/>
+ <source bridge='virbr0'/>
+ <filterref filter='${filtername}'>
+ <parameter name='IP' value='${ipaddr}'/>
+ </filterref>
+ <target dev='${vmname}'/>
+ </interface>
+ <console type='pty'>
+ </console>
+ <input type='mouse' bus='ps2'/>
+ <graphics type='vnc' port='-1' autoport='yes'/>
+ </devices>
+ </domain>
+EOF
+
+ res=$(${VIRSH} define ${tmpfile})
+ if [ $? -ne 0 ]; then
+ echo "Could not define VM ${vmname} : ${res}"
+ return 1
+ fi
+
+ res=$(${VIRSH} start ${vmname})
+ if [ $? -ne 0 ]; then
+ echo "Could not start VM ${vmname} : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ $(${VIRSH} undefine ${vmname})
+ return 1
+ fi
+
+ [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM
${vmname}."
+
+ rm -rf ${tmpfile}
+
+ return 0
+}
+
+
+function destroyVM() {
+ local vmname="$1"
+ local flags="$2"
+ local res
+
+ res=$(${VIRSH} destroy ${vmname})
+ if [ $? -ne 0 ]; then
+ echo "Could not destroy VM ${vmname} : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+
+ res=$(${VIRSH} undefine ${vmname})
+ if [ $? -ne 0 ]; then
+ echo "Could not undefine VM ${vmname} : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+
+ [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM
${vmname}."
+
+ return 0
+}
+
+
+function createTestFilters() {
+ local flags="$1"
+ local tmpfile=`mktmpfile`
+ local res
+
+ cat >${tmpfile} << EOF
+<filter name="${TESTFILTERNAME}">
+ <filterref filter='clean-traffic'/>
+
+ <rule action='drop' direction='inout' priority='1000'>
+ <all/>
+ </rule>
+
+ <rule action='drop' direction='inout' priority='1000'>
+ <all-ipv6/>
+ </rule>
+</filter>
+EOF
+ res=$(${VIRSH} nwfilter-define ${tmpfile})
+ if [ $? -ne 0 ]; then
+ echo "Could not define filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ rm -rf ${tmpfile}
+ return 1
+ fi
+
+ cat >${tmpfile} << EOF
+<filter name="testcase">
+</filter>
+EOF
+ res=$(${VIRSH} nwfilter-define ${tmpfile})
+ if [ $? -ne 0 ]; then
+ echo "Could not define filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ rm -rf ${tmpfile}
+ return 1
+ fi
+
+ rm -rf ${tmpfile}
+
+ return 0
+}
+
+
+function deleteTestFilter() {
+ local flags="$1"
+ local res
+
+ res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME})
+ if [ $? -ne 0 ]; then
+ echo "Could not undefine filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+ res=$(${VIRSH} nwfilter-undefine testcase)
+ if [ $? -ne 0 ]; then
+ echo "Could not undefine filter : ${res}"
+ if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+ echo "Press enter."
+ read
+ fi
+ return 1
+ fi
+ return 0
+}
+
+
+function main() {
+ local prgname="$0"
+ local vm1 vm2
+ local xmldir="nwfilterxml2xmlin"
+ local fwalldir="nwfilterxml2fwallout"
+ local found=0 vms res
+ local filtername="testcase"
+ local libvirtdpid=-1
+ local flags OPWD
+
+ ((flags=${FLAG_ATTACH}))
+
+ while [ $# -ne 0 ]; do
+ case "$1" in
+ --help|-h|-\?) usage ${prgname}; exit 0;;
+ --noattach) ((flags ^= FLAG_ATTACH ));;
+ --wait) ((flags |= FLAG_WAIT ));;
+ --verbose) ((flags |= FLAG_VERBOSE ));;
+ --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));;
+ --tap-test) ((flags |= FLAG_TAP_TEST ));;
+ *) usage ${prgname}; exit 1;;
+ esac
+ shift 1
+ done
+
+ if [ `uname` != "Linux" ]; then
+ echo "This script will only run on Linux."
+ exit 1;
+ fi
+
+ if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then
+ pushd ${PWD} > /dev/null
+ . test-lib.sh
+ test_intro $this_test
+ popd > /dev/null
+ fi
+
+ res=$(${VIRSH} capabilities 2>/dev/null 1>/dev/null)
+
+ if [ $? -ne 0 ]; then
+ if [ "x${LIBVIRTD}x" == "xx" ]; then
+ echo "Cannot find libvirtd. Exiting."
+ exit 1
+ fi
+
+ rm -rf pid-file 2>/dev/null
+ ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null &
+ libvirtdpid=$!
+ sleep 2
+
+ res=$(${VIRSH} capabilities 2>/dev/null 1>/dev/null)
+ if [ $? -ne 0 ]; then
+ echo "Could not start the libvirt daemon : $res"
+ echo "Exiting."
+ exit 1
+ fi
+ fi
+
+ vm1="testvm${RANDOM}"
+ vm2="testvm${RANDOM}"
+
+ createTestFilters "${flags}"
+ if [ $? -ne 0 ]; then
+ exit 1;
+ fi
+
+ createVM "${vm1}" "testcase" "10.2.2.2"
"52:54:0:0:0:1" "${flags}"
+ if [ $? -ne 0 ]; then
+ echo "Could not create VM ${vm1}. Exiting."
+ exit 1
+ fi
+
+ createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1"
"52:54:0:9f:33:da" \
+ "${flags}"
+ if [ $? -ne 0 ]; then
+ echo "Could not create VM ${vm2}. Exiting."
+ destroyVM "${vm1}" "${flags}"
+ exit 1
+ fi
+
+ runTests "${vm1}" "${vm2}" "${xmldir}"
"${fwalldir}" "${flags}"
+
+ destroyVM "${vm1}" "${flags}"
+ destroyVM "${vm2}" "${flags}"
+ deleteTestFilter "${flags}"
+
+ [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid}
+ rm -rf pid-file 2>/dev/null
+
+ return 0
+}
+
+main "$@"
Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/100-apply-verify.t
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+pwd=$(dirname $0)
+
+pushd ${PWD} > /dev/null
+
+cd ${pwd}
+bash ./nwfilter2vmtest.sh --tap-test --noattach
+
+popd > /dev/null
\ No newline at end of file
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype
12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f
-j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff
-j ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j
ACCEPT
+-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype
0xffff -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml
@@ -0,0 +1,33 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='arp'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ hwtype='12'
+ protocoltype='34'
+ opcode='Request'
+ arpsrcmacaddr='1:2:3:4:5:6'
+ arpdstmacaddr='a:b:c:d:e:f'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='1' hwtype='255' protocoltype='255'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='11' hwtype='256' protocoltype='256'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65535' hwtype='65535' protocoltype='65535'
/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65536' hwtype='65536' protocoltype='65536'
/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat
@@ -0,0 +1,73 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv4 -j I-vnet0-ipv4
+-p ARP -j I-vnet0-arp
+-p 0x8035 -j I-vnet0-rarp
+-p 0x835 -j ACCEPT
+-j DROP
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv4 -j O-vnet0-ipv4
+-p ARP -j O-vnet0-arp
+-p 0x8035 -j O-vnet0-rarp
+-j DROP
+#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$"
+-s ! 52:54:0:9f:33:da -j DROP
+-p IPv4 --ip-src ! 10.1.1.1 -j DROP
+#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$"
+-j ACCEPT
+#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$"
+-s ! 52:54:0:9f:33:da -j DROP
+-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP
+-p ARP --arp-ip-src ! 10.1.1.1 -j DROP
+-p ARP --arp-op Request -j ACCEPT
+-p ARP --arp-op Reply -j ACCEPT
+-j DROP
+#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$"
+-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP
+-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP
+-p ARP --arp-op Request -j ACCEPT
+-p ARP --arp-op Reply -j ACCEPT
+-j DROP
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+DROP all ::/0 ::/0
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all ::/0 ::/0
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+DROP all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ah srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <ah srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <all srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <all srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml
@@ -0,0 +1,12 @@
+<filter name='testcase' chain='root'>
+ <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid>
+ <rule action='drop' direction='out' priority='500'>
+ <icmp connlimit-above='1'/>
+ </rule>
+ <rule action='drop' direction='out' priority='500'>
+ <tcp connlimit-above='2'/>
+ </rule>
+ <rule action='accept' direction='out' priority='500'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <esp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <esp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml
@@ -0,0 +1,56 @@
+<filter name='testcase'>
+ <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+
+ <rule action='accept' direction='in'>
+ <mac protocolid='0x1234'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ srcipaddr='10.1.2.3' srcipmask='255.255.255.255'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ protocol='udp'
+ srcportstart='0x123' srcportend='0x234'
+ dstportstart='0x3456' dstportend='0x4567'
+ dscp='0x32'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
+ srcipaddr='::10.1.2.3' srcipmask='22'
+ dstipaddr='::10.1.2.3'
+ dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
+ protocol='tcp'
+ srcportstart='0x111' srcportend='400'
+ dstportstart='0x3333' dstportend='65535'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ hwtype='0x12'
+ protocoltype='0x56'
+ opcode='Request'
+ arpsrcmacaddr='1:2:3:4:5:6'
+ arpdstmacaddr='a:b:c:d:e:f'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='0x22'
+ srcportstart='0x123' srcportend='400'
+ dstportstart='0x234' dstportend='0x444'/>
+ </rule>
+
+ <rule action='accept' direction='in'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='0x40'
+ srcportstart='0x20' srcportend='0x21'
+ dstportstart='0x100' dstportend='0x1111'/>
+ </rule>
+
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+ <!-- allow incoming ICMP Echo Reply -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Request -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml
@@ -0,0 +1,15 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <!-- allow incoming ICMP Echo Request -->
+ <rule action='accept' direction='in' priority='500'>
+ <icmp type='8'/>
+ </rule>
+ <!-- allow outgoing ICMP Echo Reply -->
+ <rule action='accept' direction='out' priority='500'>
+ <icmp type='0'/>
+ </rule>
+ <!-- drop all other ICMP traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <icmp/>
+ </rule>
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml
@@ -0,0 +1,10 @@
+<filter name='testcase'>
+ <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+ <rule action='accept' direction='out' priority='500'>
+ <icmp/>
+ </rule>
+ <!-- drop all other traffic -->
+ <rule action='drop' direction='inout' priority='600'>
+ <all/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <icmp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2' type='12' code='11'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33' type='255' code='255'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33' type='256' code='256'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <icmpv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2' type='12' code='11'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmpv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33' type='255' code='255'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <icmpv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33' type='256' code='256'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <igmp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <igmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <igmp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml
@@ -0,0 +1,34 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ip srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ srcipaddr='10.1.2.3' srcipmask='255.255.255.255'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ protocol='udp'
+ srcportstart='20' srcportend='22'
+ dstportstart='100' dstportend='101'
+ />
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <ip srcipaddr='10.1.2.3' srcipmask='255.255.128.0'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.0'
+ protocol='17' dscp='63'
+ />
+ </rule>
+
+ <rule action='accept' direction='in'>
+ <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.254'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.128'
+ protocol='255' dscp='64'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ip srcipaddr='10.1.2.3' srcipmask='255.255.255.127'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.254'
+ protocol='256' dscp='64'
+ />
+ </rule>
+</filter>
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
@@ -0,0 +1,14 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='drop' direction='inout'>
+ <!-- should use $MAC for MAC address, but tests would depend on VM's
+ MAC address -->
+ <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+ </rule>
+
+ <rule action='drop' direction='in'>
+ <!-- not accepting incoming traffic from a certain MAC address -->
+ <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+ </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml
@@ -0,0 +1,43 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
+ srcipaddr='::10.1.2.3' srcipmask='22'
+ dstipaddr='::10.1.2.3'
+ dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
+ protocol='udp'
+ srcportstart='20' srcportend='22'
+ dstportstart='100' dstportend='101'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ipv6 srcipaddr='1::2' srcipmask='128'
+ dstipaddr='a:b:c::'
+ dstipmask='ffff:ffff:ffff:ffff:8000::'
+ protocol='6'
+ srcportstart='20' srcportend='22'
+ dstportstart='100' dstportend='101'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ipv6 srcipaddr='1::2' srcipmask='128'
+ dstipaddr='a:b:c::'
+ dstipmask='ffff:ffff:ffff:ffff:8000::'
+ protocol='6'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'
+ />
+ </rule>
+
+ <rule action='accept' direction='inout'>
+ <ipv6 srcipaddr='1::2' srcipmask='128'
+ dstipaddr='a:b:c::'
+ dstipmask='ffff:ffff:ffff:ffff:8000::'
+ protocol='18'
+ />
+ </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml
@@ -0,0 +1,23 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='arp'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='ipv4'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='1536'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='15'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='65535'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml
@@ -0,0 +1,33 @@
+<filter name='testcase'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='rarp'
+ dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+ hwtype='12'
+ protocoltype='34'
+ opcode='Request'
+ arpsrcmacaddr='1:2:3:4:5:6'
+ arpdstmacaddr='a:b:c:d:e:f'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='1' hwtype='255' protocoltype='255'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='11' hwtype='256' protocoltype='256'/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65535' hwtype='65535' protocoltype='65535'
/>
+ </rule>
+
+ <rule action='accept' direction='out'>
+ <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ opcode='65536' hwtype='65536' protocoltype='65536'
/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase'>
+ <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid>
+ <filterref filter='clean-traffic'/>
+ <rule action='accept' direction='out'>
+ <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+ protocolid='arp'/>
+ </rule>
+ <rule action='accept' direction='out'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='out'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml
@@ -0,0 +1,4 @@
+<filter name='testcase'>
+ <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid>
+ <filterref filter='clean-traffic'/>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <sctp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <sctp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in' statematch='false'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in' statematch='0'>
+ <tcp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c' srcipmask='128'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml
@@ -0,0 +1,22 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='33'
+ srcportstart='20' srcportend='21'
+ dstportstart='100' dstportend='1111'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udp srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='32'
+ dscp='63'
+ srcportstart='255' srcportend='256'
+ dstportstart='65535' dstportend='65536'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='a:b:c::d:e:f' dstipmask='128'
+ srcipaddr='f:e:d::c:b:a' srcipmask='127'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='a:b:c::' srcipmask='128'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='::10.1.2.3' srcipmask='129'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml
@@ -0,0 +1,18 @@
+<filter name='testcase' chain='root'>
+ <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+ <rule action='accept' direction='out'>
+ <udplite srcmacaddr='1:2:3:4:5:6'
+ dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+ dscp='2'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+ <rule action='accept' direction='in'>
+ <udplite srcmacaddr='1:2:3:4:5:6'
+ srcipaddr='10.1.2.3' srcipmask='22'
+ dscp='33'/>
+ </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN ah ::/0 a:b:c::/128 DSCP match
0x21state ESTABLISHED
+RETURN ah ::/0 ::10.1.2.3/128 DSCP match
0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match
0x02state ESTABLISHED
+ACCEPT ah a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT ah ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT ah ::/0 a:b:c::/128 DSCP match
0x21
+ACCEPT ah ::/0 ::10.1.2.3/128 DSCP match
0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN ah -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT ah -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT ah -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT ah -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall
@@ -0,0 +1,32 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN all ::/0 a:b:c::/128 DSCP match
0x21state ESTABLISHED
+RETURN all ::/0 ::10.1.2.3/128 DSCP match
0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match
0x02state ESTABLISHED
+ACCEPT all a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT all ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT all ::/0 a:b:c::/128 DSCP match
0x21
+ACCEPT all ::/0 ::10.1.2.3/128 DSCP match
0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+#ip6tables -L FORWARD --line-number | grep libvirt
+1 libvirt-in all anywhere anywhere
+2 libvirt-out all anywhere anywhere
+3 libvirt-in-post all anywhere anywhere
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall
@@ -0,0 +1,30 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN all -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT all -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT all -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
+#iptables -L FORWARD --line-number | grep libvirt
+1 libvirt-in all -- anywhere anywhere
+2 libvirt-out all -- anywhere anywhere
+3 libvirt-in-post all -- anywhere anywhere
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall
@@ -0,0 +1,24 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1
+DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2
+RETURN all -- 0.0.0.0/0 0.0.0.0/0 state
NEW,ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 1
+DROP tcp -- 0.0.0.0/0 0.0.0.0/0 #conn/32 > 2
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN esp ::/0 a:b:c::/128 DSCP match
0x21state ESTABLISHED
+RETURN esp ::/0 ::10.1.2.3/128 DSCP match
0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP match
0x02state ESTABLISHED
+ACCEPT esp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT esp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT esp ::/0 a:b:c::/128 DSCP match
0x21
+ACCEPT esp ::/0 ::10.1.2.3/128 DSCP match
0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN esp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT esp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT esp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT esp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall
@@ -0,0 +1,68 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst
10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport
13398:17767 -j ACCEPT
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d
aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst
::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp
--ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype
18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f
-j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p 0x1234 -j ACCEPT
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state
NEW,ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092
+#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp ::/0 a:b:c::/128 tcp
spts:256:4369 dpts:32:33 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp ::/0 a:b:c::/128 tcp
spts:256:4369 dpts:32:33
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
8 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
0 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
0 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type
8 state NEW,ESTABLISHED
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
+DROP icmp -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 0.0.0.0/0 state
NEW,ESTABLISHED
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 state
ESTABLISHED
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
+DROP all -- 0.0.0.0/0 0.0.0.0/0
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED
+RETURN icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state
NEW,ESTABLISHED
+ACCEPT icmp -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11
+ACCEPT icmp -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall
@@ -0,0 +1,26 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state
NEW,ESTABLISHED
+RETURN icmpv6 ::/0 ::10.1.2.3/128 DSCP
match 0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmpv6 a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state
NEW,ESTABLISHED
+ACCEPT icmpv6 ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT icmpv6 f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11
+ACCEPT icmpv6 ::/0 ::10.1.2.3/128 DSCP
match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN 2 -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+RETURN 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT 2 -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT 2 -- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT 2 -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+ACCEPT 2 -- 0.0.0.0/0 10.1.0.0/22 DSCP match
0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst
10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT
+-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F
--ip-proto udp -j ACCEPT
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT
+-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT
+
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC !
12:34:56:78:9A:BC
+DROP all -- 0.0.0.0/0 0.0.0.0/0 MAC !
AA:AA:AA:AA:AA:AA
+#iptables -L HI-vnet0
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall
@@ -0,0 +1,13 @@
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d
aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst
::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp
--ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst
1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport
100:101 --ip6-dport 20:22 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst
1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport
65535 --ip6-dport 255:256 -j ACCEPT
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst
1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
--ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport
20:22 --ip6-dport 100:101 -j ACCEPT
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
--ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport
255:256 --ip6-dport 65535 -j ACCEPT
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
--ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep
-v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v
"^$"
+-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT
+-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT
+-d aa:bb:cc:dd:ee:ff -j ACCEPT
+-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v
"^Bridge" | grep -v "^$"
+-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request
--arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst
a:b:c:d:e:f -j ACCEPT
+-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype
0xff -j ACCEPT
+-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j
ACCEPT
+-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype
0xffff -j ACCEPT
+-p RARP -s 1:2:3:4:5:6 -j ACCEPT
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp ::/0 a:b:c::/128 DSCP match
0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN sctp ::/0 ::10.1.2.3/128 DSCP match
0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp a:b:c::d:e:f/128 ::/0 DSCP match
0x02state ESTABLISHED
+ACCEPT sctp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT sctp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp ::/0 a:b:c::/128 DSCP match
0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp ::/0 ::10.1.2.3/128 DSCP match
0x3fsctp spt:65535 dpts:255:256
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT sctp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21sctp spts:100:1111 dpts:20:21
+ACCEPT sctp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fsctp spt:65535 dpts:255:256
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN tcp ::/0 a:b:c::/128 DSCP match
0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN tcp ::/0 ::10.1.2.3/128 DSCP match
0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp a:b:c::d:e:f/128 ::/0 DSCP match
0x02state ESTABLISHED
+ACCEPT tcp a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT tcp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT tcp ::/0 a:b:c::/128 DSCP match
0x21tcp spts:100:1111 dpts:20:21
+ACCEPT tcp ::/0 ::10.1.2.3/128 DSCP match
0x3ftcp spt:65535 dpts:255:256
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21tcp spts:100:1111 dpts:20:21
+RETURN tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3ftcp spt:65535 dpts:255:256
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111
+ACCEPT tcp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21tcp spts:100:1111 dpts:20:21
+ACCEPT tcp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3ftcp spt:65535 dpts:255:256
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp ::/0 ::/0 DSCP match
0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN udp ::/0 ::10.1.2.3/128 DSCP match
0x3fudp spt:65535 dpts:255:256 state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp a:b:c::d:e:f/128 ::/0 DSCP match
0x02state ESTABLISHED
+ACCEPT udp ::/0 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT udp ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp ::/0 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp ::/0 ::/0 DSCP match
0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp ::/0 ::10.1.2.3/128 DSCP match
0x3fudp spt:65535 dpts:255:256
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED
+RETURN udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fudp spt:65535 dpts:255:256 state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 DSCP match
0x02state ESTABLISHED
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state
NEW,ESTABLISHED
+ACCEPT udp -- 10.1.2.3 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state
NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x21udp spts:100:1111 dpts:20:21
+ACCEPT udp -- 0.0.0.0/0 10.1.2.3 DSCP match
0x3fudp spt:65535 dpts:255:256
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0
Index:
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall
===================================================================
--- /dev/null
+++
libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udplite ::/0 a:b:c::/128 DSCP
match 0x21state ESTABLISHED
+RETURN udplite ::/0 ::10.1.2.3/128 DSCP
match 0x21state ESTABLISHED
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite a:b:c::d:e:f/128 f:e:d::c:b:a/127 DSCP
match 0x02state ESTABLISHED
+ACCEPT udplite a:b:c::/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT udplite ::10.1.2.3/128 ::/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite f:e:d::c:b:a/127 a:b:c::d:e:f/128 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udplite ::/0 a:b:c::/128 DSCP
match 0x21
+ACCEPT udplite ::/0 ::10.1.2.3/128 DSCP
match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1 libvirt-host-in all ::/0 ::/0
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT all ::/0 ::/0 PHYSDEV
match --physdev-in vnet0
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target prot opt source destination
+RETURN udplite-- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED
+RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21state ESTABLISHED
+RETURN udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21state ESTABLISHED
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite-- 10.1.2.3 0.0.0.0/0 DSCP
match 0x02state ESTABLISHED
+ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+ACCEPT udplite-- 10.1.0.0/22 0.0.0.0/0 MAC
01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target prot opt source destination
+ACCEPT udplite-- 0.0.0.0/0 10.1.2.3 MAC
01:02:03:04:05:06 DSCP match 0x02
+ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21
+ACCEPT udplite-- 0.0.0.0/0 10.1.0.0/22 DSCP
match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in
vnet0
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 PHYSDEV
match --physdev-in vnet0
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out
vnet0