hi,all we can define variable in nwfilter xml file, and assign value in domain xml . i add a new attribute , if the value is constant, it works . if it is variable, it will product wrong iptables rules. i want to know how libvirt process variable? where is the difference between processing constant and variable? when it is variable, if validator function is needed? thanks