External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-05 04:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
8f0f6ff082
libvirt/docs/schemas/nwfilter.rng

987 lines
27 KiB
Plaintext
Raw Normal View History

nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<?xml version="1.0" encoding="UTF-8"?>
<grammar ns="" xmlns="http://relaxng.org/ns/structure/1.0" datatypeLibrary="http://www.w3.org/2001/XMLSchema-datatypes">
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<include href="basictypes.rng"/>
<include href="nwfilter_params.rng"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<start>
<ref name="filter"/>
</start>
<define name="filter">
<element name="filter">
<ref name="filter-node-attributes"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
<optional>
<element name="uuid">
<ref name="UUID"/>
</element>
</optional>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<zeroOrMore>
<choice>
<element name="filterref">
<ref name="filterref-node-attributes"/>
</element>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
<element name="rule">
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<ref name="rule-node-attributes"/>
rng: fix nwfilter rule contents The contents of a <rule> are a choice of exactly one union member. The RNG schema, however, was allowing an arbitrary number of instances of every union member at once. Reviewed-by: John Ferlan <jferlan@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-12-06 16:41:31 +00:00
<choice>
schema: allow a <rule> element with no subelements in a nwfilter This is a regression in behavior caused by commit 37359814. It was intended to limit the schema to allow only a single subelement of <rule>, but it is also acceptable for <rule> to have no subelement at all. To prevent the same error from reoccurring in the future, the examples/xml/nwfilter directory was added to the list of nwfilter schema test directories. Resolves: https://bugzilla.redhat.com/1593549 Signed-off-by: Laine Stump <laine@laine.org> ACKed-by: Michal Privoznik <mprivozn@redhat.com>
2018-06-21 06:07:17 +00:00
<empty/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
<element name="mac">
<ref name="match-attribute"/>
<ref name="common-l2-attributes"/>
<ref name="mac-attributes"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
<element name="vlan">
<ref name="match-attribute"/>
<ref name="common-l2-attributes"/>
<ref name="vlan-attributes"/>
<ref name="comment-attribute"/>
</element>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<element name="stp">
<ref name="match-attribute"/>
<ref name="srcmacandmask-attributes"/>
<ref name="stp-attributes"/>
<ref name="comment-attribute"/>
</element>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
<element name="arp">
<ref name="match-attribute"/>
<ref name="common-l2-attributes"/>
<ref name="arp-attributes"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="rarp">
<ref name="match-attribute"/>
<ref name="common-l2-attributes"/>
<ref name="arp-attributes"/> <!-- same as arp -->
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="ip">
<ref name="match-attribute"/>
<ref name="common-l2-attributes"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-port-attributes"/>
<ref name="ip-attributes"/>
<ref name="dscp-attribute"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="ipv6">
<ref name="match-attribute"/>
<ref name="common-l2-attributes"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-port-attributes"/>
<ref name="ip-attributes"/>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 16:41:49 +00:00
<ref name="icmp-attribute-ranges"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="tcp">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-port-attributes"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilters: support for TCP flags evaluation This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
2011-04-08 00:13:38 +00:00
<ref name="tcp-attributes"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="udp">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-port-attributes"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="sctp">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-port-attributes"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="icmp">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
<ref name="icmp-attributes"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="igmp">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="all">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="esp">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="ah">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="udplite">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ip-attributes-p1"/>
<ref name="common-ip-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="tcp-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-port-attributes"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilters: support for TCP flags evaluation This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
2011-04-08 00:13:38 +00:00
<ref name="tcp-attributes"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="udp-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-port-attributes"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="sctp-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-port-attributes"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="icmpv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
<ref name="icmp-attributes"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="all-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="esp-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="ah-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
<element name="udplite-ipv6">
<ref name="match-attribute"/>
<ref name="srcmac-attribute"/>
<ref name="common-ipv6-attributes-p1"/>
<ref name="common-ipv6-attributes-p2"/>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<ref name="comment-attribute"/>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
</element>
rng: fix nwfilter rule contents The contents of a <rule> are a choice of exactly one union member. The RNG schema, however, was allowing an arbitrary number of instances of every union member at once. Reviewed-by: John Ferlan <jferlan@redhat.com> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2017-12-06 16:41:31 +00:00
</choice>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</element>
</choice>
</zeroOrMore>
</element>
</define>
<!-- ########### attributes of XML nodes ############ -->
<define name="filter-node-attributes">
<attribute name="name">
<data type="NCName"/>
</attribute>
<optional>
<attribute name="chain">
<choice>
<value>root</value>
Add a 'mac' chain With hunks borrowed from one of David Steven's previous patches, we now add the capability of having a 'mac' chain which is useful to filter for multiple valid MAC addresses. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">mac[a-zA-Z0-9_\.:\-]{0,9}</param>
Add a 'mac' chain With hunks borrowed from one of David Steven's previous patches, we now add the capability of having a 'mac' chain which is useful to filter for multiple valid MAC addresses. Signed-off-by: David L Stevens <dlstevens@us.ibm.com> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
</data>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">stp[a-zA-Z0-9_\.:\-]{0,9}</param>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
</data>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">vlan[a-zA-Z0-9_\.:\-]{0,8}</param>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
</data>
Enable chains with names having a known prefix This patch enables chains that have a known prefix in their name. Known prefixes are: 'ipv4', 'ipv6', 'arp', 'rarp'. All prefixes are also protocols that can be evaluated on the ebtables level. Following the prefix they will be automatically connected to an interface's 'root' chain and jumped into following the protocol they evaluate, i.e., a table 'arp-xyz' will be accessed from the root table using ebtables -t nat -A <iface root table> -p arp -j I-<ifname>-arp-xyz thus generating a 'root' chain like this one here: Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -p ARP -j O-vnet0-arp-xyz -j DROP where the chain 'arp-xyz' is accessed for filtering of ARP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:18 +00:00
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">arp[a-zA-Z0-9_\.:\-]{0,9}</param>
Enable chains with names having a known prefix This patch enables chains that have a known prefix in their name. Known prefixes are: 'ipv4', 'ipv6', 'arp', 'rarp'. All prefixes are also protocols that can be evaluated on the ebtables level. Following the prefix they will be automatically connected to an interface's 'root' chain and jumped into following the protocol they evaluate, i.e., a table 'arp-xyz' will be accessed from the root table using ebtables -t nat -A <iface root table> -p arp -j I-<ifname>-arp-xyz thus generating a 'root' chain like this one here: Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -p ARP -j O-vnet0-arp-xyz -j DROP where the chain 'arp-xyz' is accessed for filtering of ARP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:18 +00:00
</data>
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">rarp[a-zA-Z0-9_\.:\-]{0,8}</param>
Enable chains with names having a known prefix This patch enables chains that have a known prefix in their name. Known prefixes are: 'ipv4', 'ipv6', 'arp', 'rarp'. All prefixes are also protocols that can be evaluated on the ebtables level. Following the prefix they will be automatically connected to an interface's 'root' chain and jumped into following the protocol they evaluate, i.e., a table 'arp-xyz' will be accessed from the root table using ebtables -t nat -A <iface root table> -p arp -j I-<ifname>-arp-xyz thus generating a 'root' chain like this one here: Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -p ARP -j O-vnet0-arp-xyz -j DROP where the chain 'arp-xyz' is accessed for filtering of ARP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:18 +00:00
</data>
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">ipv4[a-zA-Z0-9_\.:\-]{0,8}</param>
Enable chains with names having a known prefix This patch enables chains that have a known prefix in their name. Known prefixes are: 'ipv4', 'ipv6', 'arp', 'rarp'. All prefixes are also protocols that can be evaluated on the ebtables level. Following the prefix they will be automatically connected to an interface's 'root' chain and jumped into following the protocol they evaluate, i.e., a table 'arp-xyz' will be accessed from the root table using ebtables -t nat -A <iface root table> -p arp -j I-<ifname>-arp-xyz thus generating a 'root' chain like this one here: Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -p ARP -j O-vnet0-arp-xyz -j DROP where the chain 'arp-xyz' is accessed for filtering of ARP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:18 +00:00
</data>
<data type="string">
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<param name="pattern">ipv6[a-zA-Z0-9_\.:\-]{0,8}</param>
Enable chains with names having a known prefix This patch enables chains that have a known prefix in their name. Known prefixes are: 'ipv4', 'ipv6', 'arp', 'rarp'. All prefixes are also protocols that can be evaluated on the ebtables level. Following the prefix they will be automatically connected to an interface's 'root' chain and jumped into following the protocol they evaluate, i.e., a table 'arp-xyz' will be accessed from the root table using ebtables -t nat -A <iface root table> -p arp -j I-<ifname>-arp-xyz thus generating a 'root' chain like this one here: Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT -p IPv4 -j O-vnet0-ipv4 -p ARP -j O-vnet0-arp -p 0x8035 -j O-vnet0-rarp -p ARP -j O-vnet0-arp-xyz -j DROP where the chain 'arp-xyz' is accessed for filtering of ARP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:18 +00:00
</data>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</choice>
</attribute>
</optional>
Extend the filter XML to support priorities of chains This patch extends the filter XML to support priorities of chains in the XML. An example would be: <filter name='allow-arpxyz' chain='arp-xyz' priority='200'> [...] </filter> The permitted values for priorities are [-1000, 1000]. By setting the priority of a chain the order in which it is accessed from the interface root chain can be influenced. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:17 +00:00
<optional>
<attribute name="priority">
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<ref name="priority-type"/>
Extend the filter XML to support priorities of chains This patch extends the filter XML to support priorities of chains in the XML. An example would be: <filter name='allow-arpxyz' chain='arp-xyz' priority='200'> [...] </filter> The permitted values for priorities are [-1000, 1000]. By setting the priority of a chain the order in which it is accessed from the interface root chain can be influenced. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-18 16:58:17 +00:00
</attribute>
</optional>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="rule-node-attributes">
<attribute name="action">
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<ref name="action-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</attribute>
<attribute name="direction">
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<ref name="direction-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</attribute>
<optional>
<attribute name="priority">
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<ref name="priority-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</attribute>
</optional>
nwfilter: add XML attribute to control iptables state match This patch adds an optional XML attribute to a nwfilter rule to give the user control over whether the rule is supposed to be using the iptables state match or not. A rule may now look like shown in the XML below with the statematch attribute either having value '0' or 'false' (case-insensitive). [...] <rule action='accept' direction='in' statematch='false'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> [...] I am also extending the nwfilter schema and add this attribute to a test case.
2010-06-17 18:12:34 +00:00
<optional>
<attribute name="statematch">
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<ref name="statematch-type"/>
nwfilter: add XML attribute to control iptables state match This patch adds an optional XML attribute to a nwfilter rule to give the user control over whether the rule is supposed to be using the iptables state match or not. A rule may now look like shown in the XML below with the statematch attribute either having value '0' or 'false' (case-insensitive). [...] <rule action='accept' direction='in' statematch='false'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> [...] I am also extending the nwfilter schema and add this attribute to a test case.
2010-06-17 18:12:34 +00:00
</attribute>
</optional>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="match-attribute">
<interleave>
<optional>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<attribute name="match">
<ref name="virYesNo"/>
</attribute>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</optional>
</interleave>
</define>
<define name="srcmac-attribute">
<interleave>
<optional>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<attribute name="srcmacaddr">
<ref name="addrMAC"/>
</attribute>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</optional>
</interleave>
</define>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<define name="srcmacandmask-attributes">
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<interleave>
<ref name="srcmac-attribute"/>
<optional>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<attribute name="srcmacmask">
<ref name="addrMAC"/>
</attribute>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</optional>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
</interleave>
</define>
<define name="common-l2-attributes">
<interleave>
<ref name="srcmacandmask-attributes"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<optional>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<attribute name="dstmacaddr">
<ref name="addrMAC"/>
</attribute>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</optional>
<optional>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<attribute name="dstmacmask">
<ref name="addrMAC"/>
</attribute>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</optional>
</interleave>
</define>
<define name="common-ip-attributes-p1">
<interleave>
<optional>
<attribute name="srcipaddr">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="srcipmask">
<ref name="addrMask"/>
</attribute>
</optional>
<optional>
<attribute name="dstipaddr">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="dstipmask">
<ref name="addrMask"/>
</attribute>
</optional>
</interleave>
</define>
<define name="common-ip-attributes-p2">
<interleave>
<optional>
<attribute name="srcipfrom">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="srcipto">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="dstipfrom">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="dstipto">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="dscp">
<ref name="sixbitrange"/>
</attribute>
</optional>
nwfilter: extend schema + add testcase w/ connlimit-above I am extending the schema with the recently added connlimit-above attribute and adding a test case for it to the test suite.
2010-04-23 15:42:39 +00:00
<optional>
<attribute name="connlimit-above">
<ref name="uint16range"/>
</attribute>
</optional>
nwfilter: Extend schema to accept state attribute Extend the nwfilter.rng schema to accept state attribute.
2010-10-07 10:44:41 +00:00
<optional>
<attribute name="state">
<ref name="stateflags-type"/>
</attribute>
</optional>
nwfilter: Add support for ipset This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan
2012-05-21 10:26:34 +00:00
<optional>
<attribute name="ipset">
<ref name="ipset-name-type"/>
</attribute>
<attribute name="ipsetflags">
<ref name="ipset-flags-type"/>
</attribute>
</optional>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</interleave>
</define>
<define name="common-ipv6-attributes-p1">
<interleave>
<optional>
<attribute name="srcipaddr">
<ref name="addrIPv6"/>
</attribute>
</optional>
<optional>
<attribute name="srcipmask">
<ref name="addrMaskv6"/>
</attribute>
</optional>
<optional>
<attribute name="dstipaddr">
<ref name="addrIPv6"/>
</attribute>
</optional>
<optional>
<attribute name="dstipmask">
<ref name="addrMaskv6"/>
</attribute>
</optional>
</interleave>
</define>
<define name="common-ipv6-attributes-p2">
<interleave>
<optional>
<attribute name="srcipfrom">
<ref name="addrIPv6"/>
</attribute>
</optional>
<optional>
<attribute name="srcipto">
<ref name="addrIPv6"/>
</attribute>
</optional>
<optional>
<attribute name="dstipfrom">
<ref name="addrIPv6"/>
</attribute>
</optional>
<optional>
<attribute name="dstipto">
<ref name="addrIPv6"/>
</attribute>
</optional>
<optional>
<attribute name="dscp">
<ref name="sixbitrange"/>
</attribute>
</optional>
</interleave>
</define>
<define name="common-port-attributes">
<interleave>
<optional>
<attribute name="srcportstart">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="srcportend">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="dstportstart">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="dstportend">
<ref name="uint16range"/>
</attribute>
</optional>
</interleave>
</define>
<define name="icmp-attributes">
<interleave>
<optional>
<attribute name="type">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</attribute>
</optional>
<optional>
<attribute name="code">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</attribute>
</optional>
</interleave>
</define>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 16:41:49 +00:00
<define name="icmp-attribute-ranges">
<interleave>
<optional>
<attribute name="type">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 16:41:49 +00:00
</attribute>
</optional>
<optional>
<attribute name="typeend">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 16:41:49 +00:00
</attribute>
</optional>
<optional>
<attribute name="code">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 16:41:49 +00:00
</attribute>
</optional>
<optional>
<attribute name="codeend">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 16:41:49 +00:00
</attribute>
</optional>
</interleave>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<define name="mac-attributes">
<interleave>
<optional>
<attribute name="protocolid">
<ref name="mac-protocolid"/>
</attribute>
</optional>
</interleave>
</define>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
<define name="vlan-attributes">
<interleave>
<optional>
<attribute name="vlanid">
<ref name="vlan-vlanid"/>
</attribute>
</optional>
<optional>
<attribute name="encap-protocol">
<ref name="mac-protocolid"/>
</attribute>
</optional>
</interleave>
</define>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<define name="stp-attributes">
<optional>
<attribute name="type">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
</attribute>
</optional>
<optional>
<attribute name="flags">
schema: rename uint8range/uint24range to uint8/uint24 nwfilter.rng defines uint16range and uint32range, but in a different manner (it also allows a variable name as the value, rather than just a decimal or hex number). I wanted to add uint16range to basictypes.rng, but my desired definition was parallel to those for uint8range and uint24range which are defined in basictypes.rng - they *don't* allow a variable name for the value. The simplest path to make everyone happy is to make the "plain" versions in basictypes.rng have simpler names - "uint8", "uint16", and "uint24". This patch renames uint8range and uint24range to uint8 and uint24, while the next patch will add uint16.
2016-03-22 16:00:40 +00:00
<ref name="uint8"/>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
</attribute>
</optional>
<optional>
<attribute name="root-priority">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="root-priority-hi">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="root-address">
<ref name="addrMAC"/>
</attribute>
</optional>
<optional>
<attribute name="root-address-mask">
<ref name="addrMAC"/>
</attribute>
</optional>
<optional>
<attribute name="root-cost">
<ref name="uint32range"/>
</attribute>
</optional>
<optional>
<attribute name="root-cost-hi">
<ref name="uint32range"/>
</attribute>
</optional>
<optional>
<attribute name="sender-priority">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="sender-priority-hi">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="sender-address">
<ref name="addrMAC"/>
</attribute>
</optional>
<optional>
<attribute name="sender-address-mask">
<ref name="addrMAC"/>
</attribute>
</optional>
<optional>
<attribute name="port">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="port-hi">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="age">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="age-hi">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="max-age">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="max-age-hi">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="hello-time">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="hello-time-hi">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="forward-delay">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="forward-delay-hi">
<ref name="uint16range"/>
</attribute>
</optional>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<define name="arp-attributes">
<interleave>
<optional>
<attribute name="arpsrcmacaddr">
<ref name="addrMAC"/>
</attribute>
</optional>
<optional>
<attribute name="arpsrcipaddr">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="arpdstmacaddr">
<ref name="addrMAC"/>
</attribute>
</optional>
<optional>
<attribute name="arpdstipaddr">
<ref name="addrIP"/>
</attribute>
</optional>
<optional>
<attribute name="hwtype">
<ref name="uint16range"/>
</attribute>
</optional>
<optional>
<attribute name="opcode">
<ref name="arpOpcodeType"/>
</attribute>
</optional>
<optional>
<attribute name="protocoltype">
<ref name="uint16range"/>
</attribute>
</optional>
nwfilter: enable filtering of gratuitous ARP packets This patch enables filtering of gratuitous ARP packets using the following XML: <rule action='accept' direction='in' priority='425'> <arp gratuitous='true'/> </rule>
2011-05-23 23:41:18 +00:00
<optional>
<attribute name="gratuitous">
<ref name="boolean"/>
</attribute>
</optional>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
</interleave>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="ip-attributes">
<optional>
<attribute name="protocol">
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<ref name="ipProtocolType"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</attribute>
</optional>
</define>
<define name="dscp-attribute">
<optional>
<attribute name="dscp">
<ref name="sixbitrange"/>
</attribute>
</optional>
</define>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<define name="comment-attribute">
<optional>
<attribute name="comment">
<ref name="comment-type"/>
</attribute>
</optional>
</define>
nwfilters: support for TCP flags evaluation This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
2011-04-08 00:13:38 +00:00
<define name="tcp-attributes">
<optional>
<attribute name="flags">
<ref name="tcpflags-type"/>
</attribute>
</optional>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<!-- ################ type library ################ -->
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<define name="variable-name-type">
<data type="string">
schema: nwfiter: Allow leading/trailing whitespace in 'variable-name-type' The reference string parser tolerates some leading/trailing whitespace for the reference strings as witnessed by tests/nwfilterxml2xmlin/iter-test3.xml Allow them in the schema so that the test passes schema validation. Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-10-07 14:19:42 +00:00
<param name="pattern">$[ ]*[a-zA-Z0-9_]+(\[[ ]*[@]?[0-9]+[ ]*\])?[ ]*</param>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
</data>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<define name="addrMAC">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="string">
<param name="pattern">([a-fA-F0-9]{1,2}:){5}[a-fA-F0-9]{1,2}</param>
</data>
</choice>
</define>
<define name="addrIP">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="string">
<param name="pattern">([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9]</param>
</data>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
</choice>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="addrIPv6">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="string">
<param name="pattern">([a-fA-F0-9]{0,4}:){2,7}([a-fA-F0-9]*)(([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9])?</param>
</data>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
</choice>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="addrMask">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">32</param>
</data>
<data type="string">
<param name="pattern">([0-2]?[0-9]?[0-9]\.){3}[0-2]?[0-9]?[0-9]</param>
</data>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
</choice>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="addrMaskv6">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">128</param>
</data>
<data type="string">
<param name="pattern">([a-fA-F0-9]{0,4}:){2,7}([a-fA-F0-9]*)</param>
</data>
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
</choice>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
<define name="sixbitrange">
<choice>
nwfilter: enable hex number inputs in filter XML With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Changes from V1 to V2: - using asHex boolean in all printf type of functions to select the output format in hex or decimal format
2010-04-26 17:50:40 +00:00
<data type="string">
<param name="pattern">0x([0-3][0-9a-fA-F]|[0-9a-fA-F])</param>
</data>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">63</param>
</data>
</choice>
</define>
<define name="mac-protocolid">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
nwfilter: enable hex number inputs in filter XML With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Changes from V1 to V2: - using asHex boolean in all printf type of functions to select the output format in hex or decimal format
2010-04-26 17:50:40 +00:00
<data type="string">
<param name="pattern">0x([6-9a-fA-F][0-9a-fA-F]{2}|[0-9a-fA-F]{4})</param>
</data>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">1536</param>
<param name="maxInclusive">65535</param>
</data>
<choice>
<value>arp</value>
nwfilter: allow to mix filterrefs and rules in the schema So far the references to other filters needed to appear before filtering rules. With the below patch they can now appear in any order. Also I forgot to add a couple of 'rarp's.
2010-04-28 13:12:39 +00:00
<value>rarp</value>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<value>ipv4</value>
<value>ipv6</value>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
<value>vlan</value>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</choice>
</choice>
</define>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
<define name="vlan-vlanid">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
Add support for VLAN filtering This patch adds support for filtering of VLAN (802.1Q) traffic to the parser and makes us of the ebtables support for VLAN filtering. This code now enables the filtering of traffic in chains with prefix 'vlan'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-19 12:26:56 +00:00
<data type="string">
<param name="pattern">0x([0-9a-fA-F]{1,3})</param>
</data>
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">4095</param>
</data>
</choice>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<define name="uint16range">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
nwfilter: enable hex number inputs in filter XML With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Changes from V1 to V2: - using asHex boolean in all printf type of functions to select the output format in hex or decimal format
2010-04-26 17:50:40 +00:00
<data type="string">
<param name="pattern">0x[0-9a-fA-F]{1,4}</param>
</data>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">65535</param>
</data>
</choice>
</define>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<define name="uint32range">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
<data type="string">
<param name="pattern">0x[0-9a-fA-F]{1,8}</param>
</data>
Correct invalid RNG schemas The 'trang' utility, which is able to transform '.rng' files into '.rnc' files, reported some errors in our schemas that weren't caught by the tools we use in the build. I haven't added a test for this, but the validity can be checked by the following command: trang -I rng -O rnc domain.rng domain.rnc There were unescaped minuses in regular expressions and we were constraining int (which is by default in the range of [-2^31;2^31-1] to maximum of 2^32. But what we wanted was exactly an unsignedInt.
2013-03-19 11:26:02 +00:00
<data type="unsignedInt"/>
Add support for STP filtering This patch adds support for filtering of STP (spanning tree protocol) traffic to the parser and makes us of the ebtables support for STP filtering. This code now enables the filtering of traffic in chains with prefix 'stp'. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2011-11-22 20:12:03 +00:00
</choice>
</define>
nwfilter: enable filtering of gratuitous ARP packets This patch enables filtering of gratuitous ARP packets using the following XML: <rule action='accept' direction='in' priority='425'> <arp gratuitous='true'/> </rule>
2011-05-23 23:41:18 +00:00
<define name="boolean">
<choice>
<value>yes</value>
<value>no</value>
<value>true</value>
<value>false</value>
<value>1</value>
<value>0</value>
</choice>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<define name="arpOpcodeType">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">65535</param>
</data>
<data type="string">
<param name="pattern">([Rr]eply|[Rr]equest|[Rr]equest_[Rr]everse|[Rr]eply_[Rr]everse|DRARP_[Rr]equest|DRARP_[Rr]eply|DRARP_[Ee]rror|InARP_[Rr]equest|ARP_NAK)</param>
</data>
</choice>
</define>
<define name="ipProtocolType">
<choice>
Introduce possibility to have an iterator per variable This patch introduces the capability to use a different iterator per variable. The currently supported notation of variables in a filtering rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A' srcportstart='$B'/> </rule> processes the two lists 'A' and 'B' in parallel. This means that A and B must have the same number of 'N' elements and that 'N' rules will be instantiated (assuming all tuples from A and B are unique). In this patch we now introduce the assignment of variables to different iterators. Therefore a rule like <rule action='accept' direction='out'> <tcp srcipaddr='$A[@1]' srcportstart='$B[@2]'/> </rule> will now create every combination of elements in A with elements in B since A has been assigned to an iterator with Id '1' and B has been assigned to an iterator with Id '2', thus processing their value independently. The first rule has an equivalent notation of <rule action='accept' direction='out'> <tcp srcipaddr='$A[@0]' srcportstart='$B[@0]'/> </rule>
2012-01-11 11:42:37 +00:00
<ref name="variable-name-type"/>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
nwfilter: enable hex number inputs in filter XML With this patch I want to enable hex number inputs in the filter XML. A number that was entered as hex is also printed as hex unless a string representing the meaning can be found. I am also extending the schema and adding a test case. A problem with the DSCP value is fixed on the way as well. Changes from V1 to V2: - using asHex boolean in all printf type of functions to select the output format in hex or decimal format
2010-04-26 17:50:40 +00:00
<data type="string">
<param name="pattern">0x[0-9a-fA-F]{1,2}</param>
</data>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<data type="int">
<param name="minInclusive">0</param>
<param name="maxInclusive">255</param>
</data>
<choice>
<value>tcp</value>
<value>udp</value>
<value>udplite</value>
<value>esp</value>
<value>ah</value>
<value>icmp</value>
<value>igmp</value>
<value>sctp</value>
<value>icmpv6</value>
</choice>
</choice>
</define>
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="action-type">
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<choice>
<value>drop</value>
<value>accept</value>
nwfilter: enable rejection of packets This patch adds the possibility to not just drop packets, but to also have them rejected where iptables at least sends an ICMP msg back to the originator. On ebtables this again maps into dropping packets since rejecting is not supported. I am adding 'since 0.8.9' to the docs assuming this will be the next version of libvirt.
2011-02-19 01:13:40 +00:00
<value>reject</value>
nwfilter: extend schema to support new targets Extend the nwfilter schema to support the continue and return targets.
2011-10-25 15:21:57 +00:00
<value>continue</value>
<value>return</value>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</choice>
</define>
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="direction-type">
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
<choice>
<value>in</value>
<value>out</value>
<value>inout</value>
</choice>
</define>
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="priority-type">
rng: Fix formatting Some elements are offset just one space compared to their parent, some are misaligned completely, and so on. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
2017-09-07 10:16:04 +00:00
<data type="int">
<param name="minInclusive">-1000</param>
<param name="maxInclusive">1000</param>
</data>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</define>
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="statematch-type">
nwfilter: add XML attribute to control iptables state match This patch adds an optional XML attribute to a nwfilter rule to give the user control over whether the rule is supposed to be using the iptables state match or not. A rule may now look like shown in the XML below with the statematch attribute either having value '0' or 'false' (case-insensitive). [...] <rule action='accept' direction='in' statematch='false'> <tcp srcmacaddr='1:2:3:4:5:6' srcipaddr='10.1.2.3' srcipmask='32' dscp='33' srcportstart='20' srcportend='21' dstportstart='100' dstportend='1111'/> </rule> [...] I am also extending the nwfilter schema and add this attribute to a test case.
2010-06-17 18:12:34 +00:00
<data type="string">
<param name="pattern">([Ff][Aa][Ll][Ss][Ee]|0)</param>
</data>
</define>
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="comment-type">
nwfilter: Extend nwfilter schema to accept comment attrib. Extend the nwfilter.rng schema to accept comment attributes for all protocol types.
2010-09-30 20:00:11 +00:00
<data type="string"/>
</define>
nwfilter: Extend schema to accept state attribute Extend the nwfilter.rng schema to accept state attribute.
2010-10-07 10:44:41 +00:00
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="stateflags-type">
nwfilter: Extend schema to accept state attribute Extend the nwfilter.rng schema to accept state attribute.
2010-10-07 10:44:41 +00:00
<data type="string">
<param name="pattern">((NEW|ESTABLISHED|RELATED|INVALID)(,(NEW|ESTABLISHED|RELATED|INVALID))*|NONE)</param>
</data>
</define>
nwfilters: support for TCP flags evaluation This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
2011-04-08 00:13:38 +00:00
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="tcpflags-type">
nwfilters: support for TCP flags evaluation This patch adds support for the evaluation of TCP flags in nwfilters. It adds documentation to the web page and extends the tests as well. Also, the nwfilter schema is extended. The following are some example for rules using the tcp flags: <rule action='accept' direction='in'> <tcp state='NONE' flags='SYN/ALL' dsptportstart='80'/> </rule> <rule action='drop' direction='in'> <tcp state='NONE' flags='SYN/ALL'/> </rule>
2011-04-08 00:13:38 +00:00
<data type="string">
<param name="pattern">((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)/((SYN|ACK|URG|PSH|FIN|RST)(,(SYN|ACK|URG|PSH|FIN|RST))*|ALL|NONE)</param>
</data>
</define>
nwfilter: Add support for ipset This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan
2012-05-21 10:26:34 +00:00
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="ipset-name-type">
nwfilter: Add support for ipset This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan
2012-05-21 10:26:34 +00:00
<choice>
<ref name="variable-name-type"/>
<data type="string">
<param name="pattern">[a-zA-Z0-9_\.:\-\+ ]{1,31}</param>
</data>
</choice>
</define>
schema: Unify apostrophe and quotation mark usage Quotation marks were used ~ 7000 times, apostrophes ~ 3000 times. Signed-off-by: Tim Wiederhake <twiederh@redhat.com> Reviewed-by: Peter Krempa <pkrempa@redhat.com>
2020-09-30 11:54:58 +00:00
<define name="ipset-flags-type">
nwfilter: Add support for ipset This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan
2012-05-21 10:26:34 +00:00
<data type="string">
schema: nwfilter: Allow all accepted values for 'ipsetflags' The parser for the 'ipsetflags' accepts the 'src' and 'dst' values stripping case. Express the same in the schema to pass validation of any accepted string. Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
2020-10-07 13:37:40 +00:00
<param name="pattern">([Ss][Rr][Cc]|[Dd][Ss][Tt])(,([Ss][Rr][Cc]|[Dd][Ss][Tt])){0,5}</param>
nwfilter: Add support for ipset This patch adds support for the recent ipset iptables extension to libvirt's nwfilter subsystem. Ipset allows to maintain 'sets' of IP addresses, ports and other packet parameters and allows for faster lookup (in the order of O(1) vs. O(n)) and rule evaluation to achieve higher throughput than what can be achieved with individual iptables rules. On the command line iptables supports ipset using iptables ... -m set --match-set <ipset name> <flags> -j ... where 'ipset name' is the name of a previously created ipset and flags is a comma-separated list of up to 6 flags. Flags use 'src' and 'dst' for selecting IP addresses, ports etc. from the source or destination part of a packet. So a concrete example may look like this: iptables -A INPUT -m set --match-set test src,src -j ACCEPT Since ipset management is quite complex, the idea was to leave ipset management outside of libvirt but still allow users to reference an ipset. The user would have to make sure the ipset is available once the VM is started so that the iptables rule(s) referencing the ipset can be created. Using XML to describe an ipset in an nwfilter rule would then look as follows: <rule action='accept' direction='in'> <all ipset='test' ipsetflags='src,src'/> </rule> The two parameters on the command line are also the two distinct XML attributes 'ipset' and 'ipsetflags'. FYI: Here is the man page for ipset: https://ipset.netfilter.org/ipset.man.html Regards, Stefan
2012-05-21 10:26:34 +00:00
</data>
</define>
nwfilter: Add filter schema for nwfilter XML, extend domain XML schema This patch adds a relaxng nwfilter schema along with a test that verifies all the test output XML against the schema. The input XMLs contain a lot of intentional out-of-range values that make them fail the schema verification, so I am not verifying against those.
2010-04-06 15:09:46 +00:00
</grammar>
Reference in New Issue Copy Permalink