External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-05 21:01:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
bbc1b3fc6e
libvirt/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables

275 lines
2.7 KiB
Plaintext
Raw Normal View History

tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_output \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
iifname \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_input \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
oifname \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_cross \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
iifname \
virbr0 \
oifname \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_output \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
iifname \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_input \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
oifname \
virbr0 \
counter \
reject
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_cross \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
iifname \
virbr0 \
oifname \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_output \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip \
saddr \
192.168.122.0/24 \
iifname \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_input \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
oifname \
virbr0 \
ip \
daddr \
192.168.122.0/24 \
ct \
state \
related,established \
counter \
accept
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
'!=' \
192.168.122.0/24 \
counter \
masquerade
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
meta \
l4proto \
udp \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
'!=' \
192.168.122.0/24 \
counter \
masquerade \
to \
:1024-65535
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
meta \
l4proto \
tcp \
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
'!=' \
192.168.122.0/24 \
counter \
masquerade \
to \
:1024-65535
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
255.255.255.255/32 \
counter \
return
nft \
-ae insert \
rule \
ip \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip \
saddr \
192.168.122.0/24 \
ip \
daddr \
224.0.0.0/24 \
counter \
return
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_output \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip6 \
saddr \
2001:db8:ca2:2::/64 \
iifname \
virbr0 \
counter \
accept
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_input \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
oifname \
virbr0 \
ip6 \
daddr \
2001:db8:ca2:2::/64 \
ct \
state \
related,established \
counter \
accept
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip6 \
saddr \
2001:db8:ca2:2::/64 \
ip6 \
daddr \
'!=' \
2001:db8:ca2:2::/64 \
counter \
masquerade
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
meta \
l4proto \
udp \
ip6 \
saddr \
2001:db8:ca2:2::/64 \
ip6 \
daddr \
'!=' \
2001:db8:ca2:2::/64 \
counter \
masquerade \
to \
:1024-65535
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
meta \
l4proto \
tcp \
ip6 \
saddr \
2001:db8:ca2:2::/64 \
ip6 \
daddr \
'!=' \
2001:db8:ca2:2::/64 \
counter \
masquerade \
to \
:1024-65535
nft \
-ae insert \
rule \
ip6 \
network: name the nftables table "libvirt_network" rather than "libvirt" This way when we implement nftables for the nwfilter driver, we can create a separate table called "libvirt_nwfilter" and everything will look all symmetrical and stuff. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:06:55 +00:00
libvirt_network \
network: rename chains used by network driver nftables backend Because the chains added by the network driver nftables backend will go into a table used only by libvirt, we don't need to have "libvirt" in the chain names. Instead, we can make them more descriptive and less abrasive (by using lower case, and using full words rather than abbreviations). Also (again because nobody else is using the private "libvirt_network" table) we can directly put our rules into the input ("guest_to_host"), output ("host_to_guest"), and postrouting ("guest_nat") chains rather than creating a subordinate chain as done in the iptables backend. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-29 18:21:14 +00:00
guest_nat \
tests: test cases for nftables backend Run all the networkxml2firewall tests twice - once with iptables backend, and once with the nftables backend. The results files for the existing iptables tests were previously named *.args. That has been changed to *.iptables, and the results files for the new nftables tests are named *.nftables. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
2024-04-20 02:19:43 +00:00
ip6 \
saddr \
2001:db8:ca2:2::/64 \
ip6 \
daddr \
ff02::/16 \
counter \
return
Reference in New Issue Copy Permalink