External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-07-11 12:25:52 +00:00
Code Issues Packages Projects Releases Wiki Activity
f1a950379d
libvirt/tests/nwfilterxml2firewalldata/comment-linux.args

248 lines
4.3 KiB
Plaintext
Raw Normal View History

tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
ebtables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
--concurrent \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-t nat \
-A libvirt-P-vnet0 \
-p 0x1234 \
-j ACCEPT
ebtables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
--concurrent \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-t nat \
-A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p ipv4 \
--ip-source 10.1.2.3/32 \
--ip-destination 10.1.2.3/32 \
--ip-protocol 17 \
--ip-source-port 291:564 \
--ip-destination-port 13398:17767 \
--ip-tos 0x32 \
-j ACCEPT
ebtables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
--concurrent \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-t nat \
-A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:80 \
-p ipv6 \
tests: Update IPv4-in-IPv6 addresses We have couple of tests where the obsolete IPv4-in-IPv6 notation is used (::10.1.2.3). Change them to the correct format (::ffff:10.1.2.3). Signed-off-by: Michal Privoznik <mprivozn@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com>
2022-03-03 15:57:30 +00:00
--ip6-source ::ffff:10.1.2.3/22 \
--ip6-destination ::ffff:10.1.2.3/113 \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
--ip6-protocol 6 \
--ip6-source-port 273:400 \
--ip6-destination-port 13107:65535 \
-j ACCEPT
ebtables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
--concurrent \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-t nat \
-A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x806 \
--arp-htype 18 \
--arp-opcode 1 \
--arp-ptype 0x56 \
--arp-mac-src 01:02:03:04:05:06 \
--arp-mac-dst 0a:0b:0c:0d:0e:0f \
-j ACCEPT
iptables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FJ-vnet0 \
-p udp \
-m mac \
--mac-source 01:02:03:04:05:06 \
--destination 10.1.2.3/32 \
-m dscp \
--dscp 34 \
--sport 291:400 \
--dport 564:1092 \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate NEW,ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Original \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'udp rule' \
-j RETURN
iptables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FP-vnet0 \
-p udp \
--source 10.1.2.3/32 \
-m dscp \
--dscp 34 \
--dport 291:400 \
--sport 564:1092 \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'udp rule' \
-j ACCEPT
iptables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A HJ-vnet0 \
-p udp \
-m mac \
--mac-source 01:02:03:04:05:06 \
--destination 10.1.2.3/32 \
-m dscp \
--dscp 34 \
--sport 291:400 \
--dport 564:1092 \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate NEW,ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Original \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'udp rule' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FJ-vnet0 \
-p tcp \
--destination a:b:c::/128 \
-m dscp \
--dscp 57 \
--dport 32:33 \
--sport 256:4369 \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'tcp/ipv6 rule' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FP-vnet0 \
-p tcp \
-m mac \
--mac-source 01:02:03:04:05:06 \
--source a:b:c::/128 \
-m dscp \
--dscp 57 \
--sport 32:33 \
--dport 256:4369 \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate NEW,ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Original \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'tcp/ipv6 rule' \
-j ACCEPT
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A HJ-vnet0 \
-p tcp \
--destination a:b:c::/128 \
-m dscp \
--dscp 57 \
--dport 32:33 \
--sport 256:4369 \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'tcp/ipv6 rule' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FJ-vnet0 \
-p udp \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FP-vnet0 \
-p udp \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate NEW,ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Original \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \
-j ACCEPT
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A HJ-vnet0 \
-p udp \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FJ-vnet0 \
-p sctp \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FP-vnet0 \
-p sctp \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate NEW,ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Original \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \
-j ACCEPT
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A HJ-vnet0 \
-p sctp \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
--comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FJ-vnet0 \
-p ah \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
nwfilterxml2firewalldata: Use internal wrapping to wrap output files As with previous commits use virCommandSetDryRun to invoke virCommandToString so that it returns pre-wrapped string. Since virCommand is better aware of where the arguments terminate we can see an improvement where comments are no longer line-wrapped. The changes to the 'commonRules' strings were done with the following regex: s/ -/ \\\\\\n-/ Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2021-04-06 12:19:40 +00:00
--comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-j RETURN
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A FP-vnet0 \
-p ah \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate NEW,ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Original \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
nwfilterxml2firewalldata: Use internal wrapping to wrap output files As with previous commits use virCommandSetDryRun to invoke virCommandToString so that it returns pre-wrapped string. Since virCommand is better aware of where the arguments terminate we can see an improvement where comments are no longer line-wrapped. The changes to the 'commonRules' strings were done with the following regex: s/ -/ \\\\\\n-/ Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2021-04-06 12:19:40 +00:00
--comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-j ACCEPT
ip6tables \
util/tests: enable locking on iptables/ebtables commandlines in unit tests All the unit tests that use iptables/ip6tables/ebtables have been written to omit the locking/exclusive use primitive on the generated commandlines. Even though none of the tests actually execute those commands (and so it doesn't matter for purposes of the test whether or not the commands support these options), it still made sense when some systems had these locking options and some didn't. We are now at a point where every supported Linux distro has supported the locking options on these commands for quite a long time, and are going to make their use non-optional. As a first step, this patch uses the virFirewallSetLockOverride() function, which is called at the beginning of all firewall-related tests, to set all the bools controlling whether or not the locking options are used to true. This means that all the test cases must be updated to include the proper locking option in their commandlines. The change to make actual execs of the commands unconditionally use the locking option will be in an upcoming patch - this one affects only the unit tests. Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
2020-11-17 00:20:53 +00:00
-w \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-A HJ-vnet0 \
-p ah \
nwfilter: drop support for legacy iptables match syntax Long ago we adapted to iptables changes by introducing support for '-m conntrack': commit 06844ccbaa8544d7d08d568aff37bc4e3648f304 Author: Stefan Berger <stefanb@us.ibm.com> Date: Tue Aug 6 20:30:46 2013 -0400 nwfilter: Use -m conntrack rather than -m state Since iptables version 1.4.16 '-m state --state NEW' is converted to '-m conntrack --ctstate NEW'. Therefore, when encountering this or later versions of iptables use '-m conntrack --ctstate'. Given our supported platform targets, we no longer need to consider a version of iptables before 1.4.16, so can drop support for the old syntax. The test suite updates are triggered because that never probed for the new syntax, and so unconditionally generated the old syntax. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:24:21 +00:00
-m conntrack \
--ctstate ESTABLISHED \
nwfilter: drop support for legacy iptables conntrack direction Long ago we adapted to Linux kernel changes which inverted the behaviour of the conntrack --ctdir setting: commit a6a04ea47a8143ba46150889d8dae1c861df6389 Author: Stefan Berger <stefanb@us.ibm.com> Date: Wed May 15 21:02:11 2013 -0400 nwfilter: check for inverted ctdir Linux netfilter at some point (Linux 2.6.39) inverted the meaning of the '--ctdir reply' and newer netfilter implementations now expect '--ctdir original' instead and vice-versa. We check for the kernel version and assume that all Linux kernels with version 2.6.39 have the newer inverted logic. Any distro backporting the Linux kernel patch that inverts the --ctdir logic (Linux commit 96120d86f) must also backport this patch for Linux and adapt the kernel version being tested for. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> Given our supported platform targets, we no longer need to consider a version of Linux before 2.6.39, so can drop support for the old direction behaviour. The test suite updates are triggered because that never probed for the ctdir direction, and so the iptables syntax generator unconditionally dropped the ctdir args. Reviewed-by: Laine Stump <laine@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-25 16:28:32 +00:00
-m conntrack \
--ctdir Reply \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-m comment \
nwfilterxml2firewalldata: Use internal wrapping to wrap output files As with previous commits use virCommandSetDryRun to invoke virCommandToString so that it returns pre-wrapped string. Since virCommand is better aware of where the arguments terminate we can see an improvement where comments are no longer line-wrapped. The changes to the 'commonRules' strings were done with the following regex: s/ -/ \\\\\\n-/ Signed-off-by: Peter Krempa <pkrempa@redhat.com> Reviewed-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
2021-04-06 12:19:40 +00:00
--comment 'tmp=`mktemp`; echo ${RANDOM} > ${tmp} ; cat < ${tmp}; rm -f ${tmp}' \
tests: redo test argv file line wrapping Back in commit bd6c46fa0cfe275c24debc1152cfc5206c04b59b Author: Juerg Haefliger <juerg.haefliger@hp.com> Date: Mon Jan 31 06:42:57 2011 -0500 tests: handle backspace-newline pairs in test input files all the test argv files were line wrapped so that the args were less than 80 characters. The way the line wrapping was done turns out to be quite undesirable, because it often leaves multiple parameters on the same line. If we later need to add or remove individual parameters, then it leaves us having to redo line wrapping. This commit changes the line wrapping so that every single "-param value" is one its own new line. If the "value" is still too long, then we break on ',' or ':' or ' ' as needed. This means that when we come to add / remove parameters from the test files line, the patch diffs will only ever show a single line added/removed which will greatly simplify review work. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2015-11-06 13:20:06 +00:00
-j RETURN
Reference in New Issue Copy Permalink