External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 13:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

util/tests: enable locking on iptables/ebtables commandlines in unit tests

Browse Source 
All the unit tests that use iptables/ip6tables/ebtables have been
written to omit the locking/exclusive use primitive on the generated
commandlines. Even though none of the tests actually execute those
commands (and so it doesn't matter for purposes of the test whether or
not the commands support these options), it still made sense when some
systems had these locking options and some didn't.

We are now at a point where every supported Linux distro has supported
the locking options on these commands for quite a long time, and are
going to make their use non-optional. As a first step, this patch uses
the virFirewallSetLockOverride() function, which is called at the
beginning of all firewall-related tests, to set all the bools
controlling whether or not the locking options are used to true. This
means that all the test cases must be updated to include the proper
locking option in their commandlines.

The change to make actual execs of the commands unconditionally use
the locking option will be in an upcoming patch - this one affects
only the unit tests.

Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
This commit is contained in:
Laine Stump 2020-11-16 19:20:53 -05:00
parent 28a3dedddd
commit e66451f685
51 changed files with 1115 additions and 358 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/util/virfirewall.c
View File

@ -105,6 +105,12 @@ void
virFirewallSetLockOverride(bool avoid) virFirewallSetLockOverride(bool avoid)
{ {
lockOverride = avoid; lockOverride = avoid;
if (avoid) {
/* add the lock option to all commands */
iptablesUseLock = true;
ip6tablesUseLock = true;
ebtablesUseLock = true;
}
} }
static void static void

34
tests/networkxml2firewalldata/base.args
View File

@ -1,116 +1,150 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--list-rules --list-rules
iptables \ iptables \
-w \
--table nat \ --table nat \
--list-rules --list-rules
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--list-rules --list-rules
iptables \ iptables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_INP --new-chain LIBVIRT_INP
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert INPUT \ --insert INPUT \
--jump LIBVIRT_INP --jump LIBVIRT_INP
iptables \ iptables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_OUT --new-chain LIBVIRT_OUT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert OUTPUT \ --insert OUTPUT \
--jump LIBVIRT_OUT --jump LIBVIRT_OUT
iptables \ iptables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_FWO --new-chain LIBVIRT_FWO
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert FORWARD \ --insert FORWARD \
--jump LIBVIRT_FWO --jump LIBVIRT_FWO
iptables \ iptables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_FWI --new-chain LIBVIRT_FWI
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert FORWARD \ --insert FORWARD \
--jump LIBVIRT_FWI --jump LIBVIRT_FWI
iptables \ iptables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_FWX --new-chain LIBVIRT_FWX
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert FORWARD \ --insert FORWARD \
--jump LIBVIRT_FWX --jump LIBVIRT_FWX
iptables \ iptables \
-w \
--table nat \ --table nat \
--new-chain LIBVIRT_PRT --new-chain LIBVIRT_PRT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert POSTROUTING \ --insert POSTROUTING \
--jump LIBVIRT_PRT --jump LIBVIRT_PRT
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--new-chain LIBVIRT_PRT --new-chain LIBVIRT_PRT
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert POSTROUTING \ --insert POSTROUTING \
--jump LIBVIRT_PRT --jump LIBVIRT_PRT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--list-rules --list-rules
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--list-rules --list-rules
ip6tables \ ip6tables \
-w \
--table mangle \ --table mangle \
--list-rules --list-rules
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_INP --new-chain LIBVIRT_INP
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert INPUT \ --insert INPUT \
--jump LIBVIRT_INP --jump LIBVIRT_INP
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_OUT --new-chain LIBVIRT_OUT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert OUTPUT \ --insert OUTPUT \
--jump LIBVIRT_OUT --jump LIBVIRT_OUT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_FWO --new-chain LIBVIRT_FWO
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert FORWARD \ --insert FORWARD \
--jump LIBVIRT_FWO --jump LIBVIRT_FWO
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_FWI --new-chain LIBVIRT_FWI
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert FORWARD \ --insert FORWARD \
--jump LIBVIRT_FWI --jump LIBVIRT_FWI
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--new-chain LIBVIRT_FWX --new-chain LIBVIRT_FWX
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert FORWARD \ --insert FORWARD \
--jump LIBVIRT_FWX --jump LIBVIRT_FWX
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--new-chain LIBVIRT_PRT --new-chain LIBVIRT_PRT
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--insert POSTROUTING \ --insert POSTROUTING \
--jump LIBVIRT_PRT --jump LIBVIRT_PRT
ip6tables \ ip6tables \
-w \
--table mangle \ --table mangle \
--new-chain LIBVIRT_PRT --new-chain LIBVIRT_PRT
ip6tables \ ip6tables \
-w \
--table mangle \ --table mangle \
--insert POSTROUTING \ --insert POSTROUTING \
--jump LIBVIRT_PRT --jump LIBVIRT_PRT

19
tests/networkxml2firewalldata/nat-default-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,28 +63,33 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
@ -85,12 +98,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 '!' \ --source 192.168.122.0/24 '!' \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -99,6 +114,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -107,18 +123,21 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--out-interface virbr0 \ --out-interface virbr0 \

30
tests/networkxml2firewalldata/nat-ipv6-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,38 +63,45 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -94,6 +109,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -101,6 +117,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -108,6 +125,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -115,6 +133,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -122,6 +141,7 @@ ip6tables \
--destination-port 547 \ --destination-port 547 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -129,12 +149,14 @@ ip6tables \
--destination-port 546 \ --destination-port 546 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
@ -143,12 +165,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 '!' \ --source 192.168.122.0/24 '!' \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -157,6 +181,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -165,30 +190,35 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 2001:db8:ca2:2::/64 \ --source 2001:db8:ca2:2::/64 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 2001:db8:ca2:2::/64 \ --destination 2001:db8:ca2:2::/64 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--out-interface virbr0 \ --out-interface virbr0 \

34
tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,38 +63,45 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -94,6 +109,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -101,6 +117,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -108,6 +125,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -115,6 +133,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -122,6 +141,7 @@ ip6tables \
--destination-port 547 \ --destination-port 547 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -129,12 +149,14 @@ ip6tables \
--destination-port 546 \ --destination-port 546 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
@ -143,12 +165,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 '!' \ --source 192.168.122.0/24 '!' \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -157,6 +181,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -165,24 +190,28 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 2001:db8:ca2:2::/64 \ --source 2001:db8:ca2:2::/64 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 2001:db8:ca2:2::/64 \ --destination 2001:db8:ca2:2::/64 \
@ -191,12 +220,14 @@ ip6tables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 2001:db8:ca2:2::/64 '!' \ --source 2001:db8:ca2:2::/64 '!' \
--destination 2001:db8:ca2:2::/64 \ --destination 2001:db8:ca2:2::/64 \
--jump MASQUERADE --jump MASQUERADE
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 2001:db8:ca2:2::/64 \ --source 2001:db8:ca2:2::/64 \
@ -205,6 +236,7 @@ ip6tables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 2001:db8:ca2:2::/64 \ --source 2001:db8:ca2:2::/64 \
@ -213,12 +245,14 @@ ip6tables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
ip6tables \ ip6tables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 2001:db8:ca2:2::/64 \ --source 2001:db8:ca2:2::/64 \
--destination ff02::/16 \ --destination ff02::/16 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--out-interface virbr0 \ --out-interface virbr0 \

33
tests/networkxml2firewalldata/nat-many-ips-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,28 +63,33 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
@ -85,12 +98,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 '!' \ --source 192.168.122.0/24 '!' \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -99,6 +114,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -107,24 +123,28 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.128.0/24 \ --source 192.168.128.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.128.0/24 \ --destination 192.168.128.0/24 \
@ -133,12 +153,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.128.0/24 '!' \ --source 192.168.128.0/24 '!' \
--destination 192.168.128.0/24 \ --destination 192.168.128.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.128.0/24 \ --source 192.168.128.0/24 \
@ -147,6 +169,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.128.0/24 \ --source 192.168.128.0/24 \
@ -155,24 +178,28 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.128.0/24 \ --source 192.168.128.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.128.0/24 \ --source 192.168.128.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.150.0/24 \ --source 192.168.150.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.150.0/24 \ --destination 192.168.150.0/24 \
@ -181,12 +208,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.150.0/24 '!' \ --source 192.168.150.0/24 '!' \
--destination 192.168.150.0/24 \ --destination 192.168.150.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.150.0/24 \ --source 192.168.150.0/24 \
@ -195,6 +224,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.150.0/24 \ --source 192.168.150.0/24 \
@ -203,18 +233,21 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.150.0/24 \ --source 192.168.150.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.150.0/24 \ --source 192.168.150.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--out-interface virbr0 \ --out-interface virbr0 \

29
tests/networkxml2firewalldata/nat-no-dhcp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,38 +63,45 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -94,6 +109,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -101,6 +117,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -108,6 +125,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -115,6 +133,7 @@ ip6tables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -122,6 +141,7 @@ ip6tables \
--destination-port 547 \ --destination-port 547 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -129,12 +149,14 @@ ip6tables \
--destination-port 546 \ --destination-port 546 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
@ -143,12 +165,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 '!' \ --source 192.168.122.0/24 '!' \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -157,6 +181,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -165,24 +190,28 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 2001:db8:ca2:2::/64 \ --source 2001:db8:ca2:2::/64 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
ip6tables \ ip6tables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 2001:db8:ca2:2::/64 \ --destination 2001:db8:ca2:2::/64 \

21
tests/networkxml2firewalldata/nat-tftp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,6 +63,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -62,6 +71,7 @@ iptables \
--destination-port 69 \ --destination-port 69 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -69,28 +79,33 @@ iptables \
--destination-port 69 \ --destination-port 69 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
@ -99,12 +114,14 @@ iptables \
--ctstate ESTABLISHED,RELATED \ --ctstate ESTABLISHED,RELATED \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 '!' \ --source 192.168.122.0/24 '!' \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--jump MASQUERADE --jump MASQUERADE
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -113,6 +130,7 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
@ -121,18 +139,21 @@ iptables \
--jump MASQUERADE \ --jump MASQUERADE \
--to-ports 1024-65535 --to-ports 1024-65535
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 255.255.255.255/32 \ --destination 255.255.255.255/32 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table nat \ --table nat \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--destination 224.0.0.0/24 \ --destination 224.0.0.0/24 \
--jump RETURN --jump RETURN
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--out-interface virbr0 \ --out-interface virbr0 \

14
tests/networkxml2firewalldata/route-default-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -6,6 +7,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -13,6 +15,7 @@ iptables \
--destination-port 67 \ --destination-port 67 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -20,6 +23,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -27,6 +31,7 @@ iptables \
--destination-port 68 \ --destination-port 68 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -34,6 +39,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_INP \ --insert LIBVIRT_INP \
--in-interface virbr0 \ --in-interface virbr0 \
@ -41,6 +47,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -48,6 +55,7 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_OUT \ --insert LIBVIRT_OUT \
--out-interface virbr0 \ --out-interface virbr0 \
@ -55,34 +63,40 @@ iptables \
--destination-port 53 \ --destination-port 53 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--in-interface virbr0 \ --in-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--out-interface virbr0 \ --out-interface virbr0 \
--jump REJECT --jump REJECT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWX \ --insert LIBVIRT_FWX \
--in-interface virbr0 \ --in-interface virbr0 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWO \ --insert LIBVIRT_FWO \
--source 192.168.122.0/24 \ --source 192.168.122.0/24 \
--in-interface virbr0 \ --in-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table filter \ --table filter \
--insert LIBVIRT_FWI \ --insert LIBVIRT_FWI \
--destination 192.168.122.0/24 \ --destination 192.168.122.0/24 \
--out-interface virbr0 \ --out-interface virbr0 \
--jump ACCEPT --jump ACCEPT
iptables \ iptables \
-w \
--table mangle \ --table mangle \
--insert LIBVIRT_PRT \ --insert LIBVIRT_PRT \
--out-interface virbr0 \ --out-interface virbr0 \

464
tests/nwfilterebiptablestest.c
View File

@ -36,34 +36,34 @@
#define VIR_NWFILTER_NEW_RULES_TEARDOWN \ #define VIR_NWFILTER_NEW_RULES_TEARDOWN \
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
"iptables -F FP-vnet0\n" \ "iptables -w -F FP-vnet0\n" \
"iptables -X FP-vnet0\n" \ "iptables -w -X FP-vnet0\n" \
"iptables -F FJ-vnet0\n" \ "iptables -w -F FJ-vnet0\n" \
"iptables -X FJ-vnet0\n" \ "iptables -w -X FJ-vnet0\n" \
"iptables -F HJ-vnet0\n" \ "iptables -w -F HJ-vnet0\n" \
"iptables -X HJ-vnet0\n" \ "iptables -w -X HJ-vnet0\n" \
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
"ip6tables -F FP-vnet0\n" \ "ip6tables -w -F FP-vnet0\n" \
"ip6tables -X FP-vnet0\n" \ "ip6tables -w -X FP-vnet0\n" \
"ip6tables -F FJ-vnet0\n" \ "ip6tables -w -F FJ-vnet0\n" \
"ip6tables -X FJ-vnet0\n" \ "ip6tables -w -X FJ-vnet0\n" \
"ip6tables -F HJ-vnet0\n" \ "ip6tables -w -F HJ-vnet0\n" \
"ip6tables -X HJ-vnet0\n" \ "ip6tables -w -X HJ-vnet0\n" \
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \
"ebtables -t nat -L libvirt-J-vnet0\n" \ "ebtables --concurrent -t nat -L libvirt-J-vnet0\n" \
"ebtables -t nat -L libvirt-P-vnet0\n" \ "ebtables --concurrent -t nat -L libvirt-P-vnet0\n" \
"ebtables -t nat -F libvirt-J-vnet0\n" \ "ebtables --concurrent -t nat -F libvirt-J-vnet0\n" \
"ebtables -t nat -X libvirt-J-vnet0\n" \ "ebtables --concurrent -t nat -X libvirt-J-vnet0\n" \
"ebtables -t nat -F libvirt-P-vnet0\n" \ "ebtables --concurrent -t nat -F libvirt-P-vnet0\n" \
"ebtables -t nat -X libvirt-P-vnet0\n" "ebtables --concurrent -t nat -X libvirt-P-vnet0\n"
static int static int
testNWFilterEBIPTablesAllTeardown(const void *opaque G_GNUC_UNUSED) testNWFilterEBIPTablesAllTeardown(const void *opaque G_GNUC_UNUSED)
@ -71,36 +71,36 @@ testNWFilterEBIPTablesAllTeardown(const void *opaque G_GNUC_UNUSED)
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"iptables -F FO-vnet0\n" "iptables -w -F FO-vnet0\n"
"iptables -X FO-vnet0\n" "iptables -w -X FO-vnet0\n"
"iptables -F FI-vnet0\n" "iptables -w -F FI-vnet0\n"
"iptables -X FI-vnet0\n" "iptables -w -X FI-vnet0\n"
"iptables -F HI-vnet0\n" "iptables -w -F HI-vnet0\n"
"iptables -X HI-vnet0\n" "iptables -w -X HI-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"ip6tables -F FO-vnet0\n" "ip6tables -w -F FO-vnet0\n"
"ip6tables -X FO-vnet0\n" "ip6tables -w -X FO-vnet0\n"
"ip6tables -F FI-vnet0\n" "ip6tables -w -F FI-vnet0\n"
"ip6tables -X FI-vnet0\n" "ip6tables -w -X FI-vnet0\n"
"ip6tables -F HI-vnet0\n" "ip6tables -w -F HI-vnet0\n"
"ip6tables -X HI-vnet0\n" "ip6tables -w -X HI-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n" "ebtables --concurrent -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n" "ebtables --concurrent -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n" "ebtables --concurrent -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n" "ebtables --concurrent -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n" "ebtables --concurrent -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n"; "ebtables --concurrent -t nat -X libvirt-O-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;
@ -130,44 +130,44 @@ testNWFilterEBIPTablesTearOldRules(const void *opaque G_GNUC_UNUSED)
{ {
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"iptables -F FO-vnet0\n" "iptables -w -F FO-vnet0\n"
"iptables -X FO-vnet0\n" "iptables -w -X FO-vnet0\n"
"iptables -F FI-vnet0\n" "iptables -w -F FI-vnet0\n"
"iptables -X FI-vnet0\n" "iptables -w -X FI-vnet0\n"
"iptables -F HI-vnet0\n" "iptables -w -F HI-vnet0\n"
"iptables -X HI-vnet0\n" "iptables -w -X HI-vnet0\n"
"iptables -E FP-vnet0 FO-vnet0\n" "iptables -w -E FP-vnet0 FO-vnet0\n"
"iptables -E FJ-vnet0 FI-vnet0\n" "iptables -w -E FJ-vnet0 FI-vnet0\n"
"iptables -E HJ-vnet0 HI-vnet0\n" "iptables -w -E HJ-vnet0 HI-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"ip6tables -F FO-vnet0\n" "ip6tables -w -F FO-vnet0\n"
"ip6tables -X FO-vnet0\n" "ip6tables -w -X FO-vnet0\n"
"ip6tables -F FI-vnet0\n" "ip6tables -w -F FI-vnet0\n"
"ip6tables -X FI-vnet0\n" "ip6tables -w -X FI-vnet0\n"
"ip6tables -F HI-vnet0\n" "ip6tables -w -F HI-vnet0\n"
"ip6tables -X HI-vnet0\n" "ip6tables -w -X HI-vnet0\n"
"ip6tables -E FP-vnet0 FO-vnet0\n" "ip6tables -w -E FP-vnet0 FO-vnet0\n"
"ip6tables -E FJ-vnet0 FI-vnet0\n" "ip6tables -w -E FJ-vnet0 FI-vnet0\n"
"ip6tables -E HJ-vnet0 HI-vnet0\n" "ip6tables -w -E HJ-vnet0 HI-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n" "ebtables --concurrent -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n" "ebtables --concurrent -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n" "ebtables --concurrent -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n" "ebtables --concurrent -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n" "ebtables --concurrent -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n" "ebtables --concurrent -t nat -X libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-J-vnet0\n" "ebtables --concurrent -t nat -L libvirt-J-vnet0\n"
"ebtables -t nat -L libvirt-P-vnet0\n" "ebtables --concurrent -t nat -L libvirt-P-vnet0\n"
"ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n"
"ebtables -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; "ebtables --concurrent -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;
@ -197,22 +197,22 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque G_GNUC_UNUSED)
{ {
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n" "ebtables --concurrent -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n" "ebtables --concurrent -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n" "ebtables --concurrent -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n" "ebtables --concurrent -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n" "ebtables --concurrent -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n" "ebtables --concurrent -t nat -X libvirt-O-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -L libvirt-J-vnet0\n" "ebtables --concurrent -t nat -L libvirt-J-vnet0\n"
"ebtables -t nat -L libvirt-P-vnet0\n" "ebtables --concurrent -t nat -L libvirt-P-vnet0\n"
"ebtables -t nat -F libvirt-J-vnet0\n" "ebtables --concurrent -t nat -F libvirt-J-vnet0\n"
"ebtables -t nat -X libvirt-J-vnet0\n" "ebtables --concurrent -t nat -X libvirt-J-vnet0\n"
"ebtables -t nat -F libvirt-P-vnet0\n" "ebtables --concurrent -t nat -F libvirt-P-vnet0\n"
"ebtables -t nat -X libvirt-P-vnet0\n"; "ebtables --concurrent -t nat -X libvirt-P-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;
@ -273,43 +273,43 @@ testNWFilterEBIPTablesApplyBasicRules(const void *opaque G_GNUC_UNUSED)
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"iptables -F FO-vnet0\n" "iptables -w -F FO-vnet0\n"
"iptables -X FO-vnet0\n" "iptables -w -X FO-vnet0\n"
"iptables -F FI-vnet0\n" "iptables -w -F FI-vnet0\n"
"iptables -X FI-vnet0\n" "iptables -w -X FI-vnet0\n"
"iptables -F HI-vnet0\n" "iptables -w -F HI-vnet0\n"
"iptables -X HI-vnet0\n" "iptables -w -X HI-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"ip6tables -F FO-vnet0\n" "ip6tables -w -F FO-vnet0\n"
"ip6tables -X FO-vnet0\n" "ip6tables -w -X FO-vnet0\n"
"ip6tables -F FI-vnet0\n" "ip6tables -w -F FI-vnet0\n"
"ip6tables -X FI-vnet0\n" "ip6tables -w -X FI-vnet0\n"
"ip6tables -F HI-vnet0\n" "ip6tables -w -F HI-vnet0\n"
"ip6tables -X HI-vnet0\n" "ip6tables -w -X HI-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n" "ebtables --concurrent -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n" "ebtables --concurrent -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n" "ebtables --concurrent -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n" "ebtables --concurrent -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n" "ebtables --concurrent -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n" "ebtables --concurrent -t nat -X libvirt-O-vnet0\n"
"ebtables -t nat -N libvirt-J-vnet0\n" "ebtables --concurrent -t nat -N libvirt-J-vnet0\n"
"ebtables -t nat -A libvirt-J-vnet0 -s '!' 10:20:30:40:50:60 -j DROP\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -s '!' 10:20:30:40:50:60 -j DROP\n"
"ebtables -t nat -A libvirt-J-vnet0 -p IPv4 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -p IPv4 -j ACCEPT\n"
"ebtables -t nat -A libvirt-J-vnet0 -p ARP -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -p ARP -j ACCEPT\n"
"ebtables -t nat -A libvirt-J-vnet0 -j DROP\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -j DROP\n"
"ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n"; "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;
virMacAddr mac = { .addr = { 0x10, 0x20, 0x30, 0x40, 0x50, 0x60 } }; virMacAddr mac = { .addr = { 0x10, 0x20, 0x30, 0x40, 0x50, 0x60 } };
@ -341,51 +341,51 @@ testNWFilterEBIPTablesApplyDHCPOnlyRules(const void *opaque G_GNUC_UNUSED)
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"iptables -F FO-vnet0\n" "iptables -w -F FO-vnet0\n"
"iptables -X FO-vnet0\n" "iptables -w -X FO-vnet0\n"
"iptables -F FI-vnet0\n" "iptables -w -F FI-vnet0\n"
"iptables -X FI-vnet0\n" "iptables -w -X FI-vnet0\n"
"iptables -F HI-vnet0\n" "iptables -w -F HI-vnet0\n"
"iptables -X HI-vnet0\n" "iptables -w -X HI-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"ip6tables -F FO-vnet0\n" "ip6tables -w -F FO-vnet0\n"
"ip6tables -X FO-vnet0\n" "ip6tables -w -X FO-vnet0\n"
"ip6tables -F FI-vnet0\n" "ip6tables -w -F FI-vnet0\n"
"ip6tables -X FI-vnet0\n" "ip6tables -w -X FI-vnet0\n"
"ip6tables -F HI-vnet0\n" "ip6tables -w -F HI-vnet0\n"
"ip6tables -X HI-vnet0\n" "ip6tables -w -X HI-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n" "ebtables --concurrent -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n" "ebtables --concurrent -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n" "ebtables --concurrent -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n" "ebtables --concurrent -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n" "ebtables --concurrent -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n" "ebtables --concurrent -t nat -X libvirt-O-vnet0\n"
"ebtables -t nat -N libvirt-J-vnet0\n" "ebtables --concurrent -t nat -N libvirt-J-vnet0\n"
"ebtables -t nat -N libvirt-P-vnet0\n" "ebtables --concurrent -t nat -N libvirt-P-vnet0\n"
"ebtables -t nat -A libvirt-J-vnet0 -s 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-sport 68 --ip-dport 67 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -s 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-sport 68 --ip-dport 67 -j ACCEPT\n"
"ebtables -t nat -A libvirt-J-vnet0 -j DROP\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -j DROP\n"
"ebtables -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n"
"ebtables -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n"
"ebtables -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n"
"ebtables -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n"
"ebtables -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n"
"ebtables -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n"
"ebtables -t nat -A libvirt-P-vnet0 -j DROP\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -j DROP\n"
"ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" "ebtables --concurrent -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n"
"ebtables -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; "ebtables --concurrent -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;
virMacAddr mac = { .addr = { 0x10, 0x20, 0x30, 0x40, 0x50, 0x60 } }; virMacAddr mac = { .addr = { 0x10, 0x20, 0x30, 0x40, 0x50, 0x60 } };
@ -428,44 +428,44 @@ testNWFilterEBIPTablesApplyDropAllRules(const void *opaque G_GNUC_UNUSED)
g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER;
const char *expected = const char *expected =
VIR_NWFILTER_NEW_RULES_TEARDOWN VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"iptables -F FO-vnet0\n" "iptables -w -F FO-vnet0\n"
"iptables -X FO-vnet0\n" "iptables -w -X FO-vnet0\n"
"iptables -F FI-vnet0\n" "iptables -w -F FI-vnet0\n"
"iptables -X FI-vnet0\n" "iptables -w -X FI-vnet0\n"
"iptables -F HI-vnet0\n" "iptables -w -F HI-vnet0\n"
"iptables -X HI-vnet0\n" "iptables -w -X HI-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n"
"ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"ip6tables -F FO-vnet0\n" "ip6tables -w -F FO-vnet0\n"
"ip6tables -X FO-vnet0\n" "ip6tables -w -X FO-vnet0\n"
"ip6tables -F FI-vnet0\n" "ip6tables -w -F FI-vnet0\n"
"ip6tables -X FI-vnet0\n" "ip6tables -w -X FI-vnet0\n"
"ip6tables -F HI-vnet0\n" "ip6tables -w -F HI-vnet0\n"
"ip6tables -X HI-vnet0\n" "ip6tables -w -X HI-vnet0\n"
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n"
"ebtables -t nat -L libvirt-I-vnet0\n" "ebtables --concurrent -t nat -L libvirt-I-vnet0\n"
"ebtables -t nat -L libvirt-O-vnet0\n" "ebtables --concurrent -t nat -L libvirt-O-vnet0\n"
"ebtables -t nat -F libvirt-I-vnet0\n" "ebtables --concurrent -t nat -F libvirt-I-vnet0\n"
"ebtables -t nat -X libvirt-I-vnet0\n" "ebtables --concurrent -t nat -X libvirt-I-vnet0\n"
"ebtables -t nat -F libvirt-O-vnet0\n" "ebtables --concurrent -t nat -F libvirt-O-vnet0\n"
"ebtables -t nat -X libvirt-O-vnet0\n" "ebtables --concurrent -t nat -X libvirt-O-vnet0\n"
"ebtables -t nat -N libvirt-J-vnet0\n" "ebtables --concurrent -t nat -N libvirt-J-vnet0\n"
"ebtables -t nat -N libvirt-P-vnet0\n" "ebtables --concurrent -t nat -N libvirt-P-vnet0\n"
"ebtables -t nat -A libvirt-J-vnet0 -j DROP\n" "ebtables --concurrent -t nat -A libvirt-J-vnet0 -j DROP\n"
"ebtables -t nat -A libvirt-P-vnet0 -j DROP\n" "ebtables --concurrent -t nat -A libvirt-P-vnet0 -j DROP\n"
"ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" "ebtables --concurrent -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n"
"ebtables -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; "ebtables --concurrent -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n";
char *actual = NULL; char *actual = NULL;
int ret = -1; int ret = -1;

9
tests/nwfilterxml2firewalldata/ah-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -11,6 +12,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
--destination f:e:d::c:b:a/127 \ --destination f:e:d::c:b:a/127 \
@ -21,6 +23,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -33,6 +36,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -42,6 +46,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -53,6 +58,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -62,6 +68,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -71,6 +78,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -82,6 +90,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

9
tests/nwfilterxml2firewalldata/ah-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -39,6 +43,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -50,6 +55,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -59,6 +65,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -68,6 +75,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
-m mac \ -m mac \
@ -79,6 +87,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \

9
tests/nwfilterxml2firewalldata/all-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -11,6 +12,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
--destination f:e:d::c:b:a/127 \ --destination f:e:d::c:b:a/127 \
@ -21,6 +23,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -33,6 +36,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -42,6 +46,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -53,6 +58,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -62,6 +68,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -71,6 +78,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -82,6 +90,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

9
tests/nwfilterxml2firewalldata/all-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -39,6 +43,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -50,6 +55,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -59,6 +65,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -68,6 +75,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -79,6 +87,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \

5
tests/nwfilterxml2firewalldata/arp-linux.args
View File

@ -1,4 +1,5 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -11,6 +12,7 @@ ebtables \
--arp-mac-dst 0a:0b:0c:0d:0e:0f \ --arp-mac-dst 0a:0b:0c:0d:0e:0f \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -20,6 +22,7 @@ ebtables \
--arp-ptype 0xff \ --arp-ptype 0xff \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -29,6 +32,7 @@ ebtables \
--arp-ptype 0x100 \ --arp-ptype 0x100 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -38,6 +42,7 @@ ebtables \
--arp-ptype 0xffff \ --arp-ptype 0xffff \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p 0x806 \ -p 0x806 \

19
tests/nwfilterxml2firewalldata/comment-linux.args
View File

@ -1,9 +1,11 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p 0x1234 \ -p 0x1234 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -17,6 +19,7 @@ ebtables \
--ip-tos 0x32 \ --ip-tos 0x32 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \
@ -29,6 +32,7 @@ ebtables \
--ip6-destination-port 13107:65535 \ --ip6-destination-port 13107:65535 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -41,6 +45,7 @@ ebtables \
--arp-mac-dst 0a:0b:0c:0d:0e:0f \ --arp-mac-dst 0a:0b:0c:0d:0e:0f \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -56,6 +61,7 @@ iptables \
--comment 'udp rule' \ --comment 'udp rule' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -69,6 +75,7 @@ iptables \
--comment 'udp rule' \ --comment 'udp rule' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -84,6 +91,7 @@ iptables \
--comment 'udp rule' \ --comment 'udp rule' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -97,6 +105,7 @@ ip6tables \
--comment 'tcp/ipv6 rule' \ --comment 'tcp/ipv6 rule' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -112,6 +121,7 @@ ip6tables \
--comment 'tcp/ipv6 rule' \ --comment 'tcp/ipv6 rule' \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -125,6 +135,7 @@ ip6tables \
--comment 'tcp/ipv6 rule' \ --comment 'tcp/ipv6 rule' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
-m state \ -m state \
@ -133,6 +144,7 @@ ip6tables \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \ --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
-m state \ -m state \
@ -141,6 +153,7 @@ ip6tables \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \ --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
-m state \ -m state \
@ -149,6 +162,7 @@ ip6tables \
--comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \ --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
-m state \ -m state \
@ -157,6 +171,7 @@ ip6tables \
--comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \ --comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
-m state \ -m state \
@ -165,6 +180,7 @@ ip6tables \
--comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \ --comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
-m state \ -m state \
@ -173,6 +189,7 @@ ip6tables \
--comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \ --comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p ah \ -p ah \
-m state \ -m state \
@ -182,6 +199,7 @@ ip6tables \
-f ${tmp}' \ -f ${tmp}' \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p ah \ -p ah \
-m state \ -m state \
@ -191,6 +209,7 @@ ip6tables \
-f ${tmp}' \ -f ${tmp}' \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p ah \ -p ah \
-m state \ -m state \

7
tests/nwfilterxml2firewalldata/conntrack-linux.args
View File

@ -1,40 +1,47 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
-m connlimit \ -m connlimit \
--connlimit-above 1 \ --connlimit-above 1 \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
-m connlimit \ -m connlimit \
--connlimit-above 1 \ --connlimit-above 1 \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
-m connlimit \ -m connlimit \
--connlimit-above 2 \ --connlimit-above 2 \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
-m connlimit \ -m connlimit \
--connlimit-above 2 \ --connlimit-above 2 \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \

9
tests/nwfilterxml2firewalldata/esp-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -11,6 +12,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p esp \ -p esp \
--destination f:e:d::c:b:a/127 \ --destination f:e:d::c:b:a/127 \
@ -21,6 +23,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -33,6 +36,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p esp \ -p esp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -42,6 +46,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -53,6 +58,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p esp \ -p esp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -62,6 +68,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p esp \ -p esp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -71,6 +78,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -82,6 +90,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p esp \ -p esp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

9
tests/nwfilterxml2firewalldata/esp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p esp \ -p esp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p esp \ -p esp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -39,6 +43,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -50,6 +55,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p esp \ -p esp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -59,6 +65,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p esp \ -p esp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -68,6 +75,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p esp \ -p esp \
-m mac \ -m mac \
@ -79,6 +87,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p esp \ -p esp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \

12
tests/nwfilterxml2firewalldata/example-1-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--sport 22 \ --sport 22 \
@ -6,6 +7,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--dport 22 \ --dport 22 \
@ -13,6 +15,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--sport 22 \ --sport 22 \
@ -20,50 +23,59 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-j DROP -j DROP

10
tests/nwfilterxml2firewalldata/example-2-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -7,6 +8,7 @@ iptables \
--comment 'out: existing and related (ftp) connections' \ --comment 'out: existing and related (ftp) connections' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -15,6 +17,7 @@ iptables \
--comment 'out: existing and related (ftp) connections' \ --comment 'out: existing and related (ftp) connections' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -23,6 +26,7 @@ iptables \
--comment 'in: existing connections' \ --comment 'in: existing connections' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--dport 21:22 \ --dport 21:22 \
@ -32,6 +36,7 @@ iptables \
--comment 'in: ftp and ssh' \ --comment 'in: ftp and ssh' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
@ -40,6 +45,7 @@ iptables \
--comment 'in: icmp' \ --comment 'in: icmp' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--dport 53 \ --dport 53 \
@ -49,6 +55,7 @@ iptables \
--comment 'out: DNS lookups' \ --comment 'out: DNS lookups' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--dport 53 \ --dport 53 \
@ -58,18 +65,21 @@ iptables \
--comment 'out: DNS lookups' \ --comment 'out: DNS lookups' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
--comment 'inout: drop all non-accepted traffic' \ --comment 'inout: drop all non-accepted traffic' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
--comment 'inout: drop all non-accepted traffic' \ --comment 'inout: drop all non-accepted traffic' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \

10
tests/nwfilterxml2firewalldata/hex-data-linux.args
View File

@ -1,9 +1,11 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p 0x1234 \ -p 0x1234 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -17,6 +19,7 @@ ebtables \
--ip-tos 0x32 \ --ip-tos 0x32 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \
@ -29,6 +32,7 @@ ebtables \
--ip6-destination-port 13107:65535 \ --ip6-destination-port 13107:65535 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -41,6 +45,7 @@ ebtables \
--arp-mac-dst 0a:0b:0c:0d:0e:0f \ --arp-mac-dst 0a:0b:0c:0d:0e:0f \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -54,6 +59,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -65,6 +71,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -78,6 +85,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -89,6 +97,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -102,6 +111,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \

6
tests/nwfilterxml2firewalldata/icmp-direction-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
--icmp-type 0 \ --icmp-type 0 \
@ -6,6 +7,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
--icmp-type 8 \ --icmp-type 8 \
@ -13,6 +15,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
--icmp-type 8 \ --icmp-type 8 \
@ -20,14 +23,17 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
-j DROP -j DROP

6
tests/nwfilterxml2firewalldata/icmp-direction2-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
--icmp-type 8 \ --icmp-type 8 \
@ -6,6 +7,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
--icmp-type 0 \ --icmp-type 0 \
@ -13,6 +15,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
--icmp-type 0 \ --icmp-type 0 \
@ -20,14 +23,17 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
-j DROP -j DROP

6
tests/nwfilterxml2firewalldata/icmp-direction3-linux.args
View File

@ -1,30 +1,36 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
-m state \ -m state \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-j DROP -j DROP

3
tests/nwfilterxml2firewalldata/icmp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmp \ -p icmp \
-m mac \ -m mac \
@ -11,6 +12,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmp \ -p icmp \
-m mac \ -m mac \
@ -23,6 +25,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmp \ -p icmp \
-m mac \ -m mac \

4
tests/nwfilterxml2firewalldata/icmpv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p icmpv6 \ -p icmpv6 \
-m mac \ -m mac \
@ -12,6 +13,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p icmpv6 \ -p icmpv6 \
-m mac \ -m mac \
@ -25,6 +27,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmpv6 \ -p icmpv6 \
-m mac \ -m mac \
@ -37,6 +40,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p icmpv6 \ -p icmpv6 \
-m mac \ -m mac \

9
tests/nwfilterxml2firewalldata/igmp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p igmp \ -p igmp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p igmp \ -p igmp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p igmp \ -p igmp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p igmp \ -p igmp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -39,6 +43,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p igmp \ -p igmp \
-m mac \ -m mac \
@ -50,6 +55,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p igmp \ -p igmp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -59,6 +65,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p igmp \ -p igmp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -68,6 +75,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p igmp \ -p igmp \
-m mac \ -m mac \
@ -79,6 +87,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p igmp \ -p igmp \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \

3
tests/nwfilterxml2firewalldata/ip-linux.args
View File

@ -1,4 +1,5 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -11,6 +12,7 @@ ebtables \
--ip-destination-port 100:101 \ --ip-destination-port 100:101 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv4 \ -p ipv4 \
@ -20,6 +22,7 @@ ebtables \
--ip-tos 0x3f \ --ip-tos 0x3f \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv4 \ -p ipv4 \

18
tests/nwfilterxml2firewalldata/ipset-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -7,6 +8,7 @@ iptables \
--match-set tck_test src,dst \ --match-set tck_test src,dst \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -15,6 +17,7 @@ iptables \
--match-set tck_test dst,src \ --match-set tck_test dst,src \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -23,6 +26,7 @@ iptables \
--match-set tck_test src,dst \ --match-set tck_test src,dst \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m set \ -m set \
@ -31,6 +35,7 @@ iptables \
--comment in+NONE \ --comment in+NONE \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m set \ -m set \
@ -39,6 +44,7 @@ iptables \
--comment out+NONE \ --comment out+NONE \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m set \ -m set \
@ -47,6 +53,7 @@ iptables \
--comment out+NONE \ --comment out+NONE \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -55,6 +62,7 @@ iptables \
--match-set tck_test dst,src,dst \ --match-set tck_test dst,src,dst \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -63,6 +71,7 @@ iptables \
--match-set tck_test src,dst,src \ --match-set tck_test src,dst,src \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -71,6 +80,7 @@ iptables \
--match-set tck_test dst,src,dst \ --match-set tck_test dst,src,dst \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -79,6 +89,7 @@ iptables \
--match-set tck_test dst,src,dst \ --match-set tck_test dst,src,dst \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -87,6 +98,7 @@ iptables \
--match-set tck_test src,dst,src \ --match-set tck_test src,dst,src \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -95,6 +107,7 @@ iptables \
--match-set tck_test dst,src,dst \ --match-set tck_test dst,src,dst \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -103,6 +116,7 @@ iptables \
--match-set tck_test dst,src \ --match-set tck_test dst,src \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -111,6 +125,7 @@ iptables \
--match-set tck_test src,dst \ --match-set tck_test src,dst \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m state \ -m state \
@ -119,6 +134,7 @@ iptables \
--match-set tck_test dst,src \ --match-set tck_test dst,src \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m set \ -m set \
@ -127,6 +143,7 @@ iptables \
--comment inout \ --comment inout \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m set \ -m set \
@ -135,6 +152,7 @@ iptables \
--comment inout \ --comment inout \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m set \ -m set \

2
tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.args
View File

@ -1,10 +1,12 @@
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac '!' \ -m mac '!' \
--mac-source 12:34:56:78:9a:bc \ --mac-source 12:34:56:78:9a:bc \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac '!' \ -m mac '!' \

15
tests/nwfilterxml2firewalldata/ipv6-linux.args
View File

@ -1,4 +1,5 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \
@ -11,6 +12,7 @@ ebtables \
--ip6-destination-port 100:101 \ --ip6-destination-port 100:101 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -21,6 +23,7 @@ ebtables \
--ip6-source-port 100:101 \ --ip6-source-port 100:101 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \
@ -31,6 +34,7 @@ ebtables \
--ip6-destination-port 100:101 \ --ip6-destination-port 100:101 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -41,6 +45,7 @@ ebtables \
--ip6-source-port 65535:65535 \ --ip6-source-port 65535:65535 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \
@ -51,6 +56,7 @@ ebtables \
--ip6-destination-port 65535:65535 \ --ip6-destination-port 65535:65535 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -59,6 +65,7 @@ ebtables \
--ip6-protocol 18 \ --ip6-protocol 18 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \
@ -67,6 +74,7 @@ ebtables \
--ip6-protocol 18 \ --ip6-protocol 18 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -76,6 +84,7 @@ ebtables \
--ip6-icmp-type 1:11/10:11 \ --ip6-icmp-type 1:11/10:11 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \
@ -85,6 +94,7 @@ ebtables \
--ip6-icmp-type 1:11/10:11 \ --ip6-icmp-type 1:11/10:11 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -94,6 +104,7 @@ ebtables \
--ip6-icmp-type 1:1/10:10 \ --ip6-icmp-type 1:1/10:10 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \
@ -103,6 +114,7 @@ ebtables \
--ip6-icmp-type 1:1/10:10 \ --ip6-icmp-type 1:1/10:10 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -112,6 +124,7 @@ ebtables \
--ip6-icmp-type 0:255/10:10 \ --ip6-icmp-type 0:255/10:10 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \
@ -121,6 +134,7 @@ ebtables \
--ip6-icmp-type 0:255/10:10 \ --ip6-icmp-type 0:255/10:10 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-p ipv6 \ -p ipv6 \
@ -130,6 +144,7 @@ ebtables \
--ip6-icmp-type 1:1/0:255 \ --ip6-icmp-type 1:1/0:255 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-p ipv6 \ -p ipv6 \

9
tests/nwfilterxml2firewalldata/iter1-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--source 1.1.1.1 \ --source 1.1.1.1 \
@ -9,6 +10,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--destination 1.1.1.1 \ --destination 1.1.1.1 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--source 1.1.1.1 \ --source 1.1.1.1 \
@ -29,6 +32,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -39,6 +43,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--destination 2.2.2.2 \ --destination 2.2.2.2 \
@ -49,6 +54,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -59,6 +65,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--source 3.3.3.3 \ --source 3.3.3.3 \
@ -69,6 +76,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--destination 3.3.3.3 \ --destination 3.3.3.3 \
@ -79,6 +87,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--source 3.3.3.3 \ --source 3.3.3.3 \

171
tests/nwfilterxml2firewalldata/iter2-linux.args
View File

File diff suppressed because it is too large Load Diff

15
tests/nwfilterxml2firewalldata/iter3-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--source 1.1.1.1 \ --source 1.1.1.1 \
@ -9,6 +10,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--destination 1.1.1.1 \ --destination 1.1.1.1 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--source 1.1.1.1 \ --source 1.1.1.1 \
@ -29,6 +32,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--source 1.1.1.1 \ --source 1.1.1.1 \
@ -39,6 +43,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--destination 1.1.1.1 \ --destination 1.1.1.1 \
@ -49,6 +54,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--source 1.1.1.1 \ --source 1.1.1.1 \
@ -59,6 +65,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -69,6 +76,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
--destination 2.2.2.2 \ --destination 2.2.2.2 \
@ -79,6 +87,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -89,6 +98,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -99,6 +109,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
--destination 2.2.2.2 \ --destination 2.2.2.2 \
@ -109,6 +120,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -119,6 +131,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
--source 2.2.2.2 \ --source 2.2.2.2 \
@ -130,6 +143,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
--destination 2.2.2.2 \ --destination 2.2.2.2 \
@ -141,6 +155,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
--source 2.2.2.2 \ --source 2.2.2.2 \

4
tests/nwfilterxml2firewalldata/mac-linux.args
View File

@ -1,22 +1,26 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-p 0x806 \ -p 0x806 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x800 \ -p 0x800 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x600 \ -p 0x600 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \

6
tests/nwfilterxml2firewalldata/rarp-linux.args
View File

@ -1,7 +1,9 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-N libvirt-J-vnet0 -N libvirt-J-vnet0
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -14,6 +16,7 @@ ebtables \
--arp-mac-dst 0a:0b:0c:0d:0e:0f \ --arp-mac-dst 0a:0b:0c:0d:0e:0f \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -23,6 +26,7 @@ ebtables \
--arp-ptype 0xff \ --arp-ptype 0xff \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -32,6 +36,7 @@ ebtables \
--arp-ptype 0x100 \ --arp-ptype 0x100 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -41,6 +46,7 @@ ebtables \
--arp-ptype 0xffff \ --arp-ptype 0xffff \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A PREROUTING \ -A PREROUTING \
-i vnet0 \ -i vnet0 \

9
tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
--source a:b:c::d:e:f/128 \ --source a:b:c::d:e:f/128 \
@ -19,6 +21,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -41,6 +45,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -54,6 +59,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -65,6 +71,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -76,6 +83,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -89,6 +97,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

9
tests/nwfilterxml2firewalldata/sctp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -41,6 +45,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -54,6 +59,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -65,6 +71,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p sctp \ -p sctp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -76,6 +83,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p sctp \ -p sctp \
-m mac \ -m mac \
@ -89,6 +97,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p sctp \ -p sctp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \

11
tests/nwfilterxml2firewalldata/stp-linux.args
View File

@ -1,32 +1,41 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-F J-vnet0-stp-xyz -F J-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-X J-vnet0-stp-xyz -X J-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-N J-vnet0-stp-xyz -N J-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-d 01:80:c2:00:00:00 \ -d 01:80:c2:00:00:00 \
-j J-vnet0-stp-xyz -j J-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-F P-vnet0-stp-xyz -F P-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-X P-vnet0-stp-xyz -X P-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-N P-vnet0-stp-xyz -N P-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d 01:80:c2:00:00:00 \ -d 01:80:c2:00:00:00 \
-j P-vnet0-stp-xyz -j P-vnet0-stp-xyz
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A P-vnet0-stp-xyz \ -A P-vnet0-stp-xyz \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -35,6 +44,7 @@ ebtables \
--stp-flags 68 \ --stp-flags 68 \
-j CONTINUE -j CONTINUE
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A J-vnet0-stp-xyz \ -A J-vnet0-stp-xyz \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -44,6 +54,7 @@ ebtables \
--stp-root-cost 287454020:573785173 \ --stp-root-cost 287454020:573785173 \
-j RETURN -j RETURN
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A P-vnet0-stp-xyz \ -A P-vnet0-stp-xyz \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \

33
tests/nwfilterxml2firewalldata/target-linux.args
View File

@ -1,40 +1,47 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-p 0x806 \ -p 0x806 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-p 0x806 \ -p 0x806 \
-j DROP -j DROP
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
-p 0x806 \ -p 0x806 \
-j DROP -j DROP
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x800 \ -p 0x800 \
-j ACCEPT -j ACCEPT
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x800 \ -p 0x800 \
-j DROP -j DROP
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \
-p 0x800 \ -p 0x800 \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -49,6 +56,7 @@ iptables \
-- dir out' \ -- dir out' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -61,6 +69,7 @@ iptables \
-- dir out' \ -- dir out' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -75,6 +84,7 @@ iptables \
-- dir out' \ -- dir out' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -87,6 +97,7 @@ iptables \
-- dir out' \ -- dir out' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -97,6 +108,7 @@ iptables \
-- dir out' \ -- dir out' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -109,6 +121,7 @@ iptables \
-- dir out' \ -- dir out' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -121,6 +134,7 @@ iptables \
-- dir out' \ -- dir out' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -131,6 +145,7 @@ iptables \
-- dir out' \ -- dir out' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -143,6 +158,7 @@ iptables \
-- dir out' \ -- dir out' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -155,6 +171,7 @@ iptables \
-- dir in' \ -- dir in' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -169,6 +186,7 @@ iptables \
-- dir in' \ -- dir in' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -181,6 +199,7 @@ iptables \
-- dir in' \ -- dir in' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -191,6 +210,7 @@ iptables \
-- dir in' \ -- dir in' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -203,6 +223,7 @@ iptables \
-- dir in' \ -- dir in' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -213,6 +234,7 @@ iptables \
-- dir in' \ -- dir in' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -223,6 +245,7 @@ iptables \
-- dir in' \ -- dir in' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m mac \ -m mac \
@ -235,6 +258,7 @@ iptables \
-- dir in' \ -- dir in' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -245,6 +269,7 @@ iptables \
-- dir in' \ -- dir in' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -252,6 +277,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -259,6 +285,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -266,6 +293,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -273,6 +301,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -280,6 +309,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -287,6 +317,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -294,6 +325,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-m comment \ -m comment \
@ -301,6 +333,7 @@ iptables \
-- dir inout' \ -- dir inout' \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-m comment \ -m comment \

12
tests/nwfilterxml2firewalldata/target2-linux.args
View File

@ -1,19 +1,23 @@
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--dport 22 \ --dport 22 \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--sport 22 \ --sport 22 \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--sport 22 \ --sport 22 \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--sport 80 \ --sport 80 \
@ -21,6 +25,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--dport 80 \ --dport 80 \
@ -28,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--sport 80 \ --sport 80 \
@ -35,26 +41,32 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
-j REJECT -j REJECT
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p all \ -p all \
-j DROP -j DROP
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p all \ -p all \
-j DROP -j DROP
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p all \ -p all \
-j DROP -j DROP

9
tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--source a:b:c::d:e:f/128 \ --source a:b:c::d:e:f/128 \
@ -19,6 +21,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -41,6 +45,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -54,6 +59,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -65,6 +71,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -76,6 +83,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -89,6 +97,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

13
tests/nwfilterxml2firewalldata/tcp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -39,6 +43,7 @@ iptables \
--sport 100:1111 \ --sport 100:1111 \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -50,6 +55,7 @@ iptables \
--dport 100:1111 \ --dport 100:1111 \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -59,6 +65,7 @@ iptables \
--sport 100:1111 \ --sport 100:1111 \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p tcp \ -p tcp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -68,6 +75,7 @@ iptables \
--sport 65535:65535 \ --sport 65535:65535 \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
-m mac \ -m mac \
@ -79,6 +87,7 @@ iptables \
--dport 65535:65535 \ --dport 65535:65535 \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p tcp \ -p tcp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -88,21 +97,25 @@ iptables \
--sport 65535:65535 \ --sport 65535:65535 \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--tcp-flags SYN ALL \ --tcp-flags SYN ALL \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--tcp-flags SYN SYN,ACK \ --tcp-flags SYN SYN,ACK \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--tcp-flags RST NONE \ --tcp-flags RST NONE \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p tcp \ -p tcp \
--tcp-flags PSH NONE \ --tcp-flags PSH NONE \

9
tests/nwfilterxml2firewalldata/udp-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
--source a:b:c::d:e:f/128 \ --source a:b:c::d:e:f/128 \
@ -19,6 +21,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--destination ::a:b:c/128 \ --destination ::a:b:c/128 \
@ -41,6 +45,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -54,6 +59,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--destination ::a:b:c/128 \ --destination ::a:b:c/128 \
@ -65,6 +71,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -76,6 +83,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -89,6 +97,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

9
tests/nwfilterxml2firewalldata/udp-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -41,6 +45,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -54,6 +59,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -65,6 +71,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udp \ -p udp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \
@ -76,6 +83,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udp \ -p udp \
-m mac \ -m mac \
@ -89,6 +97,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udp \ -p udp \
--destination 10.1.2.3/32 \ --destination 10.1.2.3/32 \

9
tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args
View File

@ -1,4 +1,5 @@
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -11,6 +12,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udplite \ -p udplite \
--destination f:e:d::c:b:a/127 \ --destination f:e:d::c:b:a/127 \
@ -21,6 +23,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -33,6 +36,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udplite \ -p udplite \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -42,6 +46,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -53,6 +58,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udplite \ -p udplite \
--destination a:b:c::/128 \ --destination a:b:c::/128 \
@ -62,6 +68,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udplite \ -p udplite \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \
@ -71,6 +78,7 @@ ip6tables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
ip6tables \ ip6tables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -82,6 +90,7 @@ ip6tables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
ip6tables \ ip6tables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udplite \ -p udplite \
--destination ::10.1.2.3/128 \ --destination ::10.1.2.3/128 \

9
tests/nwfilterxml2firewalldata/udplite-linux.args
View File

@ -1,4 +1,5 @@
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -10,6 +11,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udplite \ -p udplite \
--source 10.1.2.3/32 \ --source 10.1.2.3/32 \
@ -19,6 +21,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -30,6 +33,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udplite \ -p udplite \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -39,6 +43,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -50,6 +55,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udplite \ -p udplite \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -59,6 +65,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FJ-vnet0 \ -A FJ-vnet0 \
-p udplite \ -p udplite \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \
@ -68,6 +75,7 @@ iptables \
--state ESTABLISHED \ --state ESTABLISHED \
-j RETURN -j RETURN
iptables \ iptables \
-w \
-A FP-vnet0 \ -A FP-vnet0 \
-p udplite \ -p udplite \
-m mac \ -m mac \
@ -79,6 +87,7 @@ iptables \
--state NEW,ESTABLISHED \ --state NEW,ESTABLISHED \
-j ACCEPT -j ACCEPT
iptables \ iptables \
-w \
-A HJ-vnet0 \ -A HJ-vnet0 \
-p udplite \ -p udplite \
--destination 10.1.2.3/22 \ --destination 10.1.2.3/22 \

7
tests/nwfilterxml2firewalldata/vlan-linux.args
View File

@ -1,4 +1,5 @@
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-d 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -d 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -7,6 +8,7 @@ ebtables \
--vlan-id 291 \ --vlan-id 291 \
-j CONTINUE -j CONTINUE
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -15,6 +17,7 @@ ebtables \
--vlan-id 291 \ --vlan-id 291 \
-j CONTINUE -j CONTINUE
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-d 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -d 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -23,6 +26,7 @@ ebtables \
--vlan-id 1234 \ --vlan-id 1234 \
-j RETURN -j RETURN
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -31,6 +35,7 @@ ebtables \
--vlan-id 1234 \ --vlan-id 1234 \
-j RETURN -j RETURN
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-P-vnet0 \ -A libvirt-P-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -39,6 +44,7 @@ ebtables \
--vlan-id 291 \ --vlan-id 291 \
-j DROP -j DROP
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \
@ -47,6 +53,7 @@ ebtables \
--vlan-encap 2054 \ --vlan-encap 2054 \
-j DROP -j DROP
ebtables \ ebtables \
--concurrent \
-t nat \ -t nat \
-A libvirt-J-vnet0 \ -A libvirt-J-vnet0 \
-s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \

144
tests/nwfilterxml2firewalltest.c
View File

@ -58,90 +58,90 @@ struct _virNWFilterInst {
static const char *commonRules[] = { static const char *commonRules[] = {
/* Dropping ebtables rules */ /* Dropping ebtables rules */
"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
"ebtables -t nat -L libvirt-J-vnet0\n" "ebtables --concurrent -t nat -L libvirt-J-vnet0\n"
"ebtables -t nat -L libvirt-P-vnet0\n" "ebtables --concurrent -t nat -L libvirt-P-vnet0\n"
"ebtables -t nat -F libvirt-J-vnet0\n" "ebtables --concurrent -t nat -F libvirt-J-vnet0\n"
"ebtables -t nat -X libvirt-J-vnet0\n" "ebtables --concurrent -t nat -X libvirt-J-vnet0\n"
"ebtables -t nat -F libvirt-P-vnet0\n" "ebtables --concurrent -t nat -F libvirt-P-vnet0\n"
"ebtables -t nat -X libvirt-P-vnet0\n", "ebtables --concurrent -t nat -X libvirt-P-vnet0\n",
/* Creating ebtables chains */ /* Creating ebtables chains */
"ebtables -t nat -N libvirt-J-vnet0\n" "ebtables --concurrent -t nat -N libvirt-J-vnet0\n"
"ebtables -t nat -N libvirt-P-vnet0\n", "ebtables --concurrent -t nat -N libvirt-P-vnet0\n",
/* Dropping iptables rules */ /* Dropping iptables rules */
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"iptables -F FP-vnet0\n" "iptables -w -F FP-vnet0\n"
"iptables -X FP-vnet0\n" "iptables -w -X FP-vnet0\n"
"iptables -F FJ-vnet0\n" "iptables -w -F FJ-vnet0\n"
"iptables -X FJ-vnet0\n" "iptables -w -X FJ-vnet0\n"
"iptables -F HJ-vnet0\n" "iptables -w -F HJ-vnet0\n"
"iptables -X HJ-vnet0\n", "iptables -w -X HJ-vnet0\n",
/* Creating iptables chains */ /* Creating iptables chains */
"iptables -N libvirt-in\n" "iptables -w -N libvirt-in\n"
"iptables -N libvirt-out\n" "iptables -w -N libvirt-out\n"
"iptables -N libvirt-in-post\n" "iptables -w -N libvirt-in-post\n"
"iptables -N libvirt-host-in\n" "iptables -w -N libvirt-host-in\n"
"iptables -D FORWARD -j libvirt-in\n" "iptables -w -D FORWARD -j libvirt-in\n"
"iptables -D FORWARD -j libvirt-out\n" "iptables -w -D FORWARD -j libvirt-out\n"
"iptables -D FORWARD -j libvirt-in-post\n" "iptables -w -D FORWARD -j libvirt-in-post\n"
"iptables -D INPUT -j libvirt-host-in\n" "iptables -w -D INPUT -j libvirt-host-in\n"
"iptables -I FORWARD 1 -j libvirt-in\n" "iptables -w -I FORWARD 1 -j libvirt-in\n"
"iptables -I FORWARD 2 -j libvirt-out\n" "iptables -w -I FORWARD 2 -j libvirt-out\n"
"iptables -I FORWARD 3 -j libvirt-in-post\n" "iptables -w -I FORWARD 3 -j libvirt-in-post\n"
"iptables -I INPUT 1 -j libvirt-host-in\n" "iptables -w -I INPUT 1 -j libvirt-host-in\n"
"iptables -N FP-vnet0\n" "iptables -w -N FP-vnet0\n"
"iptables -N FJ-vnet0\n" "iptables -w -N FJ-vnet0\n"
"iptables -N HJ-vnet0\n" "iptables -w -N HJ-vnet0\n"
"iptables -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" "iptables -w -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"iptables -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" "iptables -w -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"iptables -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" "iptables -w -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"iptables -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n", "iptables -w -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n",
/* Dropping ip6tables rules */ /* Dropping ip6tables rules */
"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"ip6tables -F FP-vnet0\n" "ip6tables -w -F FP-vnet0\n"
"ip6tables -X FP-vnet0\n" "ip6tables -w -X FP-vnet0\n"
"ip6tables -F FJ-vnet0\n" "ip6tables -w -F FJ-vnet0\n"
"ip6tables -X FJ-vnet0\n" "ip6tables -w -X FJ-vnet0\n"
"ip6tables -F HJ-vnet0\n" "ip6tables -w -F HJ-vnet0\n"
"ip6tables -X HJ-vnet0\n", "ip6tables -w -X HJ-vnet0\n",
/* Creating ip6tables chains */ /* Creating ip6tables chains */
"ip6tables -N libvirt-in\n" "ip6tables -w -N libvirt-in\n"
"ip6tables -N libvirt-out\n" "ip6tables -w -N libvirt-out\n"
"ip6tables -N libvirt-in-post\n" "ip6tables -w -N libvirt-in-post\n"
"ip6tables -N libvirt-host-in\n" "ip6tables -w -N libvirt-host-in\n"
"ip6tables -D FORWARD -j libvirt-in\n" "ip6tables -w -D FORWARD -j libvirt-in\n"
"ip6tables -D FORWARD -j libvirt-out\n" "ip6tables -w -D FORWARD -j libvirt-out\n"
"ip6tables -D FORWARD -j libvirt-in-post\n" "ip6tables -w -D FORWARD -j libvirt-in-post\n"
"ip6tables -D INPUT -j libvirt-host-in\n" "ip6tables -w -D INPUT -j libvirt-host-in\n"
"ip6tables -I FORWARD 1 -j libvirt-in\n" "ip6tables -w -I FORWARD 1 -j libvirt-in\n"
"ip6tables -I FORWARD 2 -j libvirt-out\n" "ip6tables -w -I FORWARD 2 -j libvirt-out\n"
"ip6tables -I FORWARD 3 -j libvirt-in-post\n" "ip6tables -w -I FORWARD 3 -j libvirt-in-post\n"
"ip6tables -I INPUT 1 -j libvirt-host-in\n" "ip6tables -w -I INPUT 1 -j libvirt-host-in\n"
"ip6tables -N FP-vnet0\n" "ip6tables -w -N FP-vnet0\n"
"ip6tables -N FJ-vnet0\n" "ip6tables -w -N FJ-vnet0\n"
"ip6tables -N HJ-vnet0\n" "ip6tables -w -N HJ-vnet0\n"
"ip6tables -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" "ip6tables -w -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
"ip6tables -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" "ip6tables -w -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
"ip6tables -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" "ip6tables -w -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
"ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n"
"ip6tables -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n", "ip6tables -w -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n",
/* Inserting ebtables rules */ /* Inserting ebtables rules */
"ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
"ebtables -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n", "ebtables --concurrent -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n",
}; };

112
tests/virfirewalltest.c
View File

@ -149,15 +149,17 @@ VIR_MOCK_WRAP_RET_ARGS(g_dbus_connection_call_sync,
*error = g_dbus_error_new_for_dbus_error("org.firewalld.error", *error = g_dbus_error_new_for_dbus_error("org.firewalld.error",
"something bad happened"); "something bad happened");
} else { } else {
if (nargs == 1 && if (nargs == 2 &&
STREQ(type, "ipv4") && STREQ(type, "ipv4") &&
STREQ(args[0], "-L")) { STREQ(args[0], "-w") &&
STREQ(args[1], "-L")) {
reply = g_variant_new("(s)", TEST_FILTER_TABLE_LIST); reply = g_variant_new("(s)", TEST_FILTER_TABLE_LIST);
} else if (nargs == 3 && } else if (nargs == 4 &&
STREQ(type, "ipv4") && STREQ(type, "ipv4") &&
STREQ(args[0], "-t") && STREQ(args[0], "-w") &&
STREQ(args[1], "nat") && STREQ(args[1], "-t") &&
STREQ(args[2], "-L")) { STREQ(args[2], "nat") &&
STREQ(args[3], "-L")) {
reply = g_variant_new("(s)", TEST_NAT_TABLE_LIST); reply = g_variant_new("(s)", TEST_NAT_TABLE_LIST);
} else { } else {
reply = g_variant_new("(s)", "success"); reply = g_variant_new("(s)", "success");
@ -184,8 +186,8 @@ testFirewallSingleGroup(const void *opaque)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -236,8 +238,8 @@ testFirewallRemoveRule(const void *opaque)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
virFirewallRulePtr fwrule; virFirewallRulePtr fwrule;
@ -295,10 +297,10 @@ testFirewallManyGroups(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"
IPTABLES_PATH " -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A OUTPUT --jump DROP\n"; IPTABLES_PATH " -w -A OUTPUT --jump DROP\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -382,10 +384,10 @@ testFirewallIgnoreFailGroup(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A OUTPUT --jump DROP\n"; IPTABLES_PATH " -w -A OUTPUT --jump DROP\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -450,10 +452,10 @@ testFirewallIgnoreFailRule(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A OUTPUT --jump DROP\n"; IPTABLES_PATH " -w -A OUTPUT --jump DROP\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -517,8 +519,8 @@ testFirewallNoRollback(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n"; IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -577,11 +579,11 @@ testFirewallSingleRollback(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -D INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -657,10 +659,10 @@ testFirewallManyRollback(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -740,14 +742,14 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.127 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.127 --jump REJECT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host 192.168.122.127 --jump REJECT\n" IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.127 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n" IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host 192.168.122.255 --jump REJECT\n" IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n"
IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
fwDisabled = data->fwDisabled; fwDisabled = data->fwDisabled;
@ -882,12 +884,14 @@ testFirewallQueryHook(const char *const*args,
void *opaque G_GNUC_UNUSED) void *opaque G_GNUC_UNUSED)
{ {
if (STREQ(args[0], IPTABLES_PATH) && if (STREQ(args[0], IPTABLES_PATH) &&
STREQ(args[1], "-L")) { STREQ(args[1], "-w") &&
STREQ(args[2], "-L")) {
*output = g_strdup(TEST_FILTER_TABLE_LIST); *output = g_strdup(TEST_FILTER_TABLE_LIST);
} else if (STREQ(args[0], IPTABLES_PATH) && } else if (STREQ(args[0], IPTABLES_PATH) &&
STREQ(args[1], "-t") && STREQ(args[1], "-w") &&
STREQ(args[2], "nat") && STREQ(args[2], "-t") &&
STREQ(args[3], "-L")) { STREQ(args[3], "nat") &&
STREQ(args[4], "-L")) {
*output = g_strdup(TEST_NAT_TABLE_LIST); *output = g_strdup(TEST_NAT_TABLE_LIST);
} }
} }
@ -930,15 +934,15 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED)
int ret = -1; int ret = -1;
const char *actual = NULL; const char *actual = NULL;
const char *expected = const char *expected =
IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.127 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.127 --jump REJECT\n"
IPTABLES_PATH " -L\n" IPTABLES_PATH " -w -L\n"
IPTABLES_PATH " -t nat -L\n" IPTABLES_PATH " -w -t nat -L\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.130 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.130 --jump REJECT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.129' --jump REJECT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.129' --jump REJECT\n"
IPTABLES_PATH " -A INPUT --source-host 192.168.122.128 --jump REJECT\n" IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.128 --jump REJECT\n"
IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n";
const struct testFirewallData *data = opaque; const struct testFirewallData *data = opaque;
expectedLineNum = 0; expectedLineNum = 0;