shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-23 21:34:54 +03:00
Code Releases Activity
fb6c1f16c5
libvirt/tests/nwfilterxml2firewalldata/ipv6.xml

82 lines
2.3 KiB
XML
Raw Normal View History

Add a test suite for nwfilter ebiptables tech driver Create a nwfilterxml2firewalltest to exercise the ebiptables_driver.applyNewRules method with a variety of different XML input files. The XML input files are taken from the libvirt-tck nwfilter tests. While the nwfilter tests verify the final state of the iptables chains, this test verifies the set of commands invoked to create the chains. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2014-04-01 10:19:38 +04:00
<filter name='tck-testcase'>
<uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
<rule action='accept' direction='out'>
<ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
srcipaddr='::10.1.2.3' srcipmask='22'
dstipaddr='::10.1.2.3'
dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
protocol='udp'
srcportstart='20' srcportend='22'
dstportstart='100' dstportend='101'
/>
</rule>
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='6'
srcportstart='20' srcportend='22'
dstportstart='100' dstportend='101'
/>
</rule>
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='6'
srcportstart='255' srcportend='256'
dstportstart='65535' dstportend='65535'
/>
</rule>
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='18'
/>
</rule>
nwfilter: Add support for icmpv6 filtering Make use of the ebtables functionality to be able to filter certain parameters of icmpv6 packets. Extend the XML parser for icmpv6 types, type ranges, codes, and code ranges. Extend the nwfilter documentation, schema, and test cases. Being able to filter icmpv6 types and codes helps extending the DHCP snooper for IPv6 and filtering at least some parameters of IPv6's NDP (Neighbor Discovery Protocol) packets. However, the filtering will not be as good as the filtering of ARP packets since we cannot check on IP addresses in the payload of the NDP packets. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
2015-01-07 19:41:49 +03:00
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='icmpv6'
type='1' typeend='11'
code='10' codeend='11'
/>
</rule>
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='icmpv6'
type='1'
code='10'
/>
</rule>
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='icmpv6'
code='10'
/>
</rule>
<rule action='accept' direction='inout'>
<ipv6 srcipaddr='1::2' srcipmask='128'
dstipaddr='a:b:c::'
dstipmask='ffff:ffff:ffff:ffff:8000::'
protocol='icmpv6'
type='1'
/>
</rule>
Add a test suite for nwfilter ebiptables tech driver Create a nwfilterxml2firewalltest to exercise the ebiptables_driver.applyNewRules method with a variety of different XML input files. The XML input files are taken from the libvirt-tck nwfilter tests. While the nwfilter tests verify the final state of the iptables chains, this test verifies the set of commands invoked to create the chains. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2014-04-01 10:19:38 +04:00
</filter>
Copy Permalink