mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 17:34:18 +03:00
3ba789ccd5
Create a nwfilterxml2firewalltest to exercise the ebiptables_driver.applyNewRules method with a variety of different XML input files. The XML input files are taken from the libvirt-tck nwfilter tests. While the nwfilter tests verify the final state of the iptables chains, this test verifies the set of commands invoked to create the chains. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
38 lines
1.2 KiB
XML
38 lines
1.2 KiB
XML
<filter name='tck-testcase'>
|
|
<uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid>
|
|
|
|
<!-- VM outgoing: allow all established and related connections -->
|
|
<rule action='accept' direction='out' priority='100'>
|
|
<all state='ESTABLISHED,RELATED'
|
|
comment='out: existing and related (ftp) connections'/>
|
|
</rule>
|
|
|
|
<!-- VM incoming: allow all established connections -->
|
|
<rule action='accept' direction='in' priority='100'>
|
|
<all state='ESTABLISHED'
|
|
comment='in: existing connections'/>
|
|
</rule>
|
|
|
|
<!-- allow incoming ssh and ftp traffic -->
|
|
<rule action='accept' direction='in' priority='200'>
|
|
<tcp dstportstart='21' dstportend='22' state='NEW'
|
|
comment='in: ftp and ssh'/>
|
|
</rule>
|
|
|
|
<!-- allow incoming ICMP (ping) packets -->
|
|
<rule action='accept' direction='in' priority='300'>
|
|
<icmp state='NEW' comment='in: icmp'/>
|
|
</rule>
|
|
|
|
<!-- allow outgong DNS lookups -->
|
|
<rule action='accept' direction='out' priority='300'>
|
|
<udp dstportstart='53' state='NEW' comment='out: DNS lookups'/>
|
|
</rule>
|
|
|
|
<!-- drop all other traffic -->
|
|
<rule action='drop' direction='inout' priority='1000'>
|
|
<all comment='inout: drop all non-accepted traffic'/>
|
|
</rule>
|
|
|
|
</filter>
|