diff --git a/SOURCES/libvirt-Add-testdata-for-AMD-EPYC-7502.patch b/SOURCES/libvirt-Add-testdata-for-AMD-EPYC-7502.patch
new file mode 100644
index 0000000..1530f4e
--- /dev/null
+++ b/SOURCES/libvirt-Add-testdata-for-AMD-EPYC-7502.patch
@@ -0,0 +1,2173 @@
+From a2f2e97422de810517a77d8f098564e3b6c0f7c2 Mon Sep 17 00:00:00 2001
+Message-Id: cpus
specifies the CPU or range of CPUs that are
+ part of the node. memory
specifies the node memory
+ in kibibytes (i.e. blocks of 1024 bytes).
++ Since 6.6.0 the cpus
attribute
++ is optional and if omitted a CPU-less NUMA node is created.
+ Since 1.2.11 one can use an additional unit
attribute to
+ define units in which memory
is specified.
+diff --git a/docs/schemas/cputypes.rng b/docs/schemas/cputypes.rng
+index e2744acad3..a1682a1003 100644
+--- a/docs/schemas/cputypes.rng
++++ b/docs/schemas/cputypes.rng
+@@ -115,9 +115,11 @@
+
+
+
+-
++... ++<cpu> ++ ... ++ <numa> ++ <cell id='0' cpus='0-3' memory='512000' unit='KiB' discard='yes'/> ++ <cell id='1' cpus='4-7' memory='512000' unit='KiB' memAccess='shared'/> ++ <cell id='3' cpus='0-3' memory='2097152' unit='KiB'> ++ <cache level='1' associativity='direct' policy='writeback'> ++ <size value='10' unit='KiB'/> ++ <line value='8' unit='B'/> ++ </cache> ++ </cell> ++ <interconnects> ++ <latency initiator='0' target='0' type='access' value='5'/> ++ <latency initiator='0' target='0' cache='1' type='access' value='10'/> ++ <bandwidth initiator='0' target='0' type='access' value='204800' unit='KiB'/> ++ </interconnects> ++ </numa> ++ ... ++</cpu> ++...++ ++
++ Since 6.6.0 the cell
element can
++ have a cache
child element which describes memory side cache
++ for memory proximity domains. The cache
element has a
++ level
attribute describing the cache level and thus the
++ element can be repeated multiple times to describe different levels of
++ the cache.
++
++ The cache
element then has following mandatory attributes:
++
level
associativity
none
,
++ direct
and full
).
++ policy
none
, writeback
and
++ writethrough
).
++
++ The cache
element has two mandatory child elements then:
++ size
and line
which describe cache size and
++ cache line size. Both elements accept two attributes: value
++ and unit
which set the value of corresponding cache
++ attribute.
++
++ The NUMA description has an optional interconnects
element that
++ describes the normalized memory read/write latency, read/write bandwidth
++ between Initiator Proximity Domains (Processor or I/O) and Target
++ Proximity Domains (Memory).
++
++ The interconnects
element can have zero or more
++ latency
child elements to describe latency between two
++ memory nodes and zero or more bandwidth
child elements to
++ describe bandwidth between two memory nodes. Both these have the
++ following mandatory attributes:
++
initiator
target
type
access
,
++ read
, write
value
unit
attribute to change the units.
++ To describe latency from one NUMA node to a cache of another NUMA node
++ the latency
element has optional cache
++ attribute which in combination with target
attribute creates
++ full reference to distant NUMA node's cache level. For instance,
++ target='0' cache='1'
refers to the first level cache of NUMA
++ node 0.
++
+diff --git a/docs/schemas/cputypes.rng b/docs/schemas/cputypes.rng
+index a1682a1003..ba30dbf9ff 100644
+--- a/docs/schemas/cputypes.rng
++++ b/docs/schemas/cputypes.rng
+@@ -102,9 +102,14 @@
+
+ quota
as any
+ negative value indicates that the domain has infinite bandwidth for
+ vCPU threads, which means that it is not bandwidth controlled. The value
+- should be in range [1000, 18446744073709551] or less than 0. A quota
++ should be in range [1000, 17592186044415] or less than 0. A quota
+ with value 0 means no value. You can use this feature to ensure that all
+ vCPUs run at the same speed.
+ Only QEMU driver support since 0.9.4, LXC since
+@@ -894,7 +894,7 @@
+ domain. A domain with global_quota
as any negative
+ value indicates that the domain has infinite bandwidth, which means that
+ it is not bandwidth controlled. The value should be in range
+- [1000, 18446744073709551] or less than 0. A global_quota
++ [1000, 17592186044415] or less than 0. A global_quota
+ with value 0 means no value.
+ Only QEMU driver support since 1.3.3
+
+@@ -915,7 +915,7 @@
+ excluding vCPUs). A domain with emulator_quota
as any negative
+ value indicates that the domain has infinite bandwidth for emulator threads
+ (those excluding vCPUs), which means that it is not bandwidth controlled.
+- The value should be in range [1000, 18446744073709551] or less than 0. A
++ The value should be in range [1000, 17592186044415] or less than 0. A
+ quota with value 0 means no value.
+ Only QEMU driver support since 0.10.0
+
+@@ -937,7 +937,7 @@
+ iothread_quota
as any negative value indicates that the
+ domain IOThreads have infinite bandwidth, which means that it is
+ not bandwidth controlled. The value should be in range
+- [1000, 18446744073709551] or less than 0. An iothread_quota
++ [1000, 17592186044415] or less than 0. An iothread_quota
+ with value 0 means no value. You can use this feature to ensure that
+ all IOThreads run at the same speed.
+ Only QEMU driver support since 2.1.0
+diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst
+index 0804465d44..a5b95c1123 100644
+--- a/docs/manpages/virsh.rst
++++ b/docs/manpages/virsh.rst
+@@ -3715,7 +3715,7 @@ XEN_CREDIT scheduler.
+ ``Note``: The vcpu_period, emulator_period, and iothread_period parameters
+ have a valid value range of 1000-1000000 or 0, and the vcpu_quota,
+ emulator_quota, and iothread_quota parameters have a valid value range of
+-1000-18446744073709551 or less than 0. The value 0 for
++1000-17592186044415 or less than 0. The value 0 for
+ either parameter is the same as not specifying that parameter.
+
+
+diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng
+index 4a42cb9b40..6671ef3dfa 100644
+--- a/docs/schemas/domaincommon.rng
++++ b/docs/schemas/domaincommon.rng
+@@ -6649,7 +6649,7 @@
+ auto
is set to yes
, libvirt
+ will assign a free CID automatically on domain startup.
+- Since 4.4.0
driver
element allows to specify virtio options, see
++ Virtio-specific options for more details.
++ Since 7.1.0
+
+ + ... +diff --git a/docs/schemas/domaincommon.rng b/docs/schemas/domaincommon.rng +index 9fda5f17e0..4a42cb9b40 100644 +--- a/docs/schemas/domaincommon.rng ++++ b/docs/schemas/domaincommon.rng +@@ -4685,6 +4685,11 @@ ++ +++ + ++++ + + + +diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c +index c5a0442c6f..166c3e48d2 100644 +--- a/src/conf/domain_conf.c ++++ b/src/conf/domain_conf.c +@@ -2392,6 +2392,7 @@ virDomainVsockDefFree(virDomainVsockDefPtr vsock) + + virObjectUnref(vsock->privateData); + virDomainDeviceInfoClear(&vsock->info); ++ VIR_FREE(vsock->virtio); + VIR_FREE(vsock); + } + +@@ -6504,6 +6505,15 @@ virDomainMemoryDefValidate(const virDomainMemoryDef *mem) + } + + ++static bool ++virDomainVsockIsVirtioModel(const virDomainVsockDef *vsock) ++{ ++ return (vsock->model == VIR_DOMAIN_VSOCK_MODEL_VIRTIO || ++ vsock->model == VIR_DOMAIN_VSOCK_MODEL_VIRTIO_TRANSITIONAL || ++ vsock->model == VIR_DOMAIN_VSOCK_MODEL_VIRTIO_NON_TRANSITIONAL); ++} ++ ++ + static int + virDomainVsockDefValidate(const virDomainVsockDef *vsock) + { +@@ -6513,6 +6523,10 @@ virDomainVsockDefValidate(const virDomainVsockDef *vsock) + return -1; + } + ++ if (!virDomainVsockIsVirtioModel(vsock) && ++ virDomainCheckVirtioOptions(vsock->virtio) < 0) ++ return -1; ++ + return 0; + } + +@@ -16649,6 +16663,11 @@ virDomainVsockDefParseXML(virDomainXMLOptionPtr xmlopt, + if (virDomainDeviceInfoParseXML(xmlopt, node, &vsock->info, flags) < 0) + return NULL; + ++ if (virDomainVirtioOptionsParseXML(virXPathNode("./driver", ctxt), ++ &vsock->virtio) < 0) ++ return NULL; ++ ++ + return g_steal_pointer(&vsock); + } + +@@ -23350,6 +23369,10 @@ virDomainVsockDefCheckABIStability(virDomainVsockDefPtr src, + return false; + } + ++ if (src->virtio && dst->virtio && ++ !virDomainVirtioOptionsCheckABIStability(src->virtio, dst->virtio)) ++ return false; ++ + if (!virDomainDeviceInfoCheckABIStability(&src->info, &dst->info)) + return false; + +@@ -28364,6 +28387,7 @@ virDomainVsockDefFormat(virBufferPtr buf, + g_auto(virBuffer) childBuf = VIR_BUFFER_INIT_CHILD(buf); + g_auto(virBuffer) attrBuf = VIR_BUFFER_INITIALIZER; + g_auto(virBuffer) cidAttrBuf = VIR_BUFFER_INITIALIZER; ++ g_auto(virBuffer) drvAttrBuf = VIR_BUFFER_INITIALIZER; + + if (vsock->model) { + virBufferAsprintf(&attrBuf, " model='%s'", +@@ -28381,6 +28405,9 @@ virDomainVsockDefFormat(virBufferPtr buf, + if (virDomainDeviceInfoFormat(&childBuf, &vsock->info, 0) < 0) + return -1; + ++ virDomainVirtioOptionsFormat(&drvAttrBuf, vsock->virtio); ++ ++ virXMLFormatElement(&childBuf, "driver", &drvAttrBuf, NULL); + virXMLFormatElement(buf, "vsock", &attrBuf, &childBuf); + + return 0; +diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h +index 118077edaa..3aed1fb22a 100644 +--- a/src/conf/domain_conf.h ++++ b/src/conf/domain_conf.h +@@ -2389,6 +2389,7 @@ struct _virDomainVsockDef { + virTristateBool auto_cid; + + virDomainDeviceInfo info; ++ virDomainVirtioOptionsPtr virtio; + }; + + struct _virDomainVirtioOptions { +diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c +index 67d7334b0f..998c3c90f8 100644 +--- a/src/qemu/qemu_command.c ++++ b/src/qemu/qemu_command.c +@@ -9965,6 +9965,10 @@ qemuBuildVsockDevStr(virDomainDefPtr def, + virBufferAsprintf(&buf, ",id=%s", vsock->info.alias); + virBufferAsprintf(&buf, ",guest-cid=%u", vsock->guest_cid); + virBufferAsprintf(&buf, ",vhostfd=%s%u", fdprefix, priv->vhostfd); ++ ++ if (qemuBuildVirtioOptionsStr(&buf, vsock->virtio, qemuCaps) < 0) ++ return NULL; ++ + if (qemuBuildDeviceAddressStr(&buf, def, &vsock->info, qemuCaps) < 0) + return NULL; + +diff --git a/tests/qemuxml2argvdata/vhost-vsock-ccw-iommu.s390x-latest.args b/tests/qemuxml2argvdata/vhost-vsock-ccw-iommu.s390x-latest.args +new file mode 100644 +index 0000000000..78eede78d3 +--- /dev/null ++++ b/tests/qemuxml2argvdata/vhost-vsock-ccw-iommu.s390x-latest.args +@@ -0,0 +1,37 @@ ++LC_ALL=C \ ++PATH=/bin \ ++HOME=/tmp/lib/domain--1-QEMUGuest1 \ ++USER=test \ ++LOGNAME=test \ ++XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest1/.local/share \ ++XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest1/.cache \ ++XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest1/.config \ ++QEMU_AUDIO_DRV=none \ ++/usr/bin/qemu-system-s390x \ ++-name guest=QEMUGuest1,debug-threads=on \ ++-S \ ++-object secret,id=masterKey0,format=raw,\ ++file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \ ++-machine s390-ccw-virtio,accel=tcg,usb=off,dump-guest-core=off \ ++-cpu qemu \ ++-m 214 \ ++-overcommit mem-lock=off \ ++-smp 1,sockets=1,cores=1,threads=1 \ ++-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ ++-display none \ ++-no-user-config \ ++-nodefaults \ ++-chardev socket,id=charmonitor,fd=1729,server,nowait \ ++-mon chardev=charmonitor,id=monitor,mode=control \ ++-rtc base=utc \ ++-no-shutdown \ ++-boot strict=on \ ++-drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-virtio-disk0 \ ++-device virtio-blk-ccw,scsi=off,devno=fe.0.0000,drive=drive-virtio-disk0,\ ++id=virtio-disk0,bootindex=1 \ ++-device virtio-balloon-ccw,id=balloon0,devno=fe.0.0001 \ ++-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\ ++resourcecontrol=deny \ ++-device vhost-vsock-ccw,id=vsock0,guest-cid=4,vhostfd=6789,iommu_platform=on,\ ++devno=fe.0.0002 \ ++-msg timestamp=on +diff --git a/tests/qemuxml2argvdata/vhost-vsock-ccw-iommu.xml b/tests/qemuxml2argvdata/vhost-vsock-ccw-iommu.xml +new file mode 100644 +index 0000000000..dbfe082a6f +--- /dev/null ++++ b/tests/qemuxml2argvdata/vhost-vsock-ccw-iommu.xml +@@ -0,0 +1,37 @@ ++++ ++ ++++ +diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c +index 629f5ac100..a22e3ba157 100644 +--- a/tests/qemuxml2argvtest.c ++++ b/tests/qemuxml2argvtest.c +@@ -3056,6 +3056,7 @@ mymain(void) + DO_TEST_CAPS_LATEST("vhost-vsock-auto"); + DO_TEST_CAPS_ARCH_LATEST("vhost-vsock-ccw", "s390x"); + DO_TEST_CAPS_ARCH_LATEST("vhost-vsock-ccw-auto", "s390x"); ++ DO_TEST_CAPS_ARCH_LATEST("vhost-vsock-ccw-iommu", "s390x"); + + DO_TEST_CAPS_VER("launch-security-sev", "2.12.0"); + +diff --git a/tests/qemuxml2xmloutdata/vhost-vsock-ccw-iommu.s390x-latest.xml b/tests/qemuxml2xmloutdata/vhost-vsock-ccw-iommu.s390x-latest.xml +new file mode 120000 +index 0000000000..78971a8ef9 +--- /dev/null ++++ b/tests/qemuxml2xmloutdata/vhost-vsock-ccw-iommu.s390x-latest.xml +@@ -0,0 +1 @@ ++../qemuxml2argvdata/vhost-vsock-ccw-iommu.xml +\ No newline at end of file +diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c +index 60efcac6c8..461b5bc68f 100644 +--- a/tests/qemuxml2xmltest.c ++++ b/tests/qemuxml2xmltest.c +@@ -1433,6 +1433,8 @@ mymain(void) + QEMU_CAPS_CCW); + DO_TEST("vhost-vsock-ccw-auto", QEMU_CAPS_DEVICE_VHOST_VSOCK, + QEMU_CAPS_CCW); ++ DO_TEST_CAPS_ARCH_LATEST("vhost-vsock-ccw-iommu", "s390x"); ++ + + DO_TEST_CAPS_LATEST("vhost-user-fs-fd-memory"); + DO_TEST_CAPS_LATEST("vhost-user-fs-hugepages"); +-- +2.30.0 + diff --git a/SOURCES/libvirt-qemu-Build-HMAT-command-line.patch b/SOURCES/libvirt-qemu-Build-HMAT-command-line.patch new file mode 100644 index 0000000..d65e257 --- /dev/null +++ b/SOURCES/libvirt-qemu-Build-HMAT-command-line.patch @@ -0,0 +1,388 @@ +From fe08906feb3ab006c4013957895cfb4fa69b7396 Mon Sep 17 00:00:00 2001 +Message-Id:QEMUGuest1 ++c7a5fdbd-edaf-9455-926a-d65c16db1809 ++219136 ++219136 ++1 ++++ ++hvm ++++ ++ ++qemu ++++ destroy ++restart ++destroy ++++ ++/usr/bin/qemu-system-s390x ++++ ++++ ++ ++ ++ ++ ++ ++ ++++ ++ ++++ ++ ++ +From: Michal Privoznik +Date: Wed, 7 Oct 2020 18:45:43 +0200 +Subject: [PATCH] qemu: Build HMAT command line +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1786303 + +Signed-off-by: Michal Privoznik +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit aeecbc87b7317e88a8ef8c82b29bcacd1005c8c2) + +Apart from conflicts below, I had to remove '-cpu qemu64' from +tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args to make +qemuxml2argvtest happy. This is because +3b8feb4793cef66f5dbfb9bdabe4d40834f1e90e isn't backported. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Conflicts: +- src/qemu/qemu_command.c: Context +- src/qemu/qemu_validate.c: The file doesn't exist in downstream. +I've made the change to validator that lives in qemu_domain.c. + +Signed-off-by: Michal Privoznik +Message-Id: <0e8dfded8022b564ec7d0563cd745a0d3ffc815f.1602087923.git.mprivozn@redhat.com> +Reviewed-by: Ján Tomko +--- + src/conf/numa_conf.c | 7 + + src/qemu/qemu_command.c | 171 ++++++++++++++++++ + src/qemu/qemu_domain.c | 7 + + .../numatune-hmat.x86_64-latest.args | 52 ++++++ + tests/qemuxml2argvtest.c | 1 + + tests/qemuxml2xmltest.c | 2 +- + 6 files changed, 239 insertions(+), 1 deletion(-) + create mode 100644 tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args + +diff --git a/src/conf/numa_conf.c b/src/conf/numa_conf.c +index 277a695d84..5a92eb35cc 100644 +--- a/src/conf/numa_conf.c ++++ b/src/conf/numa_conf.c +@@ -1875,6 +1875,13 @@ virDomainNumaGetNodeInitiator(const virDomainNuma *numa, + if (!numa || node >= numa->nmem_nodes) + return -1; + ++ /* A NUMA node which has at least one vCPU is initiator to itself by ++ * definition. */ ++ if (numa->mem_nodes[node].cpumask) ++ return node; ++ ++ /* For the rest, "NUMA node that has best performance (the lowest ++ * latency or largest bandwidth) to this NUMA node." */ + for (i = 0; i < numa->ninterconnects; i++) { + const virDomainNumaInterconnect *l = &numa->interconnects[i]; + +diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c +index ac63d18a42..959207bfea 100644 +--- a/src/qemu/qemu_command.c ++++ b/src/qemu/qemu_command.c +@@ -7172,6 +7172,9 @@ qemuBuildMachineCommandLine(virCommandPtr cmd, + virBufferAsprintf(&buf, ",pflash1=%s", priv->pflash1->nodeformat); + } + ++ if (virDomainNumaHasHMAT(def->numa)) ++ virBufferAddLit(&buf, ",hmat=on"); ++ + virCommandAddArgBuffer(cmd, &buf); + + return 0; +@@ -7355,6 +7358,134 @@ qemuBuildIOThreadCommandLine(virCommandPtr cmd, + } + + ++static int ++qemuBuilNumaCellCache(virCommandPtr cmd, ++ const virDomainDef *def, ++ size_t cell) ++{ ++ size_t ncaches = virDomainNumaGetNodeCacheCount(def->numa, cell); ++ size_t i; ++ ++ if (ncaches == 0) ++ return 0; ++ ++ for (i = 0; i < ncaches; i++) { ++ g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; ++ unsigned int level; ++ unsigned int size; ++ unsigned int line; ++ virDomainCacheAssociativity associativity; ++ virDomainCachePolicy policy; ++ ++ if (virDomainNumaGetNodeCache(def->numa, cell, i, ++ &level, &size, &line, ++ &associativity, &policy) < 0) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", ++ _("Unable to format NUMA node cache")); ++ return -1; ++ } ++ ++ virBufferAsprintf(&buf, ++ "hmat-cache,node-id=%zu,size=%uK,level=%u", ++ cell, size, level); ++ ++ switch (associativity) { ++ case VIR_DOMAIN_CACHE_ASSOCIATIVITY_NONE: ++ virBufferAddLit(&buf, ",associativity=none"); ++ break; ++ case VIR_DOMAIN_CACHE_ASSOCIATIVITY_DIRECT: ++ virBufferAddLit(&buf, ",associativity=direct"); ++ break; ++ case VIR_DOMAIN_CACHE_ASSOCIATIVITY_FULL: ++ virBufferAddLit(&buf, ",associativity=complex"); ++ break; ++ case VIR_DOMAIN_CACHE_ASSOCIATIVITY_LAST: ++ break; ++ } ++ ++ switch (policy) { ++ case VIR_DOMAIN_CACHE_POLICY_NONE: ++ virBufferAddLit(&buf, ",policy=none"); ++ break; ++ case VIR_DOMAIN_CACHE_POLICY_WRITEBACK: ++ virBufferAddLit(&buf, ",policy=write-back"); ++ break; ++ case VIR_DOMAIN_CACHE_POLICY_WRITETHROUGH: ++ virBufferAddLit(&buf, ",policy=write-through"); ++ break; ++ case VIR_DOMAIN_CACHE_POLICY_LAST: ++ break; ++ } ++ ++ if (line > 0) ++ virBufferAsprintf(&buf, ",line=%u", line); ++ ++ virCommandAddArg(cmd, "-numa"); ++ virCommandAddArgBuffer(cmd, &buf); ++ } ++ ++ return 0; ++} ++ ++ ++VIR_ENUM_DECL(qemuDomainMemoryHierarchy); ++VIR_ENUM_IMPL(qemuDomainMemoryHierarchy, ++ 4, /* Maximum level of cache */ ++ "memory", /* Special case, whole memory not specific cache */ ++ "first-level", ++ "second-level", ++ "third-level"); ++ ++static int ++qemuBuildNumaHMATCommandLine(virCommandPtr cmd, ++ const virDomainDef *def) ++{ ++ size_t nlatencies; ++ size_t i; ++ ++ if (!def->numa) ++ return 0; ++ ++ nlatencies = virDomainNumaGetInterconnectsCount(def->numa); ++ for (i = 0; i < nlatencies; i++) { ++ g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; ++ virDomainNumaInterconnectType type; ++ unsigned int initiator; ++ unsigned int target; ++ unsigned int cache; ++ virDomainMemoryLatency accessType; ++ unsigned long value; ++ const char *hierarchyStr; ++ const char *accessStr; ++ ++ if (virDomainNumaGetInterconnect(def->numa, i, ++ &type, &initiator, &target, ++ &cache, &accessType, &value) < 0) ++ return -1; ++ ++ hierarchyStr = qemuDomainMemoryHierarchyTypeToString(cache); ++ accessStr = virDomainMemoryLatencyTypeToString(accessType); ++ virBufferAsprintf(&buf, ++ "hmat-lb,initiator=%u,target=%u,hierarchy=%s,data-type=%s-", ++ initiator, target, hierarchyStr, accessStr); ++ ++ switch (type) { ++ case VIR_DOMAIN_NUMA_INTERCONNECT_TYPE_LATENCY: ++ virBufferAsprintf(&buf, "latency,latency=%lu", value); ++ break; ++ case VIR_DOMAIN_NUMA_INTERCONNECT_TYPE_BANDWIDTH: ++ virBufferAsprintf(&buf, "bandwidth,bandwidth=%luK", value); ++ break; ++ } ++ ++ virCommandAddArg(cmd, "-numa"); ++ virCommandAddArgBuffer(cmd, &buf); ++ } ++ ++ return 0; ++} ++ ++ + static int + qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, + virDomainDefPtr def, +@@ -7367,13 +7498,20 @@ qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, + char *next = NULL; + virBufferPtr nodeBackends = NULL; + bool needBackend = false; ++ bool hmat = false; + int rc; + int ret = -1; + size_t ncells = virDomainNumaGetNodeCount(def->numa); ++ ssize_t masterInitiator = -1; + + if (!virDomainNumatuneNodesetIsAvailable(def->numa, priv->autoNodeset)) + goto cleanup; + ++ if (virDomainNumaHasHMAT(def->numa)) { ++ needBackend = true; ++ hmat = true; ++ } ++ + if (VIR_ALLOC_N(nodeBackends, ncells) < 0) + goto cleanup; + +@@ -7397,8 +7535,22 @@ qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, + qemuBuildMemPathStr(cfg, def, cmd, priv) < 0) + goto cleanup; + ++ for (i = 0; i < ncells; i++) { ++ if (virDomainNumaGetNodeCpumask(def->numa, i)) { ++ masterInitiator = i; ++ break; ++ } ++ } ++ ++ if (masterInitiator) { ++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", ++ _("At least one NUMA node has to have CPUs")); ++ goto cleanup; ++ } ++ + for (i = 0; i < ncells; i++) { + virBitmapPtr cpumask = virDomainNumaGetNodeCpumask(def->numa, i); ++ ssize_t initiator = virDomainNumaGetNodeInitiator(def->numa, i); + + if (needBackend) { + virCommandAddArg(cmd, "-object"); +@@ -7423,6 +7575,13 @@ qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, + } + } + ++ if (hmat) { ++ if (initiator < 0) ++ initiator = masterInitiator; ++ ++ virBufferAsprintf(&buf, ",initiator=%zd", initiator); ++ } ++ + if (needBackend) + virBufferAsprintf(&buf, ",memdev=ram-node%zu", i); + else +@@ -7448,6 +7607,18 @@ qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, + } + } + ++ if (hmat) { ++ if (qemuBuildNumaHMATCommandLine(cmd, def) < 0) ++ goto cleanup; ++ ++ /* This can't be moved into any of the loops above, ++ * because hmat-cache can be specified only after hmat-lb. */ ++ for (i = 0; i < ncells; i++) { ++ if (qemuBuilNumaCellCache(cmd, def, i) < 0) ++ goto cleanup; ++ } ++ } ++ + ret = 0; + + cleanup: +diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c +index be25790f12..e51e176a80 100644 +--- a/src/qemu/qemu_domain.c ++++ b/src/qemu/qemu_domain.c +@@ -5904,6 +5904,13 @@ qemuDomainDefValidate(const virDomainDef *def, + } + } + ++ if (virDomainNumaHasHMAT(def->numa) && ++ !virQEMUCapsGet(qemuCaps, QEMU_CAPS_NUMA_HMAT)) { ++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", ++ _("HMAT is not supported with this QEMU")); ++ return -1; ++ } ++ + if (def->genidRequested && + !virQEMUCapsGet(qemuCaps, QEMU_CAPS_DEVICE_VMGENID)) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", +diff --git a/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args b/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args +new file mode 100644 +index 0000000000..413d247a4d +--- /dev/null ++++ b/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args +@@ -0,0 +1,52 @@ ++LC_ALL=C \ ++PATH=/bin \ ++HOME=/tmp/lib/domain--1-QEMUGuest \ ++USER=test \ ++LOGNAME=test \ ++XDG_DATA_HOME=/tmp/lib/domain--1-QEMUGuest/.local/share \ ++XDG_CACHE_HOME=/tmp/lib/domain--1-QEMUGuest/.cache \ ++XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest/.config \ ++QEMU_AUDIO_DRV=none \ ++/usr/bin/qemu-system-x86_64 \ ++-name guest=QEMUGuest,debug-threads=on \ ++-S \ ++-object secret,id=masterKey0,format=raw,\ ++file=/tmp/lib/domain--1-QEMUGuest/master-key.aes \ ++-machine pc,accel=tcg,usb=off,dump-guest-core=off,hmat=on \ ++-m 12288 \ ++-overcommit mem-lock=off \ ++-smp 12,sockets=12,cores=1,threads=1 \ ++-object memory-backend-ram,id=ram-node0,size=2147483648 \ ++-numa node,nodeid=0,cpus=0-3,initiator=0,memdev=ram-node0 \ ++-object memory-backend-ram,id=ram-node1,size=2147483648 \ ++-numa node,nodeid=1,cpus=4-7,initiator=1,memdev=ram-node1 \ ++-object memory-backend-ram,id=ram-node2,size=2147483648 \ ++-numa node,nodeid=2,cpus=8-11,initiator=2,memdev=ram-node2 \ ++-object memory-backend-ram,id=ram-node3,size=2147483648 \ ++-numa node,nodeid=3,initiator=0,memdev=ram-node3 \ ++-object memory-backend-ram,id=ram-node4,size=2147483648 \ ++-numa node,nodeid=4,initiator=0,memdev=ram-node4 \ ++-object memory-backend-ram,id=ram-node5,size=2147483648 \ ++-numa node,nodeid=5,initiator=0,memdev=ram-node5 \ ++-numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-latency,\ ++latency=5 \ ++-numa hmat-lb,initiator=0,target=0,hierarchy=first-level,\ ++data-type=access-latency,latency=10 \ ++-numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-bandwidth,\ ++bandwidth=204800K \ ++-numa hmat-cache,node-id=0,size=10K,level=1,associativity=direct,\ ++policy=write-back,line=8 \ ++-uuid c7a5fdb2-cdaf-9455-926a-d65c16db1809 \ ++-display none \ ++-no-user-config \ ++-nodefaults \ ++-chardev socket,id=charmonitor,fd=1729,server,nowait \ ++-mon chardev=charmonitor,id=monitor,mode=control \ ++-rtc base=utc \ ++-no-shutdown \ ++-boot strict=on \ ++-device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \ ++-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \ ++-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\ ++resourcecontrol=deny \ ++-msg timestamp=on +diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c +index 49699e495d..629f5ac100 100644 +--- a/tests/qemuxml2argvtest.c ++++ b/tests/qemuxml2argvtest.c +@@ -1813,6 +1813,7 @@ mymain(void) + + DO_TEST("numatune-distances", QEMU_CAPS_NUMA, QEMU_CAPS_NUMA_DIST); + DO_TEST("numatune-no-vcpu", NONE); ++ DO_TEST_CAPS_LATEST("numatune-hmat"); + + DO_TEST("numatune-auto-nodeset-invalid", NONE); + DO_TEST("numatune-auto-prefer", QEMU_CAPS_OBJECT_MEMORY_RAM, +diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c +index de1d720e1d..f790bbc6f1 100644 +--- a/tests/qemuxml2xmltest.c ++++ b/tests/qemuxml2xmltest.c +@@ -1106,7 +1106,7 @@ mymain(void) + DO_TEST("numatune-memnode-no-memory", QEMU_CAPS_OBJECT_MEMORY_FILE); + DO_TEST("numatune-distances", QEMU_CAPS_NUMA, QEMU_CAPS_NUMA_DIST); + DO_TEST("numatune-no-vcpu", QEMU_CAPS_NUMA); +- DO_TEST("numatune-hmat", NONE); ++ DO_TEST("numatune-hmat", QEMU_CAPS_NUMA_HMAT); + + DO_TEST("bios-nvram", NONE); + DO_TEST("bios-nvram-os-interleave", NONE); +-- +2.29.2 + diff --git a/SOURCES/libvirt-qemu-Introduce-QEMU_CAPS_NUMA_HMAT-capability.patch b/SOURCES/libvirt-qemu-Introduce-QEMU_CAPS_NUMA_HMAT-capability.patch new file mode 100644 index 0000000..1354f7c --- /dev/null +++ b/SOURCES/libvirt-qemu-Introduce-QEMU_CAPS_NUMA_HMAT-capability.patch @@ -0,0 +1,97 @@ +From f1de31795f1010016beab3b669db821799e5a6d3 Mon Sep 17 00:00:00 2001 +Message-Id: +From: Michal Privoznik +Date: Wed, 7 Oct 2020 18:45:42 +0200 +Subject: [PATCH] qemu: Introduce QEMU_CAPS_NUMA_HMAT capability +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This capability tracks whether QEMU is capable of defining HMAT +ACPI table for the guest. + +Signed-off-by: Michal Privoznik +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit c2f15f1b1869c1732e529967d1851582409290fb) + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Conflicts: +- src/qemu/qemu_capabilities.c: The set of capabilities diverged. +- src/qemu/qemu_capabilities.h: Ditto. +- tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml: Ditto. +- tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml: Ditto. +- tests/qemucapabilitiesdata/caps_5.0.0.ppc64.xml: Doesn't exist + downstream. +- tests/qemucapabilitiesdata/caps_5.0.0.riscv64.xml: Ditto. +- tests/qemucapabilitiesdata/caps_5.1.0.x86_64.xml: Ditto. + +Signed-off-by: Michal Privoznik +Message-Id: +Reviewed-by: Ján Tomko +--- + src/qemu/qemu_capabilities.c | 2 ++ + src/qemu/qemu_capabilities.h | 1 + + tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml | 1 + + tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml | 1 + + 4 files changed, 5 insertions(+) + +diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c +index 278eaa0009..ce52c51199 100644 +--- a/src/qemu/qemu_capabilities.c ++++ b/src/qemu/qemu_capabilities.c +@@ -568,6 +568,7 @@ VIR_ENUM_IMPL(virQEMUCaps, + "storage.werror", + "pcie-root-port.hotplug", + "i8042", ++ "numa.hmat", + ); + + +@@ -1451,6 +1452,7 @@ static struct virQEMUCapsStringFlags virQEMUCapsQMPSchemaQueries[] = { + { "human-monitor-command/$savevm-monitor-nodes", QEMU_CAPS_SAVEVM_MONITOR_NODES }, + { "blockdev-add/arg-type/+nvme", QEMU_CAPS_DRIVE_NVME }, + { "blockdev-snapshot/$allow-write-only-overlay", QEMU_CAPS_BLOCKDEV_SNAPSHOT_ALLOW_WRITE_ONLY }, ++ { "set-numa-node/arg-type/+hmat-lb", QEMU_CAPS_NUMA_HMAT }, + }; + + typedef struct _virQEMUCapsObjectTypeProps virQEMUCapsObjectTypeProps; +diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h +index 15ebcb5077..98cac5b9dc 100644 +--- a/src/qemu/qemu_capabilities.h ++++ b/src/qemu/qemu_capabilities.h +@@ -548,6 +548,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */ + QEMU_CAPS_STORAGE_WERROR, /* virtio-blk,scsi-hd.werror */ + QEMU_CAPS_PCIE_ROOT_PORT_HOTPLUG, /* pcie-root-port.hotplug */ + QEMU_CAPS_DEVICE_I8042, /* PS/2 controller */ ++ QEMU_CAPS_NUMA_HMAT, /* -numa hmat */ + + QEMU_CAPS_LAST /* this must always be the last item */ + } virQEMUCapsFlags; +diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml +index 140a466910..92da5cbd94 100644 +--- a/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml ++++ b/tests/qemucapabilitiesdata/caps_5.0.0.aarch64.xml +@@ -181,6 +181,7 @@ + + + ++ + 4002050 +0 +61700241 +diff --git a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml +index 733e6b1eb4..0b841a49ac 100644 +--- a/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml ++++ b/tests/qemucapabilitiesdata/caps_5.0.0.x86_64.xml +@@ -226,6 +226,7 @@ ++ + ++ + 4002091 +0 +43100241 +-- +2.29.2 + diff --git a/SOURCES/libvirt-qemu-format-ramfb-attribute-for-mediated-devices.patch b/SOURCES/libvirt-qemu-format-ramfb-attribute-for-mediated-devices.patch new file mode 100644 index 0000000..8545d91 --- /dev/null +++ b/SOURCES/libvirt-qemu-format-ramfb-attribute-for-mediated-devices.patch @@ -0,0 +1,114 @@ +From 9a993a7d566b7acdc548c1f0114b99fe17ba3c12 Mon Sep 17 00:00:00 2001 +Message-Id: <9a993a7d566b7acdc548c1f0114b99fe17ba3c12@dist-git> +From: Jonathon Jongsma+Date: Fri, 4 Dec 2020 15:02:42 -0600 +Subject: [PATCH] qemu: format 'ramfb' attribute for mediated devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +It's possible to use ramfb as the boot display of an assigned vgpu +device. This was introduced in 4b95738c, but unfortunately the attribute +was not formatted into the xml output for such a device. This patch +fixes that oversight and adds a xml2xml test to verify proper behavior. + +https://bugzilla.redhat.com/show_bug.cgi?id=1847791 + +(the expected test results were massaged slightly due to the fact that +commit 3b8feb4793cef66f5dbfb9bdabe4d40834f1e90e is not present in this +build). + +Signed-off-by: Jonathon Jongsma +Reviewed-by: Daniel Henrique Barboza +Signed-off-by: Ján Tomko +Reviewed-by: Ján Tomko +(cherry picked from commit c5815b31976f3982d18c7f6c1367ab6e403eb7eb) + +https://bugzilla.redhat.com/show_bug.cgi?id=1876297 + +Signed-off-by: Jonathon Jongsma +Message-Id: <20201204210242.822641-2-jjongsma@redhat.com> +Reviewed-by: Michal Privoznik +--- + src/conf/domain_conf.c | 3 ++ + ...stdev-mdev-display-ramfb.x86_64-latest.xml | 41 +++++++++++++++++++ + tests/qemuxml2xmltest.c | 1 + + 3 files changed, 45 insertions(+) + create mode 100644 tests/qemuxml2xmloutdata/hostdev-mdev-display-ramfb.x86_64-latest.xml + +diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c +index cd5c15f297..c5a0442c6f 100644 +--- a/src/conf/domain_conf.c ++++ b/src/conf/domain_conf.c +@@ -27603,6 +27603,9 @@ virDomainHostdevDefFormat(virBufferPtr buf, + if (mdevsrc->display != VIR_TRISTATE_SWITCH_ABSENT) + virBufferAsprintf(buf, " display='%s'", + virTristateSwitchTypeToString(mdevsrc->display)); ++ if (mdevsrc->ramfb != VIR_TRISTATE_SWITCH_ABSENT) ++ virBufferAsprintf(buf, " ramfb='%s'", ++ virTristateSwitchTypeToString(mdevsrc->ramfb)); + } + + } +diff --git a/tests/qemuxml2xmloutdata/hostdev-mdev-display-ramfb.x86_64-latest.xml b/tests/qemuxml2xmloutdata/hostdev-mdev-display-ramfb.x86_64-latest.xml +new file mode 100644 +index 0000000000..90c49842a5 +--- /dev/null ++++ b/tests/qemuxml2xmloutdata/hostdev-mdev-display-ramfb.x86_64-latest.xml +@@ -0,0 +1,41 @@ ++ ++ +diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c +index f790bbc6f1..60efcac6c8 100644 +--- a/tests/qemuxml2xmltest.c ++++ b/tests/qemuxml2xmltest.c +@@ -524,6 +524,7 @@ mymain(void) + QEMU_CAPS_VFIO_PCI_DISPLAY, + QEMU_CAPS_DEVICE_VFIO_PCI, + QEMU_CAPS_VNC); ++ DO_TEST_CAPS_LATEST("hostdev-mdev-display-ramfb"); + DO_TEST("pci-rom", NONE); + DO_TEST("pci-rom-disabled", NONE); + DO_TEST("pci-rom-disabled-invalid", NONE); +-- +2.29.2 + diff --git a/SOURCES/libvirt-qemu-move-cgroup-cpu-period-and-quota-defines-to-vircgroup.h.patch b/SOURCES/libvirt-qemu-move-cgroup-cpu-period-and-quota-defines-to-vircgroup.h.patch new file mode 100644 index 0000000..2ee6d62 --- /dev/null +++ b/SOURCES/libvirt-qemu-move-cgroup-cpu-period-and-quota-defines-to-vircgroup.h.patch @@ -0,0 +1,130 @@ +From 7a964b43185f4d818eec0c39197bde17371f4c2b Mon Sep 17 00:00:00 2001 +Message-Id: <7a964b43185f4d818eec0c39197bde17371f4c2b@dist-git> +From: Pavel HrdinaQEMUGuest2 ++c7a5fdbd-edaf-9455-926a-d65c16db1809 ++219136 ++219136 ++1 ++++ ++hvm ++++ ++ destroy ++restart ++destroy ++++ ++/usr/bin/qemu-system-i386 ++++ ++ ++++ ++ ++ ++ ++ ++++ ++ ++++ ++ ++ ++ ++++ +Date: Thu, 21 Jan 2021 10:24:03 -0300 +Subject: [PATCH] qemu: move cgroup cpu period and quota defines to vircgroup.h + +Signed-off-by: Pavel Hrdina +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit a818e3f6f02ffc9c1c9ea6e8131c307213fa18ec) + +Conflicts: src/qemu/qemu_driver.c + Context due to lots of changes upstream in the file. + +https://bugzilla.redhat.com/1915733 + +Signed-off-by: Daniel Henrique Barboza +Message-Id: <20210121132406.337681-2-dbarboza@redhat.com> +Reviewed-by: Pavel Hrdina +--- + src/qemu/qemu_driver.c | 21 ++++++++------------- + src/util/vircgroup.h | 5 +++++ + 2 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c +index 80a4a43e2e..a1103a96dd 100644 +--- a/src/qemu/qemu_driver.c ++++ b/src/qemu/qemu_driver.c +@@ -122,11 +122,6 @@ VIR_LOG_INIT("qemu.qemu_driver"); + + #define QEMU_NB_NUMA_PARAM 2 + +-#define QEMU_SCHED_MIN_PERIOD 1000LL +-#define QEMU_SCHED_MAX_PERIOD 1000000LL +-#define QEMU_SCHED_MIN_QUOTA 1000LL +-#define QEMU_SCHED_MAX_QUOTA 18446744073709551LL +- + #define QEMU_GUEST_VCPU_MAX_ID 4096 + + #define QEMU_NB_BLKIO_PARAM 6 +@@ -10655,7 +10650,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_VCPU_PERIOD)) { + SCHED_RANGE_CHECK(value_ul, VIR_DOMAIN_SCHEDULER_VCPU_PERIOD, +- QEMU_SCHED_MIN_PERIOD, QEMU_SCHED_MAX_PERIOD); ++ VIR_CGROUP_CPU_PERIOD_MIN, VIR_CGROUP_CPU_PERIOD_MAX); + + if (def && value_ul) { + if ((rc = qemuSetVcpusBWLive(vm, priv->cgroup, value_ul, 0))) +@@ -10675,7 +10670,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_VCPU_QUOTA)) { + SCHED_RANGE_CHECK(value_l, VIR_DOMAIN_SCHEDULER_VCPU_QUOTA, +- QEMU_SCHED_MIN_QUOTA, QEMU_SCHED_MAX_QUOTA); ++ VIR_CGROUP_CPU_QUOTA_MIN, VIR_CGROUP_CPU_QUOTA_MAX); + + if (def && value_l) { + if ((rc = qemuSetVcpusBWLive(vm, priv->cgroup, 0, value_l))) +@@ -10695,7 +10690,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_GLOBAL_PERIOD)) { + SCHED_RANGE_CHECK(value_ul, VIR_DOMAIN_SCHEDULER_GLOBAL_PERIOD, +- QEMU_SCHED_MIN_PERIOD, QEMU_SCHED_MAX_PERIOD); ++ VIR_CGROUP_CPU_PERIOD_MIN, VIR_CGROUP_CPU_PERIOD_MAX); + + if (def && value_ul) { + if ((rc = qemuSetGlobalBWLive(priv->cgroup, value_ul, 0))) +@@ -10715,7 +10710,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_GLOBAL_QUOTA)) { + SCHED_RANGE_CHECK(value_l, VIR_DOMAIN_SCHEDULER_GLOBAL_QUOTA, +- QEMU_SCHED_MIN_QUOTA, QEMU_SCHED_MAX_QUOTA); ++ VIR_CGROUP_CPU_QUOTA_MIN, VIR_CGROUP_CPU_QUOTA_MAX); + + if (def && value_l) { + if ((rc = qemuSetGlobalBWLive(priv->cgroup, 0, value_l))) +@@ -10735,7 +10730,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_EMULATOR_PERIOD)) { + SCHED_RANGE_CHECK(value_ul, VIR_DOMAIN_SCHEDULER_EMULATOR_PERIOD, +- QEMU_SCHED_MIN_PERIOD, QEMU_SCHED_MAX_PERIOD); ++ VIR_CGROUP_CPU_PERIOD_MIN, VIR_CGROUP_CPU_PERIOD_MAX); + + if (def && value_ul) { + if ((rc = qemuSetEmulatorBandwidthLive(priv->cgroup, +@@ -10756,7 +10751,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_EMULATOR_QUOTA)) { + SCHED_RANGE_CHECK(value_l, VIR_DOMAIN_SCHEDULER_EMULATOR_QUOTA, +- QEMU_SCHED_MIN_QUOTA, QEMU_SCHED_MAX_QUOTA); ++ VIR_CGROUP_CPU_QUOTA_MIN, VIR_CGROUP_CPU_QUOTA_MAX); + + if (def && value_l) { + if ((rc = qemuSetEmulatorBandwidthLive(priv->cgroup, +@@ -10777,7 +10772,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_IOTHREAD_PERIOD)) { + SCHED_RANGE_CHECK(value_ul, VIR_DOMAIN_SCHEDULER_IOTHREAD_PERIOD, +- QEMU_SCHED_MIN_PERIOD, QEMU_SCHED_MAX_PERIOD); ++ VIR_CGROUP_CPU_PERIOD_MIN, VIR_CGROUP_CPU_PERIOD_MAX); + + if (def && value_ul) { + if ((rc = qemuSetIOThreadsBWLive(vm, priv->cgroup, value_ul, 0))) +@@ -10797,7 +10792,7 @@ qemuDomainSetSchedulerParametersFlags(virDomainPtr dom, + + } else if (STREQ(param->field, VIR_DOMAIN_SCHEDULER_IOTHREAD_QUOTA)) { + SCHED_RANGE_CHECK(value_l, VIR_DOMAIN_SCHEDULER_IOTHREAD_QUOTA, +- QEMU_SCHED_MIN_QUOTA, QEMU_SCHED_MAX_QUOTA); ++ VIR_CGROUP_CPU_QUOTA_MIN, VIR_CGROUP_CPU_QUOTA_MAX); + + if (def && value_l) { + if ((rc = qemuSetIOThreadsBWLive(vm, priv->cgroup, 0, value_l))) +diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h +index 3eefe78787..83fa74840f 100644 +--- a/src/util/vircgroup.h ++++ b/src/util/vircgroup.h +@@ -243,6 +243,11 @@ virCgroupGetDomainTotalCpuStats(virCgroupPtr group, + int virCgroupSetCpuShares(virCgroupPtr group, unsigned long long shares); + int virCgroupGetCpuShares(virCgroupPtr group, unsigned long long *shares); + ++#define VIR_CGROUP_CPU_PERIOD_MIN 1000LL ++#define VIR_CGROUP_CPU_PERIOD_MAX 1000000LL ++#define VIR_CGROUP_CPU_QUOTA_MIN 1000LL ++#define VIR_CGROUP_CPU_QUOTA_MAX 18446744073709551LL ++ + int virCgroupSetCpuCfsPeriod(virCgroupPtr group, unsigned long long cfs_period); + int virCgroupGetCpuCfsPeriod(virCgroupPtr group, unsigned long long *cfs_period); + +-- +2.30.0 + diff --git a/SOURCES/libvirt-qemuBuildMachineCommandLine-Drop-needless-check.patch b/SOURCES/libvirt-qemuBuildMachineCommandLine-Drop-needless-check.patch new file mode 100644 index 0000000..a904b27 --- /dev/null +++ b/SOURCES/libvirt-qemuBuildMachineCommandLine-Drop-needless-check.patch @@ -0,0 +1,46 @@ +From 4a3d416229ddf600ff985f9a90e3feb669548690 Mon Sep 17 00:00:00 2001 +Message-Id: <4a3d416229ddf600ff985f9a90e3feb669548690@dist-git> +From: Michal Privoznik +Date: Wed, 7 Oct 2020 18:45:36 +0200 +Subject: [PATCH] qemuBuildMachineCommandLine: Drop needless check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The machine can not be NULL at this point - +qemuDomainDefPostParse() makes sure it isn't. + +Signed-off-by: Michal Privoznik +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit fe43b3a5a5532377f7de40e77ca9ffde5aa2ca7e) + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Signed-off-by: Michal Privoznik +Message-Id: <4a0c05b78ac65e598b919acdb66d24a19fcf6251.1602087923.git.mprivozn@redhat.com> +Reviewed-by: Ján Tomko +--- + src/qemu/qemu_command.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c +index 8c4f7a015f..1a573c2817 100644 +--- a/src/qemu/qemu_command.c ++++ b/src/qemu/qemu_command.c +@@ -6977,13 +6977,6 @@ qemuBuildMachineCommandLine(virCommandPtr cmd, + g_auto(virBuffer) buf = VIR_BUFFER_INITIALIZER; + size_t i; + +- /* This should *never* be NULL, since we always provide +- * a machine in the capabilities data for QEMU. So this +- * check is just here as a safety in case the unexpected +- * happens */ +- if (!def->os.machine) +- return 0; +- + virCommandAddArg(cmd, "-machine"); + virBufferAdd(&buf, def->os.machine, -1); + +-- +2.29.2 + diff --git a/SOURCES/libvirt-qemuBuildNumaCommandLine-Fix-masterInitiator-check.patch b/SOURCES/libvirt-qemuBuildNumaCommandLine-Fix-masterInitiator-check.patch new file mode 100644 index 0000000..2186773 --- /dev/null +++ b/SOURCES/libvirt-qemuBuildNumaCommandLine-Fix-masterInitiator-check.patch @@ -0,0 +1,46 @@ +From a8905f41cd62a0553e703f1b653dd4f6b1acd31f Mon Sep 17 00:00:00 2001 +Message-Id: +From: Michal Privoznik +Date: Wed, 7 Oct 2020 18:45:44 +0200 +Subject: [PATCH] qemuBuildNumaCommandLine: Fix @masterInitiator check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +A few commits ago, in aeecbc87b73, I've implemented command line +generation for ACPI HMAT. For this, we need to know if at least +one guest NUMA node has vCPUs. This is tracked in +@masterInitiator variable, which is initialized to -1, then we +iterate through guest NUMA nodes and break the loop if we find a +node with a vCPU. After the loop, if masterInitiator is still +negative then no NUMA node has a vCPU and we error out. But this +exact check was missing comparison for negativeness. + +Signed-off-by: Michal Privoznik +(cherry picked from commit ccf627c110a178afa529818474e555bca62fc165) + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Signed-off-by: Michal Privoznik +Message-Id: +Reviewed-by: Ján Tomko +--- + src/qemu/qemu_command.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c +index 959207bfea..67d7334b0f 100644 +--- a/src/qemu/qemu_command.c ++++ b/src/qemu/qemu_command.c +@@ -7542,7 +7542,7 @@ qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, + } + } + +- if (masterInitiator) { ++ if (masterInitiator < 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("At least one NUMA node has to have CPUs")); + goto cleanup; +-- +2.29.2 + diff --git a/SOURCES/libvirt-qemu_command-Rename-qemuBuildNumaArgStr.patch b/SOURCES/libvirt-qemu_command-Rename-qemuBuildNumaArgStr.patch new file mode 100644 index 0000000..7b61648 --- /dev/null +++ b/SOURCES/libvirt-qemu_command-Rename-qemuBuildNumaArgStr.patch @@ -0,0 +1,57 @@ +From 4fd196d6126cb9daeb771522ad23ecba0e9fd5c9 Mon Sep 17 00:00:00 2001 +Message-Id: <4fd196d6126cb9daeb771522ad23ecba0e9fd5c9@dist-git> +From: Michal Privoznik +Date: Wed, 7 Oct 2020 18:45:35 +0200 +Subject: [PATCH] qemu_command: Rename qemuBuildNumaArgStr() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The function doesn't just build the argument for -numa. Since the +-numa can be repeated multiple times, it also puts -numa onto the +cmd line. Also, the rest of the functions has 'Command' infix. + +Signed-off-by: Michal Privoznik +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit 8ba1792785e17736db866d62b68812a9c7e7ca40) + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Signed-off-by: Michal Privoznik +Message-Id: +Reviewed-by: Ján Tomko +--- + src/qemu/qemu_command.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c +index ed5f60e82e..8c4f7a015f 100644 +--- a/src/qemu/qemu_command.c ++++ b/src/qemu/qemu_command.c +@@ -7363,10 +7363,10 @@ qemuBuildIOThreadCommandLine(virCommandPtr cmd, + + + static int +-qemuBuildNumaArgStr(virQEMUDriverConfigPtr cfg, +- virDomainDefPtr def, +- virCommandPtr cmd, +- qemuDomainObjPrivatePtr priv) ++qemuBuildNumaCommandLine(virQEMUDriverConfigPtr cfg, ++ virDomainDefPtr def, ++ virCommandPtr cmd, ++ qemuDomainObjPrivatePtr priv) + { + size_t i, j; + virQEMUCapsPtr qemuCaps = priv->qemuCaps; +@@ -9930,7 +9930,7 @@ qemuBuildCommandLine(virQEMUDriverPtr driver, + return NULL; + + if (virDomainNumaGetNodeCount(def->numa) && +- qemuBuildNumaArgStr(cfg, def, cmd, priv) < 0) ++ qemuBuildNumaCommandLine(cfg, def, cmd, priv) < 0) + return NULL; + + if (qemuBuildMemoryDeviceCommandLine(cmd, cfg, def, priv) < 0) +-- +2.29.2 + diff --git a/SOURCES/libvirt-qemuxml2xmltest-Add-numatune-distance-test-case.patch b/SOURCES/libvirt-qemuxml2xmltest-Add-numatune-distance-test-case.patch new file mode 100644 index 0000000..64b5e6f --- /dev/null +++ b/SOURCES/libvirt-qemuxml2xmltest-Add-numatune-distance-test-case.patch @@ -0,0 +1,145 @@ +From 6047fac5e90c96d2d79b08e0c9d32ee7f0ad52cd Mon Sep 17 00:00:00 2001 +Message-Id: <6047fac5e90c96d2d79b08e0c9d32ee7f0ad52cd@dist-git> +From: Michal Privoznik +Date: Wed, 7 Oct 2020 18:45:32 +0200 +Subject: [PATCH] qemuxml2xmltest: Add "numatune-distance" test case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This test case checks that expanding NUMA distance works. On +input we accept if only distance from A to B is specified. On the +output we format the B to A distance too. + +Signed-off-by: Michal Privoznik +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit afb1ea67769d88290499c5c6a0c34982bad6e9c9) + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Signed-off-by: Michal Privoznik +Message-Id: <6974ab2c0987840742965ea925adcc4395f72ec2.1602087923.git.mprivozn@redhat.com> +Reviewed-by: Ján Tomko +--- + .../qemuxml2xmloutdata/numatune-distances.xml | 96 +++++++++++++++++++ + tests/qemuxml2xmltest.c | 1 + + 2 files changed, 97 insertions(+) + create mode 100644 tests/qemuxml2xmloutdata/numatune-distances.xml + +diff --git a/tests/qemuxml2xmloutdata/numatune-distances.xml b/tests/qemuxml2xmloutdata/numatune-distances.xml +new file mode 100644 +index 0000000000..48f89cb015 +--- /dev/null ++++ b/tests/qemuxml2xmloutdata/numatune-distances.xml +@@ -0,0 +1,96 @@ ++ ++ +diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c +index c8218e423e..6c3f5c4a9e 100644 +--- a/tests/qemuxml2xmltest.c ++++ b/tests/qemuxml2xmltest.c +@@ -1104,6 +1104,7 @@ mymain(void) + DO_TEST("numatune-auto-prefer", NONE); + DO_TEST("numatune-memnode", QEMU_CAPS_NUMA, QEMU_CAPS_OBJECT_MEMORY_FILE); + DO_TEST("numatune-memnode-no-memory", QEMU_CAPS_OBJECT_MEMORY_FILE); ++ DO_TEST("numatune-distances", QEMU_CAPS_NUMA, QEMU_CAPS_NUMA_DIST); + + DO_TEST("bios-nvram", NONE); + DO_TEST("bios-nvram-os-interleave", NONE); +-- +2.29.2 + diff --git a/SOURCES/libvirt-tests-add-cgroup-nested-tests.patch b/SOURCES/libvirt-tests-add-cgroup-nested-tests.patch new file mode 100644 index 0000000..300ab47 --- /dev/null +++ b/SOURCES/libvirt-tests-add-cgroup-nested-tests.patch @@ -0,0 +1,226 @@ +From c94691d796682d951ffa8fb3a4fcb985aae17d9b Mon Sep 17 00:00:00 2001 +Message-Id:QEMUGuest ++c7a5fdb2-cdaf-9455-926a-d65c16db1809 ++8388608 ++8388608 ++12 ++++ ++hvm ++++ ++ ++++ ++ ++ ++ ++++ ++++ | ++++ ++++ ++ ++ ++ ++ ++ ++ | ++++ ++++ ++ ++ ++ ++ ++ ++ | ++++ ++++ ++ ++ ++ ++ ++ ++ | ++++ ++++ ++ ++ ++ ++ ++ ++ | ++++ ++++ ++ ++ ++ ++ ++ ++ | ++++ ++++ ++ ++ ++ ++ ++ ++ destroy ++restart ++restart ++++ ++/usr/bin/qemu-system-x86_64 ++++ ++ ++++ ++ ++ ++ ++ +++From: Pavel Hrdina +Date: Fri, 19 Feb 2021 13:34:00 +0100 +Subject: [PATCH] tests: add cgroup nested tests +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Pavel Hrdina +Reviewed-by: Michal Privoznik +(cherry picked from commit 85099c339346e41f457234e8ad831841aef1d5e3) + +Conflicts: + tests/vircgrouptest.c + - missing upstream g_autofree rewrite + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1798463 + +Signed-off-by: Pavel Hrdina +Message-Id: +Reviewed-by: Ján Tomko +--- + tests/vircgroupdata/systemd-legacy.cgroups | 12 +++ + tests/vircgroupdata/systemd-legacy.mounts | 11 +++ + .../vircgroupdata/systemd-legacy.self.cgroup | 11 +++ + tests/vircgroupdata/systemd-unified.cgroups | 13 +++ + tests/vircgroupdata/systemd-unified.mounts | 1 + + .../vircgroupdata/systemd-unified.self.cgroup | 1 + + tests/vircgrouptest.c | 82 +++++++++++++++++++ + 7 files changed, 131 insertions(+) + create mode 100644 tests/vircgroupdata/systemd-legacy.cgroups + create mode 100644 tests/vircgroupdata/systemd-legacy.mounts + create mode 100644 tests/vircgroupdata/systemd-legacy.self.cgroup + create mode 100644 tests/vircgroupdata/systemd-unified.cgroups + create mode 100644 tests/vircgroupdata/systemd-unified.mounts + create mode 100644 tests/vircgroupdata/systemd-unified.self.cgroup + +diff --git a/tests/vircgroupdata/systemd-legacy.cgroups b/tests/vircgroupdata/systemd-legacy.cgroups +new file mode 100644 +index 0000000000..444354e3c8 +--- /dev/null ++++ b/tests/vircgroupdata/systemd-legacy.cgroups +@@ -0,0 +1,12 @@ ++#subsys_name hierarchy num_cgroups enabled ++blkio 1 1 1 ++cpu 2 1 1 ++cpuacct 3 1 1 ++cpuset 4 1 1 ++devices 5 1 1 ++freezer 6 1 1 ++hugetlb 7 1 1 ++memory 8 1 1 ++net_cls 9 1 1 ++perf_event 10 1 1 ++pids 11 1 1 +diff --git a/tests/vircgroupdata/systemd-legacy.mounts b/tests/vircgroupdata/systemd-legacy.mounts +new file mode 100644 +index 0000000000..23462e9e68 +--- /dev/null ++++ b/tests/vircgroupdata/systemd-legacy.mounts +@@ -0,0 +1,11 @@ ++cgroup /not/really/sys/fs/cgroup/blkio cgroup rw,seclabel,nosuid,nodev,noexec,relatime,blkio 0 0 ++cgroup /not/really/sys/fs/cgroup/cpu cgroup rw,seclabel,nosuid,nodev,noexec,relatime,cpu 0 0 ++cgroup /not/really/sys/fs/cgroup/cpuacct cgroup rw,seclabel,nosuid,nodev,noexec,relatime,cpuacct 0 0 ++cgroup /not/really/sys/fs/cgroup/cpuset cgroup rw,seclabel,nosuid,nodev,noexec,relatime,cpuset 0 0 ++cgroup /not/really/sys/fs/cgroup/devices cgroup rw,seclabel,nosuid,nodev,noexec,relatime,devices 0 0 ++cgroup /not/really/sys/fs/cgroup/freezer cgroup rw,seclabel,nosuid,nodev,noexec,relatime,freezer 0 0 ++cgroup /not/really/sys/fs/cgroup/hugetlb cgroup rw,seclabel,nosuid,nodev,noexec,relatime,hugetlb 0 0 ++cgroup /not/really/sys/fs/cgroup/memory cgroup rw,seclabel,nosuid,nodev,noexec,relatime,memory 0 0 ++cgroup /not/really/sys/fs/cgroup/net_cls cgroup rw,seclabel,nosuid,nodev,noexec,relatime,net_cls 0 0 ++cgroup /not/really/sys/fs/cgroup/perf_event cgroup rw,seclabel,nosuid,nodev,noexec,relatime,perf_event 0 0 ++cgroup /not/really/sys/fs/cgroup/pids cgroup rw,seclabel,nosuid,nodev,noexec,relatime,pids 0 0 +diff --git a/tests/vircgroupdata/systemd-legacy.self.cgroup b/tests/vircgroupdata/systemd-legacy.self.cgroup +new file mode 100644 +index 0000000000..5c133a3c08 +--- /dev/null ++++ b/tests/vircgroupdata/systemd-legacy.self.cgroup +@@ -0,0 +1,11 @@ ++1:blkio:/libvirt ++2:cpu:/libvirt/emulator ++3:cpuacct:/libvirt/emulator ++4:cpuset:/libvirt/emulator ++5:devices:/libvirt ++6:freezer:/libvirt ++7:hugetlb:/ ++8:memory:/libvirt ++9:net_cls:/libvirt ++10:perf_event:/libvirt ++11:pids:/ +diff --git a/tests/vircgroupdata/systemd-unified.cgroups b/tests/vircgroupdata/systemd-unified.cgroups +new file mode 100644 +index 0000000000..e0d8a3561c +--- /dev/null ++++ b/tests/vircgroupdata/systemd-unified.cgroups +@@ -0,0 +1,13 @@ ++#subsys_name hierarchy num_cgroups enabled ++cpuset 0 1 1 ++cpu 0 1 1 ++cpuacct 0 1 1 ++blkio 0 1 1 ++memory 0 1 1 ++devices 0 1 1 ++freezer 0 1 1 ++net_cls 0 1 1 ++perf_event 0 1 1 ++net_prio 0 1 1 ++hugetlb 0 1 1 ++pids 0 1 1 +diff --git a/tests/vircgroupdata/systemd-unified.mounts b/tests/vircgroupdata/systemd-unified.mounts +new file mode 100644 +index 0000000000..8225f37f45 +--- /dev/null ++++ b/tests/vircgroupdata/systemd-unified.mounts +@@ -0,0 +1 @@ ++cgroup2 /not/really/sys/fs/cgroup cgroup2 rw,seclabel,nosuid,nodev,noexec,relatime,nsdelegate 0 0 +diff --git a/tests/vircgroupdata/systemd-unified.self.cgroup b/tests/vircgroupdata/systemd-unified.self.cgroup +new file mode 100644 +index 0000000000..6007ce7e18 +--- /dev/null ++++ b/tests/vircgroupdata/systemd-unified.self.cgroup +@@ -0,0 +1 @@ ++0::/libvirt/emulator +diff --git a/tests/vircgrouptest.c b/tests/vircgrouptest.c +index 2d6f52fb6e..aebb90c16c 100644 +--- a/tests/vircgrouptest.c ++++ b/tests/vircgrouptest.c +@@ -636,6 +636,74 @@ static int testCgroupNewForSelfHybrid(const void *args G_GNUC_UNUSED) + } + + ++static int testCgroupNewForSelfSystemdLegacy(const void *args G_GNUC_UNUSED) ++{ ++ virCgroupPtr cgroup = NULL; ++ int ret = -1; ++ const char *empty[VIR_CGROUP_CONTROLLER_LAST] = { 0 }; ++ const char *mounts[VIR_CGROUP_CONTROLLER_LAST] = { ++ [VIR_CGROUP_CONTROLLER_BLKIO] = "/not/really/sys/fs/cgroup/blkio", ++ [VIR_CGROUP_CONTROLLER_CPU] = "/not/really/sys/fs/cgroup/cpu", ++ [VIR_CGROUP_CONTROLLER_CPUACCT] = "/not/really/sys/fs/cgroup/cpuacct", ++ [VIR_CGROUP_CONTROLLER_CPUSET] = "/not/really/sys/fs/cgroup/cpuset", ++ [VIR_CGROUP_CONTROLLER_DEVICES] = "/not/really/sys/fs/cgroup/devices", ++ [VIR_CGROUP_CONTROLLER_FREEZER] = "/not/really/sys/fs/cgroup/freezer", ++ [VIR_CGROUP_CONTROLLER_MEMORY] = "/not/really/sys/fs/cgroup/memory", ++ [VIR_CGROUP_CONTROLLER_NET_CLS] = "/not/really/sys/fs/cgroup/net_cls", ++ [VIR_CGROUP_CONTROLLER_PERF_EVENT] = "/not/really/sys/fs/cgroup/perf_event", ++ }; ++ const char *placement[VIR_CGROUP_CONTROLLER_LAST] = { ++ [VIR_CGROUP_CONTROLLER_BLKIO] = "", ++ [VIR_CGROUP_CONTROLLER_CPU] = "", ++ [VIR_CGROUP_CONTROLLER_CPUACCT] = "", ++ [VIR_CGROUP_CONTROLLER_CPUSET] = "", ++ [VIR_CGROUP_CONTROLLER_DEVICES] = "", ++ [VIR_CGROUP_CONTROLLER_FREEZER] = "", ++ [VIR_CGROUP_CONTROLLER_MEMORY] = "", ++ [VIR_CGROUP_CONTROLLER_NET_CLS] = "", ++ [VIR_CGROUP_CONTROLLER_PERF_EVENT] = "", ++ }; ++ ++ if (virCgroupNewSelf(&cgroup) < 0) { ++ fprintf(stderr, "Cannot create cgroup for self\n"); ++ goto cleanup; ++ } ++ ++ ret = validateCgroup(cgroup, "", mounts, empty, placement, NULL, NULL, 0); ++ ++ cleanup: ++ virCgroupFree(&cgroup); ++ return ret; ++} ++ ++ ++static int testCgroupNewForSelfSystemdUnified(const void *args G_GNUC_UNUSED) ++{ ++ virCgroupPtr cgroup = NULL; ++ int ret = -1; ++ const char *empty[VIR_CGROUP_CONTROLLER_LAST] = { 0 }; ++ unsigned int controllers = ++ (1 << VIR_CGROUP_CONTROLLER_CPU) | ++ (1 << VIR_CGROUP_CONTROLLER_CPUACCT) | ++ (1 << VIR_CGROUP_CONTROLLER_MEMORY) | ++ (1 << VIR_CGROUP_CONTROLLER_DEVICES) | ++ (1 << VIR_CGROUP_CONTROLLER_BLKIO); ++ ++ if (virCgroupNewSelf(&cgroup) < 0) { ++ fprintf(stderr, "Cannot create cgroup for self\n"); ++ goto cleanup; ++ } ++ ++ ret = validateCgroup(cgroup, "", empty, empty, empty, ++ "/not/really/sys/fs/cgroup", "", ++ controllers); ++ ++ cleanup: ++ virCgroupFree(&cgroup); ++ return ret; ++} ++ ++ + static int testCgroupAvailable(const void *args) + { + bool got = virCgroupAvailable(); +@@ -1125,6 +1193,20 @@ mymain(void) + ret = -1; + cleanupFakeFS(fakerootdir); + ++ fakerootdir = initFakeFS("legacy", "systemd-legacy"); ++ if (virTestRun("New cgroup for self (systemd-legacy)", ++ testCgroupNewForSelfSystemdLegacy, NULL) < 0) { ++ ret = -1; ++ } ++ cleanupFakeFS(fakerootdir); ++ ++ fakerootdir = initFakeFS("unified", "systemd-unified"); ++ if (virTestRun("New cgroup for self (systemd-unified)", ++ testCgroupNewForSelfSystemdUnified, NULL) < 0) { ++ ret = -1; ++ } ++ cleanupFakeFS(fakerootdir); ++ + return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; + } + +-- +2.30.0 + diff --git a/SOURCES/libvirt-tests-fix-iptables-test-case-commandline-options-in-virfirewalltest.c.patch b/SOURCES/libvirt-tests-fix-iptables-test-case-commandline-options-in-virfirewalltest.c.patch new file mode 100644 index 0000000..60697f8 --- /dev/null +++ b/SOURCES/libvirt-tests-fix-iptables-test-case-commandline-options-in-virfirewalltest.c.patch @@ -0,0 +1,522 @@ +From 2439f55f8a44ae3bddde8098f3f6ea67ccfd1d9b Mon Sep 17 00:00:00 2001 +Message-Id: <2439f55f8a44ae3bddde8098f3f6ea67ccfd1d9b@dist-git> +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:47 -0500 +Subject: [PATCH] tests: fix iptables test case commandline options in + virfirewalltest.c + +This test was created with all the commandlines erroneously having +"--source-host", which is not a valid iptables option. The correct +name for the option is "--source". However, since the test is just +checking that the generated commandline matches what we told it to +generate (and never actually runs iptables, as that would be a "Really +Bad Idea"(tm)), the test has always succeeded. I only found it because +I made a change to the code that caused the test to incorrectly try to +run iptables during the test, and the error message I received was +"odd" (it complained about the bad option, rather than complaining +that I had insufficient privilege to run the command). + +https://bugzilla.redhat.com/1607929 + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit e9693502fb63ce5ddd07d2599daddc563c422eed) +Message-Id: <20210116035151.1066734-5-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + tests/virfirewalltest.c | 168 ++++++++++++++++++++-------------------- + 1 file changed, 84 insertions(+), 84 deletions(-) + +diff --git a/tests/virfirewalltest.c b/tests/virfirewalltest.c +index 1ec768d302..40e7f4f00b 100644 +--- a/tests/virfirewalltest.c ++++ b/tests/virfirewalltest.c +@@ -206,8 +206,8 @@ testFirewallSingleGroup(const void *opaque) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -225,12 +225,12 @@ testFirewallSingleGroup(const void *opaque) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + if (virFirewallApply(fw) < 0) +@@ -262,8 +262,8 @@ testFirewallRemoveRule(const void *opaque) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + virFirewallRulePtr fwrule; + +@@ -282,17 +282,17 @@ testFirewallRemoveRule(const void *opaque) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + fwrule = virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", NULL); +- virFirewallRuleAddArg(fw, fwrule, "--source-host"); ++ virFirewallRuleAddArg(fw, fwrule, "--source"); + virFirewallRemoveRule(fw, fwrule); + + fwrule = virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", NULL); +- virFirewallRuleAddArg(fw, fwrule, "--source-host"); ++ virFirewallRuleAddArg(fw, fwrule, "--source"); + virFirewallRuleAddArgFormat(fw, fwrule, "%s", "!192.168.122.1"); + virFirewallRuleAddArgList(fw, fwrule, "--jump", "REJECT", NULL); + +@@ -325,9 +325,9 @@ testFirewallManyGroups(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" +- IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.1' --jump REJECT\n" ++ IPTABLES_PATH " -w -A OUTPUT --source 192.168.122.1 --jump ACCEPT\n" + IPTABLES_PATH " -w -A OUTPUT --jump DROP\n"; + const struct testFirewallData *data = opaque; + +@@ -346,19 +346,19 @@ testFirewallManyGroups(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + virFirewallStartTransaction(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "OUTPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, +@@ -416,9 +416,9 @@ testFirewallIgnoreFailGroup(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -A OUTPUT --source 192.168.122.1 --jump ACCEPT\n" + IPTABLES_PATH " -w -A OUTPUT --jump DROP\n"; + const struct testFirewallData *data = opaque; + +@@ -439,19 +439,19 @@ testFirewallIgnoreFailGroup(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallStartTransaction(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "OUTPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, +@@ -488,9 +488,9 @@ testFirewallIgnoreFailRule(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -A OUTPUT --source 192.168.122.1 --jump ACCEPT\n" + IPTABLES_PATH " -w -A OUTPUT --jump DROP\n"; + const struct testFirewallData *data = opaque; + +@@ -511,18 +511,18 @@ testFirewallIgnoreFailRule(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRuleFull(fw, VIR_FIREWALL_LAYER_IPV4, + true, NULL, NULL, + "-A", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "OUTPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, +@@ -559,8 +559,8 @@ testFirewallNoRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.255 --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -580,17 +580,17 @@ testFirewallNoRollback(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + if (virFirewallApply(fw) == 0) { +@@ -623,11 +623,11 @@ testFirewallSingleRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -D INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -647,34 +647,34 @@ testFirewallSingleRollback(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + virFirewallStartRollback(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + if (virFirewallApply(fw) == 0) { +@@ -707,10 +707,10 @@ testFirewallManyRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -730,38 +730,38 @@ testFirewallManyRollback(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallStartRollback(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallStartTransaction(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + virFirewallStartRollback(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + if (virFirewallApply(fw) == 0) { +@@ -794,14 +794,14 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.127 --jump REJECT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.127 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.127 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.1' --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source 192.168.122.127 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source '!192.168.122.1' --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -821,14 +821,14 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallStartRollback(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + +@@ -836,24 +836,24 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.127", ++ "--source", "192.168.122.127", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + virFirewallStartRollback(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.127", ++ "--source", "192.168.122.127", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + +@@ -861,24 +861,24 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + virFirewallStartRollback(fw, VIR_FIREWALL_ROLLBACK_INHERIT_PREVIOUS); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "192.168.122.255", ++ "--source", "192.168.122.255", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-D", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + if (virFirewallApply(fw) == 0) { +@@ -962,7 +962,7 @@ testFirewallQueryCallback(virFirewallPtr fw, + size_t i; + virFirewallAddRule(fw, layer, + "-A", "INPUT", +- "--source-host", "!192.168.122.129", ++ "--source", "!192.168.122.129", + "--jump", "REJECT", NULL); + + for (i = 0; lines[i] != NULL; i++) { +@@ -990,15 +990,15 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.127 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.127 --jump REJECT\n" + IPTABLES_PATH " -w -L\n" + IPTABLES_PATH " -w -t nat -L\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.130 --jump REJECT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" +- IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.128 --jump REJECT\n" +- IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.130 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.129' --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.129' --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source 192.168.122.128 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + expectedLineNum = 0; +@@ -1020,14 +1020,14 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.1", ++ "--source", "192.168.122.1", + "--jump", "ACCEPT", NULL); + + virFirewallStartTransaction(fw, 0); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.127", ++ "--source", "192.168.122.127", + "--jump", "REJECT", NULL); + + virFirewallAddRuleFull(fw, VIR_FIREWALL_LAYER_IPV4, +@@ -1043,7 +1043,7 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.130", ++ "--source", "192.168.122.130", + "--jump", "REJECT", NULL); + + +@@ -1051,12 +1051,12 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED) + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "192.168.122.128", ++ "--source", "192.168.122.128", + "--jump", "REJECT", NULL); + + virFirewallAddRule(fw, VIR_FIREWALL_LAYER_IPV4, + "-A", "INPUT", +- "--source-host", "!192.168.122.1", ++ "--source", "!192.168.122.1", + "--jump", "REJECT", NULL); + + if (virFirewallApply(fw) < 0) +-- +2.30.0 + diff --git a/SOURCES/libvirt-tests-qemuxml2argv-Use-existing-machine-type-for-numatune-distances-case.patch b/SOURCES/libvirt-tests-qemuxml2argv-Use-existing-machine-type-for-numatune-distances-case.patch new file mode 100644 index 0000000..6d94707 --- /dev/null +++ b/SOURCES/libvirt-tests-qemuxml2argv-Use-existing-machine-type-for-numatune-distances-case.patch @@ -0,0 +1,59 @@ +From 5fad3414910beac08371233414939433644a92e8 Mon Sep 17 00:00:00 2001 +Message-Id: <5fad3414910beac08371233414939433644a92e8@dist-git> +From: Peter Krempa +Date: Wed, 7 Oct 2020 18:45:31 +0200 +Subject: [PATCH] tests: qemuxml2argv: Use existing machine type for + 'numatune-distances' case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Peter Krempa +Reviewed-by: Michal Privoznik +(cherry picked from commit 99dcdf505e0856a5ebfb31f0047a1e24ec60b557) + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1749518 + +Signed-off-by: Michal Privoznik +Message-Id: <4af6d896e777397acd8b5945da6bf6bf071f2e98.1602087923.git.mprivozn@redhat.com> +Reviewed-by: Ján Tomko +--- + tests/qemuxml2argvdata/numatune-distances.args | 4 ++-- + tests/qemuxml2argvdata/numatune-distances.xml | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tests/qemuxml2argvdata/numatune-distances.args b/tests/qemuxml2argvdata/numatune-distances.args +index 895efeab15..a20b40b5c5 100644 +--- a/tests/qemuxml2argvdata/numatune-distances.args ++++ b/tests/qemuxml2argvdata/numatune-distances.args +@@ -10,7 +10,7 @@ QEMU_AUDIO_DRV=none \ + /usr/bin/qemu-system-x86_64 \ + -name QEMUGuest \ + -S \ +--machine xenfv,accel=tcg,usb=off,dump-guest-core=off \ ++-machine pc,accel=tcg,usb=off,dump-guest-core=off \ + -m 12288 \ + -realtime mlock=off \ + -smp 12,sockets=12,cores=1,threads=1 \ +@@ -66,4 +66,4 @@ server,nowait \ + -rtc base=utc \ + -no-shutdown \ + -usb \ +--device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2 ++-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 +diff --git a/tests/qemuxml2argvdata/numatune-distances.xml b/tests/qemuxml2argvdata/numatune-distances.xml +index 0f33526b46..fa4de6aaf6 100644 +--- a/tests/qemuxml2argvdata/numatune-distances.xml ++++ b/tests/qemuxml2argvdata/numatune-distances.xml +@@ -5,7 +5,7 @@ + 8388608 +12 ++- +hvm ++hvm ++ +-- +2.29.2 + diff --git a/SOURCES/libvirt-util-Add-phys_port_name-support-on-virPCIGetNetName.patch b/SOURCES/libvirt-util-Add-phys_port_name-support-on-virPCIGetNetName.patch new file mode 100644 index 0000000..2cbe85e --- /dev/null +++ b/SOURCES/libvirt-util-Add-phys_port_name-support-on-virPCIGetNetName.patch @@ -0,0 +1,228 @@ +From cfe170216accf60938ff4ea9440a4ac78b0bd83f Mon Sep 17 00:00:00 2001 +Message-Id: +From: Dmytro Linkin +Date: Thu, 28 Jan 2021 23:17:29 -0500 +Subject: [PATCH] util: Add phys_port_name support on virPCIGetNetName + +virPCIGetNetName is used to get the name of the netdev associated with +a particular PCI device. This is used when we have a VF name, but need +the PF name in order to send a netlink command (e.g. in order to +get/set the MAC address of the VF). + +In simple cases there is a single netdev associated with any PCI +device, so it is easy to figure out the PF netdev for a VF - just look +for the PCI device that has the VF listed in its "virtfns" directory; +the only name in the "net" subdirectory of that PCI device's sysfs +directory is the PF netdev that is upstream of the VF in question. + +In some cases there can be more than one netdev in a PCI device's net +directory though. In the past, the only case of this was for SR-IOV +NICs that could have multiple PF's per PCI device. In this case, all +PF netdevs associated with a PCI address would be listed in the "net" +subdirectory of the PCI device's directory in sysfs. At the same time, +all VF netdevs and all PF netdevs have a phys_port_id in their sysfs, +so the way to learn the correct PF netdev for a particular VF netdev +is to search through the list of devices in the net subdirectory of +the PF's PCI device, looking for the one netdev with a "phys_port_id" +matching that of the VF netdev. + +But starting in kernel 5.8, the NVIDIA Mellanox driver began linking +the VFs' representor netdevs to the PF PCI address [1], and so the VF +representor netdevs would also show up in the net +subdirectory. However, all of the devices that do so also only have a +single PF netdev for any given PCI address. + +This means that the net directory of the PCI device can still hold +multiple net devices, but only one of them will be the PF netdev (the +others are VF representors): + +$ ls '/sys/bus/pci/devices/0000:82:00.0/net' +ens1f0 eth0 eth1 + +In this case the way to find the PF device is to look at the +"phys_port_name" attribute of each netdev in sysfs. All PF devices +have a phys_port_name matching a particular regex + + (p[0-9]+$)|(p[0-9]+s[0-9]+$) + +Since there can only be one PF in the entire list of devices, once we +match that regex, we've found the PF netdev. + +[1] - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/ + commit/?id=123f0f53dd64b67e34142485fe866a8a581f12f1 + +Resolves: https://bugzilla.redhat.com/1918708 +Co-Authored-by: Moshe Levi +Signed-off-by: Dmytro Linkin +Reviewed-by: Adrian Chiris +Reviewed-by: Laine Stump +(cherry picked from commit 5b1c525b1f3608156884aed0dc5e925306c1e260) + +Conflicts: src/util/virpci.c - upstream all DIR* were converted to use + g_autoptr, which permitted virPCIGetNetName() to be + simplified. Unfortunately, backporting this refactor would require + backporting an ever-ballooning set of patches, making the + possibility of causing a regression a very real danger. Instead, + one small refactor of virPCIGetName() that didn't affect any other + functions was backported, and this patch (adding phys_port_name + support) resolved the remaining conflicts by mimicking the current + upstream version of the function, but with all "return 0" replaced + by "ret = 0; goto cleanup;" and all "return -1" replaced by "goto + cleanup;" (the code at cleanup: just closes the DIR* and returns + the current value of ret). This will assure identical behavior to + upstream. +Signed-off-by: Laine Stump +Message-Id: <20210129041729.1076345-4-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virpci.c | 93 ++++++++++++++++++++++++++++------------------- + src/util/virpci.h | 5 +++ + 2 files changed, 61 insertions(+), 37 deletions(-) + +diff --git a/src/util/virpci.c b/src/util/virpci.c +index 00377eed31..d5c038b7fe 100644 +--- a/src/util/virpci.c ++++ b/src/util/virpci.c +@@ -2424,9 +2424,9 @@ virPCIDeviceAddressGetSysfsFile(virPCIDeviceAddressPtr addr, + * virPCIGetNetName: + * @device_link_sysfs_path: sysfs path to the PCI device + * @idx: used to choose which netdev when there are several +- * (ignored if physPortID is set) ++ * (ignored if physPortID is set or physPortName is available) + * @physPortID: match this string in the netdev's phys_port_id +- * (or NULL to ignore and use idx instead) ++ * (or NULL to ignore and use phys_port_name or idx instead) + * @netname: used to return the name of the netdev + * (set to NULL (but returns success) if there is no netdev) + * +@@ -2460,6 +2460,14 @@ virPCIGetNetName(const char *device_link_sysfs_path, + } + + while (virDirRead(dir, &entry, pcidev_sysfs_net_path) > 0) { ++ /* save the first entry we find to use as a failsafe ++ * in case we don't match the phys_port_id. This is ++ * needed because some NIC drivers (e.g. i40e) ++ * implement phys_port_id for PFs, but not for VFs ++ */ ++ if (!firstEntryName) ++ firstEntryName = g_strdup(entry->d_name); ++ + /* if the caller sent a physPortID, compare it to the + * physportID of this netdev. If not, look for entry[idx]. + */ +@@ -2470,50 +2478,61 @@ virPCIGetNetName(const char *device_link_sysfs_path, + goto cleanup; + + /* if this one doesn't match, keep looking */ +- if (STRNEQ_NULLABLE(physPortID, thisPhysPortID)) { +- /* save the first entry we find to use as a failsafe +- * in case we don't match the phys_port_id. This is +- * needed because some NIC drivers (e.g. i40e) +- * implement phys_port_id for PFs, but not for VFs +- */ +- if (!firstEntryName) +- firstEntryName = g_strdup(entry->d_name); +- ++ if (STRNEQ_NULLABLE(physPortID, thisPhysPortID)) + continue; +- } ++ + } else { +- if (i++ < idx) +- continue; +- } ++ /* Most switch devices use phys_port_name instead of ++ * phys_port_id. ++ * NOTE: VFs' representors net devices can be linked to PF's PCI ++ * device, which mean that there'll be multiple net devices ++ * instances and to get a proper net device need to match on ++ * specific regex. ++ * To get PF netdev, for ex., used following regex: ++ * "(p[0-9]+$)|(p[0-9]+s[0-9]+$)" ++ * or to get exact VF's netdev next regex is used: ++ * "pf0vf1$" ++ */ ++ g_autofree char *thisPhysPortName = NULL; + +- *netname = g_strdup(entry->d_name); ++ if (virNetDevGetPhysPortName(entry->d_name, &thisPhysPortName) < 0) ++ goto cleanup; + +- ret = 0; +- break; +- } ++ if (thisPhysPortName) { ++ ++ /* if this one doesn't match, keep looking */ ++ if (!virStringMatch(thisPhysPortName, VIR_PF_PHYS_PORT_NAME_REGEX)) ++ continue; + +- if (ret < 0) { +- if (physPortID) { +- if (firstEntryName) { +- /* we didn't match the provided phys_port_id, but this +- * is probably because phys_port_id isn't implemented +- * for this NIC driver, so just return the first +- * (probably only) netname we found. +- */ +- *netname = firstEntryName; +- firstEntryName = NULL; +- ret = 0; + } else { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("Could not find network device with " +- "phys_port_id '%s' under PCI device at %s"), +- physPortID, device_link_sysfs_path); ++ ++ if (i++ < idx) ++ continue; + } +- } else { +- ret = 0; /* no netdev at the given index is *not* an error */ + } ++ ++ *netname = g_strdup(entry->d_name); ++ ret = 0; ++ goto cleanup; + } +- cleanup: ++ ++ if (firstEntryName) { ++ /* we didn't match the provided phys_port_id / find a ++ * phys_port_name matching VIR_PF_PHYS_PORT_NAME_REGEX / find ++ * as many net devices as the value of idx, but this is ++ * probably because phys_port_id / phys_port_name isn't ++ * implemented for this NIC driver, so just return the first ++ * (probably only) netname we found. ++ */ ++ *netname = g_steal_pointer(&firstEntryName); ++ ret = 0; ++ goto cleanup; ++ } ++ ++ virReportError(VIR_ERR_INTERNAL_ERROR, ++ _("Could not find any network device under PCI device at %s"), ++ device_link_sysfs_path); ++cleanup: + VIR_DIR_CLOSE(dir); + return ret; + } +diff --git a/src/util/virpci.h b/src/util/virpci.h +index f6796fc422..e47c766918 100644 +--- a/src/util/virpci.h ++++ b/src/util/virpci.h +@@ -49,6 +49,11 @@ struct _virZPCIDeviceAddress { + + #define VIR_PCI_DEVICE_ADDRESS_FMT "%04x:%02x:%02x.%d" + ++/* Represents format of PF's phys_port_name in switchdev mode: ++ * 'p%u' or 'p%us%u'. New line checked since value is readed from sysfs file. ++ */ ++#define VIR_PF_PHYS_PORT_NAME_REGEX "(p[0-9]+$)|(p[0-9]+s[0-9]+$)" ++ + struct _virPCIDeviceAddress { + unsigned int domain; + unsigned int bus; +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-add-virNetDevGetPhysPortName.patch b/SOURCES/libvirt-util-add-virNetDevGetPhysPortName.patch new file mode 100644 index 0000000..15a794f --- /dev/null +++ b/SOURCES/libvirt-util-add-virNetDevGetPhysPortName.patch @@ -0,0 +1,143 @@ +From 1b2014e2206b30a743a75908a129e444761726a7 Mon Sep 17 00:00:00 2001 +Message-Id: <1b2014e2206b30a743a75908a129e444761726a7@dist-git> +From: Moshe Levi +Date: Thu, 28 Jan 2021 23:17:27 -0500 +Subject: [PATCH] util: add virNetDevGetPhysPortName + +This commit add virNetDevGetPhysPortName to read netdevice +phys_port_name from sysfs. It also refactor the code so +virNetDevGetPhysPortName and virNetDevGetPhysPortID will use +same method to read the netdevice sysfs. + +https://bugzilla.redhat.com/1918708 +Signed-off-by: Moshe Levi +Reviewed-by: Laine Stump +(cherry picked from commit 97ebb982453bc23759c5f180799d6f2207b81c80) + +Conflicts: src/util/virnetdev.c was converted to use g_autofree upstream. + This patch removes the need for the g_autofreed variable. +Signed-off-by: Laine Stump +Message-Id: <20210129041729.1076345-2-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virnetdev.c | 72 +++++++++++++++++++++++++++++++++----------- + src/util/virnetdev.h | 4 +++ + 2 files changed, 59 insertions(+), 17 deletions(-) + +diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c +index e2aad07c24..52c9343d63 100644 +--- a/src/util/virnetdev.c ++++ b/src/util/virnetdev.c +@@ -1143,6 +1143,29 @@ virNetDevGetPCIDevice(const char *devName) + } + + ++/* A wrapper to get content of file from ifname SYSFS_NET_DIR ++ */ ++static int ++virNetDevGetSysfsFileValue(const char *ifname, ++ const char *fileName, ++ char **sysfsFileData) ++{ ++ g_autofree char *sysfsFile = NULL; ++ ++ *sysfsFileData = NULL; ++ ++ if (virNetDevSysfsFile(&sysfsFile, ifname, fileName) < 0) ++ return -1; ++ ++ /* a failure to read just means the driver doesn't support ++ * , so set success now and ignore the return from ++ * virFileReadAllQuiet(). ++ */ ++ ++ ignore_value(virFileReadAllQuiet(sysfsFile, 1024, sysfsFileData)); ++ return 0; ++} ++ + /** + * virNetDevGetPhysPortID: + * +@@ -1161,25 +1184,29 @@ int + virNetDevGetPhysPortID(const char *ifname, + char **physPortID) + { +- int ret = -1; +- char *physPortIDFile = NULL; +- +- *physPortID = NULL; +- +- if (virNetDevSysfsFile(&physPortIDFile, ifname, "phys_port_id") < 0) +- goto cleanup; +- +- /* a failure to read just means the driver doesn't support +- * phys_port_id, so set success now and ignore the return from +- * virFileReadAllQuiet(). +- */ +- ret = 0; ++ return virNetDevGetSysfsFileValue(ifname, "phys_port_id", physPortID); ++} + +- ignore_value(virFileReadAllQuiet(physPortIDFile, 1024, physPortID)); + +- cleanup: +- VIR_FREE(physPortIDFile); +- return ret; ++/** ++ * virNetDevGetPhysPortName: ++ * ++ * @ifname: name of a netdev ++ * ++ * @physPortName: pointer to char* that will receive @ifname's ++ * phys_port_name from sysfs (null terminated ++ * string). Could be NULL if @ifname's net driver doesn't ++ * support phys_port_name (most netdev drivers ++ * don't). Caller is responsible for freeing the string ++ * when finished. ++ * ++ * Returns 0 on success or -1 on failure. ++ */ ++int ++virNetDevGetPhysPortName(const char *ifname, ++ char **physPortName) ++{ ++ return virNetDevGetSysfsFileValue(ifname, "phys_port_name", physPortName); + } + + +@@ -1461,6 +1488,17 @@ virNetDevGetPhysPortID(const char *ifname G_GNUC_UNUSED, + return 0; + } + ++int ++virNetDevGetPhysPortName(const char *ifname G_GNUC_UNUSED, ++ char **physPortName) ++{ ++ /* this actually should never be called, and is just here to ++ * satisfy the linker. ++ */ ++ *physPortName = NULL; ++ return 0; ++} ++ + int + virNetDevGetVirtualFunctions(const char *pfname G_GNUC_UNUSED, + char ***vfname G_GNUC_UNUSED, +diff --git a/src/util/virnetdev.h b/src/util/virnetdev.h +index 24b41498ed..26fe76cc2c 100644 +--- a/src/util/virnetdev.h ++++ b/src/util/virnetdev.h +@@ -227,6 +227,10 @@ int virNetDevGetPhysPortID(const char *ifname, + char **physPortID) + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) + G_GNUC_WARN_UNUSED_RESULT; ++int virNetDevGetPhysPortName(const char *ifname, ++ char **physPortName) ++ ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ++ G_GNUC_WARN_UNUSED_RESULT; + + int virNetDevGetVirtualFunctions(const char *pfname, + char ***vfname, +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-always-check-for-ebtables-iptables-binaries-even-when-using-firewalld.patch b/SOURCES/libvirt-util-always-check-for-ebtables-iptables-binaries-even-when-using-firewalld.patch new file mode 100644 index 0000000..f4fe465 --- /dev/null +++ b/SOURCES/libvirt-util-always-check-for-ebtables-iptables-binaries-even-when-using-firewalld.patch @@ -0,0 +1,108 @@ +From 36a12736f39da72dba98b843def645e5e4ed0afb Mon Sep 17 00:00:00 2001 +Message-Id: <36a12736f39da72dba98b843def645e5e4ed0afb@dist-git> +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:49 -0500 +Subject: [PATCH] util: always check for ebtables/iptables binaries, even when + using firewalld + +Even though *we* don't call ebtables/iptables/ip6tables (yet) when the +firewalld backend is selected, firewalld does, so these binaries need +to be there; let's check for them. (Also, the patch after this one is +going to start execing those binaries directly rather than via +firewalld). + +https://bugzilla.redhat.com/1607929 + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit 56dd128bd06c38fab4256a098124d47d803e919a) +Message-Id: <20210116035151.1066734-7-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virfirewall.c | 56 ++++++++++++++++++++---------------------- + 1 file changed, 26 insertions(+), 30 deletions(-) + +diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c +index 2e3b02402e..520d515c11 100644 +--- a/src/util/virfirewall.c ++++ b/src/util/virfirewall.c +@@ -100,24 +100,38 @@ VIR_ONCE_GLOBAL_INIT(virFirewall); + static int + virFirewallValidateBackend(virFirewallBackend backend) + { +- VIR_DEBUG("Validating backend %d", backend); ++ const char *commands[] = { ++ IPTABLES_PATH, IP6TABLES_PATH, EBTABLES_PATH ++ }; ++ size_t i; ++ ++ for (i = 0; i < G_N_ELEMENTS(commands); i++) { ++ if (!virFileIsExecutable(commands[i])) { ++ virReportSystemError(errno, ++ _("%s not available, firewall backend will not function"), ++ commands[i]); ++ return -1; ++ } ++ } ++ VIR_DEBUG("found iptables/ip6tables/ebtables"); ++ + if (backend == VIR_FIREWALL_BACKEND_AUTOMATIC || + backend == VIR_FIREWALL_BACKEND_FIREWALLD) { + int rv = virFirewallDIsRegistered(); + + VIR_DEBUG("Firewalld is registered ? %d", rv); +- if (rv < 0) { +- if (rv == -2) { +- if (backend == VIR_FIREWALL_BACKEND_FIREWALLD) { +- virReportError(VIR_ERR_INTERNAL_ERROR, "%s", +- _("firewalld firewall backend requested, but service is not running")); +- return -1; +- } else { +- VIR_DEBUG("firewalld service not running, trying direct backend"); +- backend = VIR_FIREWALL_BACKEND_DIRECT; +- } +- } else { ++ ++ if (rv == -1) ++ return -1; ++ ++ if (rv == -2) { ++ if (backend == VIR_FIREWALL_BACKEND_FIREWALLD) { ++ virReportError(VIR_ERR_INTERNAL_ERROR, "%s", ++ _("firewalld backend requested, but service is not running")); + return -1; ++ } else { ++ VIR_DEBUG("firewalld service not running, using direct backend"); ++ backend = VIR_FIREWALL_BACKEND_DIRECT; + } + } else { + VIR_DEBUG("firewalld service running, using firewalld backend"); +@@ -125,25 +139,7 @@ virFirewallValidateBackend(virFirewallBackend backend) + } + } + +- if (backend == VIR_FIREWALL_BACKEND_DIRECT) { +- const char *commands[] = { +- IPTABLES_PATH, IP6TABLES_PATH, EBTABLES_PATH +- }; +- size_t i; +- +- for (i = 0; i < G_N_ELEMENTS(commands); i++) { +- if (!virFileIsExecutable(commands[i])) { +- virReportSystemError(errno, +- _("direct firewall backend requested, but %s is not available"), +- commands[i]); +- return -1; +- } +- } +- VIR_DEBUG("found iptables/ip6tables/ebtables, using direct backend"); +- } +- + currentBackend = backend; +- + return 0; + } + +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-assign-tap-device-names-using-a-monotonically-increasing-integer.patch b/SOURCES/libvirt-util-assign-tap-device-names-using-a-monotonically-increasing-integer.patch new file mode 100644 index 0000000..1a1e009 --- /dev/null +++ b/SOURCES/libvirt-util-assign-tap-device-names-using-a-monotonically-increasing-integer.patch @@ -0,0 +1,280 @@ +From 37b1acb1c820421d62b1416d90138bae7961bfb7 Mon Sep 17 00:00:00 2001 +Message-Id: <37b1acb1c820421d62b1416d90138bae7961bfb7@dist-git> +From: Laine Stump +Date: Sat, 12 Dec 2020 22:04:52 -0500 +Subject: [PATCH] util: assign tap device names using a monotonically + increasing integer + +When creating a standard tap device, if provided with an ifname that +contains "%d", rather than taking that literally as the name to use +for the new device, the kernel will instead use that string as a +template, and search for the lowest number that could be put in place +of %d and produce an otherwise unused and unique name for the new +device. For example, if there is no tap device name given in the XML, +libvirt will always send "vnet%d" as the device name, and the kernel +will create new devices named "vnet0", "vnet1", etc. If one of those +devices is deleted, creating a "hole" in the name list, the kernel +will always attempt to reuse the name in the hole first before using a +name with a higher number (i.e. it finds the lowest possible unused +number). + +The problem with this, as described in the previous patch dealing with +macvtap device naming, is that it makes "immediate reuse" of a newly +freed tap device name *much* more common, and in the aftermath of +deleting a tap device, there is some other necessary cleanup of things +which are named based on the device name (nwfilter rules, bandwidth +rules, OVS switch ports, to name a few) that could end up stomping +over the top of the setup of a new device of the same name for a +different guest. + +Since the kernel "create a name based on a template" functionality for +tap devices doesn't exist for macvtap, this patch for standard tap +devices is a bit different from the previous patch for macvtap - in +particular there was no previous "bitmap ID reservation system" or +overly-complex retry loop that needed to be removed. We simply find +and unused name, and pass that name on to the kernel instead of +"vnet%d". + +This counter is also wrapped when either it gets to INT_MAX or if the +full name would overflow IFNAMSIZ-1 characters. In the case of +"vnet%d" and a 32 bit int, we would reach INT_MAX first, but possibly +someday someone will change the name from vnet to something else. + +(NB: It is still possible for a user to provide their own +parameterized template name (e.g. "mytap%d") in the XML, and libvirt +will just pass that through to the kernel as it always has.) + +Signed-off-by: Laine Stump +Reviewed-by: Michal Privoznik +(cherry picked from commit 95089f481e003d971fe0a082018216c58c1b80e5) + +https://bugzilla.redhat.com/1874304 +Signed-off-by: Laine Stump +Message-Id: <20201213030453.48851-3-laine@redhat.com> +Reviewed-by: Michal Privoznik +--- + src/libvirt_private.syms | 1 + + src/qemu/qemu_process.c | 20 +++++++- + src/util/virnetdevtap.c | 108 ++++++++++++++++++++++++++++++++++++++- + src/util/virnetdevtap.h | 4 ++ + 4 files changed, 130 insertions(+), 3 deletions(-) + +diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms +index 1c66c40f86..d6598c2514 100644 +--- a/src/libvirt_private.syms ++++ b/src/libvirt_private.syms +@@ -2638,6 +2638,7 @@ virNetDevTapGetName; + virNetDevTapGetRealDeviceName; + virNetDevTapInterfaceStats; + virNetDevTapReattachBridge; ++virNetDevTapReserveName; + + + # util/virnetdevveth.h +diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c +index b49a463c02..f90096e68d 100644 +--- a/src/qemu/qemu_process.c ++++ b/src/qemu/qemu_process.c +@@ -3287,8 +3287,26 @@ qemuProcessNotifyNets(virDomainDefPtr def) + * domain to be unceremoniously killed, which would be *very* + * impolite. + */ +- if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_DIRECT) ++ switch (virDomainNetGetActualType(net)) { ++ case VIR_DOMAIN_NET_TYPE_DIRECT: + virNetDevMacVLanReserveName(net->ifname); ++ break; ++ case VIR_DOMAIN_NET_TYPE_BRIDGE: ++ case VIR_DOMAIN_NET_TYPE_NETWORK: ++ case VIR_DOMAIN_NET_TYPE_ETHERNET: ++ virNetDevTapReserveName(net->ifname); ++ break; ++ case VIR_DOMAIN_NET_TYPE_USER: ++ case VIR_DOMAIN_NET_TYPE_VHOSTUSER: ++ case VIR_DOMAIN_NET_TYPE_SERVER: ++ case VIR_DOMAIN_NET_TYPE_CLIENT: ++ case VIR_DOMAIN_NET_TYPE_MCAST: ++ case VIR_DOMAIN_NET_TYPE_INTERNAL: ++ case VIR_DOMAIN_NET_TYPE_HOSTDEV: ++ case VIR_DOMAIN_NET_TYPE_UDP: ++ case VIR_DOMAIN_NET_TYPE_LAST: ++ break; ++ } + + if (net->type == VIR_DOMAIN_NET_TYPE_NETWORK) { + if (!conn && !(conn = virGetConnectNetwork())) +diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c +index 6a16b58d60..fd4b70df30 100644 +--- a/src/util/virnetdevtap.c ++++ b/src/util/virnetdevtap.c +@@ -45,11 +45,51 @@ + #if defined(HAVE_GETIFADDRS) && defined(AF_LINK) + # include + #endif ++#include + + #define VIR_FROM_THIS VIR_FROM_NONE + + VIR_LOG_INIT("util.netdevtap"); + ++virMutex virNetDevTapCreateMutex = VIR_MUTEX_INITIALIZER; ++static int virNetDevTapLastID = -1; /* not "unsigned" because callers use %d */ ++ ++ ++/** ++ * virNetDevTapReserveName: ++ * @name: name of an existing tap device ++ * ++ * Set the value of virNetDevTapLastID to assure that any new tap ++ * device created with an autogenerated name will use a number higher ++ * than the number in the given tap device name. ++ * ++ * Returns nothing. ++ */ ++void ++virNetDevTapReserveName(const char *name) ++{ ++ unsigned int id; ++ const char *idstr = NULL; ++ ++ ++ if (STRPREFIX(name, VIR_NET_GENERATED_TAP_PREFIX)) { ++ ++ VIR_INFO("marking device in use: '%s'", name); ++ ++ idstr = name + strlen(VIR_NET_GENERATED_TAP_PREFIX); ++ ++ if (virStrToLong_ui(idstr, NULL, 10, &id) >= 0) { ++ virMutexLock(&virNetDevTapCreateMutex); ++ ++ if (virNetDevTapLastID < (int)id) ++ virNetDevTapLastID = id; ++ ++ virMutexUnlock(&virNetDevTapCreateMutex); ++ } ++ } ++} ++ ++ + /** + * virNetDevTapGetName: + * @tapfd: a tun/tap file descriptor +@@ -200,6 +240,55 @@ virNetDevProbeVnetHdr(int tapfd) + + + #ifdef TUNSETIFF ++/** ++ * virNetDevTapGenerateName: ++ * @ifname: pointer to pointer to string containing template ++ * ++ * generate a new (currently unused) name for a new tap device based ++ * on the templace string in @ifname - replace %d with ++ * ++virNetDevTapLastID, and keep trying new values until one is found ++ * that doesn't already exist, or we've tried 10000 different ++ * names. Once a usable name is found, replace the template with the ++ * actual name. ++ * ++ * Returns 0 on success, -1 on failure. ++ */ ++static int ++virNetDevTapGenerateName(char **ifname) ++{ ++ int id; ++ double maxIDd = pow(10, IFNAMSIZ - 1 - strlen(VIR_NET_GENERATED_TAP_PREFIX)); ++ int maxID = INT_MAX; ++ int attempts = 0; ++ ++ if (maxIDd <= (double)INT_MAX) ++ maxID = (int)maxIDd; ++ ++ do { ++ g_autofree char *try = NULL; ++ ++ id = ++virNetDevTapLastID; ++ ++ /* reset before overflow */ ++ if (virNetDevTapLastID >= maxID) ++ virNetDevTapLastID = -1; ++ ++ try = g_strdup_printf(*ifname, id); ++ ++ if (!virNetDevExists(try)) { ++ g_free(*ifname); ++ *ifname = g_steal_pointer(&try); ++ return 0; ++ } ++ } while (++attempts < 10000); ++ ++ virReportError(VIR_ERR_INTERNAL_ERROR, ++ _("no unused %s names available"), ++ VIR_NET_GENERATED_TAP_PREFIX); ++ return -1; ++} ++ ++ + /** + * virNetDevTapCreate: + * @ifname: the interface name +@@ -226,10 +315,22 @@ int virNetDevTapCreate(char **ifname, + size_t tapfdSize, + unsigned int flags) + { +- size_t i; ++ size_t i = 0; + struct ifreq ifr; + int ret = -1; +- int fd; ++ int fd = 0; ++ ++ virMutexLock(&virNetDevTapCreateMutex); ++ ++ /* if ifname is "vnet%d", then auto-generate a name for the new ++ * device (the kernel could do this for us, but has a bad habit of ++ * immediately re-using names that have just been released, which ++ * can lead to race conditions). ++ */ ++ if (STREQ(*ifname, VIR_NET_GENERATED_TAP_PREFIX "%d") && ++ virNetDevTapGenerateName(ifname) < 0) { ++ goto cleanup; ++ } + + if (!tunpath) + tunpath = "/dev/net/tun"; +@@ -295,9 +396,11 @@ int virNetDevTapCreate(char **ifname, + tapfd[i] = fd; + } + ++ VIR_INFO("created device: '%s'", *ifname); + ret = 0; + + cleanup: ++ virMutexUnlock(&virNetDevTapCreateMutex); + if (ret < 0) { + VIR_FORCE_CLOSE(fd); + while (i--) +@@ -347,6 +450,7 @@ int virNetDevTapDelete(const char *ifname, + goto cleanup; + } + ++ VIR_INFO("delete device: '%s'", ifname); + ret = 0; + + cleanup: +diff --git a/src/util/virnetdevtap.h b/src/util/virnetdevtap.h +index cae8e61861..2994c9ca71 100644 +--- a/src/util/virnetdevtap.h ++++ b/src/util/virnetdevtap.h +@@ -29,6 +29,10 @@ + # define VIR_NETDEV_TAP_REQUIRE_MANUAL_CLEANUP 1 + #endif + ++void ++virNetDevTapReserveName(const char *name) ++ ATTRIBUTE_NONNULL(1); ++ + int virNetDevTapCreate(char **ifname, + const char *tunpath, + int *tapfd, +-- +2.29.2 + diff --git a/SOURCES/libvirt-util-avoid-manual-VIR_FREE-of-a-g_autofree-pointer-in-virPCIGetName.patch b/SOURCES/libvirt-util-avoid-manual-VIR_FREE-of-a-g_autofree-pointer-in-virPCIGetName.patch new file mode 100644 index 0000000..bb987c0 --- /dev/null +++ b/SOURCES/libvirt-util-avoid-manual-VIR_FREE-of-a-g_autofree-pointer-in-virPCIGetName.patch @@ -0,0 +1,52 @@ +From 4eed301c16a93fdcc6867823a88406e9578c1da7 Mon Sep 17 00:00:00 2001 +Message-Id: <4eed301c16a93fdcc6867823a88406e9578c1da7@dist-git> +From: Laine Stump +Date: Thu, 28 Jan 2021 23:17:28 -0500 +Subject: [PATCH] util: avoid manual VIR_FREE of a g_autofree pointer in + virPCIGetName() + +thisPhysPortID is only used inside a conditional, so reduce its scope +to just the body of that conditional, which will eliminate the need +for the undesirable manual VIR_FREE(). + +https://bugzilla.redhat.com/1918708 +Signed-off-by: Laine Stump +Reviewed-by: Erik Skultety +Reviewed-by: Peter Krempa +(cherry picked from commit fefd478644a2ad2951491552081cd53b6ecd4223) +Message-Id: <20210129041729.1076345-3-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virpci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/util/virpci.c b/src/util/virpci.c +index 0b1222373e..00377eed31 100644 +--- a/src/util/virpci.c ++++ b/src/util/virpci.c +@@ -2440,7 +2440,6 @@ virPCIGetNetName(const char *device_link_sysfs_path, + { + g_autofree char *pcidev_sysfs_net_path = NULL; + g_autofree char *firstEntryName = NULL; +- g_autofree char *thisPhysPortID = NULL; + int ret = -1; + DIR *dir = NULL; + struct dirent *entry = NULL; +@@ -2465,12 +2464,13 @@ virPCIGetNetName(const char *device_link_sysfs_path, + * physportID of this netdev. If not, look for entry[idx]. + */ + if (physPortID) { ++ g_autofree char *thisPhysPortID = NULL; ++ + if (virNetDevGetPhysPortID(entry->d_name, &thisPhysPortID) < 0) + goto cleanup; + + /* if this one doesn't match, keep looking */ + if (STRNEQ_NULLABLE(physPortID, thisPhysPortID)) { +- VIR_FREE(thisPhysPortID); + /* save the first entry we find to use as a failsafe + * in case we don't match the phys_port_id. This is + * needed because some NIC drivers (e.g. i40e) +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-call-iptables-directly-rather-than-via-firewalld.patch b/SOURCES/libvirt-util-call-iptables-directly-rather-than-via-firewalld.patch new file mode 100644 index 0000000..3ec098c --- /dev/null +++ b/SOURCES/libvirt-util-call-iptables-directly-rather-than-via-firewalld.patch @@ -0,0 +1,228 @@ +From 4d8a10886f4dffd08fcf6a93694e12f76a2afd66 Mon Sep 17 00:00:00 2001 +Message-Id: <4d8a10886f4dffd08fcf6a93694e12f76a2afd66@dist-git> +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:51 -0500 +Subject: [PATCH] util: call iptables directly rather than via firewalld + +When libvirt added support for firewalld, we were unable to use +firewalld's higher level rules, because they weren't detailed enough +and could not be applied to the iptables FORWARD or OUTPUT chains +(only to the INPUT chain). Instead we changed our code so that rather +than running the iptables/ip6tables/ebtables binaries ourselves, we +would send these commands to firewalld as "passthrough commands", and +firewalld would run the appropriate program on our behalf. + +This was done under the assumption that firewalld was somehow tracking +all these rules, and that this tracking was benefitting proper +operation of firewalld and the system in general. + +Several years later this came up in a discussion on IRC, and we +learned from the firewalld developers that, in fact, adding iptables +and ebtables rules with firewalld's passthrough commands actually has +*no* advantage; firewalld doesn't keep track of these rules in any +way, and doesn't use them to tailor the construction of its own rules. + +Meanwhile, users have been complaining for some time that whenever +firewalld is restarted on a system with libvirt virtual networks +and/or nwfilter rules active, the system logs would be flooded with +warning messages whining that [lots of different rules] could not be +deleted because they didn't exist. For example: + +firewalld[3536040]: WARNING: COMMAND_FAILED: + '/usr/sbin/iptables -w10 -w --table filter --delete LIBVIRT_OUT + --out-interface virbr4 --protocol udp --destination-port 68 + --jump ACCEPT' failed: iptables: Bad rule + (does a matching rule exist in that chain?). + +See: + + https://bugzilla.redhat.com/1607929 (RHEL8) + https://bugzilla.redhat.com/1790837 (RHEL8-AV) + +for many more examples and a discussion) + +Note that these messages are created by iptables, but are logged by +firewalld - when an iptables/ebtables command fails, firewalld grabs +whatever is in stderr of the program, and spits it out to the system +log as a warning. We've requested that firewalld not do this (and +instead leave it up to the calling application to do the appropriate +logging), but this request has been respectfully denied. + +But combining the two problems above ( 1) firewalld doesn't do +anything useful when you use it as a proxy to add/remove iptables +rules, 2) firewalld often insists on logging lots of +annoying/misleading/useless "error" messages when you use it as a +proxy to remove iptables rules that don't already exist), leads to a +solution - simply stop using firewalld to add and remove iptables +rules. Instead, exec iptables/ip6tables/ebtables directly in the same +way we do when firewalld isn't active. + +We still need to keep track of whether or not firewalld is active, as +there are some things that must be done, e.g. we need to add some +actual firewalld rules in the firewalld "libvirt" zone, and we need to +take notice when firewalld restarts, so that we can reload all our +rules. + +This patch doesn't remove the infrastructure that allows having +different firewall backends that perform their functions in different +ways, as that will very possibly come in handy in the future when we +want to have an nftables direct backend, and possibly a "pure" +firewalld backend (now that firewalld supports more complex rules, and +can add those rules to the FORWARD and OUTPUT chains). Instead, it +just changes the action when the selected backend is "firewalld" so +that it adds rules directly rather than through firewalld, while +leaving as much of the existing code intact as possible. + +In order for tests to still pass, virfirewalltest also had to be +modified to behave in a different way (i.e. by capturing the generated +commandline as it does for the DIRECT backend, rather than capturing +dbus messages using a mocked dbus API). + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit b19863640d10b47b7c4a7cbadb21f196d61d96a2) +Message-Id: <20210116035151.1066734-9-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virfirewall.c | 13 +++++++++++-- + tests/virfirewalltest.c | 30 ++++++++++++++++++++---------- + 2 files changed, 31 insertions(+), 12 deletions(-) + +diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c +index 66d20d3f17..2ea821ec17 100644 +--- a/src/util/virfirewall.c ++++ b/src/util/virfirewall.c +@@ -644,7 +644,7 @@ virFirewallApplyRuleDirect(virFirewallRulePtr rule, + } + + +-static int ++static int G_GNUC_UNUSED + virFirewallApplyRuleFirewallD(virFirewallRulePtr rule, + bool ignoreErrors, + char **output) +@@ -702,7 +702,16 @@ virFirewallApplyRule(virFirewallPtr firewall, + return -1; + break; + case VIR_FIREWALL_BACKEND_FIREWALLD: +- if (virFirewallApplyRuleFirewallD(rule, ignoreErrors, &output) < 0) ++ /* Since we are using raw iptables rules, there is no ++ * advantage to going through firewalld, so instead just add ++ * them directly rather that via dbus calls to firewalld. This ++ * has the useful side effect of eliminating extra unwanted ++ * warning messages in the system logs when trying to delete ++ * rules that don't exist (which is something that happens ++ * often when libvirtd is started, and *always* when firewalld ++ * is restarted) ++ */ ++ if (virFirewallApplyRuleDirect(rule, ignoreErrors, &output) < 0) + return -1; + break; + +diff --git a/tests/virfirewalltest.c b/tests/virfirewalltest.c +index 40e7f4f00b..1036353579 100644 +--- a/tests/virfirewalltest.c ++++ b/tests/virfirewalltest.c +@@ -214,7 +214,8 @@ testFirewallSingleGroup(const void *opaque) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) + virCommandSetDryRun(&cmdbuf, NULL, NULL); + else + fwBuf = &cmdbuf; +@@ -271,7 +272,8 @@ testFirewallRemoveRule(const void *opaque) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) + virCommandSetDryRun(&cmdbuf, NULL, NULL); + else + fwBuf = &cmdbuf; +@@ -335,7 +337,8 @@ testFirewallManyGroups(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) + virCommandSetDryRun(&cmdbuf, NULL, NULL); + else + fwBuf = &cmdbuf; +@@ -426,7 +429,8 @@ testFirewallIgnoreFailGroup(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallRollbackHook, NULL); + } else { + fwBuf = &cmdbuf; +@@ -498,7 +502,8 @@ testFirewallIgnoreFailRule(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallRollbackHook, NULL); + } else { + fwBuf = &cmdbuf; +@@ -567,7 +572,8 @@ testFirewallNoRollback(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallRollbackHook, NULL); + } else { + fwBuf = &cmdbuf; +@@ -634,7 +640,8 @@ testFirewallSingleRollback(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallRollbackHook, NULL); + } else { + fwError = true; +@@ -717,7 +724,8 @@ testFirewallManyRollback(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallRollbackHook, NULL); + } else { + fwBuf = &cmdbuf; +@@ -808,7 +816,8 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallRollbackHook, NULL); + } else { + fwBuf = &cmdbuf; +@@ -1007,7 +1016,8 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED) + if (virFirewallSetBackend(data->tryBackend) < 0) + goto cleanup; + +- if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT) { ++ if (data->expectBackend == VIR_FIREWALL_BACKEND_DIRECT || ++ data->expectBackend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virCommandSetDryRun(&cmdbuf, testFirewallQueryHook, NULL); + } else { + fwBuf = &cmdbuf; +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-fix-typo-in-VIR_MOCK_WRAP_RET_ARGS.patch b/SOURCES/libvirt-util-fix-typo-in-VIR_MOCK_WRAP_RET_ARGS.patch new file mode 100644 index 0000000..6a8ab2d --- /dev/null +++ b/SOURCES/libvirt-util-fix-typo-in-VIR_MOCK_WRAP_RET_ARGS.patch @@ -0,0 +1,39 @@ +From 15b1f63574db2100d433d283a975928f83bb0ecb Mon Sep 17 00:00:00 2001 +Message-Id: <15b1f63574db2100d433d283a975928f83bb0ecb@dist-git> +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:44 -0500 +Subject: [PATCH] util: fix typo in VIR_MOCK_WRAP_RET_ARGS() + +When virfirewalltest.c was first written in commit 3a0ca7de51 (March +2013), a conditional accidentally tested for "ipv4" instead of +"ipv6". Since the file ended up only testing ipv4 rules, this has +never made any difference in practice, but I'm making some other +changes in this file and just couldn't let it stand :-) + +https://bugzilla.redhat.com/1607929 + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit 28a3deddddfe102b37f2e373bf4581c2ce8d2050) +Message-Id: <20210116035151.1066734-2-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + tests/virfirewalltest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tests/virfirewalltest.c b/tests/virfirewalltest.c +index c4827918c3..8aba127610 100644 +--- a/tests/virfirewalltest.c ++++ b/tests/virfirewalltest.c +@@ -129,7 +129,7 @@ VIR_MOCK_WRAP_RET_ARGS(dbus_connection_send_with_reply_and_block, + if (fwBuf) { + if (STREQ(type, "ipv4")) + virBufferAddLit(fwBuf, IPTABLES_PATH); +- else if (STREQ(type, "ipv4")) ++ else if (STREQ(type, "ipv6")) + virBufferAddLit(fwBuf, IP6TABLES_PATH); + else + virBufferAddLit(fwBuf, EBTABLES_PATH); +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-replace-macvtap-name-reservation-bitmap-with-a-simple-counter.patch b/SOURCES/libvirt-util-replace-macvtap-name-reservation-bitmap-with-a-simple-counter.patch new file mode 100644 index 0000000..34969d8 --- /dev/null +++ b/SOURCES/libvirt-util-replace-macvtap-name-reservation-bitmap-with-a-simple-counter.patch @@ -0,0 +1,736 @@ +From 4238e5f0783c63802de79bc5ed2a1f49673ef2a3 Mon Sep 17 00:00:00 2001 +Message-Id: <4238e5f0783c63802de79bc5ed2a1f49673ef2a3@dist-git> +From: Laine Stump +Date: Sat, 12 Dec 2020 22:04:51 -0500 +Subject: [PATCH] util: replace macvtap name reservation bitmap with a simple + counter + +There have been some reports that, due to libvirt always trying to +assign the lowest numbered macvtap / tap device name possible, a new +guest would sometimes be started using the same tap device name as +previously used by another guest that is in the process of being +destroyed *as the new guest is starting. + +In some cases this has led to, for example, the old guest's +qemuProcessStop() code deleting a port from an OVS switch that had +just been re-added by the new guest (because the port name is based on +only the device name using the port). Similar problems can happen (and +I believe have) with nwfilter rules and bandwidth rules (which are +both instantiated based on the name of the tap device). + +A couple patches have been previously proposed to change the ordering +of startup and shutdown processing, or to put a mutex around +everything related to the tap/macvtap device name usage, but in the +end no matter what you do there will still be possible holes, because +the device could be deleted outside libvirt's control (for example, +regular tap devices are automatically deleted when the qemu process +terminates, and that isn't always initiated by libvirt but could +instead happen completely asynchronously - libvirt then has no control +over the ordering of shutdown operations, and no opportunity to +protect it with a mutex.) + +But this only happens if a new device is created at the same time as +one is being deleted. We can effectively eliminate the chance of this +happening if we end the practice of always looking for the lowest +numbered available device name, and instead just keep an integer that +is incremented each time we need a new device name. At some point it +will need to wrap back around to 0 (in order to avoid the IFNAMSIZ 15 +character limit if nothing else), and we can't guarantee that the new +name really will be the *least* recently used name, but "math" +suggests that it will be *much* less common that we'll try to re-use +the *most* recently used name. + +This patch implements such a counter for macvtap/macvlan, replacing +the existing, and much more complicated, "ID reservation" system. The +counter is set according to whatever macvtap/macvlan devices are +already in use by guests when libvirtd is started, incremented each +time a new device name is needed, and wraps back to 0 when either +INT_MAX is reached, or when the resulting device name would be longer +than IFNAMSIZ-1 characters (which actually is what happens when the +template for the device name is "maccvtap%d"). The result is that no +macvtap name will be re-used until the host has created (and possibly +destroyed) 99,999,999 devices. + +Signed-off-by: Laine Stump +Reviewed-by: Michal Privoznik +(cherry picked from commit d7f38beb2ee072f1f19bb91fbafc9182ce9b069e) + +https://bugzilla.redhat.com/1874304 +Signed-off-by: Laine Stump +Message-Id: <20201213030453.48851-2-laine@redhat.com> +Reviewed-by: Michal Privoznik +--- + src/libvirt_private.syms | 1 - + src/libxl/libxl_driver.c | 2 +- + src/lxc/lxc_process.c | 2 +- + src/qemu/qemu_process.c | 2 +- + src/util/virnetdevmacvlan.c | 403 +++++++++++++----------------------- + src/util/virnetdevmacvlan.h | 6 +- + 6 files changed, 145 insertions(+), 271 deletions(-) + +diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms +index fdd104cd25..1c66c40f86 100644 +--- a/src/libvirt_private.syms ++++ b/src/libvirt_private.syms +@@ -2604,7 +2604,6 @@ virNetDevMacVLanDelete; + virNetDevMacVLanDeleteWithVPortProfile; + virNetDevMacVLanIsMacvtap; + virNetDevMacVLanModeTypeFromString; +-virNetDevMacVLanReleaseName; + virNetDevMacVLanReserveName; + virNetDevMacVLanRestartWithVPortProfile; + virNetDevMacVLanTapOpen; +diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c +index 1449795494..9269e9b475 100644 +--- a/src/libxl/libxl_driver.c ++++ b/src/libxl/libxl_driver.c +@@ -367,7 +367,7 @@ libxlReconnectNotifyNets(virDomainDefPtr def) + * impolite. + */ + if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_DIRECT) +- ignore_value(virNetDevMacVLanReserveName(net->ifname, false)); ++ virNetDevMacVLanReserveName(net->ifname); + + if (net->type == VIR_DOMAIN_NET_TYPE_NETWORK) { + if (!conn && !(conn = virGetConnectNetwork())) +diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c +index 0a9ccdf9ec..114c40b0ea 100644 +--- a/src/lxc/lxc_process.c ++++ b/src/lxc/lxc_process.c +@@ -1638,7 +1638,7 @@ virLXCProcessReconnectNotifyNets(virDomainDefPtr def) + * impolite. + */ + if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_DIRECT) +- ignore_value(virNetDevMacVLanReserveName(net->ifname, false)); ++ virNetDevMacVLanReserveName(net->ifname); + + if (net->type == VIR_DOMAIN_NET_TYPE_NETWORK) { + if (!conn && !(conn = virGetConnectNetwork())) +diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c +index 95c0315e53..b49a463c02 100644 +--- a/src/qemu/qemu_process.c ++++ b/src/qemu/qemu_process.c +@@ -3288,7 +3288,7 @@ qemuProcessNotifyNets(virDomainDefPtr def) + * impolite. + */ + if (virDomainNetGetActualType(net) == VIR_DOMAIN_NET_TYPE_DIRECT) +- ignore_value(virNetDevMacVLanReserveName(net->ifname, false)); ++ virNetDevMacVLanReserveName(net->ifname); + + if (net->type == VIR_DOMAIN_NET_TYPE_NETWORK) { + if (!conn && !(conn = virGetConnectNetwork())) +diff --git a/src/util/virnetdevmacvlan.c b/src/util/virnetdevmacvlan.c +index 3ca568fb44..7046cbb04e 100644 +--- a/src/util/virnetdevmacvlan.c ++++ b/src/util/virnetdevmacvlan.c +@@ -47,6 +47,7 @@ VIR_ENUM_IMPL(virNetDevMacVLanMode, + + # include + # include ++# include + + /* Older kernels lacked this enum value. */ + # if !HAVE_DECL_MACVLAN_MODE_PASSTHRU +@@ -70,211 +71,121 @@ VIR_LOG_INIT("util.netdevmacvlan"); + ((flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) ? \ + VIR_NET_GENERATED_MACVTAP_PREFIX : VIR_NET_GENERATED_MACVLAN_PREFIX) + +-# define MACVLAN_MAX_ID 8191 + + virMutex virNetDevMacVLanCreateMutex = VIR_MUTEX_INITIALIZER; +-virBitmapPtr macvtapIDs = NULL; +-virBitmapPtr macvlanIDs = NULL; +- +-static int +-virNetDevMacVLanOnceInit(void) +-{ +- if (!macvtapIDs && +- !(macvtapIDs = virBitmapNew(MACVLAN_MAX_ID + 1))) +- return -1; +- if (!macvlanIDs && +- !(macvlanIDs = virBitmapNew(MACVLAN_MAX_ID + 1))) +- return -1; +- return 0; +-} +- +-VIR_ONCE_GLOBAL_INIT(virNetDevMacVLan); ++static int virNetDevMacVTapLastID = -1; ++static int virNetDevMacVLanLastID = -1; + + +-/** +- * virNetDevMacVLanReserveID: +- * +- * @id: id 0 - MACVLAN_MAX_ID+1 to reserve (or -1 for "first free") +- * @flags: set VIR_NETDEV_MACVLAN_CREATE_WITH_TAP for macvtapN else macvlanN +- * @quietFail: don't log an error if this name is already in-use +- * @nextFree: reserve the next free ID *after* @id rather than @id itself +- * +- * Reserve the indicated ID in the appropriate bitmap, or find the +- * first free ID if @id is -1. +- * +- * Returns newly reserved ID# on success, or -1 to indicate failure. +- */ +-static int +-virNetDevMacVLanReserveID(int id, unsigned int flags, +- bool quietFail, bool nextFree) ++static void ++virNetDevMacVLanReserveNameInternal(const char *name) + { +- virBitmapPtr bitmap; +- +- if (virNetDevMacVLanInitialize() < 0) +- return -1; +- +- bitmap = (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) ? +- macvtapIDs : macvlanIDs; ++ unsigned int id; ++ const char *idstr = NULL; ++ int *lastID = NULL; ++ int len; + +- if (id > MACVLAN_MAX_ID) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("can't use name %s%d - out of range 0-%d"), +- VIR_NET_GENERATED_PREFIX, id, MACVLAN_MAX_ID); +- return -1; ++ if (STRPREFIX(name, VIR_NET_GENERATED_MACVTAP_PREFIX)) { ++ lastID = &virNetDevMacVTapLastID; ++ len = strlen(VIR_NET_GENERATED_MACVTAP_PREFIX); ++ } else if (STRPREFIX(name, VIR_NET_GENERATED_MACVLAN_PREFIX)) { ++ lastID = &virNetDevMacVTapLastID; ++ len = strlen(VIR_NET_GENERATED_MACVLAN_PREFIX); ++ } else { ++ return; + } + +- if ((id < 0 || nextFree) && +- (id = virBitmapNextClearBit(bitmap, id)) < 0) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("no unused %s names available"), +- VIR_NET_GENERATED_PREFIX); +- return -1; +- } ++ VIR_INFO("marking device in use: '%s'", name); + +- if (virBitmapIsBitSet(bitmap, id)) { +- if (quietFail) { +- VIR_INFO("couldn't reserve name %s%d - already in use", +- VIR_NET_GENERATED_PREFIX, id); +- } else { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("couldn't reserve name %s%d - already in use"), +- VIR_NET_GENERATED_PREFIX, id); +- } +- return -1; +- } ++ idstr = name + len; + +- if (virBitmapSetBit(bitmap, id) < 0) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("couldn't mark %s%d as used"), +- VIR_NET_GENERATED_PREFIX, id); +- return -1; ++ if (virStrToLong_ui(idstr, NULL, 10, &id) >= 0) { ++ if (*lastID < (int)id) ++ *lastID = id; + } +- +- VIR_INFO("reserving device %s%d", VIR_NET_GENERATED_PREFIX, id); +- return id; + } + + + /** +- * virNetDevMacVLanReleaseID: +- * @id: id 0 - MACVLAN_MAX_ID+1 to release ++ * virNetDevMacVLanReserveName: ++ * @name: name of an existing macvtap/macvlan device + * +- * Returns 0 for success or -1 for failure. ++ * Set the value of virNetDevMacV(Lan|Tap)LastID to assure that any ++ * new device created with an autogenerated name will use a number ++ * higher than the number in the given device name. ++ * ++ * Returns nothing. + */ +-static int +-virNetDevMacVLanReleaseID(int id, unsigned int flags) ++void ++virNetDevMacVLanReserveName(const char *name) + { +- virBitmapPtr bitmap; +- +- if (virNetDevMacVLanInitialize() < 0) +- return 0; +- +- bitmap = (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) ? +- macvtapIDs : macvlanIDs; +- +- if (id > MACVLAN_MAX_ID) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("can't free name %s%d - out of range 0-%d"), +- VIR_NET_GENERATED_PREFIX, id, MACVLAN_MAX_ID); +- return -1; +- } +- +- if (id < 0) +- return 0; +- +- VIR_INFO("releasing %sdevice %s%d", +- virBitmapIsBitSet(bitmap, id) ? "" : "unreserved", +- VIR_NET_GENERATED_PREFIX, id); +- +- if (virBitmapClearBit(bitmap, id) < 0) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("couldn't mark %s%d as unused"), +- VIR_NET_GENERATED_PREFIX, id); +- return -1; +- } +- return 0; ++ virMutexLock(&virNetDevMacVLanCreateMutex); ++ virNetDevMacVLanReserveNameInternal(name); ++ virMutexUnlock(&virNetDevMacVLanCreateMutex); + } + + + /** +- * virNetDevMacVLanReserveName: +- * +- * @name: already-known name of device +- * @quietFail: don't log an error if this name is already in-use ++ * virNetDevMacVLanGenerateName: ++ * @ifname: pointer to pointer to string containing template ++ * @lastID: counter to add to the template to form the name + * +- * Extract the device type and id from a macvtap/macvlan device name +- * and mark the appropriate position as in-use in the appropriate +- * bitmap. ++ * generate a new (currently unused) name for a new macvtap/macvlan ++ * device based on the template string in @ifname - replace %d with ++ * ++(*counter), and keep trying new values until one is found ++ * that doesn't already exist, or we've tried 10000 different ++ * names. Once a usable name is found, replace the template with the ++ * actual name. + * +- * Returns reserved ID# on success, -1 on failure, -2 if the name +- * doesn't fit the auto-pattern (so not reserveable). ++ * Returns 0 on success, -1 on failure. + */ +-int +-virNetDevMacVLanReserveName(const char *name, bool quietFail) ++static int ++virNetDevMacVLanGenerateName(char **ifname, unsigned int flags) + { +- unsigned int id; +- unsigned int flags = 0; +- const char *idstr = NULL; ++ const char *prefix; ++ const char *iftemplate; ++ int *lastID; ++ int id; ++ double maxIDd; ++ int maxID = INT_MAX; ++ int attempts = 0; + +- if (virNetDevMacVLanInitialize() < 0) +- return -1; +- +- if (STRPREFIX(name, VIR_NET_GENERATED_MACVTAP_PREFIX)) { +- idstr = name + strlen(VIR_NET_GENERATED_MACVTAP_PREFIX); +- flags |= VIR_NETDEV_MACVLAN_CREATE_WITH_TAP; +- } else if (STRPREFIX(name, VIR_NET_GENERATED_MACVLAN_PREFIX)) { +- idstr = name + strlen(VIR_NET_GENERATED_MACVLAN_PREFIX); ++ if (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) { ++ prefix = VIR_NET_GENERATED_MACVTAP_PREFIX; ++ iftemplate = VIR_NET_GENERATED_MACVTAP_PREFIX "%d"; ++ lastID = &virNetDevMacVTapLastID; + } else { +- return -2; ++ prefix = VIR_NET_GENERATED_MACVLAN_PREFIX; ++ iftemplate = VIR_NET_GENERATED_MACVLAN_PREFIX "%d"; ++ lastID = &virNetDevMacVLanLastID; + } + +- if (virStrToLong_ui(idstr, NULL, 10, &id) < 0) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("couldn't get id value from macvtap device name %s"), +- name); +- return -1; +- } +- return virNetDevMacVLanReserveID(id, flags, quietFail, false); +-} ++ maxIDd = pow(10, IFNAMSIZ - 1 - strlen(prefix)); ++ if (maxIDd <= (double)INT_MAX) ++ maxID = (int)maxIDd; + ++ do { ++ g_autofree char *try = NULL; + +-/** +- * virNetDevMacVLanReleaseName: +- * +- * @name: already-known name of device +- * +- * Extract the device type and id from a macvtap/macvlan device name +- * and mark the appropriate position as in-use in the appropriate +- * bitmap. +- * +- * returns 0 on success, -1 on failure +- */ +-int +-virNetDevMacVLanReleaseName(const char *name) +-{ +- unsigned int id; +- unsigned int flags = 0; +- const char *idstr = NULL; ++ id = ++(*lastID); + +- if (virNetDevMacVLanInitialize() < 0) +- return -1; ++ /* reset before overflow */ ++ if (*lastID == maxID) ++ *lastID = -1; + +- if (STRPREFIX(name, VIR_NET_GENERATED_MACVTAP_PREFIX)) { +- idstr = name + strlen(VIR_NET_GENERATED_MACVTAP_PREFIX); +- flags |= VIR_NETDEV_MACVLAN_CREATE_WITH_TAP; +- } else if (STRPREFIX(name, VIR_NET_GENERATED_MACVLAN_PREFIX)) { +- idstr = name + strlen(VIR_NET_GENERATED_MACVLAN_PREFIX); +- } else { +- return 0; +- } ++ try = g_strdup_printf(iftemplate, id); + +- if (virStrToLong_ui(idstr, NULL, 10, &id) < 0) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("couldn't get id value from macvtap device name %s"), +- name); +- return -1; +- } +- return virNetDevMacVLanReleaseID(id, flags); ++ if (!virNetDevExists(try)) { ++ g_free(*ifname); ++ *ifname = g_steal_pointer(&try); ++ return 0; ++ } ++ } while (++attempts < 10000); ++ ++ virReportError(VIR_ERR_INTERNAL_ERROR, ++ _("no unused %s names available"), ++ *ifname); ++ return -1; + } + + +@@ -321,8 +232,7 @@ virNetDevMacVLanCreate(const char *ifname, + const char *type, + const virMacAddr *macaddress, + const char *srcdev, +- uint32_t macvlan_mode, +- int *retry) ++ uint32_t macvlan_mode) + { + int error = 0; + int ifindex = 0; +@@ -331,7 +241,6 @@ virNetDevMacVLanCreate(const char *ifname, + .mac = macaddress, + }; + +- *retry = 0; + + if (virNetDevGetIndex(srcdev, &ifindex) < 0) + return -1; +@@ -339,17 +248,15 @@ virNetDevMacVLanCreate(const char *ifname, + data.ifindex = &ifindex; + if (virNetlinkNewLink(ifname, type, &data, &error) < 0) { + char macstr[VIR_MAC_STRING_BUFLEN]; +- if (error == -EEXIST) +- *retry = 1; +- else if (error < 0) +- virReportSystemError(-error, +- _("error creating %s interface %s@%s (%s)"), +- type, ifname, srcdev, +- virMacAddrFormat(macaddress, macstr)); + ++ virReportSystemError(-error, ++ _("error creating %s interface %s@%s (%s)"), ++ type, ifname, srcdev, ++ virMacAddrFormat(macaddress, macstr)); + return -1; + } + ++ VIR_INFO("created device: '%s'", ifname); + return 0; + } + +@@ -364,6 +271,7 @@ virNetDevMacVLanCreate(const char *ifname, + */ + int virNetDevMacVLanDelete(const char *ifname) + { ++ VIR_INFO("delete device: '%s'", ifname); + return virNetlinkDelLink(ifname, NULL); + } + +@@ -904,13 +812,8 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, + unsigned int flags) + { + const char *type = VIR_NET_GENERATED_PREFIX; +- const char *pattern = (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) ? +- VIR_NET_GENERATED_MACVTAP_PATTERN : VIR_NET_GENERATED_MACVLAN_PATTERN; +- int reservedID = -1; +- char ifname[IFNAMSIZ]; +- int retries, do_retry = 0; ++ g_autofree char *ifname = NULL; + uint32_t macvtapMode; +- const char *ifnameCreated = NULL; + int vf = -1; + bool vnet_hdr = flags & VIR_NETDEV_MACVLAN_VNET_HDR; + +@@ -945,6 +848,8 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, + return -1; + } + ++ virMutexLock(&virNetDevMacVLanCreateMutex); ++ + if (ifnameRequested) { + int rc; + bool isAutoName +@@ -952,97 +857,81 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, + STRPREFIX(ifnameRequested, VIR_NET_GENERATED_MACVLAN_PREFIX)); + + VIR_INFO("Requested macvtap device name: %s", ifnameRequested); +- virMutexLock(&virNetDevMacVLanCreateMutex); + + if ((rc = virNetDevExists(ifnameRequested)) < 0) { + virMutexUnlock(&virNetDevMacVLanCreateMutex); + return -1; + } ++ + if (rc) { +- if (isAutoName) +- goto create_name; +- virReportSystemError(EEXIST, +- _("Unable to create %s device %s"), +- type, ifnameRequested); +- virMutexUnlock(&virNetDevMacVLanCreateMutex); +- return -1; +- } +- if (isAutoName && +- (reservedID = virNetDevMacVLanReserveName(ifnameRequested, true)) < 0) { +- reservedID = -1; +- goto create_name; +- } ++ /* ifnameRequested is already being used */ + +- if (virNetDevMacVLanCreate(ifnameRequested, type, macaddress, +- linkdev, macvtapMode, &do_retry) < 0) { +- if (isAutoName) { +- virNetDevMacVLanReleaseName(ifnameRequested); +- reservedID = -1; +- goto create_name; ++ if (!isAutoName) { ++ virReportSystemError(EEXIST, ++ _("Unable to create device '%s'"), ++ ifnameRequested); ++ virMutexUnlock(&virNetDevMacVLanCreateMutex); ++ return -1; ++ } ++ } else { ++ ++ /* ifnameRequested is available. try to open it */ ++ ++ virNetDevMacVLanReserveNameInternal(ifnameRequested); ++ ++ if (virNetDevMacVLanCreate(ifnameRequested, type, macaddress, ++ linkdev, macvtapMode) == 0) { ++ ++ /* virNetDevMacVLanCreate() was successful - use this name */ ++ ifname = g_strdup(ifnameRequested); ++ ++ } else if (!isAutoName) { ++ /* coudn't open ifnameRequested, but it wasn't an ++ * autogenerated named, so there is nothing else to ++ * try - fail and return. ++ */ ++ virMutexUnlock(&virNetDevMacVLanCreateMutex); ++ return -1; + } +- virMutexUnlock(&virNetDevMacVLanCreateMutex); +- return -1; + } +- /* virNetDevMacVLanCreate() was successful - use this name */ +- ifnameCreated = ifnameRequested; +- create_name: +- virMutexUnlock(&virNetDevMacVLanCreateMutex); + } + +- retries = MACVLAN_MAX_ID; +- while (!ifnameCreated && retries) { +- virMutexLock(&virNetDevMacVLanCreateMutex); +- reservedID = virNetDevMacVLanReserveID(reservedID, flags, false, true); +- if (reservedID < 0) { ++ if (!ifname) { ++ /* ifnameRequested was NULL, or it was an already in use ++ * autogenerated name, so now we look for an unused ++ * autogenerated name. ++ */ ++ if (virNetDevMacVLanGenerateName(&ifname, flags) < 0 || ++ virNetDevMacVLanCreate(ifname, type, macaddress, ++ linkdev, macvtapMode) < 0) { + virMutexUnlock(&virNetDevMacVLanCreateMutex); + return -1; + } +- g_snprintf(ifname, sizeof(ifname), pattern, reservedID); +- if (virNetDevMacVLanCreate(ifname, type, macaddress, linkdev, +- macvtapMode, &do_retry) < 0) { +- virNetDevMacVLanReleaseID(reservedID, flags); +- virMutexUnlock(&virNetDevMacVLanCreateMutex); +- if (!do_retry) +- return -1; +- VIR_INFO("Device %s wasn't reserved but already existed, skipping", +- ifname); +- retries--; +- continue; +- } +- ifnameCreated = ifname; +- virMutexUnlock(&virNetDevMacVLanCreateMutex); + } + +- if (!ifnameCreated) { +- virReportError(VIR_ERR_INTERNAL_ERROR, +- _("Too many unreserved %s devices in use"), +- type); +- return -1; +- } ++ /* all done creating the device */ ++ virMutexUnlock(&virNetDevMacVLanCreateMutex); + +- if (virNetDevVPortProfileAssociate(ifnameCreated, ++ if (virNetDevVPortProfileAssociate(ifname, + virtPortProfile, + macaddress, + linkdev, + vf, +- vmuuid, vmOp, false) < 0) ++ vmuuid, vmOp, false) < 0) { + goto link_del_exit; ++ } + + if (flags & VIR_NETDEV_MACVLAN_CREATE_IFUP) { +- if (virNetDevSetOnline(ifnameCreated, true) < 0) ++ if (virNetDevSetOnline(ifname, true) < 0) + goto disassociate_exit; + } + + if (flags & VIR_NETDEV_MACVLAN_CREATE_WITH_TAP) { +- if (virNetDevMacVLanTapOpen(ifnameCreated, tapfd, tapfdSize) < 0) ++ if (virNetDevMacVLanTapOpen(ifname, tapfd, tapfdSize) < 0) + goto disassociate_exit; + + if (virNetDevMacVLanTapSetup(tapfd, tapfdSize, vnet_hdr) < 0) + goto disassociate_exit; +- +- *ifnameResult = g_strdup(ifnameCreated); +- } else { +- *ifnameResult = g_strdup(ifnameCreated); + } + + if (vmOp == VIR_NETDEV_VPORT_PROFILE_OP_CREATE || +@@ -1051,17 +940,18 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, + * a saved image) - migration and libvirtd restart are handled + * elsewhere. + */ +- if (virNetDevMacVLanVPortProfileRegisterCallback(ifnameCreated, macaddress, ++ if (virNetDevMacVLanVPortProfileRegisterCallback(ifname, macaddress, + linkdev, vmuuid, + virtPortProfile, + vmOp) < 0) + goto disassociate_exit; + } + ++ *ifnameResult = g_steal_pointer(&ifname); + return 0; + + disassociate_exit: +- ignore_value(virNetDevVPortProfileDisassociate(ifnameCreated, ++ ignore_value(virNetDevVPortProfileDisassociate(ifname, + virtPortProfile, + macaddress, + linkdev, +@@ -1071,9 +961,7 @@ virNetDevMacVLanCreateWithVPortProfile(const char *ifnameRequested, + VIR_FORCE_CLOSE(tapfd[tapfdSize]); + + link_del_exit: +- ignore_value(virNetDevMacVLanDelete(ifnameCreated)); +- virNetDevMacVLanReleaseName(ifnameCreated); +- ++ ignore_value(virNetDevMacVLanDelete(ifname)); + return -1; + } + +@@ -1107,7 +995,6 @@ int virNetDevMacVLanDeleteWithVPortProfile(const char *ifname, + ret = -1; + if (virNetDevMacVLanDelete(ifname) < 0) + ret = -1; +- virNetDevMacVLanReleaseName(ifname); + } + + if (mode == VIR_NETDEV_MACVLAN_MODE_PASSTHRU) { +@@ -1182,8 +1069,7 @@ int virNetDevMacVLanCreate(const char *ifname G_GNUC_UNUSED, + const char *type G_GNUC_UNUSED, + const virMacAddr *macaddress G_GNUC_UNUSED, + const char *srcdev G_GNUC_UNUSED, +- uint32_t macvlan_mode G_GNUC_UNUSED, +- int *retry G_GNUC_UNUSED) ++ uint32_t macvlan_mode G_GNUC_UNUSED) + { + virReportSystemError(ENOSYS, "%s", + _("Cannot create macvlan devices on this platform")); +@@ -1272,18 +1158,9 @@ int virNetDevMacVLanVPortProfileRegisterCallback(const char *ifname G_GNUC_UNUSE + return -1; + } + +-int virNetDevMacVLanReleaseName(const char *name G_GNUC_UNUSED) ++void virNetDevMacVLanReserveName(const char *name G_GNUC_UNUSED) + { + virReportSystemError(ENOSYS, "%s", + _("Cannot create macvlan devices on this platform")); +- return -1; +-} +- +-int virNetDevMacVLanReserveName(const char *name G_GNUC_UNUSED, +- bool quietFail G_GNUC_UNUSED) +-{ +- virReportSystemError(ENOSYS, "%s", +- _("Cannot create macvlan devices on this platform")); +- return -1; + } + #endif /* ! WITH_MACVTAP */ +diff --git a/src/util/virnetdevmacvlan.h b/src/util/virnetdevmacvlan.h +index fc1bb018a2..48800a8fcf 100644 +--- a/src/util/virnetdevmacvlan.h ++++ b/src/util/virnetdevmacvlan.h +@@ -54,8 +54,7 @@ typedef enum { + #define VIR_NET_GENERATED_MACVTAP_PREFIX "macvtap" + #define VIR_NET_GENERATED_MACVLAN_PREFIX "macvlan" + +-int virNetDevMacVLanReserveName(const char *name, bool quietfail); +-int virNetDevMacVLanReleaseName(const char *name); ++void virNetDevMacVLanReserveName(const char *name); + + bool virNetDevMacVLanIsMacvtap(const char *ifname) + ATTRIBUTE_NONNULL(1) G_GNUC_WARN_UNUSED_RESULT G_GNUC_NO_INLINE; +@@ -64,8 +63,7 @@ int virNetDevMacVLanCreate(const char *ifname, + const char *type, + const virMacAddr *macaddress, + const char *srcdev, +- uint32_t macvlan_mode, +- int *retry) ++ uint32_t macvlan_mode) + ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3) ATTRIBUTE_NONNULL(4) + G_GNUC_WARN_UNUSED_RESULT; + +-- +2.29.2 + diff --git a/SOURCES/libvirt-util-synchronize-with-firewalld-before-we-start-calling-iptables-directly.patch b/SOURCES/libvirt-util-synchronize-with-firewalld-before-we-start-calling-iptables-directly.patch new file mode 100644 index 0000000..63ca58b --- /dev/null +++ b/SOURCES/libvirt-util-synchronize-with-firewalld-before-we-start-calling-iptables-directly.patch @@ -0,0 +1,152 @@ +From dc8cf11686c075166a3029e974a6caeefe521d75 Mon Sep 17 00:00:00 2001 +Message-Id: +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:50 -0500 +Subject: [PATCH] util: synchronize with firewalld before we start calling + iptables directly + +When it is starting up, firewalld will delete all existing iptables +rules and chains before adding its own rules. If libvirtd were to try +to directly add iptables rules during the time before firewalld has +finished initializing, firewalld would end up deleting the rules that +libvirtd has just added. + +Currently this isn't a problem, since libvirtd only adds iptables +rules via the firewalld "passthrough command" API, and so firewalld is +able to properly serialize everything. However, we will soon be +changing libvirtd to add its iptables and ebtables rules by directly +calling iptables/ebtables rather than via firewalld, thus removing the +serialization of libvirtd adding rules vs. firewalld deleting rules. + +This will especially apparent (if we don't fix it in advance, as this +patch does) when libvirtd is responding to the dbus NameOwnerChanged +event, which is used to learn when firewalld has been restarted. In +that case, dbus sends the event before firewalld has been able to +complete its initialization, so when libvirt responds to the event by +adding back its iptables rules (with direct calls to +/usr/bin/iptables), some of those rules are added before firewalld has +a chance to do its "remove everything" startup protocol. The usual +result of this is that libvirt will successfully add its private +chains (e.g. LIBVIRT_INP, etc), but then fail when it tries to add a +rule jumping to one of those chains (because in the interim, firewalld +has deleted the new chains). + +The solution is for libvirt to preface it's direct calling to iptables +with a iptables command sent via firewalld's passthrough command +API. Since commands sent to firewalld are completed synchronously, and +since firewalld won't service them until it has completed its own +initialization, this will assure that by the time libvirt starts +calling iptables to add rules, that firewalld will not be following up +by deleting any of those rules. + +To minimize the amount of extra overhead, we request the simplest +iptables command possible: "iptables -V" (and aside from logging a +debug message, we ignore the result, for good measure). + +(This patch is being done *before* the patch that switches to calling +iptables directly, so that everything will function properly with any +fractional part of the series applied). + +https://bugzilla.redhat.com/1607929 + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit 070690538a1ed301b004c542d94b13ee9bffc9d6) + +Conflicts: src/util/viriptables.c: + one line of code in context moved during g_autoptr conversion. +Signed-off-by: Laine Stump +Message-Id: <20210116035151.1066734-8-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/libvirt_private.syms | 1 + + src/util/virfirewall.c | 30 ++++++++++++++++++++++++++++++ + src/util/virfirewall.h | 2 ++ + src/util/viriptables.c | 7 +++++++ + 4 files changed, 40 insertions(+) + +diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms +index edc53ce899..9d87e2a27b 100644 +--- a/src/libvirt_private.syms ++++ b/src/libvirt_private.syms +@@ -2080,6 +2080,7 @@ virFileCacheSetPriv; + # util/virfirewall.h + virFirewallAddRuleFull; + virFirewallApply; ++virFirewallBackendSynchronize; + virFirewallFree; + virFirewallNew; + virFirewallRemoveRule; +diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c +index 520d515c11..66d20d3f17 100644 +--- a/src/util/virfirewall.c ++++ b/src/util/virfirewall.c +@@ -653,6 +653,36 @@ virFirewallApplyRuleFirewallD(virFirewallRulePtr rule, + return virFirewallDApplyRule(rule->layer, rule->args, rule->argsLen, ignoreErrors, output); + } + ++ ++void ++virFirewallBackendSynchronize(void) ++{ ++ const char *arg = "-V"; ++ g_autofree char *output = NULL; ++ ++ switch (currentBackend) { ++ case VIR_FIREWALL_BACKEND_DIRECT: ++ /* nobody to synchronize with */ ++ break; ++ case VIR_FIREWALL_BACKEND_FIREWALLD: ++ /* Send a simple rule via firewalld's passthrough iptables ++ * command so that we'll be sure firewalld has fully ++ * initialized and caught up with its internal queue of ++ * iptables commands. Waiting for this will prevent our own ++ * directly-executed iptables commands from being run while ++ * firewalld is still initializing. ++ */ ++ ignore_value(virFirewallDApplyRule(VIR_FIREWALL_LAYER_IPV4, ++ (char **)&arg, 1, true, &output)); ++ VIR_DEBUG("Result of 'iptables -V' via firewalld: %s", NULLSTR(output)); ++ break; ++ case VIR_FIREWALL_BACKEND_AUTOMATIC: ++ case VIR_FIREWALL_BACKEND_LAST: ++ break; ++ } ++} ++ ++ + static int + virFirewallApplyRule(virFirewallPtr firewall, + virFirewallRulePtr rule, +diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h +index fda3cdec01..3db0864380 100644 +--- a/src/util/virfirewall.h ++++ b/src/util/virfirewall.h +@@ -111,4 +111,6 @@ void virFirewallStartRollback(virFirewallPtr firewall, + + int virFirewallApply(virFirewallPtr firewall); + ++void virFirewallBackendSynchronize(void); ++ + G_DEFINE_AUTOPTR_CLEANUP_FUNC(virFirewall, virFirewallFree); +diff --git a/src/util/viriptables.c b/src/util/viriptables.c +index 6b3a025880..41544b7f36 100644 +--- a/src/util/viriptables.c ++++ b/src/util/viriptables.c +@@ -154,6 +154,13 @@ iptablesSetupPrivateChains(virFirewallLayer layer) + + fw = virFirewallNew(); + ++ /* When the backend is firewalld, we need to make sure that ++ * firewalld has been fully started and completed its ++ * initialization, otherwise firewalld might delete our rules soon ++ * after we add them! ++ */ ++ virFirewallBackendSynchronize(); ++ + virFirewallStartTransaction(fw, 0); + + for (i = 0; i < G_N_ELEMENTS(data); i++) +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-tests-enable-locking-on-iptables-ebtables-commandlines-by-default.patch b/SOURCES/libvirt-util-tests-enable-locking-on-iptables-ebtables-commandlines-by-default.patch new file mode 100644 index 0000000..6446cf4 --- /dev/null +++ b/SOURCES/libvirt-util-tests-enable-locking-on-iptables-ebtables-commandlines-by-default.patch @@ -0,0 +1,225 @@ +From d7703d11a44505d1a17001d8cfd36bf74d20b710 Mon Sep 17 00:00:00 2001 +Message-Id: +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:46 -0500 +Subject: [PATCH] util/tests: enable locking on iptables/ebtables commandlines + by default + +iptables and ip6tables have had a "-w" commandline option to grab a +systemwide lock that prevents two iptables invocations from modifying +the iptables chains since 2013 (upstream commit 93587a04 in +iptables-1.4.20). Similarly, ebtables has had a "--concurrent" +commandline option for the same purpose since 2011 (in the upstream +ebtables commit f9b4bcb93, which was present in ebtables-2.0.10.4). + +Libvirt added code to conditionally use the commandline option for +iptables/ip6tables in upstream commit ba95426d6f (libvirt-1.2.0, +November 2013), and for ebtables in upstream commit dc33e6e4a5 +(libvirt-1.2.11, November 2014) (the latter actually *re*-added the +locking for iptables/ip6tables, as it had accidentally been removed +during a refactor of firewall code in the interim). + +I say "conditionally" because a check was made during firewall module +initialization that tried executing a test command with the +-w/--concurrent option, and only continued using it for actual +commands if that test command completed successfully. At the time the +code was added this was a reasonable thing to do, as it had been less +than a year since introduction of -w to iptables, so many distros +supported by libvirt were still using iptables (and possibly even +ebtables) versions too old to have the new commandline options. + +It is now 2020, and as far as I can discern from repology.org (and +manually examining a RHEL7.9 system), every version of every distro +that is supported by libvirt now uses new enough versions of both +iptables and ebtables that they all have support for -w/--concurrent. +That means we can finally remove the conditional code and simply +always use them. + +https://bugzilla.redhat.com/1607929 + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit 0a867cd895f06134d24eb27070285bb4b50c088f) +Message-Id: <20210116035151.1066734-4-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/libvirt_private.syms | 1 - + src/util/virfirewall.c | 64 ++------------------------------ + src/util/virfirewall.h | 2 - + tests/networkxml2firewalltest.c | 2 - + tests/nwfilterebiptablestest.c | 2 - + tests/nwfilterxml2firewalltest.c | 2 - + tests/virfirewalltest.c | 2 - + 7 files changed, 3 insertions(+), 72 deletions(-) + +diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms +index d6598c2514..edc53ce899 100644 +--- a/src/libvirt_private.syms ++++ b/src/libvirt_private.syms +@@ -2089,7 +2089,6 @@ virFirewallRuleAddArgList; + virFirewallRuleAddArgSet; + virFirewallRuleGetArgCount; + virFirewallSetBackend; +-virFirewallSetLockOverride; + virFirewallStartRollback; + virFirewallStartTransaction; + +diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c +index c2de2bccae..2e3b02402e 100644 +--- a/src/util/virfirewall.c ++++ b/src/util/virfirewall.c +@@ -97,59 +97,6 @@ virFirewallOnceInit(void) + + VIR_ONCE_GLOBAL_INIT(virFirewall); + +-static bool iptablesUseLock; +-static bool ip6tablesUseLock; +-static bool ebtablesUseLock; +-static bool lockOverride; /* true to avoid lock probes */ +- +-void +-virFirewallSetLockOverride(bool avoid) +-{ +- lockOverride = avoid; +- if (avoid) { +- /* add the lock option to all commands */ +- iptablesUseLock = true; +- ip6tablesUseLock = true; +- ebtablesUseLock = true; +- } +-} +- +-static void +-virFirewallCheckUpdateLock(bool *lockflag, +- const char *const*args) +-{ +- int status; /* Ignore failed commands without logging them */ +- g_autoptr(virCommand) cmd = virCommandNewArgs(args); +- if (virCommandRun(cmd, &status) < 0 || status) { +- VIR_INFO("locking not supported by %s", args[0]); +- } else { +- VIR_INFO("using locking for %s", args[0]); +- *lockflag = true; +- } +-} +- +-static void +-virFirewallCheckUpdateLocking(void) +-{ +- const char *iptablesArgs[] = { +- IPTABLES_PATH, "-w", "-L", "-n", NULL, +- }; +- const char *ip6tablesArgs[] = { +- IP6TABLES_PATH, "-w", "-L", "-n", NULL, +- }; +- const char *ebtablesArgs[] = { +- EBTABLES_PATH, "--concurrent", "-L", NULL, +- }; +- if (lockOverride) +- return; +- virFirewallCheckUpdateLock(&iptablesUseLock, +- iptablesArgs); +- virFirewallCheckUpdateLock(&ip6tablesUseLock, +- ip6tablesArgs); +- virFirewallCheckUpdateLock(&ebtablesUseLock, +- ebtablesArgs); +-} +- + static int + virFirewallValidateBackend(virFirewallBackend backend) + { +@@ -197,8 +144,6 @@ virFirewallValidateBackend(virFirewallBackend backend) + + currentBackend = backend; + +- virFirewallCheckUpdateLocking(); +- + return 0; + } + +@@ -363,16 +308,13 @@ virFirewallAddRuleFullV(virFirewallPtr firewall, + + switch (rule->layer) { + case VIR_FIREWALL_LAYER_ETHERNET: +- if (ebtablesUseLock) +- ADD_ARG(rule, "--concurrent"); ++ ADD_ARG(rule, "--concurrent"); + break; + case VIR_FIREWALL_LAYER_IPV4: +- if (iptablesUseLock) +- ADD_ARG(rule, "-w"); ++ ADD_ARG(rule, "-w"); + break; + case VIR_FIREWALL_LAYER_IPV6: +- if (ip6tablesUseLock) +- ADD_ARG(rule, "-w"); ++ ADD_ARG(rule, "-w"); + break; + case VIR_FIREWALL_LAYER_LAST: + break; +diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h +index 6148f46827..fda3cdec01 100644 +--- a/src/util/virfirewall.h ++++ b/src/util/virfirewall.h +@@ -111,6 +111,4 @@ void virFirewallStartRollback(virFirewallPtr firewall, + + int virFirewallApply(virFirewallPtr firewall); + +-void virFirewallSetLockOverride(bool avoid); +- + G_DEFINE_AUTOPTR_CLEANUP_FUNC(virFirewall, virFirewallFree); +diff --git a/tests/networkxml2firewalltest.c b/tests/networkxml2firewalltest.c +index 0ad5e2303b..886b268319 100644 +--- a/tests/networkxml2firewalltest.c ++++ b/tests/networkxml2firewalltest.c +@@ -152,8 +152,6 @@ mymain(void) + ret = -1; \ + } while (0) + +- virFirewallSetLockOverride(true); +- + if (virFirewallSetBackend(VIR_FIREWALL_BACKEND_DIRECT) < 0) { + if (!hasNetfilterTools()) { + fprintf(stderr, "iptables/ip6tables/ebtables tools not present"); +diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c +index e70f0e2400..adce7430a9 100644 +--- a/tests/nwfilterebiptablestest.c ++++ b/tests/nwfilterebiptablestest.c +@@ -510,8 +510,6 @@ mymain(void) + { + int ret = 0; + +- virFirewallSetLockOverride(true); +- + if (virFirewallSetBackend(VIR_FIREWALL_BACKEND_DIRECT) < 0) { + if (!hasNetfilterTools()) { + fprintf(stderr, "iptables/ip6tables/ebtables tools not present"); +diff --git a/tests/nwfilterxml2firewalltest.c b/tests/nwfilterxml2firewalltest.c +index c97f83b24a..73f7991a96 100644 +--- a/tests/nwfilterxml2firewalltest.c ++++ b/tests/nwfilterxml2firewalltest.c +@@ -459,8 +459,6 @@ mymain(void) + ret = -1; \ + } while (0) + +- virFirewallSetLockOverride(true); +- + if (virFirewallSetBackend(VIR_FIREWALL_BACKEND_DIRECT) < 0) { + if (!hasNetfilterTools()) { + fprintf(stderr, "iptables/ip6tables/ebtables tools not present"); +diff --git a/tests/virfirewalltest.c b/tests/virfirewalltest.c +index 195163a985..1ec768d302 100644 +--- a/tests/virfirewalltest.c ++++ b/tests/virfirewalltest.c +@@ -1141,8 +1141,6 @@ mymain(void) + RUN_TEST_DIRECT(name, method) + # endif /* ! WITH_DBUS */ + +- virFirewallSetLockOverride(true); +- + RUN_TEST("single group", testFirewallSingleGroup); + RUN_TEST("remove rule", testFirewallRemoveRule); + RUN_TEST("many groups", testFirewallManyGroups); +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-tests-enable-locking-on-iptables-ebtables-commandlines-in-unit-tests.patch b/SOURCES/libvirt-util-tests-enable-locking-on-iptables-ebtables-commandlines-in-unit-tests.patch new file mode 100644 index 0000000..6230734 --- /dev/null +++ b/SOURCES/libvirt-util-tests-enable-locking-on-iptables-ebtables-commandlines-in-unit-tests.patch @@ -0,0 +1,6497 @@ +From 4dcb98488fe7049c914a9e2bd82d2fcae834bba5 Mon Sep 17 00:00:00 2001 +Message-Id: <4dcb98488fe7049c914a9e2bd82d2fcae834bba5@dist-git> +From: Laine Stump +Date: Fri, 15 Jan 2021 22:51:45 -0500 +Subject: [PATCH] util/tests: enable locking on iptables/ebtables commandlines + in unit tests + +All the unit tests that use iptables/ip6tables/ebtables have been +written to omit the locking/exclusive use primitive on the generated +commandlines. Even though none of the tests actually execute those +commands (and so it doesn't matter for purposes of the test whether or +not the commands support these options), it still made sense when some +systems had these locking options and some didn't. + +We are now at a point where every supported Linux distro has supported +the locking options on these commands for quite a long time, and are +going to make their use non-optional. As a first step, this patch uses +the virFirewallSetLockOverride() function, which is called at the +beginning of all firewall-related tests, to set all the bools +controlling whether or not the locking options are used to true. This +means that all the test cases must be updated to include the proper +locking option in their commandlines. + +The change to make actual execs of the commands unconditionally use +the locking option will be in an upcoming patch - this one affects +only the unit tests. + +https://bugzilla.redhat.com/1607929 + +Signed-off-by: Laine Stump +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit e66451f685e29ffe4be5a060ef64b19961ad4bb5) + +Conflicts: + tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.args: + exists only upstream + + tests/virfirewalltest.c: + minor merge conflict due to glib conversion upstream. + +Signed-off-by: Laine Stump +Message-Id: <20210116035151.1066734-3-laine@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virfirewall.c | 6 + + tests/networkxml2firewalldata/base.args | 34 ++ + .../nat-default-linux.args | 19 + + .../nat-ipv6-linux.args | 30 ++ + .../nat-many-ips-linux.args | 33 ++ + .../nat-no-dhcp-linux.args | 29 ++ + .../nat-tftp-linux.args | 21 + + .../route-default-linux.args | 14 + + tests/nwfilterebiptablestest.c | 464 +++++++++--------- + .../ah-ipv6-linux.args | 9 + + tests/nwfilterxml2firewalldata/ah-linux.args | 9 + + .../all-ipv6-linux.args | 9 + + tests/nwfilterxml2firewalldata/all-linux.args | 9 + + tests/nwfilterxml2firewalldata/arp-linux.args | 5 + + .../comment-linux.args | 19 + + .../conntrack-linux.args | 7 + + .../esp-ipv6-linux.args | 9 + + tests/nwfilterxml2firewalldata/esp-linux.args | 9 + + .../example-1-linux.args | 12 + + .../example-2-linux.args | 10 + + .../hex-data-linux.args | 10 + + .../icmp-direction-linux.args | 6 + + .../icmp-direction2-linux.args | 6 + + .../icmp-direction3-linux.args | 6 + + .../nwfilterxml2firewalldata/icmp-linux.args | 3 + + .../icmpv6-linux.args | 4 + + .../nwfilterxml2firewalldata/igmp-linux.args | 9 + + tests/nwfilterxml2firewalldata/ip-linux.args | 3 + + .../nwfilterxml2firewalldata/ipset-linux.args | 18 + + .../ipt-no-macspoof-linux.args | 2 + + .../nwfilterxml2firewalldata/ipv6-linux.args | 15 + + .../nwfilterxml2firewalldata/iter1-linux.args | 9 + + .../nwfilterxml2firewalldata/iter2-linux.args | 171 +++++++ + .../nwfilterxml2firewalldata/iter3-linux.args | 15 + + tests/nwfilterxml2firewalldata/mac-linux.args | 4 + + .../nwfilterxml2firewalldata/rarp-linux.args | 6 + + .../sctp-ipv6-linux.args | 9 + + .../nwfilterxml2firewalldata/sctp-linux.args | 9 + + tests/nwfilterxml2firewalldata/stp-linux.args | 11 + + .../target-linux.args | 33 ++ + .../target2-linux.args | 12 + + .../tcp-ipv6-linux.args | 9 + + tests/nwfilterxml2firewalldata/tcp-linux.args | 13 + + .../udp-ipv6-linux.args | 9 + + tests/nwfilterxml2firewalldata/udp-linux.args | 9 + + .../udplite-ipv6-linux.args | 9 + + .../udplite-linux.args | 9 + + .../nwfilterxml2firewalldata/vlan-linux.args | 7 + + tests/nwfilterxml2firewalltest.c | 144 +++--- + tests/virfirewalltest.c | 112 +++-- + 50 files changed, 1081 insertions(+), 358 deletions(-) + +diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c +index ee72b579e4..c2de2bccae 100644 +--- a/src/util/virfirewall.c ++++ b/src/util/virfirewall.c +@@ -106,6 +106,12 @@ void + virFirewallSetLockOverride(bool avoid) + { + lockOverride = avoid; ++ if (avoid) { ++ /* add the lock option to all commands */ ++ iptablesUseLock = true; ++ ip6tablesUseLock = true; ++ ebtablesUseLock = true; ++ } + } + + static void +diff --git a/tests/networkxml2firewalldata/base.args b/tests/networkxml2firewalldata/base.args +index 0e71bf3a64..056ee12758 100644 +--- a/tests/networkxml2firewalldata/base.args ++++ b/tests/networkxml2firewalldata/base.args +@@ -1,116 +1,150 @@ + iptables \ ++-w \ + --table filter \ + --list-rules + iptables \ ++-w \ + --table nat \ + --list-rules + iptables \ ++-w \ + --table mangle \ + --list-rules + iptables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_INP + iptables \ ++-w \ + --table filter \ + --insert INPUT \ + --jump LIBVIRT_INP + iptables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_OUT + iptables \ ++-w \ + --table filter \ + --insert OUTPUT \ + --jump LIBVIRT_OUT + iptables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_FWO + iptables \ ++-w \ + --table filter \ + --insert FORWARD \ + --jump LIBVIRT_FWO + iptables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_FWI + iptables \ ++-w \ + --table filter \ + --insert FORWARD \ + --jump LIBVIRT_FWI + iptables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_FWX + iptables \ ++-w \ + --table filter \ + --insert FORWARD \ + --jump LIBVIRT_FWX + iptables \ ++-w \ + --table nat \ + --new-chain LIBVIRT_PRT + iptables \ ++-w \ + --table nat \ + --insert POSTROUTING \ + --jump LIBVIRT_PRT + iptables \ ++-w \ + --table mangle \ + --new-chain LIBVIRT_PRT + iptables \ ++-w \ + --table mangle \ + --insert POSTROUTING \ + --jump LIBVIRT_PRT + ip6tables \ ++-w \ + --table filter \ + --list-rules + ip6tables \ ++-w \ + --table nat \ + --list-rules + ip6tables \ ++-w \ + --table mangle \ + --list-rules + ip6tables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_INP + ip6tables \ ++-w \ + --table filter \ + --insert INPUT \ + --jump LIBVIRT_INP + ip6tables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_OUT + ip6tables \ ++-w \ + --table filter \ + --insert OUTPUT \ + --jump LIBVIRT_OUT + ip6tables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_FWO + ip6tables \ ++-w \ + --table filter \ + --insert FORWARD \ + --jump LIBVIRT_FWO + ip6tables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_FWI + ip6tables \ ++-w \ + --table filter \ + --insert FORWARD \ + --jump LIBVIRT_FWI + ip6tables \ ++-w \ + --table filter \ + --new-chain LIBVIRT_FWX + ip6tables \ ++-w \ + --table filter \ + --insert FORWARD \ + --jump LIBVIRT_FWX + ip6tables \ ++-w \ + --table nat \ + --new-chain LIBVIRT_PRT + ip6tables \ ++-w \ + --table nat \ + --insert POSTROUTING \ + --jump LIBVIRT_PRT + ip6tables \ ++-w \ + --table mangle \ + --new-chain LIBVIRT_PRT + ip6tables \ ++-w \ + --table mangle \ + --insert POSTROUTING \ + --jump LIBVIRT_PRT +diff --git a/tests/networkxml2firewalldata/nat-default-linux.args b/tests/networkxml2firewalldata/nat-default-linux.args +index ab18f30bd0..3cfa61333c 100644 +--- a/tests/networkxml2firewalldata/nat-default-linux.args ++++ b/tests/networkxml2firewalldata/nat-default-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -6,6 +7,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -13,6 +15,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -20,6 +23,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -27,6 +31,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -34,6 +39,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -41,6 +47,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -48,6 +55,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -55,28 +63,33 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.122.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.122.0/24 \ +@@ -85,12 +98,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 '!' \ + --destination 192.168.122.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -99,6 +114,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -107,18 +123,21 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + iptables \ ++-w \ + --table mangle \ + --insert LIBVIRT_PRT \ + --out-interface virbr0 \ +diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.args b/tests/networkxml2firewalldata/nat-ipv6-linux.args +index 05d9ee33ca..ce295cbc6d 100644 +--- a/tests/networkxml2firewalldata/nat-ipv6-linux.args ++++ b/tests/networkxml2firewalldata/nat-ipv6-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -6,6 +7,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -13,6 +15,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -20,6 +23,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -27,6 +31,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -34,6 +39,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -41,6 +47,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -48,6 +55,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -55,38 +63,45 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -94,6 +109,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -101,6 +117,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -108,6 +125,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -115,6 +133,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -122,6 +141,7 @@ ip6tables \ + --destination-port 547 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -129,12 +149,14 @@ ip6tables \ + --destination-port 546 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.122.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.122.0/24 \ +@@ -143,12 +165,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 '!' \ + --destination 192.168.122.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -157,6 +181,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -165,30 +190,35 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 2001:db8:ca2:2::/64 \ + --in-interface virbr0 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 2001:db8:ca2:2::/64 \ + --out-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table mangle \ + --insert LIBVIRT_PRT \ + --out-interface virbr0 \ +diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.args b/tests/networkxml2firewalldata/nat-many-ips-linux.args +index 82e1380f51..ba7f234b82 100644 +--- a/tests/networkxml2firewalldata/nat-many-ips-linux.args ++++ b/tests/networkxml2firewalldata/nat-many-ips-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -6,6 +7,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -13,6 +15,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -20,6 +23,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -27,6 +31,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -34,6 +39,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -41,6 +47,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -48,6 +55,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -55,28 +63,33 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.122.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.122.0/24 \ +@@ -85,12 +98,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 '!' \ + --destination 192.168.122.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -99,6 +114,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -107,24 +123,28 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.128.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.128.0/24 \ +@@ -133,12 +153,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.128.0/24 '!' \ + --destination 192.168.128.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.128.0/24 \ +@@ -147,6 +169,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.128.0/24 \ +@@ -155,24 +178,28 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.128.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.128.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.150.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.150.0/24 \ +@@ -181,12 +208,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.150.0/24 '!' \ + --destination 192.168.150.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.150.0/24 \ +@@ -195,6 +224,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.150.0/24 \ +@@ -203,18 +233,21 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.150.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.150.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + iptables \ ++-w \ + --table mangle \ + --insert LIBVIRT_PRT \ + --out-interface virbr0 \ +diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.args b/tests/networkxml2firewalldata/nat-no-dhcp-linux.args +index 8954cc5473..1e5aa05231 100644 +--- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.args ++++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -6,6 +7,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -13,6 +15,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -20,6 +23,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -27,6 +31,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -34,6 +39,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -41,6 +47,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -48,6 +55,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -55,38 +63,45 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -94,6 +109,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -101,6 +117,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -108,6 +125,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -115,6 +133,7 @@ ip6tables \ + --destination-port 53 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -122,6 +141,7 @@ ip6tables \ + --destination-port 547 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -129,12 +149,14 @@ ip6tables \ + --destination-port 546 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.122.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.122.0/24 \ +@@ -143,12 +165,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 '!' \ + --destination 192.168.122.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -157,6 +181,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -165,24 +190,28 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 2001:db8:ca2:2::/64 \ + --in-interface virbr0 \ + --jump ACCEPT + ip6tables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 2001:db8:ca2:2::/64 \ +diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.args b/tests/networkxml2firewalldata/nat-tftp-linux.args +index 88e9929b62..565fff737c 100644 +--- a/tests/networkxml2firewalldata/nat-tftp-linux.args ++++ b/tests/networkxml2firewalldata/nat-tftp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -6,6 +7,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -13,6 +15,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -20,6 +23,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -27,6 +31,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -34,6 +39,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -41,6 +47,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -48,6 +55,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -55,6 +63,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -62,6 +71,7 @@ iptables \ + --destination-port 69 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -69,28 +79,33 @@ iptables \ + --destination-port 69 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.122.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.122.0/24 \ +@@ -99,12 +114,14 @@ iptables \ + --ctstate ESTABLISHED,RELATED \ + --jump ACCEPT + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 '!' \ + --destination 192.168.122.0/24 \ + --jump MASQUERADE + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -113,6 +130,7 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ +@@ -121,18 +139,21 @@ iptables \ + --jump MASQUERADE \ + --to-ports 1024-65535 + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 255.255.255.255/32 \ + --jump RETURN + iptables \ ++-w \ + --table nat \ + --insert LIBVIRT_PRT \ + --source 192.168.122.0/24 \ + --destination 224.0.0.0/24 \ + --jump RETURN + iptables \ ++-w \ + --table mangle \ + --insert LIBVIRT_PRT \ + --out-interface virbr0 \ +diff --git a/tests/networkxml2firewalldata/route-default-linux.args b/tests/networkxml2firewalldata/route-default-linux.args +index c427d9602d..a7b969c077 100644 +--- a/tests/networkxml2firewalldata/route-default-linux.args ++++ b/tests/networkxml2firewalldata/route-default-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -6,6 +7,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -13,6 +15,7 @@ iptables \ + --destination-port 67 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -20,6 +23,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -27,6 +31,7 @@ iptables \ + --destination-port 68 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -34,6 +39,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_INP \ + --in-interface virbr0 \ +@@ -41,6 +47,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -48,6 +55,7 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_OUT \ + --out-interface virbr0 \ +@@ -55,34 +63,40 @@ iptables \ + --destination-port 53 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --in-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --out-interface virbr0 \ + --jump REJECT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWX \ + --in-interface virbr0 \ + --out-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWO \ + --source 192.168.122.0/24 \ + --in-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table filter \ + --insert LIBVIRT_FWI \ + --destination 192.168.122.0/24 \ + --out-interface virbr0 \ + --jump ACCEPT + iptables \ ++-w \ + --table mangle \ + --insert LIBVIRT_PRT \ + --out-interface virbr0 \ +diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c +index 3e6c335d4e..e70f0e2400 100644 +--- a/tests/nwfilterebiptablestest.c ++++ b/tests/nwfilterebiptablestest.c +@@ -36,34 +36,34 @@ + + + #define VIR_NWFILTER_NEW_RULES_TEARDOWN \ +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ +- "iptables -F FP-vnet0\n" \ +- "iptables -X FP-vnet0\n" \ +- "iptables -F FJ-vnet0\n" \ +- "iptables -X FJ-vnet0\n" \ +- "iptables -F HJ-vnet0\n" \ +- "iptables -X HJ-vnet0\n" \ +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ +- "ip6tables -F FP-vnet0\n" \ +- "ip6tables -X FP-vnet0\n" \ +- "ip6tables -F FJ-vnet0\n" \ +- "ip6tables -X FJ-vnet0\n" \ +- "ip6tables -F HJ-vnet0\n" \ +- "ip6tables -X HJ-vnet0\n" \ +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \ +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \ +- "ebtables -t nat -L libvirt-J-vnet0\n" \ +- "ebtables -t nat -L libvirt-P-vnet0\n" \ +- "ebtables -t nat -F libvirt-J-vnet0\n" \ +- "ebtables -t nat -X libvirt-J-vnet0\n" \ +- "ebtables -t nat -F libvirt-P-vnet0\n" \ +- "ebtables -t nat -X libvirt-P-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ ++ "iptables -w -F FP-vnet0\n" \ ++ "iptables -w -X FP-vnet0\n" \ ++ "iptables -w -F FJ-vnet0\n" \ ++ "iptables -w -X FJ-vnet0\n" \ ++ "iptables -w -F HJ-vnet0\n" \ ++ "iptables -w -X HJ-vnet0\n" \ ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ ++ "ip6tables -w -F FP-vnet0\n" \ ++ "ip6tables -w -X FP-vnet0\n" \ ++ "ip6tables -w -F FJ-vnet0\n" \ ++ "ip6tables -w -X FJ-vnet0\n" \ ++ "ip6tables -w -F HJ-vnet0\n" \ ++ "ip6tables -w -X HJ-vnet0\n" \ ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \ ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \ ++ "ebtables --concurrent -t nat -L libvirt-J-vnet0\n" \ ++ "ebtables --concurrent -t nat -L libvirt-P-vnet0\n" \ ++ "ebtables --concurrent -t nat -F libvirt-J-vnet0\n" \ ++ "ebtables --concurrent -t nat -X libvirt-J-vnet0\n" \ ++ "ebtables --concurrent -t nat -F libvirt-P-vnet0\n" \ ++ "ebtables --concurrent -t nat -X libvirt-P-vnet0\n" + + static int + testNWFilterEBIPTablesAllTeardown(const void *opaque G_GNUC_UNUSED) +@@ -71,36 +71,36 @@ testNWFilterEBIPTablesAllTeardown(const void *opaque G_GNUC_UNUSED) + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "iptables -F FO-vnet0\n" +- "iptables -X FO-vnet0\n" +- "iptables -F FI-vnet0\n" +- "iptables -X FI-vnet0\n" +- "iptables -F HI-vnet0\n" +- "iptables -X HI-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "ip6tables -F FO-vnet0\n" +- "ip6tables -X FO-vnet0\n" +- "ip6tables -F FI-vnet0\n" +- "ip6tables -X FI-vnet0\n" +- "ip6tables -F HI-vnet0\n" +- "ip6tables -X HI-vnet0\n" +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-I-vnet0\n" +- "ebtables -t nat -L libvirt-O-vnet0\n" +- "ebtables -t nat -F libvirt-I-vnet0\n" +- "ebtables -t nat -X libvirt-I-vnet0\n" +- "ebtables -t nat -F libvirt-O-vnet0\n" +- "ebtables -t nat -X libvirt-O-vnet0\n"; ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "iptables -w -F FO-vnet0\n" ++ "iptables -w -X FO-vnet0\n" ++ "iptables -w -F FI-vnet0\n" ++ "iptables -w -X FI-vnet0\n" ++ "iptables -w -F HI-vnet0\n" ++ "iptables -w -X HI-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "ip6tables -w -F FO-vnet0\n" ++ "ip6tables -w -X FO-vnet0\n" ++ "ip6tables -w -F FI-vnet0\n" ++ "ip6tables -w -X FI-vnet0\n" ++ "ip6tables -w -F HI-vnet0\n" ++ "ip6tables -w -X HI-vnet0\n" ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-O-vnet0\n"; + char *actual = NULL; + int ret = -1; + +@@ -131,44 +131,44 @@ testNWFilterEBIPTablesTearOldRules(const void *opaque G_GNUC_UNUSED) + { + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "iptables -F FO-vnet0\n" +- "iptables -X FO-vnet0\n" +- "iptables -F FI-vnet0\n" +- "iptables -X FI-vnet0\n" +- "iptables -F HI-vnet0\n" +- "iptables -X HI-vnet0\n" +- "iptables -E FP-vnet0 FO-vnet0\n" +- "iptables -E FJ-vnet0 FI-vnet0\n" +- "iptables -E HJ-vnet0 HI-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "ip6tables -F FO-vnet0\n" +- "ip6tables -X FO-vnet0\n" +- "ip6tables -F FI-vnet0\n" +- "ip6tables -X FI-vnet0\n" +- "ip6tables -F HI-vnet0\n" +- "ip6tables -X HI-vnet0\n" +- "ip6tables -E FP-vnet0 FO-vnet0\n" +- "ip6tables -E FJ-vnet0 FI-vnet0\n" +- "ip6tables -E HJ-vnet0 HI-vnet0\n" +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-I-vnet0\n" +- "ebtables -t nat -L libvirt-O-vnet0\n" +- "ebtables -t nat -F libvirt-I-vnet0\n" +- "ebtables -t nat -X libvirt-I-vnet0\n" +- "ebtables -t nat -F libvirt-O-vnet0\n" +- "ebtables -t nat -X libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-J-vnet0\n" +- "ebtables -t nat -L libvirt-P-vnet0\n" +- "ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" +- "ebtables -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "iptables -w -F FO-vnet0\n" ++ "iptables -w -X FO-vnet0\n" ++ "iptables -w -F FI-vnet0\n" ++ "iptables -w -X FI-vnet0\n" ++ "iptables -w -F HI-vnet0\n" ++ "iptables -w -X HI-vnet0\n" ++ "iptables -w -E FP-vnet0 FO-vnet0\n" ++ "iptables -w -E FJ-vnet0 FI-vnet0\n" ++ "iptables -w -E HJ-vnet0 HI-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "ip6tables -w -F FO-vnet0\n" ++ "ip6tables -w -X FO-vnet0\n" ++ "ip6tables -w -F FI-vnet0\n" ++ "ip6tables -w -X FI-vnet0\n" ++ "ip6tables -w -F HI-vnet0\n" ++ "ip6tables -w -X HI-vnet0\n" ++ "ip6tables -w -E FP-vnet0 FO-vnet0\n" ++ "ip6tables -w -E FJ-vnet0 FI-vnet0\n" ++ "ip6tables -w -E HJ-vnet0 HI-vnet0\n" ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; + char *actual = NULL; + int ret = -1; + +@@ -199,22 +199,22 @@ testNWFilterEBIPTablesRemoveBasicRules(const void *opaque G_GNUC_UNUSED) + { + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-I-vnet0\n" +- "ebtables -t nat -L libvirt-O-vnet0\n" +- "ebtables -t nat -F libvirt-I-vnet0\n" +- "ebtables -t nat -X libvirt-I-vnet0\n" +- "ebtables -t nat -F libvirt-O-vnet0\n" +- "ebtables -t nat -X libvirt-O-vnet0\n" +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" +- "ebtables -t nat -L libvirt-J-vnet0\n" +- "ebtables -t nat -L libvirt-P-vnet0\n" +- "ebtables -t nat -F libvirt-J-vnet0\n" +- "ebtables -t nat -X libvirt-J-vnet0\n" +- "ebtables -t nat -F libvirt-P-vnet0\n" +- "ebtables -t nat -X libvirt-P-vnet0\n"; ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-P-vnet0\n"; + char *actual = NULL; + int ret = -1; + +@@ -277,43 +277,43 @@ testNWFilterEBIPTablesApplyBasicRules(const void *opaque G_GNUC_UNUSED) + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "iptables -F FO-vnet0\n" +- "iptables -X FO-vnet0\n" +- "iptables -F FI-vnet0\n" +- "iptables -X FI-vnet0\n" +- "iptables -F HI-vnet0\n" +- "iptables -X HI-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "ip6tables -F FO-vnet0\n" +- "ip6tables -X FO-vnet0\n" +- "ip6tables -F FI-vnet0\n" +- "ip6tables -X FI-vnet0\n" +- "ip6tables -F HI-vnet0\n" +- "ip6tables -X HI-vnet0\n" +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-I-vnet0\n" +- "ebtables -t nat -L libvirt-O-vnet0\n" +- "ebtables -t nat -F libvirt-I-vnet0\n" +- "ebtables -t nat -X libvirt-I-vnet0\n" +- "ebtables -t nat -F libvirt-O-vnet0\n" +- "ebtables -t nat -X libvirt-O-vnet0\n" +- "ebtables -t nat -N libvirt-J-vnet0\n" +- "ebtables -t nat -A libvirt-J-vnet0 -s '!' 10:20:30:40:50:60 -j DROP\n" +- "ebtables -t nat -A libvirt-J-vnet0 -p IPv4 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-J-vnet0 -p ARP -j ACCEPT\n" +- "ebtables -t nat -A libvirt-J-vnet0 -j DROP\n" +- "ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" +- "ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n"; ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "iptables -w -F FO-vnet0\n" ++ "iptables -w -X FO-vnet0\n" ++ "iptables -w -F FI-vnet0\n" ++ "iptables -w -X FI-vnet0\n" ++ "iptables -w -F HI-vnet0\n" ++ "iptables -w -X HI-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "ip6tables -w -F FO-vnet0\n" ++ "ip6tables -w -X FO-vnet0\n" ++ "ip6tables -w -F FI-vnet0\n" ++ "ip6tables -w -X FI-vnet0\n" ++ "ip6tables -w -F HI-vnet0\n" ++ "ip6tables -w -X HI-vnet0\n" ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -N libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -s '!' 10:20:30:40:50:60 -j DROP\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -p IPv4 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -p ARP -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -j DROP\n" ++ "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n"; + char *actual = NULL; + int ret = -1; + virMacAddr mac = { .addr = { 0x10, 0x20, 0x30, 0x40, 0x50, 0x60 } }; +@@ -346,51 +346,51 @@ testNWFilterEBIPTablesApplyDHCPOnlyRules(const void *opaque G_GNUC_UNUSED) + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "iptables -F FO-vnet0\n" +- "iptables -X FO-vnet0\n" +- "iptables -F FI-vnet0\n" +- "iptables -X FI-vnet0\n" +- "iptables -F HI-vnet0\n" +- "iptables -X HI-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "ip6tables -F FO-vnet0\n" +- "ip6tables -X FO-vnet0\n" +- "ip6tables -F FI-vnet0\n" +- "ip6tables -X FI-vnet0\n" +- "ip6tables -F HI-vnet0\n" +- "ip6tables -X HI-vnet0\n" +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-I-vnet0\n" +- "ebtables -t nat -L libvirt-O-vnet0\n" +- "ebtables -t nat -F libvirt-I-vnet0\n" +- "ebtables -t nat -X libvirt-I-vnet0\n" +- "ebtables -t nat -F libvirt-O-vnet0\n" +- "ebtables -t nat -X libvirt-O-vnet0\n" +- "ebtables -t nat -N libvirt-J-vnet0\n" +- "ebtables -t nat -N libvirt-P-vnet0\n" +- "ebtables -t nat -A libvirt-J-vnet0 -s 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-sport 68 --ip-dport 67 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-J-vnet0 -j DROP\n" +- "ebtables -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" +- "ebtables -t nat -A libvirt-P-vnet0 -j DROP\n" +- "ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" +- "ebtables -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" +- "ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" +- "ebtables -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "iptables -w -F FO-vnet0\n" ++ "iptables -w -X FO-vnet0\n" ++ "iptables -w -F FI-vnet0\n" ++ "iptables -w -X FI-vnet0\n" ++ "iptables -w -F HI-vnet0\n" ++ "iptables -w -X HI-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "ip6tables -w -F FO-vnet0\n" ++ "ip6tables -w -X FO-vnet0\n" ++ "ip6tables -w -F FI-vnet0\n" ++ "ip6tables -w -X FI-vnet0\n" ++ "ip6tables -w -F HI-vnet0\n" ++ "ip6tables -w -X HI-vnet0\n" ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -N libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -N libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -s 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-sport 68 --ip-dport 67 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -j DROP\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 192.168.122.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.1 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d 10:20:30:40:50:60 -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -d ff:ff:ff:ff:ff:ff -p ipv4 --ip-protocol udp --ip-src 10.0.0.2 --ip-sport 67 --ip-dport 68 -j ACCEPT\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -j DROP\n" ++ "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; + char *actual = NULL; + int ret = -1; + virMacAddr mac = { .addr = { 0x10, 0x20, 0x30, 0x40, 0x50, 0x60 } }; +@@ -434,44 +434,44 @@ testNWFilterEBIPTablesApplyDropAllRules(const void *opaque G_GNUC_UNUSED) + virBuffer buf = VIR_BUFFER_INITIALIZER; + const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "iptables -F FO-vnet0\n" +- "iptables -X FO-vnet0\n" +- "iptables -F FI-vnet0\n" +- "iptables -X FI-vnet0\n" +- "iptables -F HI-vnet0\n" +- "iptables -X HI-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" +- "ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "ip6tables -F FO-vnet0\n" +- "ip6tables -X FO-vnet0\n" +- "ip6tables -F FI-vnet0\n" +- "ip6tables -X FI-vnet0\n" +- "ip6tables -F HI-vnet0\n" +- "ip6tables -X HI-vnet0\n" +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" +- "ebtables -t nat -L libvirt-I-vnet0\n" +- "ebtables -t nat -L libvirt-O-vnet0\n" +- "ebtables -t nat -F libvirt-I-vnet0\n" +- "ebtables -t nat -X libvirt-I-vnet0\n" +- "ebtables -t nat -F libvirt-O-vnet0\n" +- "ebtables -t nat -X libvirt-O-vnet0\n" +- "ebtables -t nat -N libvirt-J-vnet0\n" +- "ebtables -t nat -N libvirt-P-vnet0\n" +- "ebtables -t nat -A libvirt-J-vnet0 -j DROP\n" +- "ebtables -t nat -A libvirt-P-vnet0 -j DROP\n" +- "ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" +- "ebtables -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" +- "ebtables -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" +- "ebtables -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "iptables -w -F FO-vnet0\n" ++ "iptables -w -X FO-vnet0\n" ++ "iptables -w -F FI-vnet0\n" ++ "iptables -w -X FI-vnet0\n" ++ "iptables -w -F HI-vnet0\n" ++ "iptables -w -X HI-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HI-vnet0\n" ++ "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "ip6tables -w -F FO-vnet0\n" ++ "ip6tables -w -X FO-vnet0\n" ++ "ip6tables -w -F FI-vnet0\n" ++ "ip6tables -w -X FI-vnet0\n" ++ "ip6tables -w -F HI-vnet0\n" ++ "ip6tables -w -X HI-vnet0\n" ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-O-vnet0\n" ++ "ebtables --concurrent -t nat -N libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -N libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -A libvirt-J-vnet0 -j DROP\n" ++ "ebtables --concurrent -t nat -A libvirt-P-vnet0 -j DROP\n" ++ "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-J-vnet0 libvirt-I-vnet0\n" ++ "ebtables --concurrent -t nat -E libvirt-P-vnet0 libvirt-O-vnet0\n"; + char *actual = NULL; + int ret = -1; + +diff --git a/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args b/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args +index 35c9de38b8..77f0532fd2 100644 +--- a/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/ah-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + -m mac \ +@@ -11,6 +12,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + --destination f:e:d::c:b:a/127 \ +@@ -21,6 +23,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + -m mac \ +@@ -33,6 +36,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + --destination a:b:c::/128 \ +@@ -42,6 +46,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + -m mac \ +@@ -53,6 +58,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + --destination a:b:c::/128 \ +@@ -62,6 +68,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + --destination ::10.1.2.3/128 \ +@@ -71,6 +78,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + -m mac \ +@@ -82,6 +90,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/ah-linux.args b/tests/nwfilterxml2firewalldata/ah-linux.args +index 269636754e..c7e5c1eb17 100644 +--- a/tests/nwfilterxml2firewalldata/ah-linux.args ++++ b/tests/nwfilterxml2firewalldata/ah-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + --destination 10.1.2.3/22 \ +@@ -39,6 +43,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + -m mac \ +@@ -50,6 +55,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + --destination 10.1.2.3/22 \ +@@ -59,6 +65,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + --destination 10.1.2.3/22 \ +@@ -68,6 +75,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + -m mac \ +@@ -79,6 +87,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + --destination 10.1.2.3/22 \ +diff --git a/tests/nwfilterxml2firewalldata/all-ipv6-linux.args b/tests/nwfilterxml2firewalldata/all-ipv6-linux.args +index 2f84c1bfea..d86908663c 100644 +--- a/tests/nwfilterxml2firewalldata/all-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/all-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m mac \ +@@ -11,6 +12,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p all \ + --destination f:e:d::c:b:a/127 \ +@@ -21,6 +23,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m mac \ +@@ -33,6 +36,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination a:b:c::/128 \ +@@ -42,6 +46,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -53,6 +58,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination a:b:c::/128 \ +@@ -62,6 +68,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination ::10.1.2.3/128 \ +@@ -71,6 +78,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -82,6 +90,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/all-linux.args b/tests/nwfilterxml2firewalldata/all-linux.args +index 7ea769f74f..187d9ed9ca 100644 +--- a/tests/nwfilterxml2firewalldata/all-linux.args ++++ b/tests/nwfilterxml2firewalldata/all-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -39,6 +43,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -50,6 +55,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -59,6 +65,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -68,6 +75,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -79,6 +87,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +diff --git a/tests/nwfilterxml2firewalldata/arp-linux.args b/tests/nwfilterxml2firewalldata/arp-linux.args +index b1360175c4..ef9f44d7bb 100644 +--- a/tests/nwfilterxml2firewalldata/arp-linux.args ++++ b/tests/nwfilterxml2firewalldata/arp-linux.args +@@ -1,4 +1,5 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -11,6 +12,7 @@ ebtables \ + --arp-mac-dst 0a:0b:0c:0d:0e:0f \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -20,6 +22,7 @@ ebtables \ + --arp-ptype 0xff \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -29,6 +32,7 @@ ebtables \ + --arp-ptype 0x100 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -38,6 +42,7 @@ ebtables \ + --arp-ptype 0xffff \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p 0x806 \ +diff --git a/tests/nwfilterxml2firewalldata/comment-linux.args b/tests/nwfilterxml2firewalldata/comment-linux.args +index 462b2e2177..6233ccf9f5 100644 +--- a/tests/nwfilterxml2firewalldata/comment-linux.args ++++ b/tests/nwfilterxml2firewalldata/comment-linux.args +@@ -1,9 +1,11 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p 0x1234 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -17,6 +19,7 @@ ebtables \ + --ip-tos 0x32 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \ +@@ -29,6 +32,7 @@ ebtables \ + --ip6-destination-port 13107:65535 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -41,6 +45,7 @@ ebtables \ + --arp-mac-dst 0a:0b:0c:0d:0e:0f \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + -m mac \ +@@ -56,6 +61,7 @@ iptables \ + --comment 'udp rule' \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --source 10.1.2.3/32 \ +@@ -69,6 +75,7 @@ iptables \ + --comment 'udp rule' \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + -m mac \ +@@ -84,6 +91,7 @@ iptables \ + --comment 'udp rule' \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --destination a:b:c::/128 \ +@@ -97,6 +105,7 @@ ip6tables \ + --comment 'tcp/ipv6 rule' \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -m mac \ +@@ -112,6 +121,7 @@ ip6tables \ + --comment 'tcp/ipv6 rule' \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --destination a:b:c::/128 \ +@@ -125,6 +135,7 @@ ip6tables \ + --comment 'tcp/ipv6 rule' \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + -m state \ +@@ -133,6 +144,7 @@ ip6tables \ + --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + -m state \ +@@ -141,6 +153,7 @@ ip6tables \ + --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + -m state \ +@@ -149,6 +162,7 @@ ip6tables \ + --comment '`ls`;${COLUMNS};$(ls);"test";&'\''3 spaces'\''' \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + -m state \ +@@ -157,6 +171,7 @@ ip6tables \ + --comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + -m state \ +@@ -165,6 +180,7 @@ ip6tables \ + --comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + -m state \ +@@ -173,6 +189,7 @@ ip6tables \ + --comment 'comment with lone '\'', `, ", `, \, $x, and two spaces' \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p ah \ + -m state \ +@@ -182,6 +199,7 @@ ip6tables \ + -f ${tmp}' \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p ah \ + -m state \ +@@ -191,6 +209,7 @@ ip6tables \ + -f ${tmp}' \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p ah \ + -m state \ +diff --git a/tests/nwfilterxml2firewalldata/conntrack-linux.args b/tests/nwfilterxml2firewalldata/conntrack-linux.args +index c653049e8e..78495598a1 100644 +--- a/tests/nwfilterxml2firewalldata/conntrack-linux.args ++++ b/tests/nwfilterxml2firewalldata/conntrack-linux.args +@@ -1,40 +1,47 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + -m connlimit \ + --connlimit-above 1 \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + -m connlimit \ + --connlimit-above 1 \ + -j DROP + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + -m connlimit \ + --connlimit-above 2 \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + -m connlimit \ + --connlimit-above 2 \ + -j DROP + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ +diff --git a/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args +index 51cf74815b..22dad0b412 100644 +--- a/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/esp-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p esp \ + -m mac \ +@@ -11,6 +12,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p esp \ + --destination f:e:d::c:b:a/127 \ +@@ -21,6 +23,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p esp \ + -m mac \ +@@ -33,6 +36,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p esp \ + --destination a:b:c::/128 \ +@@ -42,6 +46,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p esp \ + -m mac \ +@@ -53,6 +58,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p esp \ + --destination a:b:c::/128 \ +@@ -62,6 +68,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p esp \ + --destination ::10.1.2.3/128 \ +@@ -71,6 +78,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p esp \ + -m mac \ +@@ -82,6 +90,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p esp \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/esp-linux.args b/tests/nwfilterxml2firewalldata/esp-linux.args +index 17acb8133c..7cd70afaa1 100644 +--- a/tests/nwfilterxml2firewalldata/esp-linux.args ++++ b/tests/nwfilterxml2firewalldata/esp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p esp \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p esp \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p esp \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p esp \ + --destination 10.1.2.3/22 \ +@@ -39,6 +43,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p esp \ + -m mac \ +@@ -50,6 +55,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p esp \ + --destination 10.1.2.3/22 \ +@@ -59,6 +65,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p esp \ + --destination 10.1.2.3/22 \ +@@ -68,6 +75,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p esp \ + -m mac \ +@@ -79,6 +87,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p esp \ + --destination 10.1.2.3/22 \ +diff --git a/tests/nwfilterxml2firewalldata/example-1-linux.args b/tests/nwfilterxml2firewalldata/example-1-linux.args +index c5549f8dd6..1cc3746d40 100644 +--- a/tests/nwfilterxml2firewalldata/example-1-linux.args ++++ b/tests/nwfilterxml2firewalldata/example-1-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --sport 22 \ +@@ -6,6 +7,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --dport 22 \ +@@ -13,6 +15,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --sport 22 \ +@@ -20,50 +23,59 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + -m state \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + -m state \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + -m state \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -j DROP +diff --git a/tests/nwfilterxml2firewalldata/example-2-linux.args b/tests/nwfilterxml2firewalldata/example-2-linux.args +index 2db58f1e0f..87462ad954 100644 +--- a/tests/nwfilterxml2firewalldata/example-2-linux.args ++++ b/tests/nwfilterxml2firewalldata/example-2-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ +@@ -7,6 +8,7 @@ iptables \ + --comment 'out: existing and related (ftp) connections' \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ +@@ -15,6 +17,7 @@ iptables \ + --comment 'out: existing and related (ftp) connections' \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ +@@ -23,6 +26,7 @@ iptables \ + --comment 'in: existing connections' \ + -j ACCEPT + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --dport 21:22 \ +@@ -32,6 +36,7 @@ iptables \ + --comment 'in: ftp and ssh' \ + -j ACCEPT + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + -m state \ +@@ -40,6 +45,7 @@ iptables \ + --comment 'in: icmp' \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --dport 53 \ +@@ -49,6 +55,7 @@ iptables \ + --comment 'out: DNS lookups' \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --dport 53 \ +@@ -58,18 +65,21 @@ iptables \ + --comment 'out: DNS lookups' \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m comment \ + --comment 'inout: drop all non-accepted traffic' \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m comment \ + --comment 'inout: drop all non-accepted traffic' \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m comment \ +diff --git a/tests/nwfilterxml2firewalldata/hex-data-linux.args b/tests/nwfilterxml2firewalldata/hex-data-linux.args +index f1a1f588f2..3c04e1c23d 100644 +--- a/tests/nwfilterxml2firewalldata/hex-data-linux.args ++++ b/tests/nwfilterxml2firewalldata/hex-data-linux.args +@@ -1,9 +1,11 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p 0x1234 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -17,6 +19,7 @@ ebtables \ + --ip-tos 0x32 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \ +@@ -29,6 +32,7 @@ ebtables \ + --ip6-destination-port 13107:65535 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -41,6 +45,7 @@ ebtables \ + --arp-mac-dst 0a:0b:0c:0d:0e:0f \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + -m mac \ +@@ -54,6 +59,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --source 10.1.2.3/32 \ +@@ -65,6 +71,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + -m mac \ +@@ -78,6 +85,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --destination a:b:c::/128 \ +@@ -89,6 +97,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -m mac \ +@@ -102,6 +111,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --destination a:b:c::/128 \ +diff --git a/tests/nwfilterxml2firewalldata/icmp-direction-linux.args b/tests/nwfilterxml2firewalldata/icmp-direction-linux.args +index 9f481fa831..7548aaeba5 100644 +--- a/tests/nwfilterxml2firewalldata/icmp-direction-linux.args ++++ b/tests/nwfilterxml2firewalldata/icmp-direction-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + --icmp-type 0 \ +@@ -6,6 +7,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + --icmp-type 8 \ +@@ -13,6 +15,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + --icmp-type 8 \ +@@ -20,14 +23,17 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + -j DROP +diff --git a/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args b/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args +index 1faa3d880a..026702caee 100644 +--- a/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args ++++ b/tests/nwfilterxml2firewalldata/icmp-direction2-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + --icmp-type 8 \ +@@ -6,6 +7,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + --icmp-type 0 \ +@@ -13,6 +15,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + --icmp-type 0 \ +@@ -20,14 +23,17 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + -j DROP +diff --git a/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args b/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args +index 6cc8e132d9..6ee6a4f84a 100644 +--- a/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args ++++ b/tests/nwfilterxml2firewalldata/icmp-direction3-linux.args +@@ -1,30 +1,36 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + -m state \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + -m state \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + -m state \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -j DROP +diff --git a/tests/nwfilterxml2firewalldata/icmp-linux.args b/tests/nwfilterxml2firewalldata/icmp-linux.args +index d808f0ea60..d688e29213 100644 +--- a/tests/nwfilterxml2firewalldata/icmp-linux.args ++++ b/tests/nwfilterxml2firewalldata/icmp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p icmp \ + -m mac \ +@@ -11,6 +12,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p icmp \ + -m mac \ +@@ -23,6 +25,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p icmp \ + -m mac \ +diff --git a/tests/nwfilterxml2firewalldata/icmpv6-linux.args b/tests/nwfilterxml2firewalldata/icmpv6-linux.args +index 92190eb311..6e2110fb81 100644 +--- a/tests/nwfilterxml2firewalldata/icmpv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/icmpv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p icmpv6 \ + -m mac \ +@@ -12,6 +13,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p icmpv6 \ + -m mac \ +@@ -25,6 +27,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p icmpv6 \ + -m mac \ +@@ -37,6 +40,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p icmpv6 \ + -m mac \ +diff --git a/tests/nwfilterxml2firewalldata/igmp-linux.args b/tests/nwfilterxml2firewalldata/igmp-linux.args +index 727463a62d..b954b0ae99 100644 +--- a/tests/nwfilterxml2firewalldata/igmp-linux.args ++++ b/tests/nwfilterxml2firewalldata/igmp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p igmp \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p igmp \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p igmp \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p igmp \ + --destination 10.1.2.3/22 \ +@@ -39,6 +43,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p igmp \ + -m mac \ +@@ -50,6 +55,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p igmp \ + --destination 10.1.2.3/22 \ +@@ -59,6 +65,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p igmp \ + --destination 10.1.2.3/22 \ +@@ -68,6 +75,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p igmp \ + -m mac \ +@@ -79,6 +87,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p igmp \ + --destination 10.1.2.3/22 \ +diff --git a/tests/nwfilterxml2firewalldata/ip-linux.args b/tests/nwfilterxml2firewalldata/ip-linux.args +index 399a47491e..8e64839678 100644 +--- a/tests/nwfilterxml2firewalldata/ip-linux.args ++++ b/tests/nwfilterxml2firewalldata/ip-linux.args +@@ -1,4 +1,5 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -11,6 +12,7 @@ ebtables \ + --ip-destination-port 100:101 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv4 \ +@@ -20,6 +22,7 @@ ebtables \ + --ip-tos 0x3f \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv4 \ +diff --git a/tests/nwfilterxml2firewalldata/ipset-linux.args b/tests/nwfilterxml2firewalldata/ipset-linux.args +index 0fe0739962..5cdb151354 100644 +--- a/tests/nwfilterxml2firewalldata/ipset-linux.args ++++ b/tests/nwfilterxml2firewalldata/ipset-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ +@@ -7,6 +8,7 @@ iptables \ + --match-set tck_test src,dst \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ +@@ -15,6 +17,7 @@ iptables \ + --match-set tck_test dst,src \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ +@@ -23,6 +26,7 @@ iptables \ + --match-set tck_test src,dst \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m set \ +@@ -31,6 +35,7 @@ iptables \ + --comment in+NONE \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m set \ +@@ -39,6 +44,7 @@ iptables \ + --comment out+NONE \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m set \ +@@ -47,6 +53,7 @@ iptables \ + --comment out+NONE \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ +@@ -55,6 +62,7 @@ iptables \ + --match-set tck_test dst,src,dst \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ +@@ -63,6 +71,7 @@ iptables \ + --match-set tck_test src,dst,src \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ +@@ -71,6 +80,7 @@ iptables \ + --match-set tck_test dst,src,dst \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ +@@ -79,6 +89,7 @@ iptables \ + --match-set tck_test dst,src,dst \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ +@@ -87,6 +98,7 @@ iptables \ + --match-set tck_test src,dst,src \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ +@@ -95,6 +107,7 @@ iptables \ + --match-set tck_test dst,src,dst \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m state \ +@@ -103,6 +116,7 @@ iptables \ + --match-set tck_test dst,src \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m state \ +@@ -111,6 +125,7 @@ iptables \ + --match-set tck_test src,dst \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m state \ +@@ -119,6 +134,7 @@ iptables \ + --match-set tck_test dst,src \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m set \ +@@ -127,6 +143,7 @@ iptables \ + --comment inout \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m set \ +@@ -135,6 +152,7 @@ iptables \ + --comment inout \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m set \ +diff --git a/tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.args b/tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.args +index 86ab228fb8..c35fa1e488 100644 +--- a/tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.args ++++ b/tests/nwfilterxml2firewalldata/ipt-no-macspoof-linux.args +@@ -1,10 +1,12 @@ + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac '!' \ + --mac-source 12:34:56:78:9a:bc \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac '!' \ +diff --git a/tests/nwfilterxml2firewalldata/ipv6-linux.args b/tests/nwfilterxml2firewalldata/ipv6-linux.args +index 6fba19f2eb..87db9c2979 100644 +--- a/tests/nwfilterxml2firewalldata/ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/ipv6-linux.args +@@ -1,4 +1,5 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:fe \ +@@ -11,6 +12,7 @@ ebtables \ + --ip6-destination-port 100:101 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -21,6 +23,7 @@ ebtables \ + --ip6-source-port 100:101 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +@@ -31,6 +34,7 @@ ebtables \ + --ip6-destination-port 100:101 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -41,6 +45,7 @@ ebtables \ + --ip6-source-port 65535:65535 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +@@ -51,6 +56,7 @@ ebtables \ + --ip6-destination-port 65535:65535 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -59,6 +65,7 @@ ebtables \ + --ip6-protocol 18 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +@@ -67,6 +74,7 @@ ebtables \ + --ip6-protocol 18 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -76,6 +84,7 @@ ebtables \ + --ip6-icmp-type 1:11/10:11 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +@@ -85,6 +94,7 @@ ebtables \ + --ip6-icmp-type 1:11/10:11 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -94,6 +104,7 @@ ebtables \ + --ip6-icmp-type 1:1/10:10 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +@@ -103,6 +114,7 @@ ebtables \ + --ip6-icmp-type 1:1/10:10 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -112,6 +124,7 @@ ebtables \ + --ip6-icmp-type 0:255/10:10 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +@@ -121,6 +134,7 @@ ebtables \ + --ip6-icmp-type 0:255/10:10 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -p ipv6 \ +@@ -130,6 +144,7 @@ ebtables \ + --ip6-icmp-type 1:1/0:255 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -p ipv6 \ +diff --git a/tests/nwfilterxml2firewalldata/iter1-linux.args b/tests/nwfilterxml2firewalldata/iter1-linux.args +index 31f37cf537..9bdad18748 100644 +--- a/tests/nwfilterxml2firewalldata/iter1-linux.args ++++ b/tests/nwfilterxml2firewalldata/iter1-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -9,6 +10,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -29,6 +32,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -39,6 +43,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -49,6 +54,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -59,6 +65,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -69,6 +76,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -79,6 +87,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +diff --git a/tests/nwfilterxml2firewalldata/iter2-linux.args b/tests/nwfilterxml2firewalldata/iter2-linux.args +index 4230a9d524..b088350ee5 100644 +--- a/tests/nwfilterxml2firewalldata/iter2-linux.args ++++ b/tests/nwfilterxml2firewalldata/iter2-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -9,6 +10,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -29,6 +32,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -39,6 +43,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -49,6 +54,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -59,6 +65,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -69,6 +76,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -79,6 +87,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -89,6 +98,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -99,6 +109,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 1.1.1.1 \ +@@ -109,6 +120,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -119,6 +131,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -129,6 +142,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -139,6 +153,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -149,6 +164,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -159,6 +175,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 3.3.3.3 \ +@@ -169,6 +186,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -179,6 +197,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -189,6 +208,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 1.1.1.1 \ +@@ -199,6 +219,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -209,6 +230,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -219,6 +241,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -229,6 +252,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -239,6 +263,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -249,6 +274,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 3.3.3.3 \ +@@ -259,6 +285,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -269,6 +296,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -280,6 +308,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 1.1.1.1 \ +@@ -291,6 +320,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -302,6 +332,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -313,6 +344,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 2.2.2.2 \ +@@ -324,6 +356,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -335,6 +368,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -346,6 +380,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 3.3.3.3 \ +@@ -357,6 +392,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -368,6 +404,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -379,6 +416,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 1.1.1.1 \ +@@ -390,6 +428,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -401,6 +440,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -412,6 +452,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 2.2.2.2 \ +@@ -423,6 +464,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -434,6 +476,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -445,6 +488,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 3.3.3.3 \ +@@ -456,6 +500,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -467,6 +512,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -478,6 +524,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 1.1.1.1 \ +@@ -489,6 +536,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -500,6 +548,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -511,6 +560,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 2.2.2.2 \ +@@ -522,6 +572,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -533,6 +584,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -544,6 +596,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 3.3.3.3 \ +@@ -555,6 +608,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -566,6 +620,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -577,6 +632,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 1.1.1.1 \ +@@ -588,6 +644,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -599,6 +656,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -610,6 +668,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 2.2.2.2 \ +@@ -621,6 +680,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -632,6 +692,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -643,6 +704,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 3.3.3.3 \ +@@ -654,6 +716,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -665,6 +728,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -676,6 +740,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -687,6 +752,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -698,6 +764,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -709,6 +776,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -720,6 +788,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -731,6 +800,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -742,6 +812,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -753,6 +824,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -764,6 +836,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -775,6 +848,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -786,6 +860,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -797,6 +872,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -808,6 +884,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -819,6 +896,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -830,6 +908,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -841,6 +920,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -852,6 +932,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -863,6 +944,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -874,6 +956,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -885,6 +968,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -896,6 +980,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -907,6 +992,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -918,6 +1004,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -929,6 +1016,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -940,6 +1028,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -951,6 +1040,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -962,6 +1052,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -973,6 +1064,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -984,6 +1076,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -995,6 +1088,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1006,6 +1100,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -1017,6 +1112,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1028,6 +1124,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1039,6 +1136,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -1050,6 +1148,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1061,6 +1160,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1072,6 +1172,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -1083,6 +1184,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1094,6 +1196,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1105,6 +1208,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -1116,6 +1220,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1127,6 +1232,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1138,6 +1244,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -1149,6 +1256,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1160,6 +1268,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1171,6 +1280,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -1182,6 +1292,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1193,6 +1304,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1204,6 +1316,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -1215,6 +1328,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1226,6 +1340,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1237,6 +1352,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -1248,6 +1364,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1259,6 +1376,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1270,6 +1388,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -1281,6 +1400,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1292,6 +1412,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1303,6 +1424,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -1314,6 +1436,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1325,6 +1448,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1336,6 +1460,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -1347,6 +1472,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1358,6 +1484,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1369,6 +1496,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -1380,6 +1508,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -1391,6 +1520,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1402,6 +1532,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 2.2.2.2 \ +@@ -1413,6 +1544,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 2.2.2.2 \ +@@ -1424,6 +1556,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1435,6 +1568,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 3.3.3.3 \ +@@ -1446,6 +1580,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 3.3.3.3 \ +@@ -1457,6 +1592,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -1467,6 +1603,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 1.1.1.1 \ +@@ -1477,6 +1614,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -1487,6 +1625,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -1497,6 +1636,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -1507,6 +1647,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -1517,6 +1658,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -1527,6 +1669,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 3.3.3.3 \ +@@ -1537,6 +1680,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -1547,6 +1691,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -1557,6 +1702,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 1.1.1.1 \ +@@ -1567,6 +1713,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -1577,6 +1724,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -1587,6 +1735,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -1597,6 +1746,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -1607,6 +1757,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -1617,6 +1768,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 3.3.3.3 \ +@@ -1627,6 +1779,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -1637,6 +1790,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -1647,6 +1801,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 1.1.1.1 \ +@@ -1657,6 +1812,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 1.1.1.1 \ +@@ -1667,6 +1823,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -1677,6 +1834,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -1687,6 +1845,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -1697,6 +1856,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -1707,6 +1867,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 3.3.3.3 \ +@@ -1717,6 +1878,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 3.3.3.3 \ +@@ -1727,6 +1889,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -1737,6 +1900,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 1.1.1.1 \ +@@ -1747,6 +1911,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 1.1.1.1 \ +@@ -1757,6 +1922,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -1767,6 +1933,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 2.2.2.2 \ +@@ -1777,6 +1944,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -1787,6 +1955,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +@@ -1797,6 +1966,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 3.3.3.3 \ +@@ -1807,6 +1977,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 3.3.3.3 \ +diff --git a/tests/nwfilterxml2firewalldata/iter3-linux.args b/tests/nwfilterxml2firewalldata/iter3-linux.args +index 0b16577992..cc6d442c75 100644 +--- a/tests/nwfilterxml2firewalldata/iter3-linux.args ++++ b/tests/nwfilterxml2firewalldata/iter3-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -9,6 +10,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -29,6 +32,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -39,6 +43,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --destination 1.1.1.1 \ +@@ -49,6 +54,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --source 1.1.1.1 \ +@@ -59,6 +65,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -69,6 +76,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -79,6 +87,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -89,6 +98,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -99,6 +109,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --destination 2.2.2.2 \ +@@ -109,6 +120,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --source 2.2.2.2 \ +@@ -119,6 +131,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +@@ -130,6 +143,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --destination 2.2.2.2 \ +@@ -141,6 +155,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --source 2.2.2.2 \ +diff --git a/tests/nwfilterxml2firewalldata/mac-linux.args b/tests/nwfilterxml2firewalldata/mac-linux.args +index 0fd9dbccc0..cc3aab2b92 100644 +--- a/tests/nwfilterxml2firewalldata/mac-linux.args ++++ b/tests/nwfilterxml2firewalldata/mac-linux.args +@@ -1,22 +1,26 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ + -p 0x806 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ + -p 0x800 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ + -p 0x600 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ +diff --git a/tests/nwfilterxml2firewalldata/rarp-linux.args b/tests/nwfilterxml2firewalldata/rarp-linux.args +index f5fd6433bd..3e2441818c 100644 +--- a/tests/nwfilterxml2firewalldata/rarp-linux.args ++++ b/tests/nwfilterxml2firewalldata/rarp-linux.args +@@ -1,7 +1,9 @@ + ebtables \ ++--concurrent \ + -t nat \ + -N libvirt-J-vnet0 + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -14,6 +16,7 @@ ebtables \ + --arp-mac-dst 0a:0b:0c:0d:0e:0f \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -23,6 +26,7 @@ ebtables \ + --arp-ptype 0xff \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -32,6 +36,7 @@ ebtables \ + --arp-ptype 0x100 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -41,6 +46,7 @@ ebtables \ + --arp-ptype 0xffff \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A PREROUTING \ + -i vnet0 \ +diff --git a/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args +index 959c4e8e0f..fbe6f39198 100644 +--- a/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/sctp-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + -m mac \ +@@ -10,6 +11,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --source a:b:c::d:e:f/128 \ +@@ -19,6 +21,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + -m mac \ +@@ -30,6 +33,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --destination a:b:c::/128 \ +@@ -41,6 +45,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + -m mac \ +@@ -54,6 +59,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --destination a:b:c::/128 \ +@@ -65,6 +71,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --destination ::10.1.2.3/128 \ +@@ -76,6 +83,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + -m mac \ +@@ -89,6 +97,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/sctp-linux.args b/tests/nwfilterxml2firewalldata/sctp-linux.args +index 671fc0480f..a3c5a7a72d 100644 +--- a/tests/nwfilterxml2firewalldata/sctp-linux.args ++++ b/tests/nwfilterxml2firewalldata/sctp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --destination 10.1.2.3/32 \ +@@ -41,6 +45,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + -m mac \ +@@ -54,6 +59,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --destination 10.1.2.3/32 \ +@@ -65,6 +71,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p sctp \ + --destination 10.1.2.3/32 \ +@@ -76,6 +83,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p sctp \ + -m mac \ +@@ -89,6 +97,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p sctp \ + --destination 10.1.2.3/32 \ +diff --git a/tests/nwfilterxml2firewalldata/stp-linux.args b/tests/nwfilterxml2firewalldata/stp-linux.args +index e3114ac622..76f5321856 100644 +--- a/tests/nwfilterxml2firewalldata/stp-linux.args ++++ b/tests/nwfilterxml2firewalldata/stp-linux.args +@@ -1,32 +1,41 @@ + ebtables \ ++--concurrent \ + -t nat \ + -F J-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -X J-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -N J-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -d 01:80:c2:00:00:00 \ + -j J-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -F P-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -X P-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -N P-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d 01:80:c2:00:00:00 \ + -j P-vnet0-stp-xyz + ebtables \ ++--concurrent \ + -t nat \ + -A P-vnet0-stp-xyz \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -35,6 +44,7 @@ ebtables \ + --stp-flags 68 \ + -j CONTINUE + ebtables \ ++--concurrent \ + -t nat \ + -A J-vnet0-stp-xyz \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -44,6 +54,7 @@ ebtables \ + --stp-root-cost 287454020:573785173 \ + -j RETURN + ebtables \ ++--concurrent \ + -t nat \ + -A P-vnet0-stp-xyz \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +diff --git a/tests/nwfilterxml2firewalldata/target-linux.args b/tests/nwfilterxml2firewalldata/target-linux.args +index d219877716..5216c709dd 100644 +--- a/tests/nwfilterxml2firewalldata/target-linux.args ++++ b/tests/nwfilterxml2firewalldata/target-linux.args +@@ -1,40 +1,47 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ + -p 0x806 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ + -p 0x806 \ + -j DROP + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ + -p 0x806 \ + -j DROP + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ + -p 0x800 \ + -j ACCEPT + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ + -p 0x800 \ + -j DROP + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -d aa:bb:cc:dd:ee:ff/ff:ff:ff:ff:ff:ff \ + -p 0x800 \ + -j DROP + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m mac \ +@@ -49,6 +56,7 @@ iptables \ + -- dir out' \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + --source 10.1.2.3/32 \ +@@ -61,6 +69,7 @@ iptables \ + -- dir out' \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m mac \ +@@ -75,6 +84,7 @@ iptables \ + -- dir out' \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m mac \ +@@ -87,6 +97,7 @@ iptables \ + -- dir out' \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + --source 10.1.2.3/32 \ +@@ -97,6 +108,7 @@ iptables \ + -- dir out' \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m mac \ +@@ -109,6 +121,7 @@ iptables \ + -- dir out' \ + -j DROP + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m mac \ +@@ -121,6 +134,7 @@ iptables \ + -- dir out' \ + -j REJECT + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + --source 10.1.2.3/32 \ +@@ -131,6 +145,7 @@ iptables \ + -- dir out' \ + -j REJECT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m mac \ +@@ -143,6 +158,7 @@ iptables \ + -- dir out' \ + -j REJECT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -155,6 +171,7 @@ iptables \ + -- dir in' \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -169,6 +186,7 @@ iptables \ + -- dir in' \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -181,6 +199,7 @@ iptables \ + -- dir in' \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -191,6 +210,7 @@ iptables \ + -- dir in' \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -203,6 +223,7 @@ iptables \ + -- dir in' \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -213,6 +234,7 @@ iptables \ + -- dir in' \ + -j DROP + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -223,6 +245,7 @@ iptables \ + -- dir in' \ + -j REJECT + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m mac \ +@@ -235,6 +258,7 @@ iptables \ + -- dir in' \ + -j REJECT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + --destination 10.1.2.3/22 \ +@@ -245,6 +269,7 @@ iptables \ + -- dir in' \ + -j REJECT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m comment \ +@@ -252,6 +277,7 @@ iptables \ + -- dir inout' \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m comment \ +@@ -259,6 +285,7 @@ iptables \ + -- dir inout' \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m comment \ +@@ -266,6 +293,7 @@ iptables \ + -- dir inout' \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m comment \ +@@ -273,6 +301,7 @@ iptables \ + -- dir inout' \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m comment \ +@@ -280,6 +309,7 @@ iptables \ + -- dir inout' \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m comment \ +@@ -287,6 +317,7 @@ iptables \ + -- dir inout' \ + -j DROP + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -m comment \ +@@ -294,6 +325,7 @@ iptables \ + -- dir inout' \ + -j REJECT + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -m comment \ +@@ -301,6 +333,7 @@ iptables \ + -- dir inout' \ + -j REJECT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -m comment \ +diff --git a/tests/nwfilterxml2firewalldata/target2-linux.args b/tests/nwfilterxml2firewalldata/target2-linux.args +index cfa4f589d6..c774f6f24a 100644 +--- a/tests/nwfilterxml2firewalldata/target2-linux.args ++++ b/tests/nwfilterxml2firewalldata/target2-linux.args +@@ -1,19 +1,23 @@ + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --dport 22 \ + -j ACCEPT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --sport 22 \ + -j RETURN + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --sport 22 \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --sport 80 \ +@@ -21,6 +25,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --dport 80 \ +@@ -28,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --sport 80 \ +@@ -35,26 +41,32 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + -j REJECT + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -j REJECT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + -j REJECT + iptables \ ++-w \ + -A FJ-vnet0 \ + -p all \ + -j DROP + iptables \ ++-w \ + -A FP-vnet0 \ + -p all \ + -j DROP + iptables \ ++-w \ + -A HJ-vnet0 \ + -p all \ + -j DROP +diff --git a/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args +index e6f8de3fca..8fa5e24eff 100644 +--- a/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/tcp-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + -m mac \ +@@ -10,6 +11,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --source a:b:c::d:e:f/128 \ +@@ -19,6 +21,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + -m mac \ +@@ -30,6 +33,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --destination a:b:c::/128 \ +@@ -41,6 +45,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -m mac \ +@@ -54,6 +59,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --destination a:b:c::/128 \ +@@ -65,6 +71,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --destination ::10.1.2.3/128 \ +@@ -76,6 +83,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -m mac \ +@@ -89,6 +97,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/tcp-linux.args b/tests/nwfilterxml2firewalldata/tcp-linux.args +index 195bfc01e6..74ac4a6733 100644 +--- a/tests/nwfilterxml2firewalldata/tcp-linux.args ++++ b/tests/nwfilterxml2firewalldata/tcp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --destination 10.1.2.3/32 \ +@@ -39,6 +43,7 @@ iptables \ + --sport 100:1111 \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -m mac \ +@@ -50,6 +55,7 @@ iptables \ + --dport 100:1111 \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --destination 10.1.2.3/32 \ +@@ -59,6 +65,7 @@ iptables \ + --sport 100:1111 \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p tcp \ + --destination 10.1.2.3/32 \ +@@ -68,6 +75,7 @@ iptables \ + --sport 65535:65535 \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + -m mac \ +@@ -79,6 +87,7 @@ iptables \ + --dport 65535:65535 \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p tcp \ + --destination 10.1.2.3/32 \ +@@ -88,21 +97,25 @@ iptables \ + --sport 65535:65535 \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --tcp-flags SYN ALL \ + -j ACCEPT + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --tcp-flags SYN SYN,ACK \ + -j ACCEPT + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --tcp-flags RST NONE \ + -j ACCEPT + iptables \ ++-w \ + -A FP-vnet0 \ + -p tcp \ + --tcp-flags PSH NONE \ +diff --git a/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args b/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args +index 9183c08753..59367ed3d3 100644 +--- a/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/udp-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + -m mac \ +@@ -10,6 +11,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --source a:b:c::d:e:f/128 \ +@@ -19,6 +21,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + -m mac \ +@@ -30,6 +33,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --destination ::a:b:c/128 \ +@@ -41,6 +45,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + -m mac \ +@@ -54,6 +59,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --destination ::a:b:c/128 \ +@@ -65,6 +71,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --destination ::10.1.2.3/128 \ +@@ -76,6 +83,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + -m mac \ +@@ -89,6 +97,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/udp-linux.args b/tests/nwfilterxml2firewalldata/udp-linux.args +index 910d648a8a..32a8f56dfc 100644 +--- a/tests/nwfilterxml2firewalldata/udp-linux.args ++++ b/tests/nwfilterxml2firewalldata/udp-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --destination 10.1.2.3/32 \ +@@ -41,6 +45,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + -m mac \ +@@ -54,6 +59,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --destination 10.1.2.3/32 \ +@@ -65,6 +71,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udp \ + --destination 10.1.2.3/32 \ +@@ -76,6 +83,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udp \ + -m mac \ +@@ -89,6 +97,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udp \ + --destination 10.1.2.3/32 \ +diff --git a/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args b/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args +index 9eb38d7e6d..de564aee36 100644 +--- a/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args ++++ b/tests/nwfilterxml2firewalldata/udplite-ipv6-linux.args +@@ -1,4 +1,5 @@ + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udplite \ + -m mac \ +@@ -11,6 +12,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udplite \ + --destination f:e:d::c:b:a/127 \ +@@ -21,6 +23,7 @@ ip6tables \ + --state ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udplite \ + -m mac \ +@@ -33,6 +36,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udplite \ + --destination a:b:c::/128 \ +@@ -42,6 +46,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udplite \ + -m mac \ +@@ -53,6 +58,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udplite \ + --destination a:b:c::/128 \ +@@ -62,6 +68,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FJ-vnet0 \ + -p udplite \ + --destination ::10.1.2.3/128 \ +@@ -71,6 +78,7 @@ ip6tables \ + --state ESTABLISHED \ + -j RETURN + ip6tables \ ++-w \ + -A FP-vnet0 \ + -p udplite \ + -m mac \ +@@ -82,6 +90,7 @@ ip6tables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + ip6tables \ ++-w \ + -A HJ-vnet0 \ + -p udplite \ + --destination ::10.1.2.3/128 \ +diff --git a/tests/nwfilterxml2firewalldata/udplite-linux.args b/tests/nwfilterxml2firewalldata/udplite-linux.args +index 53bc667459..8f3a9e8f24 100644 +--- a/tests/nwfilterxml2firewalldata/udplite-linux.args ++++ b/tests/nwfilterxml2firewalldata/udplite-linux.args +@@ -1,4 +1,5 @@ + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udplite \ + -m mac \ +@@ -10,6 +11,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udplite \ + --source 10.1.2.3/32 \ +@@ -19,6 +21,7 @@ iptables \ + --state ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udplite \ + -m mac \ +@@ -30,6 +33,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udplite \ + --destination 10.1.2.3/22 \ +@@ -39,6 +43,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udplite \ + -m mac \ +@@ -50,6 +55,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udplite \ + --destination 10.1.2.3/22 \ +@@ -59,6 +65,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FJ-vnet0 \ + -p udplite \ + --destination 10.1.2.3/22 \ +@@ -68,6 +75,7 @@ iptables \ + --state ESTABLISHED \ + -j RETURN + iptables \ ++-w \ + -A FP-vnet0 \ + -p udplite \ + -m mac \ +@@ -79,6 +87,7 @@ iptables \ + --state NEW,ESTABLISHED \ + -j ACCEPT + iptables \ ++-w \ + -A HJ-vnet0 \ + -p udplite \ + --destination 10.1.2.3/22 \ +diff --git a/tests/nwfilterxml2firewalldata/vlan-linux.args b/tests/nwfilterxml2firewalldata/vlan-linux.args +index 0a8204c4dc..a93c09cfbd 100644 +--- a/tests/nwfilterxml2firewalldata/vlan-linux.args ++++ b/tests/nwfilterxml2firewalldata/vlan-linux.args +@@ -1,4 +1,5 @@ + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -d 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -7,6 +8,7 @@ ebtables \ + --vlan-id 291 \ + -j CONTINUE + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -15,6 +17,7 @@ ebtables \ + --vlan-id 291 \ + -j CONTINUE + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -d 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -23,6 +26,7 @@ ebtables \ + --vlan-id 1234 \ + -j RETURN + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -31,6 +35,7 @@ ebtables \ + --vlan-id 1234 \ + -j RETURN + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-P-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -39,6 +44,7 @@ ebtables \ + --vlan-id 291 \ + -j DROP + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +@@ -47,6 +53,7 @@ ebtables \ + --vlan-encap 2054 \ + -j DROP + ebtables \ ++--concurrent \ + -t nat \ + -A libvirt-J-vnet0 \ + -s 01:02:03:04:05:06/ff:ff:ff:ff:ff:ff \ +diff --git a/tests/nwfilterxml2firewalltest.c b/tests/nwfilterxml2firewalltest.c +index da86ec9463..c97f83b24a 100644 +--- a/tests/nwfilterxml2firewalltest.c ++++ b/tests/nwfilterxml2firewalltest.c +@@ -58,90 +58,90 @@ struct _virNWFilterInst { + + static const char *commonRules[] = { + /* Dropping ebtables rules */ +- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" +- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" +- "ebtables -t nat -L libvirt-J-vnet0\n" +- "ebtables -t nat -L libvirt-P-vnet0\n" +- "ebtables -t nat -F libvirt-J-vnet0\n" +- "ebtables -t nat -X libvirt-J-vnet0\n" +- "ebtables -t nat -F libvirt-P-vnet0\n" +- "ebtables -t nat -X libvirt-P-vnet0\n", ++ "ebtables --concurrent -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -L libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -F libvirt-P-vnet0\n" ++ "ebtables --concurrent -t nat -X libvirt-P-vnet0\n", + + /* Creating ebtables chains */ +- "ebtables -t nat -N libvirt-J-vnet0\n" +- "ebtables -t nat -N libvirt-P-vnet0\n", ++ "ebtables --concurrent -t nat -N libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -N libvirt-P-vnet0\n", + + /* Dropping iptables rules */ +- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" +- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" +- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" +- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" +- "iptables -F FP-vnet0\n" +- "iptables -X FP-vnet0\n" +- "iptables -F FJ-vnet0\n" +- "iptables -X FJ-vnet0\n" +- "iptables -F HJ-vnet0\n" +- "iptables -X HJ-vnet0\n", ++ "iptables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" ++ "iptables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" ++ "iptables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" ++ "iptables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" ++ "iptables -w -F FP-vnet0\n" ++ "iptables -w -X FP-vnet0\n" ++ "iptables -w -F FJ-vnet0\n" ++ "iptables -w -X FJ-vnet0\n" ++ "iptables -w -F HJ-vnet0\n" ++ "iptables -w -X HJ-vnet0\n", + + /* Creating iptables chains */ +- "iptables -N libvirt-in\n" +- "iptables -N libvirt-out\n" +- "iptables -N libvirt-in-post\n" +- "iptables -N libvirt-host-in\n" +- "iptables -D FORWARD -j libvirt-in\n" +- "iptables -D FORWARD -j libvirt-out\n" +- "iptables -D FORWARD -j libvirt-in-post\n" +- "iptables -D INPUT -j libvirt-host-in\n" +- "iptables -I FORWARD 1 -j libvirt-in\n" +- "iptables -I FORWARD 2 -j libvirt-out\n" +- "iptables -I FORWARD 3 -j libvirt-in-post\n" +- "iptables -I INPUT 1 -j libvirt-host-in\n" +- "iptables -N FP-vnet0\n" +- "iptables -N FJ-vnet0\n" +- "iptables -N HJ-vnet0\n" +- "iptables -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" +- "iptables -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" +- "iptables -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" +- "iptables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "iptables -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n", ++ "iptables -w -N libvirt-in\n" ++ "iptables -w -N libvirt-out\n" ++ "iptables -w -N libvirt-in-post\n" ++ "iptables -w -N libvirt-host-in\n" ++ "iptables -w -D FORWARD -j libvirt-in\n" ++ "iptables -w -D FORWARD -j libvirt-out\n" ++ "iptables -w -D FORWARD -j libvirt-in-post\n" ++ "iptables -w -D INPUT -j libvirt-host-in\n" ++ "iptables -w -I FORWARD 1 -j libvirt-in\n" ++ "iptables -w -I FORWARD 2 -j libvirt-out\n" ++ "iptables -w -I FORWARD 3 -j libvirt-in-post\n" ++ "iptables -w -I INPUT 1 -j libvirt-host-in\n" ++ "iptables -w -N FP-vnet0\n" ++ "iptables -w -N FJ-vnet0\n" ++ "iptables -w -N HJ-vnet0\n" ++ "iptables -w -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" ++ "iptables -w -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" ++ "iptables -w -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" ++ "iptables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "iptables -w -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n", + + /* Dropping ip6tables rules */ +- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" +- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" +- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" +- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" +- "ip6tables -F FP-vnet0\n" +- "ip6tables -X FP-vnet0\n" +- "ip6tables -F FJ-vnet0\n" +- "ip6tables -X FJ-vnet0\n" +- "ip6tables -F HJ-vnet0\n" +- "ip6tables -X HJ-vnet0\n", ++ "ip6tables -w -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" ++ "ip6tables -w -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" ++ "ip6tables -w -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" ++ "ip6tables -w -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" ++ "ip6tables -w -F FP-vnet0\n" ++ "ip6tables -w -X FP-vnet0\n" ++ "ip6tables -w -F FJ-vnet0\n" ++ "ip6tables -w -X FJ-vnet0\n" ++ "ip6tables -w -F HJ-vnet0\n" ++ "ip6tables -w -X HJ-vnet0\n", + + /* Creating ip6tables chains */ +- "ip6tables -N libvirt-in\n" +- "ip6tables -N libvirt-out\n" +- "ip6tables -N libvirt-in-post\n" +- "ip6tables -N libvirt-host-in\n" +- "ip6tables -D FORWARD -j libvirt-in\n" +- "ip6tables -D FORWARD -j libvirt-out\n" +- "ip6tables -D FORWARD -j libvirt-in-post\n" +- "ip6tables -D INPUT -j libvirt-host-in\n" +- "ip6tables -I FORWARD 1 -j libvirt-in\n" +- "ip6tables -I FORWARD 2 -j libvirt-out\n" +- "ip6tables -I FORWARD 3 -j libvirt-in-post\n" +- "ip6tables -I INPUT 1 -j libvirt-host-in\n" +- "ip6tables -N FP-vnet0\n" +- "ip6tables -N FJ-vnet0\n" +- "ip6tables -N HJ-vnet0\n" +- "ip6tables -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" +- "ip6tables -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" +- "ip6tables -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" +- "ip6tables -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" +- "ip6tables -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n", ++ "ip6tables -w -N libvirt-in\n" ++ "ip6tables -w -N libvirt-out\n" ++ "ip6tables -w -N libvirt-in-post\n" ++ "ip6tables -w -N libvirt-host-in\n" ++ "ip6tables -w -D FORWARD -j libvirt-in\n" ++ "ip6tables -w -D FORWARD -j libvirt-out\n" ++ "ip6tables -w -D FORWARD -j libvirt-in-post\n" ++ "ip6tables -w -D INPUT -j libvirt-host-in\n" ++ "ip6tables -w -I FORWARD 1 -j libvirt-in\n" ++ "ip6tables -w -I FORWARD 2 -j libvirt-out\n" ++ "ip6tables -w -I FORWARD 3 -j libvirt-in-post\n" ++ "ip6tables -w -I INPUT 1 -j libvirt-host-in\n" ++ "ip6tables -w -N FP-vnet0\n" ++ "ip6tables -w -N FJ-vnet0\n" ++ "ip6tables -w -N HJ-vnet0\n" ++ "ip6tables -w -A libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" ++ "ip6tables -w -A libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" ++ "ip6tables -w -A libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" ++ "ip6tables -w -D libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n" ++ "ip6tables -w -A libvirt-in-post -m physdev --physdev-in vnet0 -j ACCEPT\n", + + /* Inserting ebtables rules */ +- "ebtables -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" +- "ebtables -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n", ++ "ebtables --concurrent -t nat -A PREROUTING -i vnet0 -j libvirt-J-vnet0\n" ++ "ebtables --concurrent -t nat -A POSTROUTING -o vnet0 -j libvirt-P-vnet0\n", + }; + + +diff --git a/tests/virfirewalltest.c b/tests/virfirewalltest.c +index 8aba127610..195163a985 100644 +--- a/tests/virfirewalltest.c ++++ b/tests/virfirewalltest.c +@@ -147,17 +147,19 @@ VIR_MOCK_WRAP_RET_ARGS(dbus_connection_send_with_reply_and_block, + "org.firewalld.error", + "something bad happened"); + } else { +- if (nargs == 1 && ++ if (nargs == 2 && + STREQ(type, "ipv4") && +- STREQ(args[0], "-L")) { ++ STREQ(args[0], "-w") && ++ STREQ(args[1], "-L")) { + if (virDBusCreateReply(&reply, + "s", TEST_FILTER_TABLE_LIST) < 0) + goto error; +- } else if (nargs == 3 && ++ } else if (nargs == 4 && + STREQ(type, "ipv4") && +- STREQ(args[0], "-t") && +- STREQ(args[1], "nat") && +- STREQ(args[2], "-L")) { ++ STREQ(args[0], "-w") && ++ STREQ(args[1], "-t") && ++ STREQ(args[2], "nat") && ++ STREQ(args[3], "-L")) { + if (virDBusCreateReply(&reply, + "s", TEST_NAT_TABLE_LIST) < 0) + goto error; +@@ -204,8 +206,8 @@ testFirewallSingleGroup(const void *opaque) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -260,8 +262,8 @@ testFirewallRemoveRule(const void *opaque) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + virFirewallRulePtr fwrule; + +@@ -323,10 +325,10 @@ testFirewallManyGroups(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" +- IPTABLES_PATH " -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A OUTPUT --jump DROP\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" ++ IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A OUTPUT --jump DROP\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -414,10 +416,10 @@ testFirewallIgnoreFailGroup(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A OUTPUT --jump DROP\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A OUTPUT --jump DROP\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -486,10 +488,10 @@ testFirewallIgnoreFailRule(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A OUTPUT --jump DROP\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -A OUTPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A OUTPUT --jump DROP\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -557,8 +559,8 @@ testFirewallNoRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -621,11 +623,11 @@ testFirewallSingleRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -D INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -705,10 +707,10 @@ testFirewallManyRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -792,14 +794,14 @@ testFirewallChainedRollback(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.127 --jump REJECT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host 192.168.122.127 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host 192.168.122.255 --jump REJECT\n" +- IPTABLES_PATH " -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.127 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.127 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host 192.168.122.255 --jump REJECT\n" ++ IPTABLES_PATH " -w -D INPUT --source-host '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + fwDisabled = data->fwDisabled; +@@ -938,12 +940,14 @@ testFirewallQueryHook(const char *const*args, + void *opaque G_GNUC_UNUSED) + { + if (STREQ(args[0], IPTABLES_PATH) && +- STREQ(args[1], "-L")) { ++ STREQ(args[1], "-w") && ++ STREQ(args[2], "-L")) { + *output = g_strdup(TEST_FILTER_TABLE_LIST); + } else if (STREQ(args[0], IPTABLES_PATH) && +- STREQ(args[1], "-t") && +- STREQ(args[2], "nat") && +- STREQ(args[3], "-L")) { ++ STREQ(args[1], "-w") && ++ STREQ(args[2], "-t") && ++ STREQ(args[3], "nat") && ++ STREQ(args[4], "-L")) { + *output = g_strdup(TEST_NAT_TABLE_LIST); + } + } +@@ -986,15 +990,15 @@ testFirewallQuery(const void *opaque G_GNUC_UNUSED) + int ret = -1; + const char *actual = NULL; + const char *expected = +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.127 --jump REJECT\n" +- IPTABLES_PATH " -L\n" +- IPTABLES_PATH " -t nat -L\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.130 --jump REJECT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" +- IPTABLES_PATH " -A INPUT --source-host 192.168.122.128 --jump REJECT\n" +- IPTABLES_PATH " -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.1 --jump ACCEPT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.127 --jump REJECT\n" ++ IPTABLES_PATH " -w -L\n" ++ IPTABLES_PATH " -w -t nat -L\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.130 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.129' --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host 192.168.122.128 --jump REJECT\n" ++ IPTABLES_PATH " -w -A INPUT --source-host '!192.168.122.1' --jump REJECT\n"; + const struct testFirewallData *data = opaque; + + expectedLineNum = 0; +-- +2.30.0 + diff --git a/SOURCES/libvirt-util-virNetDevTapCreate-initialize-fd-to-1.patch b/SOURCES/libvirt-util-virNetDevTapCreate-initialize-fd-to-1.patch new file mode 100644 index 0000000..d2a583f --- /dev/null +++ b/SOURCES/libvirt-util-virNetDevTapCreate-initialize-fd-to-1.patch @@ -0,0 +1,37 @@ +From 3b2892c175918021f78a7dfc8dac39f4c451a15f Mon Sep 17 00:00:00 2001 +Message-Id: <3b2892c175918021f78a7dfc8dac39f4c451a15f@dist-git> +From: =?UTF-8?q?J=C3=A1n=20Tomko?= +Date: Sat, 12 Dec 2020 22:04:53 -0500 +Subject: [PATCH] util: virNetDevTapCreate: initialize fd to -1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Ján Tomko +Fixes: 95089f481e003d971fe0a082018216c58c1b80e5 +(cherry picked from commit 2b6cd855042984b87beb7e3c30b67b0f586d89bb) + +https://bugzilla.redhat.com/1874304 +Signed-off-by: Laine Stump +Message-Id: <20201213030453.48851-4-laine@redhat.com> +Reviewed-by: Michal Privoznik +--- + src/util/virnetdevtap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/util/virnetdevtap.c b/src/util/virnetdevtap.c +index fd4b70df30..d333163ff9 100644 +--- a/src/util/virnetdevtap.c ++++ b/src/util/virnetdevtap.c +@@ -318,7 +318,7 @@ int virNetDevTapCreate(char **ifname, + size_t i = 0; + struct ifreq ifr; + int ret = -1; +- int fd = 0; ++ int fd = -1; + + virMutexLock(&virNetDevTapCreateMutex); + +-- +2.29.2 + diff --git a/SOURCES/libvirt-util-virhostcpu-Fail-when-fetching-CPU-Stats-for-invalid-cpu.patch b/SOURCES/libvirt-util-virhostcpu-Fail-when-fetching-CPU-Stats-for-invalid-cpu.patch new file mode 100644 index 0000000..34c2060 --- /dev/null +++ b/SOURCES/libvirt-util-virhostcpu-Fail-when-fetching-CPU-Stats-for-invalid-cpu.patch @@ -0,0 +1,102 @@ +From ff54ea3d2a61a25079339d38caa6c509cf697ce3 Mon Sep 17 00:00:00 2001 +Message-Id: +From: "Mauro S. M. Rodrigues" +Date: Tue, 19 Jan 2021 21:04:08 -0300 +Subject: [PATCH] util: virhostcpu: Fail when fetching CPU Stats for invalid + cpu + +virHostCPUGetStatsLinux walks through every cpu in /proc/stat until it +finds cpu%cpuNum that matches with the requested cpu. +If none is found it logs the error but it should return -1, instead of 0. +Otherwise virsh nodecpustats --cpu and API bindings +don't fail properly, printing a blank line instead of an error message. + +This patch also includes an additional test for virhostcputest to avoid +this regression to happen again in the future. + +Fixes: 93af79fba3fd75a8df6b7ca608719dd97f9511a0 +Reported-by: Satheesh Rajendran +Signed-off-by: Mauro S. M. Rodrigues +Signed-off-by: Michal Privoznik +Reviewed-by: Michal Privoznik +Reviewed-by: Christian Ehrhardt +Tested-by: Christian Ehrhardt +(cherry picked from commit 75a4ec42f70b5324f95d7ffbbfbf7457620735e4) + +https://bugzilla.redhat.com/1915183 + +Signed-off-by: Daniel Henrique Barboza +Message-Id: <20210120000408.106596-1-dbarboza@redhat.com> +Reviewed-by: Jiri Denemark +--- + src/util/virhostcpu.c | 2 +- + tests/virhostcputest.c | 21 ++++++++++++++++++--- + 2 files changed, 19 insertions(+), 4 deletions(-) + +diff --git a/src/util/virhostcpu.c b/src/util/virhostcpu.c +index 218272d7ec..37cc45e3a6 100644 +--- a/src/util/virhostcpu.c ++++ b/src/util/virhostcpu.c +@@ -855,7 +855,7 @@ virHostCPUGetStatsLinux(FILE *procstat, + _("Invalid cpuNum in %s"), + __FUNCTION__); + +- return 0; ++ return -1; + } + + +diff --git a/tests/virhostcputest.c b/tests/virhostcputest.c +index 7865b61578..70a723098b 100644 +--- a/tests/virhostcputest.c ++++ b/tests/virhostcputest.c +@@ -196,6 +196,7 @@ linuxTestHostCPU(const void *opaque) + struct nodeCPUStatsData { + const char *name; + int ncpus; ++ bool shouldFail; + }; + + static int +@@ -214,6 +215,19 @@ linuxTestNodeCPUStats(const void *data) + result = linuxCPUStatsCompareFiles(cpustatfile, + testData->ncpus, + outfile); ++ if (result < 0) { ++ if (testData->shouldFail) { ++ /* Expected error */ ++ result = 0; ++ } ++ } else { ++ if (testData->shouldFail) { ++ fprintf(stderr, "Expected a failure, got success"); ++ result = -1; ++ } ++ } ++ ++ + VIR_FREE(cpustatfile); + VIR_FREE(outfile); + return result; +@@ -258,14 +272,15 @@ mymain(void) + if (virTestRun(nodeData[i].testName, linuxTestHostCPU, &nodeData[i]) != 0) + ret = -1; + +-# define DO_TEST_CPU_STATS(name, ncpus) \ ++# define DO_TEST_CPU_STATS(name, ncpus, shouldFail) \ + do { \ +- static struct nodeCPUStatsData data = { name, ncpus }; \ ++ static struct nodeCPUStatsData data = { name, ncpus, shouldFail}; \ + if (virTestRun("CPU stats " name, linuxTestNodeCPUStats, &data) < 0) \ + ret = -1; \ + } while (0) + +- DO_TEST_CPU_STATS("24cpu", 24); ++ DO_TEST_CPU_STATS("24cpu", 24, false); ++ DO_TEST_CPU_STATS("24cpu", 25, true); + + return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE; + } +-- +2.30.0 + diff --git a/SOURCES/libvirt-vircgroup-correctly-free-nested-virCgroupPtr.patch b/SOURCES/libvirt-vircgroup-correctly-free-nested-virCgroupPtr.patch new file mode 100644 index 0000000..e72b84d --- /dev/null +++ b/SOURCES/libvirt-vircgroup-correctly-free-nested-virCgroupPtr.patch @@ -0,0 +1,45 @@ +From 7cdf83f2e699a9c9b8cafbc09dbd21d2cb3a3b45 Mon Sep 17 00:00:00 2001 +Message-Id: <7cdf83f2e699a9c9b8cafbc09dbd21d2cb3a3b45@dist-git> +From: Pavel Hrdina +Date: Fri, 19 Feb 2021 13:34:01 +0100 +Subject: [PATCH] vircgroup: correctly free nested virCgroupPtr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fixes: 184245f53b94fc84f727eb6e8a2aa52df02d69c0 + +Signed-off-by: Pavel Hrdina +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit 6a1f5e8a4f3184bb54b9dcaa3afcf8c97adccb62) + +Conflicts: + src/util/vircgroup.c + - missing upstream g_free rewrite + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1798463 + +Signed-off-by: Pavel Hrdina +Message-Id: +Reviewed-by: Ján Tomko +--- + src/util/vircgroup.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c +index d0f867ba7f..0a6404e97c 100644 +--- a/src/util/vircgroup.c ++++ b/src/util/vircgroup.c +@@ -3711,7 +3711,8 @@ virCgroupFree(virCgroupPtr *group) + VIR_FREE((*group)->unified.mountPoint); + VIR_FREE((*group)->unified.placement); + VIR_FREE((*group)->unitName); +- VIR_FREE((*group)->nested); ++ ++ virCgroupFree(&(*group)->nested); + + VIR_FREE((*group)->path); + VIR_FREE(*group); +-- +2.30.0 + diff --git a/SOURCES/libvirt-vircgroup-enforce-range-limit-for-cpu.shares.patch b/SOURCES/libvirt-vircgroup-enforce-range-limit-for-cpu.shares.patch new file mode 100644 index 0000000..d800b77 --- /dev/null +++ b/SOURCES/libvirt-vircgroup-enforce-range-limit-for-cpu.shares.patch @@ -0,0 +1,147 @@ +From c82c32f60579d148f37064e5156e857fa3c84c2f Mon Sep 17 00:00:00 2001 +Message-Id: +From: Pavel Hrdina +Date: Thu, 4 Mar 2021 12:57:57 +0100 +Subject: [PATCH] vircgroup: enforce range limit for cpu.shares +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Before the conversion to using systemd DBus API to set the cpu.shares +there was some magic conversion done by kernel which was documented in +virsh manpage as well. Now systemd errors out if the value is out of +range. + +Since we enforce the range for other cpu cgroup attributes 'quota' and +'period' it makes sense to do the same for 'shares' as well. + +Signed-off-by: Pavel Hrdina +Reviewed-by: Michal Privoznik +(cherry picked from commit 1d9d9961ada6c2d0b9facae0ef8be4f459cf7fc9) + +Conflicts: + docs/formatdomain.rst + src/conf/domain_validate.c + - both are not present in downstream + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1798463 + +Signed-off-by: Pavel Hrdina +Message-Id: <79b9ef9f98b3ab35061f8c4e4acf7b6861d28055.1614858616.git.phrdina@redhat.com> +Reviewed-by: Ján Tomko +--- + docs/formatdomain.html.in | 1 + + docs/manpages/virsh.rst | 5 +---- + src/conf/domain_conf.c | 10 ++++++++++ + src/util/vircgroup.h | 2 ++ + src/util/vircgroupv1.c | 10 ++++++++++ + src/util/vircgroupv2.c | 10 ++++++++++ + 6 files changed, 34 insertions(+), 4 deletions(-) + +diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in +index 4341e256a8..7ac9523684 100644 +--- a/docs/formatdomain.html.in ++++ b/docs/formatdomain.html.in +@@ -854,6 +854,7 @@ + it's a relative measure based on the setting of other VM, + e.g. A VM configured with value + 2048 will get twice as much CPU time as a VM configured with value 1024. ++ The value should be in range [2, 262144]. + Since 0.9.0 + + +diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst +index a5b95c1123..01e1c01912 100644 +--- a/docs/manpages/virsh.rst ++++ b/docs/manpages/virsh.rst +@@ -3704,10 +3704,7 @@ If *--live* is specified, set scheduler information of a running guest. + If *--config* is specified, affect the next boot of a persistent guest. + If *--current* is specified, affect the current guest state. + +-``Note``: The cpu_shares parameter has a valid value range of 0-262144; Negative +-values are wrapped to positive, and larger values are capped at the maximum. +-Therefore, -1 is a useful shorthand for 262144. On the Linux kernel, the +-values 0 and 1 are automatically converted to a minimal value of 2. ++``Note``: The cpu_shares parameter has a valid value range of 2-262144. + + ``Note``: The weight and cap parameters are defined only for the + XEN_CREDIT scheduler. +diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c +index 9f6cdb0de8..444657c9a1 100644 +--- a/src/conf/domain_conf.c ++++ b/src/conf/domain_conf.c +@@ -7026,6 +7026,16 @@ virDomainDefLifecycleActionValidate(const virDomainDef *def) + static int + virDomainDefCputuneValidate(const virDomainDef *def) + { ++ if (def->cputune.shares > 0 && ++ (def->cputune.shares < VIR_CGROUP_CPU_SHARES_MIN || ++ def->cputune.shares > VIR_CGROUP_CPU_SHARES_MAX)) { ++ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, ++ _("Value of cputune 'shares' must be in range [%llu, %llu]"), ++ VIR_CGROUP_CPU_SHARES_MIN, ++ VIR_CGROUP_CPU_SHARES_MAX); ++ return -1; ++ } ++ + CPUTUNE_VALIDATE_PERIOD(period); + CPUTUNE_VALIDATE_PERIOD(global_period); + CPUTUNE_VALIDATE_PERIOD(emulator_period); +diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h +index 1c6edea0be..938cfdfbe3 100644 +--- a/src/util/vircgroup.h ++++ b/src/util/vircgroup.h +@@ -243,6 +243,8 @@ virCgroupGetDomainTotalCpuStats(virCgroupPtr group, + int virCgroupSetCpuShares(virCgroupPtr group, unsigned long long shares); + int virCgroupGetCpuShares(virCgroupPtr group, unsigned long long *shares); + ++#define VIR_CGROUP_CPU_SHARES_MIN 2LL ++#define VIR_CGROUP_CPU_SHARES_MAX 262144LL + #define VIR_CGROUP_CPU_PERIOD_MIN 1000LL + #define VIR_CGROUP_CPU_PERIOD_MAX 1000000LL + #define VIR_CGROUP_CPU_QUOTA_MIN 1000LL +diff --git a/src/util/vircgroupv1.c b/src/util/vircgroupv1.c +index 49a2cb023e..d417446447 100644 +--- a/src/util/vircgroupv1.c ++++ b/src/util/vircgroupv1.c +@@ -1901,6 +1901,16 @@ static int + virCgroupV1SetCpuShares(virCgroupPtr group, + unsigned long long shares) + { ++ if (shares < VIR_CGROUP_CPU_SHARES_MIN || ++ shares > VIR_CGROUP_CPU_SHARES_MAX) { ++ virReportError(VIR_ERR_INVALID_ARG, ++ _("shares '%llu' must be in range [%llu, %llu]"), ++ shares, ++ VIR_CGROUP_CPU_SHARES_MIN, ++ VIR_CGROUP_CPU_SHARES_MAX); ++ return -1; ++ } ++ + if (group->unitName) { + return virCgroupSetValueDBus(group->unitName, "CPUShares", + "t", shares); +diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c +index a14fc669fb..079fe6a8ec 100644 +--- a/src/util/vircgroupv2.c ++++ b/src/util/vircgroupv2.c +@@ -1499,6 +1499,16 @@ static int + virCgroupV2SetCpuShares(virCgroupPtr group, + unsigned long long shares) + { ++ if (shares < VIR_CGROUP_CPU_SHARES_MIN || ++ shares > VIR_CGROUP_CPU_SHARES_MAX) { ++ virReportError(VIR_ERR_INVALID_ARG, ++ _("shares '%llu' must be in range [%llu, %llu]"), ++ shares, ++ VIR_CGROUP_CPU_SHARES_MIN, ++ VIR_CGROUP_CPU_SHARES_MAX); ++ return -1; ++ } ++ + if (group->unitName) { + return virCgroupSetValueDBus(group->unitName, "CPUWeight", + "t", shares); +-- +2.30.0 + diff --git a/SOURCES/libvirt-vircgroup-fix-cpu-quota-maximum-limit.patch b/SOURCES/libvirt-vircgroup-fix-cpu-quota-maximum-limit.patch new file mode 100644 index 0000000..c744ed7 --- /dev/null +++ b/SOURCES/libvirt-vircgroup-fix-cpu-quota-maximum-limit.patch @@ -0,0 +1,45 @@ +From 92b7a56b1a23d1cf39e810a58a6d7d0b1f500e69 Mon Sep 17 00:00:00 2001 +Message-Id: <92b7a56b1a23d1cf39e810a58a6d7d0b1f500e69@dist-git> +From: Pavel Hrdina period
+Date: Thu, 21 Jan 2021 10:24:06 -0300 +Subject: [PATCH] vircgroup: fix cpu quota maximum limit + +Kernel commit added proper +check for cpu quota maximum limit to prevent internal overflow. + +Even though this change is not present in all kernels it makes sense +to enforce the same limit in libvirt. + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1750315 + +Signed-off-by: Pavel Hrdina +Reviewed-by: Daniel Henrique Barboza +(cherry picked from commit ed1ba69f5a8132f8c1e73d2a1f142d70de0b564a) + +https://bugzilla.redhat.com/1915733 + +Signed-off-by: Daniel Henrique Barboza +Message-Id: <20210121132406.337681-5-dbarboza@redhat.com> +Reviewed-by: Pavel Hrdina +--- + src/util/vircgroup.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/util/vircgroup.h b/src/util/vircgroup.h +index 83fa74840f..1c6edea0be 100644 +--- a/src/util/vircgroup.h ++++ b/src/util/vircgroup.h +@@ -246,7 +246,9 @@ int virCgroupGetCpuShares(virCgroupPtr group, unsigned long long *shares); + #define VIR_CGROUP_CPU_PERIOD_MIN 1000LL + #define VIR_CGROUP_CPU_PERIOD_MAX 1000000LL + #define VIR_CGROUP_CPU_QUOTA_MIN 1000LL +-#define VIR_CGROUP_CPU_QUOTA_MAX 18446744073709551LL ++/* Based on kernel code ((1ULL << MAX_BW_BITS) - 1) where MAX_BW_BITS is ++ * (64 - BW_SHIFT) and BW_SHIFT is 20 */ ++#define VIR_CGROUP_CPU_QUOTA_MAX 17592186044415LL + + int virCgroupSetCpuCfsPeriod(virCgroupPtr group, unsigned long long cfs_period); + int virCgroupGetCpuCfsPeriod(virCgroupPtr group, unsigned long long *cfs_period); +-- +2.30.0 + diff --git a/SOURCES/libvirt-vircgroup-introduce-nested-cgroup-to-properly-work-with-systemd.patch b/SOURCES/libvirt-vircgroup-introduce-nested-cgroup-to-properly-work-with-systemd.patch new file mode 100644 index 0000000..435dc6a --- /dev/null +++ b/SOURCES/libvirt-vircgroup-introduce-nested-cgroup-to-properly-work-with-systemd.patch @@ -0,0 +1,879 @@ +From 2593f2e4626fbb6dfef2317bceea4d1b8275f9d8 Mon Sep 17 00:00:00 2001 +Message-Id: <2593f2e4626fbb6dfef2317bceea4d1b8275f9d8@dist-git> +From: Pavel Hrdina +Date: Fri, 19 Feb 2021 13:33:59 +0100 +Subject: [PATCH] vircgroup: introduce nested cgroup to properly work with + systemd +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When running on host with systemd we register VMs with machined. +In this case systemd creates the root VM cgroup for us. This has some +implications where one of them is that systemd owns all files inside +the root VM cgroup and we should not touch them. + +We already use DBus calls for some of the APIs but for the remaining +ones we will continue accessing the files directly. Systemd doesn't +support threaded cgroups so we need to do this. + +The reason why we don't use DBus for most of the APIs is that we already +have a code that works with files and we would have to check if systemd +supports each API. + +This change introduces new topology on systemd hosts: + +$ROOT + | + +- machine.slice + | + +- machine-qemu\x2d1\x2dvm1.scope + | + +- libvirt + | + +- emulator + +- vcpu0 + +- vcpu0 + +compared to the previous topology: + +$ROOT + | + +- machine.slice + | + +- machine-qemu\x2d1\x2dvm1.scope + | + +- emulator + +- vcpu0 + +- vcpu0 + +Signed-off-by: Pavel Hrdina +Reviewed-by: Michal Privoznik +(cherry picked from commit 184245f53b94fc84f727eb6e8a2aa52df02d69c0) + +Conflicts: + src/util/vircgroup.c + - missing upstream g_free and g_autofree rewrite + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1798463 + +Signed-off-by: Pavel Hrdina +Message-Id: <51312c8b520e4ed794f8cd8a77b77c228387bb15.1613737828.git.phrdina@redhat.com> +Reviewed-by: Ján Tomko +--- + docs/cgroups.html.in | 29 +++-- + src/util/vircgroup.c | 256 +++++++++++++++++++++++++++++++-------- + src/util/vircgrouppriv.h | 4 + + src/util/vircgroupv1.c | 15 ++- + src/util/vircgroupv2.c | 6 + + 5 files changed, 245 insertions(+), 65 deletions(-) + +diff --git a/docs/cgroups.html.in b/docs/cgroups.html.in +index 78dede1bba..412a9360ff 100644 +--- a/docs/cgroups.html.in ++++ b/docs/cgroups.html.in +@@ -117,21 +117,27 @@ $ROOT + | + +- machine-qemu\x2d1\x2dvm1.scope + | | +- | +- emulator +- | +- vcpu0 +- | +- vcpu1 ++ | +- libvirt ++ | | ++ | +- emulator ++ | +- vcpu0 ++ | +- vcpu1 + | + +- machine-qemu\x2d2\x2dvm2.scope + | | +- | +- emulator +- | +- vcpu0 +- | +- vcpu1 ++ | +- libvirt ++ | | ++ | +- emulator ++ | +- vcpu0 ++ | +- vcpu1 + | + +- machine-qemu\x2d3\x2dvm3.scope + | | +- | +- emulator +- | +- vcpu0 +- | +- vcpu1 ++ | +- libvirt ++ | | ++ | +- emulator ++ | +- vcpu0 ++ | +- vcpu1 + | + +- machine-engineering.slice + | | +@@ -148,6 +154,11 @@ $ROOT + +- machine-lxc\x2d33333\x2dcontainer3.scope +
++ Prior libvirt 7.1.0 the topology doesn't have extra
++ libvirt
directory.
++
+diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
+index 8f5bcd94f4..d0f867ba7f 100644
+--- a/src/util/vircgroup.c
++++ b/src/util/vircgroup.c
+@@ -639,6 +639,22 @@ virCgroupMakeGroup(virCgroupPtr parent,
+ }
+
+
++static bool
++virCgroupExists(virCgroupPtr group)
++{
++ size_t i;
++
++ for (i = 0; i < VIR_CGROUP_BACKEND_TYPE_LAST; i++) {
++ if (group->backends[i] &&
++ !group->backends[i]->exists(group)) {
++ return false;
++ }
++ }
++
++ return true;
++}
++
++
+ /**
+ * virCgroupNew:
+ * @path: path for the new group
+@@ -695,10 +711,11 @@ virCgroupAddTaskInternal(virCgroupPtr group,
+ unsigned int flags)
+ {
+ size_t i;
++ virCgroupPtr parent = virCgroupGetNested(group);
+
+ for (i = 0; i < VIR_CGROUP_BACKEND_TYPE_LAST; i++) {
+- if (group->backends[i] &&
+- group->backends[i]->addTask(group, pid, flags) < 0) {
++ if (parent->backends[i] &&
++ parent->backends[i]->addTask(parent, pid, flags) < 0) {
+ return -1;
+ }
+ }
+@@ -871,6 +888,30 @@ virCgroupNewPartition(const char *path,
+ }
+
+
++static int
++virCgroupNewNested(virCgroupPtr parent,
++ int controllers,
++ bool create,
++ pid_t pid,
++ virCgroupPtr *nested)
++{
++ virCgroupPtr new = NULL;
++
++ if (virCgroupNew(-1, "libvirt", parent, controllers, &new) < 0)
++ return -1;
++
++ if (create) {
++ if (virCgroupMakeGroup(parent, new, create, pid, VIR_CGROUP_NONE) < 0) {
++ virCgroupFree(&new);
++ return -1;
++ }
++ }
++
++ *nested = g_steal_pointer(&new);
++ return 0;
++}
++
++
+ /**
+ * virCgroupNewSelf:
+ *
+@@ -954,6 +995,7 @@ virCgroupNewThread(virCgroupPtr domain,
+ virCgroupPtr *group)
+ {
+ g_autofree char *name = NULL;
++ virCgroupPtr parent = NULL;
+ int controllers;
+
+ switch (nameval) {
+@@ -976,10 +1018,12 @@ virCgroupNewThread(virCgroupPtr domain,
+ (1 << VIR_CGROUP_CONTROLLER_CPUACCT) |
+ (1 << VIR_CGROUP_CONTROLLER_CPUSET));
+
+- if (virCgroupNew(-1, name, domain, controllers, group) < 0)
++ parent = virCgroupGetNested(domain);
++
++ if (virCgroupNew(-1, name, parent, controllers, group) < 0)
+ return -1;
+
+- if (virCgroupMakeGroup(domain, *group, create, -1, VIR_CGROUP_THREAD) < 0) {
++ if (virCgroupMakeGroup(parent, *group, create, -1, VIR_CGROUP_THREAD) < 0) {
+ virCgroupFree(group);
+ return -1;
+ }
+@@ -1009,6 +1053,7 @@ virCgroupNewDetectMachine(const char *name,
+ virCgroupPtr *group)
+ {
+ size_t i;
++ virCgroupPtr nested = NULL;
+
+ if (virCgroupNewDetect(pid, controllers, group) < 0) {
+ if (virCgroupNewIgnoreError())
+@@ -1032,6 +1077,14 @@ virCgroupNewDetectMachine(const char *name,
+ if (virSystemdHasMachined() == 0 && !(*group)->unitName)
+ return -1;
+
++ if (virCgroupNewNested((*group), controllers, false, -1, &nested) < 0)
++ return -1;
++
++ if (virCgroupExists(nested))
++ (*group)->nested = g_steal_pointer(&nested);
++
++ virCgroupFree(&nested);
++
+ return 0;
+ }
+
+@@ -1107,6 +1160,7 @@ virCgroupNewMachineSystemd(const char *name,
+ {
+ int rv;
+ virCgroupPtr init;
++ virCgroupPtr nested = NULL;
+ g_autofree char *path = NULL;
+ size_t i;
+
+@@ -1157,6 +1211,13 @@ virCgroupNewMachineSystemd(const char *name,
+ return -1;
+ }
+
++ if (virCgroupNewNested((*group), controllers, true, pidleader, &nested) < 0) {
++ virCgroupFree(group);
++ return -1;
++ }
++
++ (*group)->nested = nested;
++
+ if (virCgroupAddProcess(*group, pidleader) < 0) {
+ virErrorPtr saved;
+
+@@ -1349,7 +1410,9 @@ virCgroupGetBlkioIoServiced(virCgroupPtr group,
+ long long *requests_read,
+ long long *requests_write)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ getBlkioIoServiced, -1,
+ bytes_read, bytes_write,
+ requests_read, requests_write);
+@@ -1376,7 +1439,9 @@ virCgroupGetBlkioIoDeviceServiced(virCgroupPtr group,
+ long long *requests_read,
+ long long *requests_write)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ getBlkioIoDeviceServiced, -1,
+ path, bytes_read, bytes_write,
+ requests_read, requests_write);
+@@ -1427,7 +1492,9 @@ virCgroupSetBlkioDeviceReadIops(virCgroupPtr group,
+ const char *path,
+ unsigned int riops)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ setBlkioDeviceReadIops, -1, path, riops);
+ }
+
+@@ -1445,7 +1512,9 @@ virCgroupSetBlkioDeviceWriteIops(virCgroupPtr group,
+ const char *path,
+ unsigned int wiops)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ setBlkioDeviceWriteIops, -1, path, wiops);
+ }
+
+@@ -1463,7 +1532,9 @@ virCgroupSetBlkioDeviceReadBps(virCgroupPtr group,
+ const char *path,
+ unsigned long long rbps)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ setBlkioDeviceReadBps, -1, path, rbps);
+ }
+
+@@ -1480,7 +1551,9 @@ virCgroupSetBlkioDeviceWriteBps(virCgroupPtr group,
+ const char *path,
+ unsigned long long wbps)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ setBlkioDeviceWriteBps, -1, path, wbps);
+ }
+
+@@ -1516,7 +1589,9 @@ virCgroupGetBlkioDeviceReadIops(virCgroupPtr group,
+ const char *path,
+ unsigned int *riops)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ getBlkioDeviceReadIops, -1, path, riops);
+ }
+
+@@ -1533,7 +1608,9 @@ virCgroupGetBlkioDeviceWriteIops(virCgroupPtr group,
+ const char *path,
+ unsigned int *wiops)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ getBlkioDeviceWriteIops, -1, path, wiops);
+ }
+
+@@ -1550,7 +1627,9 @@ virCgroupGetBlkioDeviceReadBps(virCgroupPtr group,
+ const char *path,
+ unsigned long long *rbps)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ getBlkioDeviceReadBps, -1, path, rbps);
+ }
+
+@@ -1567,7 +1646,9 @@ virCgroupGetBlkioDeviceWriteBps(virCgroupPtr group,
+ const char *path,
+ unsigned long long *wbps)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_BLKIO,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_BLKIO,
+ getBlkioDeviceWriteBps, -1, path, wbps);
+ }
+
+@@ -1600,7 +1681,9 @@ virCgroupGetBlkioDeviceWeight(virCgroupPtr group,
+ int
+ virCgroupSetMemory(virCgroupPtr group, unsigned long long kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ setMemory, -1, kb);
+ }
+
+@@ -1627,7 +1710,9 @@ virCgroupGetMemoryStat(virCgroupPtr group,
+ unsigned long long *inactiveFile,
+ unsigned long long *unevictable)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ getMemoryStat, -1, cache,
+ activeAnon, inactiveAnon,
+ activeFile, inactiveFile,
+@@ -1646,7 +1731,9 @@ virCgroupGetMemoryStat(virCgroupPtr group,
+ int
+ virCgroupGetMemoryUsage(virCgroupPtr group, unsigned long *kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ getMemoryUsage, -1, kb);
+ }
+
+@@ -1662,7 +1749,9 @@ virCgroupGetMemoryUsage(virCgroupPtr group, unsigned long *kb)
+ int
+ virCgroupSetMemoryHardLimit(virCgroupPtr group, unsigned long long kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ setMemoryHardLimit, -1, kb);
+ }
+
+@@ -1678,7 +1767,9 @@ virCgroupSetMemoryHardLimit(virCgroupPtr group, unsigned long long kb)
+ int
+ virCgroupGetMemoryHardLimit(virCgroupPtr group, unsigned long long *kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ getMemoryHardLimit, -1, kb);
+ }
+
+@@ -1694,7 +1785,9 @@ virCgroupGetMemoryHardLimit(virCgroupPtr group, unsigned long long *kb)
+ int
+ virCgroupSetMemorySoftLimit(virCgroupPtr group, unsigned long long kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ setMemorySoftLimit, -1, kb);
+ }
+
+@@ -1710,7 +1803,9 @@ virCgroupSetMemorySoftLimit(virCgroupPtr group, unsigned long long kb)
+ int
+ virCgroupGetMemorySoftLimit(virCgroupPtr group, unsigned long long *kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ getMemorySoftLimit, -1, kb);
+ }
+
+@@ -1726,7 +1821,9 @@ virCgroupGetMemorySoftLimit(virCgroupPtr group, unsigned long long *kb)
+ int
+ virCgroupSetMemSwapHardLimit(virCgroupPtr group, unsigned long long kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ setMemSwapHardLimit, -1, kb);
+ }
+
+@@ -1742,7 +1839,9 @@ virCgroupSetMemSwapHardLimit(virCgroupPtr group, unsigned long long kb)
+ int
+ virCgroupGetMemSwapHardLimit(virCgroupPtr group, unsigned long long *kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ getMemSwapHardLimit, -1, kb);
+ }
+
+@@ -1758,7 +1857,9 @@ virCgroupGetMemSwapHardLimit(virCgroupPtr group, unsigned long long *kb)
+ int
+ virCgroupGetMemSwapUsage(virCgroupPtr group, unsigned long long *kb)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_MEMORY,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_MEMORY,
+ getMemSwapUsage, -1, kb);
+ }
+
+@@ -1774,7 +1875,9 @@ virCgroupGetMemSwapUsage(virCgroupPtr group, unsigned long long *kb)
+ int
+ virCgroupSetCpusetMems(virCgroupPtr group, const char *mems)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUSET,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUSET,
+ setCpusetMems, -1, mems);
+ }
+
+@@ -1790,7 +1893,9 @@ virCgroupSetCpusetMems(virCgroupPtr group, const char *mems)
+ int
+ virCgroupGetCpusetMems(virCgroupPtr group, char **mems)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUSET,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUSET,
+ getCpusetMems, -1, mems);
+ }
+
+@@ -1806,7 +1911,9 @@ virCgroupGetCpusetMems(virCgroupPtr group, char **mems)
+ int
+ virCgroupSetCpusetMemoryMigrate(virCgroupPtr group, bool migrate)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUSET,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUSET,
+ setCpusetMemoryMigrate, -1, migrate);
+ }
+
+@@ -1822,7 +1929,9 @@ virCgroupSetCpusetMemoryMigrate(virCgroupPtr group, bool migrate)
+ int
+ virCgroupGetCpusetMemoryMigrate(virCgroupPtr group, bool *migrate)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUSET,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUSET,
+ getCpusetMemoryMigrate, -1, migrate);
+ }
+
+@@ -1838,7 +1947,9 @@ virCgroupGetCpusetMemoryMigrate(virCgroupPtr group, bool *migrate)
+ int
+ virCgroupSetCpusetCpus(virCgroupPtr group, const char *cpus)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUSET,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUSET,
+ setCpusetCpus, -1, cpus);
+ }
+
+@@ -1854,7 +1965,9 @@ virCgroupSetCpusetCpus(virCgroupPtr group, const char *cpus)
+ int
+ virCgroupGetCpusetCpus(virCgroupPtr group, char **cpus)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUSET,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUSET,
+ getCpusetCpus, -1, cpus);
+ }
+
+@@ -1869,7 +1982,9 @@ virCgroupGetCpusetCpus(virCgroupPtr group, char **cpus)
+ int
+ virCgroupDenyAllDevices(virCgroupPtr group)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_DEVICES,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_DEVICES,
+ denyAllDevices, -1);
+ }
+
+@@ -1890,7 +2005,9 @@ virCgroupDenyAllDevices(virCgroupPtr group)
+ int
+ virCgroupAllowAllDevices(virCgroupPtr group, int perms)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_DEVICES,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_DEVICES,
+ allowAllDevices, -1, perms);
+ }
+
+@@ -1910,7 +2027,9 @@ int
+ virCgroupAllowDevice(virCgroupPtr group, char type, int major, int minor,
+ int perms)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_DEVICES,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_DEVICES,
+ allowDevice, -1, type, major, minor, perms);
+ }
+
+@@ -1936,6 +2055,7 @@ virCgroupAllowDevicePath(virCgroupPtr group,
+ bool ignoreEacces)
+ {
+ struct stat sb;
++ virCgroupPtr parent = virCgroupGetNested(group);
+
+ if (stat(path, &sb) < 0) {
+ if (errno == EACCES && ignoreEacces)
+@@ -1950,7 +2070,7 @@ virCgroupAllowDevicePath(virCgroupPtr group,
+ if (!S_ISCHR(sb.st_mode) && !S_ISBLK(sb.st_mode))
+ return 1;
+
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_DEVICES,
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_DEVICES,
+ allowDevice, -1,
+ S_ISCHR(sb.st_mode) ? 'c' : 'b',
+ major(sb.st_rdev),
+@@ -1974,7 +2094,9 @@ int
+ virCgroupDenyDevice(virCgroupPtr group, char type, int major, int minor,
+ int perms)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_DEVICES,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_DEVICES,
+ denyDevice, -1, type, major, minor, perms);
+ }
+
+@@ -2000,6 +2122,7 @@ virCgroupDenyDevicePath(virCgroupPtr group,
+ bool ignoreEacces)
+ {
+ struct stat sb;
++ virCgroupPtr parent = virCgroupGetNested(group);
+
+ if (stat(path, &sb) < 0) {
+ if (errno == EACCES && ignoreEacces)
+@@ -2014,7 +2137,7 @@ virCgroupDenyDevicePath(virCgroupPtr group,
+ if (!S_ISCHR(sb.st_mode) && !S_ISBLK(sb.st_mode))
+ return 1;
+
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_DEVICES,
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_DEVICES,
+ denyDevice, -1,
+ S_ISCHR(sb.st_mode) ? 'c' : 'b',
+ major(sb.st_rdev),
+@@ -2282,7 +2405,9 @@ virCgroupGetCpuShares(virCgroupPtr group, unsigned long long *shares)
+ int
+ virCgroupSetCpuCfsPeriod(virCgroupPtr group, unsigned long long cfs_period)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPU,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPU,
+ setCpuCfsPeriod, -1, cfs_period);
+ }
+
+@@ -2298,7 +2423,9 @@ virCgroupSetCpuCfsPeriod(virCgroupPtr group, unsigned long long cfs_period)
+ int
+ virCgroupGetCpuCfsPeriod(virCgroupPtr group, unsigned long long *cfs_period)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPU,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPU,
+ getCpuCfsPeriod, -1, cfs_period);
+ }
+
+@@ -2315,7 +2442,9 @@ virCgroupGetCpuCfsPeriod(virCgroupPtr group, unsigned long long *cfs_period)
+ int
+ virCgroupSetCpuCfsQuota(virCgroupPtr group, long long cfs_quota)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPU,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPU,
+ setCpuCfsQuota, -1, cfs_quota);
+ }
+
+@@ -2323,7 +2452,9 @@ virCgroupSetCpuCfsQuota(virCgroupPtr group, long long cfs_quota)
+ int
+ virCgroupGetCpuacctPercpuUsage(virCgroupPtr group, char **usage)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUACCT,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUACCT,
+ getCpuacctPercpuUsage, -1, usage);
+ }
+
+@@ -2669,7 +2800,9 @@ virCgroupKillPainfully(virCgroupPtr group)
+ int
+ virCgroupGetCpuCfsQuota(virCgroupPtr group, long long *cfs_quota)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPU,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPU,
+ getCpuCfsQuota, -1, cfs_quota);
+ }
+
+@@ -2677,7 +2810,9 @@ virCgroupGetCpuCfsQuota(virCgroupPtr group, long long *cfs_quota)
+ int
+ virCgroupGetCpuacctUsage(virCgroupPtr group, unsigned long long *usage)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUACCT,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUACCT,
+ getCpuacctUsage, -1, usage);
+ }
+
+@@ -2686,7 +2821,9 @@ int
+ virCgroupGetCpuacctStat(virCgroupPtr group, unsigned long long *user,
+ unsigned long long *sys)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_CPUACCT,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPUACCT,
+ getCpuacctStat, -1, user, sys);
+ }
+
+@@ -2694,7 +2831,9 @@ virCgroupGetCpuacctStat(virCgroupPtr group, unsigned long long *user,
+ int
+ virCgroupSetFreezerState(virCgroupPtr group, const char *state)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_FREEZER,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_FREEZER,
+ setFreezerState, -1, state);
+ }
+
+@@ -2702,7 +2841,9 @@ virCgroupSetFreezerState(virCgroupPtr group, const char *state)
+ int
+ virCgroupGetFreezerState(virCgroupPtr group, char **state)
+ {
+- VIR_CGROUP_BACKEND_CALL(group, VIR_CGROUP_CONTROLLER_FREEZER,
++ virCgroupPtr parent = virCgroupGetNested(group);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_FREEZER,
+ getFreezerState, -1, state);
+ }
+
+@@ -2712,10 +2853,11 @@ virCgroupBindMount(virCgroupPtr group, const char *oldroot,
+ const char *mountopts)
+ {
+ size_t i;
++ virCgroupPtr parent = virCgroupGetNested(group);
+
+ for (i = 0; i < VIR_CGROUP_BACKEND_TYPE_LAST; i++) {
+- if (group->backends[i] &&
+- group->backends[i]->bindMount(group, oldroot, mountopts) < 0) {
++ if (parent->backends[i] &&
++ parent->backends[i]->bindMount(parent, oldroot, mountopts) < 0) {
+ return -1;
+ }
+ }
+@@ -2730,10 +2872,11 @@ int virCgroupSetOwner(virCgroupPtr cgroup,
+ int controllers)
+ {
+ size_t i;
++ virCgroupPtr parent = virCgroupGetNested(cgroup);
+
+ for (i = 0; i < VIR_CGROUP_BACKEND_TYPE_LAST; i++) {
+- if (cgroup->backends[i] &&
+- cgroup->backends[i]->setOwner(cgroup, uid, gid, controllers) < 0) {
++ if (parent->backends[i] &&
++ parent->backends[i]->setOwner(parent, uid, gid, controllers) < 0) {
+ return -1;
+ }
+ }
+@@ -2752,7 +2895,9 @@ int virCgroupSetOwner(virCgroupPtr cgroup,
+ bool
+ virCgroupSupportsCpuBW(virCgroupPtr cgroup)
+ {
+- VIR_CGROUP_BACKEND_CALL(cgroup, VIR_CGROUP_CONTROLLER_CPU,
++ virCgroupPtr parent = virCgroupGetNested(cgroup);
++
++ VIR_CGROUP_BACKEND_CALL(parent, VIR_CGROUP_CONTROLLER_CPU,
+ supportsCpuBW, false);
+ }
+
+@@ -2760,10 +2905,11 @@ int
+ virCgroupHasEmptyTasks(virCgroupPtr cgroup, int controller)
+ {
+ size_t i;
++ virCgroupPtr parent = virCgroupGetNested(cgroup);
+
+ for (i = 0; i < VIR_CGROUP_BACKEND_TYPE_LAST; i++) {
+- if (cgroup->backends[i]) {
+- int rc = cgroup->backends[i]->hasEmptyTasks(cgroup, controller);
++ if (parent->backends[i]) {
++ int rc = parent->backends[i]->hasEmptyTasks(parent, controller);
+ if (rc <= 0)
+ return rc;
+ }
+@@ -3565,6 +3711,7 @@ virCgroupFree(virCgroupPtr *group)
+ VIR_FREE((*group)->unified.mountPoint);
+ VIR_FREE((*group)->unified.placement);
+ VIR_FREE((*group)->unitName);
++ VIR_FREE((*group)->nested);
+
+ VIR_FREE((*group)->path);
+ VIR_FREE(*group);
+@@ -3577,9 +3724,12 @@ virCgroupDelThread(virCgroupPtr cgroup,
+ int idx)
+ {
+ virCgroupPtr new_cgroup = NULL;
++ virCgroupPtr parent = NULL;
+
+ if (cgroup) {
+- if (virCgroupNewThread(cgroup, nameval, idx, false, &new_cgroup) < 0)
++ parent = virCgroupGetNested(cgroup);
++
++ if (virCgroupNewThread(parent, nameval, idx, false, &new_cgroup) < 0)
+ return -1;
+
+ /* Remove the offlined cgroup */
+diff --git a/src/util/vircgrouppriv.h b/src/util/vircgrouppriv.h
+index b4a9e0b379..104d74e4d7 100644
+--- a/src/util/vircgrouppriv.h
++++ b/src/util/vircgrouppriv.h
+@@ -69,8 +69,12 @@ struct _virCgroup {
+ virCgroupV2Controller unified;
+
+ char *unitName;
++ virCgroupPtr nested;
+ };
+
++#define virCgroupGetNested(cgroup) \
++ (cgroup->nested ? cgroup->nested : cgroup)
++
+ #define virCgroupSetValueDBus(unitName, key, ...) \
+ ({ \
+ int __ret = -1; \
+diff --git a/src/util/vircgroupv1.c b/src/util/vircgroupv1.c
+index 57d617cb69..49a2cb023e 100644
+--- a/src/util/vircgroupv1.c
++++ b/src/util/vircgroupv1.c
+@@ -338,6 +338,8 @@ virCgroupV1DetectPlacement(virCgroupPtr group,
+
+ for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) {
+ const char *typestr = virCgroupV1ControllerTypeToString(i);
++ g_autofree char* placement = NULL;
++ char *tmp = NULL;
+
+ if (!virCgroupV1MountOptsMatchController(controllers, typestr))
+ continue;
+@@ -348,17 +350,24 @@ virCgroupV1DetectPlacement(virCgroupPtr group,
+ if (group->legacy[i].placement)
+ continue;
+
++ /* On systemd we create a nested cgroup for some cgroup tasks
++ * but the placement should point to the root cgroup. */
++ placement = g_strdup(selfpath);
++ tmp = g_strrstr(placement, "/libvirt");
++ if (tmp)
++ *tmp = '\0';
++
+ /*
+ * selfpath == "/" + path="" -> "/"
+ * selfpath == "/libvirt.service" + path == "" -> "/libvirt.service"
+ * selfpath == "/libvirt.service" + path == "foo" -> "/libvirt.service/foo"
+ */
+ if (i == VIR_CGROUP_CONTROLLER_SYSTEMD) {
+- group->legacy[i].placement = g_strdup(selfpath);
++ group->legacy[i].placement = g_strdup(placement);
+ } else {
+- bool delim = STREQ(selfpath, "/") || STREQ(path, "");
++ bool delim = STREQ(placement, "/") || STREQ(path, "");
+
+- group->legacy[i].placement = g_strdup_printf("%s%s%s", selfpath,
++ group->legacy[i].placement = g_strdup_printf("%s%s%s", placement,
+ delim ? "" : "/",
+ path);
+ }
+diff --git a/src/util/vircgroupv2.c b/src/util/vircgroupv2.c
+index d15e2354cf..a14fc669fb 100644
+--- a/src/util/vircgroupv2.c
++++ b/src/util/vircgroupv2.c
+@@ -210,6 +210,12 @@ virCgroupV2DetectPlacement(virCgroupPtr group,
+ if (tmp)
+ *tmp = '\0';
+
++ /* On systemd we create a nested cgroup for some cgroup tasks
++ * but the placement should point to the root cgroup. */
++ tmp = g_strrstr(placement, "/libvirt");
++ if (tmp)
++ *tmp = '\0';
++
+ /*
+ * selfpath == "/" + path="" -> "/"
+ * selfpath == "/libvirt.service" + path == "" -> "/libvirt.service"
+--
+2.30.0
+
diff --git a/SOURCES/libvirt-vircgroup-introduce-virCgroupV1Exists-and-virCgroupV2Exists.patch b/SOURCES/libvirt-vircgroup-introduce-virCgroupV1Exists-and-virCgroupV2Exists.patch
new file mode 100644
index 0000000..c73bf43
--- /dev/null
+++ b/SOURCES/libvirt-vircgroup-introduce-virCgroupV1Exists-and-virCgroupV2Exists.patch
@@ -0,0 +1,129 @@
+From f835b834d7922bed1ccda35885e42ab7c3f4a70f Mon Sep 17 00:00:00 2001
+Message-Id: