This way when we implement nftables for the nwfilter driver, we can
create a separate table called "libvirt_nwfilter" and everything will
look all symmetrical and stuff.
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
* the iptables-compat
*/
-#define VIR_NFTABLES_PRIVATE_TABLE "libvirt"
+#define VIR_NFTABLES_PRIVATE_TABLE "libvirt_network"
/* nftables backend uses the same binary (nft) for all layers, but
* IPv4 and IPv6 have their rules in separate classes of tables,
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip6 \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
ip6 \
daddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip6 \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip6 \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip6 \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip6 \
saddr \
-ae insert \
rule \
ip6 \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
ip6 \
daddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
meta \
l4proto \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_PRT \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_INP \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_OUT \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
oifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWX \
iifname \
virbr0 \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWO \
ip \
saddr \
-ae insert \
rule \
ip \
-libvirt \
+libvirt_network \
LIBVIRT_FWI \
ip \
daddr \