From: Stefan Berger <stefanb@us.ibm.com>
Date: Thu, 7 Oct 2010 10:43:35 +0000 (-0400)
Subject: nwfilter: Add test case for testing the state attribute
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=5c6405a0586ae2c30217fb501f5860fa14206985;p=libvirt.git

nwfilter: Add test case for testing the state attribute

This patch adds a test case for testing the XML parser's and instantiator's
support of the state attribute. The other test case tests existing
capabilities. Both test cases will be used in TCK again.
---

diff --git a/tests/nwfilterxml2xmlin/example-1.xml b/tests/nwfilterxml2xmlin/example-1.xml
new file mode 100644
index 0000000000..e8d00ed06e
--- /dev/null
+++ b/tests/nwfilterxml2xmlin/example-1.xml
@@ -0,0 +1,24 @@
+<filter name='testcase'>
+  <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+
+  <!-- allow incoming ssh connections -->
+  <rule action='accept' direction='in' priority='100'>
+    <tcp dstportstart='22'/>
+  </rule>
+
+  <!-- allow incoming ICMP (ping) packets -->
+  <rule action='accept' direction='in' priority='200'>
+    <icmp/>
+  </rule>
+
+  <!-- allow all outgoing traffic -->
+  <rule action='accept' direction='in' priority='300'>
+    <all/>
+  </rule>
+
+  <!-- drop all other traffic -->
+  <rule action='drop' direction='inout' priority='1000'>
+    <all/>
+  </rule>
+
+</filter>
diff --git a/tests/nwfilterxml2xmlin/example-2.xml b/tests/nwfilterxml2xmlin/example-2.xml
new file mode 100644
index 0000000000..112fa0540c
--- /dev/null
+++ b/tests/nwfilterxml2xmlin/example-2.xml
@@ -0,0 +1,37 @@
+<filter name='testcase'>
+  <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+
+  <!-- VM outgoing: allow all established and related connections -->
+  <rule action='accept' direction='out' priority='100'>
+    <all state='ESTABLISHED,RELATED'
+         comment='out: existing and related (ftp) connections'/>
+  </rule>
+
+  <!-- VM incoming: allow all established connections -->
+  <rule action='accept' direction='in' priority='100'>
+    <all state='ESTABLISHED'
+         comment='in: existing connections'/>
+  </rule>
+
+  <!-- allow incoming ssh and ftp traffic -->
+  <rule action='accept' direction='in' priority='200'>
+    <tcp dstportstart='21' dstportend='22' state='NEW'
+         comment='in: ftp and ssh'/>
+  </rule>
+
+  <!-- allow incoming ICMP (ping) packets -->
+  <rule action='accept' direction='in' priority='300'>
+    <icmp state='NEW' comment='in: icmp'/>
+  </rule>
+
+  <!-- allow outgong DNS lookups -->
+  <rule action='accept' direction='out' priority='300'>
+    <udp dstportstart='53' state='NEW' comment='out: DNS lookups'/>
+  </rule>
+
+  <!-- drop all other traffic -->
+  <rule action='drop' direction='inout' priority='1000'>
+    <all comment='inout: drop all non-accepted traffic'/>
+  </rule>
+
+</filter>
diff --git a/tests/nwfilterxml2xmlout/example-1.xml b/tests/nwfilterxml2xmlout/example-1.xml
new file mode 100644
index 0000000000..dd0ef94d9b
--- /dev/null
+++ b/tests/nwfilterxml2xmlout/example-1.xml
@@ -0,0 +1,15 @@
+<filter name='testcase' chain='root'>
+  <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+  <rule action='accept' direction='in' priority='100'>
+    <tcp dstportstart='22'/>
+  </rule>
+  <rule action='accept' direction='in' priority='200'>
+    <icmp/>
+  </rule>
+  <rule action='accept' direction='in' priority='300'>
+    <all/>
+  </rule>
+  <rule action='drop' direction='inout' priority='1000'>
+    <all/>
+  </rule>
+</filter>
diff --git a/tests/nwfilterxml2xmlout/example-2.xml b/tests/nwfilterxml2xmlout/example-2.xml
new file mode 100644
index 0000000000..a3f0bf9b30
--- /dev/null
+++ b/tests/nwfilterxml2xmlout/example-2.xml
@@ -0,0 +1,21 @@
+<filter name='testcase' chain='root'>
+  <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+  <rule action='accept' direction='out' priority='100'>
+    <all state='ESTABLISHED,RELATED' comment='out: existing and related (ftp) connections'/>
+  </rule>
+  <rule action='accept' direction='in' priority='100'>
+    <all state='ESTABLISHED' comment='in: existing connections'/>
+  </rule>
+  <rule action='accept' direction='in' priority='200'>
+    <tcp state='NEW' dstportstart='21' dstportend='22' comment='in: ftp and ssh'/>
+  </rule>
+  <rule action='accept' direction='in' priority='300'>
+    <icmp state='NEW' comment='in: icmp'/>
+  </rule>
+  <rule action='accept' direction='out' priority='300'>
+    <udp state='NEW' dstportstart='53' comment='out: DNS lookups'/>
+  </rule>
+  <rule action='drop' direction='inout' priority='1000'>
+    <all comment='inout: drop all non-accepted traffic'/>
+  </rule>
+</filter>
diff --git a/tests/nwfilterxml2xmltest.c b/tests/nwfilterxml2xmltest.c
index e001e99fe0..3a8001d22c 100644
--- a/tests/nwfilterxml2xmltest.c
+++ b/tests/nwfilterxml2xmltest.c
@@ -126,6 +126,9 @@ mymain(int argc, char **argv)
 
     DO_TEST("comment-test");
 
+    DO_TEST("example-1");
+    DO_TEST("example-2");
+
     return (ret==0 ? EXIT_SUCCESS : EXIT_FAILURE);
 }