Use the name of the chain rather than its type index (enum).
This pushes the later enablement of chains with user-given names
into the XML parser. For now we still only allow those names that
are well known ('root', 'arp', 'rarp', 'ipv4' and 'ipv6').

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

---
 src/conf/nwfilter_conf.c                  |   16 ++++++++++++----
 src/conf/nwfilter_conf.h                  |    2 +-
 src/nwfilter/nwfilter_ebiptables_driver.c |   13 +++++++------
 src/nwfilter/nwfilter_ebiptables_driver.h |    2 +-
 4 files changed, 21 insertions(+), 12 deletions(-)

Index: libvirt-acl/src/conf/nwfilter_conf.c
===================================================================
--- libvirt-acl.orig/src/conf/nwfilter_conf.c
+++ libvirt-acl/src/conf/nwfilter_conf.c
@@ -309,6 +309,7 @@ virNWFilterDefFree(virNWFilterDefPtr def
         virNWFilterEntryFree(def->filterEntries[i]);
 
     VIR_FREE(def->filterEntries);
+    VIR_FREE(def->chainsuffix);
 
     VIR_FREE(def);
 }
@@ -2029,21 +2030,28 @@ virNWFilterDefParseXML(xmlXPathContextPt
         goto cleanup;
     }
 
-    ret->chainsuffix = VIR_NWFILTER_CHAINSUFFIX_ROOT;
     chain = virXPathString("string(./@chain)", ctxt);
     if (chain) {
-        if ((ret->chainsuffix =
-             virNWFilterChainSuffixTypeFromString(chain)) < 0) {
+        if (virNWFilterChainSuffixTypeFromString(chain) < 0) {
             virNWFilterReportError(VIR_ERR_INTERNAL_ERROR,
                                    _("unknown chain suffix '%s'"), chain);
             goto cleanup;
         }
+        ret->chainsuffix = chain;
         /* assign an implicit priority -- support XML attribute later */
         if (intMapGetByString(chain_priorities, chain, 0,
                               &ret->chainPriority) == false) {
             ret->chainPriority = (NWFILTER_MAX_FILTER_PRIORITY +
                                   NWFILTER_MIN_FILTER_PRIORITY) / 2;
         }
+        chain = NULL;
+    } else {
+        ret->chainsuffix = strdup(virNWFilterChainSuffixTypeToString(
+                                  VIR_NWFILTER_CHAINSUFFIX_ROOT));
+        if (ret->chainsuffix == NULL) {
+            virReportOOMError();
+            goto cleanup;
+        }
     }
 
     uuid = virXPathString("string(./uuid)", ctxt);
@@ -2909,7 +2917,7 @@ virNWFilterDefFormat(virNWFilterDefPtr d
 
     virBufferAsprintf(&buf, "<filter name='%s' chain='%s'",
                       def->name,
-                      virNWFilterChainSuffixTypeToString(def->chainsuffix));
+                      def->chainsuffix);
     virBufferAddLit(&buf, ">\n");
 
     virUUIDFormat(def->uuid, uuid);
Index: libvirt-acl/src/conf/nwfilter_conf.h
===================================================================
--- libvirt-acl.orig/src/conf/nwfilter_conf.h
+++ libvirt-acl/src/conf/nwfilter_conf.h
@@ -455,7 +455,7 @@ struct _virNWFilterDef {
     char *name;
     unsigned char uuid[VIR_UUID_BUFLEN];
 
-    int chainsuffix; /*enum virNWFilterChainSuffixType */
+    char *chainsuffix;
     virNWFilterChainPriority chainPriority;
 
     int nentries;
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c
+++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -369,7 +369,7 @@ ebiptablesRuleInstFree(ebiptablesRuleIns
 static int
 ebiptablesAddRuleInst(virNWFilterRuleInstPtr res,
                       char *commandTemplate,
-                      enum virNWFilterChainSuffixType neededChain,
+                      const char *neededChain,
                       virNWFilterChainPriority chainPriority,
                       char chainprefix,
                       unsigned int priority,
@@ -1945,11 +1945,13 @@ ebtablesCreateRuleInstance(char chainPre
         goto err_exit;
     }
 
-    if (nwfilter->chainsuffix == VIR_NWFILTER_CHAINSUFFIX_ROOT)
+    if (STREQ(nwfilter->chainsuffix,
+              virNWFilterChainSuffixTypeToString(
+                  VIR_NWFILTER_CHAINSUFFIX_ROOT)))
         PRINT_ROOT_CHAIN(chain, chainPrefix, ifname);
     else
         PRINT_CHAIN(chain, chainPrefix, ifname,
-                    virNWFilterChainSuffixTypeToString(nwfilter->chainsuffix));
+                    nwfilter->chainsuffix);
 
 
     switch (rule->prtclType) {
@@ -2516,7 +2518,7 @@ ebiptablesDisplayRuleInstance(virConnect
     ebiptablesRuleInstPtr inst = (ebiptablesRuleInstPtr)_inst;
     VIR_INFO("Command Template: '%s', Needed protocol: '%s'",
              inst->commandTemplate,
-             virNWFilterChainSuffixTypeToString(inst->neededProtocolChain));
+             inst->neededProtocolChain);
     return 0;
 }
 
@@ -3447,8 +3449,7 @@ ebiptablesApplyNewRules(virConnectPtr co
     for (i = 0; i < nruleInstances; i++) {
         sa_assert (inst);
         if (inst[i]->ruleType == RT_EBTABLES) {
-            const char *name = virNWFilterChainSuffixTypeToString(
-                                      inst[i]->neededProtocolChain);
+            const char *name = inst[i]->neededProtocolChain;
             if (inst[i]->chainprefix == CHAINPREFIX_HOST_IN_TEMP) {
                 if (virHashUpdateEntry(chains_in_set, name,
                                        &inst[i]->chainPriority)) {
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.h
+++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.h
@@ -35,7 +35,7 @@ typedef struct _ebiptablesRuleInst ebipt
 typedef ebiptablesRuleInst *ebiptablesRuleInstPtr;
 struct _ebiptablesRuleInst {
     char *commandTemplate;
-    enum virNWFilterChainSuffixType neededProtocolChain;
+    const char *neededProtocolChain;
     virNWFilterChainPriority chainPriority;
     char chainprefix;    /* I for incoming, O for outgoing */
     unsigned int priority;