[libvirt] [PATCH] [TCK] nwfilter: apply filters and check firewall rules

[Daniel P. Berrange]

On Thu, Jun 17, 2010 at 10:50:53AM -0400, Stefan Berger wrote:
> Hi!
> 
> This is a patch I previously posted for use in the tests/ directory of 
> libvirt. Now I ported it to the TCK project and extended the script with 
> output in the Test Anything Protocol (TAP) format. It now allows 
> multiple output formats chosen via command line parameter supporting TAP 
> (--tap-test), the output format used in the libvirt tests directory (the 
> '.' and '!') (--libvirt-test) and one where all tests are displayed 
> (--verbose).
> 
> The program basically creates a filter called testcase and two VMs where 
> one of them references the testcase filter and the other a filter called 
> nwfiltertestfilter. The testcase filter is then subsequently modified 
> and the effect on iptables,ebtables and ip6tables verified against 
> expected output for both VMs. The VMs are torn down at the end and the 
> test filters removed.

Thanks for updating this. I've not been able to test it yet because
my infrastructure is in a mess!

> Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
> ===================================================================
> --- /dev/null
> +++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
> @@ -0,0 +1,581 @@
> +#!/bin/bash
> +
> +ORIG_IFNAME="vnet0"
> +ATTACH_IFNAME="attach0"
> +TESTFILTERNAME="nwfiltertestfilter"
> +TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat"
> +
> +LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd`
> +if [ "x${LIBVIRTD}x" == "xx" ]; then
> +    LIBVIRTD=`type -P libvirtd`
> +fi
> +
> +VIRSH=`type -P ${PWD}/../tools/virsh`
> +if [ "x${VIRSH}x" == "xx" ]; then
> +    VIRSH=`type -P virsh`
> +fi

Since you're not using the Perl framework in this test there's a
couple of things you need to handle manually. The environment
variable $LIBVIRT_TCK_CONFIG  points to the TCK configuration
file. In this file there is a 'uri' parameter that needs to be
used whenever connecting to libvirt. eg  virsh -c $URI

For sake of this test, you can just extract the URI from the
config and do

  if test "$URI" !=  "qemu:///system" ; then
     echo  "1..0 skip  Only valid for QEMU system driver"
     exit 0
  fi

> +
> +    cat >>${tmpfile} <<EOF
> +<interface type='bridge'>
> + <source bridge='${b}'/>
> + <mac address='52:54:00:11:22:33'/>
> + <target dev='${ATTACH_IFNAME}'/>
> + <filterref filter='testcase'/>
> +</interface>
> +EOF

For any filters created, it is best to start them with the name prefix 'tck'

Then as the first thing the test does, it should look to see if  any
filters already exist eg, 

  for name in `virsh nwfilter-list | awk {print $2}`
  do
     case $name in
         tck*)
           if "x$LIBVIRT_TCK_AUTOCLEAN" == "x1"
               virsh nwfilter-undefine $name
            else
               echo "Filter $name already exists, use --force to clean"
          fi
     easc
  done


Likewise for the actual guest domains.

I'll write more feedback when I've had a chance to actually run it

Regards,
Daniel
-- 
|: Red Hat, Engineering, London    -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://deltacloud.org :|
|: http://autobuild.org        -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-   F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|