From nobody Thu Nov 12 15:08:46 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1793106631; cv=none; d=zohomail.com; s=zohoarc; b=n8DbjqJubiKfYk3WE316leBE22Es6zPNYzf3Fd+81VMZuJ0KRxyzEgL65QEJpGJGcAauNsMp7i1werm4vsCqAWbpLA7qlYL4LOymmvFFmCEYK4HdavpxtmlvxAUhblTtjp8o0M3hfMs+e829tklA2brsdrjRLNjEK3XmEBhG4/Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793106631; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=3CnLrAiM/D6ycjg1ds9/wv3W0hGPLjd3PA4NVeuZE/U=; b=Cke6O3y1erMUlh+fYo/g8b8ta3/xqZy3cnQkqnWjJvldUgdJpinTl83X2cNWmjuTThO3bNPGJN0YWqccwodjSDaDjVXH/VL0tsaMbTx+VO6t8MXzzp+0cIxyiKv3oMw2eA+XJXS0QN1XVdy3BQGwDedx5mvt0gop1KITnk2xX5E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1793106631469315.5397186646344; Tue, 27 Oct 2026 06:10:31 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 0E6AC41B01; Tue, 27 Oct 2026 09:10:29 -0400 (EDT) Received: from [172.19.199.19] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id C9DA241C4B; Tue, 27 Oct 2026 09:07:55 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 2831E3F339; Tue, 27 Oct 2026 09:07:39 -0400 (EDT) Received: from mail-ej1-x62f.google.com (mail-ej1-x62f.google.com [IPv6:2a00:1450:4864:20::62f]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 0F6673F33F for ; Tue, 27 Oct 2026 09:07:37 -0400 (EDT) Received: by mail-ej1-x62f.google.com with SMTP id a640c23a62f3a-c43fbcb4393so580710966b.0 for ; Tue, 27 Oct 2026 06:07:37 -0700 (PDT) Received: from thikiepadje ([2a01:7c8:7c8:f866:12::1009]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c46bd34f465sm446917066b.8.2026.10.27.06.07.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Oct 2026 06:07:36 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793106457; x=1793711257; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3CnLrAiM/D6ycjg1ds9/wv3W0hGPLjd3PA4NVeuZE/U=; b=nO66j3ch/RsWce9u0eAULYAZINm/6ylylB2vJtWdCvYbb8rwhgrnZajzgdgVxJRJNZ 4aIKZKMU/sRu0usyqlaQyQBtCxIonnFebQIHYmOPHqZg/dA+Yr8f46UEbtN2OEyUzEzI mRqDYksE0iVLTlrtMpW6X8GZqlbdChgzm5paOI3y4JhmAQz98L/tMeMZUckFdrmE2WCc Xa5i3haenz8b/JWr9cYT6AIIf8A0lDLUNalvaIPqYTbbTtOe75MsSaGARadCKdYfG/t+ JH5FjH7jXwJ1NZKcWIHNcfN0WiBYnKB+NHlMa3urXtYAlRmpEH9Fh8cJw6TtSC8CBETY DAUw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793106457; x=1793711257; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=3CnLrAiM/D6ycjg1ds9/wv3W0hGPLjd3PA4NVeuZE/U=; b=Q8x8gVwKBK5fHgN2T9ilxmyVQtUZ7sX+HdUI04z9XrwpGJFYcfkwyH+6JvtO8yn60K +E1WWBWwvpLfWzCmSLDUkLciGb0qX5ApgidCftppezSOAvEAcpCjtaBMeYSpNp3GLQHe 6L0k/GBzXKF55QxT+iLzzvNFU0X5KnAgHkaQEFzNm2bDgpauKv7YPm9jCZ49CFa3f9nY xc8sAXS3phiVmhndtKe6yCf89718q/uAf3GCFa1JP9w3pGV2bEyZTgEyIVu7tz+fQ7Yl STG2TAbMUvCifwEdNfUMlsRbq5JrO5EcYttF9l4ijpWlo89z88vwYeWqQgNW9udH3Gez Xeyw== X-Gm-Message-State: AFq9FYIh/aLbZoqxL7IjU4Irn5tyTVWT/t4rgd7W0elpdqJm7GJcqT6D PY+HuRq8if47NZNUTGMnTwfv2VrJmwMijo1xA8NKi5n3Kd4kh0lVcGMeKF42 X-Gm-Gg: AYBFou3Kk2GYVOhD7XDJdTh59QmdptSJWBtgIesIHtOPUIkyRgUzuSY8SpgEA8yJtAm npPyXhWOwbKYf083IUDcNoU6QLXu+Pd7nSc5LxpSJDko3rS9HVZXUMm+LVcCB00KtrmOWT6p0hQ 9saUkg2hj5RPehShYyp9EVKMRPZ3e93VVxjsq7/zDPEJzuYPtUeQxfOmThOgEs5h97D2jt3A1+j jvhAQN7gYHRAiYRFgCYPd4QkrNFpuwha8yD/GymnQhF/dUpfGeyUAezr+KtBtCB5dFEb6TGDPxO PgxlYo1haqTIZAN9yJ7sdZ5iFe7SFoNgEw82lIiQezTgxAbVbyrJhi34ipfaDs4s1FzMxyRagNg a2vsqst8G7/eWEL/xZcffcGWLPpnG4M/bW7NwfphBMaHenDEHKJAJlGHAPFf2/gjaxRwq8VTPZb jgXilBt3u3F2T0etfBD2AbFs78+GcaEWYSwk9zd4fp+5DNCiCpejztnFO8xjD5ol+eD/nGhZEx5 NxaLRTTWX2m/kuKnyiorK87i6pui+d9bMf0anNXzDVYL2FXdQ== X-Received: by 2002:a17:907:9624:b0:c21:1b58:fa96 with SMTP id a640c23a62f3a-c46bdacd5aemr1056921166b.3.1793106456496; Tue, 27 Oct 2026 06:07:36 -0700 (PDT) From: Dion Bosschieter To: devel@lists.libvirt.org Subject: [PATCH 1/1] nwfilter: add default accept to nftables subchains Date: Tue, 27 Oct 2026 14:02:59 +0100 Message-ID: <20261027130259.2135676-2-dionbosschieter@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261027130259.2135676-1-dionbosschieter@gmail.com> References: <20261027130259.2135676-1-dionbosschieter@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: AHEGEQDEXHX3BQIKIV5PAX3CY6NIV7TT X-Message-ID-Hash: AHEGEQDEXHX3BQIKIV5PAX3CY6NIV7TT X-MailFrom: dionbosschieter@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: jean-louis@dupond.be, Dion Bosschieter X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1793106633031158501 Content-Type: text/plain; charset="utf-8" In ebtables a subchain was created with a default accept When converted to nftables, this resulted in an "accept" at the end of each subchain: chain O-v100562794-mac { ether daddr 52:54:00:a3:13:87 counter packets 9 bytes 1145 return ether daddr 33:33:00:00:00:00/16 counter packets 48 bytes 3712 return ether daddr ff:ff:ff:ff:ff:ff counter packets 22 bytes 924 return counter packets 3 bytes 384 drop >>>> counter packets 0 bytes 0 accept } In order to mimick this behavior we add an "accept" for each subchain by calling nftablesCreateSubChainAccept after having created all of the fw rul= es Signed-off-by: Dion Bosschieter --- src/nwfilter/nwfilter_nftables_driver.c | 60 +++++++++++++++++-- .../stp-linux.nftables.args | 14 +++++ 2 files changed, 69 insertions(+), 5 deletions(-) diff --git a/src/nwfilter/nwfilter_nftables_driver.c b/src/nwfilter/nwfilte= r_nftables_driver.c index a72c51472f..79bd987325 100644 --- a/src/nwfilter/nwfilter_nftables_driver.c +++ b/src/nwfilter/nwfilter_nftables_driver.c @@ -80,9 +80,9 @@ static bool trace_enabled; =20 #define SAME_IP_SET_NAME "same-ip-set" =20 -#define ROOT_CHAINSETTINGS(chain, defaultPolicy) \ +#define ROOT_CHAINSETTINGS(chain) \ "{ type filter hook "chain" priority %d;" \ - " policy "defaultPolicy"; %s }" + " policy "DEFAULT_POLICY"; %s }" =20 VIR_LOG_INIT("nwfilter.nwfilter_nftables_driver"); =20 @@ -183,12 +183,12 @@ static void nftablesCreateTable(virFirewall *fw, fwrule =3D virFirewallAddCmd(fw, layer, "add", "chain", "bridge", tableName, IN_CHAIN, NULL); virFirewallCmdAddArgFormat(fw, fwrule, - ROOT_CHAINSETTINGS(IN_CHAIN, DEFAULT_POLICY= ), + ROOT_CHAINSETTINGS(IN_CHAIN), tablePriority, traceSetting); fwrule =3D virFirewallAddCmd(fw, layer, "add", "chain", "bridge", tableName, OUT_CHAIN, NULL); virFirewallCmdAddArgFormat(fw, fwrule, - ROOT_CHAINSETTINGS(OUT_CHAIN, DEFAULT_POLIC= Y), + ROOT_CHAINSETTINGS(OUT_CHAIN), tablePriority, traceSetting); =20 /* add the one jump rule based on the vmap */ @@ -1825,7 +1825,7 @@ nftablesRuleInstCommand(virFirewall *fw, * nftablesCreateSubChain: * @fw: the firewall ruleset instance * @layer: the firewall layer - * @ifname : The name of the interface to apply the chain to + * @nftablesTableName : The name of the table to create the chain on * @chainPrefix: The prefix to put on the beginning of the name of the cha= in * @protoidx: Protocol id for conditional jump * @rootChain: The chain to define the jump on @@ -1871,6 +1871,41 @@ nftablesCreateSubChain(virFirewall *fw, virFirewallCmdAddArgList(fw, fwrule, "jump", chain, NULL); } =20 +/* + * nftablesCreateSubChainAccept: + * @fw: the firewall ruleset instance + * @layer: the firewall layer + * @nftablesTableName : The name of the table to create the chain on + * @chainPrefix: The prefix to put on the beginning of the name of the cha= in + * @chainPostfix: The postfix to put at the end of the name of the chain + * + * To comply with what nwfilter ipebtables was doing for ethernet subchains + * we need to end with an accept on a subchain, to follow the nwfilter ipe= btables logic + * on ebtables, subchains have an ACCEPT, which means, that if the end of = the chain + * is reached, the packet will be accepted, not returned + * Ebtables chains look as follows if translated to nftables: + * chain O-v100562794-ipv6 { + * ether type ip6 icmpv6 type 133 counter packets 0 bytes 0 drop + * ether type ip6 ether type ip6 meta l4proto ipv6-icmp counter packet= s 54 bytes 4368 accept + * ether type ip6 ip6 daddr 2a01:7c8:fffe:3::/64 counter packets 0 byt= es 0 accept + * counter packets 3 bytes 489 accept + * } + * + * The accept at the bottom has not been provided by the user, it got adde= d by translating ebtables to nftables + */ +static void nftablesCreateSubChainAccept(virFirewall *fw, + virFirewallLayer layer, + const char *nftablesTableName, + const char *chainPrefix, + const char *chainPostfix) +{ + char chain[MAX_NF_CHAINNAME_LENGTH]; + g_snprintf(chain, sizeof(chain), "%s-%s", chainPrefix, chainPostfix); + + virFirewallAddCmd(fw, layer, "add", "rule", "bridge", + nftablesTableName, chain, "accept", NULL); +} + static void nftablesCreateRootChainJump(virFirewall *fw, virFirewallLayer layer, @@ -2165,6 +2200,21 @@ nftablesHandleCreateChains(virFirewall *fw, goto cleanup; } =20 + /* create subchain accepts */ + /* to comply with what nwfilter ipebtables was doing for ethernet subc= hains + * we need to finally accept on a subchain, to follow the nwfilter ipe= btables logic + * on ebtables, subchains have an ACCEPT, which means, that if the end= of the chain + * is reached, the packet will be accepted, not returned + */ + for (i =3D 0; i < nchains; i++) { + if (chains[i]->ethernetInChain) + nftablesCreateSubChainAccept(fw, layer, NF_ETHERNET_TABLE, + chains[i]->prefix, "in"); + if (chains[i]->ethernetOutChain) + nftablesCreateSubChainAccept(fw, layer, NF_ETHERNET_TABLE, + chains[i]->prefix, "out"); + } + /* creation of temp jumps is done as libvirt doesn't execute * atomic nft changes (yet) */ nftablesCreateRootChainJump(fw, layer, cbdata->ifname, IN_IFMATCH, diff --git a/tests/nwfilterxml2firewalldata/stp-linux.nftables.args b/tests= /nwfilterxml2firewalldata/stp-linux.nftables.args index 4dabd3cbc2..85ee588a16 100644 --- a/tests/nwfilterxml2firewalldata/stp-linux.nftables.args +++ b/tests/nwfilterxml2firewalldata/stp-linux.nftables.args @@ -111,6 +111,20 @@ nft \ add \ rule \ bridge \ +libvirt_nwfilter_ethernet \ +n-vnet0-stp-xyz-in \ +accept +nft \ +add \ +rule \ +bridge \ +libvirt_nwfilter_ethernet \ +n-vnet0-stp-xyz-out \ +accept +nft \ +add \ +rule \ +bridge \ libvirt_nwfilter_inet \ postrouting \ oif \ --=20 2.53.0