[PATCH v2] [TCK] [REPOST] nwfilter: apply filters and check firewall rules

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Any comments regarding this patch?

V2:
 - Following Daniel Berrange's suggestions
   - if LIBVIRT_TCK_CONFIG is set, read the last occurrence of "^uri/s=" and assign the value to LIBVIRT_URI
   - check that LIBVIRT_URI is set to qemu:///system, otherwise skip test
   - if allowed, remove all VMs and nwfilters starting with tck-
   - rename all VMs and nwfilters created by this test program to start with 'tck-'
 - other:
   - terminate if sourcing the test-lib.sh from libvirt's tests dir is missing (would need to be copied)
   - redirect stderr to stdout whereever output is read into a variable

This is a patch I previously posted for use in the tests/ directory of libvirt. Now I ported it to the TCK project and extended the script with output in the Test Anything Protocol (TAP) format. It now allows multiple output formats chosen via command line parameter supporting TAP (--tap-test), the output format used in the libvirt tests directory (the '.' and '!') (--libvirt-test) and one where all tests are displayed (--verbose).

The program basically creates a filter called tck-testcase and two VMs where one of them references the tck-testcase filter and the other a filter called nwfiltertestfilter. The tck-testcase filter is then subsequently modified and the effect on iptables,ebtables and ip6tables verified against expected output for both VMs. The VMs are torn down at the end and the test filters removed.


Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxx>

---
 scripts/nwfilter/100-apply-verify.t                              |   10 
 scripts/nwfilter/nwfilter2vmtest.sh                              |  635 ++++++++++
 scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall         |   28 
 scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall              |   26 
 scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall        |   32 
 scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall             |   30 
 scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall             |    9 
 scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall       |   24 
 scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall        |   28 
 scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall             |   26 
 scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall        |   68 +
 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall  |   23 
 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall |   23 
 scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall |   23 
 scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall            |   23 
 scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall          |   26 
 scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall            |   26 
 scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall              |   12 
 scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall |   19 
 scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall            |   13 
 scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall             |   12 
 scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall            |    9 
 scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall       |   28 
 scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall            |   26 
 scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall        |   28 
 scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall             |   26 
 scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat           |   73 +
 scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall        |   28 
 scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall             |   26 
 scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall    |   28 
 scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall         |   26 
 scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml              |   19 
 scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml                   |   18 
 scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml             |   19 
 scripts/nwfilter/nwfilterxml2xmlin/all-test.xml                  |   18 
 scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml                  |   33 
 scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml            |   12 
 scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml             |   19 
 scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml                  |   18 
 scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml             |   56 
 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml       |   15 
 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml      |   15 
 scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml      |   10 
 scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml                 |   18 
 scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml               |   19 
 scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml                 |   18 
 scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml                   |   34 
 scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml      |   14 
 scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml                 |   43 
 scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml                  |   23 
 scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml                 |   33 
 scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml             |   18 
 scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml                  |    4 
 scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml            |   22 
 scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml                 |   22 
 scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml             |   22 
 scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml                  |   22 
 scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml             |   22 
 scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml                  |   22 
 scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml         |   19 
 scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml              |   18 
 61 files changed, 2059 insertions(+)

Index: libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilter2vmtest.sh
@@ -0,0 +1,635 @@
+#!/bin/bash
+
+ORIG_IFNAME="vnet0"
+ATTACH_IFNAME="attach0"
+TESTFILTERNAME="nwfiltertestfilter"
+TESTVM2FWALLDATA="nwfilterxml2fwallout/testvm.fwall.dat"
+
+
+LIBVIRTD=`type -P ${PWD}/../daemon/libvirtd`
+if [ "x${LIBVIRTD}x" == "xx" ]; then
+    LIBVIRTD=`type -P libvirtd`
+fi
+
+VIRSH=`type -P ${PWD}/../tools/virsh`
+if [ "x${VIRSH}x" == "xx" ]; then
+    VIRSH=`type -P virsh`
+fi
+
+LD_LIBRARY_PATH="${PWD}../src/.libs/"
+
+uri="qemu:///system"
+if [ "x${LIBVIRT_TCK_CONFIG}x" != "xx" ]; then
+     uri_exp=`cat ${LIBVIRT_TCK_CONFIG} | grep "^uri\s*=" | tail -n 1`
+     if [ "x${uri_exp}x" != "xx" ]; then
+         eval ${uri_exp}
+     fi
+fi
+LIBVIRT_URI=${uri}
+
+# Maybe no libvirtd was built
+[ -z ${LIBVIRTD} ] && exit 0;
+
+FLAG_WAIT="$((1<<0))"
+FLAG_ATTACH="$((1<<1))"
+FLAG_VERBOSE="$((1<<2))"
+FLAG_LIBVIRT_TEST="$((1<<3))"
+FLAG_TAP_TEST="$((1<<4))"
+
+failctr=0
+passctr=0
+attachfailctr=0
+attachctr=0
+
+TAP_FAIL_LIST=""
+TAP_FAIL_CTR=0
+TAP_TOT_CTR=0
+
+function usage() {
+  local cmd="$0"
+cat <<EOF
+Usage: ${cmd} [--help|-h|-?] [--noattach] [--wait] [--verbose]
+              [--libvirt-test] [--tap-test]
+
+Options:
+ --help,-h,-?   : Display this help screen.
+ --noattach     : Skip tests that attach and detach a network interface
+ --wait         : Wait for the user to press the enter key once an error
+                  was detected
+ --verbose      : Verbose output
+ --libvirt-test : Use the libvirt test output format
+ --tap-test     : TAP format output
+
+This test will create two virtual machines. The one virtual machine
+will use a filter called '${TESTFILTERNAME}', and reference the filter
+'clean-traffic' which should be available by default with every install.
+The other virtual machine will reference the filter 'tck-testcase' and will
+have its filter permanently updated.
+EOF
+}
+
+
+function tap_fail() {
+  echo "not ok $1 - ${2:0:66}"
+  TAP_FAIL_LIST+="$1 "
+  ((TAP_FAIL_CTR++))
+  ((TAP_TOT_CTR++))
+}
+
+function tap_pass() {
+  echo "ok $1 - ${2:0:70}"
+  ((TAP_TOT_CTR++))
+}
+
+function tap_final() {
+  local okay
+
+  [ -n "${TAP_FAIL_LIST}" ] && echo "FAILED tests ${TAP_FAIL_LIST}"
+
+  okay=`echo "($TAP_TOT_CTR-$TAP_FAIL_CTR)*100/$TAP_TOT_CTR" | bc -l`
+  echo "Failed ${TAP_FAIL_CTR}/${TAP_TOT_CTR} tests, ${okay:0:5}% okay"
+}
+
+# A wrapper for mktemp in case it does not exist
+# Echos the name of a temporary file.
+function mktmpfile() {
+  local tmp
+  type -P mktemp > /dev/null
+  if [ $? -eq 0 ]; then
+    tmp=$(mktemp -t nwfvmtest.XXXXXX)
+    echo ${tmp}
+  else
+    while :; do
+      tmp="/tmp/nwfvmtest.${RANDOM}"
+      if [ ! -f ${tmp} ]; then
+          touch ${tmp}
+          chmod 666 ${tmp}
+          echo ${tmp}
+          break
+      fi
+    done
+  fi
+  return 0
+}
+
+
+function checkExpectedOutput() {
+  local xmlfile="$1"
+  local fwallfile="$2"
+  local ifname="$3"
+  local flags="$4"
+  local skipregex="$5"
+  local regex="s/${ORIG_IFNAME}/${ifname}/g"
+  local cmd line tmpfile tmpfile2 skip
+
+  tmpfile=`mktmpfile`
+  tmpfile2=`mktmpfile`
+
+  exec 4<${fwallfile}
+
+  read <&4
+  line="${REPLY}"
+
+  while [ "x${line}x" != "xx" ]; do
+    cmd=`echo ${line##\#} | sed ${regex}`
+
+    skip=0
+    if [ "x${skipregex}x" != "xx" ]; then
+    	skip=`echo ${cmd} | grep -c -E ${skipregex}`
+    fi
+
+    eval ${cmd} 2>&1 | tee ${tmpfile} 1>/dev/null
+
+    rm ${tmpfile2} 2>/dev/null
+    touch ${tmpfile2}
+
+    while [ 1 ]; do
+      read <&4
+      line="${REPLY}"
+
+      if [ "${line:0:1}" == "#" ] || [ "x${line}x" == "xx"  ]; then
+
+	if [ ${skip} -ne 0 ]; then
+	  break
+	fi
+
+        diff ${tmpfile} ${tmpfile2} >/dev/null
+
+        if [ $? -ne 0 ]; then
+          if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then
+            echo "FAIL ${xmlfile} : ${cmd}"
+            diff ${tmpfile} ${tmpfile2}
+          fi
+          ((failctr++))
+          if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+                echo "tmp files: $tmpfile, $tmpfile2"
+          	echo "Press enter"
+          	read
+          fi
+          [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \
+              test_result $((passctr+failctr)) "" 1
+          [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \
+             tap_fail $((passctr+failctr)) "${xmlfile} : ${cmd}"
+        else
+          ((passctr++))
+          [ $((flags & FLAG_VERBOSE)) -ne 0 ] && \
+              echo "PASS ${xmlfile} : ${cmd}"
+          [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ] && \
+              test_result $((passctr+failctr)) "" 0
+          [ $((flags & FLAG_TAP_TEST)) -ne 0 ] && \
+              tap_pass $((passctr+failctr)) "${xmlfile} : ${cmd}"
+        fi
+
+        break
+
+      fi
+      echo "${line}" | sed ${regex} >> ${tmpfile2}
+    done
+  done
+
+  exec 4>&-
+
+  rm -rf "${tmpfile}" "${tmpfile2}" 2>/dev/null
+}
+
+
+function doTest() {
+  local xmlfile="$1"
+  local fwallfile="$2"
+  local vm1name="$3"
+  local vm2name="$4"
+  local flags="$5"
+  local testnum="$6"
+  local linenums ctr=0
+  local tmpfile b msg rc
+
+  if [ ! -r "${xmlfile}" ]; then
+    echo "FAIL : Cannot access filter XML file ${xmlfile}."
+    return 1
+  fi
+
+  ${VIRSH} nwfilter-define "${xmlfile}" > /dev/null
+
+  checkExpectedOutput "${xmlfile}" "${fwallfile}" "${vm1name}" "${flags}" \
+  	""
+
+  checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+  	"${vm2name}" "${flags}" ""
+
+  if [ $((flags & FLAG_ATTACH)) -ne 0 ]; then
+
+    tmpfile=`mktmpfile`
+
+    b=`{ ${VIRSH} dumpxml ${vm1name} | tr -d "\n"; echo; } | \
+       sed "s/.*\<interface.*source bridge='\([a-zA-Z0-9_]\+\)'.*<\/interface>.*/\1/"`
+
+    cat >>${tmpfile} <<EOF
+<interface type='bridge'>
+  <source bridge='${b}'/>
+  <mac address='52:54:00:11:22:33'/>
+  <target dev='${ATTACH_IFNAME}'/>
+  <filterref filter='tck-testcase'/>
+</interface>
+EOF
+    msg=`${VIRSH} attach-device "${vm1name}" "${tmpfile}" > /dev/null`
+    rc=$?
+
+    ((attachctr++))
+
+    if [ $rc -eq 0 ]; then
+      checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \
+        "${flags}" "(PRE|POST)ROUTING"
+      checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+        "${vm2name}" "${flags}" "(PRE|POST)ROUTING"
+      msg=`${VIRSH} detach-device "${vm1name}" "${tmpfile}"`
+      if [ $? -ne 0 ]; then
+        echo "FAIL: Detach of interface failed."
+      fi
+    else
+      if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+        # In case of TAP, run the test anyway so we get to the full number
+        # of tests
+        checkExpectedOutput "${xmlfile}" "${fwallfile}" "${ATTACH_IFNAME}" \
+          "${flags}" "" #"(PRE|POST)ROUTING"
+        checkExpectedOutput "${TESTFILTERNAME}" "${TESTVM2FWALLDATA}" \
+          "${vm2name}" "${flags}" #"(PRE|POST)ROUTING"
+      fi
+       
+      ((attachfailctr++))
+      if [ $((flags & FLAG_VERBOSE)) -ne 0 ]; then
+        echo "FAIL: Could not attach interface to vm ${vm1name}."
+        if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+          echo "Press enter"
+          read
+        fi
+      fi
+    fi
+
+    rm -rf ${tmpfile}
+  fi
+
+  return 0
+}
+
+
+function runTests() {
+  local vm1name="$1"
+  local vm2name="$2"
+  local xmldir="$3"
+  local fwalldir="$4"
+  local flags="$5"
+  local fwallfiles f c
+  local tap_total=0 ctr=0
+
+  pushd ${PWD} > /dev/null
+  cd ${fwalldir}
+  fwallfiles=`ls *.fwall`
+  popd > /dev/null
+
+  if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+    # Need to count the number of total tests
+    for fil in ${fwallfiles}; do
+      c=$(grep -c "^#" ${fwalldir}/${fil})
+      ((tap_total+=c))
+      ((ctr++))
+    done
+    c=$(grep -c "^#" "${TESTVM2FWALLDATA}")
+    ((tap_total+=c*ctr))
+    [ $((flags & FLAG_ATTACH)) -ne 0 ] && ((tap_total*=2))
+    echo "1..${tap_total}"
+  fi
+
+  for fil in ${fwallfiles}; do
+    f=${fil%%.fwall}
+    doTest "${xmldir}/${f}.xml" "${fwalldir}/${fil}" "${vm1name}" \
+           "${vm2name}" "${flags}"
+  done
+
+  if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then
+    test_final $((passctr+failctr)) $failctr
+  elif [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+    tap_final
+  else
+    echo ""
+    echo "Summary: ${failctr} failures, ${passctr} passes,"
+    if [ ${attachctr} -ne 0 ]; then
+      echo "         ${attachfailctr} interface attachment failures with ${attachctr} attempts"
+    fi
+  fi
+}
+
+
+function createVM() {
+  local vmname="$1"
+  local filtername="$2"
+  local ipaddr="$3"
+  local macaddr="$4"
+  local flags="$5"
+  local res
+  local tmpfile='mktmpfile'
+
+  cat > ${tmpfile} << EOF
+  <domain type='kvm'>
+    <name>${vmname}</name>
+    <memory>32768</memory>
+    <currentMemory>32768</currentMemory>
+    <vcpu>1</vcpu>
+    <os>
+      <type arch='x86_64' machine='pc-0.11'>hvm</type>
+      <boot dev='hd'/>
+    </os>
+    <features>
+      <acpi/>
+      <apic/>
+    </features>
+    <clock offset='utc'/>
+    <on_poweroff>destroy</on_poweroff>
+    <on_reboot>restart</on_reboot>
+    <on_crash>destroy</on_crash>
+    <devices>
+      <emulator>/usr/bin/qemu-kvm</emulator>
+      <interface type='bridge'>
+        <mac address='${macaddr}'/>
+        <source bridge='virbr0'/>
+        <filterref filter='${filtername}'>
+          <parameter name='IP' value='${ipaddr}'/>
+        </filterref>
+        <target dev='${vmname}'/>
+      </interface>
+      <console type='pty'>
+      </console>
+      <input type='mouse' bus='ps2'/>
+      <graphics type='vnc' port='-1' autoport='yes'/>
+    </devices>
+  </domain>
+EOF
+
+  res=$(${VIRSH} define ${tmpfile})
+  if [ $? -ne 0 ]; then
+    echo "Could not define VM ${vmname} : ${res}"
+    return 1
+  fi
+
+  res=$(${VIRSH} start ${vmname})
+  if [ $? -ne 0 ]; then
+    echo "Could not start VM ${vmname} : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    $(${VIRSH} undefine ${vmname})
+    return 1
+  fi
+
+  [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Created VM ${vmname}."
+
+  rm -rf ${tmpfile}
+
+  return 0
+}
+
+
+function destroyVM() {
+  local vmname="$1"
+  local flags="$2"
+  local res
+
+  res=$(${VIRSH} destroy ${vmname})
+  if [ $? -ne 0 ]; then
+    echo "Could not destroy VM ${vmname} : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    return 1
+  fi
+
+  res=$(${VIRSH} undefine ${vmname})
+  if [ $? -ne 0 ]; then
+    echo "Could not undefine VM ${vmname} : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    return 1
+  fi
+
+  [ $((flags & FLAG_VERBOSE)) -ne 0 ] && echo "Destroyed VM ${vmname}."
+
+  return 0
+}
+
+
+function createTestFilters() {
+  local flags="$1"
+  local tmpfile=`mktmpfile`
+  local res
+
+  cat >${tmpfile} << EOF
+<filter name="${TESTFILTERNAME}">
+  <filterref filter='clean-traffic'/>
+
+  <rule action='drop' direction='inout' priority='1000'>
+    <all/>
+  </rule>
+
+  <rule action='drop' direction='inout' priority='1000'>
+    <all-ipv6/>
+  </rule>
+</filter>
+EOF
+  res=$(${VIRSH} nwfilter-define ${tmpfile})
+  if [ $? -ne 0 ]; then
+    echo "Could not define filter : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    rm -rf ${tmpfile}
+    return 1
+  fi
+
+  cat >${tmpfile} << EOF
+<filter name="tck-testcase">
+</filter>
+EOF
+  res=$(${VIRSH} nwfilter-define ${tmpfile})
+  if [ $? -ne 0 ]; then
+    echo "Could not define filter : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    rm -rf ${tmpfile}
+    return 1
+  fi
+
+  rm -rf ${tmpfile}
+
+  return 0
+}
+
+
+function deleteTestFilter() {
+  local flags="$1"
+  local res
+
+  res=$(${VIRSH} nwfilter-undefine ${TESTFILTERNAME} 2>&1)
+  if [ $? -ne 0 ]; then
+    echo "Could not undefine filter : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    return 1
+  fi
+  res=$(${VIRSH} nwfilter-undefine tck-testcase 2>&1)
+  if [ $? -ne 0 ]; then
+    echo "Could not undefine filter : ${res}"
+    if [ $((flags & FLAG_WAIT)) -ne 0 ]; then
+      echo "Press enter."
+      read
+    fi
+    return 1
+  fi
+  return 0
+}
+
+
+function main() {
+  local prgname="$0"
+  local vm1 vm2
+  local xmldir="nwfilterxml2xmlin"
+  local fwalldir="nwfilterxml2fwallout"
+  local found=0 vms res
+  local filtername="tck-testcase"
+  local libvirtdpid=-1
+  local flags OPWD
+
+  ((flags=${FLAG_ATTACH}))
+
+  while [ $# -ne 0 ]; do
+    case "$1" in
+    --help|-h|-\?) usage ${prgname}; exit 0;;
+    --noattach)     ((flags ^= FLAG_ATTACH  ));;
+    --wait)         ((flags |= FLAG_WAIT    ));;
+    --verbose)      ((flags |= FLAG_VERBOSE ));;
+    --libvirt-test) ((flags |= FLAG_LIBVIRT_TEST ));;
+    --tap-test)     ((flags |= FLAG_TAP_TEST ));;
+    *) usage ${prgname}; exit 1;;
+    esac
+    shift 1
+  done
+
+  if [ `uname` != "Linux" ]; then
+    echo "This script will only run on Linux."
+    exit 1;
+  fi
+
+  if [ $((flags & FLAG_TAP_TEST)) -ne 0 ]; then
+    if [ "${LIBVIRT_URI}" != "qemu:///system" ]; then
+        echo "1..0 # Skipped: Only valid for Qemu system driver"
+        exit 0
+    fi
+
+    for name in `virsh nwfilter-list | awk '{print $2}'`
+    do
+      case ${name} in
+      tck*)
+        if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then
+          res=$(virsh nwfilter-undefine ${name} 2>&1)
+          if [ $? -ne 0 ]; then
+            echo "Bail out! Could not undefine nwfiler ${name}: ${res}"
+            exit 0
+          fi
+        else
+          echo "Bail out! Filter ${name} already exists, use --force to clean"
+          exit 1
+        fi
+      esac
+    done
+
+    for name in `virsh nwfilter-list | awk '{print $2}'`
+    do
+      case ${name} in
+      tck*)
+        if [ "x${LIBVIRT_TCK_AUTOCLEAN}" == "x1" ]; then
+          res=$(virsh undefine ${name} 2>&1)
+          if [ $? -ne 0 ]; then
+            echo "Bail out! Could not undefine domain ${name}: ${res}"
+            exit 1
+          fi
+        else
+          echo "Bail out! Domain ${name} already exists, use --force to clean"
+          exit 1
+        fi
+      esac
+    done
+  fi
+
+  if [ $((flags & FLAG_LIBVIRT_TEST)) -ne 0 ]; then
+    pushd ${PWD} > /dev/null
+    . test-lib.sh
+    if [ $? -ne 0 ]; then
+        exit 1
+    fi
+    test_intro $this_test
+    popd > /dev/null
+  fi
+
+  res=$(${VIRSH} capabilities 2>&1)
+
+  if [ $? -ne 0 ]; then
+      if [ "x${LIBVIRTD}x" == "xx" ]; then
+         echo "Cannot find libvirtd. Exiting."
+         exit 1
+      fi
+
+      rm -rf pid-file 2>/dev/null
+      ${LIBVIRTD} --pid-file=pid-file 2>/dev/null 1>/dev/null &
+      libvirtdpid=$!
+      sleep 2
+
+      res=$(${VIRSH} capabilities 2>&1)
+      if [ $? -ne 0 ]; then
+      	  echo "Could not start the libvirt daemon : $res"
+      	  echo "Exiting."
+      	  exit 1
+      fi
+  fi
+
+  vm1="tck-testvm${RANDOM}"
+  vm2="tck-testvm${RANDOM}"
+
+  createTestFilters "${flags}"
+  if [ $? -ne 0 ]; then
+  	exit 1;
+  fi
+
+  createVM "${vm1}" "tck-testcase" "10.2.2.2" "52:54:0:0:0:1" "${flags}"
+  if [ $? -ne 0 ]; then
+  	echo "Could not create VM ${vm1}. Exiting."
+  	exit 1
+  fi
+
+  createVM "${vm2}" "${TESTFILTERNAME}" "10.1.1.1" "52:54:0:9f:33:da" \
+           "${flags}"
+  if [ $? -ne 0 ]; then
+  	echo "Could not create VM ${vm2}. Exiting."
+  	destroyVM "${vm1}" "${flags}"
+  	exit 1
+  fi
+
+  runTests "${vm1}" "${vm2}" "${xmldir}" "${fwalldir}" "${flags}"
+
+  destroyVM "${vm1}" "${flags}"
+  destroyVM "${vm2}" "${flags}"
+  deleteTestFilter "${flags}"
+
+  [ ${libvirtdpid} -ge 0 ] && kill -9 ${libvirtdpid}
+  rm -rf pid-file 2>/dev/null
+
+  return 0
+}
+
+main "$@"
Index: libvirt-tck/scripts/nwfilter/100-apply-verify.t
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/100-apply-verify.t
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+pwd=$(dirname $0)
+
+pushd ${PWD} > /dev/null
+
+cd ${pwd}
+bash ./nwfilter2vmtest.sh --tap-test --noattach
+
+popd > /dev/null
\ No newline at end of file
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/arp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT 
+-p ARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT 
+-p ARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT 
+-p ARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT 
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT 
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/arp-test.xml
@@ -0,0 +1,33 @@
+<filter name='tck-testcase'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          protocolid='arp'
+          dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+          hwtype='12'
+          protocoltype='34'
+          opcode='Request'
+          arpsrcmacaddr='1:2:3:4:5:6'
+          arpdstmacaddr='a:b:c:d:e:f'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          opcode='1' hwtype='255' protocoltype='255'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          opcode='11' hwtype='256' protocoltype='256'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          opcode='65535' hwtype='65535' protocoltype='65535' />
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          opcode='65536' hwtype='65536' protocoltype='65536' />
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/testvm.fwall.dat
@@ -0,0 +1,73 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -j I-vnet0-ipv4
+-p ARP -j I-vnet0-arp
+-p 0x8035 -j I-vnet0-rarp
+-p 0x835 -j ACCEPT 
+-j DROP 
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -j O-vnet0-ipv4
+-p ARP -j O-vnet0-arp
+-p 0x8035 -j O-vnet0-rarp
+-j DROP 
+#ebtables -t nat -L I-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$"
+-s ! 52:54:0:9f:33:da -j DROP 
+-p IPv4 --ip-src ! 10.1.1.1 -j DROP 
+#ebtables -t nat -L O-vnet0-ipv4 | grep -v "^Bridge" | grep -v "^$"
+-j ACCEPT 
+#ebtables -t nat -L I-vnet0-arp | grep -v "^Bridge" | grep -v "^$"
+-s ! 52:54:0:9f:33:da -j DROP 
+-p ARP --arp-mac-src ! 52:54:0:9f:33:da -j DROP 
+-p ARP --arp-ip-src ! 10.1.1.1 -j DROP 
+-p ARP --arp-op Request -j ACCEPT 
+-p ARP --arp-op Reply -j ACCEPT 
+-j DROP 
+#ebtables -t nat -L O-vnet0-arp | grep -v "^Bridge" | grep -v "^$"
+-p ARP --arp-op Reply --arp-mac-dst ! 52:54:0:9f:33:da -j DROP 
+-p ARP --arp-ip-dst ! 10.1.1.1 -j DROP 
+-p ARP --arp-op Request -j ACCEPT 
+-p ARP --arp-op Reply -j ACCEPT 
+-j DROP 
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all      ::/0                 ::/0                
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all      ::/0                 ::/0                
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " " 
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+              dstipaddr='a:b:c::d:e:f' dstipmask='128'
+              srcipaddr='f:e:d::c:b:a' srcipmask='127'
+              dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+              srcipaddr='a:b:c::' srcipmask='128'
+              dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <ah-ipv6 srcmacaddr='1:2:3:4:5:6'
+              srcipaddr='::10.1.2.3' srcipmask='129'
+              dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ah-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <ah  srcmacaddr='1:2:3:4:5:6'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <ah  srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='22'
+          dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <ah  srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='22'
+          dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+               dstipaddr='a:b:c::d:e:f' dstipmask='128'
+               srcipaddr='f:e:d::c:b:a' srcipmask='127'
+               dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='a:b:c::' srcipmask='128'
+               dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <all-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='::10.1.2.3' srcipmask='129'
+               dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/all-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <all  srcmacaddr='1:2:3:4:5:6'
+           dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+           dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <all  srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='22'
+           dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <all  srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='22'
+           dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/conntrack-test.xml
@@ -0,0 +1,12 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>0a5288ea-612c-834a-6bbf-82a03a1a3244</uuid>
+  <rule action='drop' direction='out' priority='500'>
+    <icmp connlimit-above='1'/>
+  </rule>
+  <rule action='drop' direction='out' priority='500'>
+    <tcp connlimit-above='2'/>
+  </rule>
+  <rule action='accept' direction='out' priority='500'>
+    <all/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               dstipaddr='a:b:c::d:e:f' dstipmask='128'
+               srcipaddr='f:e:d::c:b:a' srcipmask='127'
+               dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='a:b:c::' srcipmask='128'
+               dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <esp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='::10.1.2.3' srcipmask='129'
+               dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/esp-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <esp srcmacaddr='1:2:3:4:5:6'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <esp srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='22'
+          dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <esp srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='22'
+          dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/hex-data-test.xml
@@ -0,0 +1,56 @@
+<filter name='tck-testcase'>
+  <uuid>01a992d2-f8c8-7c27-f69b-ab0a9d377379</uuid>
+
+  <rule action='accept' direction='in'>
+    <mac protocolid='0x1234'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <ip  srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+          srcipaddr='10.1.2.3' srcipmask='255.255.255.255'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          protocol='udp'
+          srcportstart='0x123' srcportend='0x234'
+          dstportstart='0x3456' dstportend='0x4567'
+          dscp='0x32'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
+           dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
+           srcipaddr='::10.1.2.3' srcipmask='22'
+           dstipaddr='::10.1.2.3'
+           dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
+           protocol='tcp'
+           srcportstart='0x111' srcportend='400'
+           dstportstart='0x3333' dstportend='65535'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <arp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+          hwtype='0x12'
+          protocoltype='0x56'
+          opcode='Request'
+          arpsrcmacaddr='1:2:3:4:5:6'
+          arpdstmacaddr='a:b:c:d:e:f'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <udp srcmacaddr='1:2:3:4:5:6'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          dscp='0x22'
+          srcportstart='0x123' srcportend='400'
+          dstportstart='0x234' dstportend='0x444'/>
+  </rule>
+
+  <rule action='accept' direction='in'>
+     <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='a:b:c::' srcipmask='128'
+               dscp='0x40'
+               srcportstart='0x20' srcportend='0x21'
+               dstportstart='0x100' dstportend='0x1111'/>
+  </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction-test.xml
@@ -0,0 +1,15 @@
+<filter name='tck-testcase'>
+    <uuid>f4b3f745-d23d-2ee6-218a-d5671611229b</uuid>
+    <!-- allow incoming ICMP Echo Reply -->
+    <rule action='accept' direction='in' priority='500'>
+        <icmp type='0'/>
+    </rule>
+    <!-- allow outgoing ICMP Echo Request -->
+    <rule action='accept' direction='out' priority='500'>
+        <icmp type='8'/>
+    </rule>
+    <!-- drop all other ICMP traffic -->
+    <rule action='drop' direction='inout' priority='600'>
+        <icmp/>
+    </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction2-test.xml
@@ -0,0 +1,15 @@
+<filter name='tck-testcase'>
+    <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+    <!-- allow incoming ICMP Echo Request -->
+    <rule action='accept' direction='in' priority='500'>
+        <icmp type='8'/>
+    </rule>
+    <!-- allow outgoing ICMP Echo Reply -->
+    <rule action='accept' direction='out' priority='500'>
+        <icmp type='0'/>
+    </rule>
+    <!-- drop all other ICMP traffic -->
+    <rule action='drop' direction='inout' priority='600'>
+        <icmp/>
+    </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-direction3-test.xml
@@ -0,0 +1,10 @@
+<filter name='tck-testcase'>
+    <uuid>d6b1a2af-def6-2898-9f8d-4a74e3c39558</uuid>
+    <rule action='accept' direction='out' priority='500'>
+        <icmp/>
+    </rule>
+    <!-- drop all other traffic -->
+    <rule action='drop' direction='inout' priority='600'>
+        <all/>
+    </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmp-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <icmp srcmacaddr='1:2:3:4:5:6'
+           dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+           dscp='2' type='12' code='11'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <icmp srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='22'
+           dscp='33' type='255' code='255'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <icmp srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='22'
+           dscp='33' type='256' code='256'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/icmpv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <icmpv6 srcmacaddr='1:2:3:4:5:6'
+             dstipaddr='a:b:c::d:e:f' dstipmask='128'
+             srcipaddr='f:e:d::c:b:a' srcipmask='127'
+             dscp='2' type='12' code='11'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <icmpv6 srcmacaddr='1:2:3:4:5:6'
+             srcipaddr='a:b:c::' srcipmask='128'
+             dscp='33' type='255' code='255'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <icmpv6 srcmacaddr='1:2:3:4:5:6'
+             srcipaddr='::10.1.2.3' srcipmask='129'
+             dscp='33' type='256' code='256'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/igmp-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <igmp srcmacaddr='1:2:3:4:5:6'
+           dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+           dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <igmp srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='22'
+           dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <igmp srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='22'
+           dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ip-test.xml
@@ -0,0 +1,34 @@
+<filter name='tck-testcase'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <ip  srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+          dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+          srcipaddr='10.1.2.3' srcipmask='255.255.255.255'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          protocol='udp'
+          srcportstart='20' srcportend='22'
+          dstportstart='100' dstportend='101'
+      />
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <ip  srcipaddr='10.1.2.3' srcipmask='255.255.128.0'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.0'
+          protocol='17' dscp='63'
+      />
+  </rule>
+
+  <rule action='accept' direction='in'>
+     <ip  srcipaddr='10.1.2.3' srcipmask='255.255.255.254'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.128'
+          protocol='255' dscp='64'
+      />
+  </rule>
+
+  <rule action='accept' direction='inout'>
+     <ip  srcipaddr='10.1.2.3' srcipmask='255.255.255.127'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.254'
+          protocol='256' dscp='64'
+      />
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipt-no-macspoof-test.xml
@@ -0,0 +1,14 @@
+<filter name='tck-testcase'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='drop' direction='inout'>
+     <!-- should use $MAC for MAC address, but tests would depend on VM's
+          MAC address -->
+     <all match='no' srcmacaddr='12:34:56:78:9a:bc'/>
+  </rule>
+
+  <rule action='drop' direction='in'>
+     <!-- not accepting incoming traffic from a certain MAC address -->
+     <all match='no' srcmacaddr='aa:aa:aa:aa:aa:aa'/>
+  </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ipv6-test.xml
@@ -0,0 +1,43 @@
+<filter name='tck-testcase'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <ipv6 srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:fe'
+           dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:80'
+           srcipaddr='::10.1.2.3' srcipmask='22'
+           dstipaddr='::10.1.2.3'
+           dstipmask='ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000'
+           protocol='udp'
+           srcportstart='20' srcportend='22'
+           dstportstart='100' dstportend='101'
+      />
+  </rule>
+
+  <rule action='accept' direction='inout'>
+     <ipv6 srcipaddr='1::2' srcipmask='128'
+           dstipaddr='a:b:c::'
+           dstipmask='ffff:ffff:ffff:ffff:8000::'
+           protocol='6'
+           srcportstart='20' srcportend='22'
+           dstportstart='100' dstportend='101'
+      />
+  </rule>
+
+  <rule action='accept' direction='inout'>
+     <ipv6 srcipaddr='1::2' srcipmask='128'
+           dstipaddr='a:b:c::'
+           dstipmask='ffff:ffff:ffff:ffff:8000::'
+           protocol='6'
+           srcportstart='255' srcportend='256'
+           dstportstart='65535' dstportend='65536'
+      />
+  </rule>
+
+  <rule action='accept' direction='inout'>
+     <ipv6 srcipaddr='1::2' srcipmask='128'
+           dstipaddr='a:b:c::'
+           dstipmask='ffff:ffff:ffff:ffff:8000::'
+           protocol='18'
+      />
+  </rule>
+
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/mac-test.xml
@@ -0,0 +1,23 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+     protocolid='arp'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+     protocolid='ipv4'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+     protocolid='1536'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+     protocolid='15'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <mac dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+     protocolid='65535'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/rarp-test.xml
@@ -0,0 +1,33 @@
+<filter name='tck-testcase'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+           protocolid='rarp'
+           dstmacaddr='aa:bb:cc:dd:ee:ff' dstmacmask='ff:ff:ff:ff:ff:ff'
+           hwtype='12'
+           protocoltype='34'
+           opcode='Request'
+           arpsrcmacaddr='1:2:3:4:5:6'
+           arpdstmacaddr='a:b:c:d:e:f'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+           opcode='1' hwtype='255' protocoltype='255'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+           opcode='11' hwtype='256' protocoltype='256'/>
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+           opcode='65535' hwtype='65535' protocoltype='65535' />
+  </rule>
+
+  <rule action='accept' direction='out'>
+     <rarp srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+           opcode='65536' hwtype='65536' protocoltype='65536' />
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-rule-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase'>
+  <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid>
+  <filterref filter='clean-traffic'/>
+  <rule action='accept' direction='out'>
+     <mac srcmacaddr='1:2:3:4:5:6' srcmacmask='ff:ff:ff:ff:ff:ff'
+     protocolid='arp'/>
+  </rule>
+  <rule action='accept' direction='out'>
+     <tcp srcmacaddr='1:2:3:4:5:6'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          dscp='2'/>
+  </rule>
+  <rule action='accept' direction='out'>
+     <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               dstipaddr='a:b:c::d:e:f' dstipmask='128'
+               dscp='2'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/ref-test.xml
@@ -0,0 +1,4 @@
+<filter name='tck-testcase'>
+  <uuid>83011800-f663-96d6-8841-fd836b4318c6</uuid>
+  <filterref filter='clean-traffic'/>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+                dstipaddr='a:b:c::d:e:f' dstipmask='128'
+                dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+                srcipaddr='a:b:c::' srcipmask='128'
+                dscp='33'
+                srcportstart='20' srcportend='21'
+                dstportstart='100' dstportend='1111'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <sctp-ipv6 srcmacaddr='1:2:3:4:5:6'
+                srcipaddr='::10.1.2.3' srcipmask='129'
+                dscp='63'
+                srcportstart='255' srcportend='256'
+                dstportstart='65535' dstportend='65536'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/sctp-test.xml
@@ -0,0 +1,22 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <sctp srcmacaddr='1:2:3:4:5:6'
+           dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+           dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <sctp srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='32'
+           dscp='33'
+           srcportstart='20' srcportend='21'
+           dstportstart='100' dstportend='1111'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <sctp srcmacaddr='1:2:3:4:5:6'
+           srcipaddr='10.1.2.3' srcipmask='32'
+           dscp='63'
+           srcportstart='255' srcportend='256'
+           dstportstart='65535' dstportend='65536'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               dstipaddr='a:b:c::d:e:f' dstipmask='128'
+               dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='a:b:c::' srcipmask='128'
+               dscp='33'
+               srcportstart='20' srcportend='21'
+               dstportstart='100' dstportend='1111'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <tcp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='::10.1.2.3' srcipmask='129'
+               dscp='63'
+               srcportstart='255' srcportend='256'
+               dstportstart='65535' dstportend='65536'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/tcp-test.xml
@@ -0,0 +1,22 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <tcp srcmacaddr='1:2:3:4:5:6'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in' statematch='false'>
+     <tcp srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='32'
+          dscp='33'
+          srcportstart='20' srcportend='21'
+          dstportstart='100' dstportend='1111'/>
+  </rule>
+  <rule action='accept' direction='in' statematch='0'>
+     <tcp srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='32'
+          dscp='63'
+          srcportstart='255' srcportend='256'
+          dstportstart='65535' dstportend='65536'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-ipv6-test.xml
@@ -0,0 +1,22 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               dstipaddr='a:b:c::d:e:f' dstipmask='128'
+               dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='a:b:c' srcipmask='128'
+               dscp='33'
+               srcportstart='20' srcportend='21'
+               dstportstart='100' dstportend='1111'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udp-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='::10.1.2.3' srcipmask='129'
+               dscp='63'
+               srcportstart='255' srcportend='256'
+               dstportstart='65535' dstportend='65536'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udp-test.xml
@@ -0,0 +1,22 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <udp srcmacaddr='1:2:3:4:5:6'
+          dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+          dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udp srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='32'
+          dscp='33'
+          srcportstart='20' srcportend='21'
+          dstportstart='100' dstportend='1111'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udp srcmacaddr='1:2:3:4:5:6'
+          srcipaddr='10.1.2.3' srcipmask='32'
+          dscp='63'
+          srcportstart='255' srcportend='256'
+          dstportstart='65535' dstportend='65536'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-ipv6-test.xml
@@ -0,0 +1,19 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+               dstipaddr='a:b:c::d:e:f' dstipmask='128'
+               srcipaddr='f:e:d::c:b:a' srcipmask='127'
+               dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='a:b:c::' srcipmask='128'
+               dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udplite-ipv6 srcmacaddr='1:2:3:4:5:6'
+               srcipaddr='::10.1.2.3' srcipmask='129'
+               dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2xmlin/udplite-test.xml
@@ -0,0 +1,18 @@
+<filter name='tck-testcase' chain='root'>
+  <uuid>5c6d49af-b071-6127-b4ec-6f8ed4b55335</uuid>
+  <rule action='accept' direction='out'>
+     <udplite srcmacaddr='1:2:3:4:5:6'
+              dstipaddr='10.1.2.3' dstipmask='255.255.255.255'
+              dscp='2'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udplite srcmacaddr='1:2:3:4:5:6'
+              srcipaddr='10.1.2.3' srcipmask='22'
+              dscp='33'/>
+  </rule>
+  <rule action='accept' direction='in'>
+     <udplite srcmacaddr='1:2:3:4:5:6'
+              srcipaddr='10.1.2.3' srcipmask='22'
+              dscp='33'/>
+  </rule>
+</filter>
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     ah       f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     ah       ::/0                 a:b:c::/128         DSCP match 0x21state ESTABLISHED 
+RETURN     ah       ::/0                 ::10.1.2.3/128      DSCP match 0x21state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     ah       a:b:c::d:e:f/128     f:e:d::c:b:a/127    DSCP match 0x02state ESTABLISHED 
+ACCEPT     ah       a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     ah       ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     ah       f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     ah       ::/0                 a:b:c::/128         DSCP match 0x21
+ACCEPT     ah       ::/0                 ::10.1.2.3/128      DSCP match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ah-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     ah   --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     ah   --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+RETURN     ah   --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     ah   --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     ah   --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     ah   --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     ah   --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     ah   --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+ACCEPT     ah   --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-ipv6-test.fwall
@@ -0,0 +1,32 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     all      f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     all      ::/0                 a:b:c::/128         DSCP match 0x21state ESTABLISHED 
+RETURN     all      ::/0                 ::10.1.2.3/128      DSCP match 0x21state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     all      a:b:c::d:e:f/128     f:e:d::c:b:a/127    DSCP match 0x02state ESTABLISHED 
+ACCEPT     all      a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     all      ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     all      f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     all      ::/0                 a:b:c::/128         DSCP match 0x21
+ACCEPT     all      ::/0                 ::10.1.2.3/128      DSCP match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
+#ip6tables -L FORWARD --line-number | grep libvirt
+1    libvirt-in  all      anywhere             anywhere            
+2    libvirt-out  all      anywhere             anywhere            
+3    libvirt-in-post  all      anywhere             anywhere            
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/all-test.fwall
@@ -0,0 +1,30 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     all  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     all  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+RETURN     all  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     all  --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     all  --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     all  --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     all  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     all  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+ACCEPT     all  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
+#iptables -L FORWARD --line-number | grep libvirt
+1    libvirt-in  all  --  anywhere             anywhere            
+2    libvirt-out  all  --  anywhere             anywhere            
+3    libvirt-in-post  all  --  anywhere             anywhere            
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/conntrack-test.fwall
@@ -0,0 +1,24 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           #conn/32 > 1 
+DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           #conn/32 > 2 
+RETURN     all  --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           #conn/32 > 1 
+DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           #conn/32 > 2 
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     esp      f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     esp      ::/0                 a:b:c::/128         DSCP match 0x21state ESTABLISHED 
+RETURN     esp      ::/0                 ::10.1.2.3/128      DSCP match 0x21state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     esp      a:b:c::d:e:f/128     f:e:d::c:b:a/127    DSCP match 0x02state ESTABLISHED 
+ACCEPT     esp      a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     esp      ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     esp      f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     esp      ::/0                 a:b:c::/128         DSCP match 0x21
+ACCEPT     esp      ::/0                 ::10.1.2.3/128      DSCP match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 |tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/esp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     esp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     esp  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+RETURN     esp  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     esp  --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     esp  --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     esp  --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     esp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     esp  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+ACCEPT     esp  --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/hex-data-test.fwall
@@ -0,0 +1,68 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-tos 0x32 --ip-proto udp --ip-sport 291:564 --ip-dport 13398:17767 -j ACCEPT 
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto tcp --ip6-sport 273:400 --ip6-dport 13107:65535 -j ACCEPT 
+-p ARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 18 --arp-ptype 0x56 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT 
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p 0x1234 -j ACCEPT 
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     udp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 state NEW,ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udp  --  10.1.2.3             0.0.0.0/0           DSCP match 0x22udp spts:564:1092 dpts:291:400 state ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x22udp spts:291:400 dpts:564:1092 
+#iptables -L libvirt-host-in -n | grep HI-vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep FI-vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     tcp      ::/0                 a:b:c::/128         tcp spts:256:4369 dpts:32:33 state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     tcp      a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 tcp spts:32:33 dpts:256:4369 state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     tcp      ::/0                 a:b:c::/128         tcp spts:256:4369 dpts:32:33 
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 state NEW,ESTABLISHED 
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0 state NEW,ESTABLISHED 
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction2-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0 state NEW,ESTABLISHED 
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 state NEW,ESTABLISHED 
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0 
+DROP       icmp --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-direction3-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     icmp --  0.0.0.0/0            0.0.0.0/0           state NEW,ESTABLISHED 
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           state ESTABLISHED 
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmp-test.fwall
@@ -0,0 +1,23 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     icmp --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 state NEW,ESTABLISHED 
+RETURN     icmp --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21icmp type 255 code 255 state NEW,ESTABLISHED 
+ACCEPT     icmp --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmp --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02icmp type 12 code 11 
+ACCEPT     icmp --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/icmpv6-test.fwall
@@ -0,0 +1,26 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     icmpv6    f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 state NEW,ESTABLISHED 
+RETURN     icmpv6    ::/0                 ::10.1.2.3/128      DSCP match 0x21state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmpv6    a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21ipv6-icmp type 255 code 255 state NEW,ESTABLISHED 
+ACCEPT     icmpv6    ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     icmpv6    f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02ipv6-icmp type 12 code 11 
+ACCEPT     icmpv6    ::/0                 ::10.1.2.3/128      DSCP match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/igmp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     2    --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     2    --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+RETURN     2    --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     2    --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     2    --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     2    --  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     2    --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     2    --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+ACCEPT     2    --  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ip-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --ip-src 10.1.2.3 --ip-dst 10.1.2.3 --ip-proto udp --ip-sport 20:22 --ip-dport 100:101 -j ACCEPT 
+-p IPv4 --ip-src 10.1.0.0/17 --ip-dst 10.1.2.0/24 --ip-tos 0x3F --ip-proto udp -j ACCEPT 
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.3 -j ACCEPT 
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 --ip-src 10.1.2.2/31 --ip-dst 10.1.2.0/25 --ip-proto 255 -j ACCEPT 
+-p IPv4 --ip-src 10.1.2.3 --ip-dst 10.1.2.2/31 -j ACCEPT 
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipt-no-macspoof-test.fwall
@@ -0,0 +1,19 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           MAC ! 12:34:56:78:9A:BC 
+DROP       all  --  0.0.0.0/0            0.0.0.0/0           MAC ! AA:AA:AA:AA:AA:AA 
+#iptables -L HI-vnet0
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/ipv6-test.fwall
@@ -0,0 +1,13 @@
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv6 -s 1:2:3:4:5:6/ff:ff:ff:ff:ff:fe -d aa:bb:cc:dd:ee:80/ff:ff:ff:ff:ff:80 --ip6-src ::/ffff:fc00:: --ip6-dst ::10.1.0.0/ffff:ffff:ffff:ffff:ffff:ffff:ffff:8000 --ip6-proto udp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT 
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 100:101 --ip6-dport 20:22 -j ACCEPT 
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto tcp --ip6-sport 65535 --ip6-dport 255:256 -j ACCEPT 
+-p IPv6 --ip6-src a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-dst 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-proto mux -j ACCEPT 
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 20:22 --ip6-dport 100:101 -j ACCEPT 
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto tcp --ip6-sport 255:256 --ip6-dport 65535 -j ACCEPT 
+-p IPv6 --ip6-src 1::2/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff --ip6-dst a:b:c::/ffff:ffff:ffff:ffff:8000:: --ip6-proto mux -j ACCEPT 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/mac-test.fwall
@@ -0,0 +1,12 @@
+#ebtables -t nat -L PREROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$"
+-i vnet0 -j libvirt-I-vnet0
+#ebtables -t nat -L POSTROUTING | grep vnet0 | grep -v "^Bridge" | grep -v "^$"
+-o vnet0 -j libvirt-O-vnet0
+#ebtables -t nat -L libvirt-I-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p ARP -s 1:2:3:4:5:6 -j ACCEPT 
+#ebtables -t nat -L libvirt-O-vnet0 | grep -v "^Bridge" | grep -v "^$"
+-p IPv4 -d aa:bb:cc:dd:ee:ff -j ACCEPT 
+-p 0x600 -d aa:bb:cc:dd:ee:ff -j ACCEPT 
+-d aa:bb:cc:dd:ee:ff -j ACCEPT 
+-p 0xffff -d aa:bb:cc:dd:ee:ff -j ACCEPT 
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/rarp-test.fwall
@@ -0,0 +1,9 @@
+#ebtables -t nat -L libvirt-I-vnet0 | sed s/0x8035/RARP/g | grep -v "^Bridge" | grep -v "^$"
+-p RARP -s 1:2:3:4:5:6 -d aa:bb:cc:dd:ee:ff --arp-op Request --arp-htype 12 --arp-ptype 0x22 --arp-mac-src 1:2:3:4:5:6 --arp-mac-dst a:b:c:d:e:f -j ACCEPT 
+-p RARP -s 1:2:3:4:5:6 --arp-op Request --arp-htype 255 --arp-ptype 0xff -j ACCEPT 
+-p RARP -s 1:2:3:4:5:6 --arp-op 11 --arp-htype 256 --arp-ptype 0x100 -j ACCEPT 
+-p RARP -s 1:2:3:4:5:6 --arp-op 65535 --arp-htype 65535 --arp-ptype 0xffff -j ACCEPT 
+-p RARP -s 1:2:3:4:5:6 -j ACCEPT 
+#ebtables -t nat -L PREROUTING | grep vnet0
+-i vnet0 -j libvirt-I-vnet0
+
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     sctp     ::/0                 a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     sctp     ::/0                 a:b:c::/128         DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED 
+RETURN     sctp     ::/0                 ::10.1.2.3/128      DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     sctp     a:b:c::d:e:f/128     ::/0                DSCP match 0x02state ESTABLISHED 
+ACCEPT     sctp     a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED 
+ACCEPT     sctp     ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     sctp     ::/0                 a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     sctp     ::/0                 a:b:c::/128         DSCP match 0x21sctp spts:100:1111 dpts:20:21 
+ACCEPT     sctp     ::/0                 ::10.1.2.3/128      DSCP match 0x3fsctp spt:65535 dpts:255:256 
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/sctp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     sctp --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     sctp --  0.0.0.0/0            10.1.2.3            DSCP match 0x21sctp spts:100:1111 dpts:20:21 state ESTABLISHED 
+RETURN     sctp --  0.0.0.0/0            10.1.2.3            DSCP match 0x3fsctp spt:65535 dpts:255:256 state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     sctp --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     sctp --  10.1.2.3             0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21sctp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED 
+ACCEPT     sctp --  10.1.2.3             0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x3fsctp spts:255:256 dpt:65535 state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     sctp --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     sctp --  0.0.0.0/0            10.1.2.3            DSCP match 0x21sctp spts:100:1111 dpts:20:21 
+ACCEPT     sctp --  0.0.0.0/0            10.1.2.3            DSCP match 0x3fsctp spt:65535 dpts:255:256 
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     tcp      ::/0                 a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     tcp      ::/0                 a:b:c::/128         DSCP match 0x21tcp spts:100:1111 dpts:20:21 state ESTABLISHED 
+RETURN     tcp      ::/0                 ::10.1.2.3/128      DSCP match 0x3ftcp spt:65535 dpts:255:256 state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     tcp      a:b:c::d:e:f/128     ::/0                DSCP match 0x02state ESTABLISHED 
+ACCEPT     tcp      a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED 
+ACCEPT     tcp      ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     tcp      ::/0                 a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     tcp      ::/0                 a:b:c::/128         DSCP match 0x21tcp spts:100:1111 dpts:20:21 
+ACCEPT     tcp      ::/0                 ::10.1.2.3/128      DSCP match 0x3ftcp spt:65535 dpts:255:256 
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/tcp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     tcp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     tcp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x21tcp spts:100:1111 dpts:20:21 
+RETURN     tcp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x3ftcp spt:65535 dpts:255:256 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     tcp  --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     tcp  --  10.1.2.3             0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21tcp spts:20:21 dpts:100:1111 
+ACCEPT     tcp  --  10.1.2.3             0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x3ftcp spts:255:256 dpt:65535 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     tcp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     tcp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x21tcp spts:100:1111 dpts:20:21 
+ACCEPT     tcp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x3ftcp spt:65535 dpts:255:256 
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     udp      ::/0                 a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     udp      ::/0                 ::/0                DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED 
+RETURN     udp      ::/0                 ::10.1.2.3/128      DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udp      a:b:c::d:e:f/128     ::/0                DSCP match 0x02state ESTABLISHED 
+ACCEPT     udp      ::/0                 ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED 
+ACCEPT     udp      ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udp      ::/0                 a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     udp      ::/0                 ::/0                DSCP match 0x21udp spts:100:1111 dpts:20:21 
+ACCEPT     udp      ::/0                 ::10.1.2.3/128      DSCP match 0x3fudp spt:65535 dpts:255:256 
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udp-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     udp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     udp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x21udp spts:100:1111 dpts:20:21 state ESTABLISHED 
+RETURN     udp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x3fudp spt:65535 dpts:255:256 state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udp  --  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     udp  --  10.1.2.3             0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21udp spts:20:21 dpts:100:1111 state NEW,ESTABLISHED 
+ACCEPT     udp  --  10.1.2.3             0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x3fudp spts:255:256 dpt:65535 state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udp  --  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     udp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x21udp spts:100:1111 dpts:20:21 
+ACCEPT     udp  --  0.0.0.0/0            10.1.2.3            DSCP match 0x3fudp spt:65535 dpts:255:256 
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-ipv6-test.fwall
@@ -0,0 +1,28 @@
+#ip6tables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     udplite    f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     udplite    ::/0                 a:b:c::/128         DSCP match 0x21state ESTABLISHED 
+RETURN     udplite    ::/0                 ::10.1.2.3/128      DSCP match 0x21state ESTABLISHED 
+#ip6tables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udplite    a:b:c::d:e:f/128     f:e:d::c:b:a/127    DSCP match 0x02state ESTABLISHED 
+ACCEPT     udplite    a:b:c::/128          ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     udplite    ::10.1.2.3/128       ::/0                MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#ip6tables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udplite    f:e:d::c:b:a/127     a:b:c::d:e:f/128    MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     udplite    ::/0                 a:b:c::/128         DSCP match 0x21
+ACCEPT     udplite    ::/0                 ::10.1.2.3/128      DSCP match 0x21
+#ip6tables -L INPUT -n --line-numbers | grep libvirt
+1    libvirt-host-in  all      ::/0                 ::/0                
+#ip6tables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all      ::/0                 ::/0                PHYSDEV match --physdev-in vnet0 
+#ip6tables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all ::/0 ::/0 [goto] PHYSDEV match --physdev-out vnet0 
Index: libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall
===================================================================
--- /dev/null
+++ libvirt-tck/scripts/nwfilter/nwfilterxml2fwallout/udplite-test.fwall
@@ -0,0 +1,26 @@
+#iptables -L FI-vnet0 -n
+Chain FI-vnet0 (1 references)
+target     prot opt source               destination         
+RETURN     udplite--  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02state NEW,ESTABLISHED 
+RETURN     udplite--  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+RETURN     udplite--  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21state ESTABLISHED 
+#iptables -L FO-vnet0 -n
+Chain FO-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udplite--  10.1.2.3             0.0.0.0/0           DSCP match 0x02state ESTABLISHED 
+ACCEPT     udplite--  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+ACCEPT     udplite--  10.1.0.0/22          0.0.0.0/0           MAC 01:02:03:04:05:06 DSCP match 0x21state NEW,ESTABLISHED 
+#iptables -L HI-vnet0 -n
+Chain HI-vnet0 (1 references)
+target     prot opt source               destination         
+ACCEPT     udplite--  0.0.0.0/0            10.1.2.3            MAC 01:02:03:04:05:06 DSCP match 0x02
+ACCEPT     udplite--  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+ACCEPT     udplite--  0.0.0.0/0            10.1.0.0/22         DSCP match 0x21
+#iptables -L libvirt-host-in -n | grep vnet0 | tr -s " "
+HI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in -n | grep vnet0 | tr -s " "
+FI-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-in-post -n | grep vnet0
+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           PHYSDEV match --physdev-in vnet0 
+#iptables -L libvirt-out -n | grep vnet0 | tr -s " "
+FO-vnet0 all -- 0.0.0.0/0 0.0.0.0/0 [goto] PHYSDEV match --physdev-out vnet0 


--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list


[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]