<commit_before>/*
 * nwfilterxml2firewalltest.c: Test iptables rule generation
 *
 * Copyright (C) 2014 Red Hat, Inc.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library.  If not, see
 * <http://www.gnu.org/licenses/>.
 *
 */

#include <config.h>

#if defined (__linux__)

# include "testutils.h"
# include "nwfilter/nwfilter_ebiptables_driver.h"
# include "virbuffer.h"

# define LIBVIRT_VIRFIREWALLPRIV_H_ALLOW
# include "virfirewallpriv.h"

# define LIBVIRT_VIRCOMMANDPRIV_H_ALLOW
# include "vircommandpriv.h"

# define VIR_FROM_THIS VIR_FROM_NONE

# ifdef __linux__
#  define RULESTYPE "linux"
# else
#  error "test case not ported to this platform"
# endif

typedef struct _virNWFilterInst virNWFilterInst;
struct _virNWFilterInst {
    virNWFilterDef **filters;
    size_t nfilters;
    virNWFilterRuleInst **rules;
    size_t nrules;
};

/*
 * Some sets of rules that will be common to all test files,
 * so we don't bother including them in the test data files
 * as that would just bloat them
 */

static const char *commonRules[] = {
    /* Dropping ebtables rules */
    "ebtables \\\n--concurrent \\\n-t nat \\\n-D PREROUTING \\\n-i vnet0 \\\n-j libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-D POSTROUTING \\\n-o vnet0 \\\n-j libvirt-P-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-L libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-L libvirt-P-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-F libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-X libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-F libvirt-P-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-X libvirt-P-vnet0\n",

    /* Creating ebtables chains */
    "ebtables \\\n--concurrent \\\n-t nat \\\n-N libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-N libvirt-P-vnet0\n",

    /* Dropping iptables rules */
    "iptables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "iptables \\\n-w \\\n-F FP-vnet0\n"
    "iptables \\\n-w \\\n-X FP-vnet0\n"
    "iptables \\\n-w \\\n-F FJ-vnet0\n"
    "iptables \\\n-w \\\n-X FJ-vnet0\n"
    "iptables \\\n-w \\\n-F HJ-vnet0\n"
    "iptables \\\n-w \\\n-X HJ-vnet0\n",

    /* Creating iptables chains */
    "iptables \\\n-w \\\n-N libvirt-in\n"
    "iptables \\\n-w \\\n-N libvirt-out\n"
    "iptables \\\n-w \\\n-N libvirt-in-post\n"
    "iptables \\\n-w \\\n-N libvirt-host-in\n"
    "iptables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in\n"
    "iptables \\\n-w \\\n-D FORWARD \\\n-j libvirt-out\n"
    "iptables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in-post\n"
    "iptables \\\n-w \\\n-D INPUT \\\n-j libvirt-host-in\n"
    "iptables \\\n-w \\\n-I FORWARD 1 \\\n-j libvirt-in\n"
    "iptables \\\n-w \\\n-I FORWARD 2 \\\n-j libvirt-out\n"
    "iptables \\\n-w \\\n-I FORWARD 3 \\\n-j libvirt-in-post\n"
    "iptables \\\n-w \\\n-I INPUT 1 \\\n-j libvirt-host-in\n"
    "iptables \\\n-w \\\n-N FP-vnet0\n"
    "iptables \\\n-w \\\n-N FJ-vnet0\n"
    "iptables \\\n-w \\\n-N HJ-vnet0\n"
    "iptables \\\n-w \\\n-A libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "iptables \\\n-w \\\n-A libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "iptables \\\n-w \\\n-A libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n"
    "iptables \\\n-w \\\n-A libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n",

    /* Dropping ip6tables rules */
    "ip6tables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-F FP-vnet0\n"
    "ip6tables \\\n-w \\\n-X FP-vnet0\n"
    "ip6tables \\\n-w \\\n-F FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-X FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-F HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-X HJ-vnet0\n",

    /* Creating ip6tables chains */
    "ip6tables \\\n-w \\\n-N libvirt-in\n"
    "ip6tables \\\n-w \\\n-N libvirt-out\n"
    "ip6tables \\\n-w \\\n-N libvirt-in-post\n"
    "ip6tables \\\n-w \\\n-N libvirt-host-in\n"
    "ip6tables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in\n"
    "ip6tables \\\n-w \\\n-D FORWARD \\\n-j libvirt-out\n"
    "ip6tables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in-post\n"
    "ip6tables \\\n-w \\\n-D INPUT \\\n-j libvirt-host-in\n"
    "ip6tables \\\n-w \\\n-I FORWARD 1 \\\n-j libvirt-in\n"
    "ip6tables \\\n-w \\\n-I FORWARD 2 \\\n-j libvirt-out\n"
    "ip6tables \\\n-w \\\n-I FORWARD 3 \\\n-j libvirt-in-post\n"
    "ip6tables \\\n-w \\\n-I INPUT 1 \\\n-j libvirt-host-in\n"
    "ip6tables \\\n-w \\\n-N FP-vnet0\n"
    "ip6tables \\\n-w \\\n-N FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-N HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-A libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "ip6tables \\\n-w \\\n-A libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-A libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n"
    "ip6tables \\\n-w \\\n-A libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n",

    /* Inserting ebtables rules */
    "ebtables \\\n--concurrent \\\n-t nat \\\n-A PREROUTING \\\n-i vnet0 \\\n-j libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-A POSTROUTING \\\n-o vnet0 \\\n-j libvirt-P-vnet0\n",
};


static GHashTable *
virNWFilterCreateVarsFrom(GHashTable *vars1,
                          GHashTable *vars2)
{
    GHashTable *res = virHashNew(virNWFilterVarValueHashFree);

    if (virNWFilterHashTablePutAll(vars1, res) < 0)
        goto err_exit;

    if (virNWFilterHashTablePutAll(vars2, res) < 0)
        goto err_exit;

    return res;

 err_exit:
    virHashFree(res);
    return NULL;
}


static void
virNWFilterRuleInstFree(virNWFilterRuleInst *inst)
{
    if (!inst)
        return;

    virHashFree(inst->vars);
    g_free(inst);
}


static void
virNWFilterInstReset(virNWFilterInst *inst)
{
    size_t i;

    for (i = 0; i < inst->nfilters; i++)
        virNWFilterDefFree(inst->filters[i]);<commit_msg>virNWFilterCreateVarsFrom: Use automatic memory management<commit_after>/*
 * nwfilterxml2firewalltest.c: Test iptables rule generation
 *
 * Copyright (C) 2014 Red Hat, Inc.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library.  If not, see
 * <http://www.gnu.org/licenses/>.
 *
 */

#include <config.h>

#if defined (__linux__)

# include "testutils.h"
# include "nwfilter/nwfilter_ebiptables_driver.h"
# include "virbuffer.h"

# define LIBVIRT_VIRFIREWALLPRIV_H_ALLOW
# include "virfirewallpriv.h"

# define LIBVIRT_VIRCOMMANDPRIV_H_ALLOW
# include "vircommandpriv.h"

# define VIR_FROM_THIS VIR_FROM_NONE

# ifdef __linux__
#  define RULESTYPE "linux"
# else
#  error "test case not ported to this platform"
# endif

typedef struct _virNWFilterInst virNWFilterInst;
struct _virNWFilterInst {
    virNWFilterDef **filters;
    size_t nfilters;
    virNWFilterRuleInst **rules;
    size_t nrules;
};

/*
 * Some sets of rules that will be common to all test files,
 * so we don't bother including them in the test data files
 * as that would just bloat them
 */

static const char *commonRules[] = {
    /* Dropping ebtables rules */
    "ebtables \\\n--concurrent \\\n-t nat \\\n-D PREROUTING \\\n-i vnet0 \\\n-j libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-D POSTROUTING \\\n-o vnet0 \\\n-j libvirt-P-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-L libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-L libvirt-P-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-F libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-X libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-F libvirt-P-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-X libvirt-P-vnet0\n",

    /* Creating ebtables chains */
    "ebtables \\\n--concurrent \\\n-t nat \\\n-N libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-N libvirt-P-vnet0\n",

    /* Dropping iptables rules */
    "iptables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "iptables \\\n-w \\\n-F FP-vnet0\n"
    "iptables \\\n-w \\\n-X FP-vnet0\n"
    "iptables \\\n-w \\\n-F FJ-vnet0\n"
    "iptables \\\n-w \\\n-X FJ-vnet0\n"
    "iptables \\\n-w \\\n-F HJ-vnet0\n"
    "iptables \\\n-w \\\n-X HJ-vnet0\n",

    /* Creating iptables chains */
    "iptables \\\n-w \\\n-N libvirt-in\n"
    "iptables \\\n-w \\\n-N libvirt-out\n"
    "iptables \\\n-w \\\n-N libvirt-in-post\n"
    "iptables \\\n-w \\\n-N libvirt-host-in\n"
    "iptables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in\n"
    "iptables \\\n-w \\\n-D FORWARD \\\n-j libvirt-out\n"
    "iptables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in-post\n"
    "iptables \\\n-w \\\n-D INPUT \\\n-j libvirt-host-in\n"
    "iptables \\\n-w \\\n-I FORWARD 1 \\\n-j libvirt-in\n"
    "iptables \\\n-w \\\n-I FORWARD 2 \\\n-j libvirt-out\n"
    "iptables \\\n-w \\\n-I FORWARD 3 \\\n-j libvirt-in-post\n"
    "iptables \\\n-w \\\n-I INPUT 1 \\\n-j libvirt-host-in\n"
    "iptables \\\n-w \\\n-N FP-vnet0\n"
    "iptables \\\n-w \\\n-N FJ-vnet0\n"
    "iptables \\\n-w \\\n-N HJ-vnet0\n"
    "iptables \\\n-w \\\n-A libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "iptables \\\n-w \\\n-A libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "iptables \\\n-w \\\n-A libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "iptables \\\n-w \\\n-D libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n"
    "iptables \\\n-w \\\n-A libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n",

    /* Dropping ip6tables rules */
    "ip6tables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-out \\\n-m physdev \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-F FP-vnet0\n"
    "ip6tables \\\n-w \\\n-X FP-vnet0\n"
    "ip6tables \\\n-w \\\n-F FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-X FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-F HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-X HJ-vnet0\n",

    /* Creating ip6tables chains */
    "ip6tables \\\n-w \\\n-N libvirt-in\n"
    "ip6tables \\\n-w \\\n-N libvirt-out\n"
    "ip6tables \\\n-w \\\n-N libvirt-in-post\n"
    "ip6tables \\\n-w \\\n-N libvirt-host-in\n"
    "ip6tables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in\n"
    "ip6tables \\\n-w \\\n-D FORWARD \\\n-j libvirt-out\n"
    "ip6tables \\\n-w \\\n-D FORWARD \\\n-j libvirt-in-post\n"
    "ip6tables \\\n-w \\\n-D INPUT \\\n-j libvirt-host-in\n"
    "ip6tables \\\n-w \\\n-I FORWARD 1 \\\n-j libvirt-in\n"
    "ip6tables \\\n-w \\\n-I FORWARD 2 \\\n-j libvirt-out\n"
    "ip6tables \\\n-w \\\n-I FORWARD 3 \\\n-j libvirt-in-post\n"
    "ip6tables \\\n-w \\\n-I INPUT 1 \\\n-j libvirt-host-in\n"
    "ip6tables \\\n-w \\\n-N FP-vnet0\n"
    "ip6tables \\\n-w \\\n-N FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-N HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-A libvirt-out \\\n-m physdev \\\n--physdev-is-bridged \\\n--physdev-out vnet0 \\\n-g FP-vnet0\n"
    "ip6tables \\\n-w \\\n-A libvirt-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g FJ-vnet0\n"
    "ip6tables \\\n-w \\\n-A libvirt-host-in \\\n-m physdev \\\n--physdev-in vnet0 \\\n-g HJ-vnet0\n"
    "ip6tables \\\n-w \\\n-D libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n"
    "ip6tables \\\n-w \\\n-A libvirt-in-post \\\n-m physdev \\\n--physdev-in vnet0 \\\n-j ACCEPT\n",

    /* Inserting ebtables rules */
    "ebtables \\\n--concurrent \\\n-t nat \\\n-A PREROUTING \\\n-i vnet0 \\\n-j libvirt-J-vnet0\n"
    "ebtables \\\n--concurrent \\\n-t nat \\\n-A POSTROUTING \\\n-o vnet0 \\\n-j libvirt-P-vnet0\n",
};


static GHashTable *
virNWFilterCreateVarsFrom(GHashTable *vars1,
                          GHashTable *vars2)
{
    g_autoptr(GHashTable) res = virHashNew(virNWFilterVarValueHashFree);

    if (virNWFilterHashTablePutAll(vars1, res) < 0)
        goto err_exit;

    if (virNWFilterHashTablePutAll(vars2, res) < 0)
        goto err_exit;

    return g_steal_pointer(&res);

 err_exit:
    return NULL;
}


static void
virNWFilterRuleInstFree(virNWFilterRuleInst *inst)
{
    if (!inst)
        return;

    virHashFree(inst->vars);
    g_free(inst);
}


static void
virNWFilterInstReset(virNWFilterInst *inst)
{
    size_t i;

    for (i = 0; i < inst->nfilters; i++)
        virNWFilterDefFree(inst->filters[i]);
{'fraction_non_alphanumeric': 0.2100006658232905, 'fraction_numerical': 0.01597975897196884, 'mean_word_length': 1.9462534327187133, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7227386', 'n_tokens_mistral': 6859, 'n_tokens_neox': 6696, 'n_words': 1498}