On Tue, Aug 11, 2026 at 01:57:02PM +0200, Dion Bosschieter wrote:
> Change the nwfilter driver loading mechanism to read from nwfilter.conf.
> By default, it will use the nftables driver, which follows the
> firewall_backend bridge driver config logic.
>
> Added extra nwfilter config options "enable_trace" and "enable_counters"
> to allow users to toggle nftable driver specific features.
>
> Added nftables to *filter_tech_drivers as an available driver option
> for users to choose from.
>
> Signed-off-by: Dion Bosschieter <[email protected]>
> ---
> libvirt.spec.in | 7 +
> po/POTFILES | 1 +
> src/conf/virnwfilterobj.h | 20 --
> src/nwfilter/libvirtd_nwfilter.aug | 45 +++++
> src/nwfilter/meson.build | 37 ++++
> src/nwfilter/nwfilter.conf.in | 50 +++++
> src/nwfilter/nwfilter_driver.c | 66 +++----
> src/nwfilter/nwfilter_driver_conf.c | 214 +++++++++++++++++++++
> src/nwfilter/nwfilter_driver_conf.h | 69 +++++++
> src/nwfilter/nwfilter_ebiptables_driver.c | 4 +-
> src/nwfilter/nwfilter_ebiptables_driver.h | 2 +-
> src/nwfilter/nwfilter_gentech_driver.c | 65 +++----
> src/nwfilter/nwfilter_gentech_driver.h | 5 +-
> src/nwfilter/nwfilter_nftables_driver.c | 35 ++--
> src/nwfilter/nwfilter_tech_driver.h | 3 +-
> src/nwfilter/test_libvirtd_nwfilter.aug.in | 7 +
> 16 files changed, 511 insertions(+), 119 deletions(-)
> create mode 100644 src/nwfilter/libvirtd_nwfilter.aug
> create mode 100644 src/nwfilter/nwfilter.conf.in
> create mode 100644 src/nwfilter/nwfilter_driver_conf.c
> create mode 100644 src/nwfilter/nwfilter_driver_conf.h
> create mode 100644 src/nwfilter/test_libvirtd_nwfilter.aug.in
> diff --git a/src/nwfilter/test_libvirtd_nwfilter.aug.in
> b/src/nwfilter/test_libvirtd_nwfilter.aug.in
> new file mode 100644
> index 0000000000..e6e62550e4
> --- /dev/null
> +++ b/src/nwfilter/test_libvirtd_nwfilter.aug.in
> @@ -0,0 +1,7 @@
> +module Test_libvirtd_nwfilter =
> + @CONFIG@
> +
> + test Libvirtd_nwfilter.lns get conf =
> +{ "firewall_backend" = "nftables" }
This needed changing to @FIREWALL_BACKEND@ instead of hardcoding
'nftables', since the default changes at build time based on
the platform.
> +{ "enable_trace" = "0" }
> +{ "enable_counters" = "0" }
> --
> 2.53.0
>
With regards,
Daniel
--
|: https://berrange.com ~~ https://hachyderm.io/@berrange :|
|: https://libvirt.org ~~ https://entangle-photo.org :|
|: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
