[libvirt] [TCK][PATCH] nwfilter: convert ctstate to state

[Eric Blake]

On 08/06/2013 09:24 AM, Stefan Berger wrote:
> iptables version 1.4.16 and later automatically convert -m state --state ...
> to -m conntrack --ctstate ... In the test cases we will then only see 'ctstate'
> and convert that back to the older 'state' before comparing actual against
> expected output.
> 
> Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>
> 
> ---

>  
> +probeIptablesCtstate() {
> +  rev=$(iptables --version | \
> +        sed -n 's/.*v\([[:digit:]].\)/\1/p' |
> +        gawk -F. '{print $1 * 1000000 + $2 * 1000 + $3 }')
> +  # 1.4.16 or later uses ctstate
> +  if [ $rev -ge 1004016 ]; then

Version number probes are inherently fragile.  Can you do a feature
probe instead, in case someone backports this feature to a build of
iptables that reports an earlier version?

>  
> +        if [ $IPTABLES_USE_CTSTATE -ne 0 ]; then
> +          #change ctstate tback o state
> +          sed -i "s/ctstate/state/" ${tmpfile}

Do we even need the version/feature probe?  What if we just ALWAYS do
this substitution?  It won't hurt on older iptables (it will just be a
no-op).

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130806/f7efa3fc/attachment-0001.sig>