Bug 972368

Description of problem:

At each start or restart, libvirtd inserts its rules at the beginning of iptables
chains FORWARD and POSTROUTING. These automatically inserted rules override any
rules that the administrator have set.

Libvirtd rules should be inserted at the end of the chain, so that the rules set
by the admin are not overriden by libvirtd rules and remain effective.

Version-Release number of selected component (if applicable):
libvirtd (libvirt) 0.8.3 from Debian Squeeze

How reproducible:
always

Steps to Reproduce:

1. start libvirtd

2. set a rule that prevents virtual machines from connecting to some hosts, for
example:
iptables -I FORWARD -d 192.168.0.0/16 -p tcp -j DROP

3. see the FORWARD chain:
# iptables -L FORWARD
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  anywhere             192.168.0.0/16
ACCEPT     all  --  anywhere             192.168.192.0/24    state RELATED,ESTABLISHED
ACCEPT     all  --  192.168.192.0/24     anywhere
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

4. run a virtual machine, try to connect to some host forbidden by the rule and
make sure that the rule is effective

5. restart libvirtd: /etc/init.d/libvirt-bin restart

6. see the content of the FORWARD chain again - you see that after libvirtd
restart the order of rules has changed
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             192.168.192.0/24    state RELATED,ESTABLISHED
ACCEPT     all  --  192.168.192.0/24     anywhere
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable
DROP       tcp  --  anywhere             192.168.0.0/16

7. switch to the virtual machine again and try to make tcp connection - you see
that the DROP rule is no longer effective and the virtual machine can connect
anywhere

Actual results:
Security is compromised - the virtual machine can connect anywhere

Expected results:
The rules that the admin inserted into iptables should be honored. libvirt should
insert it's own rules at the end of the table, not at the beginning.

Additional info:
This happens on Debian Wheezy with libvirtd 0.8.3