Description of the problem:

Requesting the patch 912d170f87b3d147bfde987249a727f7a7c7f1d7 to be applied to
RHEL 6.1

http://libvirt.org/git/?p=libvirt.git;a=commit;h=912d170f87b3d147bfde987249a727f7a7c7f1d7


Packets not accepted by a VM's nwfilter configuration could not be rejected with an ICMP message sent back to the originator but could only be dropped.


To verify that this patch was applied:

Assuming an interface description like this one containing a line <filterref
filter='acl-fw'/>

    <interface type='bridge'>
      <source bridge='virbr0'/>
      <target dev='vnet0'/>
      <model type='virtio'/>
      <filterref filter='acl-fw'/>
    </interface>


and a nwfilter like this one:

<filter name='acl-fw' chain='root'>
  <rule action='reject' direction='in' priority='400'>
    <all/>
  </rule>
</filter>

Once the VM has been started and has an interface called 'vnet0', the command

iptables -L FO-vnet0 -n

should return the following output:

iptables -L FI-vnet0
Chain FI-vnet0 (1 references)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Previous versions of libvirt would simply discard the <rule...> line in the XML since 'reject' was not known.