network: add comment to table that it belongs to libvirt

The result looks like

$ nft list ruleset
...snip...
table ip6 libvirt_network {
	comment "Managed by libvirt for virtual networks:   https://libvirt.org/firewall.html#the-virtual-network-driver"
	chain forward {
...snip...

This should reduce the number of people wondering why
these rules exists.

Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
index cffe8072f59ca67c20df7a91df6388d78dac519a..cd46ff8d8348558fb3ba22bad191e479a253d1bb 100644 (file)
--- a/src/network/network_nftables.c
+++ b/src/network/network_nftables.c
@@ -61,6 +61,10 @@ VIR_LOG_INIT("network.nftables");
 
 #define VIR_NFTABLES_PRIVATE_TABLE "libvirt_network"
 
+#define VIR_NFTABLES_COMMENT \
+    "{ comment \"Managed by libvirt for virtual networks: " \
+    "https://libvirt.org/firewall.html#the-virtual-network-driver\"; }"
+
 /* nftables backend uses the same binary (nft) for all layers, but
  * IPv4 and IPv6 have their rules in separate classes of tables,
  * either "ip" or "ip6". (there is also an "inet" class of tables that
@@ -165,7 +169,9 @@ nftablesPrivateChainCreate(virFirewall *fw,
 
     if (!tableMatch) {
         virFirewallAddCmd(fw, layer, "add", "table",
-                          layerStr, VIR_NFTABLES_PRIVATE_TABLE, NULL);
+                          layerStr, VIR_NFTABLES_PRIVATE_TABLE,
+                          VIR_NFTABLES_COMMENT,
+                          NULL);
     }
 
     for (i = 0; i < data->nchains; i++) {