LXC: live E2E for schema 0.8 directional egress covers only IPv4
@dhoehna is already working on this.
Since Aug 22, 2026.
- Dominant language
- Rust
- Stars
- 1.3k
- Forks
- 79
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 117
Description
Raised on #983 independently by @bbonaby (marked for follow-up) and @SohamDas2021 (marked non-blocking).
## What is covered today
`tests/scripts/run_lxc_network_ga_egress_test.sh` exercises the directional egress path against a real LXC container, and every case in it is IPv4.
## What is not
- **IPv6 directional peers.** The existing live IPv6 test uses the legacy host-list shape, so the parser-to-`ip6tables` path for a directional peer is covered only by unit assertions.
- **ICMP and ICMPv6 selectors.**
- **Port ranges** (`port` with `endPort`).
- **`protocol: any`.**
These are rule-level assertions only. Nothing proves the argument vectors the unit tests check actually produce the intended behavior on a live host.
## Suggested shape
Add live cases to the GA egress script covering at least one IPv6 allow and one IPv6 deny with directional peers, plus one ICMP case and one port-range case. Wire them into `tests/scripts/run_lxc_all_tests.sh` alongside the existing entry.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.