[libvirt] [PATCH v2] nwfilter: Tear down temp. filters when tearing all filters

From: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; Refactor the ebiptablesTearNewRules function so that the teardown of temporary filters can also be called by the ebiptablesAllTeardown function. This fixes a problem that leaves temporary filters behind when a VM shuts down while its filters are modified. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; v1->v2: - test cases adjusted to expect more commands --- src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++---- tests/nwfilterebiptablestest.c | 64 +++++++++++++++++-------------- 2 files changed, 52 insertions(+), 36 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index 4cbdc0e..5cb0b74 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3536,14 +3536,9 @@ ebiptablesApplyNewRules(const char *ifname, } -static int -ebiptablesTearNewRules(const char *ifname) +static void +ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname) { - virFirewallPtr fw = virFirewallNew(); - int ret = -1; - - virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); - iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); @@ -3555,13 +3550,24 @@ ebiptablesTearNewRules(const char *ifname) ebtablesRemoveTmpSubChainsFW(fw, ifname); ebtablesRemoveTmpRootChainFW(fw, true, ifname); ebtablesRemoveTmpRootChainFW(fw, false, ifname); +} + + +static int +ebiptablesTearNewRules(const char *ifname) +{ + virFirewallPtr fw = virFirewallNew(); + int ret = -1; + + virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); + + ebiptablesTearNewRulesFW(fw, ifname); ret = virFirewallApply(fw); virFirewallFree(fw); return ret; } - static int ebiptablesTearOldRules(const char *ifname) { @@ -3608,6 +3614,8 @@ ebiptablesAllTeardown(const char *ifname) virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); + ebiptablesTearNewRulesFW(fw, ifname); + iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c index df939d5..ff9a9b7 100644 --- a/tests/nwfilterebiptablestest.c +++ b/tests/nwfilterebiptablestest.c @@ -33,11 +33,43 @@ #define VIR_FROM_THIS VIR_FROM_NONE + +#define VIR_NWFILTER_NEW_RULES_TEARDOWN \ + "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ + "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ + "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ + "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ + "iptables -F FP-vnet0\n" \ + "iptables -X FP-vnet0\n" \ + "iptables -F FJ-vnet0\n" \ + "iptables -X FJ-vnet0\n" \ + "iptables -F HJ-vnet0\n" \ + "iptables -X HJ-vnet0\n" \ + "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \ + "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \ + "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \ + "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \ + "ip6tables -F FP-vnet0\n" \ + "ip6tables -X FP-vnet0\n" \ + "ip6tables -F FJ-vnet0\n" \ + "ip6tables -X FJ-vnet0\n" \ + "ip6tables -F HJ-vnet0\n" \ + "ip6tables -X HJ-vnet0\n" \ + "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \ + "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \ + "ebtables -t nat -L libvirt-J-vnet0\n" \ + "ebtables -t nat -L libvirt-P-vnet0\n" \ + "ebtables -t nat -F libvirt-J-vnet0\n" \ + "ebtables -t nat -X libvirt-J-vnet0\n" \ + "ebtables -t nat -F libvirt-P-vnet0\n" \ + "ebtables -t nat -X libvirt-P-vnet0\n" + static int testNWFilterEBIPTablesAllTeardown(const void *opaque ATTRIBUTE_UNUSED) { virBuffer buf = VIR_BUFFER_INITIALIZER; const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" @@ -221,34 +253,7 @@ testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED) { virBuffer buf = VIR_BUFFER_INITIALIZER; const char *expected = - "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" - "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" - "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" - "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" - "iptables -F FP-vnet0\n" - "iptables -X FP-vnet0\n" - "iptables -F FJ-vnet0\n" - "iptables -X FJ-vnet0\n" - "iptables -F HJ-vnet0\n" - "iptables -X HJ-vnet0\n" - "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" - "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" - "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" - "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" - "ip6tables -F FP-vnet0\n" - "ip6tables -X FP-vnet0\n" - "ip6tables -F FJ-vnet0\n" - "ip6tables -X FJ-vnet0\n" - "ip6tables -F HJ-vnet0\n" - "ip6tables -X HJ-vnet0\n" - "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" - "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" - "ebtables -t nat -L libvirt-J-vnet0\n" - "ebtables -t nat -L libvirt-P-vnet0\n" - "ebtables -t nat -F libvirt-J-vnet0\n" - "ebtables -t nat -X libvirt-J-vnet0\n" - "ebtables -t nat -F libvirt-P-vnet0\n" - "ebtables -t nat -X libvirt-P-vnet0\n"; + VIR_NWFILTER_NEW_RULES_TEARDOWN; char *actual = NULL; int ret = -1; @@ -282,6 +287,7 @@ testNWFilterEBIPTablesApplyBasicRules(const void *opaque ATTRIBUTE_UNUSED) { virBuffer buf = VIR_BUFFER_INITIALIZER; const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" @@ -353,6 +359,7 @@ testNWFilterEBIPTablesApplyDHCPOnlyRules(const void *opaque ATTRIBUTE_UNUSED) { virBuffer buf = VIR_BUFFER_INITIALIZER; const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" @@ -443,6 +450,7 @@ testNWFilterEBIPTablesApplyDropAllRules(const void *opaque ATTRIBUTE_UNUSED) { virBuffer buf = VIR_BUFFER_INITIALIZER; const char *expected = + VIR_NWFILTER_NEW_RULES_TEARDOWN "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n" "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n" -- 1.8.1.4