From: Stefan Berger <stefanb(a)linux.vnet.ibm.com>
Refactor the ebiptablesTearNewRules function so that the teardown of temporary
filters can also be called by the ebiptablesAllTeardown function.
This fixes a problem that leaves temporary filters behind when a VM shuts down
while its filters are modified.
Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com>
---
src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++++++++++--------
1 file changed, 16 insertions(+), 8 deletions(-)
diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c
b/src/nwfilter/nwfilter_ebiptables_driver.c
index de07faa..307c153 100644
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -3544,14 +3544,9 @@ ebiptablesApplyNewRules(const char *ifname,
}
-static int
-ebiptablesTearNewRules(const char *ifname)
+static void
+ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname)
{
- virFirewallPtr fw = virFirewallNew();
- int ret = -1;
-
- virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
-
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
@@ -3563,13 +3558,24 @@ ebiptablesTearNewRules(const char *ifname)
ebtablesRemoveTmpSubChainsFW(fw, ifname);
ebtablesRemoveTmpRootChainFW(fw, true, ifname);
ebtablesRemoveTmpRootChainFW(fw, false, ifname);
+}
+
+
+static int
+ebiptablesTearNewRules(const char *ifname)
+{
+ virFirewallPtr fw = virFirewallNew();
+ int ret = -1;
+
+ virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
+
+ ebiptablesTearNewRulesFW(fw, ifname);
ret = virFirewallApply(fw);
virFirewallFree(fw);
return ret;
}
-
static int
ebiptablesTearOldRules(const char *ifname)
{
@@ -3616,6 +3622,8 @@ ebiptablesAllTeardown(const char *ifname)
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
+ ebiptablesTearNewRulesFW(fw, ifname);
+
iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
--
1.8.1.4