From: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; Refactor the ebiptablesTearNewRules function so that the teardown of temporary filters can also be called by the ebiptablesAllTeardown function. This fixes a problem that leaves temporary filters behind when a VM shuts down while its filters are modified. Signed-off-by: Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; --- src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index de07faa..307c153 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3544,14 +3544,9 @@ ebiptablesApplyNewRules(const char *ifname, } -static int -ebiptablesTearNewRules(const char *ifname) +static void +ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname) { - virFirewallPtr fw = virFirewallNew(); - int ret = -1; - - virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); - iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); @@ -3563,13 +3558,24 @@ ebiptablesTearNewRules(const char *ifname) ebtablesRemoveTmpSubChainsFW(fw, ifname); ebtablesRemoveTmpRootChainFW(fw, true, ifname); ebtablesRemoveTmpRootChainFW(fw, false, ifname); +} + + +static int +ebiptablesTearNewRules(const char *ifname) +{ + virFirewallPtr fw = virFirewallNew(); + int ret = -1; + + virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); + + ebiptablesTearNewRulesFW(fw, ifname); ret = virFirewallApply(fw); virFirewallFree(fw); return ret; } - static int ebiptablesTearOldRules(const char *ifname) { @@ -3616,6 +3622,8 @@ ebiptablesAllTeardown(const char *ifname) virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); + ebiptablesTearNewRulesFW(fw, ifname); + iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); -- 1.8.1.4