[libvirt] [PATCH] nwfilter: Tear down temp. filters when tearing all filters
From: Stefan Berger <stefanb@linux.vnet.ibm.com> Refactor the ebiptablesTearNewRules function so that the teardown of temporary filters can also be called by the ebiptablesAllTeardown function. This fixes a problem that leaves temporary filters behind when a VM shuts down while its filters are modified. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c index de07faa..307c153 100644 --- a/src/nwfilter/nwfilter_ebiptables_driver.c +++ b/src/nwfilter/nwfilter_ebiptables_driver.c @@ -3544,14 +3544,9 @@ ebiptablesApplyNewRules(const char *ifname, } -static int -ebiptablesTearNewRules(const char *ifname) +static void +ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname) { - virFirewallPtr fw = virFirewallNew(); - int ret = -1; - - virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); - iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); @@ -3563,13 +3558,24 @@ ebiptablesTearNewRules(const char *ifname) ebtablesRemoveTmpSubChainsFW(fw, ifname); ebtablesRemoveTmpRootChainFW(fw, true, ifname); ebtablesRemoveTmpRootChainFW(fw, false, ifname); +} + + +static int +ebiptablesTearNewRules(const char *ifname) +{ + virFirewallPtr fw = virFirewallNew(); + int ret = -1; + + virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); + + ebiptablesTearNewRulesFW(fw, ifname); ret = virFirewallApply(fw); virFirewallFree(fw); return ret; } - static int ebiptablesTearOldRules(const char *ifname) { @@ -3616,6 +3622,8 @@ ebiptablesAllTeardown(const char *ifname) virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); + ebiptablesTearNewRulesFW(fw, ifname); + iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname); -- 1.8.1.4
On Mon, Apr 28, 2014 at 07:02:22AM -0400, Stefan Berger wrote:
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Refactor the ebiptablesTearNewRules function so that the teardown of temporary filters can also be called by the ebiptablesAllTeardown function.
This fixes a problem that leaves temporary filters behind when a VM shuts down while its filters are modified.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
ACK, ok for freeze. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
"Daniel P. Berrange" <berrange@redhat.com> wrote on 04/30/2014 10:59:59 AM:
From: "Daniel P. Berrange" <berrange@redhat.com> To: Stefan Berger/Watson/IBM@IBMUS, Cc: libvirt-list@redhat.com, Stefan Berger <stefanb@linux.vnet.ibm.com> Date: 04/30/2014 11:05 AM Subject: Re: [PATCH] nwfilter: Tear down temp. filters when tearing all filters
On Mon, Apr 28, 2014 at 07:02:22AM -0400, Stefan Berger wrote:
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Refactor the ebiptablesTearNewRules function so that the teardown of temporary filters can also be called by the ebiptablesAllTeardown function.
This fixes a problem that leaves temporary filters behind when a VM shuts down while its filters are modified.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com> --- src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-)
ACK, ok for freeze.
Well, it now produces more commands to clear filters. I will have to adapt the test cases as well. Regards, Stefan
participants (2)
-
Daniel P. Berrange -
Stefan Berger