[PATCH] nwfilter: Tear down temp. filters when tearing all filters

[Stefan Berger <stefanb@xxxxxxxxxx>]

From: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>

Refactor the ebiptablesTearNewRules function so that the teardown of temporary
filters can also be called by the ebiptablesAllTeardown function.

This fixes a problem that leaves temporary filters behind when a VM shuts down
while its filters are modified.

Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>
---
 src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index de07faa..307c153 100644
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -3544,14 +3544,9 @@ ebiptablesApplyNewRules(const char *ifname,
 }
 
 
-static int
-ebiptablesTearNewRules(const char *ifname)
+static void
+ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname)
 {
-    virFirewallPtr fw = virFirewallNew();
-    int ret = -1;
-
-    virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
-
     iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
     iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
 
@@ -3563,13 +3558,24 @@ ebiptablesTearNewRules(const char *ifname)
     ebtablesRemoveTmpSubChainsFW(fw, ifname);
     ebtablesRemoveTmpRootChainFW(fw, true, ifname);
     ebtablesRemoveTmpRootChainFW(fw, false, ifname);
+}
+
+
+static int
+ebiptablesTearNewRules(const char *ifname)
+{
+    virFirewallPtr fw = virFirewallNew();
+    int ret = -1;
+
+    virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
+
+    ebiptablesTearNewRulesFW(fw, ifname);
 
     ret = virFirewallApply(fw);
     virFirewallFree(fw);
     return ret;
 }
 
-
 static int
 ebiptablesTearOldRules(const char *ifname)
 {
@@ -3616,6 +3622,8 @@ ebiptablesAllTeardown(const char *ifname)
 
     virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
 
+    ebiptablesTearNewRulesFW(fw, ifname);
+
     iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
     iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
     iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
-- 
1.8.1.4

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list