From: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>
Refactor the ebiptablesTearNewRules function so that the teardown of temporary
filters can also be called by the ebiptablesAllTeardown function.
This fixes a problem that leaves temporary filters behind when a VM shuts down
while its filters are modified.
Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>
v1->v2:
- test cases adjusted to expect more commands
---
src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++----
tests/nwfilterebiptablestest.c | 64 +++++++++++++++++--------------
2 files changed, 52 insertions(+), 36 deletions(-)
diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index 4cbdc0e..5cb0b74 100644
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -3536,14 +3536,9 @@ ebiptablesApplyNewRules(const char *ifname,
}
-static int
-ebiptablesTearNewRules(const char *ifname)
+static void
+ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname)
{
- virFirewallPtr fw = virFirewallNew();
- int ret = -1;
-
- virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
-
iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
@@ -3555,13 +3550,24 @@ ebiptablesTearNewRules(const char *ifname)
ebtablesRemoveTmpSubChainsFW(fw, ifname);
ebtablesRemoveTmpRootChainFW(fw, true, ifname);
ebtablesRemoveTmpRootChainFW(fw, false, ifname);
+}
+
+
+static int
+ebiptablesTearNewRules(const char *ifname)
+{
+ virFirewallPtr fw = virFirewallNew();
+ int ret = -1;
+
+ virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
+
+ ebiptablesTearNewRulesFW(fw, ifname);
ret = virFirewallApply(fw);
virFirewallFree(fw);
return ret;
}
-
static int
ebiptablesTearOldRules(const char *ifname)
{
@@ -3608,6 +3614,8 @@ ebiptablesAllTeardown(const char *ifname)
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
+ ebiptablesTearNewRulesFW(fw, ifname);
+
iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c
index df939d5..ff9a9b7 100644
--- a/tests/nwfilterebiptablestest.c
+++ b/tests/nwfilterebiptablestest.c
@@ -33,11 +33,43 @@
#define VIR_FROM_THIS VIR_FROM_NONE
+
+#define VIR_NWFILTER_NEW_RULES_TEARDOWN \
+ "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
+ "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
+ "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
+ "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
+ "iptables -F FP-vnet0\n" \
+ "iptables -X FP-vnet0\n" \
+ "iptables -F FJ-vnet0\n" \
+ "iptables -X FJ-vnet0\n" \
+ "iptables -F HJ-vnet0\n" \
+ "iptables -X HJ-vnet0\n" \
+ "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
+ "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
+ "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
+ "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
+ "ip6tables -F FP-vnet0\n" \
+ "ip6tables -X FP-vnet0\n" \
+ "ip6tables -F FJ-vnet0\n" \
+ "ip6tables -X FJ-vnet0\n" \
+ "ip6tables -F HJ-vnet0\n" \
+ "ip6tables -X HJ-vnet0\n" \
+ "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \
+ "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \
+ "ebtables -t nat -L libvirt-J-vnet0\n" \
+ "ebtables -t nat -L libvirt-P-vnet0\n" \
+ "ebtables -t nat -F libvirt-J-vnet0\n" \
+ "ebtables -t nat -X libvirt-J-vnet0\n" \
+ "ebtables -t nat -F libvirt-P-vnet0\n" \
+ "ebtables -t nat -X libvirt-P-vnet0\n"
+
static int
testNWFilterEBIPTablesAllTeardown(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
+ VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@@ -221,34 +253,7 @@ testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
- "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
- "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
- "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
- "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
- "iptables -F FP-vnet0\n"
- "iptables -X FP-vnet0\n"
- "iptables -F FJ-vnet0\n"
- "iptables -X FJ-vnet0\n"
- "iptables -F HJ-vnet0\n"
- "iptables -X HJ-vnet0\n"
- "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
- "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
- "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
- "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
- "ip6tables -F FP-vnet0\n"
- "ip6tables -X FP-vnet0\n"
- "ip6tables -F FJ-vnet0\n"
- "ip6tables -X FJ-vnet0\n"
- "ip6tables -F HJ-vnet0\n"
- "ip6tables -X HJ-vnet0\n"
- "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
- "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
- "ebtables -t nat -L libvirt-J-vnet0\n"
- "ebtables -t nat -L libvirt-P-vnet0\n"
- "ebtables -t nat -F libvirt-J-vnet0\n"
- "ebtables -t nat -X libvirt-J-vnet0\n"
- "ebtables -t nat -F libvirt-P-vnet0\n"
- "ebtables -t nat -X libvirt-P-vnet0\n";
+ VIR_NWFILTER_NEW_RULES_TEARDOWN;
char *actual = NULL;
int ret = -1;
@@ -282,6 +287,7 @@ testNWFilterEBIPTablesApplyBasicRules(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
+ VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@@ -353,6 +359,7 @@ testNWFilterEBIPTablesApplyDHCPOnlyRules(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
+ VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@@ -443,6 +450,7 @@ testNWFilterEBIPTablesApplyDropAllRules(const void *opaque ATTRIBUTE_UNUSED)
{
virBuffer buf = VIR_BUFFER_INITIALIZER;
const char *expected =
+ VIR_NWFILTER_NEW_RULES_TEARDOWN
"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
--
1.8.1.4
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list