[libvirt] [PATCH v2] nwfilter: Tear down temp. filters when tearing all filters

[Stefan Berger]

From: Stefan Berger <stefanb at linux.vnet.ibm.com>

Refactor the ebiptablesTearNewRules function so that the teardown of temporary
filters can also be called by the ebiptablesAllTeardown function.

This fixes a problem that leaves temporary filters behind when a VM shuts down
while its filters are modified.

Signed-off-by: Stefan Berger <stefanb at linux.vnet.ibm.com>

v1->v2:
  - test cases adjusted to expect more commands
---
 src/nwfilter/nwfilter_ebiptables_driver.c | 24 ++++++++----
 tests/nwfilterebiptablestest.c            | 64 +++++++++++++++++--------------
 2 files changed, 52 insertions(+), 36 deletions(-)

diff --git a/src/nwfilter/nwfilter_ebiptables_driver.c b/src/nwfilter/nwfilter_ebiptables_driver.c
index 4cbdc0e..5cb0b74 100644
--- a/src/nwfilter/nwfilter_ebiptables_driver.c
+++ b/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -3536,14 +3536,9 @@ ebiptablesApplyNewRules(const char *ifname,
 }
 
 
-static int
-ebiptablesTearNewRules(const char *ifname)
+static void
+ebiptablesTearNewRulesFW(virFirewallPtr fw, const char *ifname)
 {
-    virFirewallPtr fw = virFirewallNew();
-    int ret = -1;
-
-    virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
-
     iptablesUnlinkTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
     iptablesRemoveTmpRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
 
@@ -3555,13 +3550,24 @@ ebiptablesTearNewRules(const char *ifname)
     ebtablesRemoveTmpSubChainsFW(fw, ifname);
     ebtablesRemoveTmpRootChainFW(fw, true, ifname);
     ebtablesRemoveTmpRootChainFW(fw, false, ifname);
+}
+
+
+static int
+ebiptablesTearNewRules(const char *ifname)
+{
+    virFirewallPtr fw = virFirewallNew();
+    int ret = -1;
+
+    virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
+
+    ebiptablesTearNewRulesFW(fw, ifname);
 
     ret = virFirewallApply(fw);
     virFirewallFree(fw);
     return ret;
 }
 
-
 static int
 ebiptablesTearOldRules(const char *ifname)
 {
@@ -3608,6 +3614,8 @@ ebiptablesAllTeardown(const char *ifname)
 
     virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS);
 
+    ebiptablesTearNewRulesFW(fw, ifname);
+
     iptablesUnlinkRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
     iptablesClearVirtInPostFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
     iptablesRemoveRootChainsFW(fw, VIR_FIREWALL_LAYER_IPV4, ifname);
diff --git a/tests/nwfilterebiptablestest.c b/tests/nwfilterebiptablestest.c
index df939d5..ff9a9b7 100644
--- a/tests/nwfilterebiptablestest.c
+++ b/tests/nwfilterebiptablestest.c
@@ -33,11 +33,43 @@
 
 #define VIR_FROM_THIS VIR_FROM_NONE
 
+
+#define VIR_NWFILTER_NEW_RULES_TEARDOWN \
+	"iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
+	"iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
+	"iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
+	"iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
+	"iptables -F FP-vnet0\n" \
+	"iptables -X FP-vnet0\n" \
+	"iptables -F FJ-vnet0\n" \
+	"iptables -X FJ-vnet0\n" \
+	"iptables -F HJ-vnet0\n" \
+	"iptables -X HJ-vnet0\n" \
+	"ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n" \
+	"ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n" \
+	"ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n" \
+	"ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n" \
+	"ip6tables -F FP-vnet0\n" \
+	"ip6tables -X FP-vnet0\n" \
+	"ip6tables -F FJ-vnet0\n" \
+	"ip6tables -X FJ-vnet0\n" \
+	"ip6tables -F HJ-vnet0\n" \
+	"ip6tables -X HJ-vnet0\n" \
+	"ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n" \
+	"ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n" \
+	"ebtables -t nat -L libvirt-J-vnet0\n" \
+	"ebtables -t nat -L libvirt-P-vnet0\n" \
+	"ebtables -t nat -F libvirt-J-vnet0\n" \
+	"ebtables -t nat -X libvirt-J-vnet0\n" \
+	"ebtables -t nat -F libvirt-P-vnet0\n" \
+	"ebtables -t nat -X libvirt-P-vnet0\n"
+
 static int
 testNWFilterEBIPTablesAllTeardown(const void *opaque ATTRIBUTE_UNUSED)
 {
     virBuffer buf = VIR_BUFFER_INITIALIZER;
     const char *expected =
+        VIR_NWFILTER_NEW_RULES_TEARDOWN
         "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@@ -221,34 +253,7 @@ testNWFilterEBIPTablesTearNewRules(const void *opaque ATTRIBUTE_UNUSED)
 {
     virBuffer buf = VIR_BUFFER_INITIALIZER;
     const char *expected =
-        "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
-        "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
-        "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
-        "iptables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
-        "iptables -F FP-vnet0\n"
-        "iptables -X FP-vnet0\n"
-        "iptables -F FJ-vnet0\n"
-        "iptables -X FJ-vnet0\n"
-        "iptables -F HJ-vnet0\n"
-        "iptables -X HJ-vnet0\n"
-        "ip6tables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FP-vnet0\n"
-        "ip6tables -D libvirt-out -m physdev --physdev-out vnet0 -g FP-vnet0\n"
-        "ip6tables -D libvirt-in -m physdev --physdev-in vnet0 -g FJ-vnet0\n"
-        "ip6tables -D libvirt-host-in -m physdev --physdev-in vnet0 -g HJ-vnet0\n"
-        "ip6tables -F FP-vnet0\n"
-        "ip6tables -X FP-vnet0\n"
-        "ip6tables -F FJ-vnet0\n"
-        "ip6tables -X FJ-vnet0\n"
-        "ip6tables -F HJ-vnet0\n"
-        "ip6tables -X HJ-vnet0\n"
-        "ebtables -t nat -D PREROUTING -i vnet0 -j libvirt-J-vnet0\n"
-        "ebtables -t nat -D POSTROUTING -o vnet0 -j libvirt-P-vnet0\n"
-        "ebtables -t nat -L libvirt-J-vnet0\n"
-        "ebtables -t nat -L libvirt-P-vnet0\n"
-        "ebtables -t nat -F libvirt-J-vnet0\n"
-        "ebtables -t nat -X libvirt-J-vnet0\n"
-        "ebtables -t nat -F libvirt-P-vnet0\n"
-        "ebtables -t nat -X libvirt-P-vnet0\n";
+        VIR_NWFILTER_NEW_RULES_TEARDOWN;
     char *actual = NULL;
     int ret = -1;
 
@@ -282,6 +287,7 @@ testNWFilterEBIPTablesApplyBasicRules(const void *opaque ATTRIBUTE_UNUSED)
 {
     virBuffer buf = VIR_BUFFER_INITIALIZER;
     const char *expected =
+        VIR_NWFILTER_NEW_RULES_TEARDOWN
         "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@@ -353,6 +359,7 @@ testNWFilterEBIPTablesApplyDHCPOnlyRules(const void *opaque ATTRIBUTE_UNUSED)
 {
     virBuffer buf = VIR_BUFFER_INITIALIZER;
     const char *expected =
+        VIR_NWFILTER_NEW_RULES_TEARDOWN
         "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
@@ -443,6 +450,7 @@ testNWFilterEBIPTablesApplyDropAllRules(const void *opaque ATTRIBUTE_UNUSED)
 {
     virBuffer buf = VIR_BUFFER_INITIALIZER;
     const char *expected =
+        VIR_NWFILTER_NEW_RULES_TEARDOWN
         "iptables -D libvirt-out -m physdev --physdev-is-bridged --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-out -m physdev --physdev-out vnet0 -g FO-vnet0\n"
         "iptables -D libvirt-in -m physdev --physdev-in vnet0 -g FI-vnet0\n"
-- 
1.8.1.4