Function teardown_tap_networking

crates/openshell-driver-vm/src/runtime.rs:477–532

(tap_device: &str, host_ip: &str, gateway_port: u16)

}

fn teardown_tap_networking(tap_device: &str, host_ip: &str, gateway_port: u16) {
    // Delete the entire nftables table — single atomic operation.
    let table_name = nft_ruleset::teardown_table_name(tap_device);
    let _ = run_cmd("nft", &["delete", "table", "ip", &table_name]);

    // Clean up legacy iptables rules from older driver versions.
    let subnet = tap_subnet_from_host_ip(host_ip);
    let _ = run_cmd(
        "iptables",
        &[
            "-D",
            "FORWARD",
            "-o",
            tap_device,
            "-m",
            "state",
            "--state",
            "RELATED,ESTABLISHED",
            "-j",
            "ACCEPT",
        ],
    );
    let _ = run_cmd(
        "iptables",
        &["-D", "FORWARD", "-i", tap_device, "-j", "ACCEPT"],
    );
    if gateway_port > 0 {
        let port_str = gateway_port.to_string();
        let _ = run_cmd(
            "iptables",
            &[
                "-D", "INPUT", "-i", tap_device, "-p", "tcp", "--dport", &port_str, "-j", "ACCEPT",
            ],
        );
    }
    let _ = run_cmd(
        "iptables",
        &["-D", "INPUT", "-i", tap_device, "-j", "ACCEPT"],
    );
    let _ = run_cmd(
        "iptables",
        &[
            "-t",
            "nat",
            "-D",
            "POSTROUTING",
            "-s",
            &subnet,
            "-j",
            "MASQUERADE",
        ],
    );

    let _ = run_cmd("ip", &["link", "set", tap_device, "down"]);
    let _ = run_cmd("ip", &["tuntap", "del", "dev", tap_device, "mode", "tap"]);
}

fn tap_subnet_from_host_ip(host_ip: &str) -> String {