(vm_name, vm_ip, vm_mac, vif, sec_ips)
| 146 | return ip4s, ip6s |
| 147 | |
| 148 | def destroy_network_rules_for_nic(vm_name, vm_ip, vm_mac, vif, sec_ips): |
| 149 | try: |
| 150 | rules = execute("""iptables-save -t filter | awk '/ %s / { sub(/-A/, "-D", $1) ; print }'""" % vif ).split("\n") |
| 151 | for rule in [_f for _f in rules if _f]: |
| 152 | try: |
| 153 | execute("iptables " + rule) |
| 154 | except: |
| 155 | logging.debug("Ignoring failure to delete rule: " + rule) |
| 156 | except: |
| 157 | pass |
| 158 | |
| 159 | try: |
| 160 | dnats = execute("""iptables-save -t nat | awk '/ %s / { sub(/-A/, "-D", $1) ; print }'""" % vif ).split("\n") |
| 161 | for dnat in [_f for _f in dnats if _f]: |
| 162 | try: |
| 163 | execute("iptables -t nat " + dnat) |
| 164 | except: |
| 165 | logging.debug("Ignoring failure to delete dnat: " + dnat) |
| 166 | except: |
| 167 | pass |
| 168 | |
| 169 | ips = sec_ips.split(';') |
| 170 | ips.pop() |
| 171 | ips.append(vm_ip) |
| 172 | add_to_ipset(vm_name, ips, "-D") |
| 173 | ebtables_rules_vmip(vm_name, vm_mac, ips, "-D") |
| 174 | |
| 175 | vmchain_in = vm_name + "-in" |
| 176 | vmchain_out = vm_name + "-out" |
| 177 | vmchain_in_src = vm_name + "-in-src" |
| 178 | vmchain_out_dst = vm_name + "-out-dst" |
| 179 | try: |
| 180 | execute("ebtables -t nat -D " + vmchain_in_src + " -s " + vm_mac + " -j RETURN") |
| 181 | execute("ebtables -t nat -D " + vmchain_out_dst + " -p ARP --arp-op Reply --arp-mac-dst " + vm_mac + " -j RETURN") |
| 182 | execute("ebtables -t nat -D PREROUTING -i " + vif + " -j " + vmchain_in) |
| 183 | execute("ebtables -t nat -D POSTROUTING -o " + vif + " -j " + vmchain_out) |
| 184 | except: |
| 185 | logging.debug("Ignoring failure to delete ebtable rules for vm: " + vm_name) |
| 186 | |
| 187 | def get_bridge_physdev(brname): |
| 188 | # eth1.50@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master breth1-50 state forwarding priority 32 cost 4 | |
no test coverage detected