(vm_name, vif=None)
| 192 | |
| 193 | |
| 194 | def destroy_network_rules_for_vm(vm_name, vif=None): |
| 195 | vmchain = iptables_chain_name(vm_name) |
| 196 | vmchain_egress = egress_chain_name(vm_name) |
| 197 | vmchain_default = None |
| 198 | vm_ipsetname=ipset_chain_name(vm_name) |
| 199 | |
| 200 | delete_rules_for_vm_in_bridge_firewall_chain(vm_name) |
| 201 | if 1 in [vm_name.startswith(c) for c in ['r-', 's-', 'v-']]: |
| 202 | return True |
| 203 | |
| 204 | if vm_name.startswith('i-'): |
| 205 | vmchain_default = '-'.join(vm_name.split('-')[:-1]) + "-def" |
| 206 | |
| 207 | destroy_ebtables_rules(vm_name, vif) |
| 208 | |
| 209 | chains = [vmchain_default, vmchain, vmchain_egress] |
| 210 | for chain in [_f for _f in chains if _f]: |
| 211 | try: |
| 212 | execute("iptables -F " + chain) |
| 213 | execute('ip6tables -F ' + chain) |
| 214 | except: |
| 215 | logging.debug("Ignoring failure to flush chain: " + chain) |
| 216 | |
| 217 | for chain in [_f for _f in chains if _f]: |
| 218 | try: |
| 219 | execute("iptables -X " + chain) |
| 220 | execute('ip6tables -X ' + chain) |
| 221 | except: |
| 222 | logging.debug("Ignoring failure to delete chain: " + chain) |
| 223 | |
| 224 | try: |
| 225 | for ipset in [vm_ipsetname, vm_ipsetname + '-6']: |
| 226 | execute('ipset -F ' + ipset) |
| 227 | execute('ipset -X ' + ipset) |
| 228 | except: |
| 229 | logging.debug("Ignoring failure to delete ipset " + vmchain) |
| 230 | |
| 231 | if vif: |
| 232 | try: |
| 233 | dnats = execute("""iptables -t nat -S | awk '/%s/ { sub(/-A/, "-D", $1) ; print }'""" % vif ).split("\n") |
| 234 | for dnat in [_f for _f in dnats if _f]: |
| 235 | try: |
| 236 | execute("iptables -t nat " + dnat) |
| 237 | except: |
| 238 | logging.debug("Ignoring failure to delete dnat: " + dnat) |
| 239 | except: |
| 240 | pass |
| 241 | remove_rule_log_for_vm(vm_name) |
| 242 | remove_secip_log_for_vm(vm_name) |
| 243 | |
| 244 | return True |
| 245 | |
| 246 | |
| 247 | def destroy_ebtables_rules(vm_name, vif): |
no test coverage detected