fix for lp783705 - remove nwfilters when instance is terminated

2 files changed, 67 insertions, 2 deletions

diff --git a/nova/tests/test_virt.py b/nova/tests/test_virt.py
index 1311ba361..babb5de9b 100644
--- a/nova/tests/test_virt.py
+++ b/nova/tests/test_virt.py
@@ -1045,3 +1045,45 @@ class NWFilterTestCase(test.TestCase):
                                                  network_info,
                                                  "fake")
         self.assertEquals(len(result), 3)
+
+    def test_unfilter_instance_undefines_nwfilters(self):
+        class FakeNWFilter:
+            def __init__(self):
+                self.undefine_call_count = 0
+
+            def undefine(self):
+                self.undefine_call_count += 1
+                pass
+
+        fakefilter = FakeNWFilter()
+
+        def _nwfilterLookupByName(ignore):
+            return fakefilter
+
+        def _filterDefineXMLMock(xml):
+            return True
+
+        admin_ctxt = context.get_admin_context()
+
+        self.fw._conn.nwfilterDefineXML = _filterDefineXMLMock
+        self.fw._conn.nwfilterLookupByName = _nwfilterLookupByName
+
+        instance_ref = self._create_instance()
+        inst_id = instance_ref['id']
+        instance = db.instance_get(self.context, inst_id)
+
+        ip = '10.11.12.13'
+        network_ref = db.project_get_network(self.context, 'fake')
+        fixed_ip = {'address': ip, 'network_id': network_ref['id']}
+        db.fixed_ip_create(admin_ctxt, fixed_ip)
+        db.fixed_ip_update(admin_ctxt, ip, {'allocated': True,
+                                            'instance_id': inst_id})
+        self.fw.setup_basic_filtering(instance)
+        self.fw.prepare_instance_filter(instance)
+        self.fw.apply_instance_filter(instance)
+        self.fw.unfilter_instance(instance)
+
+        # should attempt to undefine 2 filters: instance and instance-secgroup
+        self.assertEquals(fakefilter.undefine_call_count, 2)
+
+        db.instance_destroy(admin_ctxt, instance_ref['id'])
diff --git a/nova/virt/libvirt_conn.py b/nova/virt/libvirt_conn.py
index 555e44ce2..706973176 100644
--- a/nova/virt/libvirt_conn.py
+++ b/nova/virt/libvirt_conn.py
@@ -1835,8 +1835,30 @@ class NWFilterFirewall(FirewallDriver):
         tpool.execute(self._conn.nwfilterDefineXML, xml)
 
     def unfilter_instance(self, instance):
-        # Nothing to do
-        pass
+        """Clear out the nwfilter rules."""
+        network_info = _get_network_info(instance)
+        instance_name = instance.name
+        for (network, mapping) in network_info:
+            nic_id = mapping['mac'].replace(':', '')
+            instance_filter_name = self._instance_filter_name(instance, nic_id)
+
+            try:
+                self._conn.nwfilterLookupByName(instance_filter_name).\
+                                                    undefine()
+            except libvirt.libvirtError:
+                LOG.debug(_('The nwfilter(%(instance_filter_name)s) for '
+                            '%(instance_name)s is not found.') % locals())
+
+        instance_secgroup_filter_name =\
+            '%s-secgroup' % (self._instance_filter_name(instance))
+
+        try:
+            self._conn.nwfilterLookupByName(instance_secgroup_filter_name).\
+                                                undefine()
+        except libvirt.libvirtError:
+            # This will happen if called by IptablesFirewallDriver
+            LOG.debug(_('The nwfilter(%(instance_secgroup_filter_name)s) for '
+                            '%(instance_name)s is not found.') % locals())
 
     def prepare_instance_filter(self, instance, network_info=None):
         """
@@ -2000,6 +2022,7 @@ class IptablesFirewallDriver(FirewallDriver):
         if self.instances.pop(instance['id'], None):
             self.remove_filters_for_instance(instance)
             self.iptables.apply()
+            self.nwfilter.unfilter_instance(instance)
         else:
             LOG.info(_('Attempted to unfilter instance %s which is not '
                      'filtered'), instance['id'])