[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[libvirt] [PATCH] Drop iptablesContext



iptablesContext holds only 4 pairs of iptables
(table, chain) and there's no need to pass
it around.

This is a first step towards separating bridge_driver.c
in platform-specific parts.
---
 src/libvirt_private.syms    |   2 -
 src/network/bridge_driver.c | 253 +++++++++++++++++--------------------------
 src/util/viriptables.c      | 257 +++++++++++---------------------------------
 src/util/viriptables.h      |  65 ++++-------
 4 files changed, 183 insertions(+), 394 deletions(-)

diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 795e011..062c7fb 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -1417,8 +1417,6 @@ iptablesAddForwardRejectOut;
 iptablesAddOutputFixUdpChecksum;
 iptablesAddTcpInput;
 iptablesAddUdpInput;
-iptablesContextFree;
-iptablesContextNew;
 iptablesRemoveForwardAllowCross;
 iptablesRemoveForwardAllowIn;
 iptablesRemoveForwardAllowOut;
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 2cf49bb..062ec85 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -75,7 +75,6 @@ struct network_driver {
 
     virNetworkObjList networks;
 
-    iptablesContext *iptables;
     char *networkConfigDir;
     char *networkAutostartDir;
     char *stateDir;
@@ -106,8 +105,7 @@ static int networkShutdownNetwork(struct network_driver *driver,
 static int networkStartNetworkVirtual(struct network_driver *driver,
                                      virNetworkObjPtr network);
 
-static int networkShutdownNetworkVirtual(struct network_driver *driver,
-                                        virNetworkObjPtr network);
+static int networkShutdownNetworkVirtual(virNetworkObjPtr network);
 
 static int networkStartNetworkExternal(struct network_driver *driver,
                                      virNetworkObjPtr network);
@@ -420,10 +418,6 @@ networkStateInitialize(bool privileged,
         }
     }
 
-    if (!(driverState->iptables = iptablesContextNew())) {
-        goto out_of_memory;
-    }
-
     /* if this fails now, it will be retried later with dnsmasqCapsRefresh() */
     driverState->dnsmasqCaps = dnsmasqCapsNewFromBinary(DNSMASQ);
 
@@ -531,9 +525,6 @@ networkStateCleanup(void) {
     VIR_FREE(driverState->dnsmasqStateDir);
     VIR_FREE(driverState->radvdStateDir);
 
-    if (driverState->iptables)
-        iptablesContextFree(driverState->iptables);
-
     virObjectUnref(driverState->dnsmasqCaps);
 
     networkDriverUnlock(driverState);
@@ -1544,8 +1535,7 @@ networkRefreshDaemons(struct network_driver *driver)
 }
 
 static int
-networkAddMasqueradingIptablesRules(struct network_driver *driver,
-                                    virNetworkObjPtr network,
+networkAddMasqueradingIptablesRules(virNetworkObjPtr network,
                                     virNetworkIpDefPtr ipdef)
 {
     int prefix = virNetworkIpDefPrefix(ipdef);
@@ -1559,8 +1549,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
     }
 
     /* allow forwarding packets from the bridge interface */
-    if (iptablesAddForwardAllowOut(driver->iptables,
-                                   &ipdef->address,
+    if (iptablesAddForwardAllowOut(&ipdef->address,
                                    prefix,
                                    network->def->bridge,
                                    forwardIf) < 0) {
@@ -1573,8 +1562,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
     /* allow forwarding packets to the bridge interface if they are
      * part of an existing connection
      */
-    if (iptablesAddForwardAllowRelatedIn(driver->iptables,
-                                         &ipdef->address,
+    if (iptablesAddForwardAllowRelatedIn(&ipdef->address,
                                          prefix,
                                          network->def->bridge,
                                          forwardIf) < 0) {
@@ -1608,8 +1596,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
      */
 
     /* First the generic masquerade rule for other protocols */
-    if (iptablesAddForwardMasquerade(driver->iptables,
-                                     &ipdef->address,
+    if (iptablesAddForwardMasquerade(&ipdef->address,
                                      prefix,
                                      forwardIf,
                                      &network->def->forward.addr,
@@ -1626,8 +1613,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
     }
 
     /* UDP with a source port restriction */
-    if (iptablesAddForwardMasquerade(driver->iptables,
-                                     &ipdef->address,
+    if (iptablesAddForwardMasquerade(&ipdef->address,
                                      prefix,
                                      forwardIf,
                                      &network->def->forward.addr,
@@ -1644,8 +1630,7 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
     }
 
     /* TCP with a source port restriction */
-    if (iptablesAddForwardMasquerade(driver->iptables,
-                                     &ipdef->address,
+    if (iptablesAddForwardMasquerade(&ipdef->address,
                                      prefix,
                                      forwardIf,
                                      &network->def->forward.addr,
@@ -1664,30 +1649,26 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
     return 0;
 
  masqerr5:
-    iptablesRemoveForwardMasquerade(driver->iptables,
-                                    &ipdef->address,
+    iptablesRemoveForwardMasquerade(&ipdef->address,
                                     prefix,
                                     forwardIf,
                                     &network->def->forward.addr,
                                     &network->def->forward.port,
                                     "udp");
  masqerr4:
-    iptablesRemoveForwardMasquerade(driver->iptables,
-                                    &ipdef->address,
+    iptablesRemoveForwardMasquerade(&ipdef->address,
                                     prefix,
                                     forwardIf,
                                     &network->def->forward.addr,
                                     &network->def->forward.port,
                                     NULL);
  masqerr3:
-    iptablesRemoveForwardAllowRelatedIn(driver->iptables,
-                                        &ipdef->address,
+    iptablesRemoveForwardAllowRelatedIn(&ipdef->address,
                                         prefix,
                                         network->def->bridge,
                                         forwardIf);
  masqerr2:
-    iptablesRemoveForwardAllowOut(driver->iptables,
-                                  &ipdef->address,
+    iptablesRemoveForwardAllowOut(&ipdef->address,
                                   prefix,
                                   network->def->bridge,
                                   forwardIf);
@@ -1696,43 +1677,37 @@ networkAddMasqueradingIptablesRules(struct network_driver *driver,
 }
 
 static void
-networkRemoveMasqueradingIptablesRules(struct network_driver *driver,
-                                       virNetworkObjPtr network,
+networkRemoveMasqueradingIptablesRules(virNetworkObjPtr network,
                                        virNetworkIpDefPtr ipdef)
 {
     int prefix = virNetworkIpDefPrefix(ipdef);
     const char *forwardIf = virNetworkDefForwardIf(network->def, 0);
 
     if (prefix >= 0) {
-        iptablesRemoveForwardMasquerade(driver->iptables,
-                                        &ipdef->address,
+        iptablesRemoveForwardMasquerade(&ipdef->address,
                                         prefix,
                                         forwardIf,
                                         &network->def->forward.addr,
                                         &network->def->forward.port,
                                         "tcp");
-        iptablesRemoveForwardMasquerade(driver->iptables,
-                                        &ipdef->address,
+        iptablesRemoveForwardMasquerade(&ipdef->address,
                                         prefix,
                                         forwardIf,
                                         &network->def->forward.addr,
                                         &network->def->forward.port,
                                         "udp");
-        iptablesRemoveForwardMasquerade(driver->iptables,
-                                        &ipdef->address,
+        iptablesRemoveForwardMasquerade(&ipdef->address,
                                         prefix,
                                         forwardIf,
                                         &network->def->forward.addr,
                                         &network->def->forward.port,
                                         NULL);
 
-        iptablesRemoveForwardAllowRelatedIn(driver->iptables,
-                                            &ipdef->address,
+        iptablesRemoveForwardAllowRelatedIn(&ipdef->address,
                                             prefix,
                                             network->def->bridge,
                                             forwardIf);
-        iptablesRemoveForwardAllowOut(driver->iptables,
-                                      &ipdef->address,
+        iptablesRemoveForwardAllowOut(&ipdef->address,
                                       prefix,
                                       network->def->bridge,
                                       forwardIf);
@@ -1740,8 +1715,7 @@ networkRemoveMasqueradingIptablesRules(struct network_driver *driver,
 }
 
 static int
-networkAddRoutingIptablesRules(struct network_driver *driver,
-                               virNetworkObjPtr network,
+networkAddRoutingIptablesRules(virNetworkObjPtr network,
                                virNetworkIpDefPtr ipdef)
 {
     int prefix = virNetworkIpDefPrefix(ipdef);
@@ -1755,8 +1729,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
     }
 
     /* allow routing packets from the bridge interface */
-    if (iptablesAddForwardAllowOut(driver->iptables,
-                                   &ipdef->address,
+    if (iptablesAddForwardAllowOut(&ipdef->address,
                                    prefix,
                                    network->def->bridge,
                                    forwardIf) < 0) {
@@ -1767,8 +1740,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
     }
 
     /* allow routing packets to the bridge interface */
-    if (iptablesAddForwardAllowIn(driver->iptables,
-                                  &ipdef->address,
+    if (iptablesAddForwardAllowIn(&ipdef->address,
                                   prefix,
                                   network->def->bridge,
                                   forwardIf) < 0) {
@@ -1781,8 +1753,7 @@ networkAddRoutingIptablesRules(struct network_driver *driver,
     return 0;
 
 routeerr2:
-    iptablesRemoveForwardAllowOut(driver->iptables,
-                                  &ipdef->address,
+    iptablesRemoveForwardAllowOut(&ipdef->address,
                                   prefix,
                                   network->def->bridge,
                                   forwardIf);
@@ -1791,22 +1762,19 @@ routeerr1:
 }
 
 static void
-networkRemoveRoutingIptablesRules(struct network_driver *driver,
-                                  virNetworkObjPtr network,
+networkRemoveRoutingIptablesRules(virNetworkObjPtr network,
                                   virNetworkIpDefPtr ipdef)
 {
     int prefix = virNetworkIpDefPrefix(ipdef);
     const char *forwardIf = virNetworkDefForwardIf(network->def, 0);
 
     if (prefix >= 0) {
-        iptablesRemoveForwardAllowIn(driver->iptables,
-                                     &ipdef->address,
+        iptablesRemoveForwardAllowIn(&ipdef->address,
                                      prefix,
                                      network->def->bridge,
                                      forwardIf);
 
-        iptablesRemoveForwardAllowOut(driver->iptables,
-                                      &ipdef->address,
+        iptablesRemoveForwardAllowOut(&ipdef->address,
                                       prefix,
                                       network->def->bridge,
                                       forwardIf);
@@ -1819,8 +1787,7 @@ networkRemoveRoutingIptablesRules(struct network_driver *driver,
  * If any IPv6 addresses are defined, then add the rules for regular operation.
  */
 static int
-networkAddGeneralIp6tablesRules(struct network_driver *driver,
-                               virNetworkObjPtr network)
+networkAddGeneralIp6tablesRules(virNetworkObjPtr network)
 {
 
     if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) &&
@@ -1830,16 +1797,14 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver,
 
     /* Catch all rules to block forwarding to/from bridges */
 
-    if (iptablesAddForwardRejectOut(driver->iptables, AF_INET6,
-                                    network->def->bridge) < 0) {
+    if (iptablesAddForwardRejectOut(AF_INET6, network->def->bridge) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add ip6tables rule to block outbound traffic from '%s'"),
                        network->def->bridge);
         goto err1;
     }
 
-    if (iptablesAddForwardRejectIn(driver->iptables, AF_INET6,
-                                   network->def->bridge) < 0) {
+    if (iptablesAddForwardRejectIn(AF_INET6, network->def->bridge) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add ip6tables rule to block inbound traffic to '%s'"),
                        network->def->bridge);
@@ -1847,8 +1812,7 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver,
     }
 
     /* Allow traffic between guests on the same bridge */
-    if (iptablesAddForwardAllowCross(driver->iptables, AF_INET6,
-                                     network->def->bridge) < 0) {
+    if (iptablesAddForwardAllowCross(AF_INET6, network->def->bridge) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add ip6tables rule to allow cross bridge traffic on '%s'"),
                        network->def->bridge);
@@ -1860,24 +1824,21 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver,
         return 0;
 
     /* allow DNS over IPv6 */
-    if (iptablesAddTcpInput(driver->iptables, AF_INET6,
-                            network->def->bridge, 53) < 0) {
+    if (iptablesAddTcpInput(AF_INET6, network->def->bridge, 53) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add ip6tables rule to allow DNS requests from '%s'"),
                        network->def->bridge);
         goto err4;
     }
 
-    if (iptablesAddUdpInput(driver->iptables, AF_INET6,
-                            network->def->bridge, 53) < 0) {
+    if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 53) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add ip6tables rule to allow DNS requests from '%s'"),
                        network->def->bridge);
         goto err5;
     }
 
-    if (iptablesAddUdpInput(driver->iptables, AF_INET6,
-                            network->def->bridge, 547) < 0) {
+    if (iptablesAddUdpInput(AF_INET6, network->def->bridge, 547) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add ip6tables rule to allow DHCP6 requests from '%s'"),
                        network->def->bridge);
@@ -1888,44 +1849,42 @@ networkAddGeneralIp6tablesRules(struct network_driver *driver,
 
     /* unwind in reverse order from the point of failure */
 err6:
-    iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53);
+    iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53);
 err5:
-    iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53);
+    iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53);
 err4:
-    iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge);
+    iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge);
 err3:
-    iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge);
+    iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge);
 err2:
-    iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge);
+    iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge);
 err1:
     return -1;
 }
 
 static void
-networkRemoveGeneralIp6tablesRules(struct network_driver *driver,
-                                  virNetworkObjPtr network)
+networkRemoveGeneralIp6tablesRules(virNetworkObjPtr network)
 {
     if (!virNetworkDefGetIpByIndex(network->def, AF_INET6, 0) &&
         !network->def->ipv6nogw) {
         return;
     }
     if (virNetworkDefGetIpByIndex(network->def, AF_INET6, 0)) {
-        iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 547);
-        iptablesRemoveUdpInput(driver->iptables, AF_INET6, network->def->bridge, 53);
-        iptablesRemoveTcpInput(driver->iptables, AF_INET6, network->def->bridge, 53);
+        iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 547);
+        iptablesRemoveUdpInput(AF_INET6, network->def->bridge, 53);
+        iptablesRemoveTcpInput(AF_INET6, network->def->bridge, 53);
     }
 
     /* the following rules are there if no IPv6 address has been defined
      * but network->def->ipv6nogw == true
      */
-    iptablesRemoveForwardAllowCross(driver->iptables, AF_INET6, network->def->bridge);
-    iptablesRemoveForwardRejectIn(driver->iptables, AF_INET6, network->def->bridge);
-    iptablesRemoveForwardRejectOut(driver->iptables, AF_INET6, network->def->bridge);
+    iptablesRemoveForwardAllowCross(AF_INET6, network->def->bridge);
+    iptablesRemoveForwardRejectIn(AF_INET6, network->def->bridge);
+    iptablesRemoveForwardRejectOut(AF_INET6, network->def->bridge);
 }
 
 static int
-networkAddGeneralIptablesRules(struct network_driver *driver,
-                               virNetworkObjPtr network)
+networkAddGeneralIptablesRules(virNetworkObjPtr network)
 {
     int ii;
     virNetworkIpDefPtr ipv4def;
@@ -1941,16 +1900,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
 
     /* allow DHCP requests through to dnsmasq */
 
-    if (iptablesAddTcpInput(driver->iptables, AF_INET,
-                            network->def->bridge, 67) < 0) {
+    if (iptablesAddTcpInput(AF_INET, network->def->bridge, 67) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to allow DHCP requests from '%s'"),
                        network->def->bridge);
         goto err1;
     }
 
-    if (iptablesAddUdpInput(driver->iptables, AF_INET,
-                            network->def->bridge, 67) < 0) {
+    if (iptablesAddUdpInput(AF_INET, network->def->bridge, 67) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to allow DHCP requests from '%s'"),
                        network->def->bridge);
@@ -1964,24 +1921,21 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
      */
 
     if (ipv4def && (ipv4def->nranges || ipv4def->nhosts) &&
-        (iptablesAddOutputFixUdpChecksum(driver->iptables,
-                                         network->def->bridge, 68) < 0)) {
+        (iptablesAddOutputFixUdpChecksum(network->def->bridge, 68) < 0)) {
         VIR_WARN("Could not add rule to fixup DHCP response checksums "
                  "on network '%s'.", network->def->name);
         VIR_WARN("May need to update iptables package & kernel to support CHECKSUM rule.");
     }
 
     /* allow DNS requests through to dnsmasq */
-    if (iptablesAddTcpInput(driver->iptables, AF_INET,
-                            network->def->bridge, 53) < 0) {
+    if (iptablesAddTcpInput(AF_INET, network->def->bridge, 53) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to allow DNS requests from '%s'"),
                        network->def->bridge);
         goto err3;
     }
 
-    if (iptablesAddUdpInput(driver->iptables, AF_INET,
-                            network->def->bridge, 53) < 0) {
+    if (iptablesAddUdpInput(AF_INET, network->def->bridge, 53) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to allow DNS requests from '%s'"),
                        network->def->bridge);
@@ -1990,8 +1944,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
 
     /* allow TFTP requests through to dnsmasq if necessary */
     if (ipv4def && ipv4def->tftproot &&
-        iptablesAddUdpInput(driver->iptables, AF_INET,
-                            network->def->bridge, 69) < 0) {
+        iptablesAddUdpInput(AF_INET, network->def->bridge, 69) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to allow TFTP requests from '%s'"),
                        network->def->bridge);
@@ -2000,16 +1953,14 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
 
     /* Catch all rules to block forwarding to/from bridges */
 
-    if (iptablesAddForwardRejectOut(driver->iptables, AF_INET,
-                                    network->def->bridge) < 0) {
+    if (iptablesAddForwardRejectOut(AF_INET, network->def->bridge) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to block outbound traffic from '%s'"),
                        network->def->bridge);
         goto err6;
     }
 
-    if (iptablesAddForwardRejectIn(driver->iptables, AF_INET,
-                                   network->def->bridge) < 0) {
+    if (iptablesAddForwardRejectIn(AF_INET, network->def->bridge) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to block inbound traffic to '%s'"),
                        network->def->bridge);
@@ -2017,8 +1968,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
     }
 
     /* Allow traffic between guests on the same bridge */
-    if (iptablesAddForwardAllowCross(driver->iptables, AF_INET,
-                                     network->def->bridge) < 0) {
+    if (iptablesAddForwardAllowCross(AF_INET, network->def->bridge) < 0) {
         virReportError(VIR_ERR_SYSTEM_ERROR,
                        _("failed to add iptables rule to allow cross bridge traffic on '%s'"),
                        network->def->bridge);
@@ -2026,7 +1976,7 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
     }
 
     /* add IPv6 general rules, if needed */
-    if (networkAddGeneralIp6tablesRules(driver, network) < 0) {
+    if (networkAddGeneralIp6tablesRules(network) < 0) {
         goto err9;
     }
 
@@ -2034,35 +1984,34 @@ networkAddGeneralIptablesRules(struct network_driver *driver,
 
     /* unwind in reverse order from the point of failure */
 err9:
-    iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge);
+    iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge);
 err8:
-    iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge);
+    iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge);
 err7:
-    iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge);
+    iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge);
 err6:
     if (ipv4def && ipv4def->tftproot) {
-        iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69);
+        iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69);
     }
 err5:
-    iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53);
+    iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53);
 err4:
-    iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53);
+    iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53);
 err3:
-    iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67);
+    iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67);
 err2:
-    iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67);
+    iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67);
 err1:
     return -1;
 }
 
 static void
-networkRemoveGeneralIptablesRules(struct network_driver *driver,
-                                  virNetworkObjPtr network)
+networkRemoveGeneralIptablesRules(virNetworkObjPtr network)
 {
     int ii;
     virNetworkIpDefPtr ipv4def;
 
-    networkRemoveGeneralIp6tablesRules(driver, network);
+    networkRemoveGeneralIp6tablesRules(network);
 
     for (ii = 0;
          (ipv4def = virNetworkDefGetIpByIndex(network->def, AF_INET, ii));
@@ -2071,25 +2020,23 @@ networkRemoveGeneralIptablesRules(struct network_driver *driver,
             break;
     }
 
-    iptablesRemoveForwardAllowCross(driver->iptables, AF_INET, network->def->bridge);
-    iptablesRemoveForwardRejectIn(driver->iptables, AF_INET, network->def->bridge);
-    iptablesRemoveForwardRejectOut(driver->iptables, AF_INET, network->def->bridge);
+    iptablesRemoveForwardAllowCross(AF_INET, network->def->bridge);
+    iptablesRemoveForwardRejectIn(AF_INET, network->def->bridge);
+    iptablesRemoveForwardRejectOut(AF_INET, network->def->bridge);
     if (ipv4def && ipv4def->tftproot) {
-        iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 69);
+        iptablesRemoveUdpInput(AF_INET, network->def->bridge, 69);
     }
-    iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 53);
-    iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 53);
+    iptablesRemoveUdpInput(AF_INET, network->def->bridge, 53);
+    iptablesRemoveTcpInput(AF_INET, network->def->bridge, 53);
     if (ipv4def && (ipv4def->nranges || ipv4def->nhosts)) {
-        iptablesRemoveOutputFixUdpChecksum(driver->iptables,
-                                           network->def->bridge, 68);
+        iptablesRemoveOutputFixUdpChecksum(network->def->bridge, 68);
     }
-    iptablesRemoveUdpInput(driver->iptables, AF_INET, network->def->bridge, 67);
-    iptablesRemoveTcpInput(driver->iptables, AF_INET, network->def->bridge, 67);
+    iptablesRemoveUdpInput(AF_INET, network->def->bridge, 67);
+    iptablesRemoveTcpInput(AF_INET, network->def->bridge, 67);
 }
 
 static int
-networkAddIpSpecificIptablesRules(struct network_driver *driver,
-                                  virNetworkObjPtr network,
+networkAddIpSpecificIptablesRules(virNetworkObjPtr network,
                                   virNetworkIpDefPtr ipdef)
 {
     /* NB: in the case of IPv6, routing rules are added when the
@@ -2098,48 +2045,46 @@ networkAddIpSpecificIptablesRules(struct network_driver *driver,
 
     if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) {
         if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET))
-            return networkAddMasqueradingIptablesRules(driver, network, ipdef);
+            return networkAddMasqueradingIptablesRules(network, ipdef);
         else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6))
-            return networkAddRoutingIptablesRules(driver, network, ipdef);
+            return networkAddRoutingIptablesRules(network, ipdef);
     } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) {
-        return networkAddRoutingIptablesRules(driver, network, ipdef);
+        return networkAddRoutingIptablesRules(network, ipdef);
     }
     return 0;
 }
 
 static void
-networkRemoveIpSpecificIptablesRules(struct network_driver *driver,
-                                     virNetworkObjPtr network,
+networkRemoveIpSpecificIptablesRules(virNetworkObjPtr network,
                                      virNetworkIpDefPtr ipdef)
 {
     if (network->def->forward.type == VIR_NETWORK_FORWARD_NAT) {
         if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET))
-            networkRemoveMasqueradingIptablesRules(driver, network, ipdef);
+            networkRemoveMasqueradingIptablesRules(network, ipdef);
         else if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET6))
-            networkRemoveRoutingIptablesRules(driver, network, ipdef);
+            networkRemoveRoutingIptablesRules(network, ipdef);
     } else if (network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE) {
-        networkRemoveRoutingIptablesRules(driver, network, ipdef);
+        networkRemoveRoutingIptablesRules(network, ipdef);
     }
 }
 
 /* Add all rules for all ip addresses (and general rules) on a network */
 static int
-networkAddIptablesRules(struct network_driver *driver,
-                        virNetworkObjPtr network)
+networkAddIptablesRules(virNetworkObjPtr network)
 {
     int ii;
     virNetworkIpDefPtr ipdef;
     virErrorPtr orig_error;
 
     /* Add "once per network" rules */
-    if (networkAddGeneralIptablesRules(driver, network) < 0)
+    if (networkAddGeneralIptablesRules(network) < 0)
         return -1;
 
     for (ii = 0;
          (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii));
          ii++) {
         /* Add address-specific iptables rules */
-        if (networkAddIpSpecificIptablesRules(driver, network, ipdef) < 0) {
+        if (networkAddIpSpecificIptablesRules(network, ipdef) < 0) {
             goto err;
         }
     }
@@ -2155,9 +2100,9 @@ err:
      */
     while ((--ii >= 0) &&
            (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii))) {
-        networkRemoveIpSpecificIptablesRules(driver, network, ipdef);
+        networkRemoveIpSpecificIptablesRules(network, ipdef);
     }
-    networkRemoveGeneralIptablesRules(driver, network);
+    networkRemoveGeneralIptablesRules(network);
 
     /* return the original error */
     virSetError(orig_error);
@@ -2167,8 +2112,7 @@ err:
 
 /* Remove all rules for all ip addresses (and general rules) on a network */
 static void
-networkRemoveIptablesRules(struct network_driver *driver,
-                           virNetworkObjPtr network)
+networkRemoveIptablesRules(virNetworkObjPtr network)
 {
     int ii;
     virNetworkIpDefPtr ipdef;
@@ -2176,9 +2120,9 @@ networkRemoveIptablesRules(struct network_driver *driver,
     for (ii = 0;
          (ipdef = virNetworkDefGetIpByIndex(network->def, AF_UNSPEC, ii));
          ii++) {
-        networkRemoveIpSpecificIptablesRules(driver, network, ipdef);
+        networkRemoveIpSpecificIptablesRules(network, ipdef);
     }
-    networkRemoveGeneralIptablesRules(driver, network);
+    networkRemoveGeneralIptablesRules(network);
 }
 
 static void
@@ -2199,8 +2143,8 @@ networkReloadIptablesRules(struct network_driver *driver)
             /* Only the three L3 network types that are configured by libvirt
              * need to have iptables rules reloaded.
              */
-            networkRemoveIptablesRules(driver, network);
-            if (networkAddIptablesRules(driver, network) < 0) {
+            networkRemoveIptablesRules(network);
+            if (networkAddIptablesRules(network) < 0) {
                 /* failed to add but already logged */
             }
         }
@@ -2526,7 +2470,7 @@ networkStartNetworkVirtual(struct network_driver *driver,
         goto err1;
 
     /* Add "once per network" rules */
-    if (networkAddIptablesRules(driver, network) < 0)
+    if (networkAddIptablesRules(network) < 0)
         goto err1;
 
     for (ii = 0;
@@ -2619,7 +2563,7 @@ networkStartNetworkVirtual(struct network_driver *driver,
  err2:
     if (!save_err)
         save_err = virSaveLastError();
-    networkRemoveIptablesRules(driver, network);
+    networkRemoveIptablesRules(network);
 
  err1:
     if (!save_err)
@@ -2644,8 +2588,7 @@ networkStartNetworkVirtual(struct network_driver *driver,
     return -1;
 }
 
-static int networkShutdownNetworkVirtual(struct network_driver *driver,
-                                        virNetworkObjPtr network)
+static int networkShutdownNetworkVirtual(virNetworkObjPtr network)
 {
     virNetDevBandwidthClear(network->def->bridge);
 
@@ -2677,7 +2620,7 @@ static int networkShutdownNetworkVirtual(struct network_driver *driver,
 
     ignore_value(virNetDevSetOnline(network->def->bridge, 0));
 
-    networkRemoveIptablesRules(driver, network);
+    networkRemoveIptablesRules(network);
 
     ignore_value(virNetDevBridgeDelete(network->def->bridge));
 
@@ -2802,7 +2745,7 @@ static int networkShutdownNetwork(struct network_driver *driver,
     case VIR_NETWORK_FORWARD_NONE:
     case VIR_NETWORK_FORWARD_NAT:
     case VIR_NETWORK_FORWARD_ROUTE:
-        ret = networkShutdownNetworkVirtual(driver, network);
+        ret = networkShutdownNetworkVirtual(network);
         break;
 
     case VIR_NETWORK_FORWARD_BRIDGE:
@@ -3490,8 +3433,8 @@ networkUpdate(virNetworkPtr net,
             network->def->forward.type == VIR_NETWORK_FORWARD_NAT ||
             network->def->forward.type == VIR_NETWORK_FORWARD_ROUTE)) {
             /* these could affect the iptables rules */
-            networkRemoveIptablesRules(driver, network);
-            if (networkAddIptablesRules(driver, network) < 0)
+            networkRemoveIptablesRules(network);
+            if (networkAddIptablesRules(network) < 0)
                 goto cleanup;
 
         }
diff --git a/src/util/viriptables.c b/src/util/viriptables.c
index 16fbe9c..63a8031 100644
--- a/src/util/viriptables.c
+++ b/src/util/viriptables.c
@@ -88,52 +88,8 @@ enum {
     REMOVE
 };
 
-typedef struct
-{
-    char  *table;
-    char  *chain;
-} iptRules;
-
-struct _iptablesContext
-{
-    iptRules *input_filter;
-    iptRules *forward_filter;
-    iptRules *nat_postrouting;
-    iptRules *mangle_postrouting;
-};
-
-static void
-iptRulesFree(iptRules *rules)
-{
-    VIR_FREE(rules->table);
-    VIR_FREE(rules->chain);
-    VIR_FREE(rules);
-}
-
-static iptRules *
-iptRulesNew(const char *table,
-            const char *chain)
-{
-    iptRules *rules;
-
-    if (VIR_ALLOC(rules) < 0)
-        return NULL;
-
-    if (VIR_STRDUP(rules->table, table) < 0)
-        goto error;
-
-    if (VIR_STRDUP(rules->chain, chain) < 0)
-        goto error;
-
-    return rules;
-
- error:
-    iptRulesFree(rules);
-    return NULL;
-}
-
 static virCommandPtr
-iptablesCommandNew(iptRules *rules, int family, int action)
+iptablesCommandNew(const char *table, const char *chain, int family, int action)
 {
     virCommandPtr cmd = NULL;
 #if HAVE_FIREWALLD
@@ -150,9 +106,9 @@ iptablesCommandNew(iptRules *rules, int family, int action)
                         ? IP6TABLES_PATH : IPTABLES_PATH);
     }
 
-    virCommandAddArgList(cmd, "--table", rules->table,
+    virCommandAddArgList(cmd, "--table", table,
                          action == ADD ? "--insert" : "--delete",
-                         rules->chain, NULL);
+                         chain, NULL);
     return cmd;
 }
 
@@ -166,14 +122,14 @@ iptablesCommandRunAndFree(virCommandPtr cmd)
 }
 
 static int ATTRIBUTE_SENTINEL
-iptablesAddRemoveRule(iptRules *rules, int family, int action,
+iptablesAddRemoveRule(const char *table, const char *chain, int family, int action,
                       const char *arg, ...)
 {
     va_list args;
     virCommandPtr cmd = NULL;
     const char *s;
 
-    cmd = iptablesCommandNew(rules, family, action);
+    cmd = iptablesCommandNew(table, chain, family, action);
     virCommandAddArg(cmd, arg);
 
     va_start(args, arg);
@@ -184,63 +140,8 @@ iptablesAddRemoveRule(iptRules *rules, int family, int action,
     return iptablesCommandRunAndFree(cmd);
 }
 
-/**
- * iptablesContextNew:
- *
- * Create a new IPtable context
- *
- * Returns a pointer to the new structure or NULL in case of error
- */
-iptablesContext *
-iptablesContextNew(void)
-{
-    iptablesContext *ctx;
-
-    if (VIR_ALLOC(ctx) < 0)
-        return NULL;
-
-    if (!(ctx->input_filter = iptRulesNew("filter", "INPUT")))
-        goto error;
-
-    if (!(ctx->forward_filter = iptRulesNew("filter", "FORWARD")))
-        goto error;
-
-    if (!(ctx->nat_postrouting = iptRulesNew("nat", "POSTROUTING")))
-        goto error;
-
-    if (!(ctx->mangle_postrouting = iptRulesNew("mangle", "POSTROUTING")))
-        goto error;
-
-    return ctx;
-
- error:
-    iptablesContextFree(ctx);
-    return NULL;
-}
-
-/**
- * iptablesContextFree:
- * @ctx: pointer to the IP table context
- *
- * Free the resources associated with an IP table context
- */
-void
-iptablesContextFree(iptablesContext *ctx)
-{
-    if (ctx->input_filter)
-        iptRulesFree(ctx->input_filter);
-    if (ctx->forward_filter)
-        iptRulesFree(ctx->forward_filter);
-    if (ctx->nat_postrouting)
-        iptRulesFree(ctx->nat_postrouting);
-    if (ctx->mangle_postrouting)
-        iptRulesFree(ctx->mangle_postrouting);
-    VIR_FREE(ctx);
-}
-
 static int
-iptablesInput(iptablesContext *ctx,
-              int family,
+iptablesInput(int family,
               const char *iface,
               int port,
               int action,
@@ -251,7 +152,7 @@ iptablesInput(iptablesContext *ctx,
     snprintf(portstr, sizeof(portstr), "%d", port);
     portstr[sizeof(portstr) - 1] = '\0';
 
-    return iptablesAddRemoveRule(ctx->input_filter,
+    return iptablesAddRemoveRule("filter", "INPUT",
                                  family,
                                  action,
                                  "--in-interface", iface,
@@ -274,12 +175,11 @@ iptablesInput(iptablesContext *ctx,
  */
 
 int
-iptablesAddTcpInput(iptablesContext *ctx,
-                    int family,
+iptablesAddTcpInput(int family,
                     const char *iface,
                     int port)
 {
-    return iptablesInput(ctx, family, iface, port, ADD, 1);
+    return iptablesInput(family, iface, port, ADD, 1);
 }
 
 /**
@@ -294,12 +194,11 @@ iptablesAddTcpInput(iptablesContext *ctx,
  * Returns 0 in case of success or an error code in case of error
  */
 int
-iptablesRemoveTcpInput(iptablesContext *ctx,
-                       int family,
+iptablesRemoveTcpInput(int family,
                        const char *iface,
                        int port)
 {
-    return iptablesInput(ctx, family, iface, port, REMOVE, 1);
+    return iptablesInput(family, iface, port, REMOVE, 1);
 }
 
 /**
@@ -315,12 +214,11 @@ iptablesRemoveTcpInput(iptablesContext *ctx,
  */
 
 int
-iptablesAddUdpInput(iptablesContext *ctx,
-                    int family,
+iptablesAddUdpInput(int family,
                     const char *iface,
                     int port)
 {
-    return iptablesInput(ctx, family, iface, port, ADD, 0);
+    return iptablesInput(family, iface, port, ADD, 0);
 }
 
 /**
@@ -335,12 +233,11 @@ iptablesAddUdpInput(iptablesContext *ctx,
  * Returns 0 in case of success or an error code in case of error
  */
 int
-iptablesRemoveUdpInput(iptablesContext *ctx,
-                       int family,
+iptablesRemoveUdpInput(int family,
                        const char *iface,
                        int port)
 {
-    return iptablesInput(ctx, family, iface, port, REMOVE, 0);
+    return iptablesInput(family, iface, port, REMOVE, 0);
 }
 
 
@@ -381,8 +278,7 @@ static char *iptablesFormatNetwork(virSocketAddr *netaddr,
  * to proceed to WAN
  */
 static int
-iptablesForwardAllowOut(iptablesContext *ctx,
-                        virSocketAddr *netaddr,
+iptablesForwardAllowOut(virSocketAddr *netaddr,
                         unsigned int prefix,
                         const char *iface,
                         const char *physdev,
@@ -395,7 +291,7 @@ iptablesForwardAllowOut(iptablesContext *ctx,
     if (!(networkstr = iptablesFormatNetwork(netaddr, prefix)))
         return -1;
 
-    cmd = iptablesCommandNew(ctx->forward_filter,
+    cmd = iptablesCommandNew("filter", "FORWARD",
                              VIR_SOCKET_ADDR_FAMILY(netaddr),
                              action);
     virCommandAddArgList(cmd,
@@ -426,13 +322,12 @@ iptablesForwardAllowOut(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardAllowOut(iptablesContext *ctx,
-                           virSocketAddr *netaddr,
+iptablesAddForwardAllowOut(virSocketAddr *netaddr,
                            unsigned int prefix,
                            const char *iface,
                            const char *physdev)
 {
-    return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, ADD);
+    return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, ADD);
 }
 
 /**
@@ -449,13 +344,12 @@ iptablesAddForwardAllowOut(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardAllowOut(iptablesContext *ctx,
-                              virSocketAddr *netaddr,
+iptablesRemoveForwardAllowOut(virSocketAddr *netaddr,
                               unsigned int prefix,
                               const char *iface,
                               const char *physdev)
 {
-    return iptablesForwardAllowOut(ctx, netaddr, prefix, iface, physdev, REMOVE);
+    return iptablesForwardAllowOut(netaddr, prefix, iface, physdev, REMOVE);
 }
 
 
@@ -463,8 +357,7 @@ iptablesRemoveForwardAllowOut(iptablesContext *ctx,
  * and associated with an existing connection
  */
 static int
-iptablesForwardAllowRelatedIn(iptablesContext *ctx,
-                              virSocketAddr *netaddr,
+iptablesForwardAllowRelatedIn(virSocketAddr *netaddr,
                               unsigned int prefix,
                               const char *iface,
                               const char *physdev,
@@ -477,7 +370,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx,
         return -1;
 
     if (physdev && physdev[0]) {
-        ret = iptablesAddRemoveRule(ctx->forward_filter,
+        ret = iptablesAddRemoveRule("filter", "FORWARD",
                                     VIR_SOCKET_ADDR_FAMILY(netaddr),
                                     action,
                                     "--destination", networkstr,
@@ -488,7 +381,7 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx,
                                     "--jump", "ACCEPT",
                                     NULL);
     } else {
-        ret = iptablesAddRemoveRule(ctx->forward_filter,
+        ret = iptablesAddRemoveRule("filter", "FORWARD",
                                     VIR_SOCKET_ADDR_FAMILY(netaddr),
                                     action,
                                     "--destination", networkstr,
@@ -516,13 +409,12 @@ iptablesForwardAllowRelatedIn(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
-                                 virSocketAddr *netaddr,
+iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr,
                                  unsigned int prefix,
                                  const char *iface,
                                  const char *physdev)
 {
-    return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, ADD);
+    return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, ADD);
 }
 
 /**
@@ -539,20 +431,18 @@ iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx,
-                                    virSocketAddr *netaddr,
+iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr,
                                     unsigned int prefix,
                                     const char *iface,
                                     const char *physdev)
 {
-    return iptablesForwardAllowRelatedIn(ctx, netaddr, prefix, iface, physdev, REMOVE);
+    return iptablesForwardAllowRelatedIn(netaddr, prefix, iface, physdev, REMOVE);
 }
 
 /* Allow all traffic destined to the bridge, with a valid network address
  */
 static int
-iptablesForwardAllowIn(iptablesContext *ctx,
-                       virSocketAddr *netaddr,
+iptablesForwardAllowIn(virSocketAddr *netaddr,
                        unsigned int prefix,
                        const char *iface,
                        const char *physdev,
@@ -565,7 +455,7 @@ iptablesForwardAllowIn(iptablesContext *ctx,
         return -1;
 
     if (physdev && physdev[0]) {
-        ret = iptablesAddRemoveRule(ctx->forward_filter,
+        ret = iptablesAddRemoveRule("filter", "FORWARD",
                                     VIR_SOCKET_ADDR_FAMILY(netaddr),
                                     action,
                                     "--destination", networkstr,
@@ -574,7 +464,7 @@ iptablesForwardAllowIn(iptablesContext *ctx,
                                     "--jump", "ACCEPT",
                                     NULL);
     } else {
-        ret = iptablesAddRemoveRule(ctx->forward_filter,
+        ret = iptablesAddRemoveRule("filter", "FORWARD",
                                     VIR_SOCKET_ADDR_FAMILY(netaddr),
                                     action,
                                     "--destination", networkstr,
@@ -600,13 +490,12 @@ iptablesForwardAllowIn(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardAllowIn(iptablesContext *ctx,
-                          virSocketAddr *netaddr,
+iptablesAddForwardAllowIn(virSocketAddr *netaddr,
                           unsigned int prefix,
                           const char *iface,
                           const char *physdev)
 {
-    return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, ADD);
+    return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, ADD);
 }
 
 /**
@@ -623,13 +512,12 @@ iptablesAddForwardAllowIn(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardAllowIn(iptablesContext *ctx,
-                             virSocketAddr *netaddr,
+iptablesRemoveForwardAllowIn(virSocketAddr *netaddr,
                              unsigned int prefix,
                              const char *iface,
                              const char *physdev)
 {
-    return iptablesForwardAllowIn(ctx, netaddr, prefix, iface, physdev, REMOVE);
+    return iptablesForwardAllowIn(netaddr, prefix, iface, physdev, REMOVE);
 }
 
 
@@ -637,12 +525,11 @@ iptablesRemoveForwardAllowIn(iptablesContext *ctx,
  * with a valid network address
  */
 static int
-iptablesForwardAllowCross(iptablesContext *ctx,
-                          int family,
+iptablesForwardAllowCross(int family,
                           const char *iface,
                           int action)
 {
-    return iptablesAddRemoveRule(ctx->forward_filter,
+    return iptablesAddRemoveRule("filter", "FORWARD",
                                  family,
                                  action,
                                  "--in-interface", iface,
@@ -663,11 +550,10 @@ iptablesForwardAllowCross(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardAllowCross(iptablesContext *ctx,
-                             int family,
+iptablesAddForwardAllowCross(int family,
                              const char *iface)
 {
-    return iptablesForwardAllowCross(ctx, family, iface, ADD);
+    return iptablesForwardAllowCross(family, iface, ADD);
 }
 
 /**
@@ -682,11 +568,10 @@ iptablesAddForwardAllowCross(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardAllowCross(iptablesContext *ctx,
-                                int family,
+iptablesRemoveForwardAllowCross(int family,
                                 const char *iface)
 {
-    return iptablesForwardAllowCross(ctx, family, iface, REMOVE);
+    return iptablesForwardAllowCross(family, iface, REMOVE);
 }
 
 
@@ -694,12 +579,11 @@ iptablesRemoveForwardAllowCross(iptablesContext *ctx,
  * ie the bridge is the in interface
  */
 static int
-iptablesForwardRejectOut(iptablesContext *ctx,
-                         int family,
+iptablesForwardRejectOut(int family,
                          const char *iface,
                          int action)
 {
-    return iptablesAddRemoveRule(ctx->forward_filter,
+    return iptablesAddRemoveRule("filter", "FORWARD",
                                  family,
                                  action,
                                  "--in-interface", iface,
@@ -718,11 +602,10 @@ iptablesForwardRejectOut(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardRejectOut(iptablesContext *ctx,
-                            int family,
+iptablesAddForwardRejectOut(int family,
                             const char *iface)
 {
-    return iptablesForwardRejectOut(ctx, family, iface, ADD);
+    return iptablesForwardRejectOut(family, iface, ADD);
 }
 
 /**
@@ -736,11 +619,10 @@ iptablesAddForwardRejectOut(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardRejectOut(iptablesContext *ctx,
-                               int family,
+iptablesRemoveForwardRejectOut(int family,
                                const char *iface)
 {
-    return iptablesForwardRejectOut(ctx, family, iface, REMOVE);
+    return iptablesForwardRejectOut(family, iface, REMOVE);
 }
 
 
@@ -750,12 +632,11 @@ iptablesRemoveForwardRejectOut(iptablesContext *ctx,
  * ie the bridge is the out interface
  */
 static int
-iptablesForwardRejectIn(iptablesContext *ctx,
-                        int family,
+iptablesForwardRejectIn(int family,
                         const char *iface,
                         int action)
 {
-    return iptablesAddRemoveRule(ctx->forward_filter,
+    return iptablesAddRemoveRule("filter", "FORWARD",
                                  family,
                                  action,
                                  "--out-interface", iface,
@@ -774,11 +655,10 @@ iptablesForwardRejectIn(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardRejectIn(iptablesContext *ctx,
-                           int family,
+iptablesAddForwardRejectIn(int family,
                            const char *iface)
 {
-    return iptablesForwardRejectIn(ctx, family, iface, ADD);
+    return iptablesForwardRejectIn(family, iface, ADD);
 }
 
 /**
@@ -792,11 +672,10 @@ iptablesAddForwardRejectIn(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardRejectIn(iptablesContext *ctx,
-                              int family,
+iptablesRemoveForwardRejectIn(int family,
                               const char *iface)
 {
-    return iptablesForwardRejectIn(ctx, family, iface, REMOVE);
+    return iptablesForwardRejectIn(family, iface, REMOVE);
 }
 
 
@@ -804,8 +683,7 @@ iptablesRemoveForwardRejectIn(iptablesContext *ctx,
  * with the bridge
  */
 static int
-iptablesForwardMasquerade(iptablesContext *ctx,
-                          virSocketAddr *netaddr,
+iptablesForwardMasquerade(virSocketAddr *netaddr,
                           unsigned int prefix,
                           const char *physdev,
                           virSocketAddrRangePtr addr,
@@ -841,7 +719,7 @@ iptablesForwardMasquerade(iptablesContext *ctx,
         }
     }
 
-    cmd = iptablesCommandNew(ctx->nat_postrouting, AF_INET, action);
+    cmd = iptablesCommandNew("nat", "POSTROUTING", AF_INET, action);
     virCommandAddArgList(cmd, "--source", networkstr, NULL);
 
     if (protocol && protocol[0])
@@ -922,15 +800,14 @@ cleanup:
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesAddForwardMasquerade(iptablesContext *ctx,
-                             virSocketAddr *netaddr,
+iptablesAddForwardMasquerade(virSocketAddr *netaddr,
                              unsigned int prefix,
                              const char *physdev,
                              virSocketAddrRangePtr addr,
                              virPortRangePtr port,
                              const char *protocol)
 {
-    return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port,
+    return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port,
                                      protocol, ADD);
 }
 
@@ -948,22 +825,20 @@ iptablesAddForwardMasquerade(iptablesContext *ctx,
  * Returns 0 in case of success or an error code otherwise
  */
 int
-iptablesRemoveForwardMasquerade(iptablesContext *ctx,
-                                virSocketAddr *netaddr,
+iptablesRemoveForwardMasquerade(virSocketAddr *netaddr,
                                 unsigned int prefix,
                                 const char *physdev,
                                 virSocketAddrRangePtr addr,
                                 virPortRangePtr port,
                                 const char *protocol)
 {
-    return iptablesForwardMasquerade(ctx, netaddr, prefix, physdev, addr, port,
+    return iptablesForwardMasquerade(netaddr, prefix, physdev, addr, port,
                                      protocol, REMOVE);
 }
 
 
 static int
-iptablesOutputFixUdpChecksum(iptablesContext *ctx,
-                             const char *iface,
+iptablesOutputFixUdpChecksum(const char *iface,
                              int port,
                              int action)
 {
@@ -972,7 +847,7 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx,
     snprintf(portstr, sizeof(portstr), "%d", port);
     portstr[sizeof(portstr) - 1] = '\0';
 
-    return iptablesAddRemoveRule(ctx->mangle_postrouting,
+    return iptablesAddRemoveRule("mangle", "POSTROUTING",
                                  AF_INET,
                                  action,
                                  "--out-interface", iface,
@@ -998,11 +873,10 @@ iptablesOutputFixUdpChecksum(iptablesContext *ctx,
  */
 
 int
-iptablesAddOutputFixUdpChecksum(iptablesContext *ctx,
-                                const char *iface,
+iptablesAddOutputFixUdpChecksum(const char *iface,
                                 int port)
 {
-    return iptablesOutputFixUdpChecksum(ctx, iface, port, ADD);
+    return iptablesOutputFixUdpChecksum(iface, port, ADD);
 }
 
 /**
@@ -1019,9 +893,8 @@ iptablesAddOutputFixUdpChecksum(iptablesContext *ctx,
  * return an error, which should be ignored)
  */
 int
-iptablesRemoveOutputFixUdpChecksum(iptablesContext *ctx,
-                                   const char *iface,
+iptablesRemoveOutputFixUdpChecksum(const char *iface,
                                    int port)
 {
-    return iptablesOutputFixUdpChecksum(ctx, iface, port, REMOVE);
+    return iptablesOutputFixUdpChecksum(iface, port, REMOVE);
 }
diff --git a/src/util/viriptables.h b/src/util/viriptables.h
index b7ce59b..447f4a8 100644
--- a/src/util/viriptables.h
+++ b/src/util/viriptables.h
@@ -26,102 +26,77 @@
 
 # include "virsocketaddr.h"
 
-typedef struct _iptablesContext iptablesContext;
-
-iptablesContext *iptablesContextNew              (void);
-void             iptablesContextFree             (iptablesContext *ctx);
-
-int              iptablesAddTcpInput             (iptablesContext *ctx,
-                                                  int family,
+int              iptablesAddTcpInput             (int family,
                                                   const char *iface,
                                                   int port);
-int              iptablesRemoveTcpInput          (iptablesContext *ctx,
-                                                  int family,
+int              iptablesRemoveTcpInput          (int family,
                                                   const char *iface,
                                                   int port);
 
-int              iptablesAddUdpInput             (iptablesContext *ctx,
-                                                  int family,
+int              iptablesAddUdpInput             (int family,
                                                   const char *iface,
                                                   int port);
-int              iptablesRemoveUdpInput          (iptablesContext *ctx,
-                                                  int family,
+int              iptablesRemoveUdpInput          (int family,
                                                   const char *iface,
                                                   int port);
 
-int              iptablesAddForwardAllowOut      (iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesAddForwardAllowOut      (virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *iface,
                                                   const char *physdev);
-int              iptablesRemoveForwardAllowOut   (iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesRemoveForwardAllowOut   (virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *iface,
                                                   const char *physdev);
 
-int              iptablesAddForwardAllowRelatedIn(iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesAddForwardAllowRelatedIn(virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *iface,
                                                   const char *physdev);
-int              iptablesRemoveForwardAllowRelatedIn(iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesRemoveForwardAllowRelatedIn(virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *iface,
                                                   const char *physdev);
 
-int              iptablesAddForwardAllowIn       (iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesAddForwardAllowIn       (virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *iface,
                                                   const char *physdev);
-int              iptablesRemoveForwardAllowIn    (iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesRemoveForwardAllowIn    (virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *iface,
                                                   const char *physdev);
 
-int              iptablesAddForwardAllowCross    (iptablesContext *ctx,
-                                                  int family,
+int              iptablesAddForwardAllowCross    (int family,
                                                   const char *iface);
-int              iptablesRemoveForwardAllowCross (iptablesContext *ctx,
-                                                  int family,
+int              iptablesRemoveForwardAllowCross (int family,
                                                   const char *iface);
 
-int              iptablesAddForwardRejectOut     (iptablesContext *ctx,
-                                                  int family,
+int              iptablesAddForwardRejectOut     (int family,
                                                   const char *iface);
-int              iptablesRemoveForwardRejectOut  (iptablesContext *ctx,
-                                                  int family,
+int              iptablesRemoveForwardRejectOut  (int family,
                                                   const char *iface);
 
-int              iptablesAddForwardRejectIn      (iptablesContext *ctx,
-                                                  int family,
+int              iptablesAddForwardRejectIn      (int family,
                                                   const char *iface);
-int              iptablesRemoveForwardRejectIn   (iptablesContext *ctx,
-                                                  int family,
+int              iptablesRemoveForwardRejectIn   (int family,
                                                   const char *iface);
 
-int              iptablesAddForwardMasquerade    (iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesAddForwardMasquerade    (virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *physdev,
                                                   virSocketAddrRangePtr addr,
                                                   virPortRangePtr port,
                                                   const char *protocol);
-int              iptablesRemoveForwardMasquerade (iptablesContext *ctx,
-                                                  virSocketAddr *netaddr,
+int              iptablesRemoveForwardMasquerade (virSocketAddr *netaddr,
                                                   unsigned int prefix,
                                                   const char *physdev,
                                                   virSocketAddrRangePtr addr,
                                                   virPortRangePtr port,
                                                   const char *protocol);
-int              iptablesAddOutputFixUdpChecksum (iptablesContext *ctx,
-                                                  const char *iface,
+int              iptablesAddOutputFixUdpChecksum (const char *iface,
                                                   int port);
-int              iptablesRemoveOutputFixUdpChecksum (iptablesContext *ctx,
-                                                     const char *iface,
+int              iptablesRemoveOutputFixUdpChecksum (const char *iface,
                                                      int port);
 
 #endif /* __QEMUD_IPTABLES_H__ */
-- 
1.8.1.4


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]