def apply_default_policy(self, agent_mode, apply_list, firewall):
        LOG.debug('Applying firewall %(fw_id)s for tenant %(tid)s', {
            'fw_id': firewall['id'],
            'tid': firewall['tenant_id']
        })
        fwid = firewall['id']
        try:
            for ri, router_fw_ports in apply_list:
                ipt_if_prefix_list = self._get_ipt_mgrs_with_if_prefix(
                    agent_mode, ri)
                for ipt_if_prefix in ipt_if_prefix_list:
                    # the following only updates local memory; no hole in FW
                    ipt_mgr = ipt_if_prefix['ipt']
                    self._remove_chains(fwid, ipt_mgr)
                    self._remove_default_chains(ipt_mgr)

                    # create default 'DROP ALL' policy chain
                    self._add_default_policy_chain_v4v6(ipt_mgr)
                    self._enable_policy_chain(fwid, ipt_if_prefix,
                                              router_fw_ports)

                    # apply the changes immediately (no defer in firewall path)
                    ipt_mgr.defer_apply_off()
        except (LookupError, RuntimeError):
            # catch known library exceptions and raise Fwaas generic exception
            LOG.exception(
                _LE("Failed to apply default policy on firewall: %s"), fwid)
            raise fw_ext.FirewallInternalDriverError(driver=FWAAS_DRIVER_NAME)
 def create_firewall_group(self, agent_mode, apply_list, firewall):
     LOG.debug('Creating firewall %(fw_id)s for tenant %(tid)s', {
         'fw_id': firewall['id'],
         'tid': firewall['tenant_id']
     })
     try:
         if firewall['admin_state_up']:
             self._setup_firewall(agent_mode, apply_list, firewall)
             self._remove_conntrack_new_firewall(agent_mode, apply_list,
                                                 firewall)
             self.pre_firewall = dict(firewall)
         else:
             self.apply_default_policy(agent_mode, apply_list, firewall)
     except (LookupError, RuntimeError):
         # catch known library exceptions and raise Fwaas generic exception
         LOG.exception(_LE("Failed to create firewall: %s"), firewall['id'])
         raise fw_ext.FirewallInternalDriverError(driver=FWAAS_DRIVER_NAME)
 def delete_firewall_group(self, agent_mode, apply_list, firewall):
     LOG.debug('Deleting firewall %(fw_id)s for tenant %(tid)s', {
         'fw_id': firewall['id'],
         'tid': firewall['tenant_id']
     })
     fwid = firewall['id']
     try:
         for ri, router_fw_ports in apply_list:
             ipt_if_prefix_list = self._get_ipt_mgrs_with_if_prefix(
                 agent_mode, ri)
             for ipt_if_prefix in ipt_if_prefix_list:
                 ipt_mgr = ipt_if_prefix['ipt']
                 self._remove_chains(fwid, ipt_mgr)
                 self._remove_default_chains(ipt_mgr)
                 # apply the changes immediately (no defer in firewall path)
                 ipt_mgr.defer_apply_off()
         self.pre_firewall = None
     except (LookupError, RuntimeError):
         # catch known library exceptions and raise Fwaas generic exception
         LOG.exception(_LE("Failed to delete firewall: %s"), fwid)
         raise fw_ext.FirewallInternalDriverError(driver=FWAAS_DRIVER_NAME)