Bug 1607202

It's an "interesting problem". On the one hand, as is documented in the code for the delete binding:

/*
 * Note that this is primarily intended for usage by the hypervisor
 * drivers. it is exposed to the admin, however, and nothing stops
 * an admin from deleting filter bindings created by the hypervisor
 * drivers. IOW, it is the admin's responsibility not to shoot
 * themself in the foot
 */
static int
nwfilterBindingDelete(virNWFilterBindingPtr binding)

So in a way, you've found a way to shoot yourself in the foot and what you see is what you get.

Still, we shouldn't cause the guest to shutdown on libvirtd restart, so I've posted a patch upstream that can handle this case:

https://www.redhat.com/archives/libvir-list/2018-August/msg01407.html

Created a v3: 

https://www.redhat.com/archives/libvir-list/2018-August/msg01587.html

waiting on review

Since someone has to work in order to have this happen and really not blocker type material, I'm moving to rhel-7.7.0.  Deleting a binding and a filter takes a couple steps.

Patch has been pushed upstream:

commit 9e52c6496650d1412662a9e6cf98301141fbbbca
Author: John Ferlan <jferlan>
Date:   Fri Aug 24 09:29:24 2018 -0400

    qemu: Ignore nwfilter binding instantiation issues during reconnect
    
    ...
    
    It's essentially stated in the nwfilterBindingDelete that we
    will allow the admin to shoot themselves in the foot by deleting
    the nwfilter binding which then allows them to undefine the
    nwfilter that is in use for the running guest...
    
    However, by allowing this we cause a problem for libvirtd
    restart reconnect processing which would then try to recreate
    the missing binding attempting to use the deleted filter
    resulting in an error and thus shutting the guest down.
    
    So rather than keep adding virDomainConfNWFilterInstantiate
    flags to "ignore" specific error conditions, modify the logic
    to ignore, but VIR_WARN errors other than ignoreExists. This
    will at least allow the guest to not shutdown for only nwfilter
    binding errors that we can now perhaps recover from since we
    have the binding create/delete capability.
    
$ git describe 9e52c6496650d1412662a9e6cf98301141fbbbca
v4.7.0-173-g9e52c64966
$

Test on upstream libvirt-5.1.0-1.el7.x86_64, it works as expected.

# virsh nwfilter-binding-list
 Port Dev   Filter
---------------------------
 vnet0      clean-traffic

# virsh nwfilter-binding-delete vnet0
Network filter binding on vnet0 deleted

# virsh nwfilter-binding-list
 Port Dev   Filter
--------------------

# virsh nwfilter-undefine clean-traffic
Network filter clean-traffic undefined

# systemctl restart libvirtd
# virsh list
 Id   Name     State
------------------------
 2    rhel77   running

# virsh nwfilter-binding-list
 Port Dev   Filter
--------------------

# cat /var/log/libvirt/libvirtd.log | grep error
2019-02-26 05:31:00.258+0000: 43382: error : virNWFilterObjListFindInstantiateFilter:201 : internal error: referenced filter 'clean-traffic' is missing
2019-02-26 05:31:00.258+0000: 43382: warning : qemuProcessFiltersInstantiate:3299 : filter 'clean-traffic' instantiation for 'vnet0' failed 'internal error: referenced filter 'clean-traffic' is missing'

Development Management has reviewed and declined this request. You may appeal this decision by reopening this request.