From 36a12736f39da72dba98b843def645e5e4ed0afb Mon Sep 17 00:00:00 2001 Message-Id: <36a12736f39da72dba98b843def645e5e4ed0afb@dist-git> From: Laine Stump Date: Fri, 15 Jan 2021 22:51:49 -0500 Subject: [PATCH] util: always check for ebtables/iptables binaries, even when using firewalld Even though *we* don't call ebtables/iptables/ip6tables (yet) when the firewalld backend is selected, firewalld does, so these binaries need to be there; let's check for them. (Also, the patch after this one is going to start execing those binaries directly rather than via firewalld). https://bugzilla.redhat.com/1607929 Signed-off-by: Laine Stump Reviewed-by: Daniel Henrique Barboza (cherry picked from commit 56dd128bd06c38fab4256a098124d47d803e919a) Message-Id: <20210116035151.1066734-7-laine@redhat.com> Reviewed-by: Jiri Denemark --- src/util/virfirewall.c | 56 ++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 30 deletions(-) diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c index 2e3b02402e..520d515c11 100644 --- a/src/util/virfirewall.c +++ b/src/util/virfirewall.c @@ -100,24 +100,38 @@ VIR_ONCE_GLOBAL_INIT(virFirewall); static int virFirewallValidateBackend(virFirewallBackend backend) { - VIR_DEBUG("Validating backend %d", backend); + const char *commands[] = { + IPTABLES_PATH, IP6TABLES_PATH, EBTABLES_PATH + }; + size_t i; + + for (i = 0; i < G_N_ELEMENTS(commands); i++) { + if (!virFileIsExecutable(commands[i])) { + virReportSystemError(errno, + _("%s not available, firewall backend will not function"), + commands[i]); + return -1; + } + } + VIR_DEBUG("found iptables/ip6tables/ebtables"); + if (backend == VIR_FIREWALL_BACKEND_AUTOMATIC || backend == VIR_FIREWALL_BACKEND_FIREWALLD) { int rv = virFirewallDIsRegistered(); VIR_DEBUG("Firewalld is registered ? %d", rv); - if (rv < 0) { - if (rv == -2) { - if (backend == VIR_FIREWALL_BACKEND_FIREWALLD) { - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", - _("firewalld firewall backend requested, but service is not running")); - return -1; - } else { - VIR_DEBUG("firewalld service not running, trying direct backend"); - backend = VIR_FIREWALL_BACKEND_DIRECT; - } - } else { + + if (rv == -1) + return -1; + + if (rv == -2) { + if (backend == VIR_FIREWALL_BACKEND_FIREWALLD) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("firewalld backend requested, but service is not running")); return -1; + } else { + VIR_DEBUG("firewalld service not running, using direct backend"); + backend = VIR_FIREWALL_BACKEND_DIRECT; } } else { VIR_DEBUG("firewalld service running, using firewalld backend"); @@ -125,25 +139,7 @@ virFirewallValidateBackend(virFirewallBackend backend) } } - if (backend == VIR_FIREWALL_BACKEND_DIRECT) { - const char *commands[] = { - IPTABLES_PATH, IP6TABLES_PATH, EBTABLES_PATH - }; - size_t i; - - for (i = 0; i < G_N_ELEMENTS(commands); i++) { - if (!virFileIsExecutable(commands[i])) { - virReportSystemError(errno, - _("direct firewall backend requested, but %s is not available"), - commands[i]); - return -1; - } - } - VIR_DEBUG("found iptables/ip6tables/ebtables, using direct backend"); - } - currentBackend = backend; - return 0; } -- 2.30.0