109 lines
3.9 KiB
Diff
109 lines
3.9 KiB
Diff
From 36a12736f39da72dba98b843def645e5e4ed0afb Mon Sep 17 00:00:00 2001
|
|
Message-Id: <36a12736f39da72dba98b843def645e5e4ed0afb@dist-git>
|
|
From: Laine Stump <laine@redhat.com>
|
|
Date: Fri, 15 Jan 2021 22:51:49 -0500
|
|
Subject: [PATCH] util: always check for ebtables/iptables binaries, even when
|
|
using firewalld
|
|
|
|
Even though *we* don't call ebtables/iptables/ip6tables (yet) when the
|
|
firewalld backend is selected, firewalld does, so these binaries need
|
|
to be there; let's check for them. (Also, the patch after this one is
|
|
going to start execing those binaries directly rather than via
|
|
firewalld).
|
|
|
|
https://bugzilla.redhat.com/1607929
|
|
|
|
Signed-off-by: Laine Stump <laine@redhat.com>
|
|
Reviewed-by: Daniel Henrique Barboza <danielhb413@gmail.com>
|
|
(cherry picked from commit 56dd128bd06c38fab4256a098124d47d803e919a)
|
|
Message-Id: <20210116035151.1066734-7-laine@redhat.com>
|
|
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
|
---
|
|
src/util/virfirewall.c | 56 ++++++++++++++++++++----------------------
|
|
1 file changed, 26 insertions(+), 30 deletions(-)
|
|
|
|
diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c
|
|
index 2e3b02402e..520d515c11 100644
|
|
--- a/src/util/virfirewall.c
|
|
+++ b/src/util/virfirewall.c
|
|
@@ -100,24 +100,38 @@ VIR_ONCE_GLOBAL_INIT(virFirewall);
|
|
static int
|
|
virFirewallValidateBackend(virFirewallBackend backend)
|
|
{
|
|
- VIR_DEBUG("Validating backend %d", backend);
|
|
+ const char *commands[] = {
|
|
+ IPTABLES_PATH, IP6TABLES_PATH, EBTABLES_PATH
|
|
+ };
|
|
+ size_t i;
|
|
+
|
|
+ for (i = 0; i < G_N_ELEMENTS(commands); i++) {
|
|
+ if (!virFileIsExecutable(commands[i])) {
|
|
+ virReportSystemError(errno,
|
|
+ _("%s not available, firewall backend will not function"),
|
|
+ commands[i]);
|
|
+ return -1;
|
|
+ }
|
|
+ }
|
|
+ VIR_DEBUG("found iptables/ip6tables/ebtables");
|
|
+
|
|
if (backend == VIR_FIREWALL_BACKEND_AUTOMATIC ||
|
|
backend == VIR_FIREWALL_BACKEND_FIREWALLD) {
|
|
int rv = virFirewallDIsRegistered();
|
|
|
|
VIR_DEBUG("Firewalld is registered ? %d", rv);
|
|
- if (rv < 0) {
|
|
- if (rv == -2) {
|
|
- if (backend == VIR_FIREWALL_BACKEND_FIREWALLD) {
|
|
- virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
|
- _("firewalld firewall backend requested, but service is not running"));
|
|
- return -1;
|
|
- } else {
|
|
- VIR_DEBUG("firewalld service not running, trying direct backend");
|
|
- backend = VIR_FIREWALL_BACKEND_DIRECT;
|
|
- }
|
|
- } else {
|
|
+
|
|
+ if (rv == -1)
|
|
+ return -1;
|
|
+
|
|
+ if (rv == -2) {
|
|
+ if (backend == VIR_FIREWALL_BACKEND_FIREWALLD) {
|
|
+ virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
|
+ _("firewalld backend requested, but service is not running"));
|
|
return -1;
|
|
+ } else {
|
|
+ VIR_DEBUG("firewalld service not running, using direct backend");
|
|
+ backend = VIR_FIREWALL_BACKEND_DIRECT;
|
|
}
|
|
} else {
|
|
VIR_DEBUG("firewalld service running, using firewalld backend");
|
|
@@ -125,25 +139,7 @@ virFirewallValidateBackend(virFirewallBackend backend)
|
|
}
|
|
}
|
|
|
|
- if (backend == VIR_FIREWALL_BACKEND_DIRECT) {
|
|
- const char *commands[] = {
|
|
- IPTABLES_PATH, IP6TABLES_PATH, EBTABLES_PATH
|
|
- };
|
|
- size_t i;
|
|
-
|
|
- for (i = 0; i < G_N_ELEMENTS(commands); i++) {
|
|
- if (!virFileIsExecutable(commands[i])) {
|
|
- virReportSystemError(errno,
|
|
- _("direct firewall backend requested, but %s is not available"),
|
|
- commands[i]);
|
|
- return -1;
|
|
- }
|
|
- }
|
|
- VIR_DEBUG("found iptables/ip6tables/ebtables, using direct backend");
|
|
- }
|
|
-
|
|
currentBackend = backend;
|
|
-
|
|
return 0;
|
|
}
|
|
|
|
--
|
|
2.30.0
|
|
|