[libvirt] [PATCH 2/2] nwfilter: use shell variable to invoke 'ip(6)tables' command

[Eric Blake]

On 11/21/2011 06:28 AM, Stefan Berger wrote:
> Introduce a shell variable 'IBT' to invoke the ip(6)tables command.
> 
> Tested with libvirt-tck.
> 
> ---
>  src/nwfilter/nwfilter_ebiptables_driver.c |  313 ++++++++++++++----------------
>  1 file changed, 155 insertions(+), 158 deletions(-)
> 

> Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
> ===================================================================
> --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c
> +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
> @@ -146,6 +146,10 @@ static const char ebiptables_script_set_
>  
>  #define NWFILTER_SET_EBTABLES_SHELLVAR(BUFPTR) \
>      virBufferAsprintf(BUFPTR, "EBT=%s\n", ebtables_cmd_path);

These variable assignments will fail if the absolute path to
ebtables_cmd_path and friends contain any whitespace or shell
metacharacters, but then again, the old code pre-conversion would have
failed in similar manners, so we already had an implicit assumption that
the user isn't calling ./configure with an insane PATH containing a
directory with whitespace at the front as the location for their
preferred commands.  I see nothing wrong with continuing that
assumption, although someday we may want to make configure fail if it
detects a tool name that cannot be safely passed unquoted through shell
(at least, for the three tools mentioned in this .c file where we are
using the shell), as a safety valve in the interim of us ever making the
much bigger change of avoiding shell in the first place.

ACK as-is.

-- 
Eric Blake   eblake at redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 620 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20111121/7f4e43f3/attachment-0001.sig>