On Thu, Aug 30, 2018 at 11:06:07AM -0400, John Ferlan wrote:
> Similar to nwfilterDefineXML, let's be sure the a filter binding
> creation is not attempted in session mode and generate the proper
> error message.
>
> Failure to open nwfilter in session mode (nwfilterConnectOpen)
> fails already, but that doesn't stop the free thinker from using
> a different connection in order to attempt to attempt to create
> the binding. Although even doing that would result in a failure:
>
> $ virsh nwfilter-binding-create QEMUGuest1-binding.xml
> error: Failed to create network filter from QEMUGuest1-binding.xml
> error: internal error: Could not get access to ACL tech driver 'ebiptables'
>
> $
>
> Signed-off-by: John Ferlan <jferlan@xxxxxxxxxx>
> ---
> src/nwfilter/nwfilter_driver.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/src/nwfilter/nwfilter_driver.c b/src/nwfilter/nwfilter_driver.c
> index ac3a964388..1ee5162b9a 100644
> --- a/src/nwfilter/nwfilter_driver.c
> +++ b/src/nwfilter/nwfilter_driver.c
> @@ -745,6 +745,12 @@ nwfilterBindingCreateXML(virConnectPtr conn,
>
> virCheckFlags(0, NULL);
>
> + if (!driver->privileged) {
> + virReportError(VIR_ERR_OPERATION_INVALID, "%s",
> + _("Can't define NWFilter bindings in session mode"));
> + return NULL;
> + }
> +
> def = virNWFilterBindingDefParseString(xml);
> if (!def)
> return NULL;
How do we ever get to this point in a session daemon ?
The nwfilterConnectOpen() method should have failed due to 'driver'
being NULL, so the virConnectPtr doesn't exist and so no driver
callback points to nwfilterBindingCreateXML.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list
