On 11/21/2011 06:28 AM, Stefan Berger wrote: > Introduce a shell variable 'IBT' to invoke the ip(6)tables command. > > Tested with libvirt-tck. > > --- > src/nwfilter/nwfilter_ebiptables_driver.c | 313 ++++++++++++++---------------- > 1 file changed, 155 insertions(+), 158 deletions(-) > > Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c > =================================================================== > --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c > +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c > @@ -146,6 +146,10 @@ static const char ebiptables_script_set_ > > #define NWFILTER_SET_EBTABLES_SHELLVAR(BUFPTR) \ > virBufferAsprintf(BUFPTR, "EBT=%s\n", ebtables_cmd_path); These variable assignments will fail if the absolute path to ebtables_cmd_path and friends contain any whitespace or shell metacharacters, but then again, the old code pre-conversion would have failed in similar manners, so we already had an implicit assumption that the user isn't calling ./configure with an insane PATH containing a directory with whitespace at the front as the location for their preferred commands. I see nothing wrong with continuing that assumption, although someday we may want to make configure fail if it detects a tool name that cannot be safely passed unquoted through shell (at least, for the three tools mentioned in this .c file where we are using the shell), as a safety valve in the interim of us ever making the much bigger change of avoiding shell in the first place. ACK as-is. -- Eric Blake eblake@xxxxxxxxxx +1-919-301-3266 Libvirt virtualization library http://libvirt.org
Attachment:
signature.asc
Description: OpenPGP digital signature
-- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list