On 11/21/2011 06:28 AM, Stefan Berger wrote:
Introduce a shell variable 'IBT' to invoke the ip(6)tables command.
Tested with libvirt-tck.
--- src/nwfilter/nwfilter_ebiptables_driver.c | 313 ++++++++++++++---------------- 1 file changed, 155 insertions(+), 158 deletions(-)
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c +++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c @@ -146,6 +146,10 @@ static const char ebiptables_script_set_
#define NWFILTER_SET_EBTABLES_SHELLVAR(BUFPTR) \ virBufferAsprintf(BUFPTR, "EBT=%s\n", ebtables_cmd_path);
These variable assignments will fail if the absolute path to ebtables_cmd_path and friends contain any whitespace or shell metacharacters, but then again, the old code pre-conversion would have failed in similar manners, so we already had an implicit assumption that the user isn't calling ./configure with an insane PATH containing a directory with whitespace at the front as the location for their preferred commands. I see nothing wrong with continuing that assumption, although someday we may want to make configure fail if it detects a tool name that cannot be safely passed unquoted through shell (at least, for the three tools mentioned in this .c file where we are using the shell), as a safety valve in the interim of us ever making the much bigger change of avoiding shell in the first place. ACK as-is. -- Eric Blake eblake@redhat.com +1-919-301-3266 Libvirt virtualization library http://libvirt.org