7:27 a.m.
Introduce a shell variable 'EBT' to invoke the ebtables command.
Hard-code the used ebtables table to '-t nat'.
Tested with libvirt-tck.
---
src/nwfilter/nwfilter_ebiptables_driver.c | 170 +++++++++++++++++-------------
1 file changed, 97 insertions(+), 73 deletions(-)
Index: libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
===================================================================
--- libvirt-acl.orig/src/nwfilter/nwfilter_ebiptables_driver.c
+++ libvirt-acl/src/nwfilter/nwfilter_ebiptables_driver.c
@@ -46,7 +46,6 @@
#define VIR_FROM_THIS VIR_FROM_NWFILTER
-#define EBTABLES_DEFAULT_TABLE "nat"
#define EBTABLES_CHAIN_INCOMING "PREROUTING"
#define EBTABLES_CHAIN_OUTGOING "POSTROUTING"
@@ -86,7 +85,6 @@ static char *ip6tables_cmd_path;
static char *grep_cmd_path;
static char *gawk_cmd_path;
-
#define PRINT_ROOT_CHAIN(buf, prefix, ifname) \
snprintf(buf, sizeof(buf), "libvirt-%c-%s", prefix, ifname)
#define PRINT_CHAIN(buf, prefix, ifname, suffix) \
@@ -110,7 +108,7 @@ static const char ebtables_script_func_c
"collect_chains()\n"
"{\n"
" for tmp2 in $*; do\n"
- " for tmp in $(%s -t %s -L $tmp2 | \\\n"
+ " for tmp in $($EBT -t nat -L $tmp2 | \\\n"
" sed -n \"/Bridge chain/,\\$ s/.*-j
\\\\([%s]-.*\\\\)/\\\\1/p\");\n"
" do\n"
" echo $tmp\n"
@@ -122,8 +120,8 @@ static const char ebtables_script_func_c
static const char ebiptables_script_func_rm_chains[] =
"rm_chains()\n"
"{\n"
- " for tmp in $*; do %s -t %s -F $tmp; done\n"
- " for tmp in $*; do %s -t %s -X $tmp; done\n"
+ " for tmp in $*; do $EBT -t nat -F $tmp; done\n"
+ " for tmp in $*; do $EBT -t nat -X $tmp; done\n"
"}\n";
static const char ebiptables_script_func_rename_chains[] =
@@ -131,8 +129,8 @@ static const char ebiptables_script_func
"{\n"
" for tmp in $*; do\n"
" case $tmp in\n"
- " %c*) %s -t %s -E $tmp %c${tmp#?} ;;\n"
- " %c*) %s -t %s -E $tmp %c${tmp#?} ;;\n"
+ " %c*) $EBT -t nat -E $tmp %c${tmp#?} ;;\n"
+ " %c*) $EBT -t nat -E $tmp %c${tmp#?} ;;\n"
" esac\n"
" done\n"
"}\n";
@@ -146,6 +144,9 @@ static const char ebiptables_script_set_
#define NWFILTER_FUNC_RENAME_CHAINS ebiptables_script_func_rename_chains
#define NWFILTER_FUNC_SET_IFS ebiptables_script_set_ifs
+#define NWFILTER_SET_EBTABLES_SHELLVAR(BUFPTR) \
+ virBufferAsprintf(BUFPTR, "EBT=%s\n", ebtables_cmd_path);
+
#define VIRT_IN_CHAIN "libvirt-in"
#define VIRT_OUT_CHAIN "libvirt-out"
#define VIRT_IN_POST_CHAIN "libvirt-in-post"
@@ -1990,9 +1991,8 @@ ebtablesCreateRuleInstance(char chainPre
case VIR_NWFILTER_RULE_PROTOCOL_MAC:
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
-
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
if (ebtablesHandleEthHdr(&buf,
vars,
@@ -2015,8 +2015,8 @@ ebtablesCreateRuleInstance(char chainPre
case VIR_NWFILTER_RULE_PROTOCOL_VLAN:
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
if (ebtablesHandleEthHdr(&buf,
@@ -2082,8 +2082,8 @@ ebtablesCreateRuleInstance(char chainPre
}
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
if (ebtablesHandleEthHdr(&buf,
@@ -2120,8 +2120,8 @@ ebtablesCreateRuleInstance(char chainPre
case VIR_NWFILTER_RULE_PROTOCOL_RARP:
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
if (ebtablesHandleEthHdr(&buf,
vars,
@@ -2229,8 +2229,8 @@ ebtablesCreateRuleInstance(char chainPre
case VIR_NWFILTER_RULE_PROTOCOL_IP:
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
if (ebtablesHandleEthHdr(&buf,
vars,
@@ -2365,8 +2365,8 @@ ebtablesCreateRuleInstance(char chainPre
case VIR_NWFILTER_RULE_PROTOCOL_IPV6:
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
if (ebtablesHandleEthHdr(&buf,
vars,
@@ -2489,8 +2489,8 @@ ebtablesCreateRuleInstance(char chainPre
case VIR_NWFILTER_RULE_PROTOCOL_NONE:
virBufferAsprintf(&buf,
- CMD_DEF_PRE "%s -t %s -%%c %s %%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ CMD_DEF_PRE "$EBT -t nat -%%c %s %%s",
+ chain);
break;
default:
@@ -2757,10 +2757,10 @@ ebtablesCreateTmpRootChain(virBufferPtr
PRINT_ROOT_CHAIN(chain, chainPrefix, ifname);
virBufferAsprintf(buf,
- CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -N %s") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
+ chain,
CMD_STOPONERR(stopOnError));
return 0;
@@ -2780,10 +2780,9 @@ ebtablesLinkTmpRootChain(virBufferPtr bu
PRINT_ROOT_CHAIN(chain, chainPrefix, ifname);
virBufferAsprintf(buf,
- CMD_DEF("%s -t %s -A %s -%c %s -j %s") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -%c %s -j %s") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
(incoming) ? EBTABLES_CHAIN_INCOMING
: EBTABLES_CHAIN_OUTGOING,
iodev, ifname, chain,
@@ -2811,10 +2810,10 @@ _ebtablesRemoveRootChain(virBufferPtr bu
PRINT_ROOT_CHAIN(chain, chainPrefix, ifname);
virBufferAsprintf(buf,
- "%s -t %s -F %s" CMD_SEPARATOR
- "%s -t %s -X %s" CMD_SEPARATOR,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain);
+ "$EBT -t nat -F %s" CMD_SEPARATOR
+ "$EBT -t nat -X %s" CMD_SEPARATOR,
+ chain,
+ chain);
return 0;
}
@@ -2856,8 +2855,7 @@ _ebtablesUnlinkRootChain(virBufferPtr bu
PRINT_ROOT_CHAIN(chain, chainPrefix, ifname);
virBufferAsprintf(buf,
- "%s -t %s -D %s -%c %s -j %s" CMD_SEPARATOR,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
+ "$EBT -t nat -D %s -%c %s -j %s" CMD_SEPARATOR,
(incoming) ? EBTABLES_CHAIN_INCOMING
: EBTABLES_CHAIN_OUTGOING,
iodev, ifname, chain);
@@ -2917,25 +2915,24 @@ ebtablesCreateTmpSubChain(ebiptablesRule
}
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -F %s") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -F %s") CMD_SEPARATOR
CMD_EXEC
- CMD_DEF("%s -t %s -X %s") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -X %s") CMD_SEPARATOR
CMD_EXEC
- CMD_DEF("%s -t %s -N %s") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -N %s") CMD_SEPARATOR
CMD_EXEC
"%s"
- CMD_DEF("%s -t %s -%%c %s %%s %s -j %s")
+ CMD_DEF("$EBT -t nat -%%c %s %%s %s -j %s")
CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
+ chain,
+ chain,
+ chain,
CMD_STOPONERR(stopOnError),
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
rootchain, protostr, chain,
CMD_STOPONERR(stopOnError));
@@ -2967,11 +2964,11 @@ _ebtablesRemoveSubChains(virBufferPtr bu
char rootchain[MAX_CHAINNAME_LENGTH];
unsigned i;
+ NWFILTER_SET_EBTABLES_SHELLVAR(buf);
+
virBufferAsprintf(buf, NWFILTER_FUNC_COLLECT_CHAINS,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chains);
- virBufferAsprintf(buf, NWFILTER_FUNC_RM_CHAINS,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE);
+ chains);
+ virBufferAdd(buf, NWFILTER_FUNC_RM_CHAINS, -1);
virBufferAsprintf(buf, NWFILTER_FUNC_SET_IFS);
virBufferAddLit(buf, "chains=\"$(collect_chains");
@@ -2984,8 +2981,7 @@ _ebtablesRemoveSubChains(virBufferPtr bu
for (i = 0; chains[i] != 0; i++) {
PRINT_ROOT_CHAIN(rootchain, chains[i], ifname);
virBufferAsprintf(buf,
- "%s -t %s -F %s\n",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
+ "$EBT -t nat -F %s\n",
rootchain);
}
virBufferAddLit(buf, "rm_chains $chains\n");
@@ -3040,8 +3036,8 @@ ebtablesRenameTmpSubChain(virBufferPtr b
}
virBufferAsprintf(buf,
- "%s -t %s -E %s %s" CMD_SEPARATOR,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, tmpchain, chain);
+ "$EBT -t nat -E %s %s" CMD_SEPARATOR,
+ tmpchain, chain);
return 0;
}
@@ -3064,14 +3060,14 @@ ebtablesRenameTmpSubAndRootChains(virBuf
CHAINPREFIX_HOST_OUT_TEMP,
0};
+ NWFILTER_SET_EBTABLES_SHELLVAR(buf);
+
virBufferAsprintf(buf, NWFILTER_FUNC_COLLECT_CHAINS,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chains);
+ chains);
virBufferAsprintf(buf, NWFILTER_FUNC_RENAME_CHAINS,
CHAINPREFIX_HOST_IN_TEMP,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
CHAINPREFIX_HOST_IN,
CHAINPREFIX_HOST_OUT_TEMP,
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
CHAINPREFIX_HOST_OUT);
virBufferAsprintf(buf, NWFILTER_FUNC_SET_IFS);
@@ -3151,40 +3147,41 @@ ebtablesApplyBasicRules(const char *ifna
ebiptablesAllTeardown(ifname);
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesCreateTmpRootChain(&buf, 1, ifname, 1);
PRINT_ROOT_CHAIN(chain, chainPrefix, ifname);
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -s ! %s -j DROP") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -s ! %s -j DROP")
CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
chain, macaddr_str,
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -p IPv4 -j ACCEPT")
CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -p IPv4 -j ACCEPT")
CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
+ chain,
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -p ARP -j ACCEPT") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -p ARP -j ACCEPT")
CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
+ chain,
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain,
+ chain,
CMD_STOPONERR(1));
ebtablesLinkTmpRootChain(&buf, 1, ifname, 1);
@@ -3250,6 +3247,8 @@ ebtablesApplyDHCPOnlyRules(const char *i
ebiptablesAllTeardown(ifname);
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesCreateTmpRootChain(&buf, 1, ifname, 1);
ebtablesCreateTmpRootChain(&buf, 0, ifname, 1);
@@ -3257,7 +3256,7 @@ ebtablesApplyDHCPOnlyRules(const char *i
PRINT_ROOT_CHAIN(chain_out, CHAINPREFIX_HOST_OUT_TEMP, ifname);
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s"
+ CMD_DEF("$EBT -t nat -A %s"
" -s %s -d Broadcast "
" -p ipv4 --ip-protocol udp"
" --ip-src 0.0.0.0 --ip-dst 255.255.255.255"
@@ -3266,20 +3265,20 @@ ebtablesApplyDHCPOnlyRules(const char *i
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_in,
+ chain_in,
macaddr_str,
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_in,
+ chain_in,
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s"
+ CMD_DEF("$EBT -t nat -A %s"
" -d %s"
" -p ipv4 --ip-protocol udp"
" %s"
@@ -3288,17 +3287,17 @@ ebtablesApplyDHCPOnlyRules(const char *i
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_out,
+ chain_out,
macaddr_str,
srcIPParam != NULL ? srcIPParam : "",
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_out,
+ chain_out,
CMD_STOPONERR(1));
ebtablesLinkTmpRootChain(&buf, 1, ifname, 1);
@@ -3352,6 +3351,8 @@ ebtablesApplyDropAllRules(const char *if
ebiptablesAllTeardown(ifname);
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesCreateTmpRootChain(&buf, 1, ifname, 1);
ebtablesCreateTmpRootChain(&buf, 0, ifname, 1);
@@ -3359,19 +3360,19 @@ ebtablesApplyDropAllRules(const char *if
PRINT_ROOT_CHAIN(chain_out, CHAINPREFIX_HOST_OUT_TEMP, ifname);
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_in,
+ chain_in,
CMD_STOPONERR(1));
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -A %s -j DROP") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -A %s -j DROP") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE, chain_out,
+ chain_out,
CMD_STOPONERR(1));
ebtablesLinkTmpRootChain(&buf, 1, ifname, 1);
@@ -3410,6 +3411,8 @@ static int ebtablesCleanAll(const char *
if (!ebtables_cmd_path)
return 0;
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesUnlinkRootChain(&buf, 1, ifname);
ebtablesUnlinkRootChain(&buf, 0, ifname);
ebtablesRemoveSubChains(&buf, ifname);
@@ -3611,8 +3614,11 @@ ebiptablesApplyNewRules(virConnectPtr co
}
}
+
/* cleanup whatever may exist */
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesUnlinkTmpRootChain(&buf, 1, ifname);
ebtablesUnlinkTmpRootChain(&buf, 0, ifname);
ebtablesRemoveTmpSubChains(&buf, ifname);
@@ -3621,6 +3627,8 @@ ebiptablesApplyNewRules(virConnectPtr co
ebiptablesExecCLI(&buf, &cli_status, NULL);
}
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
/* create needed chains */
if (ebtablesCreateTmpRootAndSubChains(&buf, ifname, chains_in_set , 1,
&ebtChains, &nEbtChains) ||
@@ -3636,6 +3644,8 @@ ebiptablesApplyNewRules(virConnectPtr co
if (ebiptablesExecCLI(&buf, &cli_status, &errmsg) || cli_status != 0)
goto tear_down_tmpebchains;
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
/* process ebtables commands; interleave commands from filters with
commands for creating and connecting ebtables chains */
j = 0;
@@ -3735,6 +3745,8 @@ ebiptablesApplyNewRules(virConnectPtr co
iptablesCheckBridgeNFCallEnabled(true);
}
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
if (virHashSize(chains_in_set) != 0)
ebtablesLinkTmpRootChain(&buf, 1, ifname, 1);
if (virHashSize(chains_out_set) != 0)
@@ -3756,6 +3768,8 @@ ebiptablesApplyNewRules(virConnectPtr co
tear_down_ebsubchains_and_unlink:
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesUnlinkTmpRootChain(&buf, 1, ifname);
ebtablesUnlinkTmpRootChain(&buf, 0, ifname);
}
@@ -3774,6 +3788,8 @@ tear_down_tmpiptchains:
tear_down_tmpebchains:
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesRemoveTmpSubChains(&buf, ifname);
ebtablesRemoveTmpRootChain(&buf, 1, ifname);
ebtablesRemoveTmpRootChain(&buf, 0, ifname);
@@ -3819,6 +3835,8 @@ ebiptablesTearNewRules(virConnectPtr con
}
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesUnlinkTmpRootChain(&buf, 1, ifname);
ebtablesUnlinkTmpRootChain(&buf, 0, ifname);
@@ -3858,6 +3876,8 @@ ebiptablesTearOldRules(virConnectPtr con
}
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesUnlinkRootChain(&buf, 1, ifname);
ebtablesUnlinkRootChain(&buf, 0, ifname);
@@ -3899,6 +3919,8 @@ ebiptablesRemoveRules(virConnectPtr conn
virBuffer buf = VIR_BUFFER_INITIALIZER;
ebiptablesRuleInstPtr *inst = (ebiptablesRuleInstPtr *)_inst;
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
for (i = 0; i < nruleInstances; i++)
ebiptablesInstCommand(&buf,
inst[i]->commandTemplate,
@@ -3948,6 +3970,8 @@ ebiptablesAllTeardown(const char *ifname
}
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
+
ebtablesUnlinkRootChain(&buf, 1, ifname);
ebtablesUnlinkRootChain(&buf, 0, ifname);
@@ -4003,12 +4027,12 @@ ebiptablesDriverInit(bool privileged)
ebtables_cmd_path = virFindFileInPath("ebtables");
if (ebtables_cmd_path) {
+ NWFILTER_SET_EBTABLES_SHELLVAR(&buf);
/* basic probing */
virBufferAsprintf(&buf,
- CMD_DEF("%s -t %s -L") CMD_SEPARATOR
+ CMD_DEF("$EBT -t nat -L") CMD_SEPARATOR
CMD_EXEC
"%s",
- ebtables_cmd_path, EBTABLES_DEFAULT_TABLE,
CMD_STOPONERR(1));
if (ebiptablesExecCLI(&buf, &cli_status, NULL) || cli_status)