The way this function works is that for both iptables and ip6tables (or their firewalld friends) and for every table ("filter", "nat", "mangle") it lists chains defined for the table and then calls iptablesPrivateChainCreate() over the list. The callback is then supposed to find libvirt private chains and if not found create rules to add them. So far so good. Problem is if one of the tables doesn't exist (e.g. due to a module missing). For instance, on my system I don't have CONFIG_IP6_NF_MANGLE enabled therefore I'm lacking "mangle" table for ip6tables. This means that the whole operation of setting up private chains fails because the whole transaction is run as "do not ignore errors". The solution is to have two transactions, the first one which just lists chains can run ignoring errors, and the second one which then installs the private chains will run normally. In the code, this approach is pushed to another level - every table for which private chains are created is run as a separate transaction. The reason is that it saves us one more variable where we would track if the second transaction was started already or not; and also, it doesn't matter. Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; --- src/util/viriptables.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/util/viriptables.c b/src/util/viriptables.c index d67b640a3b..ea24b03ec8 100644 --- a/src/util/viriptables.c +++ b/src/util/viriptables.c @@ -101,6 +101,16 @@ iptablesPrivateChainCreate(virFirewallPtr fw, tmp++; } + /* This function is running in the context of the very first transaction, + * which does nothing more than just lists current tables and chains. But + * since some tables might not be there (e.g. because of a module missing), + * the transaction is run with IGNORE_ERRORS flag. But obviously, we don't + * want to ignore errors here, where we are constructing our own chains and + * rules. The only way to resolve this is to start a new transaction so + * that all those AddRule() calls below add rules to new transaction/group. + */ + virFirewallStartTransaction(fw, 0); + for (i = 0; i < data->nchains; i++) { const char *from; if (!virHashLookup(chains, data->chains[i].child)) { @@ -160,7 +170,7 @@ iptablesSetupPrivateChains(void) fw = virFirewallNew(); - virFirewallStartTransaction(fw, 0); + virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_IGNORE_ERRORS); for (i = 0; i < ARRAY_CARDINALITY(data); i++) virFirewallAddRuleFull(fw, data[i].layer, -- 2.19.2