network: prevent a few invalid configuration combinations

This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=767057

It was possible to define a network with <forward mode='bridge'> that
had both a bridge device and a forward device defined. These two are
mutually exclusive by definition (if you are using a bridge device,
then this is a host bridge, and if you have a forward dev defined,
this is using macvtap). It was also possible to put <ip>, <dns>, and
<domain> elements in this definition, although those aren't supported
by the current driver (although it's conceivable that some other
driver might support that).

The items that are invalid by definition, are now checked in the XML
parser (since they will definitely *always* be wrong), and the others
are checked in networkValidate() in the network driver (since, as
mentioned, it's possible that some other network driver, or even this
one, could some day support setting those).

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 8c77c50a8cc6ce2d219f42bddaaedf963fbf45af..7220659ed55fa4d435701a6dc9b1e9346efb82e8 100644 (file)
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -1594,6 +1594,15 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt)
                                def->name);
                 goto error;
             }
+            if (def->bridge && (def->nForwardIfs || nForwardPfs)) {
+                virReportError(VIR_ERR_XML_ERROR,
+                               _("A network with forward mode='%s' can specify "
+                                 "a  bridge name or a forward dev, but not "
+                                 "both (network '%s')"),
+                               virNetworkForwardTypeToString(def->forwardType),
+                               def->name);
+                goto error;
+            }
             break;
         }
     }

diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 946bb20dcdc197164b56d768f7d7aa77d1dc5cf5..bc01fe5bac3c9e4a7041959edd6f270ef4cc3969 100644 (file)
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -857,6 +857,7 @@ virNetworkDefParseString;
 virNetworkDeleteConfig;
 virNetworkFindByName;
 virNetworkFindByUUID;
+virNetworkForwardTypeToString;
 virNetworkIpDefNetmask;
 virNetworkIpDefPrefix;
 virNetworkList;

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index e8ea77f387f1577c6010ba0028e88e092a67e1db..00cffee47916da6f9d919537eadd4be55aef8638 100644 (file)
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -2751,6 +2751,35 @@ networkValidate(struct network_driver *driver,
             return -1;
 
         virNetworkSetBridgeMacAddr(def);
+    } else {
+        /* They are also the only types that currently support setting
+         * an IP address for the host-side device (bridge)
+         */
+        if (virNetworkDefGetIpByIndex(def, AF_UNSPEC, 0)) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                           _("Unsupported <ip> element in network %s "
+                             "with forward mode='%s'"),
+                           def->name,
+                           virNetworkForwardTypeToString(def->forwardType));
+            return -1;
+        }
+        if (def->dns &&
+            (def->dns->ntxtrecords || def->dns->nhosts || def->dns->nsrvrecords)) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                           _("Unsupported <dns> element in network %s "
+                             "with forward mode='%s'"),
+                           def->name,
+                           virNetworkForwardTypeToString(def->forwardType));
+            return -1;
+        }
+        if (def->domain) {
+            virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                           _("Unsupported <domain> element in network %s "
+                             "with forward mode='%s'"),
+                           def->name,
+                           virNetworkForwardTypeToString(def->forwardType));
+            return -1;
+        }
     }
 
     /* We only support dhcp on one IPv4 address per defined network */