Re: [Xen-devel] [PATCH] vif-common.sh prevent physdev match: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic is not supported anymore

[Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>]

Sander Eikelenboom writes ("[Xen-devel] [PATCH] vif-common.sh prevent physdev 
match: using --physdev-out in the OUTPUT, FORWARD and POSTROUTING chains for 
non-bridged traffic is not supported anymore"):
> -  iptables "$c" FORWARD -m physdev --physdev-in "$vif" "$@" -j ACCEPT \
> +  iptables "$c" FORWARD -m physdev --physdev-is-bridged --physdev-in "$vif" 
> "$@" -j ACCEPT \

This will break on earlier iptables and/or earlier kernels.

Is there a way to detect whether --physdev-is-bridged is going to work ?

We could grep the output from iptables but is that sufficient ?  I
guess we may need to check for kernel behaviour too somehow.

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel