<html><body> <tt>Stefan Berger/Watson/IBM wrote on 05/11/2011 12:32:41 PM:</tt> <tt>> > So now this command puts the default policy of every ebtables chain > to end with an implicit drop. What if I had previously</tt> <tt>> created a filter assuming an implicit accept, which is the current > behavior? Now that filter wouldn't work correctly anymore</tt> <tt>> since my packets all get droped. Is this change really necessary?</tt> <tt> Well, all of the generated chains need this (to support</tt> <tt>multiple address matching). This can, of course, be done by</tt> <tt>adding a "-j DROP" at the end of every chain. But since it is</tt> <tt>all of them, I thought changing the default and having fewer</tt> <tt>rules made a lot more sense.</tt> <tt> So, it isn't a requirement, but any modifications to these</tt> <tt>chains will need to account for either a DROP policy explicitly</tt> <tt>or a "-j DROP" at the end, if it's modifying an existing filter.</tt> <tt> I don't see any way around custom filters needing to be</tt> <tt>reviewed and adapted to any change in the examples set. Independent</tt> <tt>filters can explicitly use "-j DROP" or "-j ACCEPT" and not rely</tt> <tt>on the policy, but insertions in existing filters can't insert</tt> <tt>after a "-j DROP" and still work, either. With the changed policy,</tt> <tt>they can append rules and possibly still work without modification.</tt> <tt> +-DLS</tt> </body></html>