[libvirt] [PATCH] network: properly update iptables rules during net-update
Eric Blake
eblake at redhat.com
Wed Nov 27 22:14:29 UTC 2013
On 11/27/2013 11:03 AM, Laine Stump wrote:
> This patch resolves:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1035336
>
> The basic problem is that during a network update, the required
> iptables rules sometimes change, and this was being handled by simply
> removing and re-adding the rules. However, the removal of the old
> rules was done based on the *new* state of the network, which would
> mean that some of the rules would not match those currently in the
> system, so the old rules wouldn't be removed.
>
> This patch removes the old rules prior to updating the network
> definitionm then adds the new rules as soon as the definition is
s/definitionm/definition/
> updated. Note that this could lead to a stray packet or two during the
> interim, but that was already a problem before (the period of limbo is
> now just slightly longer).
>
> While moving the location for the rules, I added a few more sections that should result in the iptables rules being redone:
Line wrap
ACK. Worth having in 1.2.0
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20131127/85f5e5c2/attachment-0001.sig>
More information about the libvir-list
mailing list