files, included 'upstream' qemu dropped, bconds

[packages/xen.git] / xen-net-disable-iptables-on-bridge.patch

diff -dur -x '*.orig' -x '*.rej' -x '*~' xen-4.2.0.orig/tools/hotplug/Linux/vif-bridge xen-4.2.0/tools/hotplug/Linux/vif-bridge
--- xen-4.2.0.orig/tools/hotplug/Linux/vif-bridge	2012-09-17 12:21:18.000000000 +0200
+++ xen-4.2.0/tools/hotplug/Linux/vif-bridge	2012-10-22 13:05:43.000000000 +0200
@@ -101,10 +101,6 @@
         ;;
 esac
 
-if [ "$type_if" = vif ]; then
-    handle_iptable
-fi
-
 call_hooks vif post
 
 log debug "Successful vif-bridge $command for $dev, bridge $bridge."
diff -dur -x '*.orig' -x '*.rej' -x '*~' xen-4.2.0.orig/tools/hotplug/Linux/xen-network-common.sh xen-4.2.0/tools/hotplug/Linux/xen-network-common.sh
--- xen-4.2.0.orig/tools/hotplug/Linux/xen-network-common.sh	2012-09-17 12:21:18.000000000 +0200
+++ xen-4.2.0/tools/hotplug/Linux/xen-network-common.sh	2012-10-22 13:05:02.000000000 +0200
@@ -115,6 +115,13 @@
 	brctl addbr ${bridge}
 	brctl stp ${bridge} off
 	brctl setfd ${bridge} 0
+	# Setting these to zero stops guest<->LAN traffic
+	# traversing the bridge from hitting the *tables
+	# rulesets. guest<->host traffic still gets processed
+	# by the host's iptables rules so this isn't a hole
+	sysctl -q -w "net.bridge.bridge-nf-call-arptables=0"
+	sysctl -q -w "net.bridge.bridge-nf-call-ip6tables=0"
+	sysctl -q -w "net.bridge.bridge-nf-call-iptables=0"
     fi
 }