On Mon, 2015-06-01 at 16:08 +0100, Jan Beulich wrote:
> >>> On 01.06.15 at 16:59, <anthony.per...@citrix.com> wrote:
> > --- a/tools/hotplug/Linux/vif-common.sh
> > +++ b/tools/hotplug/Linux/vif-common.sh
> > @@ -130,9 +130,9 @@ frob_iptable()
> > local c="-D"
> > fi
> >
> > - iptables "$c" FORWARD -m physdev --physdev-is-bridged --physdev-in
> > "$dev" \
> > + iptables --wait "$c" FORWARD -m physdev --physdev-is-bridged
> > --physdev-in "$dev" \
> > "$@" -j ACCEPT 2>/dev/null &&
> > - iptables "$c" FORWARD -m physdev --physdev-is-bridged --physdev-out
> > "$dev" \
> > + iptables --wait "$c" FORWARD -m physdev --physdev-is-bridged
> > --physdev-out "$dev" \
> > -j ACCEPT 2>/dev/null
> >
> > if [ \( "$command" == "online" -o "$command" == "add" \) -a $? -ne 0 ]
>
> Looking at my oldest system's "iptables --help" I can't spot such an
> option (which doesn't necessarily mean it's not supported). Did you
> make sure all (older) distros we care about actually support this?
It's not really clear if/why --wait is the solution to the problem of
another party using iptables-{save,restore} to do their own network
management in the first place.
If OpenStack is doing save/modify/restore then what stops us rewriting
things in the middle and then getting those changes clobbered on
restore? Surely iptables-save can't exit holding the lock...
And if nova-network is managing networking do we really need to do it
too?
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
