From: Hans van Kranenburg Date: Thu, 3 Jan 2019 23:35:45 +0000 (+0100) Subject: t/h/L/vif-common.sh: disable handle_iptable X-Git-Tag: archive/raspbian/4.16.1-1+rpi1^2~12 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=8f203251179a886926c77efb6e11914dfce08399;p=xen.git t/h/L/vif-common.sh: disable handle_iptable Also see Debian bug #894013. The current attempt at providing anti-spoofing rules results in a situation that does not have any effect. Also note that forwarding bridged traffic to iptables is not enabled by default, and that for openvswitch users it does not make any sense. So, stop cluttering the live iptables ruleset. This functionality seems to be introduced before 2004 and since then it has never got some additional love. It would be nice to have a proper discussion upstream about how Xen could provide some anti mac/ip spoofing in the dom0. It does not seem to be a trivial thing to do, since it requires having quite some knowledge about what the domU is allowed to do or not (e.g. a domU can be a router...). Signed-off-by: Hans van Kranenburg --- diff --git a/tools/hotplug/Linux/vif-common.sh b/tools/hotplug/Linux/vif-common.sh index a8e65178f9..99ff1baaa6 100644 --- a/tools/hotplug/Linux/vif-common.sh +++ b/tools/hotplug/Linux/vif-common.sh @@ -182,6 +182,9 @@ frob_iptable() # handle_iptable() { + # This function is disabled in Debian packaging. See Debian bug #894013. + return 0 + # Check for a working iptables installation. Checking for the iptables # binary is not sufficient, because the user may not have the appropriate # modules installed. If iptables is not working, then there's no need to do