From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <ian.campbell@citrix.com>
Subject: Re: [PATCH RFC] hotplug/Linux: Add --wait to iptables
 calls.
Date: Mon, 1 Jun 2015 17:15:24 +0100
Message-ID: <1433175324.15036.225.camel@citrix.com>
References: <1433170772-17684-1-git-send-email-anthony.perard@citrix.com>
	<556C91A2020000780007FCEE@mail.emea.novell.com>
	<1433171871.15036.218.camel@citrix.com>
	<20150601160956.GE1666@perard.uk.xensource.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <20150601160956.GE1666@perard.uk.xensource.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Anthony PERARD <anthony.perard@citrix.com>
Cc: Ian Jackson <ian.jackson@eu.citrix.com>, Xen Devel <xen-devel@lists.xen.org>, Wei Liu <wei.liu2@citrix.com>, Jan Beulich <JBeulich@suse.com>, Stefano Stabellini <stefano.stabellini@eu.citrix.com>
List-Id: xen-devel@lists.xenproject.org

On Mon, 2015-06-01 at 17:09 +0100, Anthony PERARD wrote:
> On Mon, Jun 01, 2015 at 04:17:51PM +0100, Ian Campbell wrote:
> > On Mon, 2015-06-01 at 16:08 +0100, Jan Beulich wrote:
> > > >>> On 01.06.15 at 16:59, <anthony.perard@citrix.com> wrote:
> > > > --- a/tools/hotplug/Linux/vif-common.sh
> > > > +++ b/tools/hotplug/Linux/vif-common.sh
> > > > @@ -130,9 +130,9 @@ frob_iptable()
> > > >      local c="-D"
> > > >    fi
> > > >  
> > > > -  iptables "$c" FORWARD -m physdev --physdev-is-bridged --physdev-in "$dev" \
> > > > +  iptables --wait "$c" FORWARD -m physdev --physdev-is-bridged --physdev-in "$dev" \
> > > >      "$@" -j ACCEPT 2>/dev/null &&
> > > > -  iptables "$c" FORWARD -m physdev --physdev-is-bridged --physdev-out "$dev" \
> > > > +  iptables --wait "$c" FORWARD -m physdev --physdev-is-bridged --physdev-out "$dev" \
> > > >      -j ACCEPT 2>/dev/null
> > > >  
> > > >    if [ \( "$command" == "online" -o "$command" == "add" \) -a $? -ne 0 ]
> > > 
> > > Looking at my oldest system's "iptables --help" I can't spot such an
> > > option (which doesn't necessarily mean it's not supported). Did you
> > > make sure all (older) distros we care about actually support this?
> 
> --wait does not appear work on a debian weezy (Debian 7.8).
> 
> > It's not really clear if/why --wait is the solution to the problem of
> > another party using iptables-{save,restore} to do their own network
> > management in the first place.
> > 
> > If OpenStack is doing save/modify/restore then what stops us rewriting
> > things in the middle and then getting those changes clobbered on
> > restore? Surely iptables-save can't exit holding the lock...
> 
> That could be an issue.
> 
> > And if nova-network is managing networking do we really need to do it
> > too?
> 
> I will investigate in that, check what there are doing, and what we are
> doing. The solution might just be a script=none.

Or script=nova-network even.

Ian.