Re: [libvirt] [libvirt PATCHv3 04/10] make default chain policy DROP

2011-10-17 Thread Stefan Berger
On 10/12/2011 03:50 PM, David L Stevens wrote: This patch simplifies the table rules by setting the protocol chains policy to be DROP and removes the explicit -j DROP entries that the protocol rules had previously. It also makes no-other-rarp-traffic.xml obsolete. I agree with Daniel's

Re: [libvirt] [libvirt PATCHv3 04/10] make default chain policy DROP

2011-10-17 Thread David Stevens
Stefan Berger stef...@linux.vnet.ibm.com wrote on 10/17/2011 08:50:14 AM: I agree with Daniel's previous comments that this could introduce compatibility problems. It would be best not to change it or if really need be later on introduce an XML attribute for a chain that allows to choose

Re: [libvirt] [libvirt PATCHv3 04/10] make default chain policy DROP

2011-10-17 Thread Stefan Berger
On 10/17/2011 01:04 PM, David Stevens wrote: Stefan Bergerstef...@linux.vnet.ibm.com wrote on 10/17/2011 08:50:14 AM: I agree with Daniel's previous comments that this could introduce compatibility problems. It would be best not to change it or if really need be later on introduce an XML

Re: [libvirt] [libvirt PATCHv3 04/10] make default chain policy DROP

2011-10-17 Thread David Stevens
Stefan Berger stef...@linux.vnet.ibm.com wrote on 10/17/2011 10:29:08 AM: Yes, '_at_the_end_', that's what I thought. I am not sure whether this particular requirement is the best way to proceed since obviously you cannot have any other rules with lesser priority after the ones doing the

Re: [libvirt] [libvirt PATCHv3 04/10] make default chain policy DROP

2011-10-17 Thread Stefan Berger
On 10/17/2011 05:22 PM, David Stevens wrote: Stefan Bergerstef...@linux.vnet.ibm.com wrote on 10/17/2011 10:29:08 AM: Yes, '_at_the_end_', that's what I thought. I am not sure whether this particular requirement is the best way to proceed since obviously you cannot have any other rules with

[libvirt] [libvirt PATCHv3 04/10] make default chain policy DROP

2011-10-12 Thread David L Stevens
This patch simplifies the table rules by setting the protocol chains policy to be DROP and removes the explicit -j DROP entries that the protocol rules had previously. It also makes no-other-rarp-traffic.xml obsolete. Signed-off-by: David L Stevens dlstev...@us.ibm.com ---