[netcf-devel] [PATCH 0/2] Remove code that modifies iptables config for bridges

Laine Stump laine at laine.org
Thu Sep 16 19:27:50 UTC 2010


  On 09/16/2010 02:47 PM, David Lutterkort wrote:
> On Wed, 2010-09-15 at 11:52 -0400, Laine Stump wrote:
>> Note that, even with this code removed, there is still one other
>> related problem - if there are no bridges defined on the system at
>> boot time (in /etc/sysconfig/network-scripts/ifcfg-*), the setting of
>> net.bridge.bridge-nf-call-iptablesin sysctl.conf will not take effect,
>> leaving the bridge module default setting of "1" in place. The result
>> will be that (since the aforementioned iptables rule won't be added)
>> that traffic will not pass on any newly defined bridges until 1) the
>> network service is restarted (or some other procedure that causes
>> "sysctl -a -p" to be run), or 2) the system is rebooted. Fixing that
>> is beyond the scope of netcf, though.
> Is there a bz for this ? It seems very strange to me that there is a
> difference between apparent configuration and actual configuration for
> this.

Not yet. I just figured out what was going on yesterday. If there are no 
bridges defined in ifcfg files, the network service doesn't load the 
bridge module, so when it (the network service) reloads sysctl.conf, 
those tunables don't exist in the system, and can't be set. This is also 
the case when any subsequent init script reloads sysctl.conf, right up 
until libvirtd starts; if libvirt has any virtual networks defined, it 
will autoload the bridge module, and the variables will get the module's 
default. The result is that when libvirtd initializes netcf, it sees the 
module's default rather than the sysctl default.

If there *are* bridges defined in ifcfg scripts, the bridge module will 
have been loaded by the time the network service reloads sysctl.conf, so 
the configured and actual settings will match.

(Apparently other libvirt people had previously requested that the 
bridge module change its default from 1 to 0, but were denied and told 
to just set a different default in sysctl.conf, as it would have the 
same effect. Ahem. Not quite.)

It seems to me that the best fix would be for the bridge module's init 
script to reload sysctl.conf just before it exits; does that sound right 
to you?




More information about the netcf-devel mailing list