> > Just to be doubly clear, do you mean that the name is compared at
the
> > time the rule is submitted, or at the time it is evaluated?
>
> It's the latter. See ip_packet_match in
net/ipv4/netfilter/ip_tables.c
> for example.
Wild -- that's not what I'd have guessed. I suppose it allows you to
insert rules for interfaces that don't exist yet, which is a good thing.
Anyhow, I'm inclined to take the patch to disable filtering in the
bridge unless anyone strongly objects. People should still have the
option of applying rules on the vifX.X interface, right?
Ian 
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel