[Pkg-xen-devel] Bug#613540: xen-utils-common: iptables rules missing for qemu tap interfaces

[Andreas Pflug]

Package: xen-utils-common
Version: 4.0.0-1
Severity: normal

When a qemu hvm with vif=['type=ioemu,bridge=eth0'] is created, xen will successfully create the required vif and tap bridge interfaces, but will create the corresponding iptables filter rules for the vif interface only, not the tap interface.
With a FORWARD policy of DROP (e.g. by enabling antispoofing) network traffic from/to the hvm will fail.

As a quick fix, I added 
iptables -I FORWARD -m physdev --physdev-in $1 -j ACCEPT
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -m physdev --physdev-out $1 -j ACCEPT
to /etc/xen/scripts/qemu-ifup, which makes the hvm networking functional, but the tap iptables filter rules won't get cleaned up when the hvm is shut down.

-- System Information:
Debian Release: 6.0
  APT prefers squeeze-updates
  APT policy: (500, 'squeeze-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-xen-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages xen-utils-common depends on:
ii  gawk                    1:3.1.7.dfsg-5   GNU awk, a pattern scanning and pr
ii  lsb-base                3.2-23.2squeeze1 Linux Standard Base 3.2 init scrip
ii  udev                    164-3            /dev/ and hotplug management daemo
ii  xenstore-utils          4.0.1-2          Xenstore utilities for Xen

xen-utils-common recommends no packages.

xen-utils-common suggests no packages.

-- Configuration Files:
/etc/xen/scripts/qemu-ifup changed [not included]

-- no debconf information