Re: [libvirt] [libvirt PATCHv4 0/2] DHCP Snooping support for libvirt

Stefan, Thanks for reviewing. Stefan Berger <stefanb(a)linux.vnet.ibm.com&gt; wrote on 10/25/2011 04:59:16 AM: I labelled in the code with comments the places that need to be revised (3, I believe) for multiple address support. I added one check to ignore an additional address when you already have one for an interface. The other depends on the form of multiple address support. If it is a mechanism that changes variable values (either add or remove) in place in the filters, it'll be reverting to code similar to my first post. If it uses something like virNWFilterInstantiateFilterLate(), my main concern is making sure there isn't a window while deleting or adding an address that rebuilds the entire filter where either no packets or spoofed packets would be allowed. Both cases would need to remove the DHCP-only rule installation in delete, since removing one of multiple addresses shouldn't remove the other address(es)'s filters. The internal snooping code supports multiple addresses per interface as before. It assumes 1-interface==1-network as before, so your comments about VLANs and the leasefile also require a visit, but don't apply without multiple address support in the rest of nwfilter. Tracking and saving the VLAN ID or saving and matching the DHCP client ID should do that. +-DLS