[PATCH v3 26/27] network: prefer the nftables backend over iptables
The patch that added the nftables backend for virtual networks left
iptables as the default backend when both nftables and iptables are
installed.
The only functional difference between the two backends is that the
nftables backend doesn't add any rules to fix up the checksum of DHCP
packets, which will cause failures on guests with very old OSes
(e.g. RHEL5) that have a virtio-net network interface using vhost
packet processing (the default), connected to a libvirt virtual
network, and configured to acquire the interface IP using DHCP. Since
RHEL5 has been out of support for several years already, we might as
well start off nftables support right by making it the default.
Distros that aren't quite ready to default to nftables (e.g. maybe
they're rebasing libvirt within a release and don't want to surprise
anyone with an automatic switch from iptables to nftables) can simply
run meson with "-Dfirewall_backend=iptables" during their official
package build.
In the extremely unlikely case that this causes a problem for a user,
they can work around the failure by adding "<driver name='qemu'/> to
the guest <interface> element.
Signed-off-by: Laine Stump <laine(a)redhat.com>
---
Change from V2:
* greatly simplified because all that's required now is to change
a single word in meson_options.txt
meson_options.txt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meson_options.txt b/meson_options.txt
index 367629f5dc..b68bd52477 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -98,7 +98,7 @@ option('chrdev_lock_files', type: 'string', value:
'', description: 'location fo
option('dtrace', type: 'feature', value: 'auto', description:
'use dtrace for static probing')
option('firewalld', type: 'feature', value: 'auto', description:
'firewalld support')
option('firewalld_zone', type: 'feature', value: 'auto',
description: 'whether to install firewalld libvirt zone')
-option('firewall_backend', type: 'string', value: 'iptables',
description: 'which firewall backend to use by default when none is specified')
+option('firewall_backend', type: 'string', value: 'nftables',
description: 'which firewall backend to use by default when none is specified')
option('host_validate', type: 'feature', value: 'auto',
description: 'build virt-host-validate')
option('init_script', type: 'combo', choices: ['systemd',
'openrc', 'check', 'none'], value: 'check', description:
'Style of init script to install')
option('loader_nvram', type: 'string', value: '', description:
'Pass list of pairs of <loader>:<nvram> paths. Both pairs and list items
are separated by a colon.')
--
2.44.0