From 0736e068b43d6b47c0bdeef780ba116c57cdc0b1 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Thu, 12 Jul 2012 23:08:45 -0700 Subject: debian: Do not change iptables rules by default. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Debian kernel maintainer Bastian Blank writes, at http://bugs.debian.org/680537: The netfilter rules are a shared resource. There is no synchronization, so the admin have the last word. As kernel maintainer, I see it similar to a configuration file, so ยง10.7 policy applies. The purpose of openvswitch is to provide support for switching, not to setup filter rules. This means it violates the principle of least surprise. I believe that the argument by analogy to configuration files is weak, given that the Debian policy section in question is very specifically about files, not about general principles. On the other hand, Debian does not install any firewall by default, so the presence of a rule that blocks GRE traffic is a sign that the administrator has taken an explicit action to install a firewall that blocks GRE, and therefore it is rather rude to override this. Therefore, this patch simply turns off this behavior on Debian, given that in ordinary Debian installations it will have no adverse effect on Open vSwitch. Debian bug #680537. CC: 680537@bugs.debian.org Reported-by: Bastian Blank Signed-off-by: Ben Pfaff Acked-by: Simon Horman --- debian/openvswitch-switch.init | 2 -- 1 file changed, 2 deletions(-) diff --git a/debian/openvswitch-switch.init b/debian/openvswitch-switch.init index b44daad8a..9d55a1c5b 100755 --- a/debian/openvswitch-switch.init +++ b/debian/openvswitch-switch.init @@ -71,8 +71,6 @@ start () { set "$@" --force-corefiles="$FORCE_COREFILES" fi "$@" || exit $? - - ovs_ctl --protocol=gre enable-protocol } stop () { -- cgit v1.2.1