diff -rup xen-3.0.5-testing.hg-rc2-14889/tools/examples/network-bridge xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/network-bridge
--- xen-3.0.5-testing.hg-rc2-14889/tools/examples/network-bridge	2007-04-23 19:21:23.000000000 -0400
+++ xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/network-bridge	2007-04-26 11:14:10.000000000 -0400
@@ -5,9 +5,10 @@
 # The script name to use is defined in /etc/xen/xend-config.sxp
 # in the network-script field.
 #
-# This script creates a bridge (default xenbr${vifnum}), adds a device
-# (default eth${vifnum}) to it, copies the IP addresses from the device
-# to the bridge and adjusts the routes accordingly.
+# This script creates a bridge (default ${netdev}), adds a device
+# (defaults to the device on the default gateway route) to it, copies
+# the IP addresses from the device to the bridge and adjusts the routes
+# accordingly.
 #
 # If all goes well, this should ensure that networking stays up.
 # However, some configurations are upset by this, especially
@@ -20,31 +21,27 @@
 #
 # Vars:
 #
-# vifnum     Virtual device number to use (default 0). Numbers >=8
-#            require the netback driver to have nloopbacks set to a
-#            higher value than its default of 8.
-# bridge     The bridge to use (default xenbr${vifnum}).
-# netdev     The interface to add to the bridge (default eth${vifnum}).
+# bridge     The bridge to use (default ${netdev}).
+# netdev     The interface to add to the bridge (default gateway device).
 # antispoof  Whether to use iptables to prevent spoofing (default no).
 #
 # Internal Vars:
 # pdev="p${netdev}"
-# vdev="veth${vifnum}"
-# vif0="vif0.${vifnum}"
+# tdev=tmpbridge
 #
 # start:
-# Creates the bridge
-# Copies the IP and MAC addresses from netdev to vdev
+# Creates the bridge as tdev
+# Copies the IP and MAC addresses from pdev to bridge
 # Renames netdev to be pdev 
-# Renames vdev to be netdev 
-# Enslaves pdev, vdev to bridge
+# Renames tdev to bridge
+# Enslaves pdev to bridge
 #
 # stop:
-# Removes netdev from the bridge
-# Transfers addresses, routes from netdev to pdev
-# Renames netdev to vdev
+# Removes pdev from the bridge
+# Transfers addresses, routes from bridge to pdev
+# Renames bridge to tdev
 # Renames pdev to netdev 
-# Deletes bridge
+# Deletes tdev
 #
 # status:
 # Print addresses, interfaces, routes
@@ -59,15 +56,13 @@ dir=$(dirname "$0")
 findCommand "$@"
 evalVariables "$@"
 
-vifnum=${vifnum:-$(ip route list | awk '/^default / { print $NF }' | sed 's/^[^0-9]*//')}
-vifnum=${vifnum:-0}
-bridge=${bridge:-xenbr${vifnum}}
-netdev=${netdev:-eth${vifnum}}
+netdev=${netdev:-$(ip route list | awk '/^default / { print $NF }' |
+		   sed 's/.* dev //')}
+bridge=${bridge:-${netdev}}
 antispoof=${antispoof:-no}
 
 pdev="p${netdev}"
-vdev="veth${vifnum}"
-vif0="vif0.${vifnum}"
+tdev=tmpbridge
 
 get_ip_info() {
     addr_pfx=`ip addr show dev $1 | egrep '^ *inet' | sed -e 's/ *inet //' -e 's/ .*//'`
@@ -157,7 +152,6 @@ antispoofing () {
     iptables -P FORWARD DROP
     iptables -F FORWARD
     iptables -A FORWARD -m physdev --physdev-in ${pdev} -j ACCEPT
-    iptables -A FORWARD -m physdev --physdev-in ${vif0} -j ACCEPT
 }
 
 # Usage: show_status dev bridge
@@ -184,53 +178,27 @@ op_start () {
     fi
 
     if link_exists "$pdev"; then
-	# The device is already up.
-	return
-    fi
-    if link_exists veth0 && ! link_exists "$vdev"; then
-	echo "
-Link $vdev is missing.
-This may be because you have reached the limit of the number of interfaces
-that the loopback driver supports.  If the loopback driver is a module, you
-may raise this limit by passing it as a parameter (nloopbacks=<N>); if the
-driver is compiled statically into the kernel, then you may set the parameter
-using netloop.nloopbacks=<N> on the domain 0 kernel command line.
-" >&2
-	exit 1
+        # The device is already up.
+        return
     fi
 
-    create_bridge ${bridge}
+    create_bridge ${tdev}
 
-    if link_exists "$vdev"; then
-	mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
-	preiftransfer ${netdev}
-	transfer_addrs ${netdev} ${vdev}
-	if ! ifdown ${netdev}; then
-	    # If ifdown fails, remember the IP details.
-	    get_ip_info ${netdev}
-	    ip link set ${netdev} down
-	    ip addr flush ${netdev}
-	fi
-	ip link set ${netdev} name ${pdev}
-	ip link set ${vdev} name ${netdev}
-
-	setup_bridge_port ${pdev}
-	setup_bridge_port ${vif0}
-	ip link set ${netdev} addr ${mac} arp on
-
-	ip link set ${bridge} up
-	add_to_bridge  ${bridge} ${vif0}
-	add_to_bridge2 ${bridge} ${pdev}
-	do_ifup ${netdev}
-    else
-	ip link set ${bridge} arp on
-	ip link set ${bridge} multicast on
-	# old style without ${vdev}
-	transfer_addrs  ${netdev} ${bridge}
-	transfer_routes ${netdev} ${bridge}
-	# Attach the real interface to the bridge.
-	add_to_bridge ${bridge} ${netdev}
+    preiftransfer ${netdev}
+    transfer_addrs ${netdev} ${tdev}
+    if ! ifdown ${netdev}; then
+	# If ifdown fails, remember the IP details.
+	get_ip_info ${netdev}
+	ip link set ${netdev} down
+	ip addr flush ${netdev}
     fi
+    ip link set ${netdev} name ${pdev}
+    ip link set ${tdev} name ${bridge}
+
+    setup_bridge_port ${pdev}
+
+    add_to_bridge2 ${bridge} ${pdev}
+    do_ifup ${bridge}
 
     if [ ${antispoof} = 'yes' ] ; then
 	antispoofing
@@ -245,31 +213,21 @@ op_stop () {
 	return
     fi
 
-    if link_exists "$pdev"; then
-	ip link set dev ${vif0} down
-	mac=`ip link show ${netdev} | grep 'link\/ether' | sed -e 's/.*ether \(..:..:..:..:..:..\).*/\1/'`
-	transfer_addrs ${netdev} ${pdev}
-	if ! ifdown ${netdev}; then
-	    get_ip_info ${netdev}
-	fi
-	ip link set ${netdev} down arp off
-	ip link set ${netdev} addr fe:ff:ff:ff:ff:ff
-	ip link set ${pdev} down
-	ip addr flush ${netdev}
-	ip link set ${pdev} addr ${mac} arp on
-
-	brctl delif ${bridge} ${pdev}
-	brctl delif ${bridge} ${vif0}
-	ip link set ${bridge} down
-
-	ip link set ${netdev} name ${vdev}
-	ip link set ${pdev} name ${netdev}
-	do_ifup ${netdev}
-    else
-	transfer_routes ${bridge} ${netdev}
-	ip link set ${bridge} down
+    transfer_addrs ${bridge} ${pdev}
+    if ! ifdown ${bridge}; then
+	get_ip_info ${bridge}
     fi
-    brctl delbr ${bridge}
+    ip link set ${pdev} down
+    ip addr flush ${bridge}
+
+    brctl delif ${bridge} ${pdev}
+    ip link set ${bridge} down
+
+    ip link set ${bridge} name ${tdev}
+    ip link set ${pdev} name ${netdev}
+    do_ifup ${netdev}
+
+    brctl delbr ${tdev}
 }
 
 # adds $dev to $bridge but waits for $dev to be in running state first
Only in xen-3.0.5-testing.hg-rc2-14889.new/tools/examples: network-bridge~
diff -rup xen-3.0.5-testing.hg-rc2-14889/tools/examples/vif-bridge xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/vif-bridge
--- xen-3.0.5-testing.hg-rc2-14889/tools/examples/vif-bridge	2007-04-23 19:21:23.000000000 -0400
+++ xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/vif-bridge	2007-04-26 11:06:37.000000000 -0400
@@ -44,6 +44,32 @@ then
   then
      fatal "Could not find bridge, and none was specified"
   fi
+else
+  #
+  # Old style bridge setup with netloop, used to have a bridge name
+  # of xenbrX, enslaving pethX and vif0.X, and then configuring
+  # eth0.
+  #
+  # New style bridge setup does not use netloop, so the bridge name
+  # is ethX and the physical device is enslaved pethX
+  #
+  # So if...
+  #
+  #   - User asks for xenbrX
+  #   - AND xenbrX doesn't exist
+  #   - AND there is a ethX device which is a bridge
+  #
+  # ..then we translate xenbrX to ethX
+  #
+  # This lets old config files work without modification
+  #
+  if [ ! -e "/sys/class/net/$bridge" ] && [ "${bridge:0:5}" == "xenbr" ]
+  then
+     if [ -e "/sys/class/net/eth${bridge:5}/bridge" ]
+     then
+        bridge="eth${bridge:5}"
+     fi
+  fi
 fi
 
 RET=0
@@ -65,10 +91,8 @@ case "$command" in
         ;;
 esac
 
-handle_iptable
-
 log debug "Successful vif-bridge $command for $vif, bridge $bridge."
-if [ "$command" = "online" ]
+if [ "$command" == "online" ]
 then
   success
 fi
diff -rup xen-3.0.5-testing.hg-rc2-14889/tools/examples/xend-config.sxp xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/xend-config.sxp
--- xen-3.0.5-testing.hg-rc2-14889/tools/examples/xend-config.sxp	2007-04-26 11:06:17.000000000 -0400
+++ xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/xend-config.sxp	2007-04-26 11:06:37.000000000 -0400
@@ -118,9 +118,7 @@
 ##
 # To bridge network traffic, like this:
 #
-# dom0: fake eth0 -> vif0.0 -+
-#                            |
-#                          bridge -> real eth0 -> the network
+# dom0: ----------------- bridge -> real eth0 -> the network
 #                            |
 # domU: fake eth0 -> vifN.0 -+
 #
@@ -143,6 +141,13 @@
 # yourself a wrapper script, and call network-bridge from it, as appropriate.
 #
 (network-script network-bridge)
+#### LAPTOP USERS ! #####
+# For laptops, or machines where network interfaces come/go on-the-fly,
+# or are otherwise managed by NetworkManager, comment out the above line.
+# Then, uncomment the line below, and use libvirt's virtual networking
+# capability which sets up a isolated bridge + NAT forwarding
+#(network-script /bin/true)
+#### LAPTOP USERS ! #####
 
 # The script used to control virtual interfaces.  This can be overridden on a
 # per-vif basis when creating a domain or a configuring a new vif.  The
@@ -162,12 +167,14 @@
 
 ## Use the following if network traffic is routed, as an alternative to the
 # settings for bridged networking given above.
+# NB: Obsolete. See note above for LAPTOP USERS
 #(network-script network-route)
 #(vif-script     vif-route)
 
 
 ## Use the following if network traffic is routed with NAT, as an alternative
 # to the settings for bridged networking given above.
+# NB: Obsolete. See note above for LAPTOP USERS
 #(network-script network-nat)
 #(vif-script     vif-nat)
 
diff -rup xen-3.0.5-testing.hg-rc2-14889/tools/examples/xen-network-common.sh xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/xen-network-common.sh
--- xen-3.0.5-testing.hg-rc2-14889/tools/examples/xen-network-common.sh	2007-04-23 19:21:23.000000000 -0400
+++ xen-3.0.5-testing.hg-rc2-14889.new/tools/examples/xen-network-common.sh	2007-04-26 11:06:37.000000000 -0400
@@ -90,8 +90,6 @@ find_dhcpd_init_file()
 }
 
 # configure interfaces which act as pure bridge ports:
-#  - make quiet: no arp, no multicast (ipv6 autoconf)
-#  - set mac address to fe:ff:ff:ff:ff:ff
 setup_bridge_port() {
     local dev="$1"
 
@@ -99,9 +97,6 @@ setup_bridge_port() {
     ip link set ${dev} down
 
     # ... and configure it
-    ip link set ${dev} arp off
-    ip link set ${dev} multicast off
-    ip link set ${dev} addr fe:ff:ff:ff:ff:ff
     ip addr flush ${dev}
 }
 
@@ -114,15 +109,14 @@ create_bridge () {
 	brctl addbr ${bridge}
 	brctl stp ${bridge} off
 	brctl setfd ${bridge} 0
-        ip link set ${bridge} arp off
-        ip link set ${bridge} multicast off
+	# Setting these to zero stops guest<->LAN traffic
+	# traversing the bridge from hitting the *tables
+	# rulesets. guest<->host traffic still gets processed
+	# by the host's iptables rules so this isn't a hole
+	sysctl -q -w "net.bridge.bridge-nf-call-arptables=0"
+	sysctl -q -w "net.bridge.bridge-nf-call-ip6tables=0"
+	sysctl -q -w "net.bridge.bridge-nf-call-iptables=0"
     fi
-
-    # A small MTU disables IPv6 (and therefore IPv6 addrconf).
-    mtu=$(ip link show ${bridge} | sed -n 's/.* mtu \([0-9]\+\).*/\1/p')
-    ip link set ${bridge} mtu 68
-    ip link set ${bridge} up
-    ip link set ${bridge} mtu ${mtu:-1500}
 }
 
 # Usage: add_to_bridge bridge dev
diff -rup xen-3.0.5-testing.hg-rc2-14889/tools/ioemu/target-i386-dm/qemu-ifup xen-3.0.5-testing.hg-rc2-14889.new/tools/ioemu/target-i386-dm/qemu-ifup
--- xen-3.0.5-testing.hg-rc2-14889/tools/ioemu/target-i386-dm/qemu-ifup	2007-04-23 19:21:23.000000000 -0400
+++ xen-3.0.5-testing.hg-rc2-14889.new/tools/ioemu/target-i386-dm/qemu-ifup	2007-04-26 11:06:37.000000000 -0400
@@ -5,5 +5,33 @@
 
 echo 'config qemu network with xen bridge for ' $*
 
+bridge=$2
+
+#
+# Old style bridge setup with netloop, used to have a bridge name
+# of xenbrX, enslaving pethX and vif0.X, and then configuring
+# eth0.
+#
+# New style bridge setup does not use netloop, so the bridge name
+# is ethX and the physical device is enslaved pethX
+#
+# So if...
+#
+#   - User asks for xenbrX
+#   - AND xenbrX doesn't exist
+#   - AND there is a ethX device which is a bridge
+#
+# ..then we translate xenbrX to ethX
+#
+# This lets old config files work without modification
+#
+if [ ! -e "/sys/class/net/$bridge" ] && [ "${bridge:0:5}" == "xenbr" ]
+then
+   if [ -e "/sys/class/net/eth${bridge:5}/bridge" ]
+   then
+      bridge="eth${bridge:5}"
+   fi
+fi
+
 ifconfig $1 0.0.0.0 up
-brctl addif $2 $1
+brctl addif $bridge $1