Description of problem:
Xen supports IP antispoofing using iptables. It can also support multiple ip
antispoofing (several IP's for one interface, simply separated by spaces), but
it is not possible to have several IPs, because of the bug in
/etc/xen/scripts/vif-common.sh script.

Version-Release number of selected component (if applicable):
All?

How reproducible:
Always

Steps to Reproduce:
1. Create guest domain config with this network config sample: vif = [
'mac=some_mac, bridge=xenbr0, ip=10.X.X.X 10.X.X.Y' ]
2. Start domain
3. iptables -L
  
Actual results:
Failed iptables command is logged in /var/log/messages. iptables -L shows that
there is no FORWARD rules which will let those ip to pass through. Guest domain
has no net connectivity because packets are dropped by default forward rule.
messages log example:
Apr 19 18:21:04 somehost logger: /etc/xen/scripts/vif-bridge: iptables -A
FORWARD -m physdev --physdev-in vifXX.0 -s 10.X.X.X 10.X.X.Y -j ACCEPT failed.
If you are using iptables, this may affect networking for guest domains.

Expected results:
iptables -L should return:
-A FORWARD -s 10.X.X.X -m physdev  --physdev-in vifXX.0 -j ACCEPT 
-A FORWARD -s 10.X.X.Y -m physdev  --physdev-in vifXX.0 -j ACCEPT
other rules...
Guest domain has connectivity, packets are not dropped by default forward rules,
but accepted by rules above.

Additional info:

Bug in /etc/xen/scripts/vif-common.sh
line 106
for addr in "$ip"
do
    frob_iptable -s "$addr"
done
should be:
for addr in $ip
do
    frob_iptable -s "$addr"
done