Re: [Libvir] Virtual networking (not the rathole thread :-)

On Tue, 2007-01-16 at 22:28 +0000, Daniel P. Berrange wrote: Indeed :-) Sure. There is the argument that always using VDE is nicer because it's consistent with the non-privileged and remotely connected network versions. As you say, though, this way is consistent with the Xen version. Okay, to avoid a userspace network stack, you need a way to securely allow guests running as unprivileged users to use the kernel's network stack. That implies: 1) The packets/frames have to arrive on a network interface created by the user (e.g. a TAP or SLIP iface) 2) It should not be possible to spoof as another host or adversely affect the host's connectivity, or any other machine on the same network as the host 3) slirp prevents spoofing by effectively translating the source address of any packet which leaves the virtual network, just like a router using SNAT 4) We can do the same thing by enabling IP forwarding and having all packets forwarded by the host go through SNAT 5) The problem with that is what to do about packets not being forwarded by the host, but which are destined for the host itself? SNAT in PREROUTING might do it, but that's not allowed it seems. 6) We also have to worry about whether people could e.g. screw up the host's ARP cache 7) We also have to worry about a DOS whereby someone creates lots of network interfaces And note, this isn't just about worrying about nasty guests. You have to worry about what nasty users on the host could do with a setuid helper like this. It's certainly got to be "possible" ... but I don't yet feel I know what all the bases are that need to be covered, never mind how we'd cover them. The general problem with any SLIRP derivative or similar it's another network stack implementation. That makes me nervous for security, performance, stability and portability reasons. And as I found out, the case in point is that SLIRP currently has buffer overflow vulnerabilities and isn't 64 bit clean. Right, further on in the mail I said: * Where is the connection between domains and networks in either the API or the XML format? How is a domain associated with a network? You put a bridge name in the <network> definition and use that in the domains <interface> definition? Or you put the network name in the interface definition and have libvirt look up the bridge name when creating the guest? Well, the UUID isn't much good if you can't map it. So, it would probably be the name and libvirt URI, right? Well, I think there should be a default virtual network defined somehow. You shouldn't need to create one unless you want a second one. But remember that under the model I'm suggesting, guests connect *either* to a virtual network or a physical network via a "shared physical interface". The shared physical interface just winds up being a bridge you enslave the guest's interface to, so the easiest answer for that is that we stick with the way it is right now for Xen and have QEMU create a TAP device and enslave that to the bridge in this mode. Dunno, it does need more thought/discussion ... I find the current <interface> stuff quite strange now - e.g. "bridge" vs. "ethernet" types and the bridge name is in <source> ? Cheers, Mark.