Re: [libvirt] [RFC] Proposal for introduction of network traffic filtering capabilities for filtering of network traffic from and to VMs

libvir-list-bounces(a)redhat.com wrote on 01/26/2010 08:24:43 AM: As the implementation of this progresses and we make design decision, we now introduced attributes and values for the filters to be passed in the format of att%d='<attribute>' val%d='<value>' thus we would rewrite the above example to: <domain type='kvm'> <name>demo</name> <memory>256000</memory> <devices> <interface type="bridge"> <filter name='demofilter' att0='IP' val0='10.0.0.1'/> </interface> </devices> </domain> This allows us to pass any necessary parameters to the filters for instantiation in the respective environment. So, if a filter is to be instantiated and holds the variable XYZ, then one may add att1='XYZ' val1='<some value>' --> <include href='no-arp-spoofing' att0='IP' val0='1.2.3.4'. So any referenced filter, also as shown above in the demofilter.xml, could hold environment-specific values for required variables. A filter requiring a variable that is not passed is not instantiated and will prevent interface creation / attachment or the start of the VM. Further, if an attribute value pair (IP) as shown here is passed from the domain XML and another value as shown here in the referenced filter is again set, the one from further 'up' is used, i.e., IP=10.0.0.1 rather than IP=1.2.3.4. Does this sound ok? Regards, Stefan