Re: [libvirt] [libvirt PATCHv3 03/10] reverse sense of address matching

[...] diff --git a/examples/xml/nwfilter/Makefile.am b/examples/xml/nwfilter/Makefile.am index 23fd753..84aaa3c 100644 --- a/examples/xml/nwfilter/Makefile.am +++ b/examples/xml/nwfilter/Makefile.am @@ -3,12 +3,16 @@ FILTERS = \ allow-arp.xml \ + allow-arpip.xml \ + allow-arpmac.xml \ allow-dhcp-server.xml \ allow-dhcp.xml \ allow-incoming-ipv4.xml \ allow-ipv4.xml \ clean-traffic.xml \ no-arp-spoofing.xml \ + no-arpmac-spoofing.xml \ + no-arpip-spoofing.xml \ no-ip-multicast.xml \ no-ip-spoofing.xml \ no-mac-broadcast.xml \ diff --git a/examples/xml/nwfilter/allow-arp.xml b/examples/xml/nwfilter/allow-arp.xml index 63a92b2..6271ae4 100644 --- a/examples/xml/nwfilter/allow-arp.xml +++ b/examples/xml/nwfilter/allow-arp.xml @@ -1,3 +1,4 @@ -<filter name='allow-arp' chain='arp'> -<rule direction='inout' action='accept'/> +<filter name='allow-arp' chain='arpmac'> +<filterref filter='allow-arpmac.xml'/> +<filterref filter='allow-arpip.xml'/> </filter>

diff --git a/examples/xml/nwfilter/allow-arpip.xml b/examples/xml/nwfilter/allow-arpip.xml new file mode 100644 index 0000000..6ddb6fe --- /dev/null +++ b/examples/xml/nwfilter/allow-arpip.xml @@ -0,0 +1,3 @@ +<filter name='allow-arpip' chain='arpip'> +<rule direction='inout' action='accept'/> +</filter>

diff --git a/examples/xml/nwfilter/allow-arpmac.xml b/examples/xml/nwfilter/allow-arpmac.xml new file mode 100644 index 0000000..54f6714 --- /dev/null +++ b/examples/xml/nwfilter/allow-arpmac.xml @@ -0,0 +1,3 @@ +<filter name='allow-arpmac' chain='arpmac'> +<rule direction='inout' action='accept'/> +</filter>

diff --git a/examples/xml/nwfilter/clean-traffic.xml b/examples/xml/nwfilter/clean-traffic.xml index 40f0ecb..9cee799 100644 --- a/examples/xml/nwfilter/clean-traffic.xml +++ b/examples/xml/nwfilter/clean-traffic.xml @@ -11,10 +11,10 @@ <!-- preventing ARP spoofing/poisoning --> <filterref filter='no-arp-spoofing'/> -<!-- preventing any other traffic than IPv4 and ARP --> -<filterref filter='no-other-l2-traffic'/> - <!-- allow qemu to send a self-announce upon migration end --> <filterref filter='qemu-announce-self'/> +<!-- preventing any other traffic than IPv4 and ARP --> +<filterref filter='no-other-l2-traffic'/> + </filter>

diff --git a/examples/xml/nwfilter/no-arp-spoofing.xml b/examples/xml/nwfilter/no-arp-spoofing.xml index 3c83acd..1979b20 100644 --- a/examples/xml/nwfilter/no-arp-spoofing.xml +++ b/examples/xml/nwfilter/no-arp-spoofing.xml @@ -1,17 +1,4 @@ -<filter name='no-arp-spoofing' chain='arp'> -<uuid>f88f1932-debf-4aa1-9fbe-f10d3aa4bc95</uuid> -<rule action='drop' direction='out' priority='300'> -<mac match='no' srcmacaddr='$MAC'/> -</rule> - -<!-- no arp spoofing --> -<!-- drop if ipaddr or macaddr does not belong to guest --> -<rule action='drop' direction='out' priority='350'> -<arp match='no' arpsrcmacaddr='$MAC'/> -</rule> -<rule action='drop' direction='out' priority='400'> -<arp match='no' arpsrcipaddr='$IP' /> -</rule> -<!-- allow everything else --> -<rule action='accept' direction='in' priority='425' /> +<filter name='no-arp-spoofing'> +<filterref filter='no-arpmac-spoofing' /> +<filterref filter='no-arpip-spoofing' /> </filter> diff --git a/examples/xml/nwfilter/no-arpip-spoofing.xml b/examples/xml/nwfilter/no-arpip-spoofing.xml new file mode 100644 index 0000000..ee42d40 --- /dev/null +++ b/examples/xml/nwfilter/no-arpip-spoofing.xml @@ -0,0 +1,12 @@ +<filter name='no-arpip-spoofing' chain='arpip'> +<!-- no arp spoofing --> +<!-- drop if ipaddr does not belong to guest --> +<rule action='return' direction='out' priority='400'> +<arp match='yes' arpsrcipaddr='$IP' /> +</rule> +<rule action='return' direction='out' priority='410'> +<arp match='yes' arpsrcipaddr='0.0.0.0' /> +</rule>

+<!-- drop everything else --> +<rule action='drop' direction='out' priority='1000' /> +</filter> diff --git a/examples/xml/nwfilter/no-arpmac-spoofing.xml b/examples/xml/nwfilter/no-arpmac-spoofing.xml new file mode 100644 index 0000000..90499d3 --- /dev/null +++ b/examples/xml/nwfilter/no-arpmac-spoofing.xml @@ -0,0 +1,7 @@ +<filter name='no-arpmac-spoofing' chain='arpmac'> +<rule action='return' direction='out' priority='350'> +<arp match='yes' arpsrcmacaddr='$MAC'/> +</rule> +<!-- drop everything else --> +<rule action='drop' direction='out' priority='1000' /> +</filter> diff --git a/examples/xml/nwfilter/no-ip-spoofing.xml b/examples/xml/nwfilter/no-ip-spoofing.xml index b8c94c8..84e8a5e 100644 --- a/examples/xml/nwfilter/no-ip-spoofing.xml +++ b/examples/xml/nwfilter/no-ip-spoofing.xml @@ -1,7 +1,9 @@ <filter name='no-ip-spoofing' chain='ipv4'> <!-- drop if srcipaddr is not the IP address of the guest --> -<rule action='drop' direction='out'> -<ip match='no' srcipaddr='$IP' /> +<rule action='return' direction='out'> +<ip match='yes' srcipaddr='$IP' /> </rule> +<!-- drop any that don't match the source IP list --> +<rule action='drop' direction='out' /> </filter> diff --git a/examples/xml/nwfilter/no-mac-spoofing.xml b/examples/xml/nwfilter/no-mac-spoofing.xml index f210623..aee56c7 100644 --- a/examples/xml/nwfilter/no-mac-spoofing.xml +++ b/examples/xml/nwfilter/no-mac-spoofing.xml @@ -1,5 +1,9 @@ -<filter name='no-mac-spoofing' chain='ipv4'> -<rule action='drop' direction='out' priority='10'> -<mac match='no' srcmacaddr='$MAC' /> -</rule> +<filter name='no-mac-spoofing' chain='mac'> +<!-- no mac spoofing --> +<!-- drop if macaddr does not belong to guest --> +<rule action='return' direction='out' priority='350'> +<mac match='yes' srcmacaddr='$MAC'/> +</rule> +<!-- drop everything else --> +<rule action='drop' direction='out' priority='1000' /> </filter> diff --git a/examples/xml/nwfilter/no-other-l2-traffic.xml b/examples/xml/nwfilter/no-other-l2-traffic.xml index 8bad86e..0501b1a 100644 --- a/examples/xml/nwfilter/no-other-l2-traffic.xml +++ b/examples/xml/nwfilter/no-other-l2-traffic.xml @@ -1,7 +1,12 @@ -<filter name='no-other-l2-traffic'> +<filter name='no-other-l2-traffic' chain='root'> -<!-- drop all other l2 traffic than for which rules have been - written for; i.e., drop all other than arp and ipv4 traffic --> -<rule action='drop' direction='inout' priority='1000'/> +<!-- drop all other than arp and ipv4 traffic --> +<rule action='accept' direction='inout'> +<mac protocolid='0x800' /> +</rule> +<rule action='accept' direction='inout'> +<mac protocolid='0x806' /> +</rule> +<rule action='drop' direction='inout' priority='1000' />