[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Xense-devel] Re: [Xen-devel] RFC: virtual network access control
xense-devel-bounces@xxxxxxxxxxxxxxxxxxx wrote on 07/28/2006
> > We see other problems as well: IPtables seems to not see any
> > ethernet-bridged packets. If you wanted to use IPtables then
> > would need to replace the ethernet bridge with routing each packet.
> You want CONFIG_BRIDGE_NETFILTER=y, this makes iptabes see bridged
> Additionally you need CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y, that allows
> matching on the physical device name for bridged packets. That
> can filter by domain (because each domain has its own virtual bridge
> port) instead of ip/mac address.
Using IPtables this way sounds like a feasible compromise
for the short term.
There are drawbacks to this short-term solution:
* dependencies on user space tools (also coordination
requirements wrt other users of IPtables)
* performance: rules add up in IPTables when the number
of interfaces increases
* scalability: for every interface coming up we make
a number of hypercalls to setup the filters to the existing interfaces
[O(n) for sHype/ACM; other non-symmetric policies might involve more overhead]
For these reasons, I suggest that we include networking
in our discussions about the long-term security architecture and related
interfaces in Xen.
If there are no other suggestions then we will proceed
following the suggestion to use IPtables and filtering based on devices.
Xen-devel mailing list