[Xen-API] XCP antispoofing (idea and working patch)

[George Shuklin <george.shuklin@xxxxxxxxx>]

Good day.

I like to raise a question which bother me (and not only me) long time.

How we can protect one guest form malicious actions from other guest?
One of the simplest way to break network is spoofing (usurping) some
IP/mac addresses on network by abusing ARP or (even) simply assign wrong
IP to guest machine network interface.

Classic Xen shipped with antispoofing scripts, but XCP is not.

What problem we shall solve for quality antispoofing? 

Restriction:
1) Shall be configurable (some interface must be restricted, some not)
2) must be applying on EVERY host in the pool
3) Shall be removed when VM is down or mirgrated out (do not disturb any
other VM)
4) Shall survive reboot (when dom ID and vif interface int dom0
changing)
5) Shall survive migration 
6) shall restrict both IP and mac usage.


I create some simple patch to /etc/xensource/scripts/vif (it called
every time new vif initializing or deinitializing).

It depends on openvswitch (and does not work with classic brtools),
using /etc/xensource/ip_restriction.conf with following syntax:

vif-uuid ip
(one per line), f.e.
25ca3ed1-06ea-5f58-9283-f2af3e8b373e 192.168.1.144

This file must be identical on every host in the pool.

If vif uuid is not listed it this file, it silently do nothing. If
openvswitch is not used, it silently do nothing.

If IP (right now only ipv4) is assigned to vif-uuid, that vif is
restricted to it mac (autodetected via xenstore) too.

When vif is down (vm down, migrated or rebooted) it clear all
restriction on openvswitch port right before port unplugging.

The main concern is usage of configuration file instead xapi. I think it
must be placed somewhere to vif's other config (but it far beyond my
knowledge, and I except some help with this). xapi shall place
ip_restriction to other config and copy it to xenstore for vif to be
readable from scripts/vif script.

This patch is against XCP 0.5 (not 1.0b)

Attachment: vif_ip_restriction.diff
Description: Text Data

_______________________________________________
xen-api mailing list
xen-api@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/mailman/listinfo/xen-api