[libvirt] [PATCH V9 0/6] Add DHCP snooping support to nwfilter

Stefan Berger stefanb at linux.vnet.ibm.com
Fri Apr 13 15:09:32 UTC 2012


This series of patches adds DHCP snooping support to libvirt's
nwfilter subsystem.

DHCP snooping detects DHCP leases obtained by a VM and automatically
adjusts the network traffic filters to reflect the IP addresses
with which a VM may send its traffic, thus for example preventing
IP address spoofing.
Once leases on IP addresses expire or if a VM gives up on a
lease on an IP address, the filters are also adjusted.
All leases are persisted and automatically applied upon a VM's restart.
Leases are associated with the tuple of VM-UUID and interface MAC
address.

The following interface XML activates and uses the DHCP snooping:

    <interface type='bridge'>
      <source bridge='virbr0'/>
      <filterref filter='clean-traffic'>
        <parameter name='ip_learning' value='dhcp'/>
      </filterref>
    </interface>


Regards,
   David and Stefan




More information about the libvir-list mailing list