[libvirt] Reporting of IP detected by network filter

[Laine Stump]

On 11/20/18 10:17 AM, Daniel P. Berrangé wrote:
> On Tue, Nov 20, 2018 at 04:05:43PM +0100, Marcin Mirecki wrote:
>> Hello,
>>
>> The network filters feature has an option of automatically detecting the IP
>> of a VM [1].
>> Is it possible to retrieve this IP by any means?
> It is possibly visible in the live XML in the <filterref> XML as a
> parameter.


It would be kind of cool if it did, but alas it does not. As far as I
can tell the variables/parameters in nwfilter rules are a one way street
- stuff that's set automatically by the driver are not reflected back to
the hypervisor for its dumpxml (nor to the nwfilter-bindings-dumpxml).



>> If not, would you considering adding such a feature?
> We should make it visible via the API for fetching guest IP addrs.


It would be neat, but I don't know how much info it would actually give
us (see below).


>
> The snooping code should be moved out of nwfilter and into the
> QEMU driver.


That would:


1) only work when the domain is defined in qemu:///system (emphasis on
the _system_ part), so in our future utopia where qemu:///session
domains have access to all of the same networking as qemu:///system,
this code would not work.


2) only work when the domain is defined in qemu:///system (emphasis on
the _qemu_ part), so xen, libxl, etc, would left out in the cold.


For those reasons, I think it would be better suited to
network:///system or nwfilter:///system.


Also, due to the extra overhead in having pcap examine every packet, we
don't want to ever actually setup the pcap socket for this unless there
is an nwfilter that uses it.


Finally, we should look at the trustability of this information, and
what are the cases that the info wouldn't be available from somewhere else:


1) in the case of nwfilter snooping ARP packets, the results of all of
those can be found by examining the ARP cache on the host, and there is
already a mode of virsh domifaddr that looks to the ARP cache ("virsh
ifaddr --source arp").


2) for guests that are doing DHCP on a libvirt virtual network, the
results of that are already available from "virsh domifaddr --source
leases".


3) for guests that are connected to a host bridge that's directly
connected to the physical network, and getting a DHCP address from an
external DHCP server, those results can also be seen in the ARP cache
("virsh domifaddr --source arp").


> The QEMU driver should simply update the nwfilter
> binding with the IP  once it has snooped it.
>
>> It would be very useful for uses cases where there is no guest agent.
> NB, there are potentially trust issues when using a snooped IP addr.
>
> eg if snooping DHCP responses, a malicious guest could act as a DHCP
> server  and send bogus responses.   If snooping ARPs a malicious
> guest can send gratuituous ARPs. Thus for nwfilter we tend to recommend
> setting explicit IP addrs, or using filters that block guests from
> sending bogus DHCP response


Agreed. Of course the info in the ARP cache can be poisoned with
incorrect data, but so can the results that come from snooping the tap
device for ARP packets (both of them in the same manner, actually). So
(to get back to my suggestion above) I don't think it would be lowering
security at all to use results from the ARP cache vs results from
snooping dhcp/arp packets from the tap device.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: pEpkey.asc
Type: application/pgp-keys
Size: 1757 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20181120/de979003/attachment-0001.bin>