[libvirt-users] macvtap direct and ip spoofing

[Laine Stump]

On 11/19/2013 11:00 AM, vlad halilov wrote:
> Hi there. I have configured kvm domain (rhel6.4) with ethernet bridged
> over macvtap, and found no filtration applied except mac. 'virsh' just
> silently ignoring attributes 'filterref' and 'ip address' in different
> formats. No error on validate stage. Config examples:
>
> ...
>     <interface type='direct'>
>       <mac address='52:54:00:31:ae:1a'/>
>       <source dev='em1' mode='private'/>
>
> <filterref filter='clean-traffic'>
> <parameter name='IP' value='10.1.101.44'/>
> </filterref>
>
>       <model type='virtio'/>
>       <address type='pci' domain='0x0000' bus='0x00' slot='0x03'
> function='0x0'/>
>     </interface>
> ...
>
> or like these:
>
> ...
>     <interface type='direct'>
>       <mac address='52:54:00:31:ae:1a'/>
>       <source dev='em1' mode='private'/>
>       <ip address='10.1.101.44'/>
>       <filterref filter='clean-traffic'/>
>       <model type='virtio'/>
>       <address type='pci' domain='0x0000' bus='0x00' slot='0x03'
> function='0x0'/>
>     </interface>
> ...
>
> With 'virsh create domain.xml',  vm created, but dumpxml show that
> filterref is disappeared. 
> I have not found any success stories with filtering rules and 'direct' interface types.
>  Is it supported with this type? Or may be other tricks to protect network from vm spoofing
>  and direct type?
>

The kernel macvtap packet processing bypasses both iptables and
ebtables, so libvirt's filters are ineffective for guest interfaces
using a macvtap connection.