This patch adds some example filters to libvirt. They are automatically
installed into the proper directory for libvirt to pick them up.
---
Makefile.am | 3 +-
configure.ac | 3 +-
examples/xml/nwfilter/Makefile.am | 29 ++++++++++++++++++++++++++
examples/xml/nwfilter/allow-arp.xml | 3 ++
examples/xml/nwfilter/allow-dhcp-server.xml | 24 +++++++++++++++++++++
examples/xml/nwfilter/allow-dhcp.xml | 21 ++++++++++++++++++
examples/xml/nwfilter/allow-ipv4.xml | 3 ++
examples/xml/nwfilter/clean-traffic.xml | 15 +++++++++++++
examples/xml/nwfilter/no-arp-spoofing.xml | 29 ++++++++++++++++++++++++++
examples/xml/nwfilter/no-ip-multicast.xml | 9 ++++++++
examples/xml/nwfilter/no-ip-spoofing.xml | 7 ++++++
examples/xml/nwfilter/no-mac-broadcast.xml | 8 +++++++
examples/xml/nwfilter/no-mac-spoofing.xml | 5 ++++
examples/xml/nwfilter/no-other-l2-traffic.xml | 7 ++++++
14 files changed, 164 insertions(+), 2 deletions(-)
Index: libvirt-acl/Makefile.am
===================================================================
--- libvirt-acl.orig/Makefile.am
+++ libvirt-acl/Makefile.am
@@ -5,7 +5,8 @@ GENHTML = genhtml
SUBDIRS = gnulib/lib include src daemon tools proxy docs gnulib/tests \
python tests po examples/domain-events/events-c examples/hellolibvirt \
- examples/dominfo examples/domsuspend examples/python examples/apparmor
+ examples/dominfo examples/domsuspend examples/python examples/apparmor \
+ examples/xml/nwfilter
ACLOCAL_AMFLAGS = -I m4 -I gnulib/m4
Index: libvirt-acl/examples/xml/nwfilter/no-mac-spoofing.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/no-mac-spoofing.xml
@@ -0,0 +1,5 @@
+<filter name='no-mac-spoofing' chain='ipv4'>
+ <rule action='drop' direction='out' priority='10'>
+ <mac match='no' srcmacaddr='$MAC' />
+ </rule>
+</filter>
Index: libvirt-acl/configure.ac
===================================================================
--- libvirt-acl.orig/configure.ac
+++ libvirt-acl/configure.ac
@@ -1987,7 +1987,8 @@ AC_OUTPUT(Makefile src/Makefile include/
examples/domsuspend/Makefile \
examples/dominfo/Makefile \
examples/python/Makefile \
- examples/hellolibvirt/Makefile)
+ examples/hellolibvirt/Makefile \
+ examples/xml/nwfilter/Makefile)
AC_MSG_NOTICE([])
AC_MSG_NOTICE([Configuration summary])
Index: libvirt-acl/examples/xml/nwfilter/Makefile.am
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/Makefile.am
@@ -0,0 +1,30 @@
+
+FILTERS = \
+ allow-arp.xml \
+ allow-dhcp-server.xml \
+ allow-dhcp.xml \
+ allow-incoming-ipv4.xml \
+ allow-ipv4.xml \
+ clean-traffic.xml \
+ no-arp-spoofing.xml \
+ no-ip-multicast.xml \
+ no-ip-spoofing.xml \
+ no-mac-broadcast.xml \
+ no-mac-spoofing.xml \
+ no-other-l2-traffic.xml
+
+confdir = $(sysconfdir)/libvirt
+
+NWFILTER_DIR = "$(DESTDIR)$(sysconfdir)/libvirt/nwfilter"
+
+install-data-local:
+ $(MKDIR_P) "$(NWFILTER_DIR)"
+ for f in $(FILTERS); do \
+ $(INSTALL_DATA) $$f "$(NWFILTER_DIR)"; \
+ done
+
+uninstall-local::
+ for f in $(FILTERS); do \
+ rm -f "$(NWFILTER_DIR)/$$f"; \
+ done
+ -test -z $(shell ls $(NWFILTER_DIR)) || rmdir $(NWFILTER_DIR)
Index: libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/no-arp-spoofing.xml
@@ -0,0 +1,29 @@
+<filter name='no-arp-spoofing' chain='arp'>
+ <uuid>f88f1932-debf-4aa1-9fbe-f10d3aa4bc95</uuid>
+
+ <!-- no arp spoofing -->
+ <!-- drop if ipaddr or macaddr does not belong to guest -->
+ <rule action='drop' direction='out' priority='400' >
+ <arp match='no' arpsrcmacaddr='$MAC'/>
+ </rule>
+ <rule action='drop' direction='out' priority='400' >
+ <arp match='no' arpsrcipaddr='$IP' />
+ </rule>
+ <!-- drop if ipaddr or macaddr odes not belong to guest -->
+ <rule action='drop' direction='in' priority='400' >
+ <arp match='no' arpdstmacaddr='$MAC'/>
+ <arp opcode='reply'/>
+ </rule>
+ <rule action='drop' direction='in' priority='400' >
+ <arp match='no' arpdstipaddr='$IP' />
+ </rule>
+ <!-- accept only request or reply packets -->
+ <rule action='accept' direction='inout' priority='500' >
+ <arp opcode='request'/>
+ </rule>
+ <rule action='accept' direction='inout' priority='500' >
+ <arp opcode='reply'/>
+ </rule>
+ <!-- drop everything else -->
+ <rule action='drop' direction='inout' priority='1000' />
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/no-mac-broadcast.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/no-mac-broadcast.xml
@@ -0,0 +1,8 @@
+<filter name='no-mac-broadcast' chain='ipv4'>
+ <!-- drop if destination mac is bcast mac addr. -->
+ <rule action='drop' direction='out'>
+ <mac dstmacaddr='ff:ff:ff:ff:ff:ff' />
+ </rule>
+
+ <!-- not doing anything with receiving side ... -->
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/no-ip-multicast.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/no-ip-multicast.xml
@@ -0,0 +1,9 @@
+<filter name='no-ip-multicast' chain='ipv4'>
+
+ <!-- drop if destination IP address is in the 224.0.0.0/4 subnet -->
+ <rule action='drop' direction='out'>
+ <ip dstipaddr='224.0.0.0' dstipmask='4' />
+ </rule>
+
+ <!-- not doing anything with receiving side ... -->
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/no-ip-spoofing.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/no-ip-spoofing.xml
@@ -0,0 +1,7 @@
+<filter name='no-ip-spoofing' chain='ipv4'>
+
+ <!-- drop if srcipaddr is not the IP address of the guest -->
+ <rule action='drop' direction='out'>
+ <ip match='no' srcipaddr='$IP' />
+ </rule>
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/allow-arp.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/allow-arp.xml
@@ -0,0 +1,3 @@
+<filter name='allow-arp' chain='arp'>
+ <rule direction='inout' action='accept'/>
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/allow-ipv4.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/allow-ipv4.xml
@@ -0,0 +1,3 @@
+<filter name='allow-ipv4' chain='ipv4'>
+ <rule direction='inout' action='accept'/>
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/allow-dhcp-server.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/allow-dhcp-server.xml
@@ -0,0 +1,24 @@
+<filter name='allow-dhcp-server' chain='ipv4'>
+
+ <!-- accept outgoing DHCP requests -->
+ <!-- note, this rule must be evaluated before general MAC broadcast
+ traffic is discarded since DHCP requests use MAC broadcast -->
+ <rule action='accept' direction='out' priority='100'>
+ <ip srcipaddr='0.0.0.0'
+ dstipaddr='255.255.255.255'
+ protocol='udp'
+ srcportstart='68'
+ dstportstart='67' />
+ </rule>
+
+ <!-- accept incoming DHCP responses from a specific DHCP server
+ parameter DHPCSERVER needs to be passed from where this filter is
+ referenced -->
+ <rule action='accept' direction='in' priority='100' >
+ <ip srcipaddr='$DHCPSERVER'
+ protocol='udp'
+ srcportstart='67'
+ dstportstart='68'/>
+ </rule>
+
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/no-other-l2-traffic.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/no-other-l2-traffic.xml
@@ -0,0 +1,7 @@
+<filter name='no-other-l2-traffic'>
+
+ <!-- drop all other l2 traffic than for which rules have been
+ written for; i.e., drop all other than arp and ipv4 traffic -->
+ <rule action='drop' direction='inout' priority='1000'/>
+
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/allow-dhcp.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/allow-dhcp.xml
@@ -0,0 +1,21 @@
+<filter name='allow-dhcp' chain='ipv4'>
+
+ <!-- accept outgoing DHCP requests -->
+ <!-- not, this rule must be evaluated before general MAC broadcast
+ traffic is discarded since DHCP requests use MAC broadcast -->
+ <rule action='accept' direction='out' priority='100'>
+ <ip srcipaddr='0.0.0.0'
+ dstipaddr='255.255.255.255'
+ protocol='udp'
+ srcportstart='68'
+ dstportstart='67' />
+ </rule>
+
+ <!-- accept incoming DHCP responses from any DHCP server -->
+ <rule action='accept' direction='in' priority='100' >
+ <ip protocol='udp'
+ srcportstart='67'
+ dstportstart='68'/>
+ </rule>
+
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/clean-traffic.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/clean-traffic.xml
@@ -0,0 +1,17 @@
+<filter name='clean-traffic'>
+ <!-- An example of a traffic filter enforcing clean traffic
+ from a VM by
+ - preventing MAC spoofing -->
+ <filterref filter='no-mac-spoofing'/>
+
+ <!-- preventing IP spoofing on outgoing, allow all IPv4 in incoming -->
+ <filterref filter='no-ip-spoofing'/>
+ <filterref filter='allow-incoming-ipv4'/>
+
+ <!-- preventing ARP spoofing/poisoning -->
+ <filterref filter='no-arp-spoofing'/>
+
+ <!-- preventing any other traffic than IPv4 and ARP -->
+ <filterref filter='no-other-l2-traffic'/>
+
+</filter>
Index: libvirt-acl/examples/xml/nwfilter/allow-incoming-ipv4.xml
===================================================================
--- /dev/null
+++ libvirt-acl/examples/xml/nwfilter/allow-incoming-ipv4.xml
@@ -0,0 +1,3 @@
+<filter name='allow-incoming-ipv4' chain='ipv4'>
+ <rule direction='in' action='accept'/>
+</filter>
--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
