This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] [SECURITY] preventing Hwaddr spoofing on bridge

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] [SECURITY] preventing Hwaddr spoofing on bridge
From: Andy Smith <andy@xxxxxxxxxxxxxx>
Date: Wed, 28 Nov 2007 12:40:47 +0000
Delivery-date: Wed, 28 Nov 2007 04:41:38 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <20071127142114.GA5072@xxxxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
Openpgp: id=BF15490B; url=http://strugglers.net/~andy/pubkey.asc
References: <474642D6.9060905@xxxxxxxxx> <20071124151225.GA18701@xxxxxxx> <4748D04E.9090802@xxxxxxxxx> <20071125014825.GA3347@xxxxxxxxxxx> <4748D580.2000406@xxxxxxxxx> <20071125075023.GE3347@xxxxxxxxxxx> <20071127142114.GA5072@xxxxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.13 (2006-08-11)

On Tue, Nov 27, 2007 at 03:21:14PM +0100, Rafał Kupka wrote:
> On Sun, Nov 25, 2007 at 07:50:23AM +0000, Andy Smith wrote:
> > I see your point.  I hadn't thought of that problem before.  I have
> > done some preliminary testing with ebtables and the following seems
> > to work:
> > 
> > ebtables -t nat -A PREROUTING -i some-vif -s ! aa:00:00:6a:38:0c 
> > --log-level debug --log-prefix 'SPOOF:' -j DROP
> > 
> > Can you still find a way to break it after using this method?
> You can still impersonate other domUs IP addresses. Rooted domUs may
> send spoofed arp replies with MAC address that belong to them.

Yes I already addressed that in my earlier reply in this thread.
The previous one was specifically about spoofing MAC address, which
I had not considered until Stefan brought it up.


Attachment: signature.asc
Description: Digital signature

Xen-users mailing list