WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xense-devel

Re: [Xen-devel] RFC: virtual network access control

To: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Subject: Re: [Xen-devel] RFC: virtual network access control
From: Reiner Sailer <sailer@xxxxxxxxxx>
Date: Fri, 28 Jul 2006 10:17:56 -0400
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx, xense-devel@xxxxxxxxxxxxxxxxxxx, Bryan D Payne <bdpayne@xxxxxxxxxx>
Delivery-date: Fri, 28 Jul 2006 07:18:25 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <d01d84aa2d4d9f0ca9cc49a1d20ed59b@xxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx

Keir Fraser <Keir.Fraser@xxxxxxxxxxxx> wrote on 07/28/2006 05:18:30 AM:

> Sounds like you want to implement a primitive firewall in netback
> simply to avoid a dependency on the existing mechanisms that Linux has.
> That doesn't sound a good tradeoff to me, and I think it's unlikely to
> fly with the kernel maintainers.


We are interested in controlling access based on the security labels of sender and receiver domains, not based on IP or other traditional firewall packet attributes.


> The only problem I can see with relying on iptables (other than
> requiring it to be installed) is that it becomes harder to configure if
> netback is in a driver domain. Possibly we need to come up with some
> xenstore<->iptables interface (e.g., run an interfacing daemon in the
> same domain as netback).


We see other problems as well: IPtables seems to not see any of the ethernet-bridged packets. If you wanted to use IPtables then you
would need to replace the ethernet bridge with routing each packet.

Reiner
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel