[libvirt] [PATCH 3/9] add DHCP snooping support to nwfilter

[Stefan Berger]

On 05/11/2011 05:53 PM, David Stevens wrote:
>
>
> >
> > Can you run a VM and do a 'ebtables -t nat -L' and post the output.
> > I'd be curious how
> > the chains look like now with the 'clean-traffic' filter without
> > having to apply the
> > patches and test them.
>
> <two stages -- before DHCP ACK and after below>
>
> Bridge table: nat
>
> Bridge chain: PREROUTING, entries: 1, policy: ACCEPT
> -i vnet0 -j libvirt-I-vnet0
>
> Bridge chain: OUTPUT, entries: 0, policy: ACCEPT
>
> Bridge chain: POSTROUTING, entries: 1, policy: ACCEPT
> -o vnet0 -j libvirt-O-vnet0
>
> Bridge chain: libvirt-I-vnet0, entries: 9, policy: ACCEPT
> -j I-vnet0-mac
> -p IPv4 -j I-vnet0-ipv4
>
Ideally the rule '-p IPv4 -j ACCEPT' would come right after this one so 
we don't need to step across all the ARP-related ones. Primarily with 
IPv4 this would be a concern, less with ARP.

> -p ARP -j I-vnet0-arpmac
> -p ARP -j I-vnet0-arpip
>
... and if possible right here the -p ARP -j ACCEPT would follow.
>
> -p 0x8035 -j I-vnet0-rarp
> -p 0x835 -j ACCEPT
> -p IPv4 -j ACCEPT
> -p ARP -j ACCEPT
> -j DROP
>
This helps. Please post this as part of future introductions to patches.

>
> Bridge chain: libvirt-O-vnet0, entries: 5, policy: ACCEPT
> -p IPv4 -j O-vnet0-ipv4
>
Also here -p IPv4 -j ACCEPT.

    Stefan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20110511/76b48336/attachment-0001.htm>