Skip to content

Commit 5e0aa25

Browse files
weizhouapacheweizhouapache
committed
KVM: enable no-mac-spoofing on virtual nics
Refer to https://libvirt.org/firewall.html#the-network-filter-driver https://libvirt.org/formatnwfilter.html#concepts
1 parent 8ff2c01 commit 5e0aa25

File tree

3 files changed

+15
-0
lines changed

3 files changed

+15
-0
lines changed

‎plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1597,6 +1597,7 @@ public String getContent() {
15971597
}
15981598
if (_macAddr != null) {
15991599
netBuilder.append("<mac address='" + _macAddr + "'/>\n");
1600+
netBuilder.append("<filterref filter='no-mac-spoofing'/>\n");
16001601
}
16011602
if (_model != null) {
16021603
netBuilder.append("<model type='" + _model + "'/>\n");

‎plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDefTest.java

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ public void testInterfaceTypeUserWithNetwork() {
5454

5555
String expected = "<interface type='user'>\n" +
5656
"<mac address='00:11:22:aa:bb:dd'/>\n" +
57+
"<filterref filter='no-mac-spoofing'/>\n" +
5758
"<model type='virtio'/>\n" +
5859
"<ip family='ipv4' address='192.168.100.0' prefix='24'/>\n" +
5960
"</interface>\n";
@@ -68,6 +69,7 @@ public void testInterfaceTypeUserWithoutNetwork() {
6869

6970
String expected = "<interface type='user'>\n" +
7071
"<mac address='00:11:22:aa:bb:dd'/>\n" +
72+
"<filterref filter='no-mac-spoofing'/>\n" +
7173
"<model type='virtio'/>\n" +
7274
"</interface>\n";
7375

@@ -83,6 +85,7 @@ public void testInterfaceEthernet() {
8385
"<interface type='ethernet'>\n"
8486
+ "<target dev='targetDeviceName'/>\n"
8587
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
88+
+ "<filterref filter='no-mac-spoofing'/>\n"
8689
+ "<model type='virtio'/>\n"
8790
+ "<link state='up'/>\n"
8891
+ "</interface>\n";
@@ -99,6 +102,7 @@ public void testInterfaceDirectNet() {
99102
"<interface type='" + LibvirtVMDef.InterfaceDef.GuestNetType.DIRECT + "'>\n"
100103
+ "<source dev='targetDeviceName' mode='private'/>\n"
101104
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
105+
+ "<filterref filter='no-mac-spoofing'/>\n"
102106
+ "<model type='virtio'/>\n"
103107
+ "<link state='up'/>\n"
104108
+ "</interface>\n";
@@ -116,6 +120,7 @@ public void testInterfaceBridgeSlot() {
116120
"<interface type='" + LibvirtVMDef.InterfaceDef.GuestNetType.BRIDGE + "'>\n"
117121
+ "<source bridge='targetDeviceName'/>\n"
118122
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
123+
+ "<filterref filter='no-mac-spoofing'/>\n"
119124
+ "<model type='virtio'/>\n"
120125
+ "<link state='up'/>\n"
121126
+ "<address type='pci' domain='0x0000' bus='0x00' slot='0x10' function='0x0'/>\n"
@@ -131,6 +136,7 @@ public void testInterfaceBridgeSlot() {
131136
+ "<source bridge='targetDeviceName'/>\n"
132137
+ "<target dev='vnet11'/>\n"
133138
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
139+
+ "<filterref filter='no-mac-spoofing'/>\n"
134140
+ "<model type='virtio'/>\n"
135141
+ "<link state='down'/>\n"
136142
+ "<address type='pci' domain='0x0000' bus='0x00' slot='0x10' function='0x0'/>\n"
@@ -152,6 +158,7 @@ public void testInterfaceWithMultiQueueAndPacked() {
152158
"<interface type='" + LibvirtVMDef.InterfaceDef.GuestNetType.BRIDGE + "'>\n"
153159
+ "<source bridge='targetDeviceName'/>\n"
154160
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
161+
+ "<filterref filter='no-mac-spoofing'/>\n"
155162
+ "<model type='virtio'/>\n"
156163
+ "<driver queues='6'/>\n"
157164
+ "<link state='up'/>\n"
@@ -163,6 +170,7 @@ public void testInterfaceWithMultiQueueAndPacked() {
163170
"<interface type='" + LibvirtVMDef.InterfaceDef.GuestNetType.BRIDGE + "'>\n"
164171
+ "<source bridge='targetDeviceName'/>\n"
165172
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
173+
+ "<filterref filter='no-mac-spoofing'/>\n"
166174
+ "<model type='virtio'/>\n"
167175
+ "<driver queues='6' packed='on'/>\n"
168176
+ "<link state='up'/>\n"
@@ -174,6 +182,7 @@ public void testInterfaceWithMultiQueueAndPacked() {
174182
"<interface type='" + LibvirtVMDef.InterfaceDef.GuestNetType.BRIDGE + "'>\n"
175183
+ "<source bridge='targetDeviceName'/>\n"
176184
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
185+
+ "<filterref filter='no-mac-spoofing'/>\n"
177186
+ "<model type='virtio'/>\n"
178187
+ "<driver packed='on'/>\n"
179188
+ "<link state='up'/>\n"
@@ -185,6 +194,7 @@ public void testInterfaceWithMultiQueueAndPacked() {
185194
"<interface type='" + LibvirtVMDef.InterfaceDef.GuestNetType.BRIDGE + "'>\n"
186195
+ "<source bridge='targetDeviceName'/>\n"
187196
+ "<mac address='00:11:22:aa:bb:dd'/>\n"
197+
+ "<filterref filter='no-mac-spoofing'/>\n"
188198
+ "<model type='virtio'/>\n"
189199
+ "<link state='up'/>\n"
190200
+ "</interface>\n";

‎plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtReplugNicCommandWrapperTest.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ public class LibvirtReplugNicCommandWrapperTest {
134134
private static final String part_2 =
135135
" <interface type='bridge'>\n"
136136
+ " <mac address='02:00:7c:98:00:02'/>\n"
137+
+ " <filterref filter='no-mac-spoofing'/>\n"
137138
+ " <source bridge='breth2-234'/>\n"
138139
+ " <bandwidth>\n"
139140
+ " <inbound average='25600' peak='25600'/>\n"
@@ -247,6 +248,7 @@ public void testReplugNic() throws LibvirtException {
247248
+ "<source bridge='breth2-234'/>\n"
248249
+ "<target dev='vnet10'/>\n"
249250
+ "<mac address='02:00:7c:98:00:02'/>\n"
251+
+ "<filterref filter='no-mac-spoofing'/>\n"
250252
+ "<model type='virtio'/>\n"
251253
+ "<bandwidth>\n"
252254
+ "<inbound average='25600' peak='25600'/>\n"
@@ -259,6 +261,7 @@ public void testReplugNic() throws LibvirtException {
259261
+ "<source bridge='eth0'/>\n"
260262
+ "<target dev='vnet10'/>\n"
261263
+ "<mac address='02:00:7c:98:00:02'/>\n"
264+
+ "<filterref filter='no-mac-spoofing'/>\n"
262265
+ "<model type='virtio'/>\n"
263266
+ "<virtualport type='openvswitch'>\n"
264267
+ "</virtualport>\n"
@@ -273,6 +276,7 @@ public void testReplugNic() throws LibvirtException {
273276
+ "<source bridge='eth0'/>\n"
274277
+ "<target dev='vnet10'/>\n"
275278
+ "<mac address='02:00:7c:98:00:02'/>\n"
279+
+ "<filterref filter='no-mac-spoofing'/>\n"
276280
+ "<model type='virtio'/>\n"
277281
+ "<virtualport type='openvswitch'>\n"
278282
+ "</virtualport>\n"

0 commit comments

Comments
 (0)