Bug 443237
| Summary: | Xen IP antispoofing is not working when multiple antispoof ip addesses are specified | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Arturas Moskvinas <artms> | ||||
| Component: | xen | Assignee: | Michal Novotny <minovotn> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 5.2 | CC: | areis, clalance, k.georgiou, leiwang, llim, xen-maint | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | xen-3.0.3-115.el5 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2011-01-13 22:16:11 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 514498 | ||||||
| Attachments: |
|
||||||
Created attachment 433305 [details]
Fix Xen IP antispoofing for multiple antispoof IP addresses
Arturas,
I've tried this one and it's working fine. Also, thanks for your patch, it's working fine.
Michal
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0031.html |
Description of problem: Xen supports IP antispoofing using iptables. It can also support multiple ip antispoofing (several IP's for one interface, simply separated by spaces), but it is not possible to have several IPs, because of the bug in /etc/xen/scripts/vif-common.sh script. Version-Release number of selected component (if applicable): All? How reproducible: Always Steps to Reproduce: 1. Create guest domain config with this network config sample: vif = [ 'mac=some_mac, bridge=xenbr0, ip=10.X.X.X 10.X.X.Y' ] 2. Start domain 3. iptables -L Actual results: Failed iptables command is logged in /var/log/messages. iptables -L shows that there is no FORWARD rules which will let those ip to pass through. Guest domain has no net connectivity because packets are dropped by default forward rule. messages log example: Apr 19 18:21:04 somehost logger: /etc/xen/scripts/vif-bridge: iptables -A FORWARD -m physdev --physdev-in vifXX.0 -s 10.X.X.X 10.X.X.Y -j ACCEPT failed. If you are using iptables, this may affect networking for guest domains. Expected results: iptables -L should return: -A FORWARD -s 10.X.X.X -m physdev --physdev-in vifXX.0 -j ACCEPT -A FORWARD -s 10.X.X.Y -m physdev --physdev-in vifXX.0 -j ACCEPT other rules... Guest domain has connectivity, packets are not dropped by default forward rules, but accepted by rules above. Additional info: Bug in /etc/xen/scripts/vif-common.sh line 106 for addr in "$ip" do frob_iptable -s "$addr" done should be: for addr in $ip do frob_iptable -s "$addr" done