Description of problem: Currently, vdsm only adds rules preventing MAC and ARP spoofing. These aren't however the only attack vectors available to rogue VMs. I dare say that the other similarly dangerous are at least: * rogue DHCP server * rogue IPv6 routers so RHEV should IMO add nwfilter rules disallowing these kinds of traffic by default and only allow them when they are explicitly allowed in vnic configuration. The various part of RHEV affected would be: 1. Permissions: Not everybody should be able to run dhcpd or IPv6 router 2. UI/API: in vnic properties, allow setting up these properties in vnic settings 3. backend: save settings for each VM/vnic, pass the settings to vdsm 4. vdsm: set up libvirt nwfilter filters, assign them to all vnics but those that have respective kinds of traffic allowed Version-Release number of selected component (if applicable): all up to 3.5 How reproducible: always Steps to Reproduce: 1. try to set up rogue dhcp server or IPv6 router (e.g. Windows 7 with teredo tunnels) 2. 3. Actual results: rogue dhcpd can operate by default Expected results: dhcpd can operate only when explicitly allowed in dhcp settings Additional info:
All that is now left is to define a vdsm-even-cleaner-traffic nwfilter and expose add it on Engine.
This is possible with clean traffic filter + network filters parameters.