enforcing ACM policy on network traffic between virtual network interfaces
RFC PATCH 1/1 enforcing ACM policy on network traffic between virtual network interfaces
This patch adds an ACM hook into the network scripts (/etc/xen/scripts). It adds iptables rules that enforce mandatory access control on network packets exchanged between virtual interfaces. If ACM is active, this patch sets the default FORWARD policy in Dom0 to DROP and adds iptables ACCEPT rules between vifs that belong to domains that are permitted to share (determined by using the get_decision ACM hypervisor call). If ACM is not active, this patch is transparent to the operation of networking in Xen.
This topic was discussed here <http://lists.xensource.com/archives/html/xen-devel/2006-07/msg01005.html> as were the implications. For example, the recent suggestion to move packets directly between physical and virtual interfaces to avoid running through the bridge <http://lists.xensource.com/archives/html/xen-devel/2006-08/msg01583.html>, would, if implemented, bypass this access control unless those new mechanisms call the netfilter hooks that are called by the bridge.
Attached are examples for iptables rulesets in bridging, routing, nat-ing network setups. Also attached the patch.
Please note that many iptables rules shown below could be collapsed if we assumed that all domains are permitted to talk to Domain0, i.e., all vifX.Y can communicate to vif0.Y. In this case, we can just add two rules saying in/out traffic through vif0.Y is always ACCEPTed. This patch does currently not leverage this simplification because we anticipate that Domain0 will become less powerful than it is today.
Comments welcome.
Thanks
Reiner
The following show examples of routes related to running domains. The policy is setup so that domains 1,4, and 5 are permitted to communicate among each other and all domains can communicate with Domain0. ACM enforcement-related iptables rules are moved into the FORWARD chain; any antispoof rules go into the INPUT chain.
Example with 1 bridge and 5 domains:
==========================
[root@941e-4 ~]# ip
Chain FORWARD (policy DROP 13 packets, 4302 bytes)
pkts bytes target prot opt in out source destination 5329 445K ACCEPT all -- any any anywhere anywhere PHYSDEV match --physdev-in peth0 1593 272K ACCEPT all -- any any anywhere anywhere PHYSDEV match --physdev-out peth0
2 1152 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif1.0 --physdev-out vif0.0
178 18153 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif0.0 --physdev-out vif1.0
2 1152 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif2.0 --physdev-out vif0.0
142 15519 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif0.0 --physdev-out vif2.0
2 1152 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif3.0 --physdev-out vif0.0
98 12646 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif0.0 --physdev-out vif3.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif4.0 --physdev-out vif0.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif0.0 --physdev-out vif4.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif4.0 --physdev-out vif1.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif1.0 --physdev-out vif4.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif5.0 --physdev-out vif0.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif0.0 --physdev-out vif5.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif5.0 --physdev-out vif1.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif1.0 --physdev-out vif5.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif5.0 --physdev-out vif4.0
0 0 ACCEPT all -- any any anywhere
anywhere PHYSDEV match --physdev-in vif4.0 --physdev-out vif5.0
Chain INPUT (policy ACCEPT 3343 packets, 312K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1595 packets, 269K bytes)
pkts bytes target prot opt in out source destination
[root@941e-4 ~]# xm list --label
Name ID Mem(MiB) VCPUs State Time(s) Label domain1 1 164 1 -b---- 6.5 Avis domain4 4 164 1 -b---- 6.6 Avis domain5 5 164 1 -b---- 6.5 Avis domain3 3 164 1 -b---- 6.6 CocaCola domain2 2 164 1 -b---- 6.4 Hertz
Domain-0 0 1948 4 r----- 218.4 SystemManagement
Example for Nat:
============
[root@941e-4 ~]# iptables -L -v
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- eth0 any anywhere anywhere 0 0 ACCEPT all -- any eth0 anywhere anywhere 0 0 ACCEPT all -- vif4.0 vif1.0 anywhere anywhere 0 0 ACCEPT all -- vif1.0 vif4.0 anywhere anywhere 0 0 ACCEPT all -- vif5.0 vif1.0 anywhere anywhere 0 0 ACCEPT all -- vif1.0 vif5.0 anywhere anywhere 0 0 ACCEPT all -- vif5.0 vif4.0 anywhere anywhere 0 0 ACCEPT all -- vif4.0 vif5.0 anywhere anywhere
Chain INPUT (policy ACCEPT 37165 packets, 4945K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 11709 packets, 7277K bytes)
pkts bytes target prot opt in out source destination
[root@941e-4 ~]# xm list --label
Name ID Mem(MiB) VCPUs State Time(s) Label domain1 1 164 1 -b---- 0.3 Avis domain4 4 164 1 -b---- 0.3 Avis domain5 5 164 1 -b---- 0.3 Avis domain3 3 164 1 -b---- 0.3 CocaCola domain2 2 164 1 -b---- 0.3 Hertz
Domain-0 0 1948 4 r----- 319.9 SystemManagement
Example for Route (w/antispoof)
=======================
[root@941e-4 route]# ip
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- eth0 any anywhere anywhere 0 0 ACCEPT all -- any eth0 anywhere anywhere 0 0 ACCEPT all -- vif2.0 vif1.0 anywhere anywhere 0 0 ACCEPT all -- vif1.0 vif2.0 anywhere anywhere
Chain INPUT (policy DROP 48 packets, 2880 bytes)
pkts bytes target prot opt in out source destination
17099 2070K ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- vif1.0 *
9.2.15.138 0.0.0.0/0
0 0 ACCEPT all -- vif2.0 *
9.2.15.142 0.0.0.0/0
0 0 ACCEPT all -- vif3.0 *
9.2.15.139 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 6792 packets, 3717K bytes)
pkts bytes target prot opt in out source destination
[root@941e-4 route]# xm list --label
Name ID Mem(MiB) VCPUs State Time(s) Label domain1 1 164 1 -b---- 6.3 Avis domain4 2 164 1 -b---- 0.3 Avis domain2 3 164 1 -b---- 0.3 Hertz
Domain-0 0 1948 4 r----- 236.2 SystemManagement
Signed-off by: Reiner Sailer <[email protected]>
--- tools/examples/Makefile | 1 tools/examples/network-bridge | 11 + tools/examples/network-nat | 2 tools/examples/network-route | 40 ++++++ tools/examples/vif-acm-hook | 259 ++++++++++++++++++++++++++++++++++++++++++ tools/examples/vif-bridge | 2 tools/examples/vif-common.sh | 12 + tools/examples/vif-nat | 2 tools/examples/vif-route | 2 9 files changed, 325 insertions(+), 6 deletions(-)
tools/examples/Makefile +1 -0
@@ -32,6 +32,7 @@ XEN_SCRIPTS += blktap XEN_SCRIPTS += vtpm vtpm-delete XEN_SCRIPTS += xen-hotplug-cleanup XEN_SCRIPTS += external-device-migrate +XEN_SCRIPTS += vif-acm-hook XEN_SCRIPT_DATA = xen-script-common.sh locking.sh logging.sh XEN_SCRIPT_DATA += xen-hotplug-common.sh xen-network-common.sh vif-common.sh XEN_SCRIPT_DATA += block-common.sh vtpm-common.sh vtpm-hotplug-common.sh
tools/examples/network-bridge +9 -2
@@ -229,8 +229,13 @@ using loopback.nloopbacks=<N> on the dom transfer_routes ${netdev} ${bridge} fi - if [ ${antispoof} = 'yes' ] ; then - antispoofing + if [ `/etc/xen/scripts/vif-acm-hook "acm_on?"` != "OFF" ] ; then + echo /etc/xen/scripts/vif-acm-hook "network-bridge-up" "$pdev" "${antispoof:-no}" + /etc/xen/scripts/vif-acm-hook "network-bridge-up" "$pdev" "${antispoof:-no}" + else + if [ ${antispoof} = 'yes' ] ; then + antispoofing + fi fi }
@@ -267,6 +272,8 @@ op_stop () { ip link set ${bridge} down fi brctl delbr ${bridge} + + /etc/xen/scripts/vif-acm-hook "network-bridge-down" "$pdev" "${antispoof:-no}" } # adds $dev to $bridge but waits for $dev to be in running state first
tools/examples/network-nat +2 -0
@@ -71,12 +71,14 @@ op_start() { echo 1 >/proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o ${netdev} -j MASQUERADE [ "$dhcp" != 'no' ] && dhcp_start + /etc/xen/scripts/vif-acm-hook "network-nat-up" "$netdev" "${antispoof:-no}" } op_stop() { [ "$dhcp" != 'no' ] && dhcp_stop iptables -t nat -D POSTROUTING -o ${netdev} -j MASQUERADE + /etc/xen/scripts/vif-acm-hook "network-nat-down" "$netdev" "${antispoof:-no}" }
tools/examples/network-route +39 -1
@@ -16,4 +16,42 @@ # #============================================================================ -echo 1 >/proc/sys/net/ipv4/ip_forward + +dir=$(dirname "$0") +. "$dir/xen-script-common.sh" +. "$dir/xen-network-common.sh" + +findCommand "$@" +evalVariables "$@" + +show_status() { + echo '============================================================' + ifconfig + echo ' ' + ip route list + echo ' ' + route -n + echo '============================================================' + +} + +case "$command" in + start) + echo 1 >/proc/sys/net/ipv4/ip_forward + /etc/xen/scripts/vif-acm-hook "network-route-up" "${netdev:-eth0}" "${antispoof:-yes}" + ;; + + stop) + echo 0 >/proc/sys/net/ipv4/ip_forward + /etc/xen/scripts/vif-acm-hook "network-route-down" "${netdev:-eth0}" "${antispoof:-yes}" + ;; + + status) + show_status + ;; + + *) + echo "Unknown command: $command" >&2 + echo 'Valid commands are: start, stop, status' >&2 + exit 1 +esac
tools/examples/vif-acm-hook new file +259 -0
259 lines not on this page · raw message
tools/examples/vif-bridge +1 -1
@@ -58,7 +58,7 @@ case "$command" in ;; esac -handle_iptable +generic_handle_iptable "bridge" log debug "Successful vif-bridge $command for $vif, bridge $bridge." if [ "$command" == "online" ]
tools/examples/vif-common.sh +12 -0
@@ -116,6 +116,18 @@ function handle_iptable() fi } +function generic_handle_iptable() +{ + if [ $1 == "route" ] ; then + antispoof=${antispoof:-yes} + fi + + if [ `/etc/xen/scripts/vif-acm-hook "acm_on?"` != "OFF" ] ; then + /etc/xen/scripts/vif-acm-hook "$command" "$vif" "${antispoof:-no}" "${1:-illegal}" "$ip" + else + handle_iptable + fi +} ## # ip_of interface
tools/examples/vif-nat +1 -1
@@ -149,7 +149,7 @@ case "$command" in esac -handle_iptable +generic_handle_iptable "nat" log debug "Successful vif-nat $command for $vif." if [ "$command" == "online" ]
tools/examples/vif-route +1 -1
@@ -47,7 +47,7 @@ if [ "${ip}" ] ; then done fi -handle_iptable +generic_handle_iptable "route" log debug "Successful vif-route $command for $vif." if [ "$command" == "online" ]
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel