RE: [Xen-devel] [patch 5/5] xen: net features

["Ian Pratt" <m+Ian.Pratt@xxxxxxxxxxxx>]

> > I can't see why making the frontend MAC readonly can really be done
> > securely within the domain.
> 
> Well, if you have module support enabled in the kernel, or some way
> that lets root write to random (domain) memory, then it's not really
> secure, although i think it's still a nice to have. Otherwise i would
> think it should be reasonably secure?

You need root access to change the mac normally, and its trivial for
root to change it under your scheme -- running sed on /dev/mem would do
it...

Enforcing the frontend's MAC address really needs to be done in the
backend, or using ebtables rules in the bridge. Anything else just gives
a false sense of security.
 
> > > (2) the addition of some xen-specific sysfs attributes
> > > on front/back vifs, 
> > 
> > What attributes?
> 
> Backend:
> - xen/fe.domain: frontend domain name
> - xen/fe.initial_address: initial frontend interface mac address
> - xen/fe.mac_mode: mac mode of the frontend interface (r/w)
> - xen/be.mac_mode: mac mode of the backend interface (r/w)
> 
> Frontend:
> - xen/mac_mode: mac mode of the interface

What's the naming convention for multiple fe/bs's.
I can see some point having the be enforce the MAC, and possibly in
having the enforcement address being configurable via sysfs. I'm not a
big fan of this section of the patch, though.

> > > (3) an option to set several vif defaults in a domain
> > > config file, for ease of use when creating multiple vifs.
> > Please give an example.
> 
>  vif_defaults = 'be_ext_sysfs=yes,ext_sysfs=yes,backend=eos'
>  
>  vif = [
>    'mac=aa:00:00:01:00:00,backend=0',
>    'mac=aa:00:00:01:01:00,be_mac=fe:ff:ff:01:01:ff',
>    'mac=aa:00:00:01:02:00,be_mac=fe:ff:ff:01:02:ff'
>  ]

Without the sysfs stuff this hunk looks less useful :-)

What do other people think?

Ian


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel