From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gerd Hoffmann Subject: Re: RFC: virtual network access control Date: Fri, 28 Jul 2006 17:13:07 +0200 Message-ID: <44CA2983.3030602@suse.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Reiner Sailer Cc: xen-devel@lists.xensource.com, xense-devel@lists.xensource.com, Bryan D Payne List-Id: xen-devel@lists.xenproject.org Reiner Sailer wrote: > We are interested in controlling access based on the security labels of > sender and receiver domains, not based on IP or other traditional > firewall packet attributes. > > We see other problems as well: IPtables seems to not see any of the > ethernet-bridged packets. If you wanted to use IPtables then you > would need to replace the ethernet bridge with routing each packet. You want CONFIG_BRIDGE_NETFILTER=y, this makes iptabes see bridged packets. Additionally you need CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y, that allows matching on the physical device name for bridged packets. That way you can filter by domain (because each domain has its own virtual bridge port) instead of ip/mac address. cheers, Gerd -- Gerd Hoffmann http://www.suse.de/~kraxel/julika-dora.jpeg