forked from libvirt/libvirt
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathformatnwfilter.html.in
2436 lines (2350 loc) · 84.7 KB
/
formatnwfilter.html.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<body>
<h1>Network Filters</h1>
<ul id="toc">
</ul>
<p>
This page provides an introduction to libvirt's network filters,
their goals, concepts and XML format.
</p>
<h2><a name="goals">Goals and background</a></h2>
<p>
The goal of the network filtering XML is to enable administrators
of a virtualized system to configure and enforce network traffic
filtering rules on virtual
machines and manage the parameters of network traffic that
virtual machines
are allowed to send or receive.
The network traffic filtering rules are
applied on the host when a virtual machine is started. Since the
filtering rules
cannot be circumvented from within
the virtual machine, it makes them mandatory from the point of
view of a virtual machine user.
<br/><br/>
The network filter subsystem allows each virtual machine's network
traffic filtering rules to be configured individually on a per
interface basis. The rules are
applied on the host when the virtual machine is started and can be modified
while the virtual machine is running. The latter can be achieved by
modifying the XML description of a network filter.
<br/><br/>
Multiple virtual machines can make use of the same generic network filter.
When such a filter is modified, the network traffic filtering rules
of all running virtual machines that reference this filter are updated.
<br/><br/>
Network filtering support is available <span class="since">since 0.8.1
(Qemu, KVM)</span>
</p>
<h2><a name="nwfconcepts">Concepts</a></h2>
<p>
The network traffic filtering subsystem enables configuration
of network traffic filtering rules on individual network
interfaces that are configured for certain types of
network configurations. Supported network types are
</p>
<ul>
<li><code>network</code></li>
<li><code>ethernet</code> -- must be used in bridging mode</li>
<li><code>bridge</code></li>
</ul>
<p>
The interface XML is used to reference a top-level filter. In the
following example, the interface description references
the filter <code>clean-traffic</code>.
</p>
<pre>
...
<devices>
<interface type='bridge'>
<mac address='00:16:3e:5d:c7:9e'/>
<filterref filter='clean-traffic'/>
</interface>
</devices>
...</pre>
<p>
Network filters are written in XML and may either contain references
to other filters, contain rules for traffic filtering, or
hold a combination of both. The above referenced filter
<code>clean-traffic </code> is a filter that only contains references to
other filters and no actual filtering rules. Since references to
other filters can be used, a <i>tree</i> of filters can be built.
The <code>clean-traffic</code> filter can be viewed using the
command <code>virsh nwfilter-dumpxml clean-traffic</code>.
<br/><br/>
As previously mentioned, a single network filter can be referenced
by multiple virtual machines. Since interfaces will typically
have individual parameters associated with their respective traffic
filtering rules, the rules described in a filter XML can
be parameterized with variables. In this case, the variable name
is used in the filter XML and the name and value are provided at the
place where the filter is referenced. In the
following example, the interface description has been extended with
the parameter <code>IP</code> and a dotted IP address as value.
</p>
<pre>
...
<devices>
<interface type='bridge'>
<mac address='00:16:3e:5d:c7:9e'/>
<filterref filter='clean-traffic'>
<parameter name='IP' value='10.0.0.1'/>
</filterref>
</interface>
</devices>
...</pre>
<p>
In this particular example, the <code>clean-traffic</code> network
traffic filter will be instantiated with the IP address parameter
10.0.0.1 and enforce that the traffic from this interface will
always be using 10.0.0.1 as the source IP address, which is
one of the purposes of this particular filter.
<br/><br/>
</p>
<h3><a name="nwfconceptschains">Filtering chains</a></h3>
<p>
Filtering rules are organized in filter chains. These chains can be
thought of as having a tree structure with packet
filtering rules as entries in individual chains (branches). <br/>
Packets start their filter evaluation in the <code>root</code> chain
and can then continue their evaluation in other chains, return from
those chains back into the <code>root</code> chain or be
dropped or accepted by a filtering rule in one of the traversed chains.
<br/>
Libvirt's network filtering system automatically creates individual
<code>root</code> chains for every virtual machine's network interface
on which the user chooses to activate traffic filtering.
The user may write filtering rules that are either directly instantiated
in the <code>root</code> chain or may create protocol-specific
filtering chains for efficient evaluation of protocol-specific rules.
The following chains exist:
</p>
<ul>
<li>root</li>
<li>mac <span class="since">(since 0.9.8)</span></li>
<li>stp (spanning tree protocol)
<span class="since">(since 0.9.8)</span></li>
<li>vlan (802.1Q) <span class="since">(since 0.9.8)</span></li>
<li>arp, rarp</li>
<li>ipv4</li>
<li>ipv6</li>
</ul>
<p>
<span class="since">Since 0.9.8</span> multiple chains evaluating the
<code>mac</code>, <code>stp</code>, <code>vlan</code>,
<code>arp</code>, <code>rarp</code>, <code>ipv4</code>, or
<code>ipv6</code> protocol can be created using
the protocol name only as a prefix in the chain's name. This for
examples allows chains with names <code>arp-xyz</code> or
<code>arp-test</code> to be specified and have ARP protocol packets
evaluated in those chains.
<br/><br/>
The following filter shows an example of filtering ARP traffic
in the <code>arp</code> chain.
</p>
<pre>
<filter name='no-arp-spoofing' chain='arp' priority='-500'>
<uuid>f88f1932-debf-4aa1-9fbe-f10d3aa4bc95</uuid>
<rule action='drop' direction='out' priority='300'>
<mac match='no' srcmacaddr='$MAC'/>
</rule>
<rule action='drop' direction='out' priority='350'>
<arp match='no' arpsrcmacaddr='$MAC'/>
</rule>
<rule action='drop' direction='out' priority='400'>
<arp match='no' arpsrcipaddr='$IP'/>
</rule>
<rule action='drop' direction='in' priority='450'>
<arp opcode='Reply'/>
<arp match='no' arpdstmacaddr='$MAC'/>
</rule>
<rule action='drop' direction='in' priority='500'>
<arp match='no' arpdstipaddr='$IP'/>
</rule>
<rule action='accept' direction='inout' priority='600'>
<arp opcode='Request'/>
</rule>
<rule action='accept' direction='inout' priority='650'>
<arp opcode='Reply'/>
</rule>
<rule action='drop' direction='inout' priority='1000'/>
</filter>
</pre>
<p>
The consequence of putting ARP-specific rules in the <code>arp</code>
chain, rather than for example in the <code>root</code> chain, is that
packets for any other protocol than ARP do not need to be evaluated by
ARP protocol-specific rules. This improves the efficiency
of the traffic filtering. However, one must then pay attention to only
put filtering rules for the given protocol into the chain since
any other rules will not be evaluated, i.e., an IPv4 rule will not
be evaluated in the ARP chain since no IPv4 protocol packets will
traverse the ARP chain.
<br/><br/>
</p>
<h3><a name="nwfconceptschainpriorities">Filtering chain priorities</a></h3>
<p>
All chains are connected to the <code>root</code> chain. The order in
which those chains are accessed is influenced by the priority of the
chain. The following table shows the chains that can be assigned a
priority and their default priorities.
</p>
<table class="top_table">
<tr>
<th> Chain (prefix) </th>
<th> Default priority </th>
</tr>
<tr>
<td>stp</td><td>-810</td>
</tr>
<tr>
<td>mac</td><td>-800</td>
</tr>
<tr>
<td>vlan</td><td>-750</td>
</tr>
<tr>
<td>ipv4</td><td>-700</td>
</tr>
<tr>
<td>ipv6</td><td>-600</td>
</tr>
<tr>
<td>arp</td><td>-500</td>
</tr>
<tr>
<td>rarp</td><td>-400</td>
</tr>
</table>
<p>
A chain with a lower priority value is accessed before one with a
higher value.
<br/>
<span class="since">Since 0.9.8</span> the above listed chains
can be assigned custom priorities by writing a value in the
range [-1000, 1000] into the priority (XML) attribute in the filter
node. The above example filter shows the default priority of -500
for <code>arp</code> chains.
</p>
<h3><a name="nwfconceptsvars">Usage of variables in filters</a></h3>
<p>
Two variables names have so far been reserved for usage by the
network traffic filtering subsystem: <code>MAC</code> and
<code>IP</code>.
<br/><br/>
<code>MAC</code> is the MAC address of the
network interface. A filtering rule that references this variable
will automatically be instantiated with the MAC address of the
interface. This works without the user having to explicitly provide
the MAC parameter. Even though it is possible to specify the MAC
parameter similar to the IP parameter above, it is discouraged
since libvirt knows what MAC address an interface will be using.
<br/><br/>
The parameter <code>IP</code> represents the IP address
that the operating system inside the virtual machine is expected
to use on the given interface. The <code>IP</code> parameter
is special in so far as the libvirt daemon will try to determine
the IP address (and thus the IP parameter's value) that is being
used on an interface if the parameter
is not explicitly provided but referenced.
For current limitations on IP address detection, consult the
<a href="#nwflimits">section on limitations</a> on how to use this
feature and what to expect when using it.
<br/><br/>
The above-shown network filer <code>no-arp-spoofing</code>
is an example of
a network filter XML referencing the <code>MAC</code> and
<code>IP</code> variables.
<br/><br/>
Note that referenced variables are always prefixed with the
$ (dollar) sign. The format of the value of a variable
must be of the type expected by the filter attribute in the
XML. In the above example, the <code>IP</code> parameter
must hold a dotted IP address in decimal numbers format.
Failure to provide the correct
value type will result in the filter not being instantiatable
and will prevent a virtual machine from starting or the
interface from attaching when hotplugging is used. The types
that are expected for each XML attribute are shown
below.
<br/><br/>
<span class="since">Since 0.9.8</span> variables can contain lists of
elements, e.g., the variable <code>IP</code> can contain multiple IP
addresses that are valid on a particular interface. The notation for
providing multiple elements for the IP variable is:
</p>
<pre>
...
<devices>
<interface type='bridge'>
<mac address='00:16:3e:5d:c7:9e'/>
<filterref filter='clean-traffic'>
<parameter name='IP' value='10.0.0.1'/>
<parameter name='IP' value='10.0.0.2'/>
<parameter name='IP' value='10.0.0.3'/>
</filterref>
</interface>
</devices>
...</pre>
<p>
This then allows filters to enable multiple IP addresses
per interface. Therefore, with the list
of IP address shown above, the following rule will create 3
individual filtering rules, one for each IP address.
</p>
<pre>
...
<rule action='accept' direction='in' priority='500'>
<tcp srpipaddr='$IP'/>
</rule>
...
</pre>
<p>
<span class="since">Since 0.9.10</span> it is possible to access
individual elements of a variable holding a list of elements.
A filtering rule like the following accesses the 2nd element
of the variable DSTPORTS.
</p>
<pre>
...
<rule action='accept' direction='in' priority='500'>
<udp dstportstart='$DSTPORTS[1]'/>
</rule>
...
</pre>
<p>
<span class="since">Since 0.9.10</span> it is possible to create
filtering rules that instantiate all combinations of rules from
different lists using the notation of
<code>$VARIABLE[@<iterator ID>]</code>.
The following rule allows a virtual machine to
receive traffic on a set of ports, which are specified in DSTPORTS,
from the set of source IP address specified in SRCIPADDRESSES.
The rule generates all combinations of elements of the variable
DSTPORT with those of SRCIPADDRESSES by using two independent
iterators to access their elements.
</p>
<pre>
...
<rule action='accept' direction='in' priority='500'>
<ip srcipaddr='$SRCIPADDRESSES[@1]' dstportstart='$DSTPORTS[@2]'/>
</rule>
...
</pre>
<p>
In an example we assign concrete values to SRCIPADDRESSES and DSTPORTS
</p>
<pre>
SRCIPADDRESSES = [ 10.0.0.1, 11.1.2.3 ]
DSTPORTS = [ 80, 8080 ]
</pre>
<p>
Accessing the variables using $SRCIPADDRESSES[@1] and $DSTPORTS[@2] would
then result in all combinations of addresses and ports being created:
</p>
<pre>
10.0.0.1, 80
10.0.0.1, 8080
11.1.2.3, 80
11.1.2.3, 8080
</pre>
<p>
Accessing the same variables using a single iterator, for example by using
the notation $SRCIPADDRESSES[@1] and $DSTPORTS[@1], would result in
parallel access to both lists and result in the following combinations:
</p>
<pre>
10.0.0.1, 80
11.1.2.3, 8080
</pre>
<p>
Further, the notation of $VARIABLE is short-hand for $VARIABLE[@0]. The
former notation always assumes the iterator with Id '0'.
</p>
<h3><a name="nwfelemsRulesAdvIPAddrDetection">Automatic IP address detection</a></h3>
<p>
The detection of IP addresses used on a virtual machine's interface
is automatically activated if the variable <code>IP</code> is referenced
but no value has been assigned to it.
<span class="since">Since 0.9.13</span>
the variable <code>CTRL_IP_LEARNING</code> can be used to specify
the IP address learning method to use. Valid values are <code>any</code>,
<code>dhcp</code>, or <code>none</code>.
<br/><br/>
The value <code>any</code> means that libvirt may use any packet to
determine the address in use by a virtual machine, which is the default
behavior if the variable <code>CTRL_IP_LEARNING</code> is not set. This method
will only detect a single IP address on an interface.
Once a VM's IP address has been detected, its IP network traffic
will be locked to that address, if for example IP address spoofing
is prevented by one of its filters. In that case the user of the VM
will not be able to change the IP address on the interface inside
the VM, which would be considered IP address spoofing.
When a VM is migrated to another host or resumed after a suspend operation,
the first packet sent by the VM will again determine the IP address it can
use on a particular interface.
<br/>
A value of <code>dhcp</code> specifies that libvirt should only honor DHCP
server-assigned addresses with valid leases. This method supports the detection
and usage of multiple IP address per interface.
When a VM is resumed after a suspend operation, still valid IP address leases
are applied to its filters. Otherwise the VM is expected to again use DHCP to obtain new
IP addresses. The migration of a VM to another physical host requires that
the VM again runs the DHCP protocol.
<br/><br/>
Use of <code>CTRL_IP_LEARNING=dhcp</code> (DHCP snooping) provides additional
anti-spoofing security, especially when combined with a filter allowing
only trusted DHCP servers to assign addresses. To enable this, set the
variable <code>DHCPSERVER</code> to the IP address of a valid DHCP server
and provide filters that use this variable to filter incoming DHCP responses.
<br/><br/>
When DHCP snooping is enabled and the DHCP lease expires,
the VM will no longer be able to use the IP address until it acquires a
new, valid lease from a DHCP server. If the VM is migrated, it must get
a new valid DHCP lease to use an IP address (e.g., by
bringing the VM interface down and up again).
<br/><br/>
Note that automatic DHCP detection listens to the DHCP traffic
the VM exchanges with the DHCP server of the infrastructure. To avoid
denial-of-service attacks on libvirt, the evaluation of those packets
is rate-limited, meaning that a VM sending an excessive number of DHCP
packets per second on an interface will not have all of those packets
evaluated and thus filters may not get adapted. Normal DHCP client
behavior is assumed to send a low number of DHCP packets per second.
Further, it is important to setup appropriate filters on all VMs in
the infrastructure to avoid them being able to send DHCP
packets. Therefore VMs must either be prevented from sending UDP and TCP
traffic from port 67 to port 68 or the <code>DHCPSERVER</code>
variable should be used on all VMs to restrict DHCP server messages to
only be allowed to originate from trusted DHCP servers. At the same
time anti-spoofing prevention must be enabled on all VMs in the subnet.
<br/><br/>
If <code>CTRL_IP_LEARNING</code> is set to <code>none</code>, libvirt does not do
IP address learning and referencing <code>IP</code> without assigning it an
explicit value is an error.
<br/><br/>
The following XML provides an example for the activation of IP address learning
using the DHCP snooping method:
</p>
<pre>
<interface type='bridge'>
<source bridge='virbr0'/>
<filterref filter='clean-traffic'>
<parameter name='CTRL_IP_LEARNING' value='dhcp'/>
</filterref>
</interface>
</pre>
<h3><a name="nwfelemsReservedVars">Reserved Variables</a></h3>
<p>
The following table lists reserved variables in use by libvirt.
</p>
<table class="top_table">
<tr>
<th> Variable Name </th>
<th> Semantics </th>
</tr>
<tr>
<td> MAC </td>
<td> The MAC address of the interface </td>
</tr>
<tr>
<td> IP </td>
<td> The list of IP addresses in use by an interface </td>
</tr>
<tr>
<td> IPV6 </td>
<td> Not currently implemented:
the list of IPV6 addresses in use by an interface </td>
</tr>
<tr>
<td> DHCPSERVER </td>
<td> The list of IP addresses of trusted DHCP servers</td>
</tr>
<tr>
<td> DHCPSERVERV6 </td>
<td> Not currently implemented:
The list of IPv6 addresses of trusted DHCP servers</td>
</tr>
<tr>
<td> CTRL_IP_LEARNING </td>
<td> The choice of the IP address detection mode </td>
</tr>
</table>
<h2><a name="nwfelems">Element and attribute overview</a></h2>
<p>
The root element required for all network filters is
named <code>filter</code> with two possible attributes. The
<code>name</code> attribute provides a unique name of the
given filter. The <code>chain</code> attribute is optional but
allows certain filters to be better organized for more efficient
processing by the firewall subsystem of the underlying host.
Currently the system only supports the chains <code>root,
ipv4, ipv6, arp and rarp</code>.
</p>
<h3><a name="nwfelemsRefs">References to other filters</a></h3>
<p>
Any filter may hold references to other filters. Individual
filters may be referenced multiple times in a filter tree but
references between filters must not introduce loops (directed
acyclic graph).
<br/><br/>
The following shows the XML of the <code>clean-traffic</code>
network filter referencing several other filters.
</p>
<pre>
<filter name='clean-traffic'>
<uuid>6ef53069-ba34-94a0-d33d-17751b9b8cb1</uuid>
<filterref filter='no-mac-spoofing'/>
<filterref filter='no-ip-spoofing'/>
<filterref filter='allow-incoming-ipv4'/>
<filterref filter='no-arp-spoofing'/>
<filterref filter='no-other-l2-traffic'/>
<filterref filter='qemu-announce-self'/>
</filter>
</pre>
<p>
To reference another filter, the XML node <code>filterref</code>
needs to be provided inside a <code>filter</code> node. This
node must have the attribute <code>filter</code> whose value contains
the name of the filter to be referenced.
<br/><br/>
New network filters can be defined at any time and
may contain references to network filters that are
not known to libvirt, yet. However, once a virtual machine
is started or a network interface
referencing a filter is to be hotplugged, all network filters
in the filter tree must be available. Otherwise the virtual
machine will not start or the network interface cannot be
attached.
</p>
<h3><a name="nwfelemsRules">Filter rules</a></h3>
<p>
The following XML shows a simple example of a network
traffic filter implementing a rule to drop traffic if
the IP address (provided through the value of the
variable IP) in an outgoing IP packet is not the expected
one, thus preventing IP address spoofing by the VM.
</p>
<pre>
<filter name='no-ip-spoofing' chain='ipv4'>
<uuid>fce8ae33-e69e-83bf-262e-30786c1f8072</uuid>
<rule action='drop' direction='out' priority='500'>
<ip match='no' srcipaddr='$IP'/>
</rule>
</filter>
</pre>
<p>
A traffic filtering rule starts with the <code>rule</code>
node. This node may contain up to three attributes
</p>
<ul>
<li>
action -- mandatory; must either be <code>drop</code>
(matching the rule silently discards the packet with no
further analysis),
<code>reject</code> (matching the rule generates an ICMP
reject message with no further analysis) <span class="since">(since
0.9.0)</span>, <code>accept</code> (matching the rule accepts
the packet with no further analysis), <code>return</code>
(matching the rule passes this filter, but returns control to
the calling filter for further
analysis) <span class="since">(since 0.9.7)</span>,
or <code>continue</code> (matching the rule goes on to the next
rule for further analysis) <span class="since">(since
0.9.7)</span>.
</li>
<li>
direction -- mandatory; must either be <code>in</code>, <code>out</code> or
<code>inout</code> if the rule is for incoming,
outgoing or incoming-and-outgoing traffic
</li>
<li>
priority -- optional; the priority of the rule controls the order in
which the rule will be instantiated relative to other rules.
Rules with lower value will be instantiated before rules with higher
values.
Valid values are in the range of 0 to 1000.
<span class="since">Since 0.9.8</span> this has been extended to cover
the range of -1000 to 1000. If this attribute is not
provided, priority 500 will automatically be assigned.
<br/>
Note that filtering rules in the <code>root</code> chain are sorted
with filters connected to the <code>root</code> chain following
their priorities. This allows to interleave filtering rules with
access to filter chains.
(See also section on
<a href="#nwfconceptschainpriorities">
filtering chain priorities
</a>.)
</li>
<li>
statematch -- optional; possible values are '0' or 'false' to
turn the underlying connection state matching off; default is 'true'
<br/>
Also read the section on <a href="#nwfelemsRulesAdv">advanced configuration</a>
topics.
</li>
</ul>
<p>
The above example indicates that the traffic of type <code>ip</code>
will be associated with the chain 'ipv4' and the rule will have
priority 500. If for example another filter is referenced whose
traffic of type <code>ip</code> is also associated with the chain
'ipv4' then that filter's rules will be ordered relative to the priority
500 of the shown rule.
<br/><br/>
A rule may contain a single rule for filtering of traffic. The
above example shows that traffic of type <code>ip</code> is to be
filtered.
</p>
<h4><a name="nwfelemsRulesProto">Supported protocols</a></h4>
<p>
The following sections enumerate the list of protocols that
are supported by the network filtering subsystem. The
type of traffic a rule is supposed to filter on is provided
in the <code>rule</code> node as a nested node. Depending
on the traffic type a rule is filtering, the attributes are
different. The above example showed the single
attribute <code>srcipaddr</code> that is valid inside the
<code>ip</code> traffic filtering node. The following sections
show what attributes are valid and what type of data they are
expecting. The following datatypes are available:
</p>
<ul>
<li>UINT8 : 8 bit integer; range 0-255</li>
<li>UINT16: 16 bit integer; range 0-65535</li>
<li>MAC_ADDR: MAC address in dotted decimal format, i.e., 00:11:22:33:44:55</li>
<li>MAC_MASK: MAC address mask in MAC address format, i.e., FF:FF:FF:FC:00:00</li>
<li>IP_ADDR: IP address in dotted decimal format, i.e., 10.1.2.3</li>
<li>IP_MASK: IP address mask in either dotted decimal format (255.255.248.0) or CIDR mask (0-32)</li>
<li>IPV6_ADDR: IPv6 address in numbers format, i.e., FFFF::1</li>
<li>IPV6_MASK: IPv6 mask in numbers format (FFFF:FFFF:FC00::) or CIDR mask (0-128)</li>
<li>STRING: A string</li>
<li>BOOLEAN: 'true', 'yes', '1' or 'false', 'no', '0'</li>
<li>IPSETFLAGS: The source and destination flags of the ipset described
by up to 6 'src' or 'dst' elements selecting features from either
the source or destination part of the packet header; example:
src,src,dst. The number of 'selectors' to provide here depends
on the type of ipset that is referenced.</li>
</ul>
<p>
<br/><br/>
Every attribute except for those of type IP_MASK or IPV6_MASK can
be negated using the <code>match</code>
attribute with value <code>no</code>. Multiple negated attributes
may be grouped together. The following
XML fragment shows such an example using abstract attributes.
</p>
<pre>
[...]
<rule action='drop' direction='in'>
<protocol match='no' attribute1='value1' attribute2='value2'/>
<protocol attribute3='value3'/>
</rule>
[...]
</pre>
<p>
Rules perform a logical AND evaluation on all values of the given
protocol attributes. Thus, if a single attribute's value does not match
the one given in the rule, the whole rule will be skipped during
evaluation. Therefore, in the above example incoming traffic
will only be dropped if
the protocol property attribute1 does not match value1 AND
the protocol property attribute2 does not match value2 AND
the protocol property attribute3 matches value3.
<br/><br/>
</p>
<h5><a name="nwfelemsRulesProtoMAC">MAC (Ethernet)</a></h5>
<p>
Protocol ID: <code>mac</code>
<br/>
Note: Rules of this type should go into the <code>root</code> chain.
</p>
<table class="top_table">
<tr>
<th> Attribute </th>
<th> Datatype </th>
<th> Semantics </th>
</tr>
<tr>
<td>srcmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of sender</td>
</tr>
<tr>
<td>srcmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of sender</td>
</tr>
<tr>
<td>dstmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of destination</td>
</tr>
<tr>
<td>dstmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of destination</td>
</tr>
<tr>
<td>protocolid</td>
<td>UINT16 (0x600-0xffff), STRING</td>
<td>Layer 3 protocol ID</td>
</tr>
<tr>
<td>comment <span class="since">(Since 0.8.5)</span></td>
<td>STRING</td>
<td>text with max. 256 characters</td>
</tr>
</table>
<p>
Valid Strings for <code>protocolid</code> are: arp, rarp, ipv4, ipv6
</p>
<pre>
[...]
<mac match='no' srcmacaddr='$MAC'/>
[...]
</pre>
<h5><a name="nwfelemsRulesProtoVLAN">VLAN (802.1Q)</a>
<span class="since">(Since 0.9.8)</span>
</h5>
<p>
Protocol ID: <code>vlan</code>
<br/>
Note: Rules of this type should go either into the <code>root</code> or
<code>vlan</code> chain.
</p>
<table class="top_table">
<tr>
<th> Attribute </th>
<th> Datatype </th>
<th> Semantics </th>
</tr>
<tr>
<td>srcmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of sender</td>
</tr>
<tr>
<td>srcmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of sender</td>
</tr>
<tr>
<td>dstmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of destination</td>
</tr>
<tr>
<td>dstmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of destination</td>
</tr>
<tr>
<td>vlanid</td>
<td>UINT16 (0x0-0xfff, 0 - 4095)</td>
<td>VLAN ID</td>
</tr>
<tr>
<td>encap-protocol</td>
<td>UINT16 (0x03c-0xfff), String</td>
<td>Encapsulated layer 3 protocol ID</td>
</tr>
<tr>
<td>comment </td>
<td>STRING</td>
<td>text with max. 256 characters</td>
</tr>
</table>
<p>
Valid Strings for <code>encap-protocol</code> are: arp, ipv4, ipv6
</p>
<h5><a name="nwfelemsRulesProtoSTP">STP (Spanning Tree Protocol)</a>
<span class="since">(Since 0.9.8)</span>
</h5>
<p>
Protocol ID: <code>stp</code>
<br/>
Note: Rules of this type should go either into the <code>root</code> or
<code>stp</code> chain.
</p>
<table class="top_table">
<tr>
<th> Attribute </th>
<th> Datatype </th>
<th> Semantics </th>
</tr>
<tr>
<td>srcmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of sender</td>
</tr>
<tr>
<td>srcmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of sender</td>
</tr>
<tr>
<td>type</td>
<td>UINT8</td>
<td>Bridge Protocol Data Unit (BPDU) type</td>
</tr>
<tr>
<td>flags</td>
<td>UINT8</td>
<td>BPDU flag</td>
</tr>
<tr>
<td>root-priority</td>
<td>UINT16</td>
<td>Root priority (range start)</td>
</tr>
<tr>
<td>root-priority-hi</td>
<td>UINT16</td>
<td>Root priority range end</td>
</tr>
<tr>
<td>root-address</td>
<td>MAC_ADDRESS</td>
<td>Root MAC address</td>
</tr>
<tr>
<td>root-address-mask</td>
<td>MAC_MASK</td>
<td>Root MAC address mask</td>
</tr>
<tr>
<td>root-cost</td>
<td>UINT32</td>
<td>Root path cost (range start)</td>
</tr>
<tr>
<td>root-cost-hi</td>
<td>UINT32</td>
<td>Root path cost range end</td>
</tr>
<tr>
<td>sender-priority</td>
<td>UINT16</td>
<td>Sender priority (range start)</td>
</tr>
<tr>
<td>sender-priority-hi</td>
<td>UINT16</td>
<td>Sender priority range end</td>
</tr>
<tr>
<td>sender-address</td>
<td>MAC_ADDRESS</td>
<td>BPDU sender MAC address</td>
</tr>
<tr>
<td>sender-address-mask</td>
<td>MAC_MASK</td>
<td>BPDU sender MAC address mask</td>
</tr>
<tr>
<td>port</td>
<td>UINT16</td>
<td>Port identifier (range start)</td>
</tr>
<tr>
<td>port_hi</td>
<td>UINT16</td>
<td>Port identifier range end</td>
</tr>
<tr>
<td>msg-age</td>
<td>UINT16</td>
<td>Message age timer (range start)</td>
</tr>
<tr>
<td>msg-age-hi</td>
<td>UINT16</td>
<td>Message age timer range end</td>
</tr>
<tr>
<td>max-age</td>
<td>UINT16</td>
<td>Maximum age timer (range start)</td>
</tr>
<tr>
<td>max-age-hi</td>
<td>UINT16</td>
<td>Maximum age timer range end</td>
</tr>
<tr>
<td>hello-time</td>
<td>UINT16</td>
<td>Hello time timer (range start)</td>
</tr>
<tr>
<td>hello-time-hi</td>
<td>UINT16</td>
<td>Hello time timer range end</td>
</tr>
<tr>
<td>forward-delay</td>
<td>UINT16</td>
<td>Forward delay (range start)</td>
</tr>
<tr>
<td>forward-delay-hi</td>
<td>UINT16</td>
<td>Forward delay range end</td>
</tr>
<tr>
<td>comment</td>
<td>STRING</td>
<td>text with max. 256 characters</td>
</tr>
</table>
<h5><a name="nwfelemsRulesProtoARP">ARP/RARP</a></h5>
<p>
Protocol ID: <code>arp</code> or <code>rarp</code>
<br/>
Note: Rules of this type should either go into the
<code>root</code> or <code>arp/rarp</code> chain.
</p>
<table class="top_table">
<tr>
<th> Attribute </th>
<th> Datatype </th>
<th> Semantics </th>
</tr>
<tr>
<td>srcmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of sender</td>
</tr>
<tr>
<td>srcmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of sender</td>
</tr>
<tr>
<td>dstmacaddr</td>
<td>MAC_ADDR</td>
<td>MAC address of destination</td>
</tr>
<tr>
<td>dstmacmask</td>
<td>MAC_MASK</td>
<td>Mask applied to MAC address of destination</td>
</tr>
<tr>
<td>hwtype</td>
<td>UINT16</td>
<td>Hardware type</td>
</tr>
<tr>
<td>protocoltype</td>
<td>UINT16</td>
<td>Protocol type</td>
</tr>
<tr>
<td>opcode</td>
<td>UINT16, STRING</td>
<td>Opcode</td>
</tr>
<tr>
<td>arpsrcmacaddr</td>
<td>MAC_ADDR</td>
<td>Source MAC address in ARP/RARP packet</td>
</tr>
<tr>
<td>arpdstmacaddr</td>
<td>MAC_ADDR</td>
<td>Destination MAC address in ARP/RARP packet</td>
</tr>
<tr>
<td>arpsrcipaddr</td>
<td>IP_ADDR</td>
<td>Source IP address in ARP/RARP packet</td>
</tr>
<tr>
<td>arpsrcipmask <span class="since">(Since 1.2.3)</span></td>
<td>IP_MASK</td>
<td>Source IP mask</td>
</tr>
<tr>
<td>arpdstipaddr</td>
<td>IP_ADDR</td>
<td>Destination IP address in ARP/RARP packet</td>