From 4ccc2c3a50a8db8faa846658fc08411ad89b4453 Mon Sep 17 00:00:00 2001 From: Chiradeep Vittal Date: Thu, 5 Jan 2012 17:44:46 -0800 Subject: [PATCH] bug 12854: arp requests can also be used to poison arp caches --- scripts/vm/hypervisor/xenserver/vmops | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/vm/hypervisor/xenserver/vmops b/scripts/vm/hypervisor/xenserver/vmops index ba89adca9e8..6e3d6f9704b 100755 --- a/scripts/vm/hypervisor/xenserver/vmops +++ b/scripts/vm/hypervisor/xenserver/vmops @@ -653,7 +653,8 @@ def default_arp_antispoof(vm_chain, vifs, vm_ip, vm_mac): #accept arp replies into the bridge as long as the source mac and ips match the vm util.pread2(['arptables', '-A', vm_chain, '-i', vif, '--opcode', 'Reply', '--source-mac', vm_mac, '--source-ip', vm_ip, '-j', 'ACCEPT']) #accept any arp requests from this vm. In the future this can be restricted to deny attacks on hosts - util.pread2(['arptables', '-A', vm_chain, '-i', vif, '--opcode', 'Request', '-j', 'ACCEPT']) + #also important to restrict source ip and src mac in these requests as they can be used to update arp tables on destination + util.pread2(['arptables', '-A', vm_chain, '-i', vif, '--opcode', 'Request', '--source-mac', vm_mac, '--source-ip', vm_ip, '-j', 'RETURN']) #accept any arp requests to this vm as long as the request is for this vm's ip util.pread2(['arptables', '-A', vm_chain, '-o', vif, '--opcode', 'Request', '--destination-ip', vm_ip, '-j', 'ACCEPT']) #accept any arp replies to this vm as long as the mac and ip matches