Guest isolation in XenServer 6.1 / XCP 1.6

Since XenServer 6.1 (XCP 1.6) there is a new feature that allows you to lock VIF to specific MAC and IP addresses. This is nice (and also very buggy!), but it doesn’t provide any security other than keeping VMs from stealing each others IPs. A better solution should allow to (optionally) isolate traffic between groups of VMs as well. For example, prevent users from accessing other users VMs over a common private/backend network, but allow communication between VMs in the same group and with external networks.

Step 1: We must relocate the VIF locking data into the VM’s vm-data store, similar to how security groups are managed by Nova (openstack). This lets us use more fields and options.

Step 2: Patch /opt/xensource/libexec/setup-vif-rules to fix *several* bugs as well as take an extra locking mode (isolated). In isolate mode, VMs can only communicate to IPs in the allowed list. Use a common set of IPs on each set of VMs in the same ‘security group’ and your various groups of guests are isolated from each other.

Step 3: Patch another bug in /etc/xensource/scripts/vif to prevent orphaned rules from piling up in openvswitch when VMs are restarted.

Patches are here:

This will only work with openvswitch networking mode and has been tested on XS 6.1 and XCP 1.6. Do not try it in bridged mode (you shouldn’t be using bridged mode anyways).

3 Responses to Guest isolation in XenServer 6.1 / XCP 1.6

  1. pete says:

    Interesting posts/patches. Do you have an example on how the vm-data store should look and how to add/remove ips?


  2. Richard says:

    Pete, did you work this out, I’ve not testedd this yet but looking at the patch and setup-vif-rules, I think it’s something along the lines of :

    xe vif-param-set uuid= locking-mode=isolated
    xe vif-param-set uuid= ipv4-allowed=

  3. Richard says:

    Last post stripped comments:

    xe vif-param-set uuid=[vif-uuid] locking-mode=isolated
    xe vif-param-set uuid=[vif-uuid] ipv4-allowed=[comma separated list of ipv4-addresses]

    Looks like the patch also support ipv6

    xe vif-param-set uuid=[vif-uuid] ipv6-allowed=[comma separated list of ipv6-addresses]