From f21d8510bb3f55b2b76aab251b0427dbfa69c5d9 Mon Sep 17 00:00:00 2001
From: Soren Hansen <soren.hansen@rackspace.com>
Date: Tue, 7 Sep 2010 14:34:27 +0200
Subject: Add a clean-traffic filterref to the libvirt templates to prevent
 spoofing and snooping attacks from the guests.

---
 nova/virt/libvirt.qemu.xml.template | 3 +++
 nova/virt/libvirt.uml.xml.template  | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/nova/virt/libvirt.qemu.xml.template b/nova/virt/libvirt.qemu.xml.template
index 307f9d03a..3de1e5009 100644
--- a/nova/virt/libvirt.qemu.xml.template
+++ b/nova/virt/libvirt.qemu.xml.template
@@ -20,6 +20,9 @@
             <source bridge='%(bridge_name)s'/>
             <mac address='%(mac_address)s'/>
             <!--   <model type='virtio'/>  CANT RUN virtio network right now -->
+            <filterref filter="clean-traffic">
+                <parameter name="IP" value="$(private_dns_name)s" />
+            </filterref>
         </interface>
         <serial type="file">
             <source path='%(basepath)s/console.log'/>
diff --git a/nova/virt/libvirt.uml.xml.template b/nova/virt/libvirt.uml.xml.template
index 6f4290f98..e64b172d8 100644
--- a/nova/virt/libvirt.uml.xml.template
+++ b/nova/virt/libvirt.uml.xml.template
@@ -14,6 +14,9 @@
         <interface type='bridge'>
             <source bridge='%(bridge_name)s'/>
             <mac address='%(mac_address)s'/>
+            <filterref filter="clean-traffic">
+                <parameter name="IP" value="$(private_dns_name)s" />
+            </filterref>
         </interface>
         <console type="pty" />
         <serial type="file">
-- 
cgit