libvirt users - Oct 2013 - network filter and openvswitch bridge

Hello all!

I try to use network filters for openvswitch interfaces.  This is the xml
configuration of my bridge interface

<interface type='bridge'>
   <mac address='00:11:22:33:44:55'/>
   <source bridge='virbr1'/>
   <virtualport type='openvswitch'>
        <parameters
interfaceid='0529d6b5-627c-4330-803f-0d7018e6d496'/>
   </virtualport>
   <model type='virtio'/>
   <filterref filter='myfilter'>
      <parameter name='IP' value='10.10.10.99'/>
   </filterref>
   <address type='pci' domain='0x0000' bus='0x00'
slot='0x06' function='0x0'/>
 </interface>

The filter 'myfilter' is defined. If I start a domain with this
interface all ports are correctly added to the 'virbr1' bridge, plus
libvirt creates firewall rules using ebtables tool. BUT ebtables controls linux
bridges, not openvswich bridges. As far as I know OVS has its own tool to create
firewall rules for its bridges - ovs-ofctl. How to make libvirt to use the right
tool for creating firewall rules for OVS bridges?

If I remove ebtables tool and try to start the domain, libvirt complains
"cannot create rule since ebtables tool is missing."

Thank you.

On 10/01/2013 10:27 AM, Pavel Tokarev wrote:
>
> Hello all!
>
> I try to use network filters for openvswitch interfaces.  This is the
> xml configuration of my bridge interface
>
> <interface type='bridge'>
>    <mac address='00:11:22:33:44:55'/>
>    <source bridge='virbr1'/>
>    <virtualport type='openvswitch'>
>         <parameters
interfaceid='0529d6b5-627c-4330-803f-0d7018e6d496'/>
>    </virtualport>
>    <model type='virtio'/>
>    <filterref filter='myfilter'>
>       <parameter name='IP' value='10.10.10.99'/>
>    </filterref>
>    <address type='pci' domain='0x0000'
bus='0x00' slot='0x06'
> function='0x0'/>
>  </interface>
>
> The filter 'myfilter' is defined. If I start a domain with this
> interface all ports are correctly added to the 'virbr1' bridge,
plus
> libvirt creates firewall rules using ebtables tool. BUT ebtables
> controls linux bridges, not openvswich bridges. As far as I know OVS
> has its own tool to create firewall rules for its bridges - ovs-ofctl.
> How to make libvirt to use the right tool for creating firewall rules
> for OVS bridges?
If Open vSwitch bridges ignore iptables/ebtables, then I guess you would
need to write a separate nwfilter driver for libvirt that dealt with
whatever ovs-ofctl uses. From the point of view of integrating Open
vSwitch with the rest of the host system that seems "really bad"
though.
Is this really the case? If so, this would make a painful time for
pretty much everyone and every package who wants to adopt Open vSwitch
usage into their ecosystem. (think about what would be required for any
general purpose firewall management application - it would need to speak
two different languages)
>
> If I remove ebtables tool and try to start the domain, libvirt
> complains "cannot create rule since ebtables tool is missing.
Because you have nwfilter rules defined, and nwfilter is going to
interpret those as requests to add ebtables/iptables rules in the
kernel, but you've removed its method of doing that.