Restrict Guest VM 802.1q tagging

[virtualbitz]

I'm using OVS and discovered that If I create a VLAN interface on a guest VM that the OVS bridge will allow it. I want to prevent this and only allow untagged traffic to and from the VM. How would I go about doing this?

 

[virtualbitz]

Bump.

Anyone have an answer for this? Is this not possible? In it's current state, it would appear that a compromised VM could participate in any VLAN it likes. This is pretty big security problem.

 

[spirit]

do you gave tried to set tag=1 ? it should force the default vlan, and exclude other vlans.

 

[virtualbitz]

I haven't tried that, but I don't use the default VLAN. The whole point is to use multiple VLANs and prevent untrusted VMs from being able to cross VM boundaries. This is the default behavior on VMware and I'm looking to replicate it here with OVS

 

[spirit]

The whole point is to use multiple VLANs and prevent untrusted VMs from being able to cross VM boundar

I want to prevent this and only allow untagged traffic to and from the VM

so, do you want only untagged, or do you want multiple vlans (with a fixed list) inside a vm ?

you can limit the number of vlans going to a vm, editing the vm config file : "netX: ....,trunks=2-4;6;8;9-10" .
It's not available in the gui currently.


Basically, if you don't define any vlan on the vm interface, it's allow any vlan going to the vm. (until you use trunks..).
if you define a vlan, it's forcing the vlan (like an access-vlan on cisco switch).

 

[virtualbitz]

so, do you want only untagged, or do you want multiple vlans (with a fixed list) inside a vm ?

you can limit the number of vlans going to a vm, editing the vm config file : "netX: ....,trunks=2-4;6;8;9-10" .
It's not available in the gui currently.


Basically, if you don't define any vlan on the vm interface, it's allow any vlan going to the vm. (until you use trunks..).
if you define a vlan, it's forcing the vlan (like an access-vlan on cisco switch).

Even if I define a VLAN on an interface via the UI, I can still create VLAN interfaces on the guest and Proxmox/OVS will allow it

 

[zimbres]

I'm using OVS and discovered that If I create a VLAN interface on a guest VM that the OVS bridge will allow it. I want to prevent this and only allow untagged traffic to and from the VM. How would I go about doing this?

Take a look to my thread https://forum.proxmox.com/threads/ovspatchport-patch-ovs_type-availability-for-openvswitch.103180/

You can create a new Bridge and limit the VLans that will be passed in the trunk.

 

[spirit]

Even if I define a VLAN on an interface via the UI, I can still create VLAN interfaces on the guest and Proxmox/OVS will allow it

That's really strange, looking at ovs doc

http://www.openvswitch.org/support/dist-docs/ovs-vswitchd.conf.db.5.html

      vlan_mode: optional string, one of access, dot1q-tunnel, native-tagged,
       native-untagged, or trunk
              The VLAN mode of the port, as described above. When this  column
              is empty, a default mode is selected as follows:

              ·      If  tag contains a value, the port is an access port. The
                     trunks column should be empty.

              ·      Otherwise, the port is a trunk port.  The  trunks  column
                     value is honored if it is present.

and proxmox code

my $ovs_bridge_add_port = sub {
    my ($bridge, $iface, $tag, $internal, $trunks) = @_;

    $trunks =~ s/;/,/g if $trunks;

    my $cmd = ['/usr/bin/ovs-vsctl'];
    # first command
    push @$cmd, '--', 'add-port', $bridge, $iface;
    push @$cmd, "tag=$tag" if $tag;
    push @$cmd, "trunks=". join(',', $trunks) if $trunks;
    push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks;
   ...

so, if a tag is defined on the vm nic gui, the ovs port should be in access mode, and only allow this vlan.

 

[virtualbitz]

That's really strange, looking at ovs doc

http://www.openvswitch.org/support/dist-docs/ovs-vswitchd.conf.db.5.html

      vlan_mode: optional string, one of access, dot1q-tunnel, native-tagged,
       native-untagged, or trunk
              The VLAN mode of the port, as described above. When this  column
              is empty, a default mode is selected as follows:

              ·      If  tag contains a value, the port is an access port. The
                     trunks column should be empty.

              ·      Otherwise, the port is a trunk port.  The  trunks  column
                     value is honored if it is present.

and proxmox code

my $ovs_bridge_add_port = sub {
    my ($bridge, $iface, $tag, $internal, $trunks) = @_;

    $trunks =~ s/;/,/g if $trunks;

    my $cmd = ['/usr/bin/ovs-vsctl'];
    # first command
    push @$cmd, '--', 'add-port', $bridge, $iface;
    push @$cmd, "tag=$tag" if $tag;
    push @$cmd, "trunks=". join(',', $trunks) if $trunks;
    push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks;
   ...

so, if a tag is defined on the vm nic gui, the ovs port should be in access mode, and only allow this vlan.

I'll do some testing in my lab this morning to confirm one way or the other. Thinking back I may have been testing with an interface that didn't have a VLAN defined in the Proxmox UI.

 

[virtualbitz]

That's really strange, looking at ovs doc

http://www.openvswitch.org/support/dist-docs/ovs-vswitchd.conf.db.5.html

      vlan_mode: optional string, one of access, dot1q-tunnel, native-tagged,
       native-untagged, or trunk
              The VLAN mode of the port, as described above. When this  column
              is empty, a default mode is selected as follows:

              ·      If  tag contains a value, the port is an access port. The
                     trunks column should be empty.

              ·      Otherwise, the port is a trunk port.  The  trunks  column
                     value is honored if it is present.

and proxmox code

my $ovs_bridge_add_port = sub {
    my ($bridge, $iface, $tag, $internal, $trunks) = @_;

    $trunks =~ s/;/,/g if $trunks;

    my $cmd = ['/usr/bin/ovs-vsctl'];
    # first command
    push @$cmd, '--', 'add-port', $bridge, $iface;
    push @$cmd, "tag=$tag" if $tag;
    push @$cmd, "trunks=". join(',', $trunks) if $trunks;
    push @$cmd, "vlan_mode=native-untagged" if $tag && $trunks;
   ...

so, if a tag is defined on the vm nic gui, the ovs port should be in access mode, and only allow this vlan.

Ah okay you're right. If a VLAN ID is defined in the Proxmox UI it's behaves as an "access" interface and only untagged traffic belonging to that VLAN ID will be allowed.

I really wasn't expecting the lack of a defined VLAN for a guest to behave as an unpruned trunk port. If any devs are watching this, I think it would be a good idea to let the user know this in the UI when configuring NIC properties for a guest.

Thanks @spirit and @zimbres for looking into it