I have a couple of kvm vms running with libvirt and they are using openvswitch bridges. I need a mechanism to prevent mac spoofing on a guest. I tried libvirt filters no-mac-spoofing and clean-traffic but they only work with linux bridges. I thought I could maybe use openflow rules to try to restrict the traffic that do not match an specific src mac (drop all packets that have a different mac than what was configured on the vm xml). This is what I have:
[root@t6 /]# ovs-ofctl show vswitch2
OFPT_FEATURES_REPLY (xid=0x2): dpid:00000030641a7b82
n_tables:254, n_buffers:0
capabilities: FLOW_STATS TABLE_STATS PORT_STATS QUEUE_STATS ARP_MATCH_IP
actions: output enqueue set_vlan_vid set_vlan_pcp strip_vlan mod_dl_src mod_dl_dst mod_nw_src mod_nw_dst mod_nw_tos mod_tp_src mod_tp_dst
1(eth5): addr:00:30:64:1a:7b:82
config: 0
state: 0
current: 1GB-FD COPPER AUTO_NEG
advertised: 10MB-HD 10MB-FD 100MB-HD 100MB-FD 1GB-FD COPPER AUTO_NEG
supported: 10MB-HD 10MB-FD 100MB-HD 100MB-FD 1GB-FD COPPER AUTO_NEG
speed: 1000 Mbps now, 1000 Mbps max
2(vnet0): addr:fe:54:00:00:00:11
config: 0
state: 0
current: 10MB-FD COPPER
speed: 10 Mbps now, 0 Mbps max
3(vnet1): addr:fe:54:00:00:00:22
config: 0
state: 0
current: 10MB-FD COPPER
speed: 10 Mbps now, 0 Mbps max
4(vnet2): addr:fe:54:00:00:00:33
config: 0
state: 0
current: 10MB-FD COPPER
speed: 10 Mbps now, 0 Mbps max
LOCAL(vswitch2): addr:00:30:64:1a:7b:82
config: 0
state: 0
speed: 0 Mbps now, 0 Mbps max
And I wanted to restrict the traffic on packets coming from vnet2. So I tried dropping the packets in which the src mac didn't match the mac configured on libvirt nic:
[root@t6 /]# ovs-ofctl add-flow vswitch2 dl_src!=52:54:00:00:00:33,in_port=4,actions=drop
ovs-ofctl: unknown keyword dl_src!
[root@t6 /]# ovs-ofctl add-flow vswitch2 dl_src!52:54:00:00:00:33,in_port=4,actions=drop
-bash: !52: event not found
But as you can see, the ! symbol is not recognized. I looked at the documentation for openflow but couldn't find anything that could help me with that... Can anyone that has some openflow and openvswitch knowledge help me with that? Is what I'm trying to do even possible with openflow? Honestly I'm really confused at the moment, as the openflow documentation is a bit overwhelming for first time users.... I thank you in advance for any help you could give!
