802.1q MAC Spoofing blocks Network Aliases

[TinoatTSI]

We are running the latest version 5.8.0 of OpenNebula und Ubuntu 18.04. If you add an alias (Attach nic) to an existing virtual NIC, the communication is dropped, if the not the MAC of the inital interface is used.
If you e.g. want to run a virtual machine on the VM or something using macvlan, the VM is unable to communication with the network, since the MAC spoofing protection setup by OpenNebula on the host interface will drop the packages.

Chain one-21-0-o (1 references)
num  target     prot opt source               destination
1    DROP       all  --  0.0.0.0/0            0.0.0.0/0            MAC ! 03:11:0A:0C:00:04
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
3    RETURN     all  --  0.0.0.0/0            0.0.0.0/0
4    DROP       all  --  0.0.0.0/0            0.0.0.0/0
>>>>

Manually removing rule 1 will work, but is more a dirty quick fix that does not last.

Can you please add additonal MACs also to the filter?

[rsmontero]

Totally! Thanks for the feedback.

As you said the driver needs to be updated to respond to this filters for the ALIAS. In the meanwhile you would need to disable MAC spoofing

[rsmontero]

Sorry, I was reading again the issue. We are aware of the IP spoofing (i.e. some of the functionalities of the drivers are bypassed for NIC alias).

However NIC ALIAS is not attaching a new interface so it will not add a new MAC filter rule. In your case you need to disable MAC spoofing either way.

[rsmontero]

Sorry, on a second thought we can add the IP/MAC pair in the MAC spoofing rules. So a NIC ALIAS includes IP/MAC pair and we can add that to the rules.

So for example, a VM template with:

NIC_ALIAS = [ NETWORK = "Public", PARENT = "private_net" ]

will result in:

NIC_ALIAS =   [ ALIAS_ID = 0, AR_ID=1, BRIDGE=virbr0, IP=1.1.1.1, MAC= 02:00:01:01:01:01...

So it may have sense to add that MAC to the rules. Is that your proposal?

[TinoatTSI]

Yes I think that would do it. This also needs to be performed when a NIC is hot-attached.
So in both cases you would need to add the alias IP/MAC pair to the spoofing protection "whitelist".

[rsmontero]

Perfect thanks! we'll address this issue as discussed

[rdiaz-on]

This issue has been fixed.