Open vSwitch 3.8

This guide describes how to use the Open vSwitch network drives. They provide two indepent functionalities that can be used together: network isolation using VLANs, and network filtering using OpenFlow. Each Virtual Network interface will receive a VLAN tag enabling network isolation. Other traffic attributes that may be configured through Open vSwitch are not modified.

The VLAN id will be the same for every interface in a given network, calculated by adding a constant to the network id. It may also be forced by specifying an VLAN_ID parameter in the Virtual Network template.

The network filtering functionality is very similar to the Firewall drivers, with a few limitations discussed below.

inlinetoc

Requirements

This driver requires Open vSwitch to be installed on each OpenNebula Host. Follow the resources specified in hosts_configuration to install it.

Considerations & Limitations

Integrating OpenNebula with Open vSwitch brings a long list of benefits to OpenNebula, read Open vSwitch Features to get a hold on these features.

This guide will address the usage of VLAN tagging and OpenFlow filtering of OpenNebula Virtual Machines. On top of that any other Open vSwitch feature may be used, but that's outside of the scope of this guide.

Configuration

Hosts Configuration

OpenNebula Configuration

To enable this driver, use ovswitch as the Virtual Network Manager driver parameter when the hosts are created with the onehost command:

<xterm> $ onehost create host01 im_kvm vmm_kvm tm_shared ovswitch </xterm>

Driver Actions

Action Description
Pre -
Post Performs the appropriate Open vSwitch commands to tag the virtual tap interface.
Clean It doesn't do anything. The virtual tap interfaces will be automatically discarded when the VM is shut down.

Usage

Network Isolation

The driver will be automatically applied to every Virtual Machine deployed in the Host. Only the virtual networks with the attribute VLAN set to YES will be isolated. There are no other special attributes required. 

NAME    = "ovswitch_net"
TYPE    = "fixed"
BRIDGE  = vbr1
 
VLAN    = "YES"
VLAN_ID = 50        # optional
 
LEASES = ...

:!: Any user with Network creation/modification permissions may force a custom vlan id with the VLAN_ID parameter in the network template. In that scenario, any user may be able to connect to another network with the same network id. Techniques to avoid this are explained under the Tuning & Extending section.

Network Filtering

The first rule that is always applied when using the Open vSwitch drivers is the MAC-spoofing rule, that prevents any traffic coming out of the VM if the user changes the MAC address.

The firewall directives must be placed in the network section of the Virtual Machine template. These are the possible attributes:

  • BLACK_PORTS_TCP = iptables_range: Doesn't permit access to the VM through the specified ports in the TCP protocol. Superseded by WHITE_PORTS_TCP if defined.
  • BLACK_PORTS_UDP = iptables_range: Doesn't permit access to the VM through the specified ports in the UDP protocol. Superseded by WHITE_PORTS_UDP if defined.
  • ICMP = drop: Blocks ICMP connections to the VM. By default it's set to accept.

iptables_range: a list of ports separated by commas, e.g.: 80,8080. Currently no ranges are supporteg, e.g.: 5900:6000 is not supported.

Example: 

NIC = [ NETWORK_ID = 3, BLACK_PORTS_TCP = "80, 22", ICMP = drop ]

Tuning & Extending

:!: Remember that any change in the /var/lib/one/remotes directory won't be effective in the Hosts until you execute, as oneadmin:

<xterm> oneadmin@frontend $ onehost sync </xterm>

This way in the next monitoring cycle the updated files will be copied again to the Hosts.

Calculating VLAN id

The vlan id is calculated by adding the network id to a constant defined in /var/lib/one/remotes/vnm/OpenNebulaNetwork.rb. You can customize that value to your own needs: 

CONF = {
    :start_vlan => 2
}

Restricting manually the VLAN_ID

You can either restrict permissions on Network creation with ACL rules, or you can entirely disable the possibility to redefine the VLAN_ID by modifying the source code of /var/lib/one/remotes/vnm/ovswitch/OpenvSwitch.rb. Change these lines: 

                if nic[:vlan_id]
                    vlan = nic[:vlan_id]
                else
                    vlan = CONF[:start_vlan] + nic[:network_id].to_i
                end

with this one: 

                vlan = CONF[:start_vlan] + nic[:network_id].to_i

OpenFlow Rules

To modify these rules you have to edit: /var/lib/one/remotes/vnm/ovswitch/OpenvSwitch.rb.

Mac-spoofing

These rules prevent any traffic to come out of the port the MAC address has changed. 

in_port=<PORT>,dl_src=<MAC>,priority=40000,actions=normal
in_port=<PORT>,priority=39000,actions=normal

Black ports (one rule per port) 

tcp,dl_dst=<MAC>,tp_dst=<PORT>,actions=drop

ICMP Drop 

icmp,dl_dst=<MAC>,actions=drop