mirror of
https://github.com/mirage/qubes-mirage-firewall.git
synced 2024-10-01 01:05:39 -04:00
0a4dd7413c
Xen appears to configure the same MAC address for both the frontend
and backend in XenStore. e.g.
[tal@dom0 ~]$ xenstore-ls /local/domain/3/backend/vif/19/0
frontend = "/local/domain/19/device/vif/0"
mac = "00:16:3e:5e:6c:00"
[...]
[tal@dom0 ~]$ xenstore-ls /local/domain/19/device/vif/0
mac = "00:16:3e:5e:6c:00"
This works if the client uses just a simple ethernet device, but fails
if it connects via a bridge. HVM domains have an associated stub domain
running qemu, which provides an emulated network device. The stub domain
uses a bridge to connect qemu's interface with eth0, and this didn't
work.
Force the use of the fixed version of mirage-net-xen, which no longer
uses XenStore to get the backend MAC, and provides a new function to get
the frontend one.
42 lines
1.2 KiB
OCaml
42 lines
1.2 KiB
OCaml
(* Copyright (C) 2017, Thomas Leonard <thomas.leonard@unikernel.com>
|
|
See the README file for details. *)
|
|
|
|
(** Configuration for the "mirage" tool. *)
|
|
|
|
open Mirage
|
|
|
|
let table_size =
|
|
let open Functoria_key in
|
|
let info = Arg.info
|
|
~doc:"The number of NAT entries to allocate."
|
|
~docv:"ENTRIES" ["nat-table-size"]
|
|
in
|
|
let key = Arg.opt ~stage:`Both Arg.int 5_000 info in
|
|
create "nat_table_size" key
|
|
|
|
let main =
|
|
foreign
|
|
~keys:[Functoria_key.abstract table_size]
|
|
~packages:[
|
|
package "vchan" ~min:"4.0.2";
|
|
package "cstruct";
|
|
package "astring";
|
|
package "tcpip" ~min:"3.7.0";
|
|
package "arp";
|
|
package "arp-mirage";
|
|
package "ethernet";
|
|
package "mirage-protocols";
|
|
package "shared-memory-ring" ~min:"3.0.0";
|
|
package "netchannel" ~min:"1.11.0" ~pin:"git+https://github.com/mirage/mirage-net-xen.git";
|
|
package "mirage-net-xen";
|
|
package "ipaddr" ~min:"3.0.0";
|
|
package "mirage-qubes";
|
|
package "mirage-nat" ~min:"1.2.0";
|
|
package "mirage-logs";
|
|
]
|
|
"Unikernel.Main" (mclock @-> job)
|
|
|
|
let () =
|
|
register "qubes-firewall" [main $ default_monotonic_clock]
|
|
~argv:no_argv
|