mirror of
https://github.com/mirage/qubes-mirage-firewall.git
synced 2024-12-28 16:49:33 -05:00
0a4dd7413c
Xen appears to configure the same MAC address for both the frontend
and backend in XenStore. e.g.
[tal@dom0 ~]$ xenstore-ls /local/domain/3/backend/vif/19/0
frontend = "/local/domain/19/device/vif/0"
mac = "00:16:3e:5e:6c:00"
[...]
[tal@dom0 ~]$ xenstore-ls /local/domain/19/device/vif/0
mac = "00:16:3e:5e:6c:00"
This works if the client uses just a simple ethernet device, but fails
if it connects via a bridge. HVM domains have an associated stub domain
running qemu, which provides an emulated network device. The stub domain
uses a bridge to connect qemu's interface with eth0, and this didn't
work.
Force the use of the fixed version of mirage-net-xen, which no longer
uses XenStore to get the backend MAC, and provides a new function to get
the frontend one.
21 lines
1.1 KiB
Docker
21 lines
1.1 KiB
Docker
# Pin the base image to a specific hash for maximum reproducibility.
|
|
# It will probably still work on newer images, though, unless Debian
|
|
# changes some compiler optimisations (unlikely).
|
|
#FROM ocaml/opam2:debian-9-ocaml-4.07
|
|
FROM ocaml/opam2@sha256:f7125924dd6632099ff98b2505536fe5f5c36bf0beb24779431bb62be5748562
|
|
|
|
# Pin last known-good version for reproducible builds.
|
|
# Remove this line (and the base image pin above) if you want to test with the
|
|
# latest versions.
|
|
RUN git fetch origin && git reset --hard d1b2a1cbc28d43926b37e61f46fc403b48ab9c23 && opam update
|
|
|
|
RUN sudo apt-get install -y m4 libxen-dev pkg-config
|
|
RUN opam pin add -yn cmdliner 'https://github.com/talex5/cmdliner.git#repro-builds'
|
|
RUN opam install -y vchan mirage-xen-ocaml mirage-xen-minios io-page mirage-xen mirage mirage-nat mirage-qubes
|
|
RUN mkdir /home/opam/qubes-mirage-firewall
|
|
ADD config.ml /home/opam/qubes-mirage-firewall/config.ml
|
|
WORKDIR /home/opam/qubes-mirage-firewall
|
|
RUN opam config exec -- mirage configure -t xen && make depend
|
|
CMD opam config exec -- mirage configure -t xen && \
|
|
opam config exec -- make tar
|