[Pkg-libvirt-maintainers] Bug#888175: libvirt: Enabling of MAC addressed based filtering on bridge ports breaks dhcp clients in guest vm's

[Dmitry Kulagin]

Source: libvirt
Severity: normal

Enabling of MAC addressed based filtering on bridge ports i.e setting in /etc/libvirt/qemu.conf
mac_filter = 1
breaks dhcp clients in guest vm's.
That happens because libvirt adds a rule to ebtables filter table only for outgoing packets:

# ebtables -t filter -L --Lc
Bridge table: filter

Bridge chain: INPUT, entries: 0, policy: ACCEPT

Bridge chain: FORWARD, entries: 1, policy: ACCEPT
-j libvirt_qemu_FORWARD, pcnt = 2951 -- bcnt = 334700

Bridge chain: OUTPUT, entries: 0, policy: ACCEPT

Bridge chain: libvirt_qemu_FORWARD, entries: 1, policy: DROP
-s 52:54:0:17:11:11 -i vnet0 -j ACCEPT , pcnt = 711 -- bcnt = 81576

So dhcp requests get to dhcp server but replies are filtered out, because we need another rule
to let them to get in the guest vm:
# ebtables -t filter -A libvirt_qemu_FORWARD -d 52:54:0:17:11:11 -o vnet0 -j ACCEPT

-- System Information:
Debian Release: buster/sid
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'proposed-updates'), (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.14.0-3-amd64 (SMP w/64 CPU cores)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8), LANGUAGE=ru_RU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)