Yes, it's the same with @xcpng as #XenServer. XenCenter and XCP-ng Center don't offer the SR-IOV network as an option for VMs. Luckily, #XenOrchestra gets that right.
While there I tested various #BSD OSes with SR-IOV and Intel i350 NICs:
#NetBSD - NIC is described (as defined in pcidevs), but no driver
#OpenBSD - NIC entirely unknown as not in pcidevs
#FreeBSD - virtual function works straight off as igb0
The #NetBSD and slightly-newer #OpenBSD iavf(8) drivers only support much newer NICs.
Well, that was annoying. I enabled SR-IOV in #XenServer and it stopped traffic to all VLANs on all interfaces. This is fair enough on the physical interface that SR-IOV is enabled on, but I wasn't expecting it to affect all NICs.
I wasted a lot of time hunting through switch and router configs to track this down.
Disabling SR-IOV isn't sufficient, each host needs to be rebooted afterwards. Let me see if I can recreate with @xcpng
XenServer VM Tools vulnerabilities let attackers gain kernel privileges on Windows VMs. If you run virtualized Windows environments, patch NOW!
#SecurityLand #CyberWatch #XenServer #CVE #VirtualizationSecurity #Windows #Vulnerability
Today I've been playing with #pkgsrc on #FreeBSD and trying to get some of my #NetBSD packages working on it.
pkgsrc bootstrap worked well on FreeBSD. Hardest part is remember you can't just type make any more!
I've been focussing on the #XenServer tools which looks to be rather stagnant in FreeBSD ports. The #pkgsrc version will work better on FreeBSD than the version from ports.
Just need to work out what to do about rc.d scripts. I can't find any prior art for rc.d from pkgsrc on FreeBSD
Pretty pleased with the speed of #zfs replication between two #NetBSD systems between our two datacentres in Cambridge:
receiving full stream of tank/[email protected]:01:01 into tank/backup/[email protected]:01:01
received 325GB stream in 3453 seconds (96.4MB/sec)
One end is virtual (a #Xen domU running on #XenServer on a host connected by 16Gb FC to an IBM FlashSystem) and the other is physical (HP Microserver Gen 10). Running over rsh on a private VLAN (so no ssh encryption overhead)
#BSI WID-SEC-2024-2209: [NEU] [mittel] #XEN, #Citrix #XenServer #und #Hypervisor: Schwachstelle ermöglicht Denial of Service
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in XEN, Citrix XenServer und Citrix Systems Hypervisor ausnutzen, um einen Denial of Service Angriff durchzuführen.
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2209
Stephen Borrill
Security Land
PUPUWEB Blog
BSI WID Advisories Feed
gyptazy