From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:55743) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q9gbR-0007kx-8X for qemu-devel@nongnu.org; Tue, 12 Apr 2011 12:38:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Q9gbQ-0001uD-3g for qemu-devel@nongnu.org; Tue, 12 Apr 2011 12:38:09 -0400 Received: from fmmailgate02.web.de ([217.72.192.227]:53692) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Q9gbP-0001tl-PO for qemu-devel@nongnu.org; Tue, 12 Apr 2011 12:38:08 -0400 Message-ID: <4DA47FEB.5070402@siemens.com> Date: Tue, 12 Apr 2011 18:38:03 +0200 From: Jan Kiszka MIME-Version: 1.0 References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: jan.kiszka@siemens.com Subject: Re: [Qemu-devel] [PATCH] Slirp reverse UDP firewall List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Daisuke Nojiri Cc: qemu-devel@nongnu.org On 2011-04-12 18:19, Daisuke Nojiri wrote: > This patch adds: -drop-udp, -allow-udp ADDR:PORT, -drop-log FILE > > e.g.) $ qemu -net user -drop-log qemu.drop -drop-udp -allow-udp > 10.0.2.3:53 No more stand-alone slirp arguments please. That syntax breaks when instantiating >1 back-ends. > > -drop-udp enables usermode firewall for out-going UDP packats from a guest. > All UDP packets except ones allowed by -allow-udp will be dropped. Dropped > packets are logged in the file specified by FILE. PORT can be a single > number > (e.g. 53) or a range (e.g. [80-81]). If ADDR is ommitted, all addresses > match > the rule. Will we see a TCP firewall as well? Can we prepare for a more generic infrastructure, or what makes UDP special? Also, please break up in smaller bits (example: logging would be a separate topic). And make sure that your patches aren't line-wrapped. Thanks, Jan -- Siemens AG, Corporate Technology, CT T DE IT 1 Corporate Competence Center Embedded Linux