Re: [OE-core] [PATCH 2/2] runqemu: limit slirp host port forwarding to localhost 127.0.0.1

Quentin Schulz
2022-11-17T13:17:23Z

Hi Mikko,

On 11/14/22 16:50, Mikko Rapeli wrote:
> With default slirp port forwarding config qemu listens on TCP ports
> 2222 and 2323 on all IP addresses available on the build host. Most
> use cases with runqemu only need it for localhost and it is not
> safe to run qemu images with root login without password enabled
> and listening on all available, possibly Internet reachable network
> interfaces. Limit qemu port forwarding to localhost 127.0.0.1 IP
> address. Now qemu machine SSH and telnet ports are only
> reachable from the build host machine, not full Internet.
>
> If qemu machine needs to be reachable from network, then it can
> be enabled via local.conf or machine config variable QB_SLIRP_OPT:
>
> QB_SLIRP_OPT = "-netdev user,id=net0,hostfwd=tcp::2222-:22"
>
> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> ---
> scripts/runqemu | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/scripts/runqemu b/scripts/runqemu
> index a6ea578564..7bd9465593 100755
> --- a/scripts/runqemu
> +++ b/scripts/runqemu
> @@ -1071,7 +1071,7 @@ class BaseConfig(object):
> logger.info("Network configuration:%s", netconf)
> self.kernel_cmdline_script += netconf
> # Port mapping
> - hostfwd = ",hostfwd=tcp::2222-:22,hostfwd=tcp::2323-:23"
> + hostfwd = ",hostfwd=tcp:127.0.0.1:2222-:22,hostfwd=tcp:127.0.0.1:2323-:23"

With the additional knowledge we gathered in the last patches, I believe
it would be a good thing to say a few words/update the documentation.

See
https://lore.kernel.org/yocto-docs/fedb4cc0-44d6-d7d8-bc26-c8de5bee06ca@theobroma-systems.com/T/#t
for a patch I believe might make it to master soon? I think we should
say what the default value entails (even if this patch isnt' taken) and
maybe point/refer to the QEMU documentation for the meaning of options
in QB_SLIRP_OPT. I believe some/all of options listed
https://www.qemu.org/docs/master/system/invocation.html are possible?

What do you think?

Cheers,
Quentin