From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LKrb6-0005gN-3P for qemu-devel@nongnu.org; Thu, 08 Jan 2009 04:54:40 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LKrb4-0005fT-OD for qemu-devel@nongnu.org; Thu, 08 Jan 2009 04:54:39 -0500 Received: from [199.232.76.173] (port=36620 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LKrb4-0005fH-G7 for qemu-devel@nongnu.org; Thu, 08 Jan 2009 04:54:38 -0500 Received: from mx2.redhat.com ([66.187.237.31]:36487) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LKrb3-0007XT-Ql for qemu-devel@nongnu.org; Thu, 08 Jan 2009 04:54:38 -0500 Received: from int-mx2.corp.redhat.com (int-mx2.corp.redhat.com [172.16.27.26]) by mx2.redhat.com (8.13.8/8.13.8) with ESMTP id n089sbtH003191 for ; Thu, 8 Jan 2009 04:54:37 -0500 Received: from ns3.rdu.redhat.com (ns3.rdu.redhat.com [10.11.255.199]) by int-mx2.corp.redhat.com (8.13.1/8.13.1) with ESMTP id n089sb30030107 for ; Thu, 8 Jan 2009 04:54:37 -0500 Received: from dhcp-1-237.tlv.redhat.com (dhcp-1-237.tlv.redhat.com [10.35.1.237]) by ns3.rdu.redhat.com (8.13.8/8.13.8) with ESMTP id n089sa0V011538 for ; Thu, 8 Jan 2009 04:54:36 -0500 Received: from dhcp-1-237.tlv.redhat.com (localhost [127.0.0.1]) by dhcp-1-237.tlv.redhat.com (Postfix) with ESMTP id 42AB118D43A for ; Thu, 8 Jan 2009 11:55:49 +0200 (IST) From: Gleb Natapov Date: Thu, 08 Jan 2009 11:55:49 +0200 Message-ID: <20090108095549.12548.12509.stgit@dhcp-1-237.tlv.redhat.com> In-Reply-To: <20090108095533.12548.8211.stgit@dhcp-1-237.tlv.redhat.com> References: <20090108095533.12548.8211.stgit@dhcp-1-237.tlv.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Subject: [Qemu-devel] [PATCH v3 3/5] Add slirp_restrict option. Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Add "slirp firewall" to permit connection only to vmchannel addresses. Signed-off-by: Gleb Natapov --- net.c | 6 +++--- slirp/bootp.c | 22 ++++++++++++---------- slirp/ip_input.c | 21 +++++++++++++++++++++ slirp/libslirp.h | 2 +- slirp/main.h | 2 ++ slirp/slirp.c | 10 ++++++++-- slirp/tcp_input.c | 11 ++++++++++- slirp/udp.c | 3 +++ 8 files changed, 60 insertions(+), 17 deletions(-) diff --git a/net.c b/net.c index 15f9153..2399557 100644 --- a/net.c +++ b/net.c @@ -482,7 +482,7 @@ static int net_slirp_init(VLANState *vlan, const char *model, const char *name) { if (!slirp_inited) { slirp_inited = 1; - slirp_init(); + slirp_init(0, NULL); } slirp_vc = qemu_new_vlan_client(vlan, model, name, slirp_receive, NULL, NULL); @@ -500,7 +500,7 @@ void net_slirp_redir(const char *redir_str) if (!slirp_inited) { slirp_inited = 1; - slirp_init(); + slirp_init(0, NULL); } p = redir_str; @@ -586,7 +586,7 @@ void net_slirp_smb(const char *exported_dir) if (!slirp_inited) { slirp_inited = 1; - slirp_init(); + slirp_init(0, NULL); } /* XXX: better tmp dir construction */ diff --git a/slirp/bootp.c b/slirp/bootp.c index 750fae3..bf704ab 100644 --- a/slirp/bootp.c +++ b/slirp/bootp.c @@ -219,16 +219,18 @@ static void bootp_reply(struct bootp_t *bp) *q++ = 0xff; *q++ = 0x00; - *q++ = RFC1533_GATEWAY; - *q++ = 4; - memcpy(q, &saddr.sin_addr, 4); - q += 4; - - *q++ = RFC1533_DNS; - *q++ = 4; - dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS); - memcpy(q, &dns_addr, 4); - q += 4; + if (!slirp_restrict) { + *q++ = RFC1533_GATEWAY; + *q++ = 4; + memcpy(q, &saddr.sin_addr, 4); + q += 4; + + *q++ = RFC1533_DNS; + *q++ = 4; + dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS); + memcpy(q, &dns_addr, 4); + q += 4; + } *q++ = RFC2132_LEASE_TIME; *q++ = 4; diff --git a/slirp/ip_input.c b/slirp/ip_input.c index b046840..73cb00e 100644 --- a/slirp/ip_input.c +++ b/slirp/ip_input.c @@ -136,6 +136,27 @@ ip_input(m) STAT(ipstat.ips_tooshort++); goto bad; } + + if (slirp_restrict) { + if (memcmp(&ip->ip_dst.s_addr, &special_addr, 3)) { + if (ip->ip_dst.s_addr == 0xffffffff && ip->ip_p != IPPROTO_UDP) + goto bad; + } else { + int host = ntohl(ip->ip_dst.s_addr) & 0xff; + struct ex_list *ex_ptr; + + if (host == 0xff) + goto bad; + + for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) + if (ex_ptr->ex_addr == host) + break; + + if (!ex_ptr) + goto bad; + } + } + /* Should drop packet if mbuf too long? hmmm... */ if (m->m_len > ip->ip_len) m_adj(m, ip->ip_len - m->m_len); diff --git a/slirp/libslirp.h b/slirp/libslirp.h index 16a817a..6c5db54 100644 --- a/slirp/libslirp.h +++ b/slirp/libslirp.h @@ -5,7 +5,7 @@ extern "C" { #endif -void slirp_init(void); +void slirp_init(int restrict, char *special_ip); void slirp_select_fill(int *pnfds, fd_set *readfds, fd_set *writefds, fd_set *xfds); diff --git a/slirp/main.h b/slirp/main.h index 3ef2996..b492614 100644 --- a/slirp/main.h +++ b/slirp/main.h @@ -44,6 +44,8 @@ extern int towrite_max; extern int ppp_exit; extern int tcp_keepintvl; extern uint8_t client_ethaddr[6]; +extern char *slirp_special_ip; +extern int slirp_restrict; #define PROTO_SLIP 0x1 #ifdef USE_PPP diff --git a/slirp/slirp.c b/slirp/slirp.c index f6f94e4..ce4a1b7 100644 --- a/slirp/slirp.c +++ b/slirp/slirp.c @@ -46,6 +46,8 @@ static struct in_addr client_ipaddr; static const uint8_t zero_ethaddr[6] = { 0, 0, 0, 0, 0, 0 }; +char *slirp_special_ip = CTL_SPECIAL; +int slirp_restrict; int do_slowtimo; int link_up; struct timeval tt; @@ -164,7 +166,7 @@ static void slirp_cleanup(void) } #endif -void slirp_init(void) +void slirp_init(int restrict, char *special_ip) { // debug_init("/tmp/slirp.log", DEBUG_DEFAULT); @@ -177,6 +179,7 @@ void slirp_init(void) #endif link_up = 1; + slirp_restrict = restrict; if_init(); ip_init(); @@ -192,7 +195,10 @@ void slirp_init(void) fprintf (stderr, "Warning: No DNS servers found\n"); } - inet_aton(CTL_SPECIAL, &special_addr); + if (special_ip) + slirp_special_ip = special_ip; + + inet_aton(slirp_special_ip, &special_addr); alias_addr.s_addr = special_addr.s_addr | htonl(CTL_ALIAS); getouraddr(); } diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c index 17a9387..408875e 100644 --- a/slirp/tcp_input.c +++ b/slirp/tcp_input.c @@ -253,6 +253,7 @@ tcp_input(m, iphlen, inso) u_long tiwin; int ret; /* int ts_present = 0; */ + struct ex_list *ex_ptr; DEBUG_CALL("tcp_input"); DEBUG_ARGS((dfd," m = %8lx iphlen = %2d inso = %lx\n", @@ -363,6 +364,15 @@ tcp_input(m, iphlen, inso) m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); + if (slirp_restrict) { + for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) + if (ex_ptr->ex_fport == ti->ti_dport && + (ntohl(ti->ti_dst.s_addr) & 0xff) == ex_ptr->ex_addr) + break; + + if (!ex_ptr) + goto drop; + } /* * Locate pcb for segment. */ @@ -646,7 +656,6 @@ findso: #endif { /* May be an add exec */ - struct ex_list *ex_ptr; for(ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { if(ex_ptr->ex_fport == so->so_fport && lastbyte == ex_ptr->ex_addr) { diff --git a/slirp/udp.c b/slirp/udp.c index 8030326..ca353b7 100644 --- a/slirp/udp.c +++ b/slirp/udp.c @@ -158,6 +158,9 @@ udp_input(m, iphlen) goto bad; } + if (slirp_restrict) + goto bad; + /* * handle TFTP */