* [Qemu-devel] [PATCH] make user networking hostfwd work with restrict=y
@ 2011-11-11 11:58 Gertjan Halkes
2011-11-11 14:24 ` Anthony Liguori
0 siblings, 1 reply; 4+ messages in thread
From: Gertjan Halkes @ 2011-11-11 11:58 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-trivial
This patch allows the hostfwd option to override the restrict=y setting in
the user network stack, as explicitly stated in the documentation on the
restrict option:
restrict=on|off
If this option is enabled, the guest will be isolated, i.e. it
will not be able to contact the host and no guest IP packets
will be routed over the host to the outside. This option does
not affect any explicitly set forwarding rules.
Qemu bug tracker:
https://bugs.launchpad.net/qemu/+bug/829455
diff -aur qemu-kvm-0.15.0+noroms/slirp/tcp_input.c qemu-kvm-0.15.0+noromsnew/slirp/tcp_input.c
--- qemu-kvm-0.15.0+noroms/slirp/tcp_input.c 2011-08-09 14:40:29.000000000 +0200
+++ qemu-kvm-0.15.0+noromsnew/slirp/tcp_input.c 2011-11-11 12:42:31.000000000 +0100
@@ -316,16 +316,6 @@
m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
- if (slirp->restricted) {
- for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
- if (ex_ptr->ex_fport == ti->ti_dport &&
- ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
- break;
- }
- }
- if (!ex_ptr)
- goto drop;
- }
/*
* Locate pcb for segment.
*/
@@ -354,7 +344,23 @@
* the only flag set, then create a session, mark it
* as if it was LISTENING, and continue...
*/
- if (so == NULL) {
+ if (so == NULL) {
+ if (slirp->restricted) {
+ /* Any hostfwds will have an existing socket, so we only get here
+ * for non-hostfwd connections. These should be dropped, unless it
+ * happens to be a guestfwd.
+ */
+ for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
+ if (ex_ptr->ex_fport == ti->ti_dport &&
+ ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
+ break;
+ }
+ }
+ if (!ex_ptr) {
+ goto dropwithreset;
+ }
+ }
+
if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
goto dropwithreset;
Signed-off-by: Gertjan Halkes <qemu@ghalkes.nl>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] make user networking hostfwd work with restrict=y
2011-11-11 11:58 [Qemu-devel] [PATCH] make user networking hostfwd work with restrict=y Gertjan Halkes
@ 2011-11-11 14:24 ` Anthony Liguori
2011-11-11 15:04 ` Gertjan Halkes
0 siblings, 1 reply; 4+ messages in thread
From: Anthony Liguori @ 2011-11-11 14:24 UTC (permalink / raw)
To: Gertjan Halkes; +Cc: qemu-trivial, qemu-devel
On 11/11/2011 05:58 AM, Gertjan Halkes wrote:
> This patch allows the hostfwd option to override the restrict=y setting in
> the user network stack, as explicitly stated in the documentation on the
> restrict option:
>
> restrict=on|off
> If this option is enabled, the guest will be isolated, i.e. it
> will not be able to contact the host and no guest IP packets
> will be routed over the host to the outside. This option does
> not affect any explicitly set forwarding rules.
>
> Qemu bug tracker:
> https://bugs.launchpad.net/qemu/+bug/829455
Please submit against qemu.git master with a Signed-off-by.
Regards,
Anthony Liguori
>
> diff -aur qemu-kvm-0.15.0+noroms/slirp/tcp_input.c qemu-kvm-0.15.0+noromsnew/slirp/tcp_input.c
> --- qemu-kvm-0.15.0+noroms/slirp/tcp_input.c 2011-08-09 14:40:29.000000000 +0200
> +++ qemu-kvm-0.15.0+noromsnew/slirp/tcp_input.c 2011-11-11 12:42:31.000000000 +0100
> @@ -316,16 +316,6 @@
> m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
> m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
>
> - if (slirp->restricted) {
> - for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
> - if (ex_ptr->ex_fport == ti->ti_dport&&
> - ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
> - break;
> - }
> - }
> - if (!ex_ptr)
> - goto drop;
> - }
> /*
> * Locate pcb for segment.
> */
> @@ -354,7 +344,23 @@
> * the only flag set, then create a session, mark it
> * as if it was LISTENING, and continue...
> */
> - if (so == NULL) {
> + if (so == NULL) {
> + if (slirp->restricted) {
> + /* Any hostfwds will have an existing socket, so we only get here
> + * for non-hostfwd connections. These should be dropped, unless it
> + * happens to be a guestfwd.
> + */
> + for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
> + if (ex_ptr->ex_fport == ti->ti_dport&&
> + ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
> + break;
> + }
> + }
> + if (!ex_ptr) {
> + goto dropwithreset;
> + }
> + }
> +
> if ((tiflags& (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
> goto dropwithreset;
>
> Signed-off-by: Gertjan Halkes<qemu@ghalkes.nl>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [PATCH] make user networking hostfwd work with restrict=y
2011-11-11 14:24 ` Anthony Liguori
@ 2011-11-11 15:04 ` Gertjan Halkes
2011-11-14 13:56 ` [Qemu-devel] [Qemu-trivial] " Stefan Hajnoczi
0 siblings, 1 reply; 4+ messages in thread
From: Gertjan Halkes @ 2011-11-11 15:04 UTC (permalink / raw)
To: Anthony Liguori; +Cc: qemu-trivial, qemu-devel
On Fri, 11 Nov 2011 08:24:04 -0600, Anthony Liguori <anthony@codemonkey.ws>
wrote:
>Please submit against qemu.git master with a Signed-off-by.
Ok, here goes:
This patch allows the hostfwd option to override the restrict=y setting in
the user network stack, as explicitly stated in the documentation on the
restrict option:
restrict=on|off
If this option is enabled, the guest will be isolated, i.e. it
will not be able to contact the host and no guest IP packets
will be routed over the host to the outside. This option does
not affect any explicitly set forwarding rules.
Qemu bug tracker:
https://bugs.launchpad.net/qemu/+bug/829455
Signed-off-by: Gertjan Halkes <qemu@ghalkes.nl>
---
slirp/tcp_input.c | 28 +++++++++++++++++-----------
1 files changed, 17 insertions(+), 11 deletions(-)
diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c
index 942aaf4..ed09c27 100644
--- a/slirp/tcp_input.c
+++ b/slirp/tcp_input.c
@@ -316,16 +316,6 @@ tcp_input(struct mbuf *m, int iphlen, struct socket *inso)
m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
- if (slirp->restricted) {
- for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
- if (ex_ptr->ex_fport == ti->ti_dport &&
- ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
- break;
- }
- }
- if (!ex_ptr)
- goto drop;
- }
/*
* Locate pcb for segment.
*/
@@ -354,7 +344,23 @@ findso:
* the only flag set, then create a session, mark it
* as if it was LISTENING, and continue...
*/
- if (so == NULL) {
+ if (so == NULL) {
+ if (slirp->restricted) {
+ /* Any hostfwds will have an existing socket, so we only get here
+ * for non-hostfwd connections. These should be dropped, unless it
+ * happens to be a guestfwd.
+ */
+ for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
+ if (ex_ptr->ex_fport == ti->ti_dport &&
+ ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
+ break;
+ }
+ }
+ if (!ex_ptr) {
+ goto dropwithreset;
+ }
+ }
+
if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
goto dropwithreset;
--
1.7.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [Qemu-devel] [Qemu-trivial] [PATCH] make user networking hostfwd work with restrict=y
2011-11-11 15:04 ` Gertjan Halkes
@ 2011-11-14 13:56 ` Stefan Hajnoczi
0 siblings, 0 replies; 4+ messages in thread
From: Stefan Hajnoczi @ 2011-11-14 13:56 UTC (permalink / raw)
To: Jan Kiszka; +Cc: qemu-trivial, Gertjan Halkes, qemu-devel
On Fri, Nov 11, 2011 at 3:04 PM, Gertjan Halkes <qemu@ghalkes.nl> wrote:
> On Fri, 11 Nov 2011 08:24:04 -0600, Anthony Liguori <anthony@codemonkey.ws>
> wrote:
>
>>Please submit against qemu.git master with a Signed-off-by.
>
> Ok, here goes:
>
> This patch allows the hostfwd option to override the restrict=y setting in
> the user network stack, as explicitly stated in the documentation on the
> restrict option:
>
> restrict=on|off
> If this option is enabled, the guest will be isolated, i.e. it
> will not be able to contact the host and no guest IP packets
> will be routed over the host to the outside. This option does
> not affect any explicitly set forwarding rules.
>
> Qemu bug tracker:
> https://bugs.launchpad.net/qemu/+bug/829455
>
> Signed-off-by: Gertjan Halkes <qemu@ghalkes.nl>
> ---
> slirp/tcp_input.c | 28 +++++++++++++++++-----------
> 1 files changed, 17 insertions(+), 11 deletions(-)
Jan: Want to take a look at this as SLIRP maintainer?
> diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c
> index 942aaf4..ed09c27 100644
> --- a/slirp/tcp_input.c
> +++ b/slirp/tcp_input.c
> @@ -316,16 +316,6 @@ tcp_input(struct mbuf *m, int iphlen, struct socket *inso)
> m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
> m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
>
> - if (slirp->restricted) {
> - for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
> - if (ex_ptr->ex_fport == ti->ti_dport &&
> - ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
> - break;
> - }
> - }
> - if (!ex_ptr)
> - goto drop;
> - }
> /*
> * Locate pcb for segment.
> */
> @@ -354,7 +344,23 @@ findso:
> * the only flag set, then create a session, mark it
> * as if it was LISTENING, and continue...
> */
> - if (so == NULL) {
> + if (so == NULL) {
> + if (slirp->restricted) {
> + /* Any hostfwds will have an existing socket, so we only get here
> + * for non-hostfwd connections. These should be dropped, unless it
> + * happens to be a guestfwd.
> + */
> + for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
> + if (ex_ptr->ex_fport == ti->ti_dport &&
> + ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
> + break;
> + }
> + }
> + if (!ex_ptr) {
> + goto dropwithreset;
> + }
> + }
> +
> if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
> goto dropwithreset;
>
> --
> 1.7.1
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-11-14 13:57 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-11 11:58 [Qemu-devel] [PATCH] make user networking hostfwd work with restrict=y Gertjan Halkes
2011-11-11 14:24 ` Anthony Liguori
2011-11-11 15:04 ` Gertjan Halkes
2011-11-14 13:56 ` [Qemu-devel] [Qemu-trivial] " Stefan Hajnoczi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).