From: Anthony Liguori <anthony@codemonkey.ws>
To: qemu-devel@nongnu.org
Subject: [Qemu-devel] [6241] Add slirp_restrict option (Gleb Natapov)
Date: Thu, 08 Jan 2009 19:24:01 +0000 [thread overview]
Message-ID: <E1LL0U4-0006F6-Us@cvs.savannah.gnu.org> (raw)
Revision: 6241
http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6241
Author: aliguori
Date: 2009-01-08 19:24:00 +0000 (Thu, 08 Jan 2009)
Log Message:
-----------
Add slirp_restrict option (Gleb Natapov)
Add "slirp firewall" to permit connection only to vmchannel addresses.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Modified Paths:
--------------
trunk/net.c
trunk/slirp/bootp.c
trunk/slirp/ip_input.c
trunk/slirp/libslirp.h
trunk/slirp/main.h
trunk/slirp/slirp.c
trunk/slirp/tcp_input.c
trunk/slirp/udp.c
Modified: trunk/net.c
===================================================================
--- trunk/net.c 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/net.c 2009-01-08 19:24:00 UTC (rev 6241)
@@ -483,7 +483,7 @@
{
if (!slirp_inited) {
slirp_inited = 1;
- slirp_init();
+ slirp_init(0, NULL);
}
slirp_vc = qemu_new_vlan_client(vlan, model, name,
slirp_receive, NULL, NULL);
@@ -501,7 +501,7 @@
if (!slirp_inited) {
slirp_inited = 1;
- slirp_init();
+ slirp_init(0, NULL);
}
p = redir_str;
@@ -587,7 +587,7 @@
if (!slirp_inited) {
slirp_inited = 1;
- slirp_init();
+ slirp_init(0, NULL);
}
/* XXX: better tmp dir construction */
Modified: trunk/slirp/bootp.c
===================================================================
--- trunk/slirp/bootp.c 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/bootp.c 2009-01-08 19:24:00 UTC (rev 6241)
@@ -219,16 +219,18 @@
*q++ = 0xff;
*q++ = 0x00;
- *q++ = RFC1533_GATEWAY;
- *q++ = 4;
- memcpy(q, &saddr.sin_addr, 4);
- q += 4;
+ if (!slirp_restrict) {
+ *q++ = RFC1533_GATEWAY;
+ *q++ = 4;
+ memcpy(q, &saddr.sin_addr, 4);
+ q += 4;
- *q++ = RFC1533_DNS;
- *q++ = 4;
- dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS);
- memcpy(q, &dns_addr, 4);
- q += 4;
+ *q++ = RFC1533_DNS;
+ *q++ = 4;
+ dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS);
+ memcpy(q, &dns_addr, 4);
+ q += 4;
+ }
*q++ = RFC2132_LEASE_TIME;
*q++ = 4;
Modified: trunk/slirp/ip_input.c
===================================================================
--- trunk/slirp/ip_input.c 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/ip_input.c 2009-01-08 19:24:00 UTC (rev 6241)
@@ -136,6 +136,27 @@
STAT(ipstat.ips_tooshort++);
goto bad;
}
+
+ if (slirp_restrict) {
+ if (memcmp(&ip->ip_dst.s_addr, &special_addr, 3)) {
+ if (ip->ip_dst.s_addr == 0xffffffff && ip->ip_p != IPPROTO_UDP)
+ goto bad;
+ } else {
+ int host = ntohl(ip->ip_dst.s_addr) & 0xff;
+ struct ex_list *ex_ptr;
+
+ if (host == 0xff)
+ goto bad;
+
+ for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
+ if (ex_ptr->ex_addr == host)
+ break;
+
+ if (!ex_ptr)
+ goto bad;
+ }
+ }
+
/* Should drop packet if mbuf too long? hmmm... */
if (m->m_len > ip->ip_len)
m_adj(m, ip->ip_len - m->m_len);
Modified: trunk/slirp/libslirp.h
===================================================================
--- trunk/slirp/libslirp.h 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/libslirp.h 2009-01-08 19:24:00 UTC (rev 6241)
@@ -5,7 +5,7 @@
extern "C" {
#endif
-void slirp_init(void);
+void slirp_init(int restrict, char *special_ip);
void slirp_select_fill(int *pnfds,
fd_set *readfds, fd_set *writefds, fd_set *xfds);
Modified: trunk/slirp/main.h
===================================================================
--- trunk/slirp/main.h 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/main.h 2009-01-08 19:24:00 UTC (rev 6241)
@@ -44,6 +44,8 @@
extern int ppp_exit;
extern int tcp_keepintvl;
extern uint8_t client_ethaddr[6];
+extern char *slirp_special_ip;
+extern int slirp_restrict;
#define PROTO_SLIP 0x1
#ifdef USE_PPP
Modified: trunk/slirp/slirp.c
===================================================================
--- trunk/slirp/slirp.c 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/slirp.c 2009-01-08 19:24:00 UTC (rev 6241)
@@ -46,6 +46,8 @@
static const uint8_t zero_ethaddr[6] = { 0, 0, 0, 0, 0, 0 };
+char *slirp_special_ip = CTL_SPECIAL;
+int slirp_restrict;
int do_slowtimo;
int link_up;
struct timeval tt;
@@ -164,7 +166,7 @@
}
#endif
-void slirp_init(void)
+void slirp_init(int restrict, char *special_ip)
{
// debug_init("/tmp/slirp.log", DEBUG_DEFAULT);
@@ -177,6 +179,7 @@
#endif
link_up = 1;
+ slirp_restrict = restrict;
if_init();
ip_init();
@@ -192,7 +195,10 @@
fprintf (stderr, "Warning: No DNS servers found\n");
}
- inet_aton(CTL_SPECIAL, &special_addr);
+ if (special_ip)
+ slirp_special_ip = special_ip;
+
+ inet_aton(slirp_special_ip, &special_addr);
alias_addr.s_addr = special_addr.s_addr | htonl(CTL_ALIAS);
getouraddr();
}
Modified: trunk/slirp/tcp_input.c
===================================================================
--- trunk/slirp/tcp_input.c 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/tcp_input.c 2009-01-08 19:24:00 UTC (rev 6241)
@@ -253,6 +253,7 @@
u_long tiwin;
int ret;
/* int ts_present = 0; */
+ struct ex_list *ex_ptr;
DEBUG_CALL("tcp_input");
DEBUG_ARGS((dfd," m = %8lx iphlen = %2d inso = %lx\n",
@@ -363,6 +364,15 @@
m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
+ if (slirp_restrict) {
+ for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
+ if (ex_ptr->ex_fport == ti->ti_dport &&
+ (ntohl(ti->ti_dst.s_addr) & 0xff) == ex_ptr->ex_addr)
+ break;
+
+ if (!ex_ptr)
+ goto drop;
+ }
/*
* Locate pcb for segment.
*/
@@ -646,7 +656,6 @@
#endif
{
/* May be an add exec */
- struct ex_list *ex_ptr;
for(ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
if(ex_ptr->ex_fport == so->so_fport &&
lastbyte == ex_ptr->ex_addr) {
Modified: trunk/slirp/udp.c
===================================================================
--- trunk/slirp/udp.c 2009-01-08 19:18:21 UTC (rev 6240)
+++ trunk/slirp/udp.c 2009-01-08 19:24:00 UTC (rev 6241)
@@ -158,6 +158,9 @@
goto bad;
}
+ if (slirp_restrict)
+ goto bad;
+
/*
* handle TFTP
*/
reply other threads:[~2009-01-08 19:24 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=E1LL0U4-0006F6-Us@cvs.savannah.gnu.org \
--to=anthony@codemonkey.ws \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).