[PATCHv2] slirp: Allow non-local DNS address when restrict is off

[PATCHv2] slirp: Allow non-local DNS address when restrict is off

[Samuel Thibault]

This can be used to set a DNS server to be used by the guest which is
different from the one configured on the host.

Buglink: https://bugs.launchpad.net/qemu/+bug/1010484
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
---
Difference from first version:
- handle DNS IPv6 as well
- reference bug with Buglink

 net/slirp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/slirp.c b/net/slirp.c
index f42f496641..c4334ee876 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -456,7 +456,7 @@ static int net_slirp_init(NetClientState *peer, const char *model,
         error_setg(errp, "Failed to parse DNS");
         return -1;
     }
-    if ((dns.s_addr & mask.s_addr) != net.s_addr) {
+    if (restricted && (dns.s_addr & mask.s_addr) != net.s_addr) {
         error_setg(errp, "DNS doesn't belong to network");
         return -1;
     }
@@ -522,7 +522,7 @@ static int net_slirp_init(NetClientState *peer, const char *model,
             error_setg(errp, "Failed to parse IPv6 DNS");
             return -1;
         }
-        if (!in6_equal_net(&ip6_prefix, &ip6_dns, vprefix6_len)) {
+        if (restricted && !in6_equal_net(&ip6_prefix, &ip6_dns, vprefix6_len)) {
             error_setg(errp, "IPv6 DNS doesn't belong to network");
             return -1;
         }
-- 
2.23.0

Re: [PATCHv2] slirp: Allow non-local DNS address when restrict is off

[Philippe Mathieu-Daudé]

On 10/1/19 5:40 PM, Samuel Thibault wrote:
> This can be used to set a DNS server to be used by the guest which is
> different from the one configured on the host.
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1010484
> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
> ---
> Difference from first version:
> - handle DNS IPv6 as well
> - reference bug with Buglink

Thanks!

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> 
>   net/slirp.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/slirp.c b/net/slirp.c
> index f42f496641..c4334ee876 100644
> --- a/net/slirp.c
> +++ b/net/slirp.c
> @@ -456,7 +456,7 @@ static int net_slirp_init(NetClientState *peer, const char *model,
>           error_setg(errp, "Failed to parse DNS");
>           return -1;
>       }
> -    if ((dns.s_addr & mask.s_addr) != net.s_addr) {
> +    if (restricted && (dns.s_addr & mask.s_addr) != net.s_addr) {
>           error_setg(errp, "DNS doesn't belong to network");
>           return -1;
>       }
> @@ -522,7 +522,7 @@ static int net_slirp_init(NetClientState *peer, const char *model,
>               error_setg(errp, "Failed to parse IPv6 DNS");
>               return -1;
>           }
> -        if (!in6_equal_net(&ip6_prefix, &ip6_dns, vprefix6_len)) {
> +        if (restricted && !in6_equal_net(&ip6_prefix, &ip6_dns, vprefix6_len)) {
>               error_setg(errp, "IPv6 DNS doesn't belong to network");
>               return -1;
>           }
> 

Re: [PATCHv2] slirp: Allow non-local DNS address when restrict is off

[Thomas Huth]

On 01/10/2019 17.40, Samuel Thibault wrote:
> This can be used to set a DNS server to be used by the guest which is
> different from the one configured on the host.
> 
> Buglink: https://bugs.launchpad.net/qemu/+bug/1010484
> Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
> ---
> Difference from first version:
> - handle DNS IPv6 as well
> - reference bug with Buglink
> 
>  net/slirp.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/slirp.c b/net/slirp.c
> index f42f496641..c4334ee876 100644
> --- a/net/slirp.c
> +++ b/net/slirp.c
> @@ -456,7 +456,7 @@ static int net_slirp_init(NetClientState *peer, const char *model,
>          error_setg(errp, "Failed to parse DNS");
>          return -1;
>      }
> -    if ((dns.s_addr & mask.s_addr) != net.s_addr) {
> +    if (restricted && (dns.s_addr & mask.s_addr) != net.s_addr) {
>          error_setg(errp, "DNS doesn't belong to network");
>          return -1;
>      }
> @@ -522,7 +522,7 @@ static int net_slirp_init(NetClientState *peer, const char *model,
>              error_setg(errp, "Failed to parse IPv6 DNS");
>              return -1;
>          }
> -        if (!in6_equal_net(&ip6_prefix, &ip6_dns, vprefix6_len)) {
> +        if (restricted && !in6_equal_net(&ip6_prefix, &ip6_dns, vprefix6_len)) {
>              error_setg(errp, "IPv6 DNS doesn't belong to network");
>              return -1;
>          }
> 

Makes sense.

Reviewed-by: Thomas Huth <thuth@redhat.com>