]>
Commit | Line | Data |
---|---|---|
7b93fadf CB |
1 | /* |
2 | * QEMU Bridge Helper | |
3 | * | |
4 | * Copyright IBM, Corp. 2011 | |
5 | * | |
6 | * Authors: | |
7 | * Anthony Liguori <aliguori@us.ibm.com> | |
8 | * Richa Marwaha <rmarwah@linux.vnet.ibm.com> | |
9 | * Corey Bryant <coreyb@linux.vnet.ibm.com> | |
10 | * | |
11 | * This work is licensed under the terms of the GNU GPL, version 2. See | |
12 | * the COPYING file in the top-level directory. | |
13 | * | |
14 | */ | |
15 | ||
16 | #include "config-host.h" | |
17 | ||
18 | #include <stdio.h> | |
19 | #include <errno.h> | |
20 | #include <fcntl.h> | |
21 | #include <unistd.h> | |
22 | #include <string.h> | |
23 | #include <stdlib.h> | |
24 | #include <stdbool.h> | |
25 | #include <ctype.h> | |
bdef79a2 | 26 | #include <glib.h> |
7b93fadf CB |
27 | |
28 | #include <sys/types.h> | |
29 | #include <sys/ioctl.h> | |
30 | #include <sys/socket.h> | |
31 | #include <sys/un.h> | |
32 | #include <sys/prctl.h> | |
33 | ||
34 | #include <net/if.h> | |
35 | ||
36 | #include <linux/sockios.h> | |
37 | ||
bdef79a2 CB |
38 | #include "qemu-queue.h" |
39 | ||
7b93fadf CB |
40 | #include "net/tap-linux.h" |
41 | ||
bdef79a2 CB |
42 | #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf" |
43 | ||
44 | enum { | |
45 | ACL_ALLOW = 0, | |
46 | ACL_ALLOW_ALL, | |
47 | ACL_DENY, | |
48 | ACL_DENY_ALL, | |
49 | }; | |
50 | ||
51 | typedef struct ACLRule { | |
52 | int type; | |
53 | char iface[IFNAMSIZ]; | |
54 | QSIMPLEQ_ENTRY(ACLRule) entry; | |
55 | } ACLRule; | |
56 | ||
57 | typedef QSIMPLEQ_HEAD(ACLList, ACLRule) ACLList; | |
58 | ||
7b93fadf CB |
59 | static void usage(void) |
60 | { | |
61 | fprintf(stderr, | |
62 | "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n"); | |
63 | } | |
64 | ||
bdef79a2 CB |
65 | static int parse_acl_file(const char *filename, ACLList *acl_list) |
66 | { | |
67 | FILE *f; | |
68 | char line[4096]; | |
69 | ACLRule *acl_rule; | |
70 | ||
71 | f = fopen(filename, "r"); | |
72 | if (f == NULL) { | |
73 | return -1; | |
74 | } | |
75 | ||
76 | while (fgets(line, sizeof(line), f) != NULL) { | |
77 | char *ptr = line; | |
78 | char *cmd, *arg, *argend; | |
79 | ||
80 | while (isspace(*ptr)) { | |
81 | ptr++; | |
82 | } | |
83 | ||
84 | /* skip comments and empty lines */ | |
85 | if (*ptr == '#' || *ptr == 0) { | |
86 | continue; | |
87 | } | |
88 | ||
89 | cmd = ptr; | |
90 | arg = strchr(cmd, ' '); | |
91 | if (arg == NULL) { | |
92 | arg = strchr(cmd, '\t'); | |
93 | } | |
94 | ||
95 | if (arg == NULL) { | |
96 | fprintf(stderr, "Invalid config line:\n %s\n", line); | |
97 | fclose(f); | |
98 | errno = EINVAL; | |
99 | return -1; | |
100 | } | |
101 | ||
102 | *arg = 0; | |
103 | arg++; | |
104 | while (isspace(*arg)) { | |
105 | arg++; | |
106 | } | |
107 | ||
108 | argend = arg + strlen(arg); | |
109 | while (arg != argend && isspace(*(argend - 1))) { | |
110 | argend--; | |
111 | } | |
112 | *argend = 0; | |
113 | ||
114 | if (strcmp(cmd, "deny") == 0) { | |
115 | acl_rule = g_malloc(sizeof(*acl_rule)); | |
116 | if (strcmp(arg, "all") == 0) { | |
117 | acl_rule->type = ACL_DENY_ALL; | |
118 | } else { | |
119 | acl_rule->type = ACL_DENY; | |
120 | snprintf(acl_rule->iface, IFNAMSIZ, "%s", arg); | |
121 | } | |
122 | QSIMPLEQ_INSERT_TAIL(acl_list, acl_rule, entry); | |
123 | } else if (strcmp(cmd, "allow") == 0) { | |
124 | acl_rule = g_malloc(sizeof(*acl_rule)); | |
125 | if (strcmp(arg, "all") == 0) { | |
126 | acl_rule->type = ACL_ALLOW_ALL; | |
127 | } else { | |
128 | acl_rule->type = ACL_ALLOW; | |
129 | snprintf(acl_rule->iface, IFNAMSIZ, "%s", arg); | |
130 | } | |
131 | QSIMPLEQ_INSERT_TAIL(acl_list, acl_rule, entry); | |
132 | } else if (strcmp(cmd, "include") == 0) { | |
133 | /* ignore errors */ | |
134 | parse_acl_file(arg, acl_list); | |
135 | } else { | |
136 | fprintf(stderr, "Unknown command `%s'\n", cmd); | |
137 | fclose(f); | |
138 | errno = EINVAL; | |
139 | return -1; | |
140 | } | |
141 | } | |
142 | ||
143 | fclose(f); | |
144 | ||
145 | return 0; | |
146 | } | |
147 | ||
7b93fadf CB |
148 | static bool has_vnet_hdr(int fd) |
149 | { | |
150 | unsigned int features = 0; | |
151 | ||
152 | if (ioctl(fd, TUNGETFEATURES, &features) == -1) { | |
153 | return false; | |
154 | } | |
155 | ||
156 | if (!(features & IFF_VNET_HDR)) { | |
157 | return false; | |
158 | } | |
159 | ||
160 | return true; | |
161 | } | |
162 | ||
163 | static void prep_ifreq(struct ifreq *ifr, const char *ifname) | |
164 | { | |
165 | memset(ifr, 0, sizeof(*ifr)); | |
166 | snprintf(ifr->ifr_name, IFNAMSIZ, "%s", ifname); | |
167 | } | |
168 | ||
169 | static int send_fd(int c, int fd) | |
170 | { | |
171 | char msgbuf[CMSG_SPACE(sizeof(fd))]; | |
172 | struct msghdr msg = { | |
173 | .msg_control = msgbuf, | |
174 | .msg_controllen = sizeof(msgbuf), | |
175 | }; | |
176 | struct cmsghdr *cmsg; | |
177 | struct iovec iov; | |
178 | char req[1] = { 0x00 }; | |
179 | ||
180 | cmsg = CMSG_FIRSTHDR(&msg); | |
181 | cmsg->cmsg_level = SOL_SOCKET; | |
182 | cmsg->cmsg_type = SCM_RIGHTS; | |
183 | cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); | |
184 | msg.msg_controllen = cmsg->cmsg_len; | |
185 | ||
186 | iov.iov_base = req; | |
187 | iov.iov_len = sizeof(req); | |
188 | ||
189 | msg.msg_iov = &iov; | |
190 | msg.msg_iovlen = 1; | |
191 | memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); | |
192 | ||
193 | return sendmsg(c, &msg, 0); | |
194 | } | |
195 | ||
196 | int main(int argc, char **argv) | |
197 | { | |
198 | struct ifreq ifr; | |
199 | int fd, ctlfd, unixfd = -1; | |
200 | int use_vnet = 0; | |
201 | int mtu; | |
202 | const char *bridge = NULL; | |
203 | char iface[IFNAMSIZ]; | |
204 | int index; | |
bdef79a2 CB |
205 | ACLRule *acl_rule; |
206 | ACLList acl_list; | |
207 | int access_allowed, access_denied; | |
7b93fadf CB |
208 | int ret = EXIT_SUCCESS; |
209 | ||
210 | /* parse arguments */ | |
211 | for (index = 1; index < argc; index++) { | |
212 | if (strcmp(argv[index], "--use-vnet") == 0) { | |
213 | use_vnet = 1; | |
214 | } else if (strncmp(argv[index], "--br=", 5) == 0) { | |
215 | bridge = &argv[index][5]; | |
216 | } else if (strncmp(argv[index], "--fd=", 5) == 0) { | |
217 | unixfd = atoi(&argv[index][5]); | |
218 | } else { | |
219 | usage(); | |
220 | return EXIT_FAILURE; | |
221 | } | |
222 | } | |
223 | ||
224 | if (bridge == NULL || unixfd == -1) { | |
225 | usage(); | |
226 | return EXIT_FAILURE; | |
227 | } | |
228 | ||
bdef79a2 CB |
229 | /* parse default acl file */ |
230 | QSIMPLEQ_INIT(&acl_list); | |
231 | if (parse_acl_file(DEFAULT_ACL_FILE, &acl_list) == -1) { | |
232 | fprintf(stderr, "failed to parse default acl file `%s'\n", | |
233 | DEFAULT_ACL_FILE); | |
234 | ret = EXIT_FAILURE; | |
235 | goto cleanup; | |
236 | } | |
237 | ||
238 | /* validate bridge against acl -- default policy is to deny | |
239 | * according acl policy if we have a deny and allow both | |
240 | * then deny should always win over allow | |
241 | */ | |
242 | access_allowed = 0; | |
243 | access_denied = 0; | |
244 | QSIMPLEQ_FOREACH(acl_rule, &acl_list, entry) { | |
245 | switch (acl_rule->type) { | |
246 | case ACL_ALLOW_ALL: | |
247 | access_allowed = 1; | |
248 | break; | |
249 | case ACL_ALLOW: | |
250 | if (strcmp(bridge, acl_rule->iface) == 0) { | |
251 | access_allowed = 1; | |
252 | } | |
253 | break; | |
254 | case ACL_DENY_ALL: | |
255 | access_denied = 1; | |
256 | break; | |
257 | case ACL_DENY: | |
258 | if (strcmp(bridge, acl_rule->iface) == 0) { | |
259 | access_denied = 1; | |
260 | } | |
261 | break; | |
262 | } | |
263 | } | |
264 | ||
265 | if ((access_allowed == 0) || (access_denied == 1)) { | |
266 | fprintf(stderr, "access denied by acl file\n"); | |
267 | ret = EXIT_FAILURE; | |
268 | goto cleanup; | |
269 | } | |
270 | ||
7b93fadf CB |
271 | /* open a socket to use to control the network interfaces */ |
272 | ctlfd = socket(AF_INET, SOCK_STREAM, 0); | |
273 | if (ctlfd == -1) { | |
274 | fprintf(stderr, "failed to open control socket: %s\n", strerror(errno)); | |
275 | ret = EXIT_FAILURE; | |
276 | goto cleanup; | |
277 | } | |
278 | ||
279 | /* open the tap device */ | |
280 | fd = open("/dev/net/tun", O_RDWR); | |
281 | if (fd == -1) { | |
282 | fprintf(stderr, "failed to open /dev/net/tun: %s\n", strerror(errno)); | |
283 | ret = EXIT_FAILURE; | |
284 | goto cleanup; | |
285 | } | |
286 | ||
287 | /* request a tap device, disable PI, and add vnet header support if | |
288 | * requested and it's available. */ | |
289 | prep_ifreq(&ifr, "tap%d"); | |
290 | ifr.ifr_flags = IFF_TAP|IFF_NO_PI; | |
291 | if (use_vnet && has_vnet_hdr(fd)) { | |
292 | ifr.ifr_flags |= IFF_VNET_HDR; | |
293 | } | |
294 | ||
295 | if (ioctl(fd, TUNSETIFF, &ifr) == -1) { | |
296 | fprintf(stderr, "failed to create tun device: %s\n", strerror(errno)); | |
297 | ret = EXIT_FAILURE; | |
298 | goto cleanup; | |
299 | } | |
300 | ||
301 | /* save tap device name */ | |
302 | snprintf(iface, sizeof(iface), "%s", ifr.ifr_name); | |
303 | ||
304 | /* get the mtu of the bridge */ | |
305 | prep_ifreq(&ifr, bridge); | |
306 | if (ioctl(ctlfd, SIOCGIFMTU, &ifr) == -1) { | |
307 | fprintf(stderr, "failed to get mtu of bridge `%s': %s\n", | |
308 | bridge, strerror(errno)); | |
309 | ret = EXIT_FAILURE; | |
310 | goto cleanup; | |
311 | } | |
312 | ||
313 | /* save mtu */ | |
314 | mtu = ifr.ifr_mtu; | |
315 | ||
316 | /* set the mtu of the interface based on the bridge */ | |
317 | prep_ifreq(&ifr, iface); | |
318 | ifr.ifr_mtu = mtu; | |
319 | if (ioctl(ctlfd, SIOCSIFMTU, &ifr) == -1) { | |
320 | fprintf(stderr, "failed to set mtu of device `%s' to %d: %s\n", | |
321 | iface, mtu, strerror(errno)); | |
322 | ret = EXIT_FAILURE; | |
323 | goto cleanup; | |
324 | } | |
325 | ||
326 | /* add the interface to the bridge */ | |
327 | prep_ifreq(&ifr, bridge); | |
328 | ifr.ifr_ifindex = if_nametoindex(iface); | |
329 | ||
330 | if (ioctl(ctlfd, SIOCBRADDIF, &ifr) == -1) { | |
331 | fprintf(stderr, "failed to add interface `%s' to bridge `%s': %s\n", | |
332 | iface, bridge, strerror(errno)); | |
333 | ret = EXIT_FAILURE; | |
334 | goto cleanup; | |
335 | } | |
336 | ||
337 | /* bring the interface up */ | |
338 | prep_ifreq(&ifr, iface); | |
339 | if (ioctl(ctlfd, SIOCGIFFLAGS, &ifr) == -1) { | |
340 | fprintf(stderr, "failed to get interface flags for `%s': %s\n", | |
341 | iface, strerror(errno)); | |
342 | ret = EXIT_FAILURE; | |
343 | goto cleanup; | |
344 | } | |
345 | ||
346 | ifr.ifr_flags |= IFF_UP; | |
347 | if (ioctl(ctlfd, SIOCSIFFLAGS, &ifr) == -1) { | |
348 | fprintf(stderr, "failed to bring up interface `%s': %s\n", | |
349 | iface, strerror(errno)); | |
350 | ret = EXIT_FAILURE; | |
351 | goto cleanup; | |
352 | } | |
353 | ||
354 | /* write fd to the domain socket */ | |
355 | if (send_fd(unixfd, fd) == -1) { | |
356 | fprintf(stderr, "failed to write fd to unix socket: %s\n", | |
357 | strerror(errno)); | |
358 | ret = EXIT_FAILURE; | |
359 | goto cleanup; | |
360 | } | |
361 | ||
362 | /* ... */ | |
363 | ||
364 | /* profit! */ | |
365 | ||
366 | cleanup: | |
367 | ||
bdef79a2 CB |
368 | while ((acl_rule = QSIMPLEQ_FIRST(&acl_list)) != NULL) { |
369 | QSIMPLEQ_REMOVE_HEAD(&acl_list, entry); | |
370 | g_free(acl_rule); | |
371 | } | |
372 | ||
7b93fadf CB |
373 | return ret; |
374 | } |