]>
git.proxmox.com Git - qemu.git/blob - qemu-bridge-helper.c
4 * Copyright IBM, Corp. 2011
7 * Anthony Liguori <aliguori@us.ibm.com>
8 * Richa Marwaha <rmarwah@linux.vnet.ibm.com>
9 * Corey Bryant <coreyb@linux.vnet.ibm.com>
11 * This work is licensed under the terms of the GNU GPL, version 2. See
12 * the COPYING file in the top-level directory.
16 #include "config-host.h"
28 #include <sys/types.h>
29 #include <sys/ioctl.h>
30 #include <sys/socket.h>
32 #include <sys/prctl.h>
36 #include <linux/sockios.h>
38 #include "qemu-queue.h"
40 #include "net/tap-linux.h"
42 #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
51 typedef struct ACLRule
{
54 QSIMPLEQ_ENTRY(ACLRule
) entry
;
57 typedef QSIMPLEQ_HEAD(ACLList
, ACLRule
) ACLList
;
59 static void usage(void)
62 "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n");
65 static int parse_acl_file(const char *filename
, ACLList
*acl_list
)
71 f
= fopen(filename
, "r");
76 while (fgets(line
, sizeof(line
), f
) != NULL
) {
78 char *cmd
, *arg
, *argend
;
80 while (isspace(*ptr
)) {
84 /* skip comments and empty lines */
85 if (*ptr
== '#' || *ptr
== 0) {
90 arg
= strchr(cmd
, ' ');
92 arg
= strchr(cmd
, '\t');
96 fprintf(stderr
, "Invalid config line:\n %s\n", line
);
104 while (isspace(*arg
)) {
108 argend
= arg
+ strlen(arg
);
109 while (arg
!= argend
&& isspace(*(argend
- 1))) {
114 if (strcmp(cmd
, "deny") == 0) {
115 acl_rule
= g_malloc(sizeof(*acl_rule
));
116 if (strcmp(arg
, "all") == 0) {
117 acl_rule
->type
= ACL_DENY_ALL
;
119 acl_rule
->type
= ACL_DENY
;
120 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
122 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
123 } else if (strcmp(cmd
, "allow") == 0) {
124 acl_rule
= g_malloc(sizeof(*acl_rule
));
125 if (strcmp(arg
, "all") == 0) {
126 acl_rule
->type
= ACL_ALLOW_ALL
;
128 acl_rule
->type
= ACL_ALLOW
;
129 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
131 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
132 } else if (strcmp(cmd
, "include") == 0) {
134 parse_acl_file(arg
, acl_list
);
136 fprintf(stderr
, "Unknown command `%s'\n", cmd
);
148 static bool has_vnet_hdr(int fd
)
150 unsigned int features
= 0;
152 if (ioctl(fd
, TUNGETFEATURES
, &features
) == -1) {
156 if (!(features
& IFF_VNET_HDR
)) {
163 static void prep_ifreq(struct ifreq
*ifr
, const char *ifname
)
165 memset(ifr
, 0, sizeof(*ifr
));
166 snprintf(ifr
->ifr_name
, IFNAMSIZ
, "%s", ifname
);
169 static int send_fd(int c
, int fd
)
171 char msgbuf
[CMSG_SPACE(sizeof(fd
))];
172 struct msghdr msg
= {
173 .msg_control
= msgbuf
,
174 .msg_controllen
= sizeof(msgbuf
),
176 struct cmsghdr
*cmsg
;
178 char req
[1] = { 0x00 };
180 cmsg
= CMSG_FIRSTHDR(&msg
);
181 cmsg
->cmsg_level
= SOL_SOCKET
;
182 cmsg
->cmsg_type
= SCM_RIGHTS
;
183 cmsg
->cmsg_len
= CMSG_LEN(sizeof(fd
));
184 msg
.msg_controllen
= cmsg
->cmsg_len
;
187 iov
.iov_len
= sizeof(req
);
191 memcpy(CMSG_DATA(cmsg
), &fd
, sizeof(fd
));
193 return sendmsg(c
, &msg
, 0);
196 int main(int argc
, char **argv
)
199 int fd
, ctlfd
, unixfd
= -1;
202 const char *bridge
= NULL
;
203 char iface
[IFNAMSIZ
];
207 int access_allowed
, access_denied
;
208 int ret
= EXIT_SUCCESS
;
210 /* parse arguments */
211 for (index
= 1; index
< argc
; index
++) {
212 if (strcmp(argv
[index
], "--use-vnet") == 0) {
214 } else if (strncmp(argv
[index
], "--br=", 5) == 0) {
215 bridge
= &argv
[index
][5];
216 } else if (strncmp(argv
[index
], "--fd=", 5) == 0) {
217 unixfd
= atoi(&argv
[index
][5]);
224 if (bridge
== NULL
|| unixfd
== -1) {
229 /* parse default acl file */
230 QSIMPLEQ_INIT(&acl_list
);
231 if (parse_acl_file(DEFAULT_ACL_FILE
, &acl_list
) == -1) {
232 fprintf(stderr
, "failed to parse default acl file `%s'\n",
238 /* validate bridge against acl -- default policy is to deny
239 * according acl policy if we have a deny and allow both
240 * then deny should always win over allow
244 QSIMPLEQ_FOREACH(acl_rule
, &acl_list
, entry
) {
245 switch (acl_rule
->type
) {
250 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
258 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
265 if ((access_allowed
== 0) || (access_denied
== 1)) {
266 fprintf(stderr
, "access denied by acl file\n");
271 /* open a socket to use to control the network interfaces */
272 ctlfd
= socket(AF_INET
, SOCK_STREAM
, 0);
274 fprintf(stderr
, "failed to open control socket: %s\n", strerror(errno
));
279 /* open the tap device */
280 fd
= open("/dev/net/tun", O_RDWR
);
282 fprintf(stderr
, "failed to open /dev/net/tun: %s\n", strerror(errno
));
287 /* request a tap device, disable PI, and add vnet header support if
288 * requested and it's available. */
289 prep_ifreq(&ifr
, "tap%d");
290 ifr
.ifr_flags
= IFF_TAP
|IFF_NO_PI
;
291 if (use_vnet
&& has_vnet_hdr(fd
)) {
292 ifr
.ifr_flags
|= IFF_VNET_HDR
;
295 if (ioctl(fd
, TUNSETIFF
, &ifr
) == -1) {
296 fprintf(stderr
, "failed to create tun device: %s\n", strerror(errno
));
301 /* save tap device name */
302 snprintf(iface
, sizeof(iface
), "%s", ifr
.ifr_name
);
304 /* get the mtu of the bridge */
305 prep_ifreq(&ifr
, bridge
);
306 if (ioctl(ctlfd
, SIOCGIFMTU
, &ifr
) == -1) {
307 fprintf(stderr
, "failed to get mtu of bridge `%s': %s\n",
308 bridge
, strerror(errno
));
316 /* set the mtu of the interface based on the bridge */
317 prep_ifreq(&ifr
, iface
);
319 if (ioctl(ctlfd
, SIOCSIFMTU
, &ifr
) == -1) {
320 fprintf(stderr
, "failed to set mtu of device `%s' to %d: %s\n",
321 iface
, mtu
, strerror(errno
));
326 /* add the interface to the bridge */
327 prep_ifreq(&ifr
, bridge
);
328 ifr
.ifr_ifindex
= if_nametoindex(iface
);
330 if (ioctl(ctlfd
, SIOCBRADDIF
, &ifr
) == -1) {
331 fprintf(stderr
, "failed to add interface `%s' to bridge `%s': %s\n",
332 iface
, bridge
, strerror(errno
));
337 /* bring the interface up */
338 prep_ifreq(&ifr
, iface
);
339 if (ioctl(ctlfd
, SIOCGIFFLAGS
, &ifr
) == -1) {
340 fprintf(stderr
, "failed to get interface flags for `%s': %s\n",
341 iface
, strerror(errno
));
346 ifr
.ifr_flags
|= IFF_UP
;
347 if (ioctl(ctlfd
, SIOCSIFFLAGS
, &ifr
) == -1) {
348 fprintf(stderr
, "failed to bring up interface `%s': %s\n",
349 iface
, strerror(errno
));
354 /* write fd to the domain socket */
355 if (send_fd(unixfd
, fd
) == -1) {
356 fprintf(stderr
, "failed to write fd to unix socket: %s\n",
368 while ((acl_rule
= QSIMPLEQ_FIRST(&acl_list
)) != NULL
) {
369 QSIMPLEQ_REMOVE_HEAD(&acl_list
, entry
);