]>
git.proxmox.com Git - qemu.git/blob - qemu-bridge-helper.c
4 * Copyright IBM, Corp. 2011
7 * Anthony Liguori <aliguori@us.ibm.com>
8 * Richa Marwaha <rmarwah@linux.vnet.ibm.com>
9 * Corey Bryant <coreyb@linux.vnet.ibm.com>
11 * This work is licensed under the terms of the GNU GPL, version 2. See
12 * the COPYING file in the top-level directory.
16 #include "config-host.h"
28 #include <sys/types.h>
29 #include <sys/ioctl.h>
30 #include <sys/socket.h>
32 #include <sys/prctl.h>
36 #include <linux/sockios.h>
39 #include <linux/if_bridge.h>
42 #include "qemu/queue.h"
44 #include "net/tap-linux.h"
50 #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
59 typedef struct ACLRule
{
62 QSIMPLEQ_ENTRY(ACLRule
) entry
;
65 typedef QSIMPLEQ_HEAD(ACLList
, ACLRule
) ACLList
;
67 static void usage(void)
70 "Usage: qemu-bridge-helper [--use-vnet] --br=bridge --fd=unixfd\n");
73 static int parse_acl_file(const char *filename
, ACLList
*acl_list
)
79 f
= fopen(filename
, "r");
84 while (fgets(line
, sizeof(line
), f
) != NULL
) {
86 char *cmd
, *arg
, *argend
;
88 while (isspace(*ptr
)) {
92 /* skip comments and empty lines */
93 if (*ptr
== '#' || *ptr
== 0) {
98 arg
= strchr(cmd
, ' ');
100 arg
= strchr(cmd
, '\t');
104 fprintf(stderr
, "Invalid config line:\n %s\n", line
);
112 while (isspace(*arg
)) {
116 argend
= arg
+ strlen(arg
);
117 while (arg
!= argend
&& isspace(*(argend
- 1))) {
122 if (strcmp(cmd
, "deny") == 0) {
123 acl_rule
= g_malloc(sizeof(*acl_rule
));
124 if (strcmp(arg
, "all") == 0) {
125 acl_rule
->type
= ACL_DENY_ALL
;
127 acl_rule
->type
= ACL_DENY
;
128 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
130 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
131 } else if (strcmp(cmd
, "allow") == 0) {
132 acl_rule
= g_malloc(sizeof(*acl_rule
));
133 if (strcmp(arg
, "all") == 0) {
134 acl_rule
->type
= ACL_ALLOW_ALL
;
136 acl_rule
->type
= ACL_ALLOW
;
137 snprintf(acl_rule
->iface
, IFNAMSIZ
, "%s", arg
);
139 QSIMPLEQ_INSERT_TAIL(acl_list
, acl_rule
, entry
);
140 } else if (strcmp(cmd
, "include") == 0) {
142 parse_acl_file(arg
, acl_list
);
144 fprintf(stderr
, "Unknown command `%s'\n", cmd
);
156 static bool has_vnet_hdr(int fd
)
158 unsigned int features
= 0;
160 if (ioctl(fd
, TUNGETFEATURES
, &features
) == -1) {
164 if (!(features
& IFF_VNET_HDR
)) {
171 static void prep_ifreq(struct ifreq
*ifr
, const char *ifname
)
173 memset(ifr
, 0, sizeof(*ifr
));
174 snprintf(ifr
->ifr_name
, IFNAMSIZ
, "%s", ifname
);
177 static int send_fd(int c
, int fd
)
179 char msgbuf
[CMSG_SPACE(sizeof(fd
))];
180 struct msghdr msg
= {
181 .msg_control
= msgbuf
,
182 .msg_controllen
= sizeof(msgbuf
),
184 struct cmsghdr
*cmsg
;
186 char req
[1] = { 0x00 };
188 cmsg
= CMSG_FIRSTHDR(&msg
);
189 cmsg
->cmsg_level
= SOL_SOCKET
;
190 cmsg
->cmsg_type
= SCM_RIGHTS
;
191 cmsg
->cmsg_len
= CMSG_LEN(sizeof(fd
));
192 msg
.msg_controllen
= cmsg
->cmsg_len
;
195 iov
.iov_len
= sizeof(req
);
199 memcpy(CMSG_DATA(cmsg
), &fd
, sizeof(fd
));
201 return sendmsg(c
, &msg
, 0);
205 static int drop_privileges(void)
207 /* clear all capabilities */
208 capng_clear(CAPNG_SELECT_BOTH
);
210 if (capng_update(CAPNG_ADD
, CAPNG_EFFECTIVE
| CAPNG_PERMITTED
,
211 CAP_NET_ADMIN
) < 0) {
215 /* change to calling user's real uid and gid, retaining supplemental
216 * groups and CAP_NET_ADMIN */
217 if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING
)) {
225 int main(int argc
, char **argv
)
229 unsigned long ifargs
[4];
232 int fd
, ctlfd
, unixfd
= -1;
235 const char *bridge
= NULL
;
236 char iface
[IFNAMSIZ
];
240 int access_allowed
, access_denied
;
241 int ret
= EXIT_SUCCESS
;
244 /* if we're run from an suid binary, immediately drop privileges preserving
246 if (geteuid() == 0 && getuid() != geteuid()) {
247 if (drop_privileges() == -1) {
248 fprintf(stderr
, "failed to drop privileges\n");
254 /* parse arguments */
255 for (index
= 1; index
< argc
; index
++) {
256 if (strcmp(argv
[index
], "--use-vnet") == 0) {
258 } else if (strncmp(argv
[index
], "--br=", 5) == 0) {
259 bridge
= &argv
[index
][5];
260 } else if (strncmp(argv
[index
], "--fd=", 5) == 0) {
261 unixfd
= atoi(&argv
[index
][5]);
268 if (bridge
== NULL
|| unixfd
== -1) {
273 /* parse default acl file */
274 QSIMPLEQ_INIT(&acl_list
);
275 if (parse_acl_file(DEFAULT_ACL_FILE
, &acl_list
) == -1) {
276 fprintf(stderr
, "failed to parse default acl file `%s'\n",
282 /* validate bridge against acl -- default policy is to deny
283 * according acl policy if we have a deny and allow both
284 * then deny should always win over allow
288 QSIMPLEQ_FOREACH(acl_rule
, &acl_list
, entry
) {
289 switch (acl_rule
->type
) {
294 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
302 if (strcmp(bridge
, acl_rule
->iface
) == 0) {
309 if ((access_allowed
== 0) || (access_denied
== 1)) {
310 fprintf(stderr
, "access denied by acl file\n");
315 /* open a socket to use to control the network interfaces */
316 ctlfd
= socket(AF_INET
, SOCK_STREAM
, 0);
318 fprintf(stderr
, "failed to open control socket: %s\n", strerror(errno
));
323 /* open the tap device */
324 fd
= open("/dev/net/tun", O_RDWR
);
326 fprintf(stderr
, "failed to open /dev/net/tun: %s\n", strerror(errno
));
331 /* request a tap device, disable PI, and add vnet header support if
332 * requested and it's available. */
333 prep_ifreq(&ifr
, "tap%d");
334 ifr
.ifr_flags
= IFF_TAP
|IFF_NO_PI
;
335 if (use_vnet
&& has_vnet_hdr(fd
)) {
336 ifr
.ifr_flags
|= IFF_VNET_HDR
;
339 if (ioctl(fd
, TUNSETIFF
, &ifr
) == -1) {
340 fprintf(stderr
, "failed to create tun device: %s\n", strerror(errno
));
345 /* save tap device name */
346 snprintf(iface
, sizeof(iface
), "%s", ifr
.ifr_name
);
348 /* get the mtu of the bridge */
349 prep_ifreq(&ifr
, bridge
);
350 if (ioctl(ctlfd
, SIOCGIFMTU
, &ifr
) == -1) {
351 fprintf(stderr
, "failed to get mtu of bridge `%s': %s\n",
352 bridge
, strerror(errno
));
360 /* set the mtu of the interface based on the bridge */
361 prep_ifreq(&ifr
, iface
);
363 if (ioctl(ctlfd
, SIOCSIFMTU
, &ifr
) == -1) {
364 fprintf(stderr
, "failed to set mtu of device `%s' to %d: %s\n",
365 iface
, mtu
, strerror(errno
));
370 /* add the interface to the bridge */
371 prep_ifreq(&ifr
, bridge
);
372 ifindex
= if_nametoindex(iface
);
374 ifargs
[0] = BRCTL_ADD_IF
;
378 ifr
.ifr_data
= (void *)ifargs
;
379 ret
= ioctl(ctlfd
, SIOCDEVPRIVATE
, &ifr
);
381 ifr
.ifr_ifindex
= ifindex
;
382 ret
= ioctl(ctlfd
, SIOCBRADDIF
, &ifr
);
385 fprintf(stderr
, "failed to add interface `%s' to bridge `%s': %s\n",
386 iface
, bridge
, strerror(errno
));
391 /* bring the interface up */
392 prep_ifreq(&ifr
, iface
);
393 if (ioctl(ctlfd
, SIOCGIFFLAGS
, &ifr
) == -1) {
394 fprintf(stderr
, "failed to get interface flags for `%s': %s\n",
395 iface
, strerror(errno
));
400 ifr
.ifr_flags
|= IFF_UP
;
401 if (ioctl(ctlfd
, SIOCSIFFLAGS
, &ifr
) == -1) {
402 fprintf(stderr
, "failed to bring up interface `%s': %s\n",
403 iface
, strerror(errno
));
408 /* write fd to the domain socket */
409 if (send_fd(unixfd
, fd
) == -1) {
410 fprintf(stderr
, "failed to write fd to unix socket: %s\n",
422 while ((acl_rule
= QSIMPLEQ_FIRST(&acl_list
)) != NULL
) {
423 QSIMPLEQ_REMOVE_HEAD(&acl_list
, entry
);