Add slirp_restrict option (Gleb Natapov)

Add "slirp firewall" to permit connection only to vmchannel addresses.

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6241 c046a42c-6fe2-441c-8c8c-71466251a162

diff --git a/net.c b/net.c
index 0a915854a64a481d3c9511a3ab551a813d43a10e..ea7e4b2ec8e2cca9238d24288a2e022d65b6dfd6 100644 (file)
--- a/net.c
+++ b/net.c
@@ -483,7 +483,7 @@ static int net_slirp_init(VLANState *vlan, const char *model, const char *name)
 {
     if (!slirp_inited) {
         slirp_inited = 1;
-        slirp_init();
+        slirp_init(0, NULL);
     }
     slirp_vc = qemu_new_vlan_client(vlan, model, name,
                                     slirp_receive, NULL, NULL);
@@ -501,7 +501,7 @@ void net_slirp_redir(const char *redir_str)
 
     if (!slirp_inited) {
         slirp_inited = 1;
-        slirp_init();
+        slirp_init(0, NULL);
     }
 
     p = redir_str;
@@ -587,7 +587,7 @@ void net_slirp_smb(const char *exported_dir)
 
     if (!slirp_inited) {
         slirp_inited = 1;
-        slirp_init();
+        slirp_init(0, NULL);
     }
 
     /* XXX: better tmp dir construction */

diff --git a/slirp/bootp.c b/slirp/bootp.c
index 750fae3d052b1516d5d7f59e9ed4d54162cb4150..bf704abf5232d88e1012996517d6abfb86fa727f 100644 (file)
--- a/slirp/bootp.c
+++ b/slirp/bootp.c
@@ -219,16 +219,18 @@ static void bootp_reply(struct bootp_t *bp)
         *q++ = 0xff;
         *q++ = 0x00;
 
-        *q++ = RFC1533_GATEWAY;
-        *q++ = 4;
-        memcpy(q, &saddr.sin_addr, 4);
-        q += 4;
-
-        *q++ = RFC1533_DNS;
-        *q++ = 4;
-        dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS);
-        memcpy(q, &dns_addr, 4);
-        q += 4;
+        if (!slirp_restrict) {
+            *q++ = RFC1533_GATEWAY;
+            *q++ = 4;
+            memcpy(q, &saddr.sin_addr, 4);
+            q += 4;
+
+            *q++ = RFC1533_DNS;
+            *q++ = 4;
+            dns_addr.s_addr = htonl(ntohl(special_addr.s_addr) | CTL_DNS);
+            memcpy(q, &dns_addr, 4);
+            q += 4;
+        }
 
         *q++ = RFC2132_LEASE_TIME;
         *q++ = 4;

diff --git a/slirp/ip_input.c b/slirp/ip_input.c
index b04684027dc379d0d54dfeb0fc7feefe1e176bb3..73cb00ea94ce4d91e8479bc3971807a6c4749649 100644 (file)
--- a/slirp/ip_input.c
+++ b/slirp/ip_input.c
@@ -136,6 +136,27 @@ ip_input(m)
                STAT(ipstat.ips_tooshort++);
                goto bad;
        }
+
+    if (slirp_restrict) {
+        if (memcmp(&ip->ip_dst.s_addr, &special_addr, 3)) {
+            if (ip->ip_dst.s_addr == 0xffffffff && ip->ip_p != IPPROTO_UDP)
+                goto bad;
+        } else {
+            int host = ntohl(ip->ip_dst.s_addr) & 0xff;
+            struct ex_list *ex_ptr;
+
+            if (host == 0xff)
+                goto bad;
+
+            for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
+                if (ex_ptr->ex_addr == host)
+                    break;
+
+            if (!ex_ptr)
+                goto bad;
+        }
+    }
+
        /* Should drop packet if mbuf too long? hmmm... */
        if (m->m_len > ip->ip_len)
           m_adj(m, ip->ip_len - m->m_len);

diff --git a/slirp/libslirp.h b/slirp/libslirp.h
index 16a817ad838b6b286380ea6c3cba5be0e1ad8cbf..6c5db54c95ed1617a3b8bd8bf7ce0deefe4bece3 100644 (file)
--- a/slirp/libslirp.h
+++ b/slirp/libslirp.h
@@ -5,7 +5,7 @@
 extern "C" {
 #endif
 
-void slirp_init(void);
+void slirp_init(int restrict, char *special_ip);
 
 void slirp_select_fill(int *pnfds,
                        fd_set *readfds, fd_set *writefds, fd_set *xfds);

diff --git a/slirp/main.h b/slirp/main.h
index 3ef29965191ccc31bd1f990f03ae8726389ddf70..b4926147d8ea1df97219eb45673f2a896b9b93af 100644 (file)
--- a/slirp/main.h
+++ b/slirp/main.h
@@ -44,6 +44,8 @@ extern int towrite_max;
 extern int ppp_exit;
 extern int tcp_keepintvl;
 extern uint8_t client_ethaddr[6];
+extern char *slirp_special_ip;
+extern int slirp_restrict;
 
 #define PROTO_SLIP 0x1
 #ifdef USE_PPP

diff --git a/slirp/slirp.c b/slirp/slirp.c
index f6f94e49bda28b0f50e33cd21e255f5298dbb9b7..ce4a1b714c9db7582c5bb46cc171925402e7e035 100644 (file)
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -46,6 +46,8 @@ static struct in_addr client_ipaddr;
 
 static const uint8_t zero_ethaddr[6] = { 0, 0, 0, 0, 0, 0 };
 
+char *slirp_special_ip = CTL_SPECIAL;
+int slirp_restrict;
 int do_slowtimo;
 int link_up;
 struct timeval tt;
@@ -164,7 +166,7 @@ static void slirp_cleanup(void)
 }
 #endif
 
-void slirp_init(void)
+void slirp_init(int restrict, char *special_ip)
 {
     //    debug_init("/tmp/slirp.log", DEBUG_DEFAULT);
 
@@ -177,6 +179,7 @@ void slirp_init(void)
 #endif
 
     link_up = 1;
+    slirp_restrict = restrict;
 
     if_init();
     ip_init();
@@ -192,7 +195,10 @@ void slirp_init(void)
         fprintf (stderr, "Warning: No DNS servers found\n");
     }
 
-    inet_aton(CTL_SPECIAL, &special_addr);
+    if (special_ip)
+        slirp_special_ip = special_ip;
+
+    inet_aton(slirp_special_ip, &special_addr);
     alias_addr.s_addr = special_addr.s_addr | htonl(CTL_ALIAS);
     getouraddr();
 }

diff --git a/slirp/tcp_input.c b/slirp/tcp_input.c
index 17a9387f041633ab51ba72859080ea2acbb28885..408875e8e86b6c66f11d7917bb2fe128ebe51bdd 100644 (file)
--- a/slirp/tcp_input.c
+++ b/slirp/tcp_input.c
@@ -253,6 +253,7 @@ tcp_input(m, iphlen, inso)
        u_long tiwin;
        int ret;
 /*     int ts_present = 0; */
+    struct ex_list *ex_ptr;
 
        DEBUG_CALL("tcp_input");
        DEBUG_ARGS((dfd," m = %8lx  iphlen = %2d  inso = %lx\n",
@@ -363,6 +364,15 @@ tcp_input(m, iphlen, inso)
        m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
        m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 
+    if (slirp_restrict) {
+        for (ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next)
+            if (ex_ptr->ex_fport == ti->ti_dport &&
+                    (ntohl(ti->ti_dst.s_addr) & 0xff) == ex_ptr->ex_addr)
+                break;
+
+        if (!ex_ptr)
+            goto drop;
+    }
        /*
         * Locate pcb for segment.
         */
@@ -646,7 +656,6 @@ findso:
 #endif
               {
                /* May be an add exec */
-               struct ex_list *ex_ptr;
                for(ex_ptr = exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
                  if(ex_ptr->ex_fport == so->so_fport &&
                     lastbyte == ex_ptr->ex_addr) {

diff --git a/slirp/udp.c b/slirp/udp.c
index 8030326ad6618a0c63365ab06f671837e168530b..ca353b7ae3e69289c2ba5cf7948ae60ecdebc231 100644 (file)
--- a/slirp/udp.c
+++ b/slirp/udp.c
@@ -158,6 +158,9 @@ udp_input(m, iphlen)
             goto bad;
         }
 
+        if (slirp_restrict)
+            goto bad;
+
         /*
          *  handle TFTP
          */